f61681fc45d2efd62a6d5775afca6353c30d1091
[WebKit-https.git] / Source / JavaScriptCore / ChangeLog
1 2013-02-12  Filip Pizlo  <fpizlo@apple.com>
2
3         Renamed SpecObjectMask to SpecObject.
4
5         Rubber stamped by Mark Hahnenberg.
6         
7         "SpecObjectMask" is a weird name considering that a bunch of the other speculated
8         types are also masks, but don't have "Mask" in the name.
9
10         * bytecode/SpeculatedType.h:
11         (JSC):
12         (JSC::isObjectSpeculation):
13         (JSC::isObjectOrOtherSpeculation):
14         * dfg/DFGAbstractState.cpp:
15         (JSC::DFG::AbstractState::execute):
16         * dfg/DFGPredictionPropagationPhase.cpp:
17         (JSC::DFG::PredictionPropagationPhase::propagate):
18         * dfg/DFGSpeculativeJIT.cpp:
19         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
20         * dfg/DFGSpeculativeJIT32_64.cpp:
21         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
22         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
23         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
24         * dfg/DFGSpeculativeJIT64.cpp:
25         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
26         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
27         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
28
29 2013-02-12  Filip Pizlo  <fpizlo@apple.com>
30
31         DFG CFA doesn't filter precisely enough for CompareStrictEq
32         https://bugs.webkit.org/show_bug.cgi?id=109618
33
34         Reviewed by Mark Hahnenberg.
35         
36         The backend speculates object for this case, but the CFA was filtering on
37         (SpecCell & ~SpecString) | SpecOther.
38
39         * dfg/DFGAbstractState.cpp:
40         (JSC::DFG::AbstractState::execute):
41
42 2013-02-12  Martin Robinson  <mrobinson@igalia.com>
43
44         Fix the gyp build of JavaScriptCore.
45
46         * JavaScriptCore.gypi: Added some missing DFG files to the source list.
47
48 2013-02-12  Sheriff Bot  <webkit.review.bot@gmail.com>
49
50         Unreviewed, rolling out r142387.
51         http://trac.webkit.org/changeset/142387
52         https://bugs.webkit.org/show_bug.cgi?id=109601
53
54         caused all layout and jscore tests on windows to fail
55         (Requested by kling on #webkit).
56
57         * bytecode/UnlinkedCodeBlock.cpp:
58         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
59         * bytecode/UnlinkedCodeBlock.h:
60         (UnlinkedCodeBlock):
61
62 2013-02-11  Filip Pizlo  <fpizlo@apple.com>
63
64         DFG CompareEq optimization should be retuned
65         https://bugs.webkit.org/show_bug.cgi?id=109545
66
67         Reviewed by Mark Hahnenberg.
68         
69         - Made the object-to-object equality case work again by hoisting the if statement
70           for it. Previously, object-to-object equality would be compiled as
71           object-to-object-or-other.
72         
73         - Added AbstractState guards for most of the type checks that the object equality
74           code uses.
75         
76         Looks like a hint of a speed-up on all of the things.
77
78         * dfg/DFGAbstractState.cpp:
79         (JSC::DFG::AbstractState::execute):
80         * dfg/DFGSpeculativeJIT.cpp:
81         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
82         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
83         (JSC::DFG::SpeculativeJIT::compare):
84         * dfg/DFGSpeculativeJIT32_64.cpp:
85         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
86         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
87         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
88         * dfg/DFGSpeculativeJIT64.cpp:
89         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
90         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
91         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
92
93 2013-02-12  Gabor Rapcsanyi  <rgabor@webkit.org>
94
95         JSC asserting with long parameter list functions in debug mode on ARM traditional
96         https://bugs.webkit.org/show_bug.cgi?id=109565
97
98         Reviewed by Zoltan Herczeg.
99
100         Increase the value of sequenceGetByIdSlowCaseInstructionSpace to 80.
101
102         * jit/JIT.h:
103
104 2013-02-11  Oliver Hunt  <oliver@apple.com>
105
106         Make JSC API more NULL tolerant
107         https://bugs.webkit.org/show_bug.cgi?id=109515
108
109         Reviewed by Mark Hahnenberg.
110
111         We do so much marshalling for the C API these days anyway that a single null
112         check isn't a performance issue.  Yet the existing "null is unsafe" behaviour
113         leads to crashes in embedding applications whenever there's an untested code
114         path, so it seems having defined behaviour is superior.
115
116         * API/APICast.h:
117         (toJS):
118         (toJSForGC):
119         * API/JSObjectRef.cpp:
120         (JSObjectIsFunction):
121         (JSObjectCallAsFunction):
122         (JSObjectIsConstructor):
123         (JSObjectCallAsConstructor):
124         * API/tests/testapi.c:
125         (main):
126
127 2013-02-11  Filip Pizlo  <fpizlo@apple.com>
128
129         Unreviewed, adding a FIXME to remind ourselves of a bug.
130         https://bugs.webkit.org/show_bug.cgi?id=109487
131
132         * dfg/DFGSpeculativeJIT.cpp:
133         (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
134
135 2013-02-11  Filip Pizlo  <fpizlo@apple.com>
136
137         Strange bug in DFG OSR in JSC
138         https://bugs.webkit.org/show_bug.cgi?id=109491
139
140         Reviewed by Mark Hahnenberg.
141         
142         Int32ToDouble was being injected after a side-effecting operation and before a SetLocal. Anytime we
143         inject something just before a SetLocal we should be aware that the previous operation may have been
144         a side-effect associated with the current code origin. Hence, we should use a forward exit.
145         Int32ToDouble does not do forward exits by default.
146         
147         This patch adds a forward-exiting form of Int32ToDouble, for use in SetLocal Int32ToDouble injections.
148         Changed the CSE and other things to treat these nodes identically, but for the exit strategy to be
149         distinct (Int32ToDouble -> backward, ForwardInt32ToDouble -> forward). The use of the NodeType for
150         signaling exit direction is not "great" but it's what we use in other places already (like
151         ForwardCheckStructure).
152
153         * dfg/DFGAbstractState.cpp:
154         (JSC::DFG::AbstractState::execute):
155         * dfg/DFGCSEPhase.cpp:
156         (JSC::DFG::CSEPhase::int32ToDoubleCSE):
157         (CSEPhase):
158         (JSC::DFG::CSEPhase::performNodeCSE):
159         * dfg/DFGCommon.h:
160         * dfg/DFGFixupPhase.cpp:
161         (JSC::DFG::FixupPhase::fixupNode):
162         (JSC::DFG::FixupPhase::fixDoubleEdge):
163         (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
164         * dfg/DFGNode.h:
165         (JSC::DFG::Node::willHaveCodeGenOrOSR):
166         * dfg/DFGNodeType.h:
167         (DFG):
168         * dfg/DFGPredictionPropagationPhase.cpp:
169         (JSC::DFG::PredictionPropagationPhase::propagate):
170         * dfg/DFGSpeculativeJIT.cpp:
171         (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
172         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
173         * dfg/DFGSpeculativeJIT.h:
174         * dfg/DFGSpeculativeJIT32_64.cpp:
175         (JSC::DFG::SpeculativeJIT::compile):
176         * dfg/DFGSpeculativeJIT64.cpp:
177         (JSC::DFG::SpeculativeJIT::compile):
178         * dfg/DFGVariableEventStream.cpp:
179         (JSC::DFG::VariableEventStream::reconstruct):
180
181 2013-02-11  Filip Pizlo  <fpizlo@apple.com>
182
183         NonStringCell and Object are practically the same thing for the purpose of speculation
184         https://bugs.webkit.org/show_bug.cgi?id=109492
185
186         Reviewed by Mark Hahnenberg.
187         
188         Removed isNonStringCellSpeculation, and made all callers use isObjectSpeculation.
189         
190         Changed isNonStringCellOrOtherSpeculation to be isObjectOrOtherSpeculation.
191         
192         I believe this is correct because even weird object types like JSNotAnObject end up
193         being "objects" from the standpoint of our typesystem. Anyway, the assumption that
194         "is cell but not a string" equates to "object" is an assumption that is already made
195         in other places in the system so there's little value in being paranoid about it.
196
197         * bytecode/SpeculatedType.h:
198         (JSC::isObjectSpeculation):
199         (JSC::isObjectOrOtherSpeculation):
200         * dfg/DFGAbstractState.cpp:
201         (JSC::DFG::AbstractState::execute):
202         * dfg/DFGNode.h:
203         (Node):
204         (JSC::DFG::Node::shouldSpeculateObjectOrOther):
205         * dfg/DFGSpeculativeJIT.cpp:
206         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
207         (JSC::DFG::SpeculativeJIT::compare):
208         (JSC::DFG::SpeculativeJIT::compileStrictEq):
209         * dfg/DFGSpeculativeJIT.h:
210         (SpeculativeJIT):
211         * dfg/DFGSpeculativeJIT32_64.cpp:
212         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
213         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
214         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
215         (JSC::DFG::SpeculativeJIT::emitBranch):
216         (JSC::DFG::SpeculativeJIT::compile):
217         * dfg/DFGSpeculativeJIT64.cpp:
218         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
219         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
220         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
221         (JSC::DFG::SpeculativeJIT::emitBranch):
222         (JSC::DFG::SpeculativeJIT::compile):
223
224 2013-02-10  Filip Pizlo  <fpizlo@apple.com>
225
226         DFG CompareEq(a, null) and CompareStrictEq(a, const) are unsound with respect to constant folding
227         https://bugs.webkit.org/show_bug.cgi?id=109387
228
229         Reviewed by Oliver Hunt and Mark Hahnenberg.
230         
231         Lock in the decision to use a non-speculative constant comparison as early as possible
232         and don't let the CFA change it by folding constants. This might be a performance
233         penalty on some really weird code (FWIW, I haven't seen this on benchmarks), but on
234         the other hand it completely side-steps the unsoundness that the bug speaks of.
235         
236         Rolling back in after adding 32-bit path.
237
238         * dfg/DFGAbstractState.cpp:
239         (JSC::DFG::AbstractState::execute):
240         * dfg/DFGByteCodeParser.cpp:
241         (JSC::DFG::ByteCodeParser::isConstantForCompareStrictEq):
242         (ByteCodeParser):
243         (JSC::DFG::ByteCodeParser::parseBlock):
244         * dfg/DFGCSEPhase.cpp:
245         (JSC::DFG::CSEPhase::performNodeCSE):
246         * dfg/DFGNodeType.h:
247         (DFG):
248         * dfg/DFGPredictionPropagationPhase.cpp:
249         (JSC::DFG::PredictionPropagationPhase::propagate):
250         * dfg/DFGSpeculativeJIT.cpp:
251         (JSC::DFG::SpeculativeJIT::compileStrictEq):
252         * dfg/DFGSpeculativeJIT32_64.cpp:
253         (JSC::DFG::SpeculativeJIT::compile):
254         * dfg/DFGSpeculativeJIT64.cpp:
255         (JSC::DFG::SpeculativeJIT::compile):
256
257 2013-02-10  Filip Pizlo  <fpizlo@apple.com>
258
259         DFG TypeOf implementation should have its backend code aligned to what the CFA does
260         https://bugs.webkit.org/show_bug.cgi?id=109385
261
262         Reviewed by Sam Weinig.
263         
264         The problem was that if we ended up trying to constant fold, but didn't succeed
265         because of prediction mismatches, then we would also fail to do filtration.
266         
267         Rearranged the control flow in the CFA to fix that.
268         
269         As far as I know, this is asymptomatic - it's sort of OK for the CFA to prove less
270         things, which is what the bug was.
271
272         * dfg/DFGAbstractState.cpp:
273         (JSC::DFG::AbstractState::execute):
274
275 2013-02-11  Sheriff Bot  <webkit.review.bot@gmail.com>
276
277         Unreviewed, rolling out r142491.
278         http://trac.webkit.org/changeset/142491
279         https://bugs.webkit.org/show_bug.cgi?id=109470
280
281         broke the 32 bit build (Requested by jessieberlin on #webkit).
282
283         * dfg/DFGAbstractState.cpp:
284         (JSC::DFG::AbstractState::execute):
285         * dfg/DFGByteCodeParser.cpp:
286         (JSC::DFG::ByteCodeParser::parseBlock):
287         * dfg/DFGCSEPhase.cpp:
288         (JSC::DFG::CSEPhase::performNodeCSE):
289         * dfg/DFGNodeType.h:
290         (DFG):
291         * dfg/DFGPredictionPropagationPhase.cpp:
292         (JSC::DFG::PredictionPropagationPhase::propagate):
293         * dfg/DFGSpeculativeJIT.cpp:
294         (JSC::DFG::SpeculativeJIT::compileStrictEq):
295         * dfg/DFGSpeculativeJIT64.cpp:
296         (JSC::DFG::SpeculativeJIT::compile):
297
298 2013-02-10  Filip Pizlo  <fpizlo@apple.com>
299
300         DFG CompareEq(a, null) and CompareStrictEq(a, const) are unsound with respect to constant folding
301         https://bugs.webkit.org/show_bug.cgi?id=109387
302
303         Reviewed by Oliver Hunt.
304         
305         Lock in the decision to use a non-speculative constant comparison as early as possible
306         and don't let the CFA change it by folding constants. This might be a performance
307         penalty on some really weird code (FWIW, I haven't seen this on benchmarks), but on
308         the other hand it completely side-steps the unsoundness that the bug speaks of.
309
310         * dfg/DFGAbstractState.cpp:
311         (JSC::DFG::AbstractState::execute):
312         * dfg/DFGByteCodeParser.cpp:
313         (JSC::DFG::ByteCodeParser::isConstantForCompareStrictEq):
314         (ByteCodeParser):
315         (JSC::DFG::ByteCodeParser::parseBlock):
316         * dfg/DFGCSEPhase.cpp:
317         (JSC::DFG::CSEPhase::performNodeCSE):
318         * dfg/DFGNodeType.h:
319         (DFG):
320         * dfg/DFGPredictionPropagationPhase.cpp:
321         (JSC::DFG::PredictionPropagationPhase::propagate):
322         * dfg/DFGSpeculativeJIT.cpp:
323         (JSC::DFG::SpeculativeJIT::compileStrictEq):
324         * dfg/DFGSpeculativeJIT64.cpp:
325         (JSC::DFG::SpeculativeJIT::compile):
326
327 2013-02-11  Csaba Osztrogon√°c  <ossy@webkit.org>
328
329         Unreviewed fix after r13954 for !ENABLE(JIT) builds.
330
331         * llint/LowLevelInterpreter.cpp:
332
333 2013-02-11  Gabor Rapcsanyi  <rgabor@webkit.org>
334
335         JSC build failing with verbose debug mode
336         https://bugs.webkit.org/show_bug.cgi?id=109441
337
338         Reviewed by Darin Adler.
339
340         Fixing some verbose messages which caused build errors.
341
342         * dfg/DFGAbstractState.cpp:
343         (JSC::DFG::AbstractState::mergeToSuccessors):
344         * dfg/DFGCFAPhase.cpp:
345         (JSC::DFG::CFAPhase::performBlockCFA):
346         * dfg/DFGCSEPhase.cpp:
347         (JSC::DFG::CSEPhase::setReplacement):
348         (JSC::DFG::CSEPhase::eliminate):
349         * dfg/DFGPredictionInjectionPhase.cpp:
350         (JSC::DFG::PredictionInjectionPhase::run):
351
352 2013-02-10  Martin Robinson  <mrobinson@igalia.com>
353
354         Fix the GTK+ gyp build
355
356         * JavaScriptCore.gypi: Update the source list to accurately
357         reflect what's in the repository and remove the offsets extractor
358         from the list of JavaScriptCore files. It's only used to build
359         the extractor binary.
360
361 2013-02-09  Andreas Kling  <akling@apple.com>
362
363         Shrink-wrap UnlinkedCodeBlock members.
364         <http://webkit.org/b/109368>
365
366         Reviewed by Oliver Hunt.
367
368         Rearrange the members of UnlinkedCodeBlock to avoid unnecessary padding on 64-bit.
369         Knocks ~600 KB off of the Membuster3 peak.
370
371         * bytecode/UnlinkedCodeBlock.cpp:
372         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
373         * bytecode/UnlinkedCodeBlock.h:
374         (UnlinkedCodeBlock):
375
376 2013-02-08  Filip Pizlo  <fpizlo@apple.com>
377
378         DFG should allow phases to break Phi's and then have one phase to rebuild them
379         https://bugs.webkit.org/show_bug.cgi?id=108414
380
381         Reviewed by Mark Hahnenberg.
382         
383         Introduces two new DFG forms: LoadStore and ThreadedCPS. These are described in
384         detail in DFGCommon.h.
385         
386         Consequently, DFG phases no longer have to worry about preserving data flow
387         links between basic blocks. It is generally always safe to request that the
388         graph be dethreaded (Graph::dethread), which brings it into LoadStore form, where
389         the data flow is implicit. In this form, only liveness-at-head needs to be
390         preserved.
391         
392         All of the machinery for "threading" the graph to introduce data flow between
393         blocks is now moved out of the bytecode parser and into the CPSRethreadingPhase.
394         All phases that previously did this maintenance themselves now just rely on
395         being able to dethread the graph. The one exception is the structure check
396         hoising phase, which operates over a threaded graph and preserves it, for the
397         sake of performance.
398         
399         Also moved two other things into their own phases: unification (previously found
400         in the parser) and prediction injection (previously found in various places).
401
402         * CMakeLists.txt:
403         * GNUmakefile.list.am:
404         * JavaScriptCore.xcodeproj/project.pbxproj:
405         * Target.pri:
406         * bytecode/Operands.h:
407         (Operands):
408         (JSC::Operands::sizeFor):
409         (JSC::Operands::atFor):
410         * dfg/DFGAbstractState.cpp:
411         (JSC::DFG::AbstractState::execute):
412         (JSC::DFG::AbstractState::mergeStateAtTail):
413         * dfg/DFGAllocator.h:
414         (JSC::DFG::::allocateSlow):
415         * dfg/DFGArgumentsSimplificationPhase.cpp:
416         (JSC::DFG::ArgumentsSimplificationPhase::run):
417         * dfg/DFGBasicBlockInlines.h:
418         (DFG):
419         * dfg/DFGByteCodeParser.cpp:
420         (JSC::DFG::ByteCodeParser::getLocal):
421         (JSC::DFG::ByteCodeParser::getArgument):
422         (JSC::DFG::ByteCodeParser::flushDirect):
423         (JSC::DFG::ByteCodeParser::parseBlock):
424         (DFG):
425         (JSC::DFG::ByteCodeParser::parse):
426         * dfg/DFGCFGSimplificationPhase.cpp:
427         (JSC::DFG::CFGSimplificationPhase::run):
428         (JSC::DFG::CFGSimplificationPhase::killUnreachable):
429         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
430         (CFGSimplificationPhase):
431         (JSC::DFG::CFGSimplificationPhase::fixJettisonedPredecessors):
432         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
433         * dfg/DFGCPSRethreadingPhase.cpp: Added.
434         (DFG):
435         (CPSRethreadingPhase):
436         (JSC::DFG::CPSRethreadingPhase::CPSRethreadingPhase):
437         (JSC::DFG::CPSRethreadingPhase::run):
438         (JSC::DFG::CPSRethreadingPhase::freeUnnecessaryNodes):
439         (JSC::DFG::CPSRethreadingPhase::clearVariablesAtHeadAndTail):
440         (JSC::DFG::CPSRethreadingPhase::addPhiSilently):
441         (JSC::DFG::CPSRethreadingPhase::addPhi):
442         (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
443         (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocal):
444         (JSC::DFG::CPSRethreadingPhase::canonicalizeSetLocal):
445         (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
446         (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocal):
447         (JSC::DFG::CPSRethreadingPhase::canonicalizeSetArgument):
448         (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
449         (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlocks):
450         (JSC::DFG::CPSRethreadingPhase::propagatePhis):
451         (JSC::DFG::CPSRethreadingPhase::PhiStackEntry::PhiStackEntry):
452         (PhiStackEntry):
453         (JSC::DFG::CPSRethreadingPhase::phiStackFor):
454         (JSC::DFG::performCPSRethreading):
455         * dfg/DFGCPSRethreadingPhase.h: Added.
456         (DFG):
457         * dfg/DFGCSEPhase.cpp:
458         (CSEPhase):
459         (JSC::DFG::CSEPhase::performNodeCSE):
460         * dfg/DFGCommon.cpp:
461         (WTF):
462         (WTF::printInternal):
463         * dfg/DFGCommon.h:
464         (JSC::DFG::logCompilationChanges):
465         (DFG):
466         (WTF):
467         * dfg/DFGConstantFoldingPhase.cpp:
468         (JSC::DFG::ConstantFoldingPhase::foldConstants):
469         * dfg/DFGDriver.cpp:
470         (JSC::DFG::compile):
471         * dfg/DFGGraph.cpp:
472         (JSC::DFG::Graph::Graph):
473         (JSC::DFG::Graph::dump):
474         (JSC::DFG::Graph::dethread):
475         (JSC::DFG::Graph::collectGarbage):
476         * dfg/DFGGraph.h:
477         (JSC::DFG::Graph::performSubstitution):
478         (Graph):
479         (JSC::DFG::Graph::performSubstitutionForEdge):
480         (JSC::DFG::Graph::convertToConstant):
481         * dfg/DFGNode.h:
482         (JSC::DFG::Node::convertToPhantomLocal):
483         (Node):
484         (JSC::DFG::Node::convertToGetLocal):
485         (JSC::DFG::Node::hasVariableAccessData):
486         * dfg/DFGNodeType.h:
487         (DFG):
488         * dfg/DFGPhase.cpp:
489         (JSC::DFG::Phase::beginPhase):
490         * dfg/DFGPhase.h:
491         (JSC::DFG::runAndLog):
492         * dfg/DFGPredictionInjectionPhase.cpp: Added.
493         (DFG):
494         (PredictionInjectionPhase):
495         (JSC::DFG::PredictionInjectionPhase::PredictionInjectionPhase):
496         (JSC::DFG::PredictionInjectionPhase::run):
497         (JSC::DFG::performPredictionInjection):
498         * dfg/DFGPredictionInjectionPhase.h: Added.
499         (DFG):
500         * dfg/DFGPredictionPropagationPhase.cpp:
501         (JSC::DFG::PredictionPropagationPhase::run):
502         (JSC::DFG::PredictionPropagationPhase::propagate):
503         * dfg/DFGSpeculativeJIT32_64.cpp:
504         (JSC::DFG::SpeculativeJIT::compile):
505         * dfg/DFGSpeculativeJIT64.cpp:
506         (JSC::DFG::SpeculativeJIT::compile):
507         * dfg/DFGStructureCheckHoistingPhase.cpp:
508         (JSC::DFG::StructureCheckHoistingPhase::run):
509         * dfg/DFGUnificationPhase.cpp: Added.
510         (DFG):
511         (UnificationPhase):
512         (JSC::DFG::UnificationPhase::UnificationPhase):
513         (JSC::DFG::UnificationPhase::run):
514         (JSC::DFG::performUnification):
515         * dfg/DFGUnificationPhase.h: Added.
516         (DFG):
517         * dfg/DFGValidate.cpp:
518         (JSC::DFG::Validate::validate):
519         (JSC::DFG::Validate::dumpGraphIfAppropriate):
520         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
521         (JSC::DFG::VirtualRegisterAllocationPhase::run):
522         * llint/LLIntSlowPaths.cpp:
523         (JSC::LLInt::setUpCall):
524         * runtime/JSCJSValue.cpp:
525         (JSC::JSValue::dump):
526         * runtime/JSString.h:
527         (JSString):
528         * runtime/Options.h:
529         (JSC):
530
531 2013-02-08  Jer Noble  <jer.noble@apple.com>
532
533         Bring WebKit up to speed with latest Encrypted Media spec.
534         https://bugs.webkit.org/show_bug.cgi?id=97037
535
536         Reviewed by Eric Carlson.
537
538         Define the ENABLE_ENCRYPTED_MEDIA_V2 setting.
539
540         * Configurations/FeatureDefines.xcconfig:
541
542 2013-02-08  Gavin Barraclough  <barraclough@apple.com>
543
544         Objective-C API for JavaScriptCore
545         https://bugs.webkit.org/show_bug.cgi?id=105889
546
547         Reviewed by Joseph Pecoraro
548
549         Following up on review comments, mostly typos.
550
551         * API/JSBlockAdaptor.h:
552         * API/JSBlockAdaptor.mm:
553         (-[JSBlockAdaptor blockFromValue:inContext:withException:]):
554         * API/JSContext.h:
555         * API/JSExport.h:
556         * API/JSValue.h:
557         * API/JSValue.mm:
558         * API/JSWrapperMap.mm:
559         (selectorToPropertyName):
560         (-[JSWrapperMap classInfoForClass:]):
561         (-[JSWrapperMap wrapperForObject:]):
562
563 2013-02-08  Martin Robinson  <mrobinson@igalia.com>
564
565         [GTK] Add an experimental gyp build
566         https://bugs.webkit.org/show_bug.cgi?id=109003
567
568         Reviewed by Gustavo Noronha Silva.
569
570         * JavaScriptCore.gypi: Update the list of source files to include those
571         necessary for the GTK+ build.
572
573 2013-02-08  Andreas Kling  <akling@apple.com>
574
575         JSC: Lower minimum PropertyTable size.
576         <http://webkit.org/b/109247>
577
578         Reviewed by Darin Adler.
579
580         Lower the minimum table size for PropertyTable from 16 to 8.
581         3.32 MB progression on Membuster3 (a ~13% reduction in memory used by PropertyTables.)
582
583         * runtime/PropertyMapHashTable.h:
584         (PropertyTable):
585         (JSC::PropertyTable::sizeForCapacity):
586
587 2013-02-07  Roger Fong  <roger_fong@apple.com>
588
589         Unreviewed. More VS2010 WebKit solution touchups.
590         Make JavaScriptCoreExports.def.in be treated as a custom build file so that changes to it cause the exports to be rebuilt.
591
592         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj:
593         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.filters:
594         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
595
596 2013-02-07  Mark Hahnenberg  <mhahnenberg@apple.com>
597
598         Objective-C API: testapi.mm should use ARC
599         https://bugs.webkit.org/show_bug.cgi?id=107838
600
601         Reviewed by Mark Rowe.
602
603         Removing the changes to the Xcode project file and moving the equivalent flags into 
604         the ToolExecutable xcconfig file.
605
606         * Configurations/ToolExecutable.xcconfig:
607         * JavaScriptCore.xcodeproj/project.pbxproj:
608
609 2013-02-07  Brent Fulgham  <bfulgham@webkit.org>
610
611         [Windows] Unreviewed Visual Studio 2010 build fixes after r142179.
612
613         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in: Correct changed symbols
614         * JavaScriptCore.vcxproj/JavaScriptCoreExports.def: Removed autogenerated file.
615
616 2013-02-05  Filip Pizlo  <fpizlo@apple.com>
617
618         DFG::ByteCodeParser should do surgical constant folding to reduce load on the optimization fixpoint
619         https://bugs.webkit.org/show_bug.cgi?id=109000
620
621         Reviewed by Oliver Hunt.
622         
623         Previously our source parser's ASTBuilder did some surgical constant folding, but it
624         didn't cover some cases.  It was particularly incapable of doing constant folding for
625         cases where we do some minimal loop peeling in the bytecode generator - since it
626         didn't "see" those constants prior to the peeling.  Example:
627
628         for (var i = 0; i < 4; ++i)
629             things;
630
631         This will get peeled just a bit by the bytecode generator, so that the "i < 4" is
632         duplicated both at the top of the loop and the bottom.  This means that we have a
633         constant comparison: "0 < 4", which the bytecode generator emits without any further
634         thought.
635
636         The DFG optimization fixpoint of course folds this and simplifies the CFG 
637         accordingly, but this incurs a compile-time cost.  The purpose of this change is to
638         do some surgical constant folding in the DFG's bytecode parser, so that such
639         constructs reduce load on the CFG simplifier and the optimization fixpoint.  The goal
640         is not to cover all cases, since the DFG CFA and CFG simplifier have a powerful
641         sparse conditional constant propagation that we can always fall back on. Instead the
642         goal is to cover enough cases that for common small functions we don't have to
643         perform such transformations, thereby reducing compile times.
644         
645         This also refactors m_inlineStackEntry->m_inlineCallFrame to be a handy method call
646         and also adds the notion of a TriState-based JSValue::pureToBoolean(). Both of these
647         things are used by the folder.
648         
649         As well, care has been taken to make sure that the bytecode parser only does folding
650         that is statically provable, and that doesn't arise out of speculation. This means
651         we cannot fold on data flow that crosses inlining boundaries. On the other hand, the
652         folding that the bytecode parser uses doesn't require phantoming anything. Such is
653         the trade-off: for anything that we do need phantoming, we defer it to the
654         optimization fixpoint.
655         
656         Slight SunSpider speed-up.
657
658         * dfg/DFGByteCodeParser.cpp:
659         (JSC::DFG::ByteCodeParser::get):
660         (JSC::DFG::ByteCodeParser::getLocal):
661         (JSC::DFG::ByteCodeParser::setLocal):
662         (JSC::DFG::ByteCodeParser::flushDirect):
663         (JSC::DFG::ByteCodeParser::flushArgumentsAndCapturedVariables):
664         (JSC::DFG::ByteCodeParser::toInt32):
665         (ByteCodeParser):
666         (JSC::DFG::ByteCodeParser::inlineCallFrame):
667         (JSC::DFG::ByteCodeParser::currentCodeOrigin):
668         (JSC::DFG::ByteCodeParser::canFold):
669         (JSC::DFG::ByteCodeParser::handleInlining):
670         (JSC::DFG::ByteCodeParser::getScope):
671         (JSC::DFG::ByteCodeParser::parseResolveOperations):
672         (JSC::DFG::ByteCodeParser::parseBlock):
673         (JSC::DFG::ByteCodeParser::parseCodeBlock):
674         * dfg/DFGNode.h:
675         (JSC::DFG::Node::isStronglyProvedConstantIn):
676         (Node):
677         * runtime/JSCJSValue.h:
678         * runtime/JSCJSValueInlines.h:
679         (JSC::JSValue::pureToBoolean):
680         (JSC):
681
682 2013-02-07  Zoltan Herczeg  <zherczeg@webkit.org>
683
684         Invalid code is generated for storing constants with baseindex addressing modes on ARM traditional.
685         https://bugs.webkit.org/show_bug.cgi?id=109050
686
687         Reviewed by Oliver Hunt.
688
689         The S! scratch register is reused, but it should contain the constant value.
690
691         * assembler/ARMAssembler.cpp:
692         (JSC::ARMAssembler::baseIndexTransfer32):
693         (JSC::ARMAssembler::baseIndexTransfer16):
694
695 2013-02-07  Andras Becsi  <andras.becsi@digia.com>
696
697         [Qt] Use GNU ar's thin archive format for intermediate static libs
698         https://bugs.webkit.org/show_bug.cgi?id=109052
699
700         Reviewed by Jocelyn Turcotte.
701
702         Adjust project files that used activeBuildConfig()
703         to use targetSubDir().
704
705         * JavaScriptCore.pri:
706         * LLIntOffsetsExtractor.pro:
707         * Target.pri:
708
709 2013-02-06  Roger Fong  <roger_fong@apple.com>
710
711         Unreviewed. Touchups to VS2010 WebKit solution.
712         Fix an export generator script, modify some property sheets, add resouce file.
713
714         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorDebug.props:
715         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd:
716         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorRelease.props:
717         * JavaScriptCore.vcxproj/resource.h: Added.
718
719 2013-02-06  Ilya Tikhonovsky  <loislo@chromium.org>
720
721         Web Inspector: Native Memory Instrumentation: assign class name to the heap graph node automatically
722         https://bugs.webkit.org/show_bug.cgi?id=107262
723
724         Reviewed by Yury Semikhatsky.
725
726         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
727
728 2013-02-06  Mike West  <mkwst@chromium.org>
729
730         Add an ENABLE_NOSNIFF feature flag.
731         https://bugs.webkit.org/show_bug.cgi?id=109029
732
733         Reviewed by Jochen Eisinger.
734
735         This new flag will control the behavior of 'X-Content-Type-Options: nosniff'
736         when processing script and other resource types.
737
738         * Configurations/FeatureDefines.xcconfig:
739
740 2013-02-05  Mark Hahnenberg  <mhahnenberg@apple.com>
741
742         put_to_base should emit a Phantom for "value" across the ForceOSRExit
743         https://bugs.webkit.org/show_bug.cgi?id=108998
744
745         Reviewed by Oliver Hunt.
746
747         Otherwise, the OSR exit compiler could clobber it, which would lead to badness.
748
749         * bytecode/CodeBlock.cpp:
750         (JSC::CodeBlock::tallyFrequentExitSites): Build fixes for when DFG debug logging is enabled.
751         * dfg/DFGByteCodeParser.cpp:
752         (JSC::DFG::ByteCodeParser::parseBlock): Added extra Phantoms for the "value" field where needed.
753         * dfg/DFGSpeculativeJIT.cpp:
754         (JSC::DFG::SpeculativeJIT::compile): Ditto.
755
756 2013-02-05  Michael Saboff  <msaboff@apple.com>
757
758         Crash at JSC::call when loading www.gap.com with JSVALUE32_64 Enabled
759         https://bugs.webkit.org/show_bug.cgi?id=108991
760
761         Reviewed by Oliver Hunt.
762
763         Changed the restoration from calleeGPR to nonArgGPR0 because the restoration of the return location
764         may step on calleeGPR is it happen to be nonArgGPR2.
765
766         * dfg/DFGRepatch.cpp:
767         (JSC::DFG::dfgLinkClosureCall):
768
769 2013-02-05  Roger Fong  <roger_fong@apple.com>
770
771         Add a JavaScriptCore Export Generator project.
772         https://bugs.webkit.org/show_bug.cgi?id=108971.
773
774         Reviewed by Brent Fulgham.
775
776         * JavaScriptCore.vcxproj/JavaScriptCore.sln:
777         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
778         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
779         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
780         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator: Added.
781         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj: Added.
782         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.filters: Added.
783         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.user: Added.
784         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorBuildCmd.cmd: Added.
785         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props: Added.
786         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorDebug.props: Added.
787         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd: Added.
788         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPreBuild.cmd: Added.
789         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorRelease.props: Added.
790         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in: Added.
791
792 2013-02-04  Filip Pizlo  <fpizlo@apple.com>
793
794         DFG should have a precise view of jump targets
795         https://bugs.webkit.org/show_bug.cgi?id=108868
796
797         Reviewed by Oliver Hunt.
798         
799         Previously, the DFG relied entirely on the CodeBlock's jump targets list for
800         determining when to break basic blocks. This worked great, except sometimes it
801         would be too conservative since the CodeBlock just says where the bytecode
802         generator inserted labels.
803         
804         This change keeps the old jump target list in CodeBlock since it is still
805         valuable to the baseline JIT, but switches the DFG to use its own jump target
806         calculator. This ought to reduce pressure on the DFG simplifier, which would
807         previously do a lot of work to try to merge redundantly created basic blocks.
808         It appears to be a 1% progression on SunSpider.
809
810         * CMakeLists.txt:
811         * GNUmakefile.list.am:
812         * JavaScriptCore.xcodeproj/project.pbxproj:
813         * Target.pri:
814         * bytecode/PreciseJumpTargets.cpp: Added.
815         (JSC):
816         (JSC::addSimpleSwitchTargets):
817         (JSC::computePreciseJumpTargets):
818         * bytecode/PreciseJumpTargets.h: Added.
819         (JSC):
820         * dfg/DFGByteCodeParser.cpp:
821         (JSC::DFG::ByteCodeParser::parseCodeBlock):
822
823 2013-02-01  Roger Fong  <roger_fong@apple.com>
824
825         Make ConfigurationBuildDir include directories precede WebKitLibraries in JSC.
826         https://bugs.webkit.org/show_bug.cgi?id=108693.
827
828         Rubberstamped by Timothy Horton.
829
830         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
831
832 2013-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
833
834         Structure::m_outOfLineCapacity is unnecessary
835         https://bugs.webkit.org/show_bug.cgi?id=108206
836
837         Reviewed by Darin Adler.
838
839         Simplifying the utility functions that we use since we don't need a 
840         bunch of fancy templates for this one specific call site.
841
842         * runtime/Structure.h:
843         (JSC::Structure::outOfLineCapacity):
844
845 2013-02-05  Mark Hahnenberg  <mhahnenberg@apple.com>
846
847         Objective-C API: testapi.mm should use ARC
848         https://bugs.webkit.org/show_bug.cgi?id=107838
849
850         Reviewed by Oliver Hunt.
851
852         In ToT testapi.mm uses the Obj-C garbage collector, which hides a lot of our object lifetime bugs.
853         We should enable ARC, since that is what most of our clients will be using. We use Xcode project 
854         settings to make sure we don't try to compile ARC on 32-bit.
855
856         * API/tests/testapi.mm:
857         (+[TestObject testObject]):
858         (testObjectiveCAPI):
859         * JavaScriptCore.xcodeproj/project.pbxproj:
860
861 2013-02-05  Brent Fulgham  <bfulgham@webkit.org>
862
863         [Windows] Unreviewed VS2010 Build Correction after r141651
864
865         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Add missing
866         StructureRareData.h and StructureRareData.cpp files.
867         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
868
869 2013-02-05  Michael Saboff  <msaboff@apple.com>
870
871         r141788 won't build due to not having all changes needed by Node* change
872         https://bugs.webkit.org/show_bug.cgi?id=108944
873
874         Reviewed by David Kilzer.
875
876         Fixed three instances of integerResult(..., m_compileIndex) to be integerResult(..., node).
877
878         * dfg/DFGSpeculativeJIT.cpp:
879         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
880         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForARMv7s):
881
882 2013-02-04  Sheriff Bot  <webkit.review.bot@gmail.com>
883
884         Unreviewed, rolling out r141809.
885         http://trac.webkit.org/changeset/141809
886         https://bugs.webkit.org/show_bug.cgi?id=108860
887
888         ARC isn't supported on 32-bit. (Requested by mhahnenberg on
889         #webkit).
890
891         * API/tests/testapi.mm:
892         (+[TestObject testObject]):
893         (testObjectiveCAPI):
894         * JavaScriptCore.xcodeproj/project.pbxproj:
895
896 2013-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
897
898         Objective-C API: testapi.mm should use ARC
899         https://bugs.webkit.org/show_bug.cgi?id=107838
900
901         Reviewed by Oliver Hunt.
902
903         In ToT testapi.mm uses the Obj-C garbage collector, which hides a lot of our object lifetime bugs. 
904         We should enable ARC, since that is what most of our clients will be using.
905
906         * API/tests/testapi.mm:
907         (-[TestObject init]):
908         (-[TestObject dealloc]):
909         (+[TestObject testObject]):
910         (testObjectiveCAPI):
911         * JavaScriptCore.xcodeproj/project.pbxproj:
912
913 2013-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
914
915         Objective-C API: ObjCCallbackFunction should retain the target of its NSInvocation
916         https://bugs.webkit.org/show_bug.cgi?id=108843
917
918         Reviewed by Darin Adler.
919
920         Currently, ObjCCallbackFunction doesn't retain the target of its NSInvocation. It needs to do 
921         this to prevent crashes when trying to invoke a callback later on.
922
923         * API/ObjCCallbackFunction.mm:
924         (ObjCCallbackFunction::ObjCCallbackFunction):
925         (ObjCCallbackFunction::~ObjCCallbackFunction):
926
927 2013-02-04  Martin Robinson  <mrobinson@igalia.com>
928
929         Fix GTK+ 'make dist' in preparation for the 1.11.5 release.
930
931         * GNUmakefile.list.am: Update the source lists.
932
933 2013-02-04  Michael Saboff  <msaboff@apple.com>
934
935         For ARMv7s use integer divide instruction for divide and modulo when possible
936         https://bugs.webkit.org/show_bug.cgi?id=108840
937
938         Reviewed in person by Filip Pizlo.
939
940         Added ARMv7s integer divide path for ArithDiv and ArithMod where operands and results are integer.
941         This is patterned after the similar code for X86.  Also added modulo power of 2 optimization
942         that uses logical and.  Added sdiv and udiv to the ARMv7 disassembler.  Put all the changes
943         behind #if CPU(APPLE_ARMV7S). 
944
945         * assembler/ARMv7Assembler.h:
946         (ARMv7Assembler):
947         (JSC::ARMv7Assembler::sdiv):
948         (JSC::ARMv7Assembler::udiv):
949         * dfg/DFGCommon.h:
950         (JSC::DFG::isARMv7s):
951         * dfg/DFGFixupPhase.cpp:
952         (JSC::DFG::FixupPhase::fixupNode):
953         * dfg/DFGSpeculativeJIT.cpp:
954         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
955         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForARMv7s):
956         * dfg/DFGSpeculativeJIT.h:
957         (SpeculativeJIT):
958         * dfg/DFGSpeculativeJIT32_64.cpp:
959         (JSC::DFG::SpeculativeJIT::compile):
960
961 2013-02-04  David Kilzer  <ddkilzer@apple.com>
962
963         Check PrivateHeaders/JSBasePrivate.h for inappropriate macros
964         <http://webkit.org/b/108749>
965
966         Reviewed by Joseph Pecoraro.
967
968         * JavaScriptCore.xcodeproj/project.pbxproj: Add
969         PrivateHeaders/JSBasePrivate.h to list of headers to check in
970         "Check for Inappropriate Macros in External Headers" build phase
971         script.
972
973 2013-02-04  David Kilzer  <ddkilzer@apple.com>
974
975         Remove duplicate entries from JavaScriptCore Xcode project
976
977             $ uniq Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj | diff -u - Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj | patch -p0 -R
978             patching file Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
979
980         * JavaScriptCore.xcodeproj/project.pbxproj: Remove duplicates.
981
982 2013-02-04  David Kilzer  <ddkilzer@apple.com>
983
984         Sort JavaScriptCore Xcode project file
985
986         * JavaScriptCore.xcodeproj/project.pbxproj:
987
988 2013-02-03  David Kilzer  <ddkilzer@apple.com>
989
990         Upstream ENABLE_PDFKIT_PLUGIN settting
991         <http://webkit.org/b/108792>
992
993         Reviewed by Tim Horton.
994
995         * Configurations/FeatureDefines.xcconfig: Disable PDFKIT_PLUGIN
996         on iOS since PDFKit is a Mac-only framework.
997
998 2013-02-02  Andreas Kling  <akling@apple.com>
999
1000         Vector should consult allocator about ideal size when choosing capacity.
1001         <http://webkit.org/b/108410>
1002         <rdar://problem/13124002>
1003
1004         Reviewed by Benjamin Poulain.
1005
1006         Remove assertion about Vector capacity that won't hold anymore since capacity()
1007         may not be what you passed to reserveCapacity().
1008         Also export WTF::fastMallocGoodSize() for Windows builds.
1009
1010         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
1011         * bytecode/CodeBlock.cpp:
1012         (JSC::CodeBlock::CodeBlock):
1013
1014 2013-02-02  Patrick Gansterer  <paroga@webkit.org>
1015
1016         [CMake] Adopt the WinCE port to new CMake
1017         https://bugs.webkit.org/show_bug.cgi?id=108754
1018
1019         Reviewed by Laszlo Gombos.
1020
1021         * os-win32/WinMain.cpp: Removed.
1022         * shell/PlatformWinCE.cmake: Removed.
1023
1024 2013-02-02  Mark Rowe  <mrowe@apple.com>
1025
1026         <http://webkit.org/b/108745> WTF shouldn't use a script build phase to detect the presence of headers when the compiler can do it for us
1027
1028         Reviewed by Sam Weinig.
1029
1030         * DerivedSources.make: Remove an obsolete Makefile rule. This should have been removed when the use
1031         of the generated file moved to WTF.
1032
1033 2013-02-02  David Kilzer  <ddkilzer@apple.com>
1034
1035         Upstream iOS FeatureDefines
1036         <http://webkit.org/b/108753>
1037
1038         Reviewed by Anders Carlsson.
1039
1040         * Configurations/FeatureDefines.xcconfig:
1041         - ENABLE_DEVICE_ORIENTATION: Add iOS configurations.
1042         - ENABLE_PLUGIN_PROXY_FOR_VIDEO: Ditto.
1043         - FEATURE_DEFINES: Add ENABLE_PLUGIN_PROXY_FOR_VIDEO.  Add
1044           PLATFORM_NAME variant to reduce future merge conflicts. 
1045
1046 2013-02-01  Mark Hahnenberg  <mhahnenberg@apple.com>
1047
1048         Structure::m_enumerationCache should be moved to StructureRareData
1049         https://bugs.webkit.org/show_bug.cgi?id=108723
1050
1051         Reviewed by Oliver Hunt.
1052
1053         m_enumerationCache is only used by objects whose properties are iterated over, so not every Structure needs this 
1054         field and it can therefore be moved safely to StructureRareData to help with memory savings.
1055
1056         * runtime/JSPropertyNameIterator.h:
1057         (JSPropertyNameIterator):
1058         (JSC::Register::propertyNameIterator):
1059         (JSC::StructureRareData::enumerationCache): Add to JSPropertyNameIterator.h so that it can see the correct type.
1060         (JSC::StructureRareData::setEnumerationCache): Ditto.
1061         * runtime/Structure.cpp:
1062         (JSC::Structure::addPropertyWithoutTransition): Use the enumerationCache() getter rather than accessing the field.
1063         (JSC::Structure::removePropertyWithoutTransition): Ditto.
1064         (JSC::Structure::visitChildren): We no longer have to worry about marking the m_enumerationCache field.
1065         * runtime/Structure.h: 
1066         (JSC::Structure::setEnumerationCache): Move the old accessors back since we don't have to have any knowledge of 
1067         the JSPropertyNameIterator type.
1068         (JSC::Structure::enumerationCache): Ditto.
1069         * runtime/StructureRareData.cpp:
1070         (JSC::StructureRareData::visitChildren): Mark the new m_enumerationCache field.
1071         * runtime/StructureRareData.h: Add new functions/fields.
1072         (StructureRareData):
1073
1074 2013-02-01  Roger Fong  <roger_fong@apple.com>
1075
1076         Unreviewed. JavaScriptCore VS2010 project cleanup.
1077
1078         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1079         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1080         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
1081         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
1082
1083 2013-02-01  Sheriff Bot  <webkit.review.bot@gmail.com>
1084
1085         Unreviewed, rolling out r141662.
1086         http://trac.webkit.org/changeset/141662
1087         https://bugs.webkit.org/show_bug.cgi?id=108738
1088
1089         it's an incorrect change since processPhiStack will
1090         dereference dangling BasicBlock pointers (Requested by pizlo
1091         on #webkit).
1092
1093         * dfg/DFGByteCodeParser.cpp:
1094         (JSC::DFG::ByteCodeParser::parse):
1095
1096 2013-02-01  Filip Pizlo  <fpizlo@apple.com>
1097
1098         Eliminate dead blocks sooner in the DFG::ByteCodeParser to make clear that you don't need to hold onto them during Phi construction
1099         https://bugs.webkit.org/show_bug.cgi?id=108717
1100
1101         Reviewed by Mark Hahnenberg.
1102         
1103         I think this makes the code clearer. It doesn't change behavior.
1104
1105         * dfg/DFGByteCodeParser.cpp:
1106         (JSC::DFG::ByteCodeParser::parse):
1107
1108 2013-02-01  Mark Hahnenberg  <mhahnenberg@apple.com>
1109
1110         Structure should have a StructureRareData field to save space
1111         https://bugs.webkit.org/show_bug.cgi?id=108659
1112
1113         Reviewed by Oliver Hunt.
1114
1115         Many of the fields in Structure are used in a subset of all total Structures; however, all Structures must 
1116         pay the memory cost of those fields, regardless of whether they use them or not. Since we can have potentially 
1117         many Structures on a single page (e.g. bing.com creates ~1500 Structures), it would be profitable to 
1118         refactor Structure so that not every Structure has to pay the memory costs for these infrequently used fields.
1119
1120         To accomplish this, we can create a new StructureRareData class to house these seldom used fields which we 
1121         can allocate on demand whenever a Structure requires it. This StructureRareData can itself be a JSCell, and 
1122         can do all the marking of the fields for the Structure. The StructureRareData field will be part of a union 
1123         with m_previous to minimize overhead. We'll add a new field to JSTypeInfo to indicate that the Structure has 
1124         a StructureRareData field. During transitions, a Structure will clone its previous Structure's StructureRareData 
1125         if it has one. There could be some potential for optimizing this process, but the initial implementation will 
1126         be dumb since we'd be paying these overhead costs for each Structure anyways.
1127
1128         Initially we'll only put two fields in the StructureRareData to avoid a memory regression. Over time we'll 
1129         continue to move fields from Structure to StructureRareData. Optimistically, this could potentially reduce our 
1130         Structure memory footprint by up to around 75%. It could also clear the way for removing destructors from 
1131         Structures (and into StructureRareData).
1132
1133         * CMakeLists.txt:
1134         * GNUmakefile.list.am:
1135         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
1136         * JavaScriptCore.xcodeproj/project.pbxproj:
1137         * Target.pri:
1138         * dfg/DFGRepatch.cpp: Includes for linking purposes.
1139         * jit/JITStubs.cpp:
1140         * jsc.cpp:
1141         * llint/LLIntSlowPaths.cpp:
1142         * runtime/JSCellInlines.h: Added ifdef guards.
1143         * runtime/JSGlobalData.cpp: New Structure for StructureRareData class.
1144         (JSC::JSGlobalData::JSGlobalData):
1145         * runtime/JSGlobalData.h:
1146         (JSGlobalData):
1147         * runtime/JSGlobalObject.h:
1148         * runtime/JSTypeInfo.h: New flag to indicate whether or not a Structure has a StructureRareData field.
1149         (JSC::TypeInfo::flags):
1150         (JSC::TypeInfo::structureHasRareData):
1151         * runtime/ObjectPrototype.cpp:
1152         * runtime/Structure.cpp: We use a combined WriteBarrier<JSCell> field m_previousOrRareData to avoid compiler issues.
1153         (JSC::Structure::dumpStatistics):
1154         (JSC::Structure::Structure): 
1155         (JSC::Structure::materializePropertyMap):
1156         (JSC::Structure::addPropertyTransition):
1157         (JSC::Structure::nonPropertyTransition):
1158         (JSC::Structure::pin):
1159         (JSC::Structure::allocateRareData): Handles allocating a brand new StructureRareData field.
1160         (JSC::Structure::cloneRareDataFrom): Handles cloning a StructureRareData field from another. Used during Structure 
1161         transitions.
1162         (JSC::Structure::visitChildren): We no longer have to worry about marking m_objectToStringValue.
1163         * runtime/Structure.h:
1164         (JSC::Structure::previousID): Checks the structureHasRareData flag to see where it should get the previous Structure.
1165         (JSC::Structure::objectToStringValue): Reads the value from the StructureRareData. If it doesn't exist, returns 0.
1166         (JSC::Structure::setObjectToStringValue): Ensures that we have a StructureRareData field, then forwards the function 
1167         call to it.
1168         (JSC::Structure::materializePropertyMapIfNecessary):
1169         (JSC::Structure::setPreviousID): Checks for StructureRareData and forwards if necessary.
1170         (Structure):
1171         (JSC::Structure::clearPreviousID): Ditto.
1172         (JSC::Structure::create):
1173         * runtime/StructureRareData.cpp: Added. All of the basic functionality of a JSCell with the fields that we've moved 
1174         from Structure and the functions required to access/modify those fields as Structure would have done.
1175         (JSC):
1176         (JSC::StructureRareData::createStructure):
1177         (JSC::StructureRareData::create):
1178         (JSC::StructureRareData::clone):
1179         (JSC::StructureRareData::StructureRareData):
1180         (JSC::StructureRareData::visitChildren):
1181         * runtime/StructureRareData.h: Added.
1182         (JSC):
1183         (StructureRareData):
1184         * runtime/StructureRareDataInlines.h: Added.
1185         (JSC):
1186         (JSC::StructureRareData::previousID):
1187         (JSC::StructureRareData::setPreviousID):
1188         (JSC::StructureRareData::clearPreviousID):
1189         (JSC::Structure::previous): Handles the ugly casting to get the value of the right type of m_previousOrRareData.
1190         (JSC::Structure::rareData): Ditto.
1191         (JSC::StructureRareData::objectToStringValue):
1192         (JSC::StructureRareData::setObjectToStringValue):
1193
1194         * CMakeLists.txt:
1195         * GNUmakefile.list.am:
1196         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
1197         * JavaScriptCore.xcodeproj/project.pbxproj:
1198         * Target.pri:
1199         * dfg/DFGRepatch.cpp:
1200         * jit/JITStubs.cpp:
1201         * jsc.cpp:
1202         * llint/LLIntSlowPaths.cpp:
1203         * runtime/JSCellInlines.h:
1204         * runtime/JSGlobalData.cpp:
1205         (JSC::JSGlobalData::JSGlobalData):
1206         * runtime/JSGlobalData.h:
1207         (JSGlobalData):
1208         * runtime/JSGlobalObject.h:
1209         * runtime/JSTypeInfo.h:
1210         (JSC):
1211         (JSC::TypeInfo::flags):
1212         (JSC::TypeInfo::structureHasRareData):
1213         * runtime/ObjectPrototype.cpp:
1214         * runtime/Structure.cpp:
1215         (JSC::Structure::dumpStatistics):
1216         (JSC::Structure::Structure):
1217         (JSC::Structure::materializePropertyMap):
1218         (JSC::Structure::addPropertyTransition):
1219         (JSC::Structure::nonPropertyTransition):
1220         (JSC::Structure::pin):
1221         (JSC::Structure::allocateRareData):
1222         (JSC):
1223         (JSC::Structure::cloneRareDataFrom):
1224         (JSC::Structure::visitChildren):
1225         * runtime/Structure.h:
1226         (JSC::Structure::previousID):
1227         (JSC::Structure::objectToStringValue):
1228         (JSC::Structure::setObjectToStringValue):
1229         (JSC::Structure::materializePropertyMapIfNecessary):
1230         (JSC::Structure::setPreviousID):
1231         (Structure):
1232         (JSC::Structure::clearPreviousID):
1233         (JSC::Structure::previous):
1234         (JSC::Structure::rareData):
1235         (JSC::Structure::create):
1236         * runtime/StructureRareData.cpp: Added.
1237         (JSC):
1238         (JSC::StructureRareData::createStructure):
1239         (JSC::StructureRareData::create):
1240         (JSC::StructureRareData::clone):
1241         (JSC::StructureRareData::StructureRareData):
1242         (JSC::StructureRareData::visitChildren):
1243         * runtime/StructureRareData.h: Added.
1244         (JSC):
1245         (StructureRareData):
1246         * runtime/StructureRareDataInlines.h: Added.
1247         (JSC):
1248         (JSC::StructureRareData::previousID):
1249         (JSC::StructureRareData::setPreviousID):
1250         (JSC::StructureRareData::clearPreviousID):
1251         (JSC::StructureRareData::objectToStringValue):
1252         (JSC::StructureRareData::setObjectToStringValue):
1253
1254 2013-02-01  Balazs Kilvady  <kilvadyb@homejinni.com>
1255
1256         offlineasm BaseIndex handling is broken on ARM due to MIPS changes
1257         https://bugs.webkit.org/show_bug.cgi?id=108261
1258
1259         Reviewed by Filip Pizlo.
1260
1261         offlineasm BaseIndex handling fix on MIPS.
1262
1263         * offlineasm/mips.rb:
1264         * offlineasm/risc.rb:
1265
1266 2013-02-01  Geoffrey Garen  <ggaren@apple.com>
1267
1268         Removed an unused function: JSGlobalObject::createFunctionExecutableFromGlobalCode
1269         https://bugs.webkit.org/show_bug.cgi?id=108657
1270
1271         Reviewed by Anders Carlsson.
1272
1273         * runtime/JSGlobalObject.cpp:
1274         (JSC):
1275         * runtime/JSGlobalObject.h:
1276         (JSGlobalObject):
1277
1278 2013-02-01  Geoffrey Garen  <ggaren@apple.com>
1279
1280         Added TriState to WTF and started using it in one place
1281         https://bugs.webkit.org/show_bug.cgi?id=108628
1282
1283         Reviewed by Beth Dakin.
1284
1285         * runtime/PrototypeMap.h:
1286         (JSC::PrototypeMap::isPrototype): Use TriState instead of boolean. In
1287         response to review feedback, this is an attempt to clarify that our
1288         'true' condition is actually just a 'maybe'.
1289
1290         * runtime/PrototypeMap.h:
1291         (PrototypeMap):
1292         (JSC::PrototypeMap::isPrototype):
1293
1294 2013-02-01  Alexis Menard  <alexis@webkit.org>
1295
1296         Enable unprefixed CSS transitions by default.
1297         https://bugs.webkit.org/show_bug.cgi?id=108216
1298
1299         Reviewed by Dean Jackson.
1300
1301         Rename the flag CSS_TRANSFORMS_ANIMATIONS_TRANSITIONS_UNPREFIXED
1302         to CSS_TRANSFORMS_ANIMATIONS_UNPREFIXED which will be used later to 
1303         guard the unprefixing work for CSS Transforms and animations.
1304
1305         * Configurations/FeatureDefines.xcconfig:
1306
1307 2013-01-31  Filip Pizlo  <fpizlo@apple.com>
1308
1309         DFG::CFGSimplificationPhase::keepOperandAlive() conflates liveness and availability
1310         https://bugs.webkit.org/show_bug.cgi?id=108580
1311
1312         Reviewed by Oliver Hunt.
1313         
1314         This is a harmless bug in that it only results in us keeping a bit too many things
1315         for OSR.  But it's worth fixing so that the code is consistent.
1316
1317         keepOperandAlive() is called when block A has a branch to blocks B and C, but the
1318         A->B edge is proven to never be taken and we want to optimize the code to have A
1319         unconditionally jump to C.  In that case, for the purposes of OSR, we need to
1320         preserve the knowledge that the state that B expected to be live incoming from A
1321         ought still to be live up to the point of where the A->B,C branch used to be.  The
1322         way we keep things alive is by using the variablesAtTail of A (i.e., we use the
1323         knowledge of in what manner A made state available to B and C).  The way we choose
1324         which state should be kept alive ought to be chosen by the variablesAtHead of B
1325         (i.e. the things B says it needs from its predecessors, including A), except that
1326         keepOperandAlive() was previously just using variablesAtTail of A for this
1327         purpose.
1328         
1329         The fix is to have keepOperandAlive() use both liveness and availability in its
1330         logic. It should use liveness (i.e. B->variablesAtHead) to decide what to keep
1331         alive, and it should use availability (i.e. A->variablesAtTail) to decide how to
1332         keep it alive.
1333         
1334         This might be a microscopic win on some programs, but it's mainly intended to be
1335         a code clean-up so that I don't end up scratching my head in confusion the next
1336         time I look at this code.
1337
1338         * dfg/DFGCFGSimplificationPhase.cpp:
1339         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
1340         (JSC::DFG::CFGSimplificationPhase::jettisonBlock):
1341         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
1342
1343 2013-01-31  Geoffrey Garen  <ggaren@apple.com>
1344
1345         REGRESSION (r141192): Crash beneath cti_op_get_by_id_generic @ discussions.apple.com
1346         https://bugs.webkit.org/show_bug.cgi?id=108576
1347
1348         Reviewed by Filip Pizlo.
1349
1350         This was a long-standing bug. The DFG would destructively reuse a register
1351         in op_convert_this, but:
1352
1353             * The bug only presented during speculation failure for type Other
1354
1355             * The bug presented by removing the low bits of a pointer, which
1356             used to be harmless, since all objects were so aligned anyway.
1357
1358         * dfg/DFGSpeculativeJIT64.cpp:
1359         (JSC::DFG::SpeculativeJIT::compile): Don't reuse our this register as
1360         our scratch register. The whole point of our scratch register is to
1361         avoid destructively modifying our this register. I'm pretty sure this
1362         was a copy-paste error.
1363
1364 2013-01-31  Roger Fong  <roger_fong@apple.com>
1365
1366         Unreviewed. Windows build fix.
1367
1368         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
1369
1370 2013-01-31  Jessie Berlin  <jberlin@apple.com>
1371
1372         Rolling out r141407 because it is causing crashes under
1373         WTF::TCMalloc_Central_FreeList::FetchFromSpans() in Release builds.
1374
1375         * bytecode/CodeBlock.cpp:
1376         (JSC::CodeBlock::CodeBlock):
1377
1378 2013-01-31  Mark Hahnenberg  <mhahnenberg@apple.com>
1379
1380         Objective-C API: JSContext exception property causes reference cycle
1381         https://bugs.webkit.org/show_bug.cgi?id=107778
1382
1383         Reviewed by Darin Adler.
1384
1385         JSContext has a (retain) JSValue * exception property which, when non-null, creates a 
1386         reference cycle (since the JSValue * holds a strong reference back to the JSContext *).
1387
1388         * API/JSContext.mm: Instead of JSValue *, we now use a plain JSValueRef, which eliminates the reference cycle.
1389         (-[JSContext initWithVirtualMachine:]):
1390         (-[JSContext setException:]):
1391         (-[JSContext exception]):
1392
1393 2013-01-31  Roger Fong  <roger_fong@apple.com>
1394
1395         Unreviewed build fix. Win7 port.
1396
1397         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
1398
1399 2013-01-31  Joseph Pecoraro  <pecoraro@apple.com>
1400
1401         Disable ENABLE_FULLSCREEN_API on iOS
1402         https://bugs.webkit.org/show_bug.cgi?id=108250
1403
1404         Reviewed by Benjamin Poulain.
1405
1406         * Configurations/FeatureDefines.xcconfig:
1407
1408 2013-01-31  Mark Hahnenberg  <mhahnenberg@apple.com>
1409
1410         Objective-C API: Fix insertion of values greater than the max index allowed by the spec
1411         https://bugs.webkit.org/show_bug.cgi?id=108264
1412
1413         Reviewed by Oliver Hunt.
1414
1415         Fixed a bug, added a test to the API tests, cleaned up some code.
1416
1417         * API/JSValue.h: Changed some of the documentation on setValue:atIndex: to indicate that 
1418         setting values at indices greater than UINT_MAX - 1 wont' affect the length of JS arrays.
1419         * API/JSValue.mm:
1420         (-[JSValue valueAtIndex:]): We weren't returning when we should have been.
1421         (-[JSValue setValue:atIndex:]): Added a comment about why we do the early check for being larger than UINT_MAX.
1422         (objectToValueWithoutCopy): Removed two redundant cases that were already checked previously.
1423         * API/tests/testapi.mm:
1424
1425 2013-01-30  Andreas Kling  <akling@apple.com>
1426
1427         Vector should consult allocator about ideal size when choosing capacity.
1428         <http://webkit.org/b/108410>
1429         <rdar://problem/13124002>
1430
1431         Reviewed by Benjamin Poulain.
1432
1433         Remove assertion about Vector capacity that won't hold anymore since capacity()
1434         may not be what you passed to reserveCapacity().
1435
1436         * bytecode/CodeBlock.cpp:
1437         (JSC::CodeBlock::CodeBlock):
1438
1439 2013-01-30  Filip Pizlo  <fpizlo@apple.com>
1440
1441         DFG bytecode parser should have more assertions about the status of local accesses
1442         https://bugs.webkit.org/show_bug.cgi?id=108417
1443
1444         Reviewed by Mark Hahnenberg.
1445         
1446         Assert some things that we already know to be true, just to reassure ourselves that they are true.
1447         This is meant as a prerequisite for https://bugs.webkit.org/show_bug.cgi?id=108414, which will
1448         make these rules even stricter.
1449
1450         * dfg/DFGByteCodeParser.cpp:
1451         (JSC::DFG::ByteCodeParser::getLocal):
1452         (JSC::DFG::ByteCodeParser::getArgument):
1453
1454 2013-01-30  Mark Hahnenberg  <mhahnenberg@apple.com>
1455
1456         Objective-C API: JSContext's dealloc causes ASSERT due to ordering of releases
1457         https://bugs.webkit.org/show_bug.cgi?id=107978
1458
1459         Reviewed by Filip Pizlo.
1460
1461         We need to add the Identifier table save/restore in JSContextGroupRelease so that we 
1462         have the correct table if we end up destroying the JSGlobalData/Heap.
1463
1464         * API/JSContextRef.cpp:
1465         (JSContextGroupRelease):
1466
1467 2013-01-30  Mark Hahnenberg  <mhahnenberg@apple.com>
1468
1469         Objective-C API: exceptionHandler needs to be released in JSContext dealloc
1470         https://bugs.webkit.org/show_bug.cgi?id=108378
1471
1472         Reviewed by Filip Pizlo.
1473
1474         JSContext has a (copy) exceptionHandler property that it doesn't release in dealloc. 
1475         That sounds like the potential for a leak. It should be released.
1476
1477         * API/JSContext.mm:
1478         (-[JSContext dealloc]):
1479
1480 2013-01-30  Filip Pizlo  <fpizlo@apple.com>
1481
1482         REGRESSION(140504): pure CSE no longer matches things, 10% regression on Kraken
1483         https://bugs.webkit.org/show_bug.cgi?id=108366
1484
1485         Reviewed by Geoffrey Garen and Mark Hahnenberg.
1486         
1487         This was a longstanding bug that was revealed by http://trac.webkit.org/changeset/140504.
1488         Pure CSE requires that the Node::flags() that may affect the behavior of a node match,
1489         when comparing a possibly redundant node to its possible replacement. It was doing this
1490         by comparing Node::arithNodeFlags(), which as the name might appear to suggest, returns
1491         just those flag bits that correspond to actual node behavior and not auxiliary things.
1492         Unfortunately, Node::arithNodeFlags() wasn't actually masking off the irrelevant bits.
1493         This worked prior to r140504 because CSE itself didn't mutate the flags, so there was a
1494         very high probability that matching nodes would also have completely identical flag bits
1495         (even the ones that aren't relevant to arithmetic behavior, like NodeDoesNotExit). But
1496         r140504 moved one of CSE's side-tables (m_relevantToOSR) into a flag bit for quicker
1497         access. These bits would be mutated as the CSE ran over a basic block, in such a way that
1498         there was a very high probability that the possible replacement would already have the
1499         bit set, while the redundant node did not have the bit set. Since Node::arithNodeFlags()
1500         returned all of the bits, this would cause CSEPhase::pureCSE() to reject the match
1501         almost every time.
1502         
1503         The solution is to make Node::arithNodeFlags() do as its name suggests: only return those
1504         flags that are relevant to arithmetic behavior. This patch introduces a new mask that
1505         represents those bits, and includes NodeBehaviorMask and NodeBackPropMask, which are both
1506         used for queries on Node::arithNodeFlags(), and both affect arithmetic code gen. None of
1507         the other flags are relevant to Node::arithNodeFlags() since they either correspond to
1508         information already conveyed by the opcode (like NodeResultMask, NodeMustGenerate,
1509         NodeHasVarArgs, NodeClobbersWorld, NodeMightClobber) or information that doesn't affect
1510         the result that the node will produce or any of the queries performed on the result of
1511         Node::arithNodeFlags (NodeDoesNotExit and of course NodeRelevantToOSR).
1512         
1513         This is a 10% speed-up on Kraken, undoing the regression from r140504.
1514
1515         * dfg/DFGNode.h:
1516         (JSC::DFG::Node::arithNodeFlags):
1517         * dfg/DFGNodeFlags.h:
1518         (DFG):
1519
1520 2013-01-29  Mark Hahnenberg  <mhahnenberg@apple.com>
1521
1522         Structure::m_outOfLineCapacity is unnecessary
1523         https://bugs.webkit.org/show_bug.cgi?id=108206
1524
1525         Reviewed by Geoffrey Garen.
1526
1527         We can calculate our out of line capacity by using the outOfLineSize and our knowledge about our resize policy.
1528         According to GDB, this knocks Structures down from 136 bytes to 128 bytes (I'm guessing the extra bytes are from
1529         better alignment of object fields), which puts Structures in a smaller size class. Woohoo! Looks neutral on our 
1530         benchmarks.
1531
1532         * runtime/Structure.cpp:
1533         (JSC::Structure::Structure):
1534         (JSC):
1535         (JSC::Structure::suggestedNewOutOfLineStorageCapacity):
1536         (JSC::Structure::addPropertyTransition):
1537         (JSC::Structure::addPropertyWithoutTransition):
1538         * runtime/Structure.h:
1539         (Structure):
1540         (JSC::Structure::outOfLineCapacity):
1541         (JSC::Structure::totalStorageCapacity):
1542
1543 2013-01-29  Geoffrey Garen  <ggaren@apple.com>
1544
1545         Be a little more conservative about emitting table-based switches
1546         https://bugs.webkit.org/show_bug.cgi?id=108292
1547
1548         Reviewed by Filip Pizlo.
1549
1550         Profiling shows we're using op_switch in cases where it's a regression.
1551
1552         * bytecompiler/NodesCodegen.cpp:
1553         (JSC):
1554         (JSC::length):
1555         (JSC::CaseBlockNode::tryTableSwitch):
1556         (JSC::CaseBlockNode::emitBytecodeForBlock):
1557         * parser/Nodes.h:
1558         (CaseBlockNode):
1559
1560 2013-01-29  Sheriff Bot  <webkit.review.bot@gmail.com>
1561
1562         Unreviewed, rolling out r140983.
1563         http://trac.webkit.org/changeset/140983
1564         https://bugs.webkit.org/show_bug.cgi?id=108277
1565
1566         Unfortunately, this API has one last client (Requested by
1567         abarth on #webkit).
1568
1569         * Configurations/FeatureDefines.xcconfig:
1570
1571 2013-01-29  Mark Hahnenberg  <mhahnenberg@apple.com>
1572
1573         Objective-C API: JSObjCClassInfo creates reference cycle with JSContext
1574         https://bugs.webkit.org/show_bug.cgi?id=107839
1575
1576         Reviewed by Geoffrey Garen.
1577
1578         Fixing several ASSERTs that were incorrect along with some of the reallocation of m_prototype and 
1579         m_constructor that they were based on.
1580
1581         * API/JSWrapperMap.mm:
1582         (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]): We now only allocate those
1583         fields that are null (i.e. have been collected or have never been allocated to begin with).
1584         (-[JSObjCClassInfo reallocateConstructorAndOrPrototype]): Renamed to better indicate that we're 
1585         reallocating one or both of the prototype/constructor combo.
1586         (-[JSObjCClassInfo wrapperForObject:]): Call new reallocate function.
1587         (-[JSObjCClassInfo constructor]): Ditto.
1588
1589 2013-01-29  Geoffrey Garen  <ggaren@apple.com>
1590
1591         Make precise size classes more precise
1592         https://bugs.webkit.org/show_bug.cgi?id=108270
1593
1594         Reviewed by Mark Hahnenberg.
1595
1596         Size inference makes this profitable.
1597
1598         I chose 8 byte increments because JSString is 24 bytes. Otherwise, 16
1599         byte increments might be better.
1600
1601         * heap/Heap.h:
1602         (Heap): Removed firstAllocatorWithoutDestructors because it's unused now.
1603
1604         * heap/MarkedBlock.h:
1605         (MarkedBlock): Updated constants.
1606
1607         * heap/MarkedSpace.h:
1608         (MarkedSpace):
1609         (JSC): Also reduced the maximum precise size class because my testing
1610         has shown that the smaller size classes are much more common. This
1611         offsets some of the size class explosion caused by reducing the precise
1612         increment.
1613
1614         * llint/LLIntData.cpp:
1615         (JSC::LLInt::Data::performAssertions): No need for this ASSERT anymore
1616         because we don't rely on firstAllocatorWithoutDestructors anymore, since
1617         we pick size classes dynamically now.
1618
1619 2013-01-29  Oliver Hunt  <oliver@apple.com>
1620
1621         Add some hardening to methodTable()
1622         https://bugs.webkit.org/show_bug.cgi?id=108253
1623
1624         Reviewed by Mark Hahnenberg.
1625
1626         When accessing methodTable() we now always make sure that our
1627         structure _could_ be valid.  Added a separate method to get a
1628         classes methodTable during destruction as it's not possible to
1629         validate the structure at that point.  This separation might
1630         also make it possible to improve the performance of methodTable
1631         access more generally in future.
1632
1633         * heap/MarkedBlock.cpp:
1634         (JSC::MarkedBlock::callDestructor):
1635         * runtime/JSCell.h:
1636         (JSCell):
1637         * runtime/JSCellInlines.h:
1638         (JSC::JSCell::methodTableForDestruction):
1639         (JSC):
1640         (JSC::JSCell::methodTable):
1641
1642 2013-01-29  Filip Pizlo  <fpizlo@apple.com>
1643
1644         offlineasm BaseIndex handling is broken on ARM due to MIPS changes
1645         https://bugs.webkit.org/show_bug.cgi?id=108261
1646
1647         Reviewed by Oliver Hunt.
1648         
1649         Backends shouldn't override each other's methods. That's not cool.
1650
1651         * offlineasm/mips.rb:
1652
1653 2013-01-29  Filip Pizlo  <fpizlo@apple.com>
1654
1655         cloop.rb shouldn't use a method called 'dump' for code generation
1656         https://bugs.webkit.org/show_bug.cgi?id=108251
1657
1658         Reviewed by Mark Hahnenberg.
1659         
1660         Revert http://trac.webkit.org/changeset/141178 and rename 'dump' to 'clDump'.
1661         
1662         Also made trivial build fixes for !ENABLE(JIT).
1663
1664         * offlineasm/cloop.rb:
1665         * runtime/Executable.h:
1666         (ExecutableBase):
1667         (JSC::ExecutableBase::intrinsicFor):
1668         * runtime/JSGlobalData.h:
1669
1670 2013-01-29  Geoffrey Garen  <ggaren@apple.com>
1671
1672         Removed GGC because it has been disabled for a long time
1673         https://bugs.webkit.org/show_bug.cgi?id=108245
1674
1675         Reviewed by Filip Pizlo.
1676
1677         * GNUmakefile.list.am:
1678         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1679         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1680         * JavaScriptCore.xcodeproj/project.pbxproj:
1681         * dfg/DFGRepatch.cpp:
1682         (JSC::DFG::emitPutReplaceStub):
1683         (JSC::DFG::emitPutTransitionStub):
1684         * dfg/DFGSpeculativeJIT.cpp:
1685         (JSC::DFG::SpeculativeJIT::writeBarrier):
1686         * dfg/DFGSpeculativeJIT.h:
1687         (SpeculativeJIT):
1688         * dfg/DFGSpeculativeJIT32_64.cpp:
1689         (JSC::DFG::SpeculativeJIT::compile):
1690         * dfg/DFGSpeculativeJIT64.cpp:
1691         (JSC::DFG::SpeculativeJIT::compile):
1692         * heap/CardSet.h: Removed.
1693         * heap/Heap.cpp:
1694         (JSC::Heap::markRoots):
1695         (JSC::Heap::collect):
1696         * heap/Heap.h:
1697         (Heap):
1698         (JSC::Heap::shouldCollect):
1699         (JSC::Heap::isWriteBarrierEnabled):
1700         (JSC):
1701         (JSC::Heap::writeBarrier):
1702         * heap/MarkedBlock.h:
1703         (MarkedBlock):
1704         (JSC):
1705         * heap/MarkedSpace.cpp:
1706         (JSC):
1707         * jit/JITPropertyAccess.cpp:
1708         (JSC::JIT::emitWriteBarrier):
1709
1710 2013-01-29  Filip Pizlo  <fpizlo@apple.com>
1711
1712         Remove redundant AST dump method from cloop.rb, since they are already defined in ast.rb
1713         https://bugs.webkit.org/show_bug.cgi?id=108247
1714
1715         Reviewed by Oliver Hunt.
1716         
1717         Makes offlineasm dumping easier to read and less likely to cause assertion failures.
1718         Also fixes the strange situation where cloop.rb and ast.rb both defined dump methods,
1719         but cloop.rb was winning.
1720
1721         * offlineasm/cloop.rb:
1722
1723 2013-01-29  Mark Hahnenberg  <mhahnenberg@apple.com>
1724
1725         Objective-C API: JSObjCClassInfo creates reference cycle with JSContext
1726         https://bugs.webkit.org/show_bug.cgi?id=107839
1727
1728         Reviewed by Oliver Hunt.
1729
1730         JSContext has a JSWrapperMap, which has an NSMutableDictionary m_classMap, which has values that 
1731         are JSObjCClassInfo objects, which have strong references to two JSValue *'s, m_prototype and 
1732         m_constructor, which in turn have strong references to the JSContext, creating a reference cycle. 
1733         We should make m_prototype and m_constructor Weak<JSObject>. This gets rid of the strong reference 
1734         to the JSContext and also prevents clients from accidentally creating reference cycles by assigning 
1735         to the prototype of the constructor. If Weak<JSObject> fields are ever garbage collected, we will 
1736         reallocate them.
1737
1738         * API/JSContext.mm:
1739         (-[JSContext wrapperMap]):
1740         * API/JSContextInternal.h:
1741         * API/JSWrapperMap.mm:
1742         (-[JSObjCClassInfo initWithContext:forClass:superClassInfo:]):
1743         (-[JSObjCClassInfo dealloc]):
1744         (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]):
1745         (-[JSObjCClassInfo allocateConstructorAndPrototype]):
1746         (-[JSObjCClassInfo wrapperForObject:]):
1747         (-[JSObjCClassInfo constructor]):
1748
1749 2013-01-29  Oliver Hunt  <oliver@apple.com>
1750
1751         REGRESSION (r140594): RELEASE_ASSERT_NOT_REACHED in JSC::Interpreter::execute
1752         https://bugs.webkit.org/show_bug.cgi?id=108097
1753
1754         Reviewed by Geoffrey Garen.
1755
1756         LiteralParser was accepting a bogus 'var a.b = c' statement
1757
1758         * runtime/LiteralParser.cpp:
1759         (JSC::::tryJSONPParse):
1760
1761 2013-01-29  Oliver Hunt  <oliver@apple.com>
1762
1763         Force debug builds to do bounds checks on contiguous property storage
1764         https://bugs.webkit.org/show_bug.cgi?id=108212
1765
1766         Reviewed by Mark Hahnenberg.
1767
1768         Add a ContiguousData type that we use to represent contiguous property
1769         storage.  In release builds it is simply a pointer to the correct type,
1770         but in debug builds it also carries the data length and performs bounds
1771         checks.  This means we don't have to add as many manual bounds assertions
1772         when performing operations over contiguous data.
1773
1774         * dfg/DFGOperations.cpp:
1775         * runtime/ArrayStorage.h:
1776         (ArrayStorage):
1777         (JSC::ArrayStorage::vector):
1778         * runtime/Butterfly.h:
1779         (JSC::ContiguousData::ContiguousData):
1780         (ContiguousData):
1781         (JSC::ContiguousData::operator[]):
1782         (JSC::ContiguousData::data):
1783         (JSC::ContiguousData::length):
1784         (JSC):
1785         (JSC::Butterfly::contiguousInt32):
1786         (Butterfly):
1787         (JSC::Butterfly::contiguousDouble):
1788         (JSC::Butterfly::contiguous):
1789         * runtime/JSArray.cpp:
1790         (JSC::JSArray::sortNumericVector):
1791         (ContiguousTypeAccessor):
1792         (JSC::ContiguousTypeAccessor::getAsValue):
1793         (JSC::ContiguousTypeAccessor::setWithValue):
1794         (JSC::ContiguousTypeAccessor::replaceDataReference):
1795         (JSC):
1796         (JSC::JSArray::sortCompactedVector):
1797         (JSC::JSArray::sort):
1798         (JSC::JSArray::fillArgList):
1799         (JSC::JSArray::copyToArguments):
1800         * runtime/JSArray.h:
1801         (JSArray):
1802         * runtime/JSObject.cpp:
1803         (JSC::JSObject::copyButterfly):
1804         (JSC::JSObject::visitButterfly):
1805         (JSC::JSObject::createInitialInt32):
1806         (JSC::JSObject::createInitialDouble):
1807         (JSC::JSObject::createInitialContiguous):
1808         (JSC::JSObject::convertUndecidedToInt32):
1809         (JSC::JSObject::convertUndecidedToDouble):
1810         (JSC::JSObject::convertUndecidedToContiguous):
1811         (JSC::JSObject::convertInt32ToDouble):
1812         (JSC::JSObject::convertInt32ToContiguous):
1813         (JSC::JSObject::genericConvertDoubleToContiguous):
1814         (JSC::JSObject::convertDoubleToContiguous):
1815         (JSC::JSObject::rageConvertDoubleToContiguous):
1816         (JSC::JSObject::ensureInt32Slow):
1817         (JSC::JSObject::ensureDoubleSlow):
1818         (JSC::JSObject::ensureContiguousSlow):
1819         (JSC::JSObject::rageEnsureContiguousSlow):
1820         (JSC::JSObject::ensureLengthSlow):
1821         * runtime/JSObject.h:
1822         (JSC::JSObject::ensureInt32):
1823         (JSC::JSObject::ensureDouble):
1824         (JSC::JSObject::ensureContiguous):
1825         (JSC::JSObject::rageEnsureContiguous):
1826         (JSObject):
1827         (JSC::JSObject::indexingData):
1828         (JSC::JSObject::currentIndexingData):
1829
1830 2013-01-29  Brent Fulgham  <bfulgham@webkit.org>
1831
1832         [Windows, WinCairo] Unreviewed build fix after r141050
1833
1834         * JavaScriptCore.vcxproj/JavaScriptCoreExports.def: Update symbols
1835         to match JavaScriptCore.vcproj version.
1836
1837 2013-01-29  Allan Sandfeld Jensen  <allan.jensen@digia.com>
1838
1839         [Qt] Implement GCActivityCallback
1840         https://bugs.webkit.org/show_bug.cgi?id=103998
1841
1842         Reviewed by Simon Hausmann.
1843
1844         Implements the activity triggered garbage collector.
1845
1846         * runtime/GCActivityCallback.cpp:
1847         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
1848         (JSC::DefaultGCActivityCallback::scheduleTimer):
1849         (JSC::DefaultGCActivityCallback::cancelTimer):
1850         * runtime/GCActivityCallback.h:
1851         (GCActivityCallback):
1852         (DefaultGCActivityCallback):
1853
1854 2013-01-29  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
1855
1856         Compilation warning in JSC
1857         https://bugs.webkit.org/show_bug.cgi?id=108178
1858
1859         Reviewed by Kentaro Hara.
1860
1861         Fixed 'comparison between signed and unsigned integer' warning in JSC::Structure constructor.
1862
1863         * runtime/Structure.cpp:
1864         (JSC::Structure::Structure):
1865
1866 2013-01-29  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
1867
1868         [Qt] Fix the JSC build on Mac
1869
1870         Unreviewed, build fix.
1871
1872         * heap/HeapTimer.h:
1873         Qt on Mac has USE(CF) true, and should use the CF HeapTimer in that case.
1874
1875 2013-01-29  Allan Sandfeld Jensen  <allan.jensen@digia.com>
1876
1877         [Qt] Implement IncrementalSweeper and HeapTimer
1878         https://bugs.webkit.org/show_bug.cgi?id=103996
1879
1880         Reviewed by Simon Hausmann.
1881
1882         Implements the incremental sweeping garbage collection for the Qt platform.
1883
1884         * heap/HeapTimer.cpp:
1885         (JSC::HeapTimer::HeapTimer):
1886         (JSC::HeapTimer::~HeapTimer):
1887         (JSC::HeapTimer::timerEvent):
1888         (JSC::HeapTimer::synchronize):
1889         (JSC::HeapTimer::invalidate):
1890         (JSC::HeapTimer::didStartVMShutdown):
1891         * heap/HeapTimer.h:
1892         (HeapTimer):
1893         * heap/IncrementalSweeper.cpp:
1894         (JSC::IncrementalSweeper::IncrementalSweeper):
1895         (JSC::IncrementalSweeper::scheduleTimer):
1896         * heap/IncrementalSweeper.h:
1897         (IncrementalSweeper):
1898
1899 2013-01-28  Filip Pizlo  <fpizlo@apple.com>
1900
1901         DFG should not use a graph that is a vector, Nodes shouldn't move after allocation, and we should always refer to nodes by Node*
1902         https://bugs.webkit.org/show_bug.cgi?id=106868
1903
1904         Reviewed by Oliver Hunt.
1905         
1906         This adds a pool allocator for Nodes, and uses that instead of a Vector. Changes all
1907         uses of Node& and NodeIndex to be simply Node*. Nodes no longer have an index except
1908         for debugging (Node::index(), which is not guaranteed to be O(1)).
1909         
1910         1% speed-up on SunSpider, presumably because this improves compile times.
1911
1912         * CMakeLists.txt:
1913         * GNUmakefile.list.am:
1914         * JavaScriptCore.xcodeproj/project.pbxproj:
1915         * Target.pri:
1916         * bytecode/DataFormat.h:
1917         (JSC::dataFormatToString):
1918         * dfg/DFGAbstractState.cpp:
1919         (JSC::DFG::AbstractState::initialize):
1920         (JSC::DFG::AbstractState::booleanResult):
1921         (JSC::DFG::AbstractState::execute):
1922         (JSC::DFG::AbstractState::mergeStateAtTail):
1923         (JSC::DFG::AbstractState::mergeToSuccessors):
1924         (JSC::DFG::AbstractState::mergeVariableBetweenBlocks):
1925         (JSC::DFG::AbstractState::dump):
1926         * dfg/DFGAbstractState.h:
1927         (DFG):
1928         (JSC::DFG::AbstractState::forNode):
1929         (AbstractState):
1930         (JSC::DFG::AbstractState::speculateInt32Unary):
1931         (JSC::DFG::AbstractState::speculateNumberUnary):
1932         (JSC::DFG::AbstractState::speculateBooleanUnary):
1933         (JSC::DFG::AbstractState::speculateInt32Binary):
1934         (JSC::DFG::AbstractState::speculateNumberBinary):
1935         (JSC::DFG::AbstractState::trySetConstant):
1936         * dfg/DFGAbstractValue.h:
1937         (AbstractValue):
1938         * dfg/DFGAdjacencyList.h:
1939         (JSC::DFG::AdjacencyList::AdjacencyList):
1940         (JSC::DFG::AdjacencyList::initialize):
1941         * dfg/DFGAllocator.h: Added.
1942         (DFG):
1943         (Allocator):
1944         (JSC::DFG::Allocator::Region::size):
1945         (JSC::DFG::Allocator::Region::headerSize):
1946         (JSC::DFG::Allocator::Region::numberOfThingsPerRegion):
1947         (JSC::DFG::Allocator::Region::data):
1948         (JSC::DFG::Allocator::Region::isInThisRegion):
1949         (JSC::DFG::Allocator::Region::regionFor):
1950         (Region):
1951         (JSC::DFG::::Allocator):
1952         (JSC::DFG::::~Allocator):
1953         (JSC::DFG::::allocate):
1954         (JSC::DFG::::free):
1955         (JSC::DFG::::freeAll):
1956         (JSC::DFG::::reset):
1957         (JSC::DFG::::indexOf):
1958         (JSC::DFG::::allocatorOf):
1959         (JSC::DFG::::bumpAllocate):
1960         (JSC::DFG::::freeListAllocate):
1961         (JSC::DFG::::allocateSlow):
1962         (JSC::DFG::::freeRegionsStartingAt):
1963         (JSC::DFG::::startBumpingIn):
1964         * dfg/DFGArgumentsSimplificationPhase.cpp:
1965         (JSC::DFG::ArgumentsSimplificationPhase::run):
1966         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
1967         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
1968         (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
1969         (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
1970         (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
1971         * dfg/DFGArrayMode.cpp:
1972         (JSC::DFG::ArrayMode::originalArrayStructure):
1973         (JSC::DFG::ArrayMode::alreadyChecked):
1974         * dfg/DFGArrayMode.h:
1975         (ArrayMode):
1976         * dfg/DFGArrayifySlowPathGenerator.h:
1977         (JSC::DFG::ArrayifySlowPathGenerator::ArrayifySlowPathGenerator):
1978         * dfg/DFGBasicBlock.h:
1979         (JSC::DFG::BasicBlock::node):
1980         (JSC::DFG::BasicBlock::isInPhis):
1981         (JSC::DFG::BasicBlock::isInBlock):
1982         (BasicBlock):
1983         * dfg/DFGBasicBlockInlines.h:
1984         (DFG):
1985         * dfg/DFGByteCodeParser.cpp:
1986         (ByteCodeParser):
1987         (JSC::DFG::ByteCodeParser::getDirect):
1988         (JSC::DFG::ByteCodeParser::get):
1989         (JSC::DFG::ByteCodeParser::setDirect):
1990         (JSC::DFG::ByteCodeParser::set):
1991         (JSC::DFG::ByteCodeParser::setPair):
1992         (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
1993         (JSC::DFG::ByteCodeParser::getLocal):
1994         (JSC::DFG::ByteCodeParser::setLocal):
1995         (JSC::DFG::ByteCodeParser::getArgument):
1996         (JSC::DFG::ByteCodeParser::setArgument):
1997         (JSC::DFG::ByteCodeParser::flushDirect):
1998         (JSC::DFG::ByteCodeParser::getToInt32):
1999         (JSC::DFG::ByteCodeParser::toInt32):
2000         (JSC::DFG::ByteCodeParser::getJSConstantForValue):
2001         (JSC::DFG::ByteCodeParser::getJSConstant):
2002         (JSC::DFG::ByteCodeParser::getCallee):
2003         (JSC::DFG::ByteCodeParser::getThis):
2004         (JSC::DFG::ByteCodeParser::setThis):
2005         (JSC::DFG::ByteCodeParser::isJSConstant):
2006         (JSC::DFG::ByteCodeParser::isInt32Constant):
2007         (JSC::DFG::ByteCodeParser::valueOfJSConstant):
2008         (JSC::DFG::ByteCodeParser::valueOfInt32Constant):
2009         (JSC::DFG::ByteCodeParser::constantUndefined):
2010         (JSC::DFG::ByteCodeParser::constantNull):
2011         (JSC::DFG::ByteCodeParser::one):
2012         (JSC::DFG::ByteCodeParser::constantNaN):
2013         (JSC::DFG::ByteCodeParser::cellConstant):
2014         (JSC::DFG::ByteCodeParser::addToGraph):
2015         (JSC::DFG::ByteCodeParser::insertPhiNode):
2016         (JSC::DFG::ByteCodeParser::addVarArgChild):
2017         (JSC::DFG::ByteCodeParser::addCall):
2018         (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
2019         (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
2020         (JSC::DFG::ByteCodeParser::getPrediction):
2021         (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
2022         (JSC::DFG::ByteCodeParser::makeSafe):
2023         (JSC::DFG::ByteCodeParser::makeDivSafe):
2024         (JSC::DFG::ByteCodeParser::ConstantRecord::ConstantRecord):
2025         (ConstantRecord):
2026         (JSC::DFG::ByteCodeParser::PhiStackEntry::PhiStackEntry):
2027         (PhiStackEntry):
2028         (JSC::DFG::ByteCodeParser::handleCall):
2029         (JSC::DFG::ByteCodeParser::emitFunctionChecks):
2030         (JSC::DFG::ByteCodeParser::handleInlining):
2031         (JSC::DFG::ByteCodeParser::setIntrinsicResult):
2032         (JSC::DFG::ByteCodeParser::handleMinMax):
2033         (JSC::DFG::ByteCodeParser::handleIntrinsic):
2034         (JSC::DFG::ByteCodeParser::handleGetByOffset):
2035         (JSC::DFG::ByteCodeParser::handleGetById):
2036         (JSC::DFG::ByteCodeParser::getScope):
2037         (JSC::DFG::ByteCodeParser::parseResolveOperations):
2038         (JSC::DFG::ByteCodeParser::parseBlock):
2039         (JSC::DFG::ByteCodeParser::processPhiStack):
2040         (JSC::DFG::ByteCodeParser::linkBlock):
2041         (JSC::DFG::ByteCodeParser::parseCodeBlock):
2042         (JSC::DFG::ByteCodeParser::parse):
2043         * dfg/DFGCFAPhase.cpp:
2044         (JSC::DFG::CFAPhase::performBlockCFA):
2045         * dfg/DFGCFGSimplificationPhase.cpp:
2046         (JSC::DFG::CFGSimplificationPhase::run):
2047         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
2048         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
2049         (JSC::DFG::CFGSimplificationPhase::fixPhis):
2050         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
2051         (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::OperandSubstitution):
2052         (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::dump):
2053         (OperandSubstitution):
2054         (JSC::DFG::CFGSimplificationPhase::skipGetLocal):
2055         (JSC::DFG::CFGSimplificationPhase::recordNewTarget):
2056         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
2057         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
2058         * dfg/DFGCSEPhase.cpp:
2059         (JSC::DFG::CSEPhase::canonicalize):
2060         (JSC::DFG::CSEPhase::endIndexForPureCSE):
2061         (JSC::DFG::CSEPhase::pureCSE):
2062         (JSC::DFG::CSEPhase::constantCSE):
2063         (JSC::DFG::CSEPhase::weakConstantCSE):
2064         (JSC::DFG::CSEPhase::getCalleeLoadElimination):
2065         (JSC::DFG::CSEPhase::getArrayLengthElimination):
2066         (JSC::DFG::CSEPhase::globalVarLoadElimination):
2067         (JSC::DFG::CSEPhase::scopedVarLoadElimination):
2068         (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
2069         (JSC::DFG::CSEPhase::globalVarStoreElimination):
2070         (JSC::DFG::CSEPhase::scopedVarStoreElimination):
2071         (JSC::DFG::CSEPhase::getByValLoadElimination):
2072         (JSC::DFG::CSEPhase::checkFunctionElimination):
2073         (JSC::DFG::CSEPhase::checkExecutableElimination):
2074         (JSC::DFG::CSEPhase::checkStructureElimination):
2075         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
2076         (JSC::DFG::CSEPhase::putStructureStoreElimination):
2077         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
2078         (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
2079         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
2080         (JSC::DFG::CSEPhase::checkArrayElimination):
2081         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
2082         (JSC::DFG::CSEPhase::getMyScopeLoadElimination):
2083         (JSC::DFG::CSEPhase::getLocalLoadElimination):
2084         (JSC::DFG::CSEPhase::setLocalStoreElimination):
2085         (JSC::DFG::CSEPhase::performSubstitution):
2086         (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
2087         (JSC::DFG::CSEPhase::setReplacement):
2088         (JSC::DFG::CSEPhase::eliminate):
2089         (JSC::DFG::CSEPhase::performNodeCSE):
2090         (JSC::DFG::CSEPhase::performBlockCSE):
2091         (CSEPhase):
2092         * dfg/DFGCommon.cpp: Added.
2093         (DFG):
2094         (JSC::DFG::NodePointerTraits::dump):
2095         * dfg/DFGCommon.h:
2096         (DFG):
2097         (JSC::DFG::NodePointerTraits::defaultValue):
2098         (NodePointerTraits):
2099         (JSC::DFG::verboseCompilationEnabled):
2100         (JSC::DFG::shouldDumpGraphAtEachPhase):
2101         (JSC::DFG::validationEnabled):
2102         * dfg/DFGConstantFoldingPhase.cpp:
2103         (JSC::DFG::ConstantFoldingPhase::foldConstants):
2104         (JSC::DFG::ConstantFoldingPhase::isCapturedAtOrAfter):
2105         (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
2106         (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
2107         * dfg/DFGDisassembler.cpp:
2108         (JSC::DFG::Disassembler::Disassembler):
2109         (JSC::DFG::Disassembler::createDumpList):
2110         (JSC::DFG::Disassembler::dumpDisassembly):
2111         * dfg/DFGDisassembler.h:
2112         (JSC::DFG::Disassembler::setForNode):
2113         (Disassembler):
2114         * dfg/DFGDriver.cpp:
2115         (JSC::DFG::compile):
2116         * dfg/DFGEdge.cpp: Added.
2117         (DFG):
2118         (JSC::DFG::Edge::dump):
2119         * dfg/DFGEdge.h:
2120         (JSC::DFG::Edge::Edge):
2121         (JSC::DFG::Edge::node):
2122         (JSC::DFG::Edge::operator*):
2123         (JSC::DFG::Edge::operator->):
2124         (Edge):
2125         (JSC::DFG::Edge::setNode):
2126         (JSC::DFG::Edge::useKind):
2127         (JSC::DFG::Edge::setUseKind):
2128         (JSC::DFG::Edge::isSet):
2129         (JSC::DFG::Edge::shift):
2130         (JSC::DFG::Edge::makeWord):
2131         (JSC::DFG::operator==):
2132         (JSC::DFG::operator!=):
2133         * dfg/DFGFixupPhase.cpp:
2134         (JSC::DFG::FixupPhase::fixupBlock):
2135         (JSC::DFG::FixupPhase::fixupNode):
2136         (JSC::DFG::FixupPhase::checkArray):
2137         (JSC::DFG::FixupPhase::blessArrayOperation):
2138         (JSC::DFG::FixupPhase::fixIntEdge):
2139         (JSC::DFG::FixupPhase::fixDoubleEdge):
2140         (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
2141         (FixupPhase):
2142         * dfg/DFGGenerationInfo.h:
2143         (JSC::DFG::GenerationInfo::GenerationInfo):
2144         (JSC::DFG::GenerationInfo::initConstant):
2145         (JSC::DFG::GenerationInfo::initInteger):
2146         (JSC::DFG::GenerationInfo::initJSValue):
2147         (JSC::DFG::GenerationInfo::initCell):
2148         (JSC::DFG::GenerationInfo::initBoolean):
2149         (JSC::DFG::GenerationInfo::initDouble):
2150         (JSC::DFG::GenerationInfo::initStorage):
2151         (GenerationInfo):
2152         (JSC::DFG::GenerationInfo::node):
2153         (JSC::DFG::GenerationInfo::noticeOSRBirth):
2154         (JSC::DFG::GenerationInfo::use):
2155         (JSC::DFG::GenerationInfo::appendFill):
2156         (JSC::DFG::GenerationInfo::appendSpill):
2157         * dfg/DFGGraph.cpp:
2158         (JSC::DFG::Graph::Graph):
2159         (JSC::DFG::Graph::~Graph):
2160         (DFG):
2161         (JSC::DFG::Graph::dumpCodeOrigin):
2162         (JSC::DFG::Graph::amountOfNodeWhiteSpace):
2163         (JSC::DFG::Graph::printNodeWhiteSpace):
2164         (JSC::DFG::Graph::dump):
2165         (JSC::DFG::Graph::dumpBlockHeader):
2166         (JSC::DFG::Graph::refChildren):
2167         (JSC::DFG::Graph::derefChildren):
2168         (JSC::DFG::Graph::predictArgumentTypes):
2169         (JSC::DFG::Graph::collectGarbage):
2170         (JSC::DFG::Graph::determineReachability):
2171         (JSC::DFG::Graph::resetExitStates):
2172         * dfg/DFGGraph.h:
2173         (Graph):
2174         (JSC::DFG::Graph::ref):
2175         (JSC::DFG::Graph::deref):
2176         (JSC::DFG::Graph::changeChild):
2177         (JSC::DFG::Graph::compareAndSwap):
2178         (JSC::DFG::Graph::clearAndDerefChild):
2179         (JSC::DFG::Graph::clearAndDerefChild1):
2180         (JSC::DFG::Graph::clearAndDerefChild2):
2181         (JSC::DFG::Graph::clearAndDerefChild3):
2182         (JSC::DFG::Graph::convertToConstant):
2183         (JSC::DFG::Graph::getJSConstantSpeculation):
2184         (JSC::DFG::Graph::addSpeculationMode):
2185         (JSC::DFG::Graph::valueAddSpeculationMode):
2186         (JSC::DFG::Graph::arithAddSpeculationMode):
2187         (JSC::DFG::Graph::addShouldSpeculateInteger):
2188         (JSC::DFG::Graph::mulShouldSpeculateInteger):
2189         (JSC::DFG::Graph::negateShouldSpeculateInteger):
2190         (JSC::DFG::Graph::isConstant):
2191         (JSC::DFG::Graph::isJSConstant):
2192         (JSC::DFG::Graph::isInt32Constant):
2193         (JSC::DFG::Graph::isDoubleConstant):
2194         (JSC::DFG::Graph::isNumberConstant):
2195         (JSC::DFG::Graph::isBooleanConstant):
2196         (JSC::DFG::Graph::isCellConstant):
2197         (JSC::DFG::Graph::isFunctionConstant):
2198         (JSC::DFG::Graph::isInternalFunctionConstant):
2199         (JSC::DFG::Graph::valueOfJSConstant):
2200         (JSC::DFG::Graph::valueOfInt32Constant):
2201         (JSC::DFG::Graph::valueOfNumberConstant):
2202         (JSC::DFG::Graph::valueOfBooleanConstant):
2203         (JSC::DFG::Graph::valueOfFunctionConstant):
2204         (JSC::DFG::Graph::valueProfileFor):
2205         (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
2206         (JSC::DFG::Graph::numSuccessors):
2207         (JSC::DFG::Graph::successor):
2208         (JSC::DFG::Graph::successorForCondition):
2209         (JSC::DFG::Graph::isPredictedNumerical):
2210         (JSC::DFG::Graph::byValIsPure):
2211         (JSC::DFG::Graph::clobbersWorld):
2212         (JSC::DFG::Graph::varArgNumChildren):
2213         (JSC::DFG::Graph::numChildren):
2214         (JSC::DFG::Graph::varArgChild):
2215         (JSC::DFG::Graph::child):
2216         (JSC::DFG::Graph::voteNode):
2217         (JSC::DFG::Graph::voteChildren):
2218         (JSC::DFG::Graph::substitute):
2219         (JSC::DFG::Graph::substituteGetLocal):
2220         (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
2221         (JSC::DFG::Graph::mulImmediateShouldSpeculateInteger):
2222         * dfg/DFGInsertionSet.h:
2223         (JSC::DFG::Insertion::Insertion):
2224         (JSC::DFG::Insertion::element):
2225         (Insertion):
2226         (JSC::DFG::InsertionSet::insert):
2227         (InsertionSet):
2228         * dfg/DFGJITCompiler.cpp:
2229         * dfg/DFGJITCompiler.h:
2230         (JSC::DFG::JITCompiler::setForNode):
2231         (JSC::DFG::JITCompiler::addressOfDoubleConstant):
2232         (JSC::DFG::JITCompiler::noticeOSREntry):
2233         * dfg/DFGLongLivedState.cpp: Added.
2234         (DFG):
2235         (JSC::DFG::LongLivedState::LongLivedState):
2236         (JSC::DFG::LongLivedState::~LongLivedState):
2237         (JSC::DFG::LongLivedState::shrinkToFit):
2238         * dfg/DFGLongLivedState.h: Added.
2239         (DFG):
2240         (LongLivedState):
2241         * dfg/DFGMinifiedID.h:
2242         (JSC::DFG::MinifiedID::MinifiedID):
2243         (JSC::DFG::MinifiedID::node):
2244         * dfg/DFGMinifiedNode.cpp:
2245         (JSC::DFG::MinifiedNode::fromNode):
2246         * dfg/DFGMinifiedNode.h:
2247         (MinifiedNode):
2248         * dfg/DFGNode.cpp: Added.
2249         (DFG):
2250         (JSC::DFG::Node::index):
2251         (WTF):
2252         (WTF::printInternal):
2253         * dfg/DFGNode.h:
2254         (DFG):
2255         (JSC::DFG::Node::Node):
2256         (Node):
2257         (JSC::DFG::Node::convertToGetByOffset):
2258         (JSC::DFG::Node::convertToPutByOffset):
2259         (JSC::DFG::Node::ref):
2260         (JSC::DFG::Node::shouldSpeculateInteger):
2261         (JSC::DFG::Node::shouldSpeculateIntegerForArithmetic):
2262         (JSC::DFG::Node::shouldSpeculateIntegerExpectingDefined):
2263         (JSC::DFG::Node::shouldSpeculateDoubleForArithmetic):
2264         (JSC::DFG::Node::shouldSpeculateNumber):
2265         (JSC::DFG::Node::shouldSpeculateNumberExpectingDefined):
2266         (JSC::DFG::Node::shouldSpeculateFinalObject):
2267         (JSC::DFG::Node::shouldSpeculateArray):
2268         (JSC::DFG::Node::dumpChildren):
2269         (WTF):
2270         * dfg/DFGNodeAllocator.h: Added.
2271         (DFG):
2272         (operator new ):
2273         * dfg/DFGOSRExit.cpp:
2274         (JSC::DFG::OSRExit::OSRExit):
2275         * dfg/DFGOSRExit.h:
2276         (OSRExit):
2277         (SpeculationFailureDebugInfo):
2278         * dfg/DFGOSRExitCompiler.cpp:
2279         * dfg/DFGOSRExitCompiler32_64.cpp:
2280         (JSC::DFG::OSRExitCompiler::compileExit):
2281         * dfg/DFGOSRExitCompiler64.cpp:
2282         (JSC::DFG::OSRExitCompiler::compileExit):
2283         * dfg/DFGOperations.cpp:
2284         * dfg/DFGPhase.cpp:
2285         (DFG):
2286         (JSC::DFG::Phase::beginPhase):
2287         (JSC::DFG::Phase::endPhase):
2288         * dfg/DFGPhase.h:
2289         (Phase):
2290         (JSC::DFG::runAndLog):
2291         * dfg/DFGPredictionPropagationPhase.cpp:
2292         (JSC::DFG::PredictionPropagationPhase::setPrediction):
2293         (JSC::DFG::PredictionPropagationPhase::mergePrediction):
2294         (JSC::DFG::PredictionPropagationPhase::isNotNegZero):
2295         (JSC::DFG::PredictionPropagationPhase::isNotZero):
2296         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoForConstant):
2297         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoNonRecursive):
2298         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwo):
2299         (JSC::DFG::PredictionPropagationPhase::propagate):
2300         (JSC::DFG::PredictionPropagationPhase::mergeDefaultFlags):
2301         (JSC::DFG::PredictionPropagationPhase::propagateForward):
2302         (JSC::DFG::PredictionPropagationPhase::propagateBackward):
2303         (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
2304         (PredictionPropagationPhase):
2305         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
2306         * dfg/DFGScoreBoard.h:
2307         (JSC::DFG::ScoreBoard::ScoreBoard):
2308         (JSC::DFG::ScoreBoard::use):
2309         (JSC::DFG::ScoreBoard::useIfHasResult):
2310         (ScoreBoard):
2311         * dfg/DFGSilentRegisterSavePlan.h:
2312         (JSC::DFG::SilentRegisterSavePlan::SilentRegisterSavePlan):
2313         (JSC::DFG::SilentRegisterSavePlan::node):
2314         (SilentRegisterSavePlan):
2315         * dfg/DFGSlowPathGenerator.h:
2316         (JSC::DFG::SlowPathGenerator::SlowPathGenerator):
2317         (JSC::DFG::SlowPathGenerator::generate):
2318         (SlowPathGenerator):
2319         * dfg/DFGSpeculativeJIT.cpp:
2320         (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
2321         (JSC::DFG::SpeculativeJIT::speculationCheck):
2322         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
2323         (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
2324         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
2325         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
2326         (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
2327         (JSC::DFG::SpeculativeJIT::silentSavePlanForFPR):
2328         (JSC::DFG::SpeculativeJIT::silentSpill):
2329         (JSC::DFG::SpeculativeJIT::silentFill):
2330         (JSC::DFG::SpeculativeJIT::checkArray):
2331         (JSC::DFG::SpeculativeJIT::arrayify):
2332         (JSC::DFG::SpeculativeJIT::fillStorage):
2333         (JSC::DFG::SpeculativeJIT::useChildren):
2334         (JSC::DFG::SpeculativeJIT::isStrictInt32):
2335         (JSC::DFG::SpeculativeJIT::isKnownInteger):
2336         (JSC::DFG::SpeculativeJIT::isKnownNumeric):
2337         (JSC::DFG::SpeculativeJIT::isKnownCell):
2338         (JSC::DFG::SpeculativeJIT::isKnownNotCell):
2339         (JSC::DFG::SpeculativeJIT::isKnownNotInteger):
2340         (JSC::DFG::SpeculativeJIT::isKnownNotNumber):
2341         (JSC::DFG::SpeculativeJIT::writeBarrier):
2342         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare):
2343         (JSC::DFG::SpeculativeJIT::nonSpeculativeStrictEq):
2344         (JSC::DFG::GPRTemporary::GPRTemporary):
2345         (JSC::DFG::FPRTemporary::FPRTemporary):
2346         (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
2347         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
2348         (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
2349         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
2350         (JSC::DFG::SpeculativeJIT::noticeOSRBirth):
2351         (JSC::DFG::SpeculativeJIT::compileMovHint):
2352         (JSC::DFG::SpeculativeJIT::compile):
2353         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
2354         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
2355         (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
2356         (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
2357         (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
2358         (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
2359         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
2360         (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
2361         (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
2362         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
2363         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
2364         (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
2365         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
2366         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
2367         (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
2368         (JSC::DFG::SpeculativeJIT::compileInstanceOf):
2369         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
2370         (JSC::DFG::SpeculativeJIT::compileAdd):
2371         (JSC::DFG::SpeculativeJIT::compileArithSub):
2372         (JSC::DFG::SpeculativeJIT::compileArithNegate):
2373         (JSC::DFG::SpeculativeJIT::compileArithMul):
2374         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86):
2375         (JSC::DFG::SpeculativeJIT::compileArithMod):
2376         (JSC::DFG::SpeculativeJIT::compare):
2377         (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
2378         (JSC::DFG::SpeculativeJIT::compileStrictEq):
2379         (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
2380         (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
2381         (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
2382         (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
2383         (JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck):
2384         (JSC::DFG::SpeculativeJIT::compileNewFunctionExpression):
2385         (JSC::DFG::SpeculativeJIT::compileRegExpExec):
2386         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
2387         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
2388         * dfg/DFGSpeculativeJIT.h:
2389         (SpeculativeJIT):
2390         (JSC::DFG::SpeculativeJIT::canReuse):
2391         (JSC::DFG::SpeculativeJIT::isFilled):
2392         (JSC::DFG::SpeculativeJIT::isFilledDouble):
2393         (JSC::DFG::SpeculativeJIT::use):
2394         (JSC::DFG::SpeculativeJIT::isConstant):
2395         (JSC::DFG::SpeculativeJIT::isJSConstant):
2396         (JSC::DFG::SpeculativeJIT::isInt32Constant):
2397         (JSC::DFG::SpeculativeJIT::isDoubleConstant):
2398         (JSC::DFG::SpeculativeJIT::isNumberConstant):
2399         (JSC::DFG::SpeculativeJIT::isBooleanConstant):
2400         (JSC::DFG::SpeculativeJIT::isFunctionConstant):
2401         (JSC::DFG::SpeculativeJIT::valueOfInt32Constant):
2402         (JSC::DFG::SpeculativeJIT::valueOfNumberConstant):
2403         (JSC::DFG::SpeculativeJIT::valueOfNumberConstantAsInt32):
2404         (JSC::DFG::SpeculativeJIT::addressOfDoubleConstant):
2405         (JSC::DFG::SpeculativeJIT::valueOfJSConstant):
2406         (JSC::DFG::SpeculativeJIT::valueOfBooleanConstant):
2407         (JSC::DFG::SpeculativeJIT::valueOfFunctionConstant):
2408         (JSC::DFG::SpeculativeJIT::isNullConstant):
2409         (JSC::DFG::SpeculativeJIT::valueOfJSConstantAsImm64):
2410         (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
2411         (JSC::DFG::SpeculativeJIT::integerResult):
2412         (JSC::DFG::SpeculativeJIT::noResult):
2413         (JSC::DFG::SpeculativeJIT::cellResult):
2414         (JSC::DFG::SpeculativeJIT::booleanResult):
2415         (JSC::DFG::SpeculativeJIT::jsValueResult):
2416         (JSC::DFG::SpeculativeJIT::storageResult):
2417         (JSC::DFG::SpeculativeJIT::doubleResult):
2418         (JSC::DFG::SpeculativeJIT::initConstantInfo):
2419         (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
2420         (JSC::DFG::SpeculativeJIT::isInteger):
2421         (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
2422         (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
2423         (JSC::DFG::SpeculativeJIT::setNodeForOperand):
2424         (JSC::DFG::IntegerOperand::IntegerOperand):
2425         (JSC::DFG::IntegerOperand::node):
2426         (JSC::DFG::IntegerOperand::gpr):
2427         (JSC::DFG::IntegerOperand::use):
2428         (IntegerOperand):
2429         (JSC::DFG::DoubleOperand::DoubleOperand):
2430         (JSC::DFG::DoubleOperand::node):
2431         (JSC::DFG::DoubleOperand::fpr):
2432         (JSC::DFG::DoubleOperand::use):
2433         (DoubleOperand):
2434         (JSC::DFG::JSValueOperand::JSValueOperand):
2435         (JSC::DFG::JSValueOperand::node):
2436         (JSC::DFG::JSValueOperand::gpr):
2437         (JSC::DFG::JSValueOperand::fill):
2438         (JSC::DFG::JSValueOperand::use):
2439         (JSValueOperand):
2440         (JSC::DFG::StorageOperand::StorageOperand):
2441         (JSC::DFG::StorageOperand::node):
2442         (JSC::DFG::StorageOperand::gpr):
2443         (JSC::DFG::StorageOperand::use):
2444         (StorageOperand):
2445         (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
2446         (JSC::DFG::SpeculateIntegerOperand::node):
2447         (JSC::DFG::SpeculateIntegerOperand::gpr):
2448         (JSC::DFG::SpeculateIntegerOperand::use):
2449         (SpeculateIntegerOperand):
2450         (JSC::DFG::SpeculateStrictInt32Operand::SpeculateStrictInt32Operand):
2451         (JSC::DFG::SpeculateStrictInt32Operand::node):
2452         (JSC::DFG::SpeculateStrictInt32Operand::gpr):
2453         (JSC::DFG::SpeculateStrictInt32Operand::use):
2454         (SpeculateStrictInt32Operand):
2455         (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
2456         (JSC::DFG::SpeculateDoubleOperand::node):
2457         (JSC::DFG::SpeculateDoubleOperand::fpr):
2458         (JSC::DFG::SpeculateDoubleOperand::use):
2459         (SpeculateDoubleOperand):
2460         (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
2461         (JSC::DFG::SpeculateCellOperand::node):
2462         (JSC::DFG::SpeculateCellOperand::gpr):
2463         (JSC::DFG::SpeculateCellOperand::use):
2464         (SpeculateCellOperand):
2465         (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
2466         (JSC::DFG::SpeculateBooleanOperand::node):
2467         (JSC::DFG::SpeculateBooleanOperand::gpr):
2468         (JSC::DFG::SpeculateBooleanOperand::use):
2469         (SpeculateBooleanOperand):
2470         * dfg/DFGSpeculativeJIT32_64.cpp:
2471         (JSC::DFG::SpeculativeJIT::fillInteger):
2472         (JSC::DFG::SpeculativeJIT::fillDouble):
2473         (JSC::DFG::SpeculativeJIT::fillJSValue):
2474         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
2475         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
2476         (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
2477         (JSC::DFG::SpeculativeJIT::cachedPutById):
2478         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
2479         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
2480         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
2481         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
2482         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
2483         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
2484         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
2485         (JSC::DFG::SpeculativeJIT::emitCall):
2486         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
2487         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
2488         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
2489         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
2490         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
2491         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
2492         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
2493         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
2494         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
2495         (JSC::DFG::SpeculativeJIT::compileIntegerCompare):
2496         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
2497         (JSC::DFG::SpeculativeJIT::compileValueAdd):
2498         (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
2499         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
2500         (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
2501         (JSC::DFG::SpeculativeJIT::emitBranch):
2502         (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
2503         (JSC::DFG::SpeculativeJIT::compile):
2504         * dfg/DFGSpeculativeJIT64.cpp:
2505         (JSC::DFG::SpeculativeJIT::fillInteger):
2506         (JSC::DFG::SpeculativeJIT::fillDouble):
2507         (JSC::DFG::SpeculativeJIT::fillJSValue):
2508         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
2509         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
2510         (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
2511         (JSC::DFG::SpeculativeJIT::cachedPutById):
2512         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
2513         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
2514         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
2515         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
2516         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
2517         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
2518         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
2519         (JSC::DFG::SpeculativeJIT::emitCall):
2520         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
2521         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
2522         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
2523         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
2524         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
2525         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
2526         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
2527         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
2528         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
2529         (JSC::DFG::SpeculativeJIT::compileIntegerCompare):
2530         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
2531         (JSC::DFG::SpeculativeJIT::compileValueAdd):
2532         (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
2533         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
2534         (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
2535         (JSC::DFG::SpeculativeJIT::emitBranch):
2536         (JSC::DFG::SpeculativeJIT::compile):
2537         * dfg/DFGStructureAbstractValue.h:
2538         (StructureAbstractValue):
2539         * dfg/DFGStructureCheckHoistingPhase.cpp:
2540         (JSC::DFG::StructureCheckHoistingPhase::run):
2541         * dfg/DFGValidate.cpp:
2542         (DFG):
2543         (Validate):
2544         (JSC::DFG::Validate::validate):
2545         (JSC::DFG::Validate::reportValidationContext):
2546         * dfg/DFGValidate.h:
2547         * dfg/DFGValueSource.cpp:
2548         (JSC::DFG::ValueSource::dump):
2549         * dfg/DFGValueSource.h:
2550         (JSC::DFG::ValueSource::ValueSource):
2551         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
2552         (JSC::DFG::VirtualRegisterAllocationPhase::run):
2553         * runtime/FunctionExecutableDump.cpp: Added.
2554         (JSC):
2555         (JSC::FunctionExecutableDump::dump):
2556         * runtime/FunctionExecutableDump.h: Added.
2557         (JSC):
2558         (FunctionExecutableDump):
2559         (JSC::FunctionExecutableDump::FunctionExecutableDump):
2560         * runtime/JSGlobalData.cpp:
2561         (JSC::JSGlobalData::JSGlobalData):
2562         * runtime/JSGlobalData.h:
2563         (JSC):
2564         (DFG):
2565         (JSGlobalData):
2566         * runtime/Options.h:
2567         (JSC):
2568
2569 2013-01-28  Laszlo Gombos  <l.gombos@samsung.com>
2570
2571         Collapse testing for a list of PLATFORM() into OS() and USE() tests
2572         https://bugs.webkit.org/show_bug.cgi?id=108018
2573
2574         Reviewed by Eric Seidel.
2575
2576         No functional change as "OS(DARWIN) && USE(CF)" equals to the
2577         following platforms: MAC, WX, QT and CHROMIUM. CHROMIUM
2578         is not using JavaScriptCore. 
2579
2580         * runtime/DatePrototype.cpp:
2581         (JSC):
2582
2583 2013-01-28  Geoffrey Garen  <ggaren@apple.com>
2584
2585         Static size inference for JavaScript objects
2586         https://bugs.webkit.org/show_bug.cgi?id=108093
2587
2588         Reviewed by Phil Pizlo.
2589
2590         * API/JSObjectRef.cpp:
2591         * JavaScriptCore.order:
2592         * JavaScriptCore.xcodeproj/project.pbxproj: Pay the tax man.
2593
2594         * bytecode/CodeBlock.cpp:
2595         (JSC::CodeBlock::dumpBytecode): op_new_object and op_create_this now
2596         have an extra inferredInlineCapacity argument. This is the statically
2597         inferred inline capacity, just from analyzing source text. op_new_object
2598         also gets a pointer to an allocation profile. (For op_create_this, the
2599         profile is in the construtor function.)
2600
2601         (JSC::CodeBlock::CodeBlock): Link op_new_object.
2602
2603         (JSC::CodeBlock::stronglyVisitStrongReferences): Mark our profiles.
2604
2605         * bytecode/CodeBlock.h:
2606         (CodeBlock): Removed some dead code. Added object allocation profiles.
2607
2608         * bytecode/Instruction.h:
2609         (JSC): New union type, since an instruction operand may point to an
2610         object allocation profile now.
2611
2612         * bytecode/ObjectAllocationProfile.h: Added.
2613         (JSC):
2614         (ObjectAllocationProfile):
2615         (JSC::ObjectAllocationProfile::offsetOfAllocator):
2616         (JSC::ObjectAllocationProfile::offsetOfStructure):
2617         (JSC::ObjectAllocationProfile::ObjectAllocationProfile):
2618         (JSC::ObjectAllocationProfile::isNull):
2619         (JSC::ObjectAllocationProfile::initialize):
2620         (JSC::ObjectAllocationProfile::structure):
2621         (JSC::ObjectAllocationProfile::inlineCapacity):
2622         (JSC::ObjectAllocationProfile::clear):
2623         (JSC::ObjectAllocationProfile::visitAggregate):
2624         (JSC::ObjectAllocationProfile::possibleDefaultPropertyCount): New class
2625         for tracking a prediction about object allocation: structure, inline
2626         capacity, allocator to use.
2627
2628         * bytecode/Opcode.h:
2629         (JSC):
2630         (JSC::padOpcodeName): Updated instruction sizes.
2631
2632         * bytecode/UnlinkedCodeBlock.cpp:
2633         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
2634         * bytecode/UnlinkedCodeBlock.h:
2635         (JSC):
2636         (JSC::UnlinkedCodeBlock::addObjectAllocationProfile):
2637         (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles):
2638         (UnlinkedCodeBlock): Unlinked support for allocation profiles.
2639
2640         * bytecompiler/BytecodeGenerator.cpp:
2641         (JSC::BytecodeGenerator::generate): Kill all remaining analyses at the
2642         end of codegen, since this is our last opportunity.
2643
2644         (JSC::BytecodeGenerator::BytecodeGenerator): Added a static property
2645         analyzer to bytecode generation. It tracks initializing assignments and
2646         makes a guess about how many will happen.
2647
2648         (JSC::BytecodeGenerator::newObjectAllocationProfile):
2649         (JSC):
2650         (JSC::BytecodeGenerator::emitProfiledOpcode):
2651         (JSC::BytecodeGenerator::emitMove):
2652         (JSC::BytecodeGenerator::emitResolve):
2653         (JSC::BytecodeGenerator::emitResolveBase):
2654         (JSC::BytecodeGenerator::emitResolveBaseForPut):
2655         (JSC::BytecodeGenerator::emitResolveWithBaseForPut):
2656         (JSC::BytecodeGenerator::emitResolveWithThis):
2657         (JSC::BytecodeGenerator::emitGetById):
2658         (JSC::BytecodeGenerator::emitPutById):
2659         (JSC::BytecodeGenerator::emitDirectPutById):
2660         (JSC::BytecodeGenerator::emitPutGetterSetter):
2661         (JSC::BytecodeGenerator::emitGetArgumentByVal):
2662         (JSC::BytecodeGenerator::emitGetByVal): Added hooks to the static property
2663         analyzer, so it can observe allocations and stores.
2664
2665         (JSC::BytecodeGenerator::emitCreateThis): Factored this into a helper
2666         function because it was a significant amount of logic, and I wanted to
2667         add to it.
2668
2669         (JSC::BytecodeGenerator::emitNewObject):
2670         (JSC::BytecodeGenerator::emitExpectedFunctionSnippet):
2671         (JSC::BytecodeGenerator::emitCall):
2672         (JSC::BytecodeGenerator::emitCallVarargs):
2673         (JSC::BytecodeGenerator::emitConstruct): Added a hook to profiled opcodes
2674         to track their stores, in case a store kills a profiled allocation. Since
2675         profiled opcodes are basically the only interesting stores we do, this
2676         is a convenient place to notice any store that might kill an allocation.
2677
2678         * bytecompiler/BytecodeGenerator.h:
2679         (BytecodeGenerator): As above.
2680
2681         * bytecompiler/StaticPropertyAnalysis.h: Added.
2682         (JSC):
2683         (StaticPropertyAnalysis):
2684         (JSC::StaticPropertyAnalysis::create):
2685         (JSC::StaticPropertyAnalysis::addPropertyIndex):
2686         (JSC::StaticPropertyAnalysis::record):
2687         (JSC::StaticPropertyAnalysis::propertyIndexCount):
2688         (JSC::StaticPropertyAnalysis::StaticPropertyAnalysis): Simple helper
2689         class for tracking allocations and stores.
2690
2691         * bytecompiler/StaticPropertyAnalyzer.h: Added.
2692         (StaticPropertyAnalyzer):
2693         (JSC::StaticPropertyAnalyzer::StaticPropertyAnalyzer):
2694         (JSC::StaticPropertyAnalyzer::createThis):
2695         (JSC::StaticPropertyAnalyzer::newObject):
2696         (JSC::StaticPropertyAnalyzer::putById):
2697         (JSC::StaticPropertyAnalyzer::mov):
2698         (JSC::StaticPropertyAnalyzer::kill): Helper class for observing allocations
2699         and stores and making an inline capacity guess. The heuristics here are
2700         intentionally minimal because we don't want this one class to try to
2701         re-create something like a DFG or a runtime analysis. If we discover that
2702         we need those kinds of analyses, we should just replace this class with
2703         something else.
2704
2705         This class tracks multiple registers that alias the same object -- that
2706         happens a lot, when moving locals into temporary registers -- but it
2707         doesn't track control flow or multiple objects that alias the same register.
2708
2709         * dfg/DFGAbstractState.cpp:
2710         (JSC::DFG::AbstractState::execute): Updated for rename.
2711
2712         * dfg/DFGByteCodeParser.cpp:
2713         (JSC::DFG::ByteCodeParser::parseBlock): Updated for inline capacity and
2714         allocation profile.
2715
2716         * dfg/DFGNode.h:
2717         (JSC::DFG::Node::hasInlineCapacity):
2718         (Node):
2719         (JSC::DFG::Node::inlineCapacity):
2720         (JSC::DFG::Node::hasFunction): Give the graph a good way to represent
2721         inline capacity for an allocation.
2722
2723         * dfg/DFGNodeType.h:
2724         (DFG): Updated for rename.
2725
2726         * dfg/DFGOperations.cpp: Updated for interface change.
2727
2728         * dfg/DFGOperations.h: We pass the inline capacity to the slow case as
2729         an argument. This is the simplest way, since it's stored as a bytecode operand.
2730
2731         * dfg/DFGPredictionPropagationPhase.cpp:
2732         (JSC::DFG::PredictionPropagationPhase::propagate): Updated for rename.
2733
2734         * dfg/DFGRepatch.cpp:
2735         (JSC::DFG::tryCacheGetByID): Fixed a horrible off-by-one-half bug that only
2736         appears when doing an inline cached load for property number 64 on a 32-bit
2737         system. In JSVALUE32_64 land, "offsetRelativeToPatchedStorage" is the
2738         offset of the 64bit JSValue -- but we'll actually issue two loads, one for
2739         the payload at that offset, and one for the tag at that offset + 4. We need
2740         to ensure that both loads have a compact representation, or we'll corrupt
2741         the instruction stream.
2742
2743         * dfg/DFGSpeculativeJIT.cpp:
2744         (JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
2745         * dfg/DFGSpeculativeJIT.h:
2746         (JSC::DFG::SpeculativeJIT::callOperation):
2747         (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
2748         (SpeculativeJIT):
2749         (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
2750         * dfg/DFGSpeculativeJIT32_64.cpp:
2751         (JSC::DFG::SpeculativeJIT::compile):
2752         * dfg/DFGSpeculativeJIT64.cpp:
2753         (JSC::DFG::SpeculativeJIT::compile): Lots of refactoring to support
2754         passing an allocator to our allocation function, and/or passing a Structure
2755         as a register instead of an immediate.
2756
2757         * heap/MarkedAllocator.h:
2758         (DFG):
2759         (MarkedAllocator):
2760         (JSC::MarkedAllocator::offsetOfFreeListHead): Added an accessor to simplify
2761         JIT code generation of allocation from an arbitrary allocator.
2762
2763         * jit/JIT.h:
2764         (JSC):
2765         * jit/JITInlines.h:
2766         (JSC):
2767         (JSC::JIT::emitAllocateJSObject):
2768         * jit/JITOpcodes.cpp:
2769         (JSC::JIT::emit_op_new_object):
2770         (JSC::JIT::emitSlow_op_new_object):
2771         (JSC::JIT::emit_op_create_this):
2772         (JSC::JIT::emitSlow_op_create_this):
2773         * jit/JITOpcodes32_64.cpp:
2774         (JSC::JIT::emit_op_new_object):
2775         (JSC::JIT::emitSlow_op_new_object):
2776         (JSC::JIT::emit_op_create_this):
2777         (JSC::JIT::emitSlow_op_create_this): Same refactoring as done for the DFG.
2778
2779         * jit/JITStubs.cpp:
2780         (JSC::tryCacheGetByID): Fixed the same bug mentioned above.
2781
2782         (JSC::DEFINE_STUB_FUNCTION): Updated for interface changes.
2783
2784         * llint/LLIntData.cpp:
2785         (JSC::LLInt::Data::performAssertions): Updated for interface changes.
2786
2787         * llint/LLIntSlowPaths.cpp:
2788         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
2789         * llint/LowLevelInterpreter.asm:
2790         * llint/LowLevelInterpreter32_64.asm:
2791         * llint/LowLevelInterpreter64.asm: Same refactoring as for the JITs.
2792
2793         * profiler/ProfilerBytecode.cpp:
2794         * profiler/ProfilerBytecodes.cpp:
2795         * profiler/ProfilerCompilation.cpp:
2796         * profiler/ProfilerCompiledBytecode.cpp:
2797         * profiler/ProfilerDatabase.cpp:
2798         * profiler/ProfilerOSRExit.cpp:
2799         * profiler/ProfilerOrigin.cpp:
2800         * profiler/ProfilerProfiledBytecodes.cpp: Include ObjectConstructor.h
2801         because that's where createEmptyObject() lives now.
2802
2803         * runtime/Executable.h:
2804         (JSC::JSFunction::JSFunction): Updated for rename.
2805
2806         * runtime/JSCellInlines.h:
2807         (JSC::allocateCell): Updated to match the allocator selection code in
2808         the JIT, so it's clearer that both are correct.
2809
2810         * runtime/JSFunction.cpp:
2811         (JSC::JSFunction::JSFunction):
2812         (JSC::JSFunction::createAllocationProfile):
2813         (JSC::JSFunction::visitChildren):
2814         (JSC::JSFunction::getOwnPropertySlot):
2815         (JSC::JSFunction::put):
2816         (JSC::JSFunction::defineOwnProperty):
2817         (JSC::JSFunction::getConstructData):
2818         * runtime/JSFunction.h:
2819         (JSC::JSFunction::offsetOfScopeChain):
2820         (JSC::JSFunction::offsetOfExecutable):
2821         (JSC::JSFunction::offsetOfAllocationProfile):
2822         (JSC::JSFunction::allocationProfile):
2823         (JSFunction):
2824         (JSC::JSFunction::tryGetAllocationProfile):
2825         (JSC::JSFunction::addAllocationProfileWatchpoint): Changed inheritorID
2826         data member to be an ObjectAllocationProfile, which includes a pointer
2827         to the desired allocator. This simplifies JIT code, since we don't have
2828         to compute the allocator on the fly. I verified by code inspection that
2829         JSFunction is still only 64 bytes.
2830
2831         * runtime/JSGlobalObject.cpp:
2832         (JSC::JSGlobalObject::reset):
2833         (JSC::JSGlobalObject::visitChildren):
2834         * runtime/JSGlobalObject.h:
2835         (JSGlobalObject):
2836         (JSC::JSGlobalObject::dateStructure): No direct pointer to the empty
2837         object structure anymore, because now clients need to specify how much
2838         inline capacity they want.
2839
2840         * runtime/JSONObject.cpp:
2841         * runtime/JSObject.h:
2842         (JSC):
2843         (JSFinalObject):
2844         (JSC::JSFinalObject::defaultInlineCapacity):
2845         (JSC::JSFinalObject::maxInlineCapacity):
2846         (JSC::JSFinalObject::createStructure): A little refactoring to try to 
2847         clarify where some of these constants derive from.
2848
2849         (JSC::maxOffsetRelativeToPatchedStorage): Used for bug fix, above.
2850
2851         * runtime/JSProxy.cpp:
2852         (JSC::JSProxy::setTarget): Ugly, but effective.
2853
2854         * runtime/LiteralParser.cpp:
2855         * runtime/ObjectConstructor.cpp:
2856         (JSC::constructObject):
2857         (JSC::constructWithObjectConstructor):
2858         (JSC::callObjectConstructor):
2859         (JSC::objectConstructorCreate): Updated for interface changes.
2860
2861         * runtime/ObjectConstructor.h:
2862         (JSC::constructEmptyObject): Clarified your options for how to allocate
2863         an empty object, to emphasize what things can actually vary.
2864
2865         * runtime/PropertyOffset.h: These constants have moved because they're
2866         really higher level concepts to do with the layout of objects and the
2867         collector. PropertyOffset is just an abstract number line, independent
2868         of those things.
2869
2870         * runtime/PrototypeMap.cpp:
2871         (JSC::PrototypeMap::emptyObjectStructureForPrototype):
2872         (JSC::PrototypeMap::clearEmptyObjectStructureForPrototype):
2873         * runtime/PrototypeMap.h:
2874         (PrototypeMap): The map key is now a pair of prototype and inline capacity,
2875         since Structure encodes inline capacity.
2876
2877         * runtime/Structure.cpp:
2878         (JSC::Structure::Structure):
2879         (JSC::Structure::materializePropertyMap):
2880         (JSC::Structure::addPropertyTransition):
2881         (JSC::Structure::nonPropertyTransition):
2882         (JSC::Structure::copyPropertyTableForPinning):
2883         * runtime/Structure.h:
2884         (Structure):
2885         (JSC::Structure::totalStorageSize):
2886         (JSC::Structure::transitionCount):
2887         (JSC::Structure::create): Fixed a nasty refactoring bug that only shows
2888         up after enabling variable-sized inline capacities: we were passing our
2889         type info where our inline capacity was expected. The compiler didn't
2890         notice because both have type int :(.
2891
2892 2013-01-28  Oliver Hunt  <oliver@apple.com>
2893
2894         Add more assertions to the property storage use in arrays
2895         https://bugs.webkit.org/show_bug.cgi?id=107728
2896
2897         Reviewed by Filip Pizlo.
2898
2899         Add a bunch of assertions to array and object butterfly
2900         usage.  This should make debugging somewhat easier.
2901
2902         I also converted a couple of assertions to release asserts
2903         as they were so low cost it seemed a sensible thing to do.
2904
2905         * runtime/JSArray.cpp:
2906         (JSC::JSArray::sortVector):
2907         (JSC::JSArray::compactForSorting):
2908         * runtime/JSObject.h:
2909         (JSC::JSObject::getHolyIndexQuickly):
2910
2911 2013-01-28  Adam Barth  <abarth@webkit.org>
2912
2913         Remove webkitNotifications.createHTMLNotification
2914         https://bugs.webkit.org/show_bug.cgi?id=107598
2915
2916         Reviewed by Benjamin Poulain.
2917
2918         * Configurations/FeatureDefines.xcconfig:
2919
2920 2013-01-28  Michael Saboff  <msaboff@apple.com>
2921
2922         Cleanup ARM version of debugName() in DFGFPRInfo.h
2923         https://bugs.webkit.org/show_bug.cgi?id=108090
2924
2925         Reviewed by David Kilzer.
2926
2927         Fixed debugName() so it will compile by adding static_cast<int> and missing commas.
2928
2929         * dfg/DFGFPRInfo.h:
2930         (JSC::DFG::FPRInfo::debugName):
2931
2932 2013-01-27  Andreas Kling  <akling@apple.com>
2933
2934         JSC: FunctionParameters are memory hungry.
2935         <http://webkit.org/b/108033>
2936         <rdar://problem/13094803>
2937
2938         Reviewed by Sam Weinig.
2939
2940         Instead of inheriting from Vector<Identifier>, make FunctionParameters a simple fixed-size array
2941         with a custom-allocating create() function. Removes one step of indirection and cuts memory usage
2942         roughly in half.
2943
2944         2.73 MB progression on Membuster3.
2945
2946         * bytecode/UnlinkedCodeBlock.cpp:
2947         (JSC::UnlinkedFunctionExecutable::paramString):
2948         * bytecompiler/BytecodeGenerator.cpp:
2949         (JSC::BytecodeGenerator::BytecodeGenerator):
2950         * parser/Nodes.cpp:
2951         (JSC::FunctionParameters::create):
2952         (JSC::FunctionParameters::FunctionParameters):
2953         (JSC::FunctionParameters::~FunctionParameters):
2954         * parser/Nodes.h:
2955         (FunctionParameters):
2956         (JSC::FunctionParameters::size):
2957         (JSC::FunctionParameters::at):
2958         (JSC::FunctionParameters::identifiers):
2959
2960 2013-01-27  Andreas Kling  <akling@apple.com>
2961
2962         JSC: SourceProviderCache is memory hungry.
2963         <http://webkit.org/b/108029>
2964         <rdar://problem/13094806>
2965
2966         Reviewed by Sam Weinig.
2967
2968         Use fixed-size arrays for SourceProviderCacheItem's lists of captured variables.
2969         Since the lists never change after the object is created, there's no need to keep them in Vectors
2970         and we can instead create the whole cache item in a single allocation.
2971
2972         13.37 MB progression on Membuster3.
2973
2974         * parser/Parser.cpp:
2975         (JSC::::parseFunctionInfo):
2976         * parser/Parser.h:
2977         (JSC::Scope::copyCapturedVariablesToVector):
2978         (JSC::Scope::fillParametersForSourceProviderCache):
2979         (JSC::Scope::restoreFromSourceProviderCache):
2980         * parser/SourceProviderCacheItem.h:
2981         (SourceProviderCacheItemCreationParameters):
2982         (SourceProviderCacheItem):
2983         (JSC::SourceProviderCacheItem::approximateByteSize):
2984         (JSC::SourceProviderCacheItem::usedVariables):
2985         (JSC::SourceProviderCacheItem::writtenVariables):
2986         (JSC::SourceProviderCacheItem::~SourceProviderCacheItem):
2987         (JSC::SourceProviderCacheItem::create):
2988         (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
2989
2990 2013-01-27  Zoltan Arvai  <zarvai@inf.u-szeged.hu>
2991
2992         Fixing atomicIncrement implementation for Windows by dropping support before XP SP2.
2993         https://bugs.webkit.org/show_bug.cgi?id=106740
2994
2995         Reviewed by Benjamin Poulain.
2996
2997         * config.h:
2998
2999 2013-01-25  Filip Pizlo  <fpizlo@apple.com>
3000
3001         DFG variable event stream shouldn't use NodeIndex
3002         https://bugs.webkit.org/show_bug.cgi?id=107996
3003
3004         Reviewed by Oliver Hunt.
3005         
3006         Introduce the notion of a DFG::MinifiedID, which is just a unique ID of a DFG Node.
3007         Internally it currently uses a NodeIndex, but we could change this without having
3008         to recode all of the users of MinifiedID. This effectively decouples the OSR exit
3009         compiler's way of identifying nodes from the speculative JIT's way of identifying
3010         nodes, and should make it easier to make changes to the speculative JIT's internals
3011         in the future.
3012         
3013         Also changed variable event stream logging to exclude information about births and
3014         deaths of constants, since the OSR exit compiler never cares about which register
3015         holds a constant; if a value is constant then the OSR exit compiler can reify it.
3016         
3017         Also changed the variable event stream's value recovery computation to use a
3018         HashMap keyed by MinifiedID rather than a Vector indexed by NodeIndex.
3019         
3020         This appears to be performance-neutral. It's primarily meant as a small step
3021         towards https://bugs.webkit.org/show_bug.cgi?id=106868.
3022
3023         * GNUmakefile.list.am:
3024         * JavaScriptCore.xcodeproj/project.pbxproj:
3025         * dfg/DFGGenerationInfo.h:
3026         (JSC::DFG::GenerationInfo::GenerationInfo):
3027         (JSC::DFG::GenerationInfo::initConstant):
3028         (JSC::DFG::GenerationInfo::initInteger):
3029         (JSC::DFG::GenerationInfo::initJSValue):
3030         (JSC::DFG::GenerationInfo::initCell):
3031         (JSC::DFG::GenerationInfo::initBoolean):
3032         (JSC::DFG::GenerationInfo::initDouble):
3033         (JSC::DFG::GenerationInfo::initStorage):
3034         (JSC::DFG::GenerationInfo::noticeOSRBirth):
3035         (JSC::DFG::GenerationInfo::use):
3036         (JSC::DFG::GenerationInfo::appendFill):
3037         (JSC::DFG::GenerationInfo::appendSpill):
3038         (GenerationInfo):
3039         * dfg/DFGJITCompiler.cpp:
3040         (JSC::DFG::JITCompiler::link):
3041         * dfg/DFGMinifiedGraph.h:
3042         (JSC::DFG::MinifiedGraph::at):
3043         (MinifiedGraph):
3044         * dfg/DFGMinifiedID.h: Added.
3045         (DFG):
3046         (MinifiedID):
3047         (JSC::DFG::MinifiedID::MinifiedID):
3048         (JSC::DFG::MinifiedID::operator!):
3049         (JSC::DFG::MinifiedID::nodeIndex):
3050         (JSC::DFG::MinifiedID::operator==):
3051         (JSC::DFG::MinifiedID::operator!=):
3052         (JSC::DFG::MinifiedID::operator<):
3053         (JSC::DFG::MinifiedID::operator>):
3054         (JSC::DFG::MinifiedID::operator<=):
3055         (JSC::DFG::MinifiedID::operator>=):
3056         (JSC::DFG::MinifiedID::hash):
3057         (JSC::DFG::MinifiedID::dump):
3058         (JSC::DFG::MinifiedID::isHashTableDeletedValue):
3059         (JSC::DFG::MinifiedID::invalidID):
3060         (JSC::DFG::MinifiedID::otherInvalidID):
3061         (JSC::DFG::MinifiedID::fromBits):
3062         (JSC::DFG::MinifiedIDHash::hash):
3063         (JSC::DFG::MinifiedIDHash::equal):
3064         (MinifiedIDHash):
3065         (WTF):
3066         * dfg/DFGMinifiedNode.cpp:
3067         (JSC::DFG::MinifiedNode::fromNode):
3068         * dfg/DFGMinifiedNode.h:
3069         (JSC::DFG::MinifiedNode::id):
3070         (JSC::DFG::MinifiedNode::child1):
3071         (JSC::DFG::MinifiedNode::getID):
3072         (JSC::DFG::MinifiedNode::compareByNodeIndex):
3073         (MinifiedNode):
3074         * dfg/DFGSpeculativeJIT.cpp:
3075         (JSC::DFG::SpeculativeJIT::compileMovHint):
3076         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
3077         * dfg/DFGSpeculativeJIT.h:
3078         (JSC::DFG::SpeculativeJIT::setNodeIndexForOperand):
3079         * dfg/DFGValueSource.cpp:
3080         (JSC::DFG::ValueSource::dump):
3081         * dfg/DFGValueSource.h:
3082         (JSC::DFG::ValueSource::ValueSource):
3083         (JSC::DFG::ValueSource::isSet):
3084         (JSC::DFG::ValueSource::kind):
3085         (JSC::DFG::ValueSource::id):
3086         (ValueSource):
3087         (JSC::DFG::ValueSource::idFromKind):
3088         (JSC::DFG::ValueSource::kindFromID):
3089         * dfg/DFGVariableEvent.cpp:
3090         (JSC::DFG::VariableEvent::dump):
3091         (JSC::DFG::VariableEvent::dumpFillInfo):
3092         (JSC::DFG::VariableEvent::dumpSpillInfo):
3093         * dfg/DFGVariableEvent.h:
3094         (JSC::DFG::VariableEvent::fillGPR):
3095         (JSC::DFG::VariableEvent::fillPair):
3096         (JSC::DFG::VariableEvent::fillFPR):
3097         (JSC::DFG::VariableEvent::spill):
3098         (JSC::DFG::VariableEvent::death):
3099         (JSC::DFG::VariableEvent::movHint):
3100         (JSC::DFG::VariableEvent::id):
3101         (VariableEvent):
3102         * dfg/DFGVariableEventStream.cpp:
3103         (DFG):
3104         (JSC::DFG::VariableEventStream::tryToSetConstantRecovery):
3105         (JSC::DFG::VariableEventStream::reconstruct):
3106         * dfg/DFGVariableEventStream.h:
3107         (VariableEventStream):
3108
3109 2013-01-25  Roger Fong  <roger_fong@apple.com>
3110
3111         Unreviewed. Rename LLInt projects folder and make appropriate changes to solutions.
3112
3113         * JavaScriptCore.vcxproj/JavaScriptCore.sln:
3114         * JavaScriptCore.vcxproj/LLInt: Copied from JavaScriptCore.vcxproj/LLInt.vcproj.
3115         * JavaScriptCore.vcxproj/LLInt.vcproj: Removed.
3116         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly: Removed.
3117         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.make: Removed.
3118         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.vcxproj: Removed.
3119         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.vcxproj.user: Removed.
3120         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/build-LLIntAssembly.sh: Removed.
3121         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets: Removed.
3122         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.make: Removed.
3123         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj: Removed.
3124         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj.user: Removed.
3125         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh: Removed.
3126         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor: Removed.
3127         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj: Removed.
3128         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj.user: Removed.
3129         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props: Removed.
3130         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props: Removed.
3131         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.props: Removed.
3132
3133 2013-01-24  Roger Fong  <roger_fong@apple.com>
3134
3135         VS2010 JavascriptCore: Clean up property sheets, add a JSC solution, add testRegExp and testAPI projects.
3136         https://bugs.webkit.org/show_bug.cgi?id=106987
3137
3138         Reviewed by Brent Fulgham.
3139
3140         * JavaScriptCore.vcxproj/JavaScriptCore.sln: Added.
3141         * JavaScriptCore.vcxproj/JavaScriptCoreCF.props:
3142         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
3143         * JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd:
3144         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
3145         * JavaScriptCore.vcxproj/jsc/jscCommon.props:
3146         * JavaScriptCore.vcxproj/jsc/jscDebug.props:
3147         * JavaScriptCore.vcxproj/jsc/jscPostBuild.cmd:
3148         * JavaScriptCore.vcxproj/jsc/jscPreLink.cmd:
3149         * JavaScriptCore.vcxproj/testRegExp: Added.
3150         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj: Added.
3151         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.filters: Added.
3152         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.user: Added.
3153         * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props: Added.
3154         * JavaScriptCore.vcxproj/testRegExp/testRegExpDebug.props: Added.
3155         * JavaScriptCore.vcxproj/testRegExp/testRegExpPostBuild.cmd: Added.
3156         * JavaScriptCore.vcxproj/testRegExp/testRegExpPreBuild.cmd: Added.
3157         * JavaScriptCore.vcxproj/testRegExp/testRegExpPreLink.cmd: Added.
3158         * JavaScriptCore.vcxproj/testRegExp/testRegExpRelease.props: Added.
3159         * JavaScriptCore.vcxproj/testapi: Added.
3160         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj: Added.
3161         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters: Added.
3162         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.user: Added.
3163         * JavaScriptCore.vcxproj/testapi/testapiCommon.props: Added.
3164         * JavaScriptCore.vcxproj/testapi/testapiDebug.props: Added.
3165         * JavaScriptCore.vcxproj/testapi/testapiPostBuild.cmd: Added.
3166         * JavaScriptCore.vcxproj/testapi/testapiPreBuild.cmd: Added.
3167         * JavaScriptCore.vcxproj/testapi/testapiPreLink.cmd: Added.
3168         * JavaScriptCore.vcxproj/testapi/testapiRelease.props: Added.
3169
3170 2013-01-24  Roger Fong  <roger_fong@apple.com>
3171
3172         Unreviewed. Windows build fix.
3173
3174         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
3175
3176 2013-01-24  Filip Pizlo  <fpizlo@apple.com>
3177
3178         DFG::JITCompiler::getSpeculation() methods are badly named and superfluous
3179         https://bugs.webkit.org/show_bug.cgi?id=107860
3180
3181         Reviewed by Mark Hahnenberg.
3182
3183         * dfg/DFGJITCompiler.h:
3184         (JITCompiler):
3185         * dfg/DFGSpeculativeJIT64.cpp:
3186         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
3187         (JSC::DFG::SpeculativeJIT::emitBranch):
3188
3189 2013-01-24  Mark Hahnenberg  <mhahnenberg@apple.com>
3190
3191         Objective-C API: Rename JSValue.h/APIJSValue.h to JSCJSValue.h/JSValue.h
3192         https://bugs.webkit.org/show_bug.cgi?id=107327
3193
3194         Reviewed by Filip Pizlo.
3195
3196         We're renaming these two files, so we have to replace the names everywhere.
3197
3198         * API/APICast.h:
3199         * API/APIJSValue.h: Removed.
3200         * API/JSBlockAdaptor.mm:
3201         * API/JSStringRefCF.cpp:
3202         * API/JSValue.h: Copied from Source/JavaScriptCore/API/APIJSValue.h.
3203         * API/JSValue.mm:
3204         * API/JSValueInternal.h:
3205         * API/JSValueRef.cpp:
3206         * API/JSWeakObjectMapRefPrivate.cpp:
3207         * API/JavaScriptCore.h:
3208         * CMakeLists.txt:
3209         * GNUmakefile.list.am:
3210         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3211         * JavaScriptCore.xcodeproj/project.pbxproj:
3212         * Target.pri:
3213         * bytecode/CallLinkStatus.h:
3214         * bytecode/CodeBlock.cpp:
3215         * bytecode/MethodOfGettingAValueProfile.h:
3216         * bytecode/ResolveGlobalStatus.cpp:
3217         * bytecode/ResolveGlobalStatus.h:
3218         * bytecode/SpeculatedType.h:
3219         * bytecode/ValueRecovery.h:
3220         * dfg/DFGByteCodeParser.cpp:
3221         * dfg/DFGJITCompiler.cpp:
3222         * dfg/DFGNode.h:
3223         * dfg/DFGSpeculativeJIT.cpp:
3224         * dfg/DFGSpeculativeJIT64.cpp:
3225         * heap/CopiedBlock.h:
3226         * heap/HandleStack.cpp:
3227         * heap/HandleTypes.h:
3228         * heap/WeakImpl.h:
3229         * interpreter/Interpreter.h:
3230         * interpreter/Register.h:
3231         * interpreter/VMInspector.h:
3232         * jit/HostCallReturnValue.cpp:
3233         * jit/HostCallReturnValue.h:
3234         * jit/JITCode.h:
3235         * jit/JITExceptions.cpp:
3236         * jit/JITExceptions.h:
3237         * jit/JSInterfaceJIT.h:
3238         * llint/LLIntCLoop.h:
3239         * llint/LLIntData.h:
3240         * llint/LLIntSlowPaths.cpp:
3241         * profiler/ProfilerBytecode.h:
3242         * profiler/ProfilerBytecodeSequence.h:
3243         * profiler/ProfilerBytecodes.h:
3244         * profiler/ProfilerCompilation.h:
3245         * profiler/ProfilerCompiledBytecode.h:
3246         * profiler/ProfilerDatabase.h:
3247         * profiler/ProfilerOSRExit.h:
3248         * profiler/ProfilerOSRExitSite.h:
3249         * profiler/ProfilerOrigin.h:
3250         * profiler/ProfilerOriginStack.h:
3251         * runtime/ArgList.cpp:
3252         * runtime/CachedTranscendentalFunction.h:
3253         * runtime/CallData.h:
3254         * runtime/Completion.h:
3255         * runtime/ConstructData.h:
3256         * runtime/DateConstructor.cpp:
3257         * runtime/DateInstance.cpp:
3258         * runtime/DatePrototype.cpp:
3259         * runtime/JSAPIValueWrapper.h:
3260         * runtime/JSCJSValue.cpp: Copied from Source/JavaScriptCore/runtime/JSValue.cpp.
3261         * runtime/JSCJSValue.h: Copied from Source/JavaScriptCore/runtime/JSValue.h.
3262         (JSValue):
3263         * runtime/JSCJSValueInlines.h: Copied from Source/JavaScriptCore/runtime/JSValueInlines.h.
3264         * runtime/JSGlobalData.h:
3265         * runtime/JSGlobalObject.cpp:
3266         * runtime/JSGlobalObjectFunctions.h:
3267         * runtime/JSStringJoiner.h:
3268         * runtime/JSValue.cpp: Removed.
3269         * runtime/JSValue.h: Removed.
3270         * runtime/JSValueInlines.h: Removed.
3271         * runtime/LiteralParser.h:
3272         * runtime/Operations.h:
3273         * runtime/PropertyDescriptor.h:
3274         * runtime/PropertySlot.h:
3275         * runtime/Protect.h:
3276         * runtime/RegExpPrototype.cpp:
3277         * runtime/Structure.h:
3278
3279 2013-01-23  Oliver Hunt  <oliver@apple.com>
3280
3281         Harden JSC a bit with RELEASE_ASSERT
3282         https://bugs.webkit.org/show_bug.cgi?id=107766
3283
3284         Reviewed by Mark Hahnenberg.
3285
3286         Went through and replaced a pile of ASSERTs that were covering
3287         significantly important details (bounds checks, etc) where
3288         having the checks did not impact release performance in any
3289         measurable way.
3290
3291         * API/JSContextRef.cpp:
3292         (JSContextCreateBacktrace):
3293         * assembler/MacroAssembler.h:
3294         (JSC::MacroAssembler::branchAdd32):
3295         (JSC::MacroAssembler::branchMul32):
3296         * bytecode/CodeBlock.cpp:
3297         (JSC::CodeBlock::dumpBytecode):
3298         (JSC::CodeBlock::handlerForBytecodeOffset):
3299         (JSC::CodeBlock::lineNumberForBytecodeOffset):
3300         (JSC::CodeBlock::bytecodeOffset):
3301         * bytecode/CodeBlock.h:
3302         (JSC::CodeBlock::bytecodeOffsetForCallAtIndex):
3303         (JSC::CodeBlock::bytecodeOffset):
3304         (JSC::CodeBlock::exceptionHandler):
3305         (JSC::CodeBlock::codeOrigin):
3306         (JSC::CodeBlock::immediateSwitchJumpTable):
3307         (JSC::CodeBlock::characterSwitchJumpTable):
3308         (JSC::CodeBlock::stringSwitchJumpTable):
3309         (JSC::CodeBlock::setIdentifiers):
3310         (JSC::baselineCodeBlockForInlineCallFrame):
3311         (JSC::ExecState::uncheckedR):
3312         * bytecode/CodeOrigin.cpp:
3313         (JSC::CodeOrigin::inlineStack):
3314         * bytecode/CodeOrigin.h:
3315         (JSC::CodeOrigin::CodeOrigin):
3316         * dfg/DFGCSEPhase.cpp:
3317         * dfg/DFGOSRExit.cpp:
3318         * dfg/DFGScratchRegisterAllocator.h:
3319         (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
3320         (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
3321         * dfg/DFGSpeculativeJIT.h:
3322         (JSC::DFG::SpeculativeJIT::allocate):
3323         (JSC::DFG::SpeculativeJIT::spill):
3324         (JSC::DFG::SpeculativeJIT::integerResult):
3325         * dfg/DFGSpeculativeJIT64.cpp:
3326         (JSC::DFG::SpeculativeJIT::fillInteger):
3327         (JSC::DFG::SpeculativeJIT::fillDouble):
3328         (JSC::DFG::SpeculativeJIT::fillJSValue):
3329         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
3330         (JSC::DFG::SpeculativeJIT::emitCall):
3331         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
3332         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
3333         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
3334         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
3335         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
3336         (JSC::DFG::SpeculativeJIT::compile):
3337         * dfg/DFGValueSource.h:
3338         (JSC::DFG::dataFormatToValueSourceKind):
3339         (JSC::DFG::ValueSource::ValueSource):
3340         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
3341         * heap/BlockAllocator.cpp:
3342         (JSC::BlockAllocator::BlockAllocator):
3343         (JSC::BlockAllocator::releaseFreeRegions):
3344         (JSC::BlockAllocator::blockFreeingThreadMain):
3345         * heap/Heap.cpp:
3346         (JSC::Heap::lastChanceToFinalize):
3347         (JSC::Heap::collect):
3348         * interpreter/Interpreter.cpp:
3349         (JSC::Interpreter::throwException):
3350         (JSC::Interpreter::execute):
3351         * jit/GCAwareJITStubRoutine.cpp:
3352         (JSC::GCAwareJITStubRoutine::observeZeroRefCount):
3353         * jit/JIT.cpp:
3354         (JSC::JIT::privateCompileMainPass):
3355         (JSC::JIT::privateCompileSlowCases):
3356         * jit/JITExceptions.cpp:
3357         (JSC::genericThrow):
3358         * jit/JITInlines.h:
3359         (JSC::JIT::emitLoad):
3360         * jit/JITOpcodes.cpp:
3361         (JSC::JIT::emit_op_end):
3362         (JSC::JIT::emit_resolve_operations):
3363         * jit/JITStubRoutine.cpp:
3364         (JSC::JITStubRoutine::observeZeroRefCount):
3365         * jit/JITStubs.cpp:
3366         (JSC::returnToThrowTrampoline):
3367         * runtime/Arguments.cpp:
3368         (JSC::Arguments::getOwnPropertySlot):
3369         (JSC::Arguments::getOwnPropertyDescriptor):
3370         (JSC::Arguments::deleteProperty):
3371         (JSC::Arguments::defineOwnProperty):
3372         (JSC::Arguments::didTearOffActivation):
3373         * runtime/ArrayPrototype.cpp:
3374         (JSC::shift):
3375         (JSC::unshift):
3376         (JSC::arrayProtoFuncLastIndexOf):
3377         * runtime/ButterflyInlines.h:
3378         (JSC::Butterfly::growPropertyStorage):
3379         * runtime/CodeCache.cpp:
3380         (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
3381         * runtime/CodeCache.h:
3382         (JSC::CacheMap::add):
3383         * runtime/Completion.cpp:
3384         (JSC::checkSyntax):
3385         (JSC::evaluate):
3386         * runtime/Executable.cpp:
3387         (JSC::FunctionExecutable::FunctionExecutable):
3388         (JSC::EvalExecutable::unlinkCalls):
3389         (JSC::ProgramExecutable::compileOptimized):
3390         (JSC::ProgramExecutable::unlinkCalls):
3391         (JSC::ProgramExecutable::initializeGlobalProperties):
3392         (JSC::FunctionExecutable::baselineCodeBlockFor):
3393         (JSC::FunctionExecutable::compileOptimizedForCall):
3394         (JSC::FunctionExecutable::compileOptimizedForConstruct):
3395         (JSC::FunctionExecutable::compileForCallInternal):
3396         (JSC::FunctionExecutable::compileForConstructInternal):
3397         (JSC::FunctionExecutable::unlinkCalls):
3398         (JSC::NativeExecutable::hashFor):
3399         * runtime/Executable.h:
3400         (JSC::EvalExecutable::compile):
3401         (JSC::ProgramExecutable::compile):
3402         (JSC::FunctionExecutable::compileForCall):
3403         (JSC::FunctionExecutable::compileForConstruct):
3404         * runtime/IndexingHeader.h:
3405         (JSC::IndexingHeader::setVectorLength):
3406         * runtime/JSArray.cpp:
3407         (JSC::JSArray::pop):
3408         (JSC::JSArray::shiftCountWithArrayStorage):
3409         (JSC::JSArray::shiftCountWithAnyIndexingType):
3410         (JSC::JSArray::unshiftCountWithArrayStorage):
3411         * runtime/JSGlobalObjectFunctions.cpp:
3412         (JSC::jsStrDecimalLiteral):
3413         * runtime/JSObject.cpp:
3414         (JSC::JSObject::copyButterfly):
3415         (JSC::JSObject::defineOwnIndexedProperty):
3416         (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
3417         * runtime/JSString.cpp:
3418         (JSC::JSRopeString::getIndexSlowCase):
3419         * yarr/YarrInterpreter.cpp:
3420         (JSC::Yarr::Interpreter::popParenthesesDisjunctionContext):
3421
3422 2013-01-23  Filip Pizlo  <fpizlo@apple.com>
3423
3424         Constant folding an access to an uncaptured variable that is captured later in the same basic block shouldn't lead to assertion failures
3425         https://bugs.webkit.org/show_bug.cgi?id=107750
3426         <rdar://problem/12387265>
3427
3428         Reviewed by Mark Hahnenberg.
3429         
3430         The point of this assertion was that if there is no variable capturing going on, then there should only be one GetLocal
3431         for the variable anywhere in the basic block. But if there is some capturing, then we'll have an unbounded number of
3432         GetLocals. The assertion was too imprecise for the latter case. I want to keep this assertion, so I introduced a
3433         checker that verifies this precisely: if there are any captured accesses to the variable anywhere at or after the
3434         GetLocal we are eliminating, then we allow redundant GetLocals.
3435
3436         * dfg/DFGConstantFoldingPhase.cpp:
3437         (JSC::DFG::ConstantFoldingPhase::foldConstants):
3438         (ConstantFoldingPhase):
3439         (JSC::DFG::ConstantFoldingPhase::isCapturedAtOrAfter):
3440
3441 2013-01-23  Oliver Hunt  <oliver@apple.com>
3442
3443         Replace ASSERT_NOT_REACHED with RELEASE_ASSERT_NOT_REACHED in JSC
3444         https://bugs.webkit.org/show_bug.cgi?id=107736
3445
3446         Reviewed by Mark Hahnenberg.
3447
3448         Mechanical change with no performance impact.
3449
3450         * API/JSBlockAdaptor.mm:
3451         (BlockArgumentTypeDelegate::typeVoid):
3452         * API/JSCallbackObjectFunctions.h:
3453         (JSC::::construct):
3454         (JSC::::call):
3455         * API/JSScriptRef.cpp:
3456         * API/ObjCCallbackFunction.mm:
3457         (ArgumentTypeDelegate::typeVoid):
3458         * assembler/ARMv7Assembler.h:
3459         (JSC::ARMv7Assembler::link):
3460         (JSC::ARMv7Assembler::replaceWithLoad):
3461         (JSC::ARMv7Assembler::replaceWithAddressComputation):
3462         * assembler/MacroAssembler.h:
3463         (JSC::MacroAssembler::invert):
3464         * assembler/MacroAssemblerARM.h:
3465         (JSC::MacroAssemblerARM::countLeadingZeros32):
3466         (JSC::MacroAssemblerARM::divDouble):
3467         * assembler/MacroAssemblerMIPS.h:
3468         (JSC::MacroAssemblerMIPS::absDouble):
3469         (JSC::MacroAssemblerMIPS::replaceWithJump):
3470         (JSC::MacroAssemblerMIPS::maxJumpReplacementSize):
3471         * assembler/MacroAssemblerSH4.h:
3472         (JSC::MacroAssemblerSH4::absDouble):
3473         (JSC::MacroAssemblerSH4::replaceWithJump):
3474         (JSC::MacroAssemblerSH4::maxJumpReplacementSize):
3475         * assembler/SH4Assembler.h:
3476         (JSC::SH4Assembler::shllImm8r):
3477         (JSC::SH4Assembler::shlrImm8r):
3478         (JSC::SH4Assembler::cmplRegReg):
3479         (JSC::SH4Assembler::branch):
3480         * assembler/X86Assembler.h:
3481         (JSC::X86Assembler::replaceWithLoad):
3482         (JSC::X86Assembler::replaceWithAddressComputation):
3483         * bytecode/CallLinkInfo.cpp:
3484         (JSC::CallLinkInfo::unlink):
3485         * bytecode/CodeBlock.cpp:
3486         (JSC::debugHookName):
3487         (JSC::CodeBlock::printGetByIdOp):
3488         (JSC::CodeBlock::printGetByIdCacheStatus):
3489         (JSC::CodeBlock::visitAggregate):
3490         (JSC::CodeBlock::finalizeUnconditionally):
3491         (JSC::CodeBlock::usesOpcode):
3492         * bytecode/DataFormat.h:
3493         (JSC::needDataFormatConversion):
3494         * bytecode/ExitKind.cpp:
3495         (JSC::exitKindToString):
3496         (JSC::exitKindIsCountable):
3497         * bytecode/MethodOfGettingAValueProfile.cpp:
3498         (JSC::MethodOfGettingAValueProfile::getSpecFailBucket):
3499         * bytecode/Opcode.h:
3500         (JSC::opcodeLength):
3501         * bytecode/PolymorphicPutByIdList.cpp:
3502         (JSC::PutByIdAccess::fromStructureStubInfo):
3503         (JSC::PutByIdAccess::visitWeak):
3504         * bytecode/StructureStubInfo.cpp:
3505         (JSC::StructureStubInfo::deref):
3506         * bytecompiler/BytecodeGenerator.cpp:
3507         (JSC::ResolveResult::checkValidity):
3508         (JSC::BytecodeGenerator::emitGetLocalVar):
3509         (JSC::BytecodeGenerator::beginSwitch):
3510         * bytecompiler/NodesCodegen.cpp:
3511         (JSC::BinaryOpNode::emitBytecode):
3512         (JSC::emitReadModifyAssignment):
3513         * dfg/DFGAbstractState.cpp:
3514         (JSC::DFG::AbstractState::execute):
3515         (JSC::DFG::AbstractState::mergeStateAtTail):
3516         (JSC::DFG::AbstractState::mergeToSuccessors):
3517         * dfg/DFGByteCodeParser.cpp:
3518         (JSC::DFG::ByteCodeParser::makeSafe):
3519         (JSC::DFG::ByteCodeParser::parseBlock):
3520         * dfg/DFGCFGSimplificationPhase.cpp:
3521         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
3522         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
3523         * dfg/DFGCSEPhase.cpp:
3524         (JSC::DFG::CSEPhase::setLocalStoreElimination):
3525         * dfg/DFGCapabilities.cpp:
3526         (JSC::DFG::canHandleOpcodes):
3527         * dfg/DFGCommon.h:
3528         (JSC::DFG::useKindToString):
3529         * dfg/DFGDoubleFormatState.h:
3530         (JSC::DFG::mergeDoubleFormatStates):
3531         (JSC::DFG::doubleFormatStateToString):
3532         * dfg/DFGFixupPhase.cpp:
3533         (JSC::DFG::FixupPhase::blessArrayOperation):
3534         * dfg/DFGGraph.h:
3535         (JSC::DFG::Graph::clobbersWorld):
3536         * dfg/DFGNode.h:
3537         (JSC::DFG::Node::valueOfJSConstant):
3538         (JSC::DFG::Node::successor):
3539         * dfg/DFGNodeFlags.cpp:
3540         (JSC::DFG::nodeFlagsAsString):
3541         * dfg/DFGNodeType.h:
3542         (JSC::DFG::defaultFlags):
3543         * dfg/DFGRepatch.h:
3544         (JSC::DFG::dfgResetGetByID):
3545         (JSC::DFG::dfgResetPutByID):
3546         * dfg/DFGSlowPathGenerator.h:
3547         (JSC::DFG::SlowPathGenerator::call):
3548         * dfg/DFGSpeculativeJIT.cpp:
3549         (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
3550         (JSC::DFG::SpeculativeJIT::silentSpill):
3551         (JSC::DFG::SpeculativeJIT::silentFill):
3552         (JSC::DFG::SpeculativeJIT::checkArray):
3553         (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
3554         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
3555         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
3556         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
3557         * dfg/DFGSpeculativeJIT.h:
3558         (JSC::DFG::SpeculativeJIT::bitOp):
3559         (JSC::DFG::SpeculativeJIT::shiftOp):
3560         (JSC::DFG::SpeculativeJIT::integerResult):
3561         * dfg/DFGSpeculativeJIT32_64.cpp:
3562         (JSC::DFG::SpeculativeJIT::fillInteger):
3563         (JSC::DFG::SpeculativeJIT::fillDouble):
3564         (JSC::DFG::SpeculativeJIT::fillJSValue):
3565         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
3566         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
3567         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
3568         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
3569         (JSC::DFG::SpeculativeJIT::compile):
3570         * dfg/DFGSpeculativeJIT64.cpp:
3571         (JSC::DFG::SpeculativeJIT::fillInteger):
3572         (JSC::DFG::SpeculativeJIT::fillDouble):
3573         (JSC::DFG::SpeculativeJIT::fillJSValue):
3574         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
3575         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
3576         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
3577         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
3578         (JSC::DFG::SpeculativeJIT::compile):
3579         * dfg/DFGStructureCheckHoistingPhase.cpp:
3580         (JSC::DFG::StructureCheckHoistingPhase::run):
3581         * dfg/DFGValueSource.h:
3582         (JSC::DFG::ValueSource::valueRecovery):
3583         * dfg/DFGVariableEvent.cpp:
3584         (JSC::DFG::VariableEvent::dump):
3585         * dfg/DFGVariableEventStream.cpp:
3586         (JSC::DFG::VariableEventStream::reconstruct):
3587         * heap/BlockAllocator.h:
3588         (JSC::BlockAllocator::regionSetFor):
3589         * heap/GCThread.cpp:
3590         (JSC::GCThread::gcThreadMain):
3591         * heap/MarkedBlock.cpp:
3592         (JSC::MarkedBlock::sweepHelper):
3593         * heap/MarkedBlock.h:
3594         (JSC::MarkedBlock::isLive):
3595         * interpreter/CallFrame.h:
3596         (JSC::ExecState::inlineCallFrame):
3597         * interpreter/Interpreter.cpp:
3598         (JSC::getCallerInfo):
3599         (JSC::getStackFrameCodeType):
3600         (JSC::Interpreter::execute):
3601         * jit/ExecutableAllocatorFixedVMPool.cpp:
3602         (JSC::FixedVMPoolExecutableAllocator::notifyPageIsFree):
3603         * jit/JIT.cpp:
3604         (JSC::JIT::privateCompileMainPass):
3605         (JSC::JIT::privateCompileSlowCases):
3606         (JSC::JIT::privateCompile):
3607         * jit/JITArithmetic.cpp:
3608         (JSC::JIT::emitSlow_op_mod):
3609         * jit/JITArithmetic32_64.cpp:
3610         (JSC::JIT::emitBinaryDoubleOp):
3611         (JSC::JIT::emitSlow_op_mod):
3612         * jit/JITPropertyAccess.cpp:
3613         (JSC::JIT::isDirectPutById):
3614         * jit/JITStubs.cpp:
3615         (JSC::getPolymorphicAccessStructureListSlot):
3616         (JSC::DEFINE_STUB_FUNCTION):
3617         * llint/LLIntSlowPaths.cpp:
3618         (JSC::LLInt::jitCompileAndSetHeuristics):
3619         * parser/Lexer.cpp:
3620         (JSC::::lex):
3621         * parser/Nodes.h:
3622         (JSC::ExpressionNode::emitBytecodeInConditionContext):
3623         * parser/Parser.h:
3624         (JSC::Parser::getTokenName):
3625         (JSC::Parser::updateErrorMessageSpecialCase):
3626         * parser/SyntaxChecker.h:
3627         (JSC::SyntaxChecker::operatorStackPop):
3628         * runtime/Arguments.cpp:
3629         (JSC::Arguments::tearOffForInlineCallFrame):
3630         * runtime/DatePrototype.cpp:
3631         (JSC::formatLocaleDate):
3632         * runtime/Executable.cpp:
3633         (JSC::samplingDescription):
3634         * runtime/Executable.h:
3635         (JSC::ScriptExecutable::unlinkCalls):
3636         * runtime/Identifier.cpp:
3637         (JSC):
3638         * runtime/InternalFunction.cpp:
3639         (JSC::InternalFunction::getCallData):
3640         * runtime/JSArray.cpp:
3641         (JSC::JSArray::push):
3642         (JSC::JSArray::sort):
3643         * runtime/JSCell.cpp:
3644         (JSC::JSCell::defaultValue):
3645         (JSC::JSCell::getOwnPropertyNames):
3646         (JSC::JSCell::getOwnNonIndexPropertyNames):
3647         (JSC::JSCell::className):
3648         (JSC::JSCell::getPropertyNames):
3649         (JSC::JSCell::customHasInstance):
3650         (JSC::JSCell::putDirectVirtual):
3651         (JSC::JSCell::defineOwnProperty):
3652         (JSC::JSCell::getOwnPropertyDescriptor):
3653         * runtime/JSCell.h:
3654         (JSCell):
3655         * runtime/JSNameScope.cpp:
3656         (JSC::JSNameScope::put):
3657         * runtime/JSObject.cpp:
3658         (JSC::JSObject::getOwnPropertySlotByIndex):
3659         (JSC::JSObject::putByIndex):
3660         (JSC::JSObject::ensureArrayStorageSlow):
3661         (JSC::JSObject::deletePropertyByIndex):
3662         (JSC::JSObject::getOwnPropertyNames):
3663         (JSC::JSObject::putByIndexBeyondVectorLength):
3664         (JSC::JSObject::putDirectIndexBeyondVectorLength):
3665         (JSC::JSObject::getOwnPropertyDescriptor):
3666         * runtime/JSObject.h:
3667         (JSC::JSObject::canGetIndexQuickly):
3668         (JSC::JSObject::getIndexQuickly):
3669         (JSC::JSObject::tryGetIndexQuickly):
3670         (JSC::JSObject::canSetIndexQuickly):
3671         (JSC::JSObject::canSetIndexQuicklyForPutDirect):
3672         (JSC::JSObject::setIndexQuickly):
3673         (JSC::JSObject::initializeIndex):
3674         (JSC::JSObject::hasSparseMap):
3675         (JSC::JSObject::inSparseIndexingMode):
3676         * runtime/JSScope.cpp:
3677         (JSC::JSScope::isDynamicScope):
3678         * runtime/JSSymbolTableObject.cpp:
3679         (JSC::JSSymbolTableObject::putDirectVirtual):
3680         * runtime/JSSymbolTableObject.h:
3681         (JSSymbolTableObject):
3682         * runtime/LiteralParser.cpp:
3683         (JSC::::parse):
3684         * runtime/RegExp.cpp:
3685         (JSC::RegExp::compile):
3686         (JSC::RegExp::compileMatchOnly):
3687         * runtime/StructureTransitionTable.h:
3688         (JSC::newIndexingType):
3689         * tools/CodeProfile.cpp:
3690         (JSC::CodeProfile::sample):
3691         * yarr/YarrCanonicalizeUCS2.h:
3692         (JSC::Yarr::getCanonicalPair):
3693         (JSC::Yarr::areCanonicallyEquivalent):
3694         * yarr/YarrInterpreter.cpp:
3695         (JSC::Yarr::Interpreter::matchCharacterClass):
3696         (JSC::Yarr::Interpreter::matchBackReference):
3697         (JSC::Yarr::Interpreter::backtrackParenthesesTerminalEnd):
3698         (JSC::Yarr::Interpreter::matchParentheses):
3699         (JSC::Yarr::Interpreter::backtrackParentheses):
3700         (JSC::Yarr::Interpreter::matchDisjunction):
3701         * yarr/YarrJIT.cpp:
3702         (JSC::Yarr::YarrGenerator::generateTerm):
3703         (JSC::Yarr::YarrGenerator::backtrackTerm):
3704         * yarr/YarrParser.h:
3705         (JSC::Yarr::Parser::CharacterClassParserDelegate::assertionWordBoundary):
3706         (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBackReference):
3707         * yarr/YarrPattern.cpp:
3708         (JSC::Yarr::YarrPatternConstructor::atomCharacterClassBuiltIn):
3709
3710 2013-01-23  Tony Chang  <tony@chromium.org>
3711
3712         Unreviewed, set svn:eol-style to CRLF on Windows .sln files.
3713
3714         * JavaScriptCore.vcproj/JavaScriptCore.sln: Modified property svn:eol-style.
3715         * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Modified property svn:eol-style.
3716
3717 2013-01-23  Oliver Hunt  <oliver@apple.com>
3718
3719         Replace numerous manual CRASH's in JSC with RELEASE_ASSERT
3720         https://bugs.webkit.org/show_bug.cgi?id=107726
3721
3722         Reviewed by Filip Pizlo.
3723
3724         Fairly manual change from if (foo) CRASH(); to RELEASE_ASSERT(!foo);
3725
3726         * assembler/MacroAssembler.h:
3727         (JSC::MacroAssembler::branchAdd32):
3728         (JSC::MacroAssembler::branchMul32):
3729         * bytecode/CodeBlockHash.cpp:
3730         (JSC::CodeBlockHash::CodeBlockHash):
3731         * heap/BlockAllocator.h:
3732         (JSC::Region::create):
3733         (JSC::Region::createCustomSize):
3734         * heap/GCAssertions.h:
3735         * heap/HandleSet.cpp:
3736         (JSC::HandleSet::visitStrongHandles):
3737         (JSC::HandleSet::writeBarrier):
3738         * heap/HandleSet.h:
3739         (JSC::HandleSet::allocate):
3740         * heap/Heap.cpp:
3741         (JSC::Heap::collect):
3742         * heap/SlotVisitor.cpp:
3743         (JSC::SlotVisitor::validate):
3744         * interpreter/Interpreter.cpp:
3745         (JSC::Interpreter::execute):
3746         * jit/ExecutableAllocator.cpp:
3747         (JSC::DemandExecutableAllocator::allocateNewSpace):
3748         (JSC::ExecutableAllocator::allocate):
3749         * jit/ExecutableAllocator.h:
3750         (JSC::roundUpAllocationSize):
3751         * jit/ExecutableAllocatorFixedVMPool.cpp:
3752         (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
3753         (JSC::ExecutableAllocator::allocate):
3754         * runtime/ButterflyInlines.h:
3755         (JSC::Butterfly::createUninitialized):
3756         * runtime/Completion.cpp:
3757         (JSC::evaluate):
3758         * runtime/JSArray.h:
3759         (JSC::constructArray):
3760         * runtime/JSGlobalObject.cpp:
3761         (JSC::slowValidateCell):
3762         * runtime/JSObject.cpp:
3763         (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
3764         (JSC::JSObject::createArrayStorage):
3765         * tools/TieredMMapArray.h:
3766         (JSC::TieredMMapArray::append):
3767         * yarr/YarrInterpreter.cpp:
3768         (JSC::Yarr::Interpreter::allocDisjunctionContext):
3769         (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
3770         (JSC::Yarr::Interpreter::InputStream::readChecked):
3771         (JSC::Yarr::Interpreter::InputStream::uncheckInput):
3772         (JSC::Yarr::Interpreter::InputStream::atEnd):
3773         (JSC::Yarr::Interpreter::interpret):
3774
3775 2013-01-22  Filip Pizlo  <fpizlo@apple.com>
3776
3777         Convert CSE phase to not rely too much on NodeIndex
3778         https://bugs.webkit.org/show_bug.cgi?id=107616
3779
3780         Reviewed by Geoffrey Garen.
3781         
3782         - Instead of looping over the graph (which assumes that you can simply loop over all
3783           nodes without considering blocks first) to reset node.replacement, do that in the
3784           loop that sets up relevantToOSR, just before running CSE on the block.
3785         
3786         - Instead of having a relevantToOSR bitvector indexed by NodeIndex, made
3787           NodeRelevantToOSR be a NodeFlag. We had exactly one bit left in NodeFlags, so I did
3788           some reshuffling to fit it in.
3789
3790         * dfg/DFGCSEPhase.cpp:
3791         (JSC::DFG::CSEPhase::CSEPhase):
3792         (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
3793         (JSC::DFG::CSEPhase::performNodeCSE):
3794         (JSC::DFG::CSEPhase::performBlockCSE):
3795         (CSEPhase):
3796         * dfg/DFGNodeFlags.h:
3797         (DFG):
3798         * dfg/DFGNodeType.h:
3799         (DFG):
3800
3801 2013-01-21  Kentaro Hara  <haraken@chromium.org>
3802
3803         Implement UIEvent constructor
3804         https://bugs.webkit.org/show_bug.cgi?id=107430
3805
3806         Reviewed by Adam Barth.
3807
3808         Editor's draft: https://dvcs.w3.org/hg/d4e/raw-file/tip/source_respec.htm
3809
3810         UIEvent constructor is implemented under a DOM4_EVENTS_CONSTRUCTOR flag,
3811         which is enabled on Safari and Chromium for now.
3812
3813         * Configurations/FeatureDefines.xcconfig:
3814
3815 2013-01-22  Roger Fong  <roger_fong@apple.com>
3816
3817         Unreviewed VS2010 build fix following r140259.
3818
3819         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
3820         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
3821
3822 2013-01-22  Roger Fong  <roger_fong@apple.com>
3823
3824         JavaScriptCore property sheets, project files and modified build scripts.
3825         https://bugs.webkit.org/show_bug.cgi?id=106987
3826
3827         Reviewed by Brent Fulgham.
3828
3829         * JavaScriptCore.vcxproj: Added.
3830         * JavaScriptCore.vcxproj/JavaScriptCore.resources: Added.
3831         * JavaScriptCore.vcxproj/JavaScriptCore.resources/Info.plist: Added.
3832         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Added.
3833         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Added.
3834         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.user: Added.
3835         * JavaScriptCore.vcxproj/JavaScriptCoreCF.props: Added.
3836         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props: Added.
3837         * JavaScriptCore.vcxproj/JavaScriptCoreDebug.props: Added.
3838         * JavaScriptCore.vcxproj/JavaScriptCoreExports.def: Added.
3839         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make: Added.
3840         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj: Added.
3841         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj.filters: Added.
3842         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj.user: Added.
3843         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedCommon.props: Added.
3844         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedDebug.props: Added.
3845         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedRelease.props: Added.
3846         * JavaScriptCore.vcxproj/JavaScriptCorePostBuild.cmd: Added.
3847         * JavaScriptCore.vcxproj/JavaScriptCorePreBuild.cmd: Added.
3848         * JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd: Added.
3849         * JavaScriptCore.vcxproj/JavaScriptCoreRelease.props: Added.
3850         * JavaScriptCore.vcxproj/LLInt.vcproj: Added.
3851         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly: Added.
3852         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.make: Added.
3853         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.vcxproj: Added.
3854         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.vcxproj.user: Added.
3855         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/build-LLIntAssembly.sh: Added.
3856         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets: Added.
3857         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.make: Added.
3858         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj: Added.
3859         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj.user: Added.
3860         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh: Added.
3861         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor: Added.
3862         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj: Added.
3863         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj.user: Added.
3864         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props: Added.
3865         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props: Added.
3866         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.props: Added.
3867         * JavaScriptCore.vcxproj/build-generated-files.sh: Added.
3868         * JavaScriptCore.vcxproj/copy-files.cmd: Added.
3869         * JavaScriptCore.vcxproj/jsc: Added.
3870         * JavaScriptCore.vcxproj/jsc/jsc.vcxproj: Added.
3871         * JavaScriptCore.vcxproj/jsc/jsc.vcxproj.filters: Added.
3872         * JavaScriptCore.vcxproj/jsc/jsc.vcxproj.user: Added.
3873         * JavaScriptCore.vcxproj/jsc/jscCommon.props: Added.
3874         * JavaScriptCore.vcxproj/jsc/jscDebug.props: Added.
3875         * JavaScriptCore.vcxproj/jsc/jscPostBuild.cmd: Added.
3876         * JavaScriptCore.vcxproj/jsc/jscPreBuild.cmd: Added.
3877         * JavaScriptCore.vcxproj/jsc/jscPreLink.cmd: Added.
3878         * JavaScriptCore.vcxproj/jsc/jscRelease.props: Added.
3879         * config.h:
3880
3881 2013-01-22  Joseph Pecoraro  <pecoraro@apple.com>
3882
3883         [Mac] Enable Page Visibility (PAGE_VISIBILITY_API)
3884         https://bugs.webkit.org/show_bug.cgi?id=107230
3885
3886         Reviewed by David Kilzer.
3887
3888         * Configurations/FeatureDefines.xcconfig:
3889
3890 2013-01-22  Tobias Netzel  <tobias.netzel@googlemail.com>
3891
3892         Yarr JIT isn't big endian compatible
3893         https://bugs.webkit.org/show_bug.cgi?id=102897
3894
3895         Reviewed by Oliver Hunt.
3896
3897         This patch was tested in the current mozilla codebase only and has passed the regexp tests there.
3898
3899         * yarr/YarrJIT.cpp:
3900         (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
3901
3902 2013-01-22  David Kilzer  <ddkilzer@apple.com>
3903
3904         Fix DateMath.cpp to compile with -Wshorten-64-to-32
3905         <http://webkit.org/b/107503>
3906
3907         Reviewed by Darin Adler.
3908
3909         * runtime/JSDateMath.cpp:
3910         (JSC::parseDateFromNullTerminatedCharacters): Remove unneeded
3911         static_cast<int>().
3912
3913 2013-01-22  Tim Horton  <timothy_horton@apple.com>
3914
3915         PDFPlugin: Build PDFPlugin everywhere, enable at runtime
3916         https://bugs.webkit.org/show_bug.cgi?id=107117
3917
3918         Reviewed by Alexey Proskuryakov.
3919
3920         Since PDFLayerController SPI is all forward-declared, the plugin should build
3921         on all Mac platforms, and can be enabled at runtime.
3922
3923         * Configurations/FeatureDefines.xcconfig:
3924
3925 2013-01-21  Justin Schuh  <jschuh@chromium.org>
3926
3927         [CHROMIUM] Suppress c4267 build warnings for Win64 targets
3928         https://bugs.webkit.org/show_bug.cgi?id=107499
3929
3930         Reviewed by Abhishek Arya.
3931
3932         * JavaScriptCore.gyp/JavaScriptCore.gyp:
3933
3934 2013-01-21  Dirk Schulze  <dschulze@adobe.com>
3935
3936         Add build flag for Canvas's Path object (disabled by default)
3937         https://bugs.webkit.org/show_bug.cgi?id=107473
3938
3939         Reviewed by Dean Jackson.
3940
3941         Add CANVAS_PATH build flag to build systems.
3942
3943         * Configurations/FeatureDefines.xcconfig:
3944
3945 2013-01-20  Geoffrey Garen  <ggaren@apple.com>
3946
3947         Weak GC maps should be easier to use
3948         https://bugs.webkit.org/show_bug.cgi?id=107312
3949
3950         Reviewed by Sam Weinig.
3951
3952         Follow-up fix.
3953
3954         * runtime/PrototypeMap.cpp:
3955         (JSC::PrototypeMap::emptyObjectStructureForPrototype): Restored this
3956         ASSERT, which was disabled because of a bug in WeakGCMap.
3957
3958         * runtime/WeakGCMap.h:
3959         (JSC::WeakGCMap::add): We can't pass our passed-in value to add() b