Source/JavaScriptCore/ChangeLog

   1 2014-03-28  Michael Saboff  <msaboff@apple.com>
   2
   3         Unreviewed, rolling r166248 back in.
   4
   5         Turns out r166070 didn't cause a 2% performance loss in page load times
   6
   7         Reverted changeset:
   8
   9         Unreviewed, rolling out r166126.
  10         Rollout r166126 in prepartion to roll out prerequisite r166070
  11
  12 2014-03-27  Commit Queue  <commit-queue@webkit.org>
  13
  14         Unreviewed, rolling out r166376.
  15         https://bugs.webkit.org/show_bug.cgi?id=130887
  16
  17         This was a misguided optimization. (Requested by kling on
  18         #webkit).
  19
  20         Reverted changeset:
  21
  22         "Avoid fetching JSObject::structure() repeatedly in
  23         putDirectInternal."
  24         https://bugs.webkit.org/show_bug.cgi?id=130857
  25         http://trac.webkit.org/changeset/166376
  26
  27 2014-03-27  Oliver Hunt  <oliver@apple.com>
  28
  29         Support spread operand in |new| expressions
  30         https://bugs.webkit.org/show_bug.cgi?id=130877
  31
  32         Reviewed by Michael Saboff.
  33
  34         Add support for the spread operator being applied in
  35         |new| expressions.  This required adding support for
  36         a new opcode, op_construct_varargs.  This is a relatively
  37         simple refactoring of the call_varargs implementation.
  38
  39         * bytecode/BytecodeList.json:
  40         * bytecode/BytecodeUseDef.h:
  41         (JSC::computeUsesForBytecodeOffset):
  42         (JSC::computeDefsForBytecodeOffset):
  43         * bytecode/CallLinkInfo.cpp:
  44         (JSC::CallLinkInfo::unlink):
  45         * bytecode/CallLinkInfo.h:
  46         (JSC::CallLinkInfo::callTypeFor):
  47         (JSC::CallLinkInfo::specializationKind):
  48         * bytecode/CodeBlock.cpp:
  49         (JSC::CodeBlock::dumpBytecode):
  50         (JSC::CodeBlock::CodeBlock):
  51         * bytecompiler/BytecodeGenerator.cpp:
  52         (JSC::BytecodeGenerator::emitCallVarargs):
  53         (JSC::BytecodeGenerator::emitConstructVarargs):
  54         (JSC::BytecodeGenerator::emitConstruct):
  55         * bytecompiler/BytecodeGenerator.h:
  56         * jit/JIT.cpp:
  57         (JSC::JIT::privateCompileMainPass):
  58         (JSC::JIT::privateCompileSlowCases):
  59         * jit/JIT.h:
  60         * jit/JITCall.cpp:
  61         (JSC::JIT::compileOpCall):
  62         (JSC::JIT::compileOpCallSlowCase):
  63         (JSC::JIT::emit_op_construct_varargs):
  64         (JSC::JIT::emitSlow_op_construct_varargs):
  65         * jit/JITCall32_64.cpp:
  66         (JSC::JIT::emitSlow_op_construct_varargs):
  67         (JSC::JIT::emit_op_construct_varargs):
  68         (JSC::JIT::compileOpCall):
  69         (JSC::JIT::compileOpCallSlowCase):
  70         * jit/JITOperations.cpp:
  71         * llint/LLIntSlowPaths.cpp:
  72         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
  73         * llint/LLIntSlowPaths.h:
  74         * llint/LowLevelInterpreter.asm:
  75         * parser/Parser.cpp:
  76         (JSC::Parser<LexerType>::parseMemberExpression):
  77
  78 2014-03-27  Filip Pizlo  <fpizlo@apple.com>
  79
  80         Revert http://trac.webkit.org/changeset/166386 because it broke builds.
  81
  82         * Configurations/Base.xcconfig:
  83         * Configurations/LLVMForJSC.xcconfig:
  84
  85 2014-03-27  Filip Pizlo  <fpizlo@apple.com>
  86
  87         Unreviewed, skip this test for now.
  88
  89         * tests/stress/recurse-infinitely-on-getter.js:
  90
  91 2014-03-27  Filip Pizlo  <fpizlo@apple.com>
  92
  93         Switch the LLVMForJSC target to using the LLVM in /usr/local rather than /usr/local/LLVMForJavaScriptCore on iOS
  94         https://bugs.webkit.org/show_bug.cgi?id=130867
  95         <rdar://problem/16432456>
  96
  97         Reviewed by Mark Hahnenberg.
  98
  99         * Configurations/Base.xcconfig:
 100         * Configurations/LLVMForJSC.xcconfig:
 101
 102 2014-03-27  Andreas Kling  <akling@apple.com>
 103
 104         Avoid fetching JSObject::structure() repeatedly in putDirectInternal.
 105         <https://webkit.org/b/130857>
 106
 107         Use the cached Structure* instead of re-fetching it over and over since
 108         that's a non-trivial operation these days.
 109
 110         Reviewed by Mark Hahnenberg.
 111
 112         * runtime/JSObject.h:
 113         (JSC::JSObject::putDirectInternal):
 114
 115 2014-03-27  Mark Hahnenberg  <mhahnenberg@apple.com>
 116
 117         Check the remembered set bit faster
 118         https://bugs.webkit.org/show_bug.cgi?id=130860
 119
 120         Reviewed by Oliver Hunt.
 121
 122         Currently we look up the remembered set bit in the MarkedBlock in C++ code, but
 123         that bit is also stored in the object. We should look it up there whenever possible.
 124
 125         * heap/CopiedBlockInlines.h:
 126         (JSC::CopiedBlock::shouldReportLiveBytes):
 127         * heap/Heap.cpp:
 128         (JSC::Heap::addToRememberedSet):
 129         * heap/Heap.h:
 130         * heap/HeapInlines.h: Removed.
 131         * heap/SlotVisitorInlines.h:
 132         (JSC::SlotVisitor::reportExtraMemoryUsage):
 133
 134 2014-03-27  Joseph Pecoraro  <pecoraro@apple.com>
 135
 136         Web Inspector: Provide SPI to disallow remote inspection of a JSContext
 137         https://bugs.webkit.org/show_bug.cgi?id=130853
 138
 139         Reviewed by Timothy Hatcher.
 140
 141         * API/JSContextPrivate.h: Added.
 142         * API/JSContext.mm:
 143         (-[JSContext _remoteInspectionEnabled]):
 144         (-[JSContext _setRemoteInspectionEnabled:]):
 145         ObjC SPI to enable/disable remote inspection.
 146
 147         * API/JSContextRefPrivate.h:
 148         * API/JSContextRef.cpp:
 149         (JSGlobalContextGetRemoteInspectionEnabled):
 150         (JSGlobalContextSetRemoteInspectionEnabled):
 151         C SPI to enable/disable remote inspection.
 152
 153         * JavaScriptCore.xcodeproj/project.pbxproj:
 154         Add new private header, and export as a private header.
 155
 156 2014-03-27  Mark Hahnenberg  <mhahnenberg@apple.com>
 157
 158         Clean up questionable style in ScriptExecutable::prepareForExecutionImpl
 159         https://bugs.webkit.org/show_bug.cgi?id=130845
 160
 161         Reviewed by Filip Pizlo.
 162
 163         There was a hack added to make sure C Loop LLInt worked which included overriding the
 164         global Options::useLLInt setting, which makes no sense to do here. We should put the
 165         update of the global setting in Options::recomputeDependentOptions along with the other
 166         execution engine flags.
 167
 168         * runtime/Executable.cpp:
 169         (JSC::ScriptExecutable::prepareForExecutionImpl):
 170         * runtime/Options.cpp:
 171         (JSC::recomputeDependentOptions):
 172
 173 2014-03-26  Filip Pizlo  <fpizlo@apple.com>
 174
 175         Enable LLVM stackmap liveOuts computation
 176         https://bugs.webkit.org/show_bug.cgi?id=130821
 177
 178         Reviewed by Andy Estes and Sam Weinig.
 179
 180         * ftl/FTLStackMaps.cpp:
 181         (JSC::FTL::StackMaps::Record::dump):
 182         * llvm/library/LLVMExports.cpp:
 183         (initializeAndGetJSCLLVMAPI):
 184
 185 2014-03-26  Filip Pizlo  <fpizlo@apple.com>
 186
 187         Parse stackmaps liveOuts
 188         https://bugs.webkit.org/show_bug.cgi?id=130801
 189
 190         Reviewed by Geoffrey Garen.
 191
 192         This just adds the code to parse them but doesn't do anything with them, yet.
 193
 194         * ftl/FTLLocation.cpp:
 195         (JSC::FTL::Location::forStackmaps):
 196         * ftl/FTLLocation.h:
 197         (JSC::FTL::Location::forRegister):
 198         (JSC::FTL::Location::forIndirect):
 199         * ftl/FTLStackMaps.cpp:
 200         (JSC::FTL::StackMaps::Location::parse):
 201         (JSC::FTL::StackMaps::Location::dump):
 202         (JSC::FTL::StackMaps::LiveOut::parse):
 203         (JSC::FTL::StackMaps::LiveOut::dump):
 204         (JSC::FTL::StackMaps::Record::parse):
 205         (JSC::FTL::StackMaps::Record::dump):
 206         * ftl/FTLStackMaps.h:
 207
 208 2014-03-26  Mark Lam  <mark.lam@apple.com>
 209
 210         Build fix after r166307.
 211
 212         Not reviewed.
 213
 214         * runtime/JSCell.h:
 215         - The inline function isAPIValueWrapper() should not be exported.  This
 216           was causing a linkage error when building for 32-bit x86 on Mac.
 217
 218 2014-03-26  Filip Pizlo  <fpizlo@apple.com>
 219
 220         Reasoning about DWARF register numbers should be moved out of FTL::Location
 221         https://bugs.webkit.org/show_bug.cgi?id=130792
 222
 223         Reviewed by Oliver Hunt.
 224
 225         Moving this code makes it possible for things other than FTL::Location to reason about
 226         DWARF register encoding. This refactoring also appears to reduce some code duplication
 227         and makes FTLLocation.cpp cleaner.
 228
 229         * JavaScriptCore.xcodeproj/project.pbxproj:
 230         * ftl/FTLCompile.cpp:
 231         (JSC::FTL::fixFunctionBasedOnStackMaps):
 232         * ftl/FTLDWARFRegister.cpp: Added.
 233         (JSC::FTL::DWARFRegister::reg):
 234         (JSC::FTL::DWARFRegister::dump):
 235         * ftl/FTLDWARFRegister.h: Added.
 236         (JSC::FTL::DWARFRegister::DWARFRegister):
 237         (JSC::FTL::DWARFRegister::dwarfRegNum):
 238         * ftl/FTLLocation.cpp:
 239         (JSC::FTL::Location::dump):
 240         (JSC::FTL::Location::isGPR):
 241         (JSC::FTL::Location::gpr):
 242         (JSC::FTL::Location::isFPR):
 243         (JSC::FTL::Location::fpr):
 244         * ftl/FTLLocation.h:
 245         (JSC::FTL::Location::hasDwarfReg):
 246         (JSC::FTL::Location::dwarfReg):
 247
 248 2014-03-26  Brent Fulgham  <bfulgham@apple.com>
 249
 250         Unreviewed build fix.
 251
 252         * runtime/JSCell.h: VS2013 confused about argument type.
 253
 254 2014-03-26  Zoltan Horvath  <zoltan@webkit.org>
 255
 256         [CSS Shapes] Remove shape-inside support
 257         https://bugs.webkit.org/show_bug.cgi?id=130698
 258
 259         Reviewed by David Hyatt.
 260
 261         * Configurations/FeatureDefines.xcconfig:
 262
 263 2014-03-26  Dániel Bátyai  <dbatyai.u-szeged@partner.samsung.com>
 264
 265         Rename hasFastArrayStorage to be more appropriate
 266         https://bugs.webkit.org/show_bug.cgi?id=130773
 267
 268         Reviewed by Filip Pizlo.
 269
 270         * dfg/DFGArrayMode.cpp:
 271         (JSC::DFG::ArrayMode::alreadyChecked):
 272         * dfg/DFGSpeculativeJIT32_64.cpp:
 273         (JSC::DFG::SpeculativeJIT::compile):
 274         * dfg/DFGSpeculativeJIT64.cpp:
 275         (JSC::DFG::SpeculativeJIT::compile):
 276         * dfg/DFGWatchpointCollectionPhase.cpp:
 277         (JSC::DFG::WatchpointCollectionPhase::handle):
 278         * ftl/FTLLowerDFGToLLVM.cpp:
 279         (JSC::FTL::LowerDFGToLLVM::compileNewArray):
 280         (JSC::FTL::LowerDFGToLLVM::compileNewArrayBuffer):
 281         (JSC::FTL::LowerDFGToLLVM::compileNewArrayWithSize):
 282         * runtime/ButterflyInlines.h:
 283         (JSC::Butterfly::unshift):
 284         (JSC::Butterfly::shift):
 285         * runtime/IndexingHeaderInlines.h:
 286         (JSC::IndexingHeader::preCapacity):
 287         * runtime/IndexingType.h:
 288         (JSC::hasArrayStorage):
 289         (JSC::hasAnyArrayStorage):
 290         (JSC::hasFastArrayStorage): Deleted.
 291         * runtime/JSArray.cpp:
 292         (JSC::JSArray::sortVector):
 293         (JSC::JSArray::compactForSorting):
 294         * runtime/JSArray.h:
 295         (JSC::JSArray::create):
 296         (JSC::JSArray::tryCreateUninitialized):
 297         * runtime/JSGlobalObject.cpp:
 298         * runtime/JSObject.cpp:
 299         (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
 300         * runtime/JSObject.h:
 301         (JSC::JSObject::ensureArrayStorage):
 302         (JSC::JSObject::arrayStorage):
 303         * runtime/StructureTransitionTable.h:
 304         (JSC::newIndexingType):
 305
 306 2014-03-26  Zan Dobersek  <zdobersek@igalia.com>
 307
 308         Unreviewed. Removing the remaining Automake cruft.
 309
 310         * GNUmakefile.list.am: Removed.
 311
 312 2014-03-25  Filip Pizlo  <fpizlo@apple.com>
 313
 314         Arguments simplification phase should be fine with marking the arguments local itself as an arguments alias
 315         https://bugs.webkit.org/show_bug.cgi?id=130764
 316         <rdar://problem/16304788>
 317
 318         Reviewed by Sam Weinig.
 319
 320         Being an arguments alias just means that your OSR exit recovery should attempt arguments
 321         creation. This is true of arguments locals. We had special cases that tried to make it not
 322         true of arguments locals. The only consequence of those special cases was to cause crashes
 323         in case of arguments that are also captured variables (i.e. we have SlowArguments). This
 324         change just removes those special cases.
 325
 326         This change means that the FTL will now see SetLocals with a FlushedArguments format.
 327         Previously you wouldn't see them because previously only non-captured variable would be
 328         arguments aliases, and non-captured variables get completely SSAified - i.e. no SetLocals
 329         left. Adding handling for FlushedArguments is a benign and simple change since its
 330         behavior is identical to FlushedJSValue for that code's purposes.
 331
 332         * dfg/DFGArgumentsSimplificationPhase.cpp:
 333         (JSC::DFG::ArgumentsSimplificationPhase::run):
 334         * ftl/FTLLowerDFGToLLVM.cpp:
 335         (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
 336         * tests/stress/captured-arguments-variable.js: Added.
 337         (foo):
 338         (noInline):
 339
 340 2014-03-25  Mark Hahnenberg  <mhahnenberg@apple.com>
 341
 342         Add HeapInlines
 343         https://bugs.webkit.org/show_bug.cgi?id=130759
 344
 345         Reviewed by Filip Pizlo.
 346
 347         * GNUmakefile.list.am:
 348         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
 349         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
 350         * JavaScriptCore.xcodeproj/project.pbxproj:
 351         * heap/Heap.cpp:
 352         (JSC::MarkedBlockSnapshotFunctor::MarkedBlockSnapshotFunctor):
 353         (JSC::MarkedBlockSnapshotFunctor::operator()):
 354         * heap/Heap.h: Also reindented while we're here.
 355         (JSC::Heap::writeBarrierBuffer):
 356         (JSC::Heap::vm):
 357         (JSC::Heap::objectSpace):
 358         (JSC::Heap::machineThreads):
 359         (JSC::Heap::operationInProgress):
 360         (JSC::Heap::allocatorForObjectWithoutDestructor):
 361         (JSC::Heap::allocatorForObjectWithNormalDestructor):
 362         (JSC::Heap::allocatorForObjectWithImmortalStructureDestructor):
 363         (JSC::Heap::storageAllocator):
 364         (JSC::Heap::notifyIsSafeToCollect):
 365         (JSC::Heap::isSafeToCollect):
 366         (JSC::Heap::handleSet):
 367         (JSC::Heap::handleStack):
 368         (JSC::Heap::lastFullGCLength):
 369         (JSC::Heap::lastEdenGCLength):
 370         (JSC::Heap::increaseLastFullGCLength):
 371         (JSC::Heap::sizeBeforeLastEdenCollection):
 372         (JSC::Heap::sizeAfterLastEdenCollection):
 373         (JSC::Heap::sizeBeforeLastFullCollection):
 374         (JSC::Heap::sizeAfterLastFullCollection):
 375         (JSC::Heap::jitStubRoutines):
 376         (JSC::Heap::isDeferred):
 377         (JSC::Heap::structureIDTable):
 378         (JSC::Heap::removeCodeBlock):
 379         * heap/HeapInlines.h: Added.
 380         (JSC::Heap::shouldCollect):
 381         (JSC::Heap::isBusy):
 382         (JSC::Heap::isCollecting):
 383         (JSC::Heap::heap):
 384         (JSC::Heap::isLive):
 385         (JSC::Heap::isInRememberedSet):
 386         (JSC::Heap::isMarked):
 387         (JSC::Heap::testAndSetMarked):
 388         (JSC::Heap::setMarked):
 389         (JSC::Heap::isWriteBarrierEnabled):
 390         (JSC::Heap::writeBarrier):
 391         (JSC::Heap::reportExtraMemoryCost):
 392         (JSC::Heap::forEachProtectedCell):
 393         (JSC::Heap::forEachCodeBlock):
 394         (JSC::Heap::allocateWithNormalDestructor):
 395         (JSC::Heap::allocateWithImmortalStructureDestructor):
 396         (JSC::Heap::allocateWithoutDestructor):
 397         (JSC::Heap::tryAllocateStorage):
 398         (JSC::Heap::tryReallocateStorage):
 399         (JSC::Heap::ascribeOwner):
 400         (JSC::Heap::blockAllocator):
 401         (JSC::Heap::releaseSoon):
 402         (JSC::Heap::incrementDeferralDepth):
 403         (JSC::Heap::decrementDeferralDepth):
 404         (JSC::Heap::collectIfNecessaryOrDefer):
 405         (JSC::Heap::decrementDeferralDepthAndGCIfNeeded):
 406         (JSC::Heap::markListSet):
 407         * runtime/JSCInlines.h:
 408
 409 2014-03-25  Filip Pizlo  <fpizlo@apple.com>
 410
 411         DFG::ByteCodeParser::SetMode should distinguish between setting immediately without a flush and setting immediately with a flush
 412         https://bugs.webkit.org/show_bug.cgi?id=130760
 413
 414         Reviewed by Mark Hahnenberg.
 415
 416         * dfg/DFGByteCodeParser.cpp:
 417         (JSC::DFG::ByteCodeParser::setLocal):
 418         (JSC::DFG::ByteCodeParser::setArgument):
 419         (JSC::DFG::ByteCodeParser::handleInlining):
 420         (JSC::DFG::ByteCodeParser::parseBlock):
 421         * tests/stress/assign-argument-in-inlined-call.js: Added.
 422         (f1):
 423         (getF2Arguments):
 424         (f2):
 425         (f3):
 426         * tests/stress/assign-captured-argument-in-inlined-call.js: Added.
 427         (f1):
 428         (f2):
 429         (f3):
 430
 431 2014-03-25  Filip Pizlo  <fpizlo@apple.com>
 432
 433         Fix 32-bit getter call alignment.
 434
 435         Reviewed by Mark Hahnenberg.
 436
 437         * jit/Repatch.cpp:
 438         (JSC::generateGetByIdStub):
 439
 440 2014-03-25  Filip Pizlo  <fpizlo@apple.com>
 441
 442         Repatch should plant calls to getters directly rather than through a C helper
 443         https://bugs.webkit.org/show_bug.cgi?id=129589
 444
 445         Reviewed by Mark Hahnenberg.
 446
 447         As the title says. All of the superstructure for this was already in place, so now it
 448         was just a matter of actually emitting the call.
 449
 450         8x speed-up for getter microbenchmarks.
 451
 452         * CMakeLists.txt:
 453         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
 454         * JavaScriptCore.xcodeproj/project.pbxproj:
 455         * bytecode/PolymorphicGetByIdList.h:
 456         (JSC::GetByIdAccess::doesCalls):
 457         * jit/AccessorCallJITStubRoutine.cpp: Added.
 458         (JSC::AccessorCallJITStubRoutine::AccessorCallJITStubRoutine):
 459         (JSC::AccessorCallJITStubRoutine::~AccessorCallJITStubRoutine):
 460         (JSC::AccessorCallJITStubRoutine::visitWeak):
 461         * jit/AccessorCallJITStubRoutine.h: Added.
 462         * jit/AssemblyHelpers.h:
 463         (JSC::AssemblyHelpers::storeCell):
 464         * jit/GCAwareJITStubRoutine.h:
 465         * jit/Repatch.cpp:
 466         (JSC::generateGetByIdStub):
 467         * runtime/GetterSetter.h:
 468         (JSC::GetterSetter::offsetOfGetter):
 469         (JSC::GetterSetter::offsetOfSetter):
 470
 471 2014-03-25  Michael Saboff  <msaboff@apple.com>
 472
 473         Unreviewed, rolling out r166126.
 474
 475         Rollout r166126 in prepartion to roll out prerequisite r166070
 476
 477         Reverted changeset:
 478
 479         "toThis() on a JSWorkerGlobalScope should return a JSProxy and
 480         not undefined"
 481         https://bugs.webkit.org/show_bug.cgi?id=130554
 482         http://trac.webkit.org/changeset/166126
 483
 484 2014-03-25  Oliver Hunt  <oliver@apple.com>
 485
 486         AST incorrectly conflates readable and writable locations
 487         https://bugs.webkit.org/show_bug.cgi?id=130734
 488
 489         Reviewed by Filip Pizlo.
 490
 491         We need to distinguish between "locations" that are valid for reading
 492         and writing, vs those that may only be written.
 493
 494         * bytecompiler/NodesCodegen.cpp:
 495         (JSC::ForInNode::emitBytecode):
 496         (JSC::ForOfNode::emitBytecode):
 497         * parser/Nodes.h:
 498         (JSC::ExpressionNode::isAssignmentLocation):
 499
 500 2014-03-24  Oliver Hunt  <oliver@apple.com>
 501
 502         ASSERTION FAILED in Parser: dst != localReg
 503         https://bugs.webkit.org/show_bug.cgi?id=130710
 504
 505         Reviewed by Filip Pizlo.
 506
 507         Just make sure we don't try to write to a captured constant,
 508         following the change to track captured variables separately.
 509
 510         * bytecompiler/NodesCodegen.cpp:
 511         (JSC::PostfixNode::emitResolve):
 512         (JSC::PrefixNode::emitResolve):
 513
 514 2014-03-25  Martin Robinson  <mrobinson@igalia.com>
 515
 516         [GTK] Remove the autotools build
 517         https://bugs.webkit.org/show_bug.cgi?id=130717
 518
 519         Reviewed by Anders Carlsson.
 520
 521         * GNUmakefile.am: Removed.
 522         * config.h: Remove references to the autotools configure file.
 523
 524 2014-03-24  Filip Pizlo  <fpizlo@apple.com>
 525
 526         More scaffolding for a stub routine to have a stub recursively embedded inside it
 527         https://bugs.webkit.org/show_bug.cgi?id=130770
 528
 529         Reviewed by Oliver Hunt.
 530
 531         * bytecode/CallLinkInfo.cpp:
 532         (JSC::CallLinkInfo::unlink): VM& argument is superfluous.
 533         (JSC::CallLinkInfo::visitWeak): Factor this out, it used to be in CodeBlock::finalizeUnconditionally().
 534         * bytecode/CallLinkInfo.h:
 535         * bytecode/CodeBlock.cpp:
 536         (JSC::CodeBlock::finalizeUnconditionally): Factor out some functionality into CallLinkInfo::visitWeak(), and make sure we pass RepatchBuffer& in more places.
 537         (JSC::CodeBlock::unlinkCalls):
 538         (JSC::CodeBlock::unlinkIncomingCalls):
 539         * bytecode/PolymorphicGetByIdList.cpp: Pass RepatchBuffer& through and call JITStubRoutine::visitWeak().
 540         (JSC::GetByIdAccess::visitWeak):
 541         (JSC::PolymorphicGetByIdList::visitWeak):
 542         * bytecode/PolymorphicGetByIdList.h:
 543         * bytecode/PolymorphicPutByIdList.cpp: Pass RepatchBuffer& through and call JITStubRoutine::visitWeak().
 544         (JSC::PutByIdAccess::visitWeak):
 545         (JSC::PolymorphicPutByIdList::visitWeak):
 546         * bytecode/PolymorphicPutByIdList.h:
 547         * bytecode/StructureStubInfo.cpp: Pass RepatchBuffer& through.
 548         (JSC::StructureStubInfo::visitWeakReferences):
 549         * bytecode/StructureStubInfo.h:
 550         * jit/ClosureCallStubRoutine.cpp: isClosureCall is unused.
 551         (JSC::ClosureCallStubRoutine::ClosureCallStubRoutine):
 552         * jit/GCAwareJITStubRoutine.cpp:
 553         (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
 554         (JSC::createJITStubRoutine):
 555         * jit/GCAwareJITStubRoutine.h: Make it easier to construct one of these.
 556         (JSC::GCAwareJITStubRoutine::isClosureCall): Deleted.
 557         * jit/JITStubRoutine.cpp:
 558         (JSC::JITStubRoutine::visitWeak): This will allow future JITStubRoutine subclasses to have stubs recursively embedded inside them.
 559         * jit/JITStubRoutine.h:
 560         * jit/Repatch.cpp:
 561         (JSC::generateGetByIdStub): Fix a possible GC bug where we weren't making the stub routine GC aware.
 562         (JSC::emitCustomSetterStub): Clean up some code.
 563
 564 2014-03-24  Geoffrey Garen  <ggaren@apple.com>
 565
 566         Safari crashes in JavaScriptCore: JSC::JSObject::growOutOfLineStorage
 567         when WebKit is compiled with fcatch-undefined-behavior
 568         https://bugs.webkit.org/show_bug.cgi?id=130652
 569
 570         Reviewed by Mark Hahnenberg.
 571
 572         Use a static member function because the butterfly we pass in might be
 573         NULL, and passing NULL to a member function is undefined behavior.
 574
 575         Stylistically, I think this new way reads a little more clearly, since it
 576         matches createOrGrowArrayRight, and it helps to convey that m_butterfly
 577         might not exist yet.
 578
 579         * runtime/Butterfly.h:
 580         * runtime/ButterflyInlines.h:
 581         (JSC::Butterfly::createOrGrowPropertyStorage): Renamed from growPropertyStorage
 582         because we might create. Split out the create path to avoid using NULL
 583         in a member function expression.
 584
 585         Removed some unused versions of this function.
 586
 587         * runtime/JSObject.cpp:
 588         (JSC::JSObject::growOutOfLineStorage): Updated for interface change.
 589
 590 2014-03-24  Oliver Hunt  <oliver@apple.com>
 591
 592         Strict mode destructuring assignment crashes the parser.
 593         https://bugs.webkit.org/show_bug.cgi?id=130538
 594
 595         Reviewed by Michael Saboff.
 596
 597         The SyntaxChecker mode always return 1 for success, except
 598         for a small subset of functions where we needed exact information.
 599         This ends up just being a poor design decision as it means
 600         the parser can get confused between a function return 1, and
 601         the Resolve constant which was also 1. So we now use a unique
 602         type for every creation method.
 603
 604         * parser/SyntaxChecker.h:
 605         (JSC::SyntaxChecker::createSourceElements):
 606         (JSC::SyntaxChecker::createFunctionBody):
 607         (JSC::SyntaxChecker::createArguments):
 608         (JSC::SyntaxChecker::createSpreadExpression):
 609         (JSC::SyntaxChecker::createArgumentsList):
 610         (JSC::SyntaxChecker::createPropertyList):
 611         (JSC::SyntaxChecker::createElementList):
 612         (JSC::SyntaxChecker::createFormalParameterList):
 613         (JSC::SyntaxChecker::createClause):
 614         (JSC::SyntaxChecker::createClauseList):
 615         (JSC::SyntaxChecker::createFuncDeclStatement):
 616         (JSC::SyntaxChecker::createBlockStatement):
 617         (JSC::SyntaxChecker::createExprStatement):
 618         (JSC::SyntaxChecker::createIfStatement):
 619         (JSC::SyntaxChecker::createForLoop):
 620         (JSC::SyntaxChecker::createForInLoop):
 621         (JSC::SyntaxChecker::createForOfLoop):
 622         (JSC::SyntaxChecker::createEmptyStatement):
 623         (JSC::SyntaxChecker::createVarStatement):
 624         (JSC::SyntaxChecker::createReturnStatement):
 625         (JSC::SyntaxChecker::createBreakStatement):
 626         (JSC::SyntaxChecker::createContinueStatement):
 627         (JSC::SyntaxChecker::createTryStatement):
 628         (JSC::SyntaxChecker::createSwitchStatement):
 629         (JSC::SyntaxChecker::createWhileStatement):
 630         (JSC::SyntaxChecker::createWithStatement):
 631         (JSC::SyntaxChecker::createDoWhileStatement):
 632         (JSC::SyntaxChecker::createLabelStatement):
 633         (JSC::SyntaxChecker::createThrowStatement):
 634         (JSC::SyntaxChecker::createDebugger):
 635         (JSC::SyntaxChecker::createConstStatement):
 636         (JSC::SyntaxChecker::appendConstDecl):
 637         (JSC::SyntaxChecker::combineCommaNodes):
 638         (JSC::SyntaxChecker::operatorStackPop):
 639
 640 2014-03-24  Brent Fulgham  <bfulgham@apple.com>
 641
 642         Activate WebVTT Tests Once Merging is Complete
 643         https://bugs.webkit.org/show_bug.cgi?id=130420
 644
 645         Reviewed by Eric Carlson.
 646
 647         * Configurations/FeatureDefines.xcconfig: Turn on ENABLE(WEBVTT_REGIONS)
 648
 649 2014-03-24  Andreas Kling  <akling@apple.com>
 650
 651         Stop pulling in all the macro assemblers from VM.h
 652         <https://webkit.org/b/130691>
 653
 654         Remove #include of "GPRInfo.h". This breaks WebCore's dependency
 655         on macro assemblers headers and removes 8 includes from every
 656         .cpp file in the JS bindings.
 657
 658         Reviewed by Geoff Garen.
 659
 660         * runtime/VM.h:
 661
 662 2014-03-24  Gavin Barraclough  <barraclough@apple.com>
 663
 664         Add support for thread QoS
 665         https://bugs.webkit.org/show_bug.cgi?id=130688
 666
 667         Reviewed by Andreas Kling.
 668
 669         * heap/BlockAllocator.cpp:
 670         (JSC::BlockAllocator::blockFreeingThreadStartFunc):
 671             - block freeing is a utility activity.
 672
 673 2014-03-24  Filip Pizlo  <fpizlo@apple.com>
 674
 675         Unreviewed, fix CLOOP build.
 676
 677         * bytecode/CallLinkStatus.cpp:
 678         (JSC::CallLinkStatus::computeFor):
 679         * bytecode/CodeBlock.cpp:
 680         (JSC::CodeBlock::printCallOp):
 681         (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex):
 682         (JSC::CodeBlock::resetStubDuringGCInternal): Deleted.
 683         * bytecode/CodeBlock.h:
 684         (JSC::CodeBlock::callLinkInfosEnd): Deleted.
 685
 686 2014-03-24  Gabor Rapcsanyi  <rgabor@webkit.org>
 687
 688         [ARM64] GNU assembler doesn't work with LLInt arm64 backend.
 689         https://bugs.webkit.org/show_bug.cgi?id=130453
 690
 691         Reviewed by Filip Pizlo.
 692
 693         Change fp and lr to x29 and x30. Add both operand kinds to emitARM64()
 694         at sxtw and uxtw instructions.
 695
 696         * offlineasm/arm64.rb:
 697
 698 2014-03-23  Hyowon Kim  <hw1008.kim@samsung.com>
 699
 700         Move all EFL typedefs into EflTypedefs.h.
 701         https://bugs.webkit.org/show_bug.cgi?id=130511
 702
 703         Reviewed by Gyuyoung Kim
 704
 705         * heap/HeapTimer.h: Remove EFL typedefs.
 706
 707 2014-03-23  Filip Pizlo  <fpizlo@apple.com>
 708
 709         Gotta grow the locals vectors if we are about to do SetLocals beyond the bytecode's numCalleeRegisters
 710         https://bugs.webkit.org/show_bug.cgi?id=130650
 711         <rdar://problem/16122966>
 712
 713         Reviewed by Michael Saboff.
 714
 715         Previously, it was only in the case of inlining that we would do SetLocal's beyond the
 716         previously established numLocals limit. But then we added generalized op_call_varargs
 717         handling, which results in us emitting SetLocals that didn't previously exist in the
 718         bytecode.
 719
 720         This factors out the inliner's ensureLocals loop and calls it from op_call_varargs.
 721
 722         * dfg/DFGByteCodeParser.cpp:
 723         (JSC::DFG::ByteCodeParser::ensureLocals):
 724         (JSC::DFG::ByteCodeParser::handleInlining):
 725         (JSC::DFG::ByteCodeParser::parseBlock):
 726         (JSC::DFG::ByteCodeParser::parse):
 727         * ftl/FTLOSRExitCompiler.cpp:
 728         (JSC::FTL::compileStub): Make this do alignment correctly.
 729         * runtime/Options.h:
 730         * tests/stress/call-varargs-from-inlined-code.js: Added.
 731         * tests/stress/call-varargs-from-inlined-code-with-odd-number-of-arguments.js: Added.
 732
 733 2014-03-22  Filip Pizlo  <fpizlo@apple.com>
 734
 735         Unreviewed, adjust sizes for ARM64.
 736
 737         * ftl/FTLInlineCacheSize.cpp:
 738         (JSC::FTL::sizeOfCall):
 739
 740 2014-03-22  Filip Pizlo  <fpizlo@apple.com>
 741
 742         Protect the silent spiller/filler's desire to fill Int32Constants by making sure that we don't mark something as having a Int32 register format if it's a non-Int32 constant
 743         https://bugs.webkit.org/show_bug.cgi?id=130649
 744         <rdar://problem/16399949>
 745
 746         Reviewed by Andreas Kling.
 747
 748         * dfg/DFGSpeculativeJIT32_64.cpp:
 749         (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
 750         * dfg/DFGSpeculativeJIT64.cpp:
 751         (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
 752         * tests/stress/fuzz-bug-16399949.js: Added.
 753         (tryItOut.f):
 754         (tryItOut):
 755
 756 2014-03-22  Filip Pizlo  <fpizlo@apple.com>
 757
 758         Call linking slow paths should be passed a CallLinkInfo* directly so that you can create a call IC without adding it to any CodeBlocks
 759         https://bugs.webkit.org/show_bug.cgi?id=130644
 760
 761         Reviewed by Andreas Kling.
 762
 763         This is conceptually a really simple change but it involves the following:
 764
 765         - The inline part of the call IC stuffs a pointer to the CallLinkInfo into regT2.
 766
 767         - CodeBlock uses a Bag of CallLinkInfos instead of a Vector.
 768
 769         - Remove the significance of a CallLinkInfo's index. This means that DFG::JITCode no
 770           longer has a vector of slow path counts that shadows the CallLinkInfo vector.
 771
 772         - Make CallLinkInfo have its own slowPathCount, which counts actual slow path executions
 773           and not all relinking.
 774
 775         This makes planting JS->JS calls inside other inline caches or stubs a lot easier, since
 776         the CallLinkInfo and the call IC slow paths no longer rely on the call being associated
 777         with a op_call/op_construct instruction and a machine code return PC within such an
 778         instruction.
 779
 780         * bytecode/CallLinkInfo.h:
 781         (JSC::getCallLinkInfoCodeOrigin):
 782         * bytecode/CallLinkStatus.cpp:
 783         (JSC::CallLinkStatus::computeFor):
 784         (JSC::CallLinkStatus::computeDFGStatuses):
 785         * bytecode/CallLinkStatus.h:
 786         * bytecode/CodeBlock.cpp:
 787         (JSC::CodeBlock::printCallOp):
 788         (JSC::CodeBlock::dumpBytecode):
 789         (JSC::CodeBlock::finalizeUnconditionally):
 790         (JSC::CodeBlock::getCallLinkInfoMap):
 791         (JSC::CodeBlock::getCallLinkInfoForBytecodeIndex):
 792         (JSC::CodeBlock::addCallLinkInfo):
 793         (JSC::CodeBlock::unlinkCalls):
 794         * bytecode/CodeBlock.h:
 795         (JSC::CodeBlock::stubInfoBegin):
 796         (JSC::CodeBlock::stubInfoEnd):
 797         (JSC::CodeBlock::callLinkInfosBegin):
 798         (JSC::CodeBlock::callLinkInfosEnd):
 799         (JSC::CodeBlock::byValInfo):
 800         * dfg/DFGByteCodeParser.cpp:
 801         (JSC::DFG::ByteCodeParser::handleCall):
 802         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
 803         * dfg/DFGJITCode.h:
 804         * dfg/DFGJITCompiler.cpp:
 805         (JSC::DFG::JITCompiler::link):
 806         * dfg/DFGJITCompiler.h:
 807         (JSC::DFG::JITCompiler::addJSCall):
 808         (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
 809         * dfg/DFGOSRExitCompilerCommon.cpp:
 810         (JSC::DFG::reifyInlinedCallFrames):
 811         * dfg/DFGSpeculativeJIT.cpp:
 812         (JSC::DFG::SpeculativeJIT::compile):
 813         * dfg/DFGSpeculativeJIT.h:
 814         * dfg/DFGSpeculativeJIT32_64.cpp:
 815         (JSC::DFG::SpeculativeJIT::emitCall):
 816         * dfg/DFGSpeculativeJIT64.cpp:
 817         (JSC::DFG::SpeculativeJIT::emitCall):
 818         * ftl/FTLCompile.cpp:
 819         (JSC::FTL::fixFunctionBasedOnStackMaps):
 820         * ftl/FTLInlineCacheSize.cpp:
 821         (JSC::FTL::sizeOfCall):
 822         * ftl/FTLJSCall.cpp:
 823         (JSC::FTL::JSCall::JSCall):
 824         (JSC::FTL::JSCall::emit):
 825         (JSC::FTL::JSCall::link):
 826         * ftl/FTLJSCall.h:
 827         * jit/JIT.cpp:
 828         (JSC::JIT::privateCompileMainPass):
 829         (JSC::JIT::privateCompileSlowCases):
 830         (JSC::JIT::privateCompile):
 831         * jit/JIT.h:
 832         * jit/JITCall.cpp:
 833         (JSC::JIT::compileOpCall):
 834         (JSC::JIT::compileOpCallSlowCase):
 835         * jit/JITCall32_64.cpp:
 836         (JSC::JIT::compileOpCall):
 837         (JSC::JIT::compileOpCallSlowCase):
 838         * jit/JITOperations.cpp:
 839         * jit/JITOperations.h:
 840         (JSC::operationLinkFor):
 841         (JSC::operationVirtualFor):
 842         (JSC::operationLinkClosureCallFor):
 843         * jit/Repatch.cpp:
 844         (JSC::linkClosureCall):
 845         * jit/ThunkGenerators.cpp:
 846         (JSC::slowPathFor):
 847         (JSC::virtualForThunkGenerator):
 848         * tests/stress/eval-that-is-not-eval.js: Added.
 849
 850 2014-03-22  Filip Pizlo  <fpizlo@apple.com>
 851
 852         Unreviewed, fix mispelled test name.
 853
 854         * tests/stress/constand-folding-osr-exit.js: Removed.
 855         * tests/stress/constant-folding-osr-exit.js: Copied from Source/JavaScriptCore/tests/stress/constand-folding-osr-exit.js.
 856
 857 2014-03-22  Andreas Kling  <akling@apple.com>
 858
 859         CREATE_DOM_WRAPPER doesn't need the ExecState.
 860         <https://webkit.org/b/130648>
 861
 862         Add a fast path from JSGlobalObject to the VM so we don't have
 863         to dance via the Heap.
 864
 865         Reviewed by Darin Adler.
 866
 867         * runtime/JSGlobalObject.cpp:
 868         (JSC::JSGlobalObject::JSGlobalObject):
 869         * runtime/JSGlobalObject.h:
 870         (JSC::JSGlobalObject::vm):
 871
 872 2014-03-22  Filip Pizlo  <fpizlo@apple.com>
 873
 874         Unreviewed, fix FTL build.
 875
 876         * ftl/FTLJITFinalizer.cpp:
 877
 878 2014-03-22  Michael Saboff  <msaboff@apple.com>
 879
 880         toThis() on a JSWorkerGlobalScope should return a JSProxy and not undefined
 881         https://bugs.webkit.org/show_bug.cgi?id=130554
 882
 883         Reviewed by Geoffrey Garen.
 884
 885         Fixed toThis() on WorkerGlobalScope to return a JSProxy instead of the JSGlobalObject.
 886         Did some cleanup as well.  Moved the setting of the thisObject in a JSGlobalObject to
 887         happen in finishCreation() so that it will also happen for other derived classes including
 888         JSWorkerGlobalScopeBase.
 889
 890         * API/JSContextRef.cpp:
 891         (JSGlobalContextCreateInGroup):
 892         * jsc.cpp:
 893         (GlobalObject::create):
 894         * API/tests/testapi.c:
 895         (globalObject_initialize): Eliminated ASSERT that the global object we are creating matches
 896         the result from JSContextGetGlobalObject() as that will return the proxy.
 897         * runtime/JSGlobalObject.cpp:
 898         (JSC::JSGlobalObject::init): Removed thisValue parameter and the call to setGlobalThis() since
 899         we now call setGlobalThis in finishCreation().
 900         * runtime/JSGlobalObject.h:
 901         (JSC::JSGlobalObject::finishCreation):
 902         (JSC::JSGlobalObject::setGlobalThis): Made this a private method.
 903
 904 2014-03-22  Andreas Kling  <akling@apple.com>
 905
 906         Fix debug build.
 907
 908         * bytecode/CodeBlock.cpp:
 909         * runtime/Executable.cpp:
 910
 911 2014-03-22  Andreas Kling  <akling@apple.com>
 912
 913         Cut down on JSC profiler includes in WebCore & co.
 914         <https://webkit.org/b/130637>
 915
 916         Most of WebKit was pulling in JSC's profiler headers via VM.h.
 917
 918         Reviewed by Darin Adler.
 919
 920         * dfg/DFGDisassembler.cpp:
 921         * dfg/DFGDisassembler.h:
 922         * dfg/DFGJITFinalizer.cpp:
 923         * jsc.cpp:
 924         * runtime/VM.cpp:
 925         * runtime/VM.h:
 926
 927 2014-03-22  Landry Breuil <landry@openbsd.org>
 928
 929         Use pthread_stackseg_np() to find the stack bounds on OpenBSD.
 930         https://bugs.webkit.org/show_bug.cgi?id=129965
 931
 932         Reviewed By Anders Carlsson.
 933
 934 2014-03-21  Mark Lam  <mark.lam@apple.com>
 935
 936         Crash when BytecodeGenerator::emitJump calls Label::bind on null pointer.
 937         <https://webkit.org/b/124508>
 938
 939         Reviewed by Oliver Hunt.
 940
 941         The issue is that BreakNode::emitBytecode() is holding onto a LabelScope
 942         pointer from the BytecodeGenerator's m_localScopes vector, and then it
 943         calls emitPopScopes().  emitPopScopes() may do finally clause handling
 944         which will require the m_localScopes to be cloned so that it can change
 945         the local scopes for the finally block, and then restore it after
 946         handling the finally clause.  These modifications of the m_localScopes
 947         vector will result in the LabelScope pointer in BreakNode::emitBytecode()
 948         becoming stale, thereby causing the crash.
 949
 950         The same issue applies to the ContinueNode as well.
 951
 952         The fix is to use the existing LabelScopePtr abstraction instead of raw
 953         LabelScope pointers.  The LabelScopePtr is resilient to the underlying
 954         vector re-allocating its backing store.
 955
 956         I also changed the LabelScopePtr constructor that takes a LabelScopeStore
 957         to expect a reference to the owner store instead of a pointer because the
 958         owner store should never be a null pointer.
 959
 960         * bytecompiler/BytecodeGenerator.cpp:
 961         (JSC::BytecodeGenerator::newLabelScope):
 962         (JSC::BytecodeGenerator::breakTarget):
 963         (JSC::BytecodeGenerator::continueTarget):
 964         * bytecompiler/BytecodeGenerator.h:
 965         * bytecompiler/LabelScope.h:
 966         (JSC::LabelScopePtr::LabelScopePtr):
 967         (JSC::LabelScopePtr::operator bool):
 968         (JSC::LabelScopePtr::null):
 969         * bytecompiler/NodesCodegen.cpp:
 970         (JSC::ContinueNode::trivialTarget):
 971         (JSC::ContinueNode::emitBytecode):
 972         (JSC::BreakNode::trivialTarget):
 973         (JSC::BreakNode::emitBytecode):
 974
 975 2014-03-21  Mark Hahnenberg  <mhahnenberg@apple.com>
 976
 977         6% SunSpider commandline regression due to r165940
 978         https://bugs.webkit.org/show_bug.cgi?id=130617
 979
 980         Reviewed by Michael Saboff.
 981
 982         In GCActivityCallback::didAllocate, lastGCLength() returns 0 if we've never collected
 983         before. Some of the benchmarks are never running a single EdenCollection, which causes
 984         them to repeatedly call scheduleTimer with a newDelay of 0. This defeats our timer
 985         slop heuristic, causing us to invoke CFRunLoopTimerSetNextFireDate a couple orders of
 986         magnitude more than we normally would.
 987
 988         The fix is to seed the last GC lengths in Heap with a non-zero length so that our heuristic works.
 989
 990         * heap/Heap.cpp:
 991         (JSC::Heap::Heap):
 992
 993 2014-03-21  Filip Pizlo  <fpizlo@apple.com>
 994
 995         Constants folded by DFG::ByteCodeParser should not be dead.
 996         https://bugs.webkit.org/show_bug.cgi?id=130576
 997
 998         Reviewed by Mark Hahnenberg.
 999
1000         This fixes bugs in the ByteCodeParser's constant folder by removing that constant folder. This
1001         reduces the number of folders in JSC from fourish to just threeish (parser, DFG AI, and one
1002         or more folders in LLVM). Doing so has no performance impact since the other constant folders
1003         already subsume this one.
1004
1005         Also added a test case for the specific bug that instigated this.
1006
1007         * dfg/DFGByteCodeParser.cpp:
1008         (JSC::DFG::ByteCodeParser::getJSConstantForValue):
1009         (JSC::DFG::ByteCodeParser::getJSConstant):
1010         (JSC::DFG::ByteCodeParser::inferredConstant):
1011         (JSC::DFG::ByteCodeParser::handleIntrinsic):
1012         (JSC::DFG::ByteCodeParser::parseBlock):
1013         * dfg/DFGNode.h:
1014         * dfg/DFGNodeFlags.h:
1015         * tests/stress/constand-folding-osr-exit.js: Added.
1016         (foo):
1017         (test):
1018         (.var):
1019
1020 2014-03-21  Mark Lam  <mark.lam@apple.com>
1021
1022         StackLayoutPhase should find the union'ed calleeVariable before accessing its machineLocal.
1023         <https://webkit.org/b/130566>
1024
1025         Reviewed by Filip Pizlo.
1026
1027         * dfg/DFGStackLayoutPhase.cpp:
1028         (JSC::DFG::StackLayoutPhase::run):
1029
1030 2014-03-20  Filip Pizlo  <fpizlo@apple.com>
1031
1032         FTL should correctly compile GetByVal on Uint32Array that claims to return non-int32 values
1033         https://bugs.webkit.org/show_bug.cgi?id=130562
1034         <rdar://problem/16382842>
1035
1036         Reviewed by Geoffrey Garen.
1037
1038         * ftl/FTLLowerDFGToLLVM.cpp:
1039         (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
1040         * tests/stress/uint32array-unsigned-load.js: Added.
1041         (foo):
1042
1043 2014-03-20  Brian Burg  <bburg@apple.com>
1044
1045         Web Inspector: add frontend controller and models for replay sessions
1046         https://bugs.webkit.org/show_bug.cgi?id=130145
1047
1048         Reviewed by Joseph Pecoraro.
1049
1050         * inspector/scripts/CodeGeneratorInspector.py: Add the conditional Replay domain.
1051
1052 2014-03-20  Filip Pizlo  <fpizlo@apple.com>
1053
1054         FTL ValueToInt32 mishandles the constant case, and by the way, there is a constant case that the FTL sees
1055         https://bugs.webkit.org/show_bug.cgi?id=130546
1056         <rdar://problem/16383308>
1057
1058         Reviewed by Mark Hahnenberg.
1059
1060         Make AI do a better job of folding this.
1061
1062         Also made the FTL backend be more tolerant of data representations. In this case it
1063         didn't know that "constant" was a valid representation. There is a finite set of
1064         possible representations, but broadly, we don't write code that presumes anything
1065         about the representation of an input; that's what methods like lowJSValue() are for.
1066         ValueToInt32 was previously not relying on those methods at all because it had some
1067         hacks. Now, those hacks are just a fast-path optimization but ultimately we fall down
1068         to lowJSValue().
1069
1070         * dfg/DFGAbstractInterpreterInlines.h:
1071         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
1072         * ftl/FTLLowerDFGToLLVM.cpp:
1073         (JSC::FTL::LowerDFGToLLVM::compileValueToInt32):
1074         (JSC::FTL::LowerDFGToLLVM::numberOrNotCellToInt32):
1075         * tests/stress/value-to-int32-undefined-constant.js: Added.
1076         (foo):
1077         * tests/stress/value-to-int32-undefined.js: Added.
1078         (foo):
1079
1080 2014-03-20  Mark Hahnenberg  <mhahnenberg@apple.com>
1081
1082         Add some assertions back
1083         https://bugs.webkit.org/show_bug.cgi?id=130531
1084
1085         Reviewed by Geoffrey Garen.
1086
1087         We removed a useful set of assertions for verifying that MarkedBlocks were
1088         in the state that we expected them to be in after clearing marks in the Heap.
1089         We should add these back to catch bugs earlier.
1090
1091         * heap/MarkedBlock.h:
1092         * heap/MarkedSpace.cpp:
1093         (JSC::VerifyMarkedOrRetired::operator()):
1094         (JSC::MarkedSpace::clearMarks):
1095
1096 2014-03-20  Filip Pizlo  <fpizlo@apple.com>
1097
1098         Implement stackmap header version check and support new stackmap formats
1099         https://bugs.webkit.org/show_bug.cgi?id=130535
1100         <rdar://problem/16164284>
1101
1102         Reviewed by Geoffrey Garen.
1103
1104         Add the notion of versioning so that LLVMers can happily implement new stackmap formats
1105         without worrying about WebKit getting version-locked to LLVM. In the future, we will have
1106         to implement parsing for a new LLVM stackmap format before it lands in LLVM, or we'll have
1107         to have a "max usable LLVM revision" limit. But, thanks to versioning, we'll always be
1108         happy to move backward in time to older versions of LLVM.
1109
1110         * ftl/FTLStackMaps.cpp:
1111         (JSC::FTL::readObject):
1112         (JSC::FTL::StackMaps::Constant::parse):
1113         (JSC::FTL::StackMaps::StackSize::parse):
1114         (JSC::FTL::StackMaps::Location::parse):
1115         (JSC::FTL::StackMaps::Record::parse):
1116         (JSC::FTL::StackMaps::parse):
1117         (JSC::FTL::StackMaps::dump):
1118         (JSC::FTL::StackMaps::dumpMultiline):
1119         * ftl/FTLStackMaps.h:
1120
1121 2014-03-20  Filip Pizlo  <fpizlo@apple.com>
1122
1123         Crash beneath operationTearOffActivation running this JS compression demo
1124         https://bugs.webkit.org/show_bug.cgi?id=130295
1125         <rdar://problem/16332337>
1126
1127         Reviewed by Oliver Hunt.
1128
1129         Make sure that we flush things as if we were at a terminal, if we are at a block with
1130         no forward edges. This fixes infinitely loopy code with captured variables.
1131
1132         Make sure that the CFG simplifier adds explicit flushes whenever it jettisons a block.
1133
1134         Make it so that NodeIsFlushed is a thing. Previously only SSA used it and it computed
1135         it by itself. Now it's an artifact of CPS rethreading.
1136
1137         Add a bunch of tests. All of them previously either crashed or returned bad output due
1138         to memory corruption.
1139
1140         * bytecode/CodeBlock.cpp:
1141         (JSC::CodeBlock::isCaptured):
1142         * dfg/DFGByteCodeParser.cpp:
1143         (JSC::DFG::ByteCodeParser::flushForTerminal):
1144         (JSC::DFG::ByteCodeParser::flushForReturn):
1145         (JSC::DFG::ByteCodeParser::flushIfTerminal):
1146         (JSC::DFG::ByteCodeParser::branchData):
1147         (JSC::DFG::ByteCodeParser::parseBlock):
1148         * dfg/DFGCFGSimplificationPhase.cpp:
1149         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
1150         * dfg/DFGCPSRethreadingPhase.cpp:
1151         (JSC::DFG::CPSRethreadingPhase::run):
1152         (JSC::DFG::CPSRethreadingPhase::computeIsFlushed):
1153         (JSC::DFG::CPSRethreadingPhase::addFlushedLocalOp):
1154         (JSC::DFG::CPSRethreadingPhase::addFlushedLocalEdge):
1155         * dfg/DFGCSEPhase.cpp:
1156         (JSC::DFG::CSEPhase::performNodeCSE):
1157         * dfg/DFGGraph.cpp:
1158         (JSC::DFG::Graph::clearFlagsOnAllNodes):
1159         * dfg/DFGGraph.h:
1160         * dfg/DFGNode.h:
1161         * dfg/DFGNodeFlags.cpp:
1162         (JSC::DFG::dumpNodeFlags):
1163         * dfg/DFGNodeFlags.h:
1164         * dfg/DFGSSAConversionPhase.cpp:
1165         (JSC::DFG::SSAConversionPhase::run):
1166         * tests/stress/activation-test-loop.js: Added.
1167         (Inner.this.doStuff):
1168         (Inner):
1169         (foo.inner.isDone):
1170         (foo):
1171         * tests/stress/inferred-infinite-loop-that-uses-captured-variables.js: Added.
1172         (bar):
1173         (foo):
1174         (noInline):
1175         * tests/stress/infinite-loop-that-uses-captured-variables-before-throwing.js: Added.
1176         (bar):
1177         (foo):
1178         (noInline):
1179         * tests/stress/infinite-loop-that-uses-captured-variables-but-they-do-not-escape.js: Added.
1180         (bar):
1181         (foo):
1182         (noInline):
1183         * tests/stress/infinite-loop-that-uses-captured-variables-with-osr-entry.js: Added.
1184         (bar):
1185         (foo):
1186         (noInline):
1187         * tests/stress/infinite-loop-that-uses-captured-variables.js: Added.
1188         (bar):
1189         (foo):
1190         (noInline):
1191         * tests/stress/tricky-indirectly-inferred-infinite-loop-that-uses-captured-variables-and-creates-the-activation-outside-the-loop.js: Added.
1192         (bar):
1193         (fuzz):
1194         (foo.f):
1195         (foo):
1196         * tests/stress/tricky-inferred-infinite-loop-that-uses-captured-variables-and-creates-the-activation-outside-the-loop.js: Added.
1197         (bar):
1198         (foo.f):
1199         (foo):
1200         * tests/stress/tricky-infinite-loop-that-uses-captured-variables-and-creates-the-activation-outside-the-loop.js: Added.
1201         (bar):
1202         (foo.f):
1203         (foo):
1204         * tests/stress/tricky-infinite-loop-that-uses-captured-variables.js: Added.
1205         (bar):
1206         (foo):
1207         (noInline):
1208
1209 2014-03-20  Oliver Hunt  <oliver@apple.com>
1210
1211         Incorrect behavior when mutating a typed array during set.
1212         https://bugs.webkit.org/show_bug.cgi?id=130428
1213
1214         Reviewed by Geoffrey Garen.
1215
1216         This fixes a null derefence that occurs if a typed array
1217         is mutated during the set() operation. The patch gets rid
1218         of the "Quickly" version of setIndex that is assigning
1219         JSValues of unknown type, as the numeric conversion can trigger
1220         side effects that lead to neutering, and so we deref null.
1221
1222         * runtime/JSGenericTypedArrayView.h:
1223         (JSC::JSGenericTypedArrayView::setIndex):
1224         * runtime/JSGenericTypedArrayViewInlines.h:
1225         (JSC::JSGenericTypedArrayView<Adaptor>::set):
1226         (JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):
1227
1228 2014-03-20  Gavin Barraclough  <barraclough@apple.com>
1229
1230         Remove IdentifierTable typedef, isIdentifier()
1231         https://bugs.webkit.org/show_bug.cgi?id=130533
1232
1233         Rubber stamped by Geoff Garen.
1234
1235         Code should use AtomicStringTable, isAtomic() directly.
1236
1237         * API/JSClassRef.cpp:
1238         (OpaqueJSClass::~OpaqueJSClass):
1239         (OpaqueJSClassContextData::OpaqueJSClassContextData):
1240         (OpaqueJSClass::className):
1241         * API/JSClassRef.h:
1242         * bytecode/SpeculatedType.cpp:
1243         (JSC::speculationFromCell):
1244         * bytecompiler/BytecodeGenerator.cpp:
1245         (JSC::BytecodeGenerator::BytecodeGenerator):
1246         * dfg/DFGSpeculativeJIT.cpp:
1247         (JSC::DFG::SpeculativeJIT::compileIn):
1248         (JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage):
1249         * ftl/FTLLowerDFGToLLVM.cpp:
1250         (JSC::FTL::LowerDFGToLLVM::speculateStringIdent):
1251         * heap/Heap.cpp:
1252         (JSC::Heap::collect):
1253         * interpreter/CallFrame.h:
1254         (JSC::ExecState::atomicStringTable):
1255         * parser/ASTBuilder.h:
1256         (JSC::ASTBuilder::addVar):
1257         * parser/Parser.cpp:
1258         (JSC::Parser<LexerType>::createBindingPattern):
1259         * runtime/Completion.cpp:
1260         (JSC::checkSyntax):
1261         (JSC::evaluate):
1262         * runtime/Identifier.cpp:
1263         (JSC::Identifier::checkCurrentAtomicStringTable):
1264         * runtime/Identifier.h:
1265         (JSC::Identifier::Identifier):
1266         * runtime/IdentifierInlines.h:
1267         (JSC::Identifier::add):
1268         * runtime/JSCJSValue.cpp:
1269         (JSC::JSValue::dumpInContext):
1270         * runtime/JSLock.cpp:
1271         (JSC::JSLock::didAcquireLock):
1272         (JSC::JSLock::willReleaseLock):
1273         (JSC::JSLock::DropAllLocks::DropAllLocks):
1274         (JSC::JSLock::DropAllLocks::~DropAllLocks):
1275         * runtime/JSLock.h:
1276         * runtime/PropertyMapHashTable.h:
1277         (JSC::PropertyTable::find):
1278         (JSC::PropertyTable::get):
1279         (JSC::PropertyTable::findWithString):
1280         * runtime/PropertyName.h:
1281         (JSC::PropertyName::PropertyName):
1282         * runtime/PropertyNameArray.cpp:
1283         (JSC::PropertyNameArray::add):
1284         * runtime/VM.cpp:
1285         (JSC::VM::VM):
1286         (JSC::VM::~VM):
1287         * runtime/VM.h:
1288         (JSC::VM::atomicStringTable):
1289
1290 2014-03-20  Gavin Barraclough  <barraclough@apple.com>
1291
1292         Merge AtomicString, Identifier
1293         https://bugs.webkit.org/show_bug.cgi?id=128624
1294
1295         Reviewed by Geoff Garen.
1296
1297         WTF::StringImpl currently supports two uniquing mechanism - AtomicString and
1298         Identifer - that is one too many.
1299
1300         Remove Identifier in favour of AtomicString. Identifier had two interesting
1301         mechanisms that we preserve.
1302
1303         (1) JSC API VMs each get their own string table, switch the string table on
1304             API entry/exit.
1305         (2) JSC caches a pointer to the string table on the VM to avoid a thread
1306             specific access. Adds a new AtomicString::add method to support this.
1307
1308         * API/JSAPIWrapperObject.mm:
1309             - updated includes.
1310         * JavaScriptCore.xcodeproj/project.pbxproj:
1311             - added IdentifierInlines.h.
1312         * inspector/JSInjectedScriptHostPrototype.cpp:
1313         * inspector/JSJavaScriptCallFramePrototype.cpp:
1314             - updated includes.
1315         * interpreter/CallFrame.h:
1316         (JSC::ExecState::atomicStringTable):
1317             - added, used via AtomicString::add to avoid thread-specific access.
1318         * runtime/ConsolePrototype.cpp:
1319             - updated includes.
1320         * runtime/Identifier.cpp:
1321         (JSC::Identifier::add):
1322         (JSC::Identifier::add8):
1323             - vm->smallStrings.singleCharacterStringRep now returns Atomic strings, use AtomicString::add.
1324         * runtime/Identifier.h:
1325         (JSC::Identifier::Identifier):
1326             - added ASSERTS.
1327         (JSC::Identifier::add):
1328             - vm->smallStrings.singleCharacterStringRep now returns Atomic strings, use AtomicString::add.
1329         * runtime/IdentifierInlines.h: Added.
1330         (JSC::Identifier::add):
1331             - moved from Identifier.h, use AtomicString::add.
1332         * runtime/JSCInlines.h:
1333             - added IdentifierInlines.h.
1334         * runtime/JSLock.h:
1335             - removed IdentifierTable.
1336         * runtime/PropertyNameArray.cpp:
1337             - updated includes.
1338         * runtime/SmallStrings.cpp:
1339         (JSC::SmallStringsStorage::SmallStringsStorage):
1340             - ensure all single character strings are Atomic.
1341         * runtime/VM.cpp:
1342         (JSC::VM::VM):
1343             - instantiate CommonIdentifiers with the correct AtomicStringTable set on thread data.
1344         * runtime/VM.h:
1345         (JSC::VM::atomicStringTable):
1346             - added, used via AtomicString::add to avoid thread-specific access.
1347
1348 2014-03-20  Gabor Rapcsanyi  <rgabor@webkit.org>
1349
1350         [ARM64] Fix assembler build issues and add cacheFlush support for Linux
1351         https://bugs.webkit.org/show_bug.cgi?id=130502
1352
1353         Reviewed by Michael Saboff.
1354
1355         Add limits.h for INT_MIN in ARM64Assembler(). Delete shouldBlindForSpecificArch(uintptr_t)
1356         because on ARM64 uint64_t and uintptr_t is the same with GCC and Clang as well.
1357         Add cacheFlush support for Linux.
1358
1359         * assembler/ARM64Assembler.h:
1360         (JSC::ARM64Assembler::linuxPageFlush):
1361         (JSC::ARM64Assembler::cacheFlush):
1362         * assembler/MacroAssemblerARM64.h:
1363         (JSC::MacroAssemblerARM64::shouldBlindForSpecificArch):
1364
1365 2014-03-19  Gavin Barraclough  <barraclough@apple.com>
1366
1367         https://bugs.webkit.org/show_bug.cgi?id=130494
1368         EmptyUnique strings are Identifiers/Atomic
1369
1370         Reviewed by Geoff Garen.
1371
1372         EmptyUnique strings should set the Identifier/Atomic flag.
1373
1374         This fixes an unreproducible bug we believe exists in Identifier handling.
1375         Expected behaviour is that while Identifiers may reference EmptyUniques
1376         (StringImpls allocated as UIDs for PrivateNames), these are not created
1377         through the main Identifier constructor, the Identifier flag is not set
1378         on PrivateNames, and we should never lookup EmptyUnique strings in the
1379         IdentifierTable.
1380
1381         Unfortunately that was happening. Some tables used to implement property
1382         access in the JIT hold StringImpl*s, and turn these back into Identifiers
1383         using the identfiier constructor. Since the code generator will now plant
1384         by-id (cachable) accesses to PrivateNames we can end up passing an
1385         EmptyUnique to Identifier::add, potentially leading to PrivateNames being
1386         uniqued together (though hard to prove, since the hash codes are random).
1387
1388         * runtime/PropertyName.h:
1389         (JSC::PropertyName::PropertyName):
1390         (JSC::PropertyName::uid):
1391         (JSC::PropertyName::publicName):
1392         (JSC::PropertyName::asIndex):
1393             - PropertyName assumed that PrivateNames are not Identifiers - instead check isEmptyUnique().
1394         * runtime/Structure.cpp:
1395         (JSC::Structure::getPropertyNamesFromStructure):
1396             - Structure assumed that PrivateNames are not Identifiers - instead check isEmptyUnique().
1397
1398 2014-03-19  Filip Pizlo  <fpizlo@apple.com>
1399
1400         Unreviewed, revert the DFGCommon.h change in r165938. It was not intentional.
1401
1402         * dfg/DFGCommon.h:
1403
1404 2014-03-19  Mark Hahnenberg  <mhahnenberg@apple.com>
1405
1406         GC timer should intelligently choose between EdenCollections and FullCollections
1407         https://bugs.webkit.org/show_bug.cgi?id=128261
1408
1409         Reviewed by Geoffrey Garen.
1410
1411         Most of the GCs while browsing the web are due to the GC timer. Currently the GC timer
1412         always does FullCollections. To reduce the impact of the GC timer on the system this patch
1413         changes Heap so that it has two timers, one for each type of collection. The FullCollection
1414         timer is notified at the end of EdenCollections how much the Heap has grown since the last
1415         FullCollection and when somebody notifies the Heap of abandoned memory (which usually wouldn't
1416         be detected by an EdenCollection).
1417
1418         * CMakeLists.txt:
1419         * GNUmakefile.list.am:
1420         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1421         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
1422         * JavaScriptCore.xcodeproj/project.pbxproj:
1423         * heap/EdenGCActivityCallback.cpp: Added.
1424         (JSC::EdenGCActivityCallback::EdenGCActivityCallback):
1425         (JSC::EdenGCActivityCallback::doCollection):
1426         (JSC::EdenGCActivityCallback::lastGCLength):
1427         (JSC::EdenGCActivityCallback::deathRate):
1428         (JSC::EdenGCActivityCallback::gcTimeSlice):
1429         * heap/EdenGCActivityCallback.h: Added.
1430         (JSC::GCActivityCallback::createEdenTimer):
1431         * heap/FullGCActivityCallback.cpp: Added.
1432         (JSC::FullGCActivityCallback::FullGCActivityCallback):
1433         (JSC::FullGCActivityCallback::doCollection):
1434         (JSC::FullGCActivityCallback::lastGCLength):
1435         (JSC::FullGCActivityCallback::deathRate):
1436         (JSC::FullGCActivityCallback::gcTimeSlice):
1437         * heap/FullGCActivityCallback.h: Added.
1438         (JSC::GCActivityCallback::createFullTimer):
1439         * heap/GCActivityCallback.cpp:
1440         (JSC::GCActivityCallback::GCActivityCallback):
1441         (JSC::GCActivityCallback::doWork):
1442         (JSC::GCActivityCallback::scheduleTimer):
1443         (JSC::GCActivityCallback::cancelTimer):
1444         (JSC::GCActivityCallback::didAllocate):
1445         (JSC::GCActivityCallback::willCollect):
1446         (JSC::GCActivityCallback::cancel):
1447         * heap/GCActivityCallback.h:
1448         * heap/Heap.cpp:
1449         (JSC::Heap::Heap):
1450         (JSC::Heap::reportAbandonedObjectGraph):
1451         (JSC::Heap::didAbandon):
1452         (JSC::Heap::collectAllGarbage):
1453         (JSC::Heap::collect):
1454         (JSC::Heap::willStartCollection):
1455         (JSC::Heap::updateAllocationLimits):
1456         (JSC::Heap::didFinishCollection):
1457         (JSC::Heap::setFullActivityCallback):
1458         (JSC::Heap::setEdenActivityCallback):
1459         (JSC::Heap::fullActivityCallback):
1460         (JSC::Heap::edenActivityCallback):
1461         (JSC::Heap::setGarbageCollectionTimerEnabled):
1462         (JSC::Heap::didAllocate):
1463         (JSC::Heap::shouldDoFullCollection):
1464         * heap/Heap.h:
1465         (JSC::Heap::lastFullGCLength):
1466         (JSC::Heap::lastEdenGCLength):
1467         (JSC::Heap::increaseLastFullGCLength):
1468         (JSC::Heap::sizeBeforeLastEdenCollection):
1469         (JSC::Heap::sizeAfterLastEdenCollection):
1470         (JSC::Heap::sizeBeforeLastFullCollection):
1471         (JSC::Heap::sizeAfterLastFullCollection):
1472         * heap/HeapOperation.h:
1473         * heap/HeapStatistics.cpp:
1474         (JSC::HeapStatistics::showObjectStatistics):
1475         * heap/HeapTimer.cpp:
1476         (JSC::HeapTimer::timerDidFire):
1477         * jsc.cpp:
1478         (functionFullGC):
1479         (functionEdenGC):
1480         * runtime/Options.h:
1481
1482 2014-03-19  Commit Queue  <commit-queue@webkit.org>
1483
1484         Unreviewed, rolling out r165926.
1485         https://bugs.webkit.org/show_bug.cgi?id=130488
1486
1487         broke the iOS build (Requested by estes on #webkit).
1488
1489         Reverted changeset:
1490
1491         "GC timer should intelligently choose between EdenCollections
1492         and FullCollections"
1493         https://bugs.webkit.org/show_bug.cgi?id=128261
1494         http://trac.webkit.org/changeset/165926
1495
1496 2014-03-13  Mark Hahnenberg  <mhahnenberg@apple.com>
1497
1498         GC timer should intelligently choose between EdenCollections and FullCollections
1499         https://bugs.webkit.org/show_bug.cgi?id=128261
1500
1501         Reviewed by Geoffrey Garen.
1502
1503         Most of the GCs while browsing the web are due to the GC timer. Currently the GC timer
1504         always does FullCollections. To reduce the impact of the GC timer on the system this patch
1505         changes Heap so that it has two timers, one for each type of collection. The FullCollection
1506         timer is notified at the end of EdenCollections how much the Heap has grown since the last
1507         FullCollection and when somebody notifies the Heap of abandoned memory (which wouldn't be
1508         detected by an EdenCollection).
1509
1510         * heap/GCActivityCallback.cpp:
1511         (JSC::GCActivityCallback::GCActivityCallback):
1512         (JSC::GCActivityCallback::doWork):
1513         (JSC::FullGCActivityCallback::FullGCActivityCallback):
1514         (JSC::FullGCActivityCallback::doCollection):
1515         (JSC::EdenGCActivityCallback::EdenGCActivityCallback):
1516         (JSC::EdenGCActivityCallback::doCollection):
1517         (JSC::GCActivityCallback::scheduleTimer):
1518         (JSC::GCActivityCallback::cancelTimer):
1519         (JSC::GCActivityCallback::didAllocate):
1520         (JSC::GCActivityCallback::willCollect):
1521         (JSC::GCActivityCallback::cancel):
1522         * heap/GCActivityCallback.h:
1523         (JSC::GCActivityCallback::GCActivityCallback):
1524         (JSC::GCActivityCallback::createFullTimer):
1525         (JSC::GCActivityCallback::createEdenTimer):
1526         * heap/Heap.cpp:
1527         (JSC::Heap::Heap):
1528         (JSC::Heap::didAbandon):
1529         (JSC::Heap::willStartCollection):
1530         (JSC::Heap::updateAllocationLimits):
1531         (JSC::Heap::setFullActivityCallback):
1532         (JSC::Heap::setEdenActivityCallback):
1533         (JSC::Heap::fullActivityCallback):
1534         (JSC::Heap::edenActivityCallback):
1535         (JSC::Heap::setGarbageCollectionTimerEnabled):
1536         (JSC::Heap::didAllocate):
1537         * heap/Heap.h:
1538         * heap/HeapTimer.cpp:
1539         (JSC::HeapTimer::timerDidFire):
1540
1541 2014-03-19  Filip Pizlo  <fpizlo@apple.com>
1542
1543         REGRESSION(r165459): It broke 109 jsc stress test on ARM Thumb2 and Mac 32 bit
1544         https://bugs.webkit.org/show_bug.cgi?id=130134
1545
1546         Reviewed by Mark Hahnenberg.
1547
1548         * dfg/DFGFixupPhase.cpp:
1549         (JSC::DFG::FixupPhase::fixupNode): Can't do some optimizations if you don't have a lot of registers.
1550         * dfg/DFGSpeculativeJIT32_64.cpp:
1551         (JSC::DFG::SpeculativeJIT::cachedGetById): Move stuff around before going into the IC code to ensure that we give the IC code the invariants it needs. This only happens in case of GetByIdFlush, where we are forced into using weird combinations of registers because the results have to be in t0/t1.
1552         (JSC::DFG::SpeculativeJIT::compile): For a normal GetById, the register allocator should just do the right thing so nobody has to move anything around.
1553         * jit/JITInlineCacheGenerator.cpp:
1554         (JSC::JITGetByIdGenerator::JITGetByIdGenerator): Assert the things we want.
1555         * jit/JITInlineCacheGenerator.h:
1556         * jit/Repatch.cpp:
1557         (JSC::generateGetByIdStub): Remove a previous incomplete hack to try to work around the DFG's problem.
1558
1559 2014-03-19  Mark Hahnenberg  <mhahnenberg@apple.com>
1560
1561         Normalize some of the older JSC options
1562         https://bugs.webkit.org/show_bug.cgi?id=128753
1563
1564         Reviewed by Michael Saboff.
1565
1566         * runtime/Options.cpp:
1567         (JSC::Options::initialize):
1568
1569 2014-03-12  Mark Lam  <mark.lam@apple.com>
1570
1571         Update type of local vars to match the type of String length.
1572         <https://webkit.org/b/130077>
1573
1574         Reviewed by Geoffrey Garen.
1575
1576         * runtime/JSStringJoiner.cpp:
1577         (JSC::JSStringJoiner::join):
1578
1579 2014-03-18  Filip Pizlo  <fpizlo@apple.com>
1580
1581         Get rid of Flush in SSA
1582         https://bugs.webkit.org/show_bug.cgi?id=130440
1583
1584         Reviewed by Sam Weinig.
1585
1586         This is basically a red patch. We used to use backwards flow for determining what was
1587         flushed, until it became clear that this doesn't make sense. Now the Flush nodes don't
1588         accomplish anything. Keeping them around in SSA can only make things hard.
1589
1590         * CMakeLists.txt:
1591         * GNUmakefile.list.am:
1592         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
1593         * JavaScriptCore.xcodeproj/project.pbxproj:
1594         * dfg/DFGBasicBlock.cpp:
1595         (JSC::DFG::BasicBlock::SSAData::SSAData):
1596         * dfg/DFGBasicBlock.h:
1597         * dfg/DFGFlushLivenessAnalysisPhase.cpp: Removed.
1598         * dfg/DFGFlushLivenessAnalysisPhase.h: Removed.
1599         * dfg/DFGGraph.cpp:
1600         (JSC::DFG::Graph::dump):
1601         * dfg/DFGPlan.cpp:
1602         (JSC::DFG::Plan::compileInThreadImpl):
1603         * dfg/DFGSSAConversionPhase.cpp:
1604         (JSC::DFG::SSAConversionPhase::run):
1605         * ftl/FTLLowerDFGToLLVM.cpp:
1606         (JSC::FTL::LowerDFGToLLVM::compileNode):
1607
1608 2014-03-18  Filip Pizlo  <fpizlo@apple.com>
1609
1610         Unreviewed, fix iOS production build.
1611
1612         * JavaScriptCore.xcodeproj/project.pbxproj:
1613
1614 2014-03-18  Michael Saboff  <msaboff@apple.com>
1615
1616         Update RegExp Tracing code
1617         https://bugs.webkit.org/show_bug.cgi?id=130381
1618
1619         Reviewed by Andreas Kling.
1620
1621         Updated the regular expression tracing code for 8/16 bit JIT as
1622         well as match only entry points.  Also added average string length
1623         metric.
1624
1625         * runtime/RegExp.cpp:
1626         (JSC::RegExp::RegExp):
1627         (JSC::RegExp::match):
1628         (JSC::RegExp::printTraceData):
1629         * runtime/RegExp.h:
1630         * runtime/VM.cpp:
1631         (JSC::VM::addRegExpToTrace):
1632         (JSC::VM::dumpRegExpTrace):
1633         * runtime/VM.h:
1634         * yarr/YarrJIT.h:
1635         (JSC::Yarr::YarrCodeBlock::get8BitMatchOnlyAddr):
1636         (JSC::Yarr::YarrCodeBlock::get16BitMatchOnlyAddr):
1637         (JSC::Yarr::YarrCodeBlock::get8BitMatchAddr):
1638         (JSC::Yarr::YarrCodeBlock::get16BitMatchAddr):
1639
1640 2014-03-17  Filip Pizlo  <fpizlo@apple.com>
1641
1642         Add CompareStrictEq(StringIdent:, NotStringVar:) and CompareStrictEq(String:, Untyped:)
1643         https://bugs.webkit.org/show_bug.cgi?id=130300
1644
1645         Reviewed by Mark Hahnenberg.
1646
1647         We can quickly strictly compare StringIdent's to NotStringVar's and String's to Untyped's.
1648         This makes the DFG aware of this.
1649
1650         Also adds StringIdent-to-StringIdent and StringIdent-to-NotStringVar strict comparisons to
1651         the FTL. Also adds StringIdent-to-StringIdent non-strict comparisons to the FTL.
1652
1653         This also gives the DFG some abstractions for checking something is a cell or is other.
1654         This made this patch easier to write and also simplified a bunch of other stuff.
1655
1656         1% speed-up on Octane.
1657
1658         * assembler/AbstractMacroAssembler.h:
1659         (JSC::AbstractMacroAssembler::JumpList::JumpList):
1660         * bytecode/SpeculatedType.h:
1661         (JSC::isNotStringVarSpeculation):
1662         * dfg/DFGFixupPhase.cpp:
1663         (JSC::DFG::FixupPhase::fixupNode):
1664         * dfg/DFGNode.h:
1665         (JSC::DFG::Node::childFor):
1666         (JSC::DFG::Node::shouldSpeculateNotStringVar):
1667         * dfg/DFGSafeToExecute.h:
1668         (JSC::DFG::SafeToExecuteEdge::operator()):
1669         * dfg/DFGSpeculativeJIT.cpp:
1670         (JSC::DFG::SpeculativeJIT::compileIn):
1671         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
1672         (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
1673         (JSC::DFG::SpeculativeJIT::compileInstanceOf):
1674         (JSC::DFG::SpeculativeJIT::compileStrictEq):
1675         (JSC::DFG::SpeculativeJIT::compileBooleanCompare):
1676         (JSC::DFG::SpeculativeJIT::compileStringEquality):
1677         (JSC::DFG::SpeculativeJIT::compileStringToUntypedEquality):
1678         (JSC::DFG::SpeculativeJIT::compileStringIdentEquality):
1679         (JSC::DFG::SpeculativeJIT::compileStringIdentToNotStringVarEquality):
1680         (JSC::DFG::SpeculativeJIT::compileStringZeroLength):
1681         (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
1682         (JSC::DFG::SpeculativeJIT::speculateString):
1683         (JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage):
1684         (JSC::DFG::SpeculativeJIT::speculateNotStringVar):
1685         (JSC::DFG::SpeculativeJIT::speculateNotCell):
1686         (JSC::DFG::SpeculativeJIT::speculateOther):
1687         (JSC::DFG::SpeculativeJIT::speculate):
1688         (JSC::DFG::SpeculativeJIT::emitSwitchChar):
1689         (JSC::DFG::SpeculativeJIT::emitSwitchString):
1690         * dfg/DFGSpeculativeJIT.h:
1691         (JSC::DFG::SpeculativeJIT::blessedBooleanResult):
1692         (JSC::DFG::SpeculativeJIT::unblessedBooleanResult):
1693         (JSC::DFG::SpeculativeJIT::booleanResult):
1694         * dfg/DFGSpeculativeJIT32_64.cpp:
1695         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
1696         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
1697         (JSC::DFG::SpeculativeJIT::emitCall):
1698         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
1699         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
1700         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
1701         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
1702         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
1703         (JSC::DFG::SpeculativeJIT::compile):
1704         (JSC::DFG::branchIsCell):
1705         (JSC::DFG::branchNotCell):
1706         (JSC::DFG::SpeculativeJIT::branchIsOther):
1707         (JSC::DFG::SpeculativeJIT::branchNotOther):
1708         (JSC::DFG::SpeculativeJIT::moveTrueTo):
1709         (JSC::DFG::SpeculativeJIT::moveFalseTo):
1710         (JSC::DFG::SpeculativeJIT::blessBoolean):
1711         * dfg/DFGSpeculativeJIT64.cpp:
1712         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
1713         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
1714         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
1715         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
1716         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
1717         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
1718         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
1719         (JSC::DFG::SpeculativeJIT::compile):
1720         (JSC::DFG::SpeculativeJIT::writeBarrier):
1721         (JSC::DFG::SpeculativeJIT::branchIsCell):
1722         (JSC::DFG::SpeculativeJIT::branchNotCell):
1723         (JSC::DFG::SpeculativeJIT::branchIsOther):
1724         (JSC::DFG::SpeculativeJIT::branchNotOther):
1725         (JSC::DFG::SpeculativeJIT::moveTrueTo):
1726         (JSC::DFG::SpeculativeJIT::moveFalseTo):
1727         (JSC::DFG::SpeculativeJIT::blessBoolean):
1728         * dfg/DFGUseKind.cpp:
1729         (WTF::printInternal):
1730         * dfg/DFGUseKind.h:
1731         (JSC::DFG::typeFilterFor):
1732         * ftl/FTLCapabilities.cpp:
1733         (JSC::FTL::canCompile):
1734         * ftl/FTLLowerDFGToLLVM.cpp:
1735         (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
1736         (JSC::FTL::LowerDFGToLLVM::lowString):
1737         (JSC::FTL::LowerDFGToLLVM::lowStringIdent):
1738         (JSC::FTL::LowerDFGToLLVM::speculate):
1739         (JSC::FTL::LowerDFGToLLVM::speculateString):
1740         (JSC::FTL::LowerDFGToLLVM::speculateStringIdent):
1741         (JSC::FTL::LowerDFGToLLVM::speculateNotStringVar):
1742         * runtime/JSCJSValue.h:
1743         * tests/stress/string-ident-to-not-string-var-equality.js: Added.
1744         (foo):
1745         (bar):
1746         (test):
1747
1748 2014-03-18  Joseph Pecoraro  <pecoraro@apple.com>
1749
1750         Add Copyright to framework.sb
1751         https://bugs.webkit.org/show_bug.cgi?id=130413
1752
1753         Reviewed by Timothy Hatcher.
1754
1755         Other sb files got the copyright. Follow suit.
1756
1757         * framework.sb:
1758
1759 2014-03-18  Matthew Mirman  <mmirman@apple.com>
1760
1761         Removed extra parens from if statement in a preprocessor define.
1762         https://bugs.webkit.org/show_bug.cgi?id=130408
1763
1764         Reviewed by Filip Pizlo.
1765
1766         * parser/Parser.cpp:
1767
1768 2014-03-18  Filip Pizlo  <fpizlo@apple.com>
1769
1770         More FTL enabling.
1771
1772         Rubber stamped by Dan Bernstein and Mark Hahnenberg.
1773
1774         * Configurations/FeatureDefines.xcconfig:
1775         * ftl/FTLCompile.cpp:
1776         (JSC::FTL::compile):
1777
1778 2014-03-17  Michael Saboff  <msaboff@apple.com>
1779
1780         V8 regexp spends most of its time in operationGetById
1781         https://bugs.webkit.org/show_bug.cgi?id=130380
1782
1783         Reviewed by Filip Pizlo.
1784
1785         Added String.length case to tryCacheGetByID that will only help the BaseLine JIT.
1786         When V8 regexp is run from the command line, this nets a 2% performance improvement.
1787         When the test is run for a longer amount of time, there is much less benefit as the
1788         DFG will emit the appropriate code for String.length.  This does remove
1789         operationGetById as the hottest function whne run from the command line.
1790
1791         * jit/Repatch.cpp:
1792         (JSC::tryCacheGetByID):
1793
1794 2014-03-17  Andreas Kling  <akling@apple.com>
1795
1796         Add one-deep cache to opaque roots hashset.
1797         <https://webkit.org/b/130357>
1798
1799         The vast majority of WebCore JS wrappers will have their Document*
1800         as the root(). This change adds a simple optimization where we cache
1801         the last lookup and avoid going to the hashset for repeated queries.
1802
1803         Looks like 0.4% progression on DYEB on my MBP.
1804
1805         Reviewed by Mark Hahnenberg.
1806
1807         * JavaScriptCore.xcodeproj/project.pbxproj:
1808         * heap/OpaqueRootSet.h: Added.
1809         (JSC::OpaqueRootSet::OpaqueRootSet):
1810         (JSC::OpaqueRootSet::contains):
1811         (JSC::OpaqueRootSet::isEmpty):
1812         (JSC::OpaqueRootSet::clear):
1813         (JSC::OpaqueRootSet::add):
1814         (JSC::OpaqueRootSet::size):
1815         (JSC::OpaqueRootSet::begin):
1816         (JSC::OpaqueRootSet::end):
1817         * heap/SlotVisitor.h:
1818
1819 2014-03-17  Tibor Meszaros  <tmeszaros.u-szeged@partner.samsung.com>
1820
1821         Implement Math.hypot
1822         https://bugs.webkit.org/show_bug.cgi?id=129486
1823
1824         Reviewed by Darin Adler.
1825
1826         * runtime/MathObject.cpp:
1827         (JSC::MathObject::finishCreation):
1828         (JSC::mathProtoFuncHypot):
1829
1830 2014-03-17  Zsolt Borbely  <borbezs@inf.u-szeged.hu>
1831
1832         Fix the !ENABLE(PROMISES) build
1833         https://bugs.webkit.org/show_bug.cgi?id=130328
1834
1835         Reviewed by Darin Adler.
1836
1837         Add missing ENABLE(PROMISES) guards.
1838
1839         * runtime/JSGlobalObject.cpp:
1840         (JSC::JSGlobalObject::reset):
1841         (JSC::JSGlobalObject::visitChildren):
1842         * runtime/JSGlobalObject.h:
1843         * runtime/JSPromiseDeferred.cpp:
1844         * runtime/JSPromiseDeferred.h:
1845         * runtime/JSPromiseReaction.cpp:
1846         * runtime/JSPromiseReaction.h:
1847         * runtime/VM.cpp:
1848         (JSC::VM::VM):
1849         * runtime/VM.h:
1850
1851 2014-03-16  Andreas Kling  <akling@apple.com>
1852
1853         REGRESSION(r165703): JSC tests crashing in StringImpl::destroy().
1854         <https://webkit.org/b/130304>
1855
1856         Reviewed by Anders Carlsson.
1857
1858         Unreviewed, restoring the old behavior of OpaqueJSString::identifier()
1859         that doesn't put a potentially unwanted string into the Identifier table.
1860
1861         * API/OpaqueJSString.cpp:
1862         (OpaqueJSString::identifier):
1863
1864 2014-03-16  Brian Burg  <bburg@apple.com>
1865
1866         Web Inspector: generated backend commands should reflect build system ENABLE settings
1867         https://bugs.webkit.org/show_bug.cgi?id=130111
1868
1869         Reviewed by Timothy Hatcher.
1870
1871         * CMakeLists.txt:
1872
1873         Combine only the Inspector domains listed in INSPECTOR_DOMAINS,
1874         instead of globbing any .json file.
1875
1876         * DerivedSources.make:
1877
1878         Force the combined inspector protocol file to be regenerated if
1879         the content or list of domains itself changes.
1880
1881 2014-03-16  Brian Burg  <bburg@apple.com>
1882
1883         Web Inspector: vended backend commands file should be generated as part of the build
1884         https://bugs.webkit.org/show_bug.cgi?id=130110
1885
1886         Reviewed by Timothy Hatcher.
1887
1888         * JavaScriptCore.xcodeproj/project.pbxproj: Copy InspectorJSBackendCommands.js to the
1889         private headers directory.
1890
1891 2014-03-16  Darin Adler  <darin@apple.com>
1892
1893         Remove all uses of deprecatedCharacters from JavaScriptCore
1894         https://bugs.webkit.org/show_bug.cgi?id=130304
1895
1896         Reviewed by Anders Carlsson.
1897
1898         * API/JSValueRef.cpp:
1899         (JSValueMakeFromJSONString): Use characters16 in the 16-bit code path.
1900         * API/OpaqueJSString.cpp:
1901         (OpaqueJSString::~OpaqueJSString): Use characters 16 in the 16-bit code path.
1902         (OpaqueJSString::identifier): Get rid of custom Identifier constructor, and
1903         juse use the standard one that takes a String.
1904         (OpaqueJSString::characters): Use getCharactersWithUpconvert instead of a
1905         hand-written alternative.
1906
1907         * bindings/ScriptValue.cpp:
1908         (Deprecated::jsToInspectorValue): Create InspectorString from String directly
1909         instead of involving a character pointer. Use the String from Identifier
1910         directly instead of making a new String.
1911
1912         * inspector/ContentSearchUtilities.cpp:
1913         (Inspector::ContentSearchUtilities::createSearchRegexSource): Use StringBuilder
1914         instead of building a String a character at a time. This is still a very slow
1915         way to do this. Also use strchr to search for a character instead of building
1916         a String every time just to use find on it.
1917
1918         * inspector/InspectorValues.cpp:
1919         (Inspector::doubleQuoteString): Remove unnecessary trip through a
1920         character pointer. This is still a really slow way to do this.
1921         (Inspector::InspectorValue::parseJSON): Use StringView::upconvertedCharacters
1922         instead of String::deprecatedCharacters. Still slow to always upconvert.
1923
1924         * runtime/DateConstructor.cpp: Removed unneeded include.
1925         * runtime/DatePrototype.cpp: Ditto.
1926
1927         * runtime/Identifier.h: Removed deprecatedCharacters function.
1928
1929         * runtime/JSGlobalObjectFunctions.cpp:
1930         (JSC::encode): Added a type cast to avoid ambiguity with the two character-
1931         appending functions from JSStringBuilder. Removed unneeded code duplicating
1932         what JSStringBuilder already does in its character append function.
1933         (JSC::decode): Deleted code that creates a JSStringBuilder that is never used.
1934         (JSC::parseIntOverflow): Changed lengths to unsigned. Made only the overload that
1935         is used outside this file have external linkage. Added a new overload that takes
1936         a StringView.
1937         (JSC::parseInt): Use StringView::substring to call parseIntOverflow.
1938         (JSC::globalFuncEscape): Use JSBuilder::append in a more efficient way for a
1939         single character.
1940
1941         * runtime/JSGlobalObjectFunctions.h: Removed unused overloads of parseIntOverflow.
1942
1943         * runtime/JSStringBuilder.h: Marked this "lightly deprecated".
1944         (JSC::JSStringBuilder::append): Overloaded for better speed with 8-bit characters.
1945         Made one overload private. Fixed a performance bug where we would reserve capacity
1946         in the 8-bit buffer but then append to the 16-bit buffer.
1947
1948         * runtime/ObjectPrototype.cpp: Removed unneeded include.
1949
1950         * runtime/StringPrototype.cpp:
1951         (JSC::stringProtoFuncFontsize): Use StringView::getCharactersWithUpconvert.
1952         (JSC::stringProtoFuncLink): Ditto.
1953
1954 2014-03-15  Filip Pizlo  <fpizlo@apple.com>
1955
1956         FTL ArrayifyToStructure shouldn't fail every time that it actually arrayifies
1957         https://bugs.webkit.org/show_bug.cgi?id=130296
1958
1959         Reviewed by Andreas Kling.
1960
1961         During the 32-bit structure ID work, the second load of the structure was removed.
1962         That's wrong. The whole point of loading the structure ID again is that the structure
1963         ID would have been changed by the arrayification call, and we're verifying that the
1964         arrayification succeeded in changing the structure. If we check the old structure - as
1965         the code was doing after the 32-bit structure ID work - then this check is guaranteed
1966         to fail, causing a significant performance regression.
1967
1968         It's actually amazing that the regression wasn't bigger. The reason is that if FTL
1969         code pathologically exits but the equivalent DFG code doesn't, then the exponential
1970         backoff almost perfectly guarantees that we just end up in the DFG. For this code, at
1971         the time at least, the DFG wasn't much slower so this didn't cause too much pain.
1972
1973         * ftl/FTLLowerDFGToLLVM.cpp:
1974         (JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):
1975
1976 2014-03-15  Filip Pizlo  <fpizlo@apple.com>
1977
1978         FTL should support CheckHasInstance/InstanceOf
1979         https://bugs.webkit.org/show_bug.cgi?id=130285
1980
1981         Reviewed by Sam Weinig.
1982
1983         Fairly straightforward; I also discovered an inaccurate FIXME in the process.
1984
1985         * dfg/DFGFixupPhase.cpp:
1986         (JSC::DFG::FixupPhase::fixupNode):
1987         * ftl/FTLAbstractHeapRepository.h:
1988         * ftl/FTLCapabilities.cpp:
1989         (JSC::FTL::canCompile):
1990         * ftl/FTLLowerDFGToLLVM.cpp:
1991         (JSC::FTL::LowerDFGToLLVM::compileNode):
1992         (JSC::FTL::LowerDFGToLLVM::compileCheckHasInstance):
1993         (JSC::FTL::LowerDFGToLLVM::compileInstanceOf):
1994         * ftl/FTLOutput.h:
1995         (JSC::FTL::Output::phi):
1996         * tests/stress/instanceof.js: Added.
1997         * tests/stress/instanceof-not-cell.js: Added.
1998
1999 2014-03-15  Michael Saboff  <msaboff@apple.com>
2000
2001         It should be possible to adjust DFG and FTL compiler thread priorities
2002         https://bugs.webkit.org/show_bug.cgi?id=130288
2003
2004         Reviewed by Filip Pizlo.
2005
2006         Added ability to change thread priorities relative to its current priority.
2007         Created options to adjust the priority of the DFG and FTL compilation work thread
2008         pools.  For two core systems, there might be three runnable threads, the main thread,
2009         the DFG compilation thread and the FTL compilation thread.  With the same priority,
2010         the scheduler is free to schedule whatever thread it wants.  By lowering the
2011         compilation threads, the main thread can run.  Further tests may suggest better values
2012         for the new options, priorityDeltaOfDFGCompilerThreads and priorityDeltaOfFTLCompilerThreads.
2013
2014         For a two-core device, this change has a net positive improvement of 1-3% across
2015         SunSpider, Octane, Kraken and AsmBench.
2016
2017         * dfg/DFGWorklist.cpp:
2018         (JSC::DFG::Worklist::finishCreation):
2019         (JSC::DFG::Worklist::create):
2020         (JSC::DFG::ensureGlobalDFGWorklist):
2021         (JSC::DFG::ensureGlobalFTLWorklist):
2022         * dfg/DFGWorklist.h:
2023         * runtime/Options.cpp:
2024         (JSC::computePriorityDeltaOfWorkerThreads):
2025         * runtime/Options.h:
2026
2027 2014-03-15  David Kilzer  <ddkilzer@apple.com>
2028
2029         [iOS] Define SYSTEM_VERSION_PREFIX consistently
2030         <http://webkit.org/b/130293>
2031         <rdar://problem/15926359>
2032
2033         Reviewed by Dan Bernstein.
2034
2035         * Configurations/Version.xcconfig:
2036         (SYSTEM_VERSION_PREFIX_iphoneos): Sync with
2037         Source/WebKit/mac/Version.xcconfig.
2038
2039 2014-03-15  David Kilzer  <ddkilzer@apple.com>
2040
2041         Fix build: using integer absolute value function 'abs' when argument is of floating point type
2042         <http://webkit.org/b/130286>
2043
2044         Reviewed by Filip Pizlo.
2045
2046         Fixes the following build failure using trunk clang:
2047
2048             JavaScriptCore/assembler/MacroAssembler.h:992:17: error: using integer absolute value function 'abs' when argument is of floating point type [-Werror,-Wabsolute-value]
2049                     value = abs(value);
2050                             ^
2051             JavaScriptCore/assembler/MacroAssembler.h:992:17: note: use function 'fabs' instead
2052                     value = abs(value);
2053                             ^~~
2054                             fabs
2055
2056         * assembler/MacroAssembler.h:
2057         (JSC::MacroAssembler::shouldBlindDouble): Switch from abs() to
2058         fabs().
2059
2060 2014-03-14  Oliver Hunt  <oliver@apple.com>
2061
2062         Reinstate intialiser syntax in for-in loops
2063         https://bugs.webkit.org/show_bug.cgi?id=130269
2064
2065         Reviewed by Michael Saboff.
2066
2067         Disallowing the initialiser broke some sites so this patch re-allows
2068         the syntax.  We still disallow the syntax in 'of' and pattern based
2069         enumeration.
2070
2071         * parser/ASTBuilder.h:
2072         (JSC::ASTBuilder::isBindingNode):
2073         * parser/Parser.cpp:
2074         (JSC::Parser<LexerType>::parseVarDeclarationList):
2075         (JSC::Parser<LexerType>::parseForStatement):
2076         * parser/SyntaxChecker.h:
2077         (JSC::SyntaxChecker::operatorStackPop):
2078
2079 2014-03-14  Mark Lam  <mark.lam@apple.com>
2080
2081         Accessing __lookupGetter__ and __lookupSetter__ should not crash the VM when undefined.
2082         <https://webkit.org/b/130279>
2083
2084         Reviewed by Filip Pizlo.
2085
2086         If neither the getter nor setter are defined, accessing __lookupGetter__
2087         and __lookupSetter__ will return undefined as expected.  However, if the
2088         getter is defined but the setter is not, accessing __lookupSetter__ will
2089         crash the VM.  Similarly, accessing __lookupGetter__ when only the setter
2090         is defined will crash the VM.
2091
2092         The reason is because objectProtoFuncLookupGetter() and
2093         objectProtoFuncLookupSetter() did not check if the getter and setter
2094         value is non-null before returning it as an EncodedJSValue.  The fix is
2095         to add the appropriate null checks.
2096
2097         * runtime/ObjectPrototype.cpp:
2098         (JSC::objectProtoFuncLookupGetter):
2099         (JSC::objectProtoFuncLookupSetter):
2100
2101 2014-03-14  Mark Rowe  <mrowe@apple.com>
2102
2103         Fix the production build.
2104
2105         Don't rely on USE_INTERNAL_SDK being set for the Production configuration since UseInternalSDK.xcconfig won't
2106         be at the expected relative path when working from installed source.
2107
2108         * Configurations/Base.xcconfig:
2109
2110 2014-03-14  Maciej Stachowiak  <mjs@apple.com>
2111
2112         Replace "Apple Computer, Inc." with "Apple Inc." in copyright headers
2113         https://bugs.webkit.org/show_bug.cgi?id=130276
2114         <rdar://problem/16266927>
2115
2116         Reviewed by Simon Fraser.
2117
2118         * API/APICast.h:
2119         * API/JSBase.cpp:
2120         * API/JSBase.h:
2121         * API/JSBasePrivate.h:
2122         * API/JSCallbackConstructor.cpp:
2123         * API/JSCallbackConstructor.h:
2124         * API/JSCallbackFunction.cpp:
2125         * API/JSCallbackFunction.h:
2126         * API/JSCallbackObject.cpp:
2127         * API/JSCallbackObject.h:
2128         * API/JSCallbackObjectFunctions.h:
2129         * API/JSClassRef.cpp:
2130         * API/JSClassRef.h:
2131         * API/JSContextRef.cpp:
2132         * API/JSContextRef.h:
2133         * API/JSContextRefPrivate.h:
2134         * API/JSObjectRef.cpp:
2135         * API/JSObjectRef.h:
2136         * API/JSProfilerPrivate.cpp:
2137         * API/JSProfilerPrivate.h:
2138         * API/JSRetainPtr.h:
2139         * API/JSStringRef.cpp:
2140         * API/JSStringRef.h:
2141         * API/JSStringRefBSTR.cpp:
2142         * API/JSStringRefBSTR.h:
2143         * API/JSStringRefCF.cpp:
2144         * API/JSStringRefCF.h:
2145         * API/JSValueRef.cpp:
2146         * API/JSValueRef.h:
2147         * API/JavaScript.h:
2148         * API/JavaScriptCore.h:
2149         * API/OpaqueJSString.cpp:
2150         * API/OpaqueJSString.h:
2151         * API/tests/JSNode.c:
2152         * API/tests/JSNode.h:
2153         * API/tests/JSNodeList.c:
2154         * API/tests/JSNodeList.h:
2155         * API/tests/Node.c:
2156         * API/tests/Node.h:
2157         * API/tests/NodeList.c:
2158         * API/tests/NodeList.h:
2159         * API/tests/minidom.c:
2160         * API/tests/minidom.js:
2161         * API/tests/testapi.c:
2162         * API/tests/testapi.js:
2163         * DerivedSources.make:
2164         * bindings/ScriptValue.cpp:
2165         * bytecode/CodeBlock.cpp:
2166         * bytecode/CodeBlock.h:
2167         * bytecode/EvalCodeCache.h:
2168         * bytecode/Instruction.h:
2169         * bytecode/JumpTable.cpp:
2170         * bytecode/JumpTable.h:
2171         * bytecode/Opcode.cpp:
2172         * bytecode/Opcode.h:
2173         * bytecode/SamplingTool.cpp:
2174         * bytecode/SamplingTool.h:
2175         * bytecode/SpeculatedType.cpp:
2176         * bytecode/SpeculatedType.h:
2177         * bytecode/ValueProfile.h:
2178         * bytecompiler/BytecodeGenerator.cpp:
2179         * bytecompiler/BytecodeGenerator.h:
2180         * bytecompiler/Label.h:
2181         * bytecompiler/LabelScope.h:
2182         * bytecompiler/RegisterID.h:
2183         * debugger/DebuggerCallFrame.cpp:
2184         * debugger/DebuggerCallFrame.h:
2185         * dfg/DFGDesiredStructureChains.cpp:
2186         * dfg/DFGDesiredStructureChains.h:
2187         * heap/GCActivityCallback.cpp:
2188         * heap/GCActivityCallback.h:
2189         * inspector/ConsoleMessage.cpp:
2190         * inspector/ConsoleMessage.h:
2191         * inspector/IdentifiersFactory.cpp:
2192         * inspector/IdentifiersFactory.h:
2193         * inspector/InjectedScriptManager.cpp:
2194         * inspector/InjectedScriptManager.h:
2195         * inspector/InjectedScriptSource.js:
2196         * inspector/ScriptBreakpoint.h:
2197         * inspector/ScriptDebugListener.h:
2198         * inspector/ScriptDebugServer.cpp:
2199         * inspector/ScriptDebugServer.h:
2200         * inspector/agents/InspectorAgent.cpp:
2201         * inspector/agents/InspectorAgent.h:
2202         * inspector/agents/InspectorDebuggerAgent.cpp:
2203         * inspector/agents/InspectorDebuggerAgent.h:
2204         * interpreter/Interpreter.cpp:
2205         * interpreter/Interpreter.h:
2206         * interpreter/JSStack.cpp:
2207         * interpreter/JSStack.h:
2208         * interpreter/Register.h:
2209         * jit/CompactJITCodeMap.h:
2210         * jit/JITStubs.cpp:
2211         * jit/JITStubs.h:
2212         * jit/JITStubsARM.h:
2213         * jit/JITStubsARMv7.h:
2214         * jit/JITStubsX86.h:
2215         * jit/JITStubsX86_64.h:
2216         * os-win32/stdbool.h:
2217         * parser/SourceCode.h:
2218         * parser/SourceProvider.h:
2219         * profiler/LegacyProfiler.cpp:
2220         * profiler/LegacyProfiler.h:
2221         * profiler/ProfileNode.cpp:
2222         * profiler/ProfileNode.h:
2223         * runtime/ArrayBufferView.cpp:
2224         * runtime/ArrayBufferView.h:
2225         * runtime/BatchedTransitionOptimizer.h:
2226         * runtime/CallData.h:
2227         * runtime/ConstructData.h:
2228         * runtime/DumpContext.cpp:
2229         * runtime/DumpContext.h:
2230         * runtime/ExceptionHelpers.cpp:
2231         * runtime/ExceptionHelpers.h:
2232         * runtime/InitializeThreading.cpp:
2233         * runtime/InitializeThreading.h:
2234         * runtime/IntegralTypedArrayBase.h:
2235         * runtime/IntendedStructureChain.cpp:
2236         * runtime/IntendedStructureChain.h:
2237         * runtime/JSActivation.cpp:
2238         * runtime/JSActivation.h:
2239         * runtime/JSExportMacros.h:
2240         * runtime/JSGlobalObject.cpp:
2241         * runtime/JSNotAnObject.cpp:
2242         * runtime/JSNotAnObject.h:
2243         * runtime/JSPropertyNameIterator.cpp:
2244         * runtime/JSPropertyNameIterator.h:
2245         * runtime/JSSegmentedVariableObject.cpp:
2246         * runtime/JSSegmentedVariableObject.h:
2247         * runtime/JSSymbolTableObject.cpp:
2248         * runtime/JSSymbolTableObject.h:
2249         * runtime/JSTypeInfo.h:
2250         * runtime/JSVariableObject.cpp:
2251         * runtime/JSVariableObject.h:
2252         * runtime/PropertyTable.cpp:
2253         * runtime/PutPropertySlot.h:
2254         * runtime/SamplingCounter.cpp:
2255         * runtime/SamplingCounter.h:
2256         * runtime/Structure.cpp:
2257         * runtime/Structure.h:
2258         * runtime/StructureChain.cpp:
2259         * runtime/StructureChain.h:
2260         * runtime/StructureInlines.h:
2261         * runtime/StructureTransitionTable.h:
2262         * runtime/SymbolTable.cpp:
2263         * runtime/SymbolTable.h:
2264         * runtime/TypedArrayBase.h:
2265         * runtime/TypedArrayType.cpp:
2266         * runtime/TypedArrayType.h:
2267         * runtime/VM.cpp:
2268         * runtime/VM.h:
2269         * yarr/RegularExpression.cpp:
2270         * yarr/RegularExpression.h:
2271
2272 2014-03-14  Filip Pizlo  <fpizlo@apple.com>
2273
2274         Final FTL iOS build magic
2275         https://bugs.webkit.org/show_bug.cgi?id=130281
2276
2277         Reviewed by Michael Saboff.
2278
2279         * Configurations/Base.xcconfig: For now our LLVM headers are in /usr/local/LLVMForJavaScriptCore/include, which is the same as OS X.
2280         * Configurations/LLVMForJSC.xcconfig: We need to be more careful about how we specify library paths if we want to get the prioritzation right. Also we need protobuf because things. :-/
2281
2282 2014-03-14  Joseph Pecoraro  <pecoraro@apple.com>
2283
2284         Web Inspector: Gracefully handle nil name -[JSContext setName:]
2285         https://bugs.webkit.org/show_bug.cgi?id=130262
2286
2287         Reviewed by Mark Hahnenberg.
2288
2289         * API/JSContext.mm:
2290         (-[JSContext setName:]):
2291         Gracefully handle nil input.
2292
2293         * API/tests/testapi.c:
2294         (globalContextNameTest):
2295         * API/tests/testapi.mm:
2296         Test for nil / NULL names in the ObjC and C APIs.
2297
2298 2014-03-11  Oliver Hunt  <oliver@apple.com>
2299
2300         Improve dom error messages
2301         https://bugs.webkit.org/show_bug.cgi?id=130103
2302
2303         Reviewed by Andreas Kling.
2304
2305         Add new helper function.
2306
2307         * runtime/Error.h:
2308         (JSC::throwVMTypeError):
2309
2310 2014-03-14  László Langó  <llango.u-szeged@partner.samsung.com>
2311
2312         Remove unused method declaration.
2313         https://bugs.webkit.org/show_bug.cgi?id=130238
2314
2315         Reviewed by Filip Pizlo.
2316
2317         The implementation of CallFrame::dumpCaller was removed in
2318         http://trac.webkit.org/changeset/153183, but the declaration of it was not.
2319
2320         * interpreter/CallFrame.h:
2321         Remove CallFrame::dumpCaller() method declaration.
2322
2323 2014-03-12  Sergio Villar Senin  <svillar@igalia.com>
2324
2325         Rename DEFINE_STATIC_LOCAL to DEPRECATED_DEFINE_STATIC_LOCAL
2326         https://bugs.webkit.org/show_bug.cgi?id=129612
2327
2328         Reviewed by Darin Adler.
2329
2330         For new code use static NeverDestroyed<T> instead.
2331
2332         * API/JSAPIWrapperObject.mm:
2333         (jsAPIWrapperObjectHandleOwner):
2334         * API/JSManagedValue.mm:
2335         (managedValueHandleOwner):
2336         * inspector/agents/InspectorDebuggerAgent.cpp:
2337         (Inspector::objectGroupForBreakpointAction):
2338         * inspector/scripts/CodeGeneratorInspectorStrings.py:
2339         * interpreter/JSStack.cpp:
2340         (JSC::stackStatisticsMutex):
2341         * jit/ExecutableAllocator.cpp:
2342         (JSC::DemandExecutableAllocator::allocators):
2343
2344 2014-03-12  Gavin Barraclough  <barraclough@apple.com>
2345
2346         Reduce memory use for static property maps
2347         https://bugs.webkit.org/show_bug.cgi?id=129986
2348
2349         Reviewed by Andreas Kling.
2350
2351         Static property tables are currently duplicated on first use from read-only memory into dirty memory
2352         in every process, and since the entries are large (48 bytes) and the tables can be unusually sparse
2353         (we use a custom hash table without a rehash) a lot of memory may be wasted.
2354
2355         First, reduce the size of the hashtable. Instead of storing values in the table the hashtable maps
2356         from string hashes to indicies into a densely packed array of values. Compute the index table at
2357         compile time as a part of the derived sources step, such that this may be read-only data.
2358
2359         Second, don't copy all data from the HashTableValue array into a HashEntry objects. Instead refer
2360         directly to the HashTableValue entries. The only data that needs to be allocated at runtime are the
2361         keys, which are Identifiers.
2362
2363         * create_hash_table:
2364             - emit the hash table index into the derived source (we were calculating this already to ensure chaining does not get too deep).
2365         * parser/Lexer.cpp:
2366         (JSC::Lexer<LChar>::parseIdentifier):
2367         (JSC::Lexer<UChar>::parseIdentifier):
2368         (JSC::Lexer<T>::parseIdentifierSlowCase):
2369             - HashEntry -> HashTableValue.
2370         * parser/Lexer.h:
2371         (JSC::Keywords::getKeyword):
2372             - HashEntry -> HashTableValue.
2373         * runtime/ClassInfo.h:
2374             - removed HashEntry.
2375         * runtime/JSObject.cpp:
2376         (JSC::getClassPropertyNames):
2377             - use HashTable::ConstIterator.
2378         (JSC::JSObject::put):
2379         (JSC::JSObject::deleteProperty):
2380         (JSC::JSObject::findPropertyHashEntry):
2381             - HashEntry -> HashTableValue.
2382         (JSC::JSObject::reifyStaticFunctionsForDelete):
2383             - changed HashTable::ConstIterator interface.
2384         * runtime/JSObject.h:
2385             - HashEntry -> HashTableValue.
2386         * runtime/Lookup.cpp:
2387         (JSC::HashTable::createTable):
2388             - table -> keys, keys array is now densely packed.
2389         (JSC::HashTable::deleteTable):
2390             - table -> keys.
2391         (JSC::setUpStaticFunctionSlot):
2392             - HashEntry -> HashTableValue.
2393         * runtime/Lookup.h:
2394         (JSC::HashTableValue::builtinGenerator):
2395         (JSC::HashTableValue::function):
2396         (JSC::HashTableValue::functionLength):
2397         (JSC::HashTableValue::propertyGetter):
2398         (JSC::HashTableValue::propertyPutter):
2399         (JSC::HashTableValue::lexerValue):
2400             - added accessor methods from HashEntry.
2401         (JSC::HashTable::copy):
2402             - fields changed.
2403         (JSC::HashTable::initializeIfNeeded):
2404             - table -> keys.
2405         (JSC::HashTable::entry):
2406             - HashEntry -> HashTableValue.
2407         (JSC::HashTable::ConstIterator::ConstIterator):
2408             - iterate packed value array, so no need to skipInvalidKeys().
2409         (JSC::HashTable::ConstIterator::value):
2410         (JSC::HashTable::ConstIterator::key):
2411         (JSC::HashTable::ConstIterator::operator->):
2412             - accessors now get HashTableValue/StringImpl* separately.
2413         (JSC::HashTable::ConstIterator::operator++):
2414             - iterate packed value array, so no need to skipInvalidKeys().
2415         (JSC::HashTable::end):
2416             - end is now size of dense not sparse array.
2417         (JSC::getStaticPropertySlot):
2418         (JSC::getStaticFunctionSlot):
2419         (JSC::getStaticValueSlot):
2420         (JSC::putEntry):
2421         (JSC::lookupPut):
2422             - HashEntry -> HashTableValue.
2423
2424 2014-03-13  Filip Pizlo  <fpizlo@apple.com>
2425
2426         Unreviewed, fix Mac no-FTL build.
2427
2428         * llvm/library/LLVMExports.cpp:
2429         (initializeAndGetJSCLLVMAPI):
2430
2431 2014-03-13  Juergen Ributzka  <juergen@apple.com>
2432
2433         Only export initializeAndGetJSCLLVMAPI from libllvmForJSC.dylib
2434         https://bugs.webkit.org/show_bug.cgi?id=130224
2435
2436         Reviewed by Filip Pizlo.
2437
2438         This limits the exported symbols to only initializeAndGetJSCLLVMAPI from
2439         the LLVM dylib. This allows the dylib to be safely used with other LLVM
2440         dylibs on the same system. It also reduces the dynamic linking overhead
2441         and also reduces the size by 6MB, because the linker can now dead strip
2442         many unused functions.
2443
2444         * Configurations/LLVMForJSC.xcconfig:
2445
2446 2014-03-13  Andreas Kling  <akling@apple.com>
2447
2448         VM::discardAllCode() should clear the RegExp cache.
2449         <https://webkit.org/b/130144>
2450
2451         Reviewed by Michael Saboff.
2452
2453         * runtime/VM.cpp:
2454         (JSC::VM::discardAllCode):
2455
2456 2014-03-13  Andreas Kling  <akling@apple.com>
2457
2458         Revert "Short-circuit JSGlobalObjectInspectorController when not inspecting."
2459         <https://webkit.org/b/129995>
2460
2461         This code path is not taken anymore on DYEB, and I can't explain why
2462         it was showing up in my profiles. Backing it out per JoePeck's suggestion.
2463
2464         * inspector/JSGlobalObjectInspectorController.cpp:
2465         (Inspector::JSGlobalObjectInspectorController::reportAPIException):
2466
2467 2014-03-13  Filip Pizlo  <fpizlo@apple.com>
2468
2469         FTL should support IsBlah
2470         https://bugs.webkit.org/show_bug.cgi?id=130202
2471
2472         Reviewed by Geoffrey Garen.
2473
2474         * ftl/FTLCapabilities.cpp:
2475         (JSC::FTL::canCompile):
2476         * ftl/FTLIntrinsicRepository.h:
2477         * ftl/FTLLowerDFGToLLVM.cpp:
2478         (JSC::FTL::LowerDFGToLLVM::compileNode):
2479         (JSC::FTL::LowerDFGToLLVM::compileIsUndefined):
2480         (JSC::FTL::LowerDFGToLLVM::compileIsBoolean):
2481         (JSC::FTL::LowerDFGToLLVM::compileIsNumber):
2482         (JSC::FTL::LowerDFGToLLVM::compileIsString):
2483         (JSC::FTL::LowerDFGToLLVM::compileIsObject):
2484         (JSC::FTL::LowerDFGToLLVM::compileIsFunction):
2485         (JSC::FTL::LowerDFGToLLVM::compileStoreBarrier):
2486         (JSC::FTL::LowerDFGToLLVM::compileStoreBarrierWithNullCheck):
2487         (JSC::FTL::LowerDFGToLLVM::isNotCellOrMisc):
2488         (JSC::FTL::LowerDFGToLLVM::isNumber):
2489         (JSC::FTL::LowerDFGToLLVM::isNotNumber):
2490         (JSC::FTL::LowerDFGToLLVM::isBoolean):
2491         * ftl/FTLOSRExitCompiler.cpp:
2492         * tests/stress/is-undefined-exit-on-masquerader.js: Added.
2493         (bar):
2494         (foo):
2495         (test):
2496         * tests/stress/is-undefined-jettison-on-masquerader.js: Added.
2497         (foo):
2498         (test):
2499         * tests/stress/is-undefined-masquerader.js: Added.
2500         (foo):
2501         (test):
2502
2503 2014-03-13  Mark Lam  <mark.lam@apple.com>
2504
2505         JS benchmarks crash with a bus error on 32-bit x86.
2506         <https://webkit.org/b/130203>
2507
2508         Reviewed by Geoffrey Garen.
2509
2510         The issue is that generateGetByIdStub() can potentially use the same register
2511         for the JSValue base register and the target tag register.  After loading the
2512         tag value into the target tag register, the JSValue base address is lost.
2513         The code then proceeds to load the payload value using the base register, and
2514         this results in a crash.
2515
2516         The fix is to check if the base register is the same as the target tag register.
2517         If so, we should make a copy the base register first before loading the tag
2518         value, and use the copy to load the payload value instead.
2519
2520         * jit/Repatch.cpp:
2521         (JSC::generateGetByIdStub):
2522
2523 2014-03-12  Filip Pizlo  <fpizlo@apple.com>
2524
2525         WebKit shouldn't crash on uniprocessor machines
2526         https://bugs.webkit.org/show_bug.cgi?id=130176
2527
2528         Reviewed by Michael Saboff.
2529
2530         Previously the math for computing the number of JIT compiler threads would come up with
2531         zero threads on uniprocessor machines, and then the Worklist code would assert.
2532
2533         * runtime/Options.cpp:
2534         (JSC::computeNumberOfWorkerThreads):
2535         * runtime/Options.h:
2536
2537 2014-03-13  Radu Stavila  <stavila@adobe.com>
2538
2539         Webkit not building on XCode 5.1 due to garbage collection no longer being supported
2540         https://bugs.webkit.org/show_bug.cgi?id=130087
2541
2542         Reviewed by Mark Rowe.
2543
2544         Disable garbage collection on macosx when not using internal SDK.
2545
2546         * Configurations/Base.xcconfig:
2547
2548 2014-03-10  Darin Adler  <darin@apple.com>
2549
2550         Avoid copy-prone idiom "for (auto item : collection)"
2551         https://bugs.webkit.org/show_bug.cgi?id=129990
2552
2553         Reviewed by Geoffrey Garen.
2554
2555         * heap/CodeBlockSet.h:
2556         (JSC::CodeBlockSet::iterate): Use auto& to be sure we don't copy by accident.
2557         * inspector/ScriptDebugServer.cpp:
2558         (Inspector::ScriptDebugServer::dispatchBreakpointActionLog): Use auto* to
2559         make explicit that we are iterating through pointers.
2560         (Inspector::ScriptDebugServer::dispatchBreakpointActionSound): Ditto.
2561         (Inspector::ScriptDebugServer::dispatchBreakpointActionProbe): Ditto.
2562         * inspector/agents/InspectorDebuggerAgent.cpp:
2563         (Inspector::InspectorDebuggerAgent::removeBreakpoint): Use auto&, and also
2564         get rid of an unneeded local variable.
2565
2566 2014-03-13  Brian Burg  <bburg@apple.com>
2567
2568         Web Inspector: Remove unused callId parameter from evaluateInWebInspector
2569         https://bugs.webkit.org/show_bug.cgi?id=129744
2570
2571         Reviewed by Timothy Hatcher.
2572
2573         * inspector/agents/InspectorAgent.cpp:
2574         (Inspector::InspectorAgent::enable):
2575         (Inspector::InspectorAgent::evaluateForTestInFrontend):
2576         * inspector/agents/InspectorAgent.h:
2577         * inspector/protocol/InspectorDomain.json:
2578
2579 2014-03-11  Filip Pizlo  <fpizlo@apple.com>
2580
2581         ASSERTION FAILED: node->op() == Phi || node->op() == SetArgument
2582         https://bugs.webkit.org/show_bug.cgi?id=130069
2583
2584         Reviewed by Geoffrey Garen.
2585
2586         This was a great assertion, and it represents our strictest interpretation of the rules of
2587         our intermediate representation. However, fixing DCE to actually preserve the relevant
2588         property would be hard, and it wouldn't have an observable effect right now because nobody
2589         actually uses the propery of CPS that this assertion is checking for.
2590
2591         In particular, we do always require, and rely on, the fact that non-captured variables
2592         have variablesAtTail refer to the last interesting use of the variable: a SetLocal if the
2593         block assigns to the variable, a GetLocal if it only reads from it, and a Flush,
2594         PhantomLocal, or Phi otherwise. We do preserve this property successfully and DCE was not
2595         broken in this regard. But, in the strictest sense, CPS also means that for captured
2596         variables, variablesAtTail also continues to point to the last relevant use of the
2597         variable. In particular, if there are multiple GetLocals, then it should point to the last
2598         one. This is hard for DCE to preserve. Also, nobody relies on variablesAtTail for captured
2599         variables, except to check the VariableAccessData; but in that case, we don't really need
2600         the *last* relevant use of the variable - any node that mentions the same variable will do
2601         just fine.
2602
2603         So, this change loosens the assertion and adds a detailed FIXME describing what we would
2604         have to do if we wanted to preserve the more strict property.
2605
2606         This also makes changes to various debug printing paths so that validation doesn't crash
2607         during graph dump. This also adds tests for the interesting cases of DCE failing to
2608         preserve CPS in the strictest sense. This also attempts to win the record for longest test
2609         name.
2610
2611         * bytecode/CodeBlock.cpp:
2612         (JSC::CodeBlock::hashAsStringIfPossible):
2613         (JSC::CodeBlock::dumpAssumingJITType):
2614         * bytecode/CodeBlock.h:
2615         * bytecode/CodeOrigin.cpp:
2616         (JSC::InlineCallFrame::hashAsStringIfPossible):
2617         (JSC::InlineCallFrame::dumpBriefFunctionInformation):
2618         * bytecode/CodeOrigin.h:
2619         * dfg/DFGCPSRethreadingPhase.cpp:
2620         (JSC::DFG::CPSRethreadingPhase::run):
2621         * dfg/DFGDCEPhase.cpp:
2622         (JSC::DFG::DCEPhase::cleanVariables):
2623         * dfg/DFGInPlaceAbstractState.cpp:
2624         (JSC::DFG::InPlaceAbstractState::mergeStateAtTail):
2625         * runtime/FunctionExecutableDump.cpp:
2626         (JSC::FunctionExecutableDump::dump):
2627         * tests/stress/dead-access-to-captured-variable-preceded-by-a-live-store-in-function-with-multiple-basic-blocks.js: Added.
2628         (foo):
2629         * tests/stress/dead-access-to-captured-variable-preceded-by-a-live-store.js: Added.
2630         (foo):
2631
2632 2014-03-12  Brian Burg  <bburg@apple.com>
2633
2634         Web Replay: add infrastructure for memoizing nondeterministic DOM APIs
2635         https://bugs.webkit.org/show_bug.cgi?id=129445
2636
2637         Reviewed by Timothy Hatcher.
2638
2639         There was a bug in the replay inputs code generator that would include
2640         headers for definitions of enum classes, even though they can be safely
2641         forward-declared.
2642
2643         * replay/scripts/CodeGeneratorReplayInputs.py:
2644         (Generator.generate_includes): Only include for copy constructor if the
2645         type is a heavy scalar (i.e., String, URL), not a normal scalar
2646         (i.e., int, double, enum classes).
2647
2648         (Generator.generate_type_forward_declarations): Forward-declare scalars
2649         that are enums or enum classes.
2650
2651 2014-03-12  Joseph Pecoraro  <pecoraro@apple.com>
2652
2653         Web Inspector: Disable REMOTE_INSPECTOR in earlier OS X releases
2654         https://bugs.webkit.org/show_bug.cgi?id=130118
2655
2656         Reviewed by Timothy Hatcher.
2657
2658         * Configurations/FeatureDefines.xcconfig:
2659
2660 2014-03-12  Joseph Pecoraro  <pecoraro@apple.com>
2661
2662         Web Inspector: Hang in Remote Inspection triggering breakpoint from console
2663         https://bugs.webkit.org/show_bug.cgi?id=130032
2664
2665         Reviewed by Timothy Hatcher.
2666
2667         * inspector/EventLoop.h:
2668         * inspector/EventLoop.cpp:
2669         (Inspector::EventLoop::remoteInspectorRunLoopMode):
2670         (Inspector::EventLoop::cycle):
2671         Expose the run loop mode name so it can be used if needed by others.
2672
2673         * inspector/remote/RemoteInspectorDebuggableConnection.h:
2674         * inspector/remote/RemoteInspectorDebuggableConnection.mm:
2675         (Inspector::RemoteInspectorBlock::RemoteInspectorBlock):
2676         (Inspector::RemoteInspectorBlock::~RemoteInspectorBlock):
2677         (Inspector::RemoteInspectorBlock::operator=):
2678         (Inspector::RemoteInspectorBlock::operator()):
2679         (Inspector::RemoteInspectorQueueTask):
2680         Instead of a dispatch_queue, have our own static Vector of debugger tasks.
2681
2682         (Inspector::RemoteInspectorHandleRunSource):
2683         (Inspector::RemoteInspectorInitializeQueue):
2684         Initialize the static queue and run loop source. When the run loop source
2685         fires, it will exhaust the queue of debugger messages.
2686
2687         (Inspector::RemoteInspectorDebuggableConnection::RemoteInspectorDebuggableConnection):
2688         (Inspector::RemoteInspectorDebuggableConnection::~RemoteInspectorDebuggableConnection):
2689         When we get a debuggable connection add a run loop source for inspector commands.
2690
2691         (Inspector::RemoteInspectorDebuggableConnection::dispatchAsyncOnDebuggable):
2692         (Inspector::RemoteInspectorDebuggableConnection::sendMessageToBackend):
2693         Enqueue blocks on our Vector instead of our dispatch_queue.
2694
2695 2014-03-12  Commit Queue  <commit-queue@webkit.org>
2696
2697         Unreviewed, rolling out r165482.
2698         https://bugs.webkit.org/show_bug.cgi?id=130157
2699
2700         Broke the windows build; "error C2466: cannot allocate an
2701         array of constant size 0" (Requested by jernoble on #webkit).
2702
2703         Reverted changeset:
2704
2705         "Reduce memory use for static property maps"
2706         https://bugs.webkit.org/show_bug.cgi?id=129986
2707         http://trac.webkit.org/changeset/165482
2708
2709 2014-03-12  Mark Hahnenberg  <mhahnenberg@apple.com>
2710
2711         Remove HandleSet::m_nextToFinalize
2712         https://bugs.webkit.org/show_bug.cgi?id=130109
2713
2714         Reviewed by Mark Lam.
2715
2716         This is a remnant of when HandleSet contained things that needed to be finalized.
2717
2718         * heap/HandleSet.cpp:
2719         (JSC::HandleSet::HandleSet):
2720         (JSC::HandleSet::writeBarrier):
2721         * heap/HandleSet.h:
2722         (JSC::HandleSet::allocate):
2723         (JSC::HandleSet::deallocate):
2724
2725 2014-03-12  Mark Hahnenberg  <mhahnenberg@apple.com>
2726
2727         Layout Test fast/workers/worker-gc.html is failing
2728         https://bugs.webkit.org/show_bug.cgi?id=130135
2729
2730         Reviewed by Geoffrey Garen.
2731
2732         When removing MarkedBlocks, we always expect them to be in the MarkedAllocator's
2733         main list of blocks, i.e. not in the retired list. When shutting down the VM this
2734         wasn't always the case which was causing ASSERTs to fire. We should rearrange things
2735         so that allocators are notified with lastChanceToFinalize. This will give them
2736         the chance to move their retired blocks back into the main list before removing them all.
2737
2738         * heap/MarkedAllocator.cpp:
2739         (JSC::LastChanceToFinalize::operator()):
2740         (JSC::MarkedAllocator::lastChanceToFinalize):
2741         * heap/MarkedAllocator.h:
2742         * heap/MarkedSpace.cpp:
2743         (JSC::LastChanceToFinalize::operator()):
2744         (JSC::MarkedSpace::lastChanceToFinalize):
2745
2746 2014-03-12  Gavin Barraclough  <barraclough@apple.com>
2747
2748         Reduce memory use for static property maps
2749         https://bugs.webkit.org/show_bug.cgi?id=129986
2750
2751         Reviewed by Andreas Kling.
2752
2753         Static property tables are currently duplicated on first use from read-only memory into dirty memory
2754         in every process, and since the entries are large (48 bytes) and the tables can be unusually sparse
2755         (we use a custom hash table without a rehash) a lot of memory may be wasted.
2756
2757         First, reduce the size of the hashtable. Instead of storing values in the table the hashtable maps
2758         from string hashes to indicies into a densely packed array of values. Compute the index table at
2759         compile time as a part of the derived sources step, such that this may be read-only data.
2760
2761         Second, don't copy all data from the HashTableValue array into a HashEntry objects. Instead refer
2762         directly to the HashTableValue entries. The only data that needs to be allocated at runtime are the
2763         keys, which are Identifiers.
2764
2765         * create_hash_table:
2766             - emit the hash table index into the derived source (we were calculating this already to ensure chaining does not get too deep).
2767         * parser/Lexer.cpp:
2768         (JSC::Lexer<LChar>::parseIdentifier):
2769         (JSC::Lexer<UChar>::parseIdentifier):
2770         (JSC::Lexer<T>::parseIdentifierSlowCase):
2771             - HashEntry -> HashTableValue.
2772         * parser/Lexer.h:
2773         (JSC::Keywords::getKeyword):
2774             - HashEntry -> HashTableValue.
2775         * runtime/ClassInfo.h:
2776             - removed HashEntry.
2777         * runtime/JSObject.cpp:
2778         (JSC::getClassPropertyNames):
2779             - use HashTable::ConstIterator.
2780         (JSC::JSObject::put):
2781         (JSC::JSObject::deleteProperty):
2782         (JSC::JSObject::findPropertyHashEntry):
2783             - HashEntry -> HashTableValue.
2784         (JSC::JSObject::reifyStaticFunctionsForDelete):
2785             - changed HashTable::ConstIterator interface.
2786         * runtime/JSObject.h:
2787             - HashEntry -> HashTableValue.
2788         * runtime/Lookup.cpp:
2789         (JSC::HashTable::createTable):
2790             - table -> keys, keys array is now densely packed.
2791         (JSC::HashTable::deleteTable):
2792             - table -> keys.
2793         (JSC::setUpStaticFunctionSlot):
2794             - HashEntry -> HashTableValue.
2795         * runtime/Lookup.h:
2796         (JSC::HashTableValue::builtinGenerator):
2797         (JSC::HashTableValue::function):
2798         (JSC::HashTableValue::functionLength):
2799         (JSC::HashTableValue::propertyGetter):
2800         (JSC::HashTableValue::propertyPutter):
2801         (JSC::HashTableValue::lexerValue):
2802             - added accessor methods from HashEntry.
2803         (JSC::HashTable::copy):
2804             - fields changed.
2805         (JSC::HashTable::initializeIfNeeded):
2806             - table -> keys.
2807         (JSC::HashTable::entry):
2808             - HashEntry -> HashTableValue.
2809         (JSC::HashTable::ConstIterator::ConstIterator):
2810             - iterate packed value array, so no need to skipInvalidKeys().
2811         (JSC::HashTable::ConstIterator::value):
2812         (JSC::HashTable::ConstIterator::key):
2813         (JSC::HashTable::ConstIterator::operator->):
2814             - accessors now get HashTableValue/StringImpl* separately.
2815         (JSC::HashTable::ConstIterator::operator++):
2816             - iterate packed value array, so no need to skipInvalidKeys().
2817         (JSC::HashTable::end):
2818             - end is now size of dense not sparse array.
2819         (JSC::getStaticPropertySlot):
2820         (JSC::getStaticFunctionSlot):
2821         (JSC::getStaticValueSlot):
2822         (JSC::putEntry):
2823         (JSC::lookupPut):
2824             - HashEntry -> HashTableValue.
2825
2826 2014-03-11  Filip Pizlo  <fpizlo@apple.com>
2827
2828         It should be possible to build WebKit with FTL on iOS
2829         https://bugs.webkit.org/show_bug.cgi?id=130116
2830
2831         Reviewed by Dan Bernstein.
2832
2833         * Configurations/Base.xcconfig:
2834
2835 2014-03-10  Filip Pizlo  <fpizlo@apple.com>
2836
2837         GetById list caching should use something object-oriented rather than PolymorphicAccessStructureList
2838         https://bugs.webkit.org/show_bug.cgi?id=129778
2839
2840         Reviewed by Geoffrey Garen.
2841
2842         Also deduplicate the GetById getter call caching. Also add some small tests for
2843         get stubs.
2844
2845         This change reduces the amount of code involved in GetById access caching and it
2846         creates data structures that can serve as an elegant scaffold for introducing other
2847         kinds of caches or improving current caching styles. It will definitely make getter
2848         performance improvements easier to implement.
2849
2850         * CMakeLists.txt:
2851         * GNUmakefile.list.am:
2852         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2853         * JavaScriptCore.xcodeproj/project.pbxproj:
2854         * bytecode/CodeBlock.cpp:
2855         (JSC::CodeBlock::printGetByIdCacheStatus):
2856         * bytecode/GetByIdStatus.cpp:
2857         (JSC::GetByIdStatus::computeForStubInfo):
2858         * bytecode/PolymorphicGetByIdList.cpp: Added.
2859         (JSC::GetByIdAccess::GetByIdAccess):
2860         (JSC::GetByIdAccess::~GetByIdAccess):
2861         (JSC::GetByIdAccess::fromStructureStubInfo):
2862         (JSC::GetByIdAccess::visitWeak):
2863         (JSC::PolymorphicGetByIdList::PolymorphicGetByIdList):
2864         (JSC::PolymorphicGetByIdList::from):
2865         (JSC::PolymorphicGetByIdList::~PolymorphicGetByIdList):
2866         (JSC::PolymorphicGetByIdList::currentSlowPathTarget):
2867         (JSC::PolymorphicGetByIdList::addAccess):
2868         (JSC::PolymorphicGetByIdList::isFull):
2869         (JSC::PolymorphicGetByIdList::isAlmostFull):
2870         (JSC::PolymorphicGetByIdList::didSelfPatching):
2871         (JSC::PolymorphicGetByIdList::visitWeak):
2872         * bytecode/PolymorphicGetByIdList.h: Added.
2873         (JSC::GetByIdAccess::GetByIdAccess):
2874         (JSC::GetByIdAccess::isSet):
2875         (JSC::GetByIdAccess::operator!):
2876         (JSC::GetByIdAccess::type):
2877         (JSC::GetByIdAccess::structure):
2878         (JSC::GetByIdAccess::chain):
2879         (JSC::GetByIdAccess::chainCount):
2880         (JSC::GetByIdAccess::stubRoutine):
2881         (JSC::GetByIdAccess::doesCalls):
2882         (JSC::PolymorphicGetByIdList::isEmpty):
2883         (JSC::PolymorphicGetByIdList::size):
2884         (JSC::PolymorphicGetByIdList::at):
2885         (JSC::PolymorphicGetByIdList::operator[]):
2886         * bytecode/StructureStubInfo.cpp:
2887         (JSC::StructureStubInfo::deref):
2888         (JSC::StructureStubInfo::visitWeakReferences):
2889         * bytecode/StructureStubInfo.h:
2890         (JSC::isGetByIdAccess):
2891         (JSC::StructureStubInfo::initGetByIdList):
2892         * jit/Repatch.cpp:
2893         (JSC::generateGetByIdStub):
2894         (JSC::tryCacheGetByID):
2895         (JSC::patchJumpToGetByIdStub):
2896         (JSC::tryBuildGetByIDList):
2897         (JSC::tryBuildPutByIdList):
2898         * tests/stress/getter.js: Added.
2899         (foo):
2900         (.o):
2901         * tests/stress/polymorphic-prototype-accesses.js: Added.
2902         (Foo):
2903         (Bar):
2904         (foo):
2905         * tests/stress/prototype-getter.js: Added.
2906         (Foo):
2907         (foo):
2908         * tests/stress/simple-prototype-accesses.js: Added.
2909         (Foo):
2910         (foo):
2911
2912 2014-03-11  Mark Hahnenberg  <mhahnenberg@apple.com>
2913
2914         MarkedBlocks that are "full enough" shouldn't be swept after EdenCollections
2915         https://bugs.webkit.org/show_bug.cgi?id=129920
2916
2917         Reviewed by Geoffrey Garen.
2918
2919         This patch introduces the notion of "retiring" MarkedBlocks. We retire a MarkedBlock
2920         when the amount of free space in a MarkedBlock drops below a certain threshold.
2921         Retired blocks are not considered for sweeping.
2922
2923         This is profitable because it reduces churn during sweeping. To build a free list,
2924         we have to scan through each cell in a block. After a collection, all objects that
2925         are live in the block will remain live until the next FullCollection, at which time
2926         we un-retire all previously retired blocks. Thus, a small number of objects in a block
2927         that die during each EdenCollection could cause us to do a disproportiante amount of
2928         sweeping for how much free memory we get back.
2929
2930         This patch looks like a consistent ~2% progression on boyer and is neutral everywhere else.
2931
2932         * heap/Heap.h:
2933         (JSC::Heap::didRetireBlockWithFreeListSize):
2934         * heap/MarkedAllocator.cpp:
2935         (JSC::MarkedAllocator::tryAllocateHelper):
2936         (JSC::MarkedAllocator::removeBlock):
2937         (JSC::MarkedAllocator::reset):
2938         * heap/MarkedAllocator.h:
2939         (JSC::MarkedAllocator::MarkedAllocator):
2940         (JSC::MarkedAllocator::forEachBlock):
2941         * heap/MarkedBlock.cpp:
2942         (JSC::MarkedBlock::sweepHelper):
2943         (JSC::MarkedBlock::clearMarksWithCollectionType):
2944         (JSC::MarkedBlock::didRetireBlock):
2945         * heap/MarkedBlock.h:
2946         (JSC::MarkedBlock::willRemoveBlock):
2947         (JSC::MarkedBlock::isLive):
2948         * heap/MarkedSpace.cpp:
2949         (JSC::MarkedSpace::clearNewlyAllocated):
2950         (JSC::MarkedSpace::clearMarks):
2951         * runtime/Options.h:
2952
2953 2014-03-11  Andreas Kling  <akling@apple.com>
2954
2955         Streamline PropertyTable for lookup-only access.
2956         <https://webkit.org/b/130060>
2957
2958         The PropertyTable lookup algorithm was written to support both read
2959         and write access. This wasn't actually needed in most places.
2960
2961         This change adds a PropertyTable::get() that just returns the value
2962         type (instead of an insertion iterator.) It also adds an early return
2963         for empty tables.
2964
2965         Finally, up the minimum table capacity from 8 to 16. It was lowered
2966         to 8 in order to save memory, but that was before PropertyTables were
2967         GC allocated. Nowadays we don't have nearly as many tables, since all
2968         the unpinned transitions die off.
2969
2970         Reviewed by Darin Adler.
2971
2972         * runtime/PropertyMapHashTable.h:
2973         (JSC::PropertyTable::get):
2974         * runtime/Structure.cpp:
2975         (JSC::Structure::despecifyDictionaryFunction):
2976         (JSC::Structure::attributeChangeTransition):
2977         (JSC::Structure::get):
2978         (JSC::Structure::despecifyFunction):
2979         * runtime/StructureInlines.h:
2980         (JSC::Structure::get):
2981
2982 2014-03-10  Mark Hahnenberg  <mhahnenberg@apple.com>
2983
2984         REGRESSION(r165407): DoYouEvenBench crashes in DRT
2985         https://bugs.webkit.org/show_bug.cgi?id=130066
2986
2987         Reviewed by Geoffrey Garen.
2988
2989         The baseline JIT does a conditional store barrier for the put_by_id, but we need
2990         an unconditional store barrier so that we cover the butterfly case as well in emitPutTransitionStub.
2991
2992         * jit/JIT.h:
2993         * jit/JITPropertyAccess.cpp:
2994         (JSC::JIT::emit_op_put_by_id):
2995         (JSC::JIT::emitWriteBarrier):
2996
2997 2014-03-10  Mark Lam  <mark.lam@apple.com>
2998
2999         Resurrect bit-rotted JIT::probe() mechanism.
3000         <https://webkit.org/b/130067>
3001
3002         Reviewed by Geoffrey Garen.
3003
3004         * jit/JITStubs.cpp:
3005         - Added the needed #include <wtf/InlineASM.h>.
3006
3007 2014-03-10  Joseph Pecoraro  <pecoraro@apple.com>
3008
3009         Fix typo in EXCLUDED_SOURCE_FILE_NAMES_iphoneos.
3010
3011         Rubber-stamped by Dan Bernstein.
3012
3013         * Configurations/JavaScriptCore.xcconfig:
3014
3015 2014-03-10  Mark Lam  <mark.lam@apple.com>
3016
3017         r165414 broke the 32-bit x86 tests: ASSERTION FAILED: result != InvalidIndex @ GPRInfo.h:330.
3018         <https://webkit.org/b/130065>
3019
3020         Reviewed by Michael Saboff.
3021
3022         There is code in ScratchRegisterAllocator.cpp that is relying on GPRInfo::toIndex()
3023         being able to return InvalidIndex.  Hence, the assertion is invalid.  Ditto for
3024         FPRInfo::toIndex().
3025
3026         The fix is to remove the "result != InvalidIndex" assertions.
3027
3028         * jit/FPRInfo.h:
3029         (JSC::FPRInfo::toIndex):
3030         * jit/GPRInfo.h:
3031         (JSC::GPRInfo::toIndex):
3032
3033 2014-03-10  Mark Lam  <mark.lam@apple.com>
3034
3035         Crash on a stack overflow on 32-bit x86 in http/tests/websocket/tests/hybi/workers/no-onmessage-in-sync-op.html.
3036         <https://webkit.org/b/129955>
3037
3038         Reviewed by Geoffrey Garen.
3039
3040         The 32-bit x86 version of getHostCallReturnValue() was leaking 16 bytes
3041         stack memory every time it was called.  This is now fixed.
3042
3043         * jit/JITOperations.cpp:
3044
3045 2014-03-10  Joseph Pecoraro  <pecoraro@apple.com>
3046
3047         Better JSContext API for named evaluations (other than //# sourceURL)
3048         https://bugs.webkit.org/show_bug.cgi?id=129911
3049
3050         Reviewed by Geoffrey Garen.
3051
3052         * API/JSBase.h:
3053         * API/JSContext.h:
3054         * API/JSContext.mm:
3055         (-[JSContext evaluateScript:]):
3056         (-[JSContext evaluateScript:withSourceURL:]):
3057         Add new evaluateScript:withSourceURL:.
3058
3059         * API/tests/testapi.c:
3060         (main):
3061         * API/tests/testapi.mm:
3062         (testObjectiveCAPI):
3063         Add tests for sourceURL in evaluate APIs. It should
3064         affect the exception objects.
3065
3066 2014-03-10  Filip Pizlo  <fpizlo@apple.com>
3067
3068         Repatch should save and restore all used registers - not just temp ones - when making a call
3069         https://bugs.webkit.org/show_bug.cgi?id=130041
3070
3071         Reviewed by Geoffrey Garen and Mark Hahnenberg.
3072
3073         The save/restore code was written back when the only client was the DFG, which only uses a
3074         subset of hardware registers: the "temp" registers in our lingo. But the FTL may use many
3075         other registers, especially on ARM64. The fact that Repatch doesn't know to save those can
3076         lead to data corruption on ARM64.
3077
3078         * jit/RegisterSet.cpp:
3079         (JSC::RegisterSet::calleeSaveRegisters):
3080         (JSC::RegisterSet::numberOfSetGPRs):
3081         (JSC::RegisterSet::numberOfSetFPRs):
3082         * jit/RegisterSet.h:
3083         * jit/Repatch.cpp:
3084         (JSC::storeToWriteBarrierBuffer):
3085         (JSC::emitPutTransitionStub):
3086         * jit/ScratchRegisterAllocator.cpp:
3087         (JSC::ScratchRegisterAllocator::ScratchRegisterAllocator):
3088         (JSC::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
3089         (JSC::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
3090         (JSC::ScratchRegisterAllocator::usedRegistersForCall):
3091         (JSC::ScratchRegisterAllocator::desiredScratchBufferSizeForCall):
3092         (JSC::ScratchRegisterAllocator::preserveUsedRegistersToScratchBufferForCall):
3093         (JSC::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBufferForCall):
3094         * jit/ScratchRegisterAllocator.h:
3095
3096 2014-03-10  Mark Hahnenberg  <mhahnenberg@apple.com>
3097
3098         Remove ConditionalStore barrier
3099         https://bugs.webkit.org/show_bug.cgi?id=130040
3100
3101         Reviewed by Geoffrey Garen.
3102
3103         ConditionalStoreBarrier was created when barriers were much more expensive. Now that
3104         they're cheap(er), we can get rid of them. This also allows us to get rid of the write
3105         barrier logic in emitPutTransitionStub because we always will have executed a write barrier
3106         on the base object in the case where we are allocating and storing a new Butterfly into it.
3107         Previously, a ConditionalStoreBarrier might or might not have barrier-ed the base object,
3108         so we'd have to emit a write barrier in the transition case.
3109
3110         This is performance neutral on the benchmarks we track.
3111
3112         * dfg/DFGAbstractInterpreterInlines.h:
3113         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
3114         * dfg/DFGClobberize.h:
3115         (JSC::DFG::clobberize):
3116         * dfg/DFGConstantFoldingPhase.cpp:
3117         (JSC::DFG::ConstantFoldingPhase::foldConstants):
3118         (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
3119         * dfg/DFGFixupPhase.cpp:
3120         (JSC::DFG::FixupPhase::fixupNode):
3121         (JSC::DFG::FixupPhase::insertStoreBarrier):
3122         * dfg/DFGNode.h:
3123         (JSC::DFG::Node::isStoreBarrier):
3124         * dfg/DFGNodeType.h:
3125         * dfg/DFGPredictionPropagationPhase.cpp:
3126         (JSC::DFG::PredictionPropagationPhase::propagate):
3127         * dfg/DFGSafeToExecute.h:
3128         (JSC::DFG::safeToExecute):
3129         * dfg/DFGSpeculativeJIT.cpp:
3130         (JSC::DFG::SpeculativeJIT::compileStoreBarrier):
3131         * dfg/DFGSpeculativeJIT32_64.cpp:
3132         (JSC::DFG::SpeculativeJIT::compile):
3133         * dfg/DFGSpeculativeJIT64.cpp:
3134         (JSC::DFG::SpeculativeJIT::compile):
3135         * ftl/FTLCapabilities.cpp:
3136         (JSC::FTL::canCompile):
3137         * ftl/FTLLowerDFGToLLVM.cpp:
3138         (JSC::FTL::LowerDFGToLLVM::compileNode):
3139         * jit/Repatch.cpp:
3140         (JSC::emitPutTransitionStub):
3141
3142 2014-03-10  Filip Pizlo  <fpizlo@apple.com>
3143
3144         DFG and FTL should know that comparing anything to Misc is cheap and easy
3145         https://bugs.webkit.org/show_bug.cgi?id=130001
3146
3147         Reviewed by Geoffrey Garen.
3148
3149         - Expand CompareStrictEq(Misc:, Misc:) to work for cases where either side of the
3150           comparison is just Untyped:.
3151
3152         - This obviates the need for CompareStrictEqConstant, so remove it.
3153
3154         - FTL had a thing called "Nully" which is really "Other". Rename it and add
3155           OtherUse.
3156
3157         9% speed-up on box2d.
3158
3159         * dfg/DFGAbstractInterpreterInlines.h:
3160         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
3161         * dfg/DFGByteCodeParser.cpp:
3162         (JSC::DFG::ByteCodeParser::parseBlock):
3163         * dfg/DFGClobberize.h:
3164         (JSC::DFG::clobberize):
3165         * dfg/DFGFixupPhase.cpp:
3166         (JSC::DFG::FixupPhase::fixupNode):
3167         * dfg/DFGNode.h:
3168         (JSC::DFG::Node::isBinaryUseKind):
3169         (JSC::DFG::Node::shouldSpeculateOther):
3170         * dfg/DFGNodeType.h:
3171         * dfg/DFGPredictionPropagationPhase.cpp:
3172         (JSC::DFG::PredictionPropagationPhase::propagate):
3173         * dfg/DFGSafeToExecute.h:
3174         (JSC::DFG::safeToExecute):
3175         * dfg/DFGSpeculativeJIT.cpp:
3176         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
3177         (JSC::DFG::SpeculativeJIT::compare):
3178         (JSC::DFG::SpeculativeJIT::compileStrictEq):
3179         * dfg/DFGSpeculativeJIT.h:
3180         * dfg/DFGSpeculativeJIT32_64.cpp:
3181         (JSC::DFG::SpeculativeJIT::compileMiscStrictEq):
3182         (JSC::DFG::SpeculativeJIT::compile):
3183         * dfg/DFGSpeculativeJIT64.cpp:
3184         (JSC::DFG::SpeculativeJIT::compileMiscStrictEq):
3185         (JSC::DFG::SpeculativeJIT::compile):
3186         * ftl/FTLCapabilities.cpp:
3187         (JSC::FTL::canCompile):
3188         * ftl/FTLLowerDFGToLLVM.cpp:
3189         (JSC::FTL::LowerDFGToLLVM::compileNode):
3190         (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
3191         (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
3192         (JSC::FTL::LowerDFGToLLVM::compareEqObjectOrOtherToObject):
3193         (JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):
3194         (JSC::FTL::LowerDFGToLLVM::isNotOther):
3195         (JSC::FTL::LowerDFGToLLVM::isOther):
3196         (JSC::FTL::LowerDFGToLLVM::speculate):
3197         (JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):
3198         (JSC::FTL::LowerDFGToLLVM::speculateNotCell):
3199         (JSC::FTL::LowerDFGToLLVM::speculateOther):
3200         (JSC::FTL::LowerDFGToLLVM::speculateMisc):
3201         * tests/stress/compare-strict-eq-integer-to-misc.js: Added.
3202
3203 2014-03-10  Filip Pizlo  <fpizlo@apple.com>
3204
3205         Unreviewed, remove unintended change.
3206
3207         * dfg/DFGDriver.cpp:
3208         (JSC::DFG::compileImpl):
3209
3210 2014-03-10  Filip Pizlo  <fpizlo@apple.com>
3211
3212         jsc commandline shouldn't have a "console" because that confuses some tests into thinking
3213         that they're running in the browser.
3214
3215         Rubber stamped by Mark Hahnenberg.
3216
3217         * jsc.cpp:
3218         (GlobalObject::finishCreation):
3219
3220 2014-03-10  Filip Pizlo  <fpizlo@apple.com>
3221
3222         Out-line ScratchRegisterAllocator
3223
3224         Rubber stamped by Mark Hahnenberg.
3225
3226         * CMakeLists.txt:
3227         * GNUmakefile.list.am:
3228         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
3229         * JavaScriptCore.xcodeproj/project.pbxproj:
3230         * dfg/DFGDriver.cpp:
3231         (JSC::DFG::compileImpl):
3232         * jit/ScratchRegisterAllocator.cpp: Added.
3233         (JSC::ScratchRegisterAllocator::ScratchRegisterAllocator):
3234         (JSC::ScratchRegisterAllocator::~ScratchRegisterAllocator):
3235         (JSC::ScratchRegisterAllocator::lock):
3236         (JSC::ScratchRegisterAllocator::allocateScratch):
3237         (JSC::ScratchRegisterAllocator::allocateScratchGPR):
3238         (JSC::ScratchRegisterAllocator::allocateScratchFPR):
3239         (JSC::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
3240         (JSC::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
3241         (JSC::ScratchRegisterAllocator::desiredScratchBufferSize):
3242         (JSC::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
3243         (JSC::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
3244         * jit/ScratchRegisterAllocator.h:
3245
3246 2014-03-10  Brent Fulgham  <bfulgham@apple.com>
3247
3248         [Win] Pass environment to Pre-Build, Pre-link, and Post-Build Stages.
3249         https://bugs.webkit.org/show_bug.cgi?id=130023
3250
3251         Reviewed by Dean Jackson.
3252
3253         * JavaScriptCore.vcxproj/JavaScriptCore.proj: Avoid trailing backslashes in
3254         path names to avoid accidental escaping of later string substitutions.
3255
3256 2014-03-10  Andreas Kling  <akling@apple.com>
3257
3258         [X86_64] Smaller code for testb_i8r when register is accumulator.
3259         <https://webkit.org/b/130026>
3260
3261         Generate the shorthand version of "test al, imm" when possible.
3262
3263         Reviewed by Michael Saboff.
3264
3265         * assembler/X86Assembler.h:
3266         (JSC::X86Assembler::testb_i8r):
3267
3268 2014-03-10  Andreas Kling  <akling@apple.com>
3269
3270         [X86_64] Smaller code for sub_ir when register is accumulator.
3271         <https://webkit.org/b/130025>
3272
3273         Generate the shorthand version of "sub eax, imm" when possible.
3274
3275         Reviewed by Michael Saboff.
3276
3277         * assembler/X86Assembler.h:
3278         (JSC::X86Assembler::subl_ir):
3279         (JSC::X86Assembler::subq_ir):
3280
3281 2014-03-10  Andreas Kling  <akling@apple.com>
3282
3283         [X86_64] Smaller code for add_ir when register is accumulator.
3284         <https://webkit.org/b/130024>
3285
3286         Generate the shorthand version of "add eax, imm" when possible.
3287
3288         Reviewed by Michael Saboff.
3289
3290         * assembler/X86Assembler.h:
3291         (JSC::X86Assembler::addl_ir):
3292         (JSC::X86Assembler::addq_ir):
3293
3294 2014-03-10  Mark Hahnenberg  <mhahnenberg@apple.com>
3295
3296         writeBarrier in emitPutReplaceStub is unnecessary
3297         https://bugs.webkit.org/show_bug.cgi?id=130030
3298
3299         Reviewed by Filip Pizlo.
3300
3301         We already emit write barriers for each put-by-id when they're first compiled, so it's
3302         redundant to emit a write barrier as part of the repatched code.
3303
3304         * jit/Repatch.cpp:
3305         (JSC::emitPutReplaceStub):
3306
3307 2014-03-10  Andreas Kling  <akling@apple.com>
3308
3309         [X86_64] Smaller code for xor_ir when register is accumulator.
3310         <https://webkit.org/b/130008>
3311
3312         Generate the shorthand version of "xor eax, imm" when possible.
3313
3314         Reviewed by Benjamin Poulain.
3315
3316         * assembler/X86Assembler.h:
3317         (JSC::X86Assembler::xorl_ir):
3318         (JSC::X86Assembler::xorq_ir):
3319
3320 2014-03-10  Andreas Kling  <akling@apple.com>
3321
3322         [X86_64] Smaller code for or_ir when register is accumulator.
3323         <https://webkit.org/b/130007>
3324
3325         Generate the shorthand version of "or eax, imm" when possible.
3326
3327         Reviewed by Benjamin Poulain.
3328
3329         * assembler/X86Assembler.h:
3330         (JSC::X86Assembler::orl_ir):
3331         (JSC::X86Assembler::orq_ir):
3332
3333 2014-03-10  Andreas Kling  <akling@apple.com>
3334
3335         [X86_64] Smaller code for test_ir when register is accumulator.
3336         <https://webkit.org/b/130006>
3337
3338         Generate the shorthand version of "test eax, imm" when possible.
3339
3340         Reviewed by Benjamin Poulain.
3341
3342         * assembler/X86Assembler.h:
3343         (JSC::X86Assembler::testl_i32r):
3344         (JSC::X86Assembler::testq_i32r):
3345
3346 2014-03-10  Andreas Kling  <akling@apple.com>
3347
3348         [X86_64] Smaller code for cmp_ir when register is accumulator.
3349         <https://webkit.org/b/130005>
3350
3351         Generate the shorthand version of "cmp eax, imm" when possible.
3352
3353         Reviewed by Benjamin Poulain.
3354
3355         * assembler/X86Assembler.h:
3356         (JSC::X86Assembler::cmpl_ir):
3357         (JSC::X86Assembler::cmpq_ir):
3358
3359 2014-03-10  Andreas Kling  <akling@apple.com>
3360
3361         [X86_64] Smaller code for store64(imm, address) when imm fits in 32 bits.
3362         <https://webkit.org/b/130002>
3363
3364         Generate this:
3365
3366             mov [address], imm32
3367
3368         Instead of this:
3369
3370             mov scratchRegister, imm32
3371             mov [address], scratchRegister
3372
3373         For store64(imm, address) where the 64-bit immediate can be passed as
3374         a sign-extended 32-bit value.
3375
3376         Reviewed by Benjamin Poulain.
3377
3378         * assembler/MacroAssemblerX86_64.h:
3379         (CAN_SIGN_EXTEND_32_64):
3380         (JSC::MacroAssemblerX86_64::store64):
3381
3382 2014-03-10  Andreas Kling  <akling@apple.com>
3383
3384         [X86_64] Smaller code for xchg_rr when one register is accumulator.
3385         <https://webkit.org/b/130004>
3386
3387         Generate the 1-byte version of "xchg eax, reg" when possible.
3388
3389         Reviewed by Benjamin Poulain.
3390
3391         * assembler/X86Assembler.h:
3392         (JSC::X86Assembler::xchgl_rr):
3393         (JSC::X86Assembler::xchgq_rr):
3394
3395 2014-03-09  Filip Pizlo  <fpizlo@apple.com>
3396
3397         GPRInfo::toIndex should return InvalidIndex for non-temp registers on ARM64
3398         https://bugs.webkit.org/show_bug.cgi?id=129998
3399
3400         Reviewed by Geoffrey Garen.
3401
3402         Not only is that the established contract, but this is used to signal to
3403         ScratchRegisterAllocator that the register doesn't need locking since it isn't a register
3404         that this allocator would use. In the FTL, we may have an inline cache where LLVM had used
3405         some non-temp register (i.e. a register that JSC itself wouldn't have used). This is totally
3406         fine but previously it would have led to either an assertion failure, or data corruption, in
3407         the ScratchRegisterAllocator.
3408
3409         * jit/GPRInfo.h:
3410         (JSC::GPRInfo::toIndex):
3411
3412 2014-03-09  Filip Pizlo  <fpizlo@apple.com>
3413
3414         FTL fails the new equals-masquerader strictEqualConstant test
3415         https://bugs.webkit.org/show_bug.cgi?id=129996
3416
3417         Reviewed by Mark Lam.
3418
3419         It turns out that the FTL was trying to do the masquerading stuff for ===null. But
3420         that's wrong since none of the other engines do it. The DFG even had an ancient
3421         FIXME about doing it - but that doesn't make sense since the LLInt and baseline JIT
3422         don't do it and JSValue::strictEqual() doesn't do it.
3423
3424         Remove the FIXME and remove the extra checks in the FTL.
3425
3426         This is a glorious patch: nothing but red and it fixes a test failure.
3427
3428         * dfg/DFGSpeculativeJIT.cpp:
3429         (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
3430         * ftl/FTLLowerDFGToLLVM.cpp:
3431         (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEqConstant):
3432
3433 2014-03-09  Andreas Kling  <akling@apple.com>
3434
3435         Short-circuit JSGlobalObjectInspectorController when not inspecting.
3436         <https://webkit.org/b/129995>
3437
3438         Add an early return in reportAPIException() when the console agent
3439         is disabled. This avoids expensive symbolication during exceptions
3440         if there's nobody expecting the fancy backtrace anyway.
3441
3442         ~2% progression on DYEB on my MBP.
3443
3444         Reviewed by Geoff Garen.
3445
3446         * inspector/JSGlobalObjectInspectorController.cpp:
3447         (Inspector::JSGlobalObjectInspectorController::reportAPIException):
3448
3449 2014-03-09  Andreas Kling  <akling@apple.com>
3450
3451         Inline the trivial parts of GC deferral.
3452         <https://webkit.org/b/129984>
3453
3454         Made most of the functions called by the DeferGC RAII object inline
3455         to avoid function call overhead.
3456
3457         Looks like ~1% progression on DYEB.
3458
3459         Reviewed by Geoffrey Garen.
3460
3461         * heap/Heap.cpp:
3462         * heap/Heap.h:
3463         (JSC::Heap::incrementDeferralDepth):
3464         (JSC::Heap::decrementDeferralDepth):
3465         (JSC::Heap::collectIfNecessaryOrDefer):
3466         (JSC::Heap::decrementDeferralDepthAndGCIfNeeded):
3467
3468 2014-03-08  Mark Lam  <mark.lam@apple.com>
3469
3470         32-bit x86 handleUncaughtException returns to wrong location after a stack overflow.
3471         <https://webkit.org/b/129969>
3472
3473         Reviewed by Geoffrey Garen.
3474
3475         The 32-bit version of handleUncaughtException was missing the handling of an
3476         edge case for stack overflows where the current frame may already be the
3477         sentinel frame.  This edge case was handled in the 64-bit version.  The fix
3478         is to bring the 32-bit version up to parity.
3479
3480         * jit/JIT.cpp:
3481         (JSC::JIT::privateCompile):
3482         * llint/LowLevelInterpreter32_64.asm:
3483
3484 2014-03-07  Mark Lam  <mark.lam@apple.com>
3485
3486         Fix bugs in 32-bit Structure implementation.
3487         <https://webkit.org/b/129947>
3488
3489         Reviewed by Mark Hahnenberg.
3490
3491         Added the loading of the Structure (from the JSCell) before use that was
3492         missing in a few places.  Also added more test cases to equals-masquerader.js.
3493
3494         * dfg/DFGSpeculativeJIT32_64.cpp:
3495         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
3496         (JSC::DFG::SpeculativeJIT::compile):
3497         * dfg/DFGSpeculativeJIT64.cpp:
3498         (JSC::DFG::SpeculativeJIT::compile):
3499         * llint/LowLevelInterpreter32_64.asm:
3500         * tests/stress/equals-masquerader.js:
3501         (equalsNull):
3502         (notEqualsNull):
3503         (strictEqualsNull):
3504         (strictNotEqualsNull):
3505         (equalsUndefined):
3506         (notEqualsUndefined):
3507         (strictEqualsUndefined):
3508         (strictNotEqualsUndefined):
3509         (isFalsey):
3510         (test):
3511
3512 2014-03-07  Andrew Trick  <atrick@apple.com>
3513
3514         Temporarily disable repeat-out-of-bounds stress tests pending fix for 129953.
3515         https://bugs.webkit.org/show_bug.cgi?id=129954
3516
3517         Reviewed by Filip Pizlo.
3518
3519         * tests/stress/float32-repeat-out-of-bounds.js:
3520         * tests/stress/int8-repeat-out-of-bounds.js:
3521
3522 2014-03-07  Michael Saboff  <msaboff@apple.com>
3523
3524         .cfi directives in LowLevelInterpreter.cpp are providing no benefit
3525         https://bugs.webkit.org/show_bug.cgi?id=129945
3526
3527         Reviewed by Mark Lam.
3528
3529         Removed .cfi directive.  Verified that stack traces didn't regress in crash reporter
3530         or in lldb.
3531
3532         * llint/LowLevelInterpreter.cpp:
3533
3534 2014-03-07  Oliver Hunt  <oliver@apple.com>
3535
3536         Continue hangs when performing for-of over arguments
3537         https://bugs.webkit.org/show_bug.cgi?id=129915
3538
3539         Reviewed by Geoffrey Garen.
3540
3541         Put the continue label in the right place
3542
3543         * bytecompiler/BytecodeGenerator.cpp:
3544         (JSC::BytecodeGenerator::emitEnumeration):
3545
3546 2014-03-07  peavo@outlook.com  <peavo@outlook.com>
3547
3548         [Win64] Compile error after r165128.
3549         https://bugs.webkit.org/show_bug.cgi?id=129807
3550
3551         Reviewed by Mark Lam.
3552
3553         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh:
3554         Check platform environment variable to determine if an assembler file should be generated.
3555
3556 2014-03-07  Michael Saboff  <msaboff@apple.com>
3557
3558         Clarify how we deal with "special" registers
3559         https://bugs.webkit.org/show_bug.cgi?id=129806
3560
3561         Already reviewed change being relanded.
3562
3563         Relanding change set r165196 as it wasn't responsible for the breakage reported in
3564         https://bugs.webkit.org/show_bug.cgi?id=129822.  That appears to be a build or
3565
3566         Reviewed by Michael Saboff.
3567         configuration issue.
3568
3569         * assembler/ARM64Assembler.h:
3570         (JSC::ARM64Assembler::lastRegister):
3571         * assembler/MacroAssembler.h:
3572         (JSC::MacroAssembler::nextRegister):
3573         * ftl/FTLLocation.cpp:
3574         (JSC::FTL::Location::restoreInto):
3575         * ftl/FTLSaveRestore.cpp:
3576         (JSC::FTL::saveAllRegisters):
3577         (JSC::FTL::restoreAllRegisters):
3578         * ftl/FTLSlowPathCall.cpp:
3579         * jit/RegisterSet.cpp:
3580         (JSC::RegisterSet::reservedHardwareRegisters):
3581         (JSC::RegisterSet::runtimeRegisters):
3582         (JSC::RegisterSet::specialRegisters):
3583         (JSC::RegisterSet::calleeSaveRegisters):
3584         * jit/RegisterSet.h:
3585
3586 2014-03-07  Mark Hahnenberg  <mhahnenberg@apple.com>
3587
3588         Move GCActivityCallback to heap
3589         https://bugs.webkit.org/show_bug.cgi?id=129457
3590
3591         Reviewed by Geoffrey Garen.
3592
3593         All the other GC timer related stuff is there already.
3594
3595         * CMakeLists.txt:
3596         * GNUmakefile.list.am:
3597         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
3598         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
3599         * JavaScriptCore.xcodeproj/project.pbxproj:
3600         * heap/GCActivityCallback.cpp: Copied from Source/JavaScriptCore/runtime/GCActivityCallback.cpp.
3601         * heap/GCActivityCallback.h: Copied from Source/JavaScriptCore/runtime/GCActivityCallback.h.
3602         * runtime/GCActivityCallback.cpp: Removed.
3603         * runtime/GCActivityCallback.h: Removed.
3604
3605 2014-03-07  Andrew Trick  <atrick@apple.com>
3606
3607         Correct a comment typo from:
3608         FLT should call fmod directly on platforms where LLVM cannot relocate the libcall
3609         https://bugs.webkit.org/show_bug.cgi?id=129865
3610
3611         Reviewed by Mark Lam.
3612
3613         * ftl/FTLOutput.h:
3614         (JSC::FTL::Output::doubleRem):
3615
3616 2014-03-07  Mark Hahnenberg  <mhahnenberg@apple.com>
3617
3618         Use OwnPtr in StructureIDTable
3619         https://bugs.webkit.org/show_bug.cgi?id=129828
3620
3621         Reviewed by Geoffrey Garen.
3622
3623         This reduces the amount of boilerplate and fixes a memory leak.
3624
3625         * runtime/StructureIDTable.cpp:
3626         (JSC::StructureIDTable::StructureIDTable):
3627         (JSC::StructureIDTable::resize):
3628         (JSC::StructureIDTable::flushOldTables):
3629         (JSC::StructureIDTable::allocateID):
3630         (JSC::StructureIDTable::deallocateID):
3631         * runtime/StructureIDTable.h:
3632         (JSC::StructureIDTable::table):
3633         (JSC::StructureIDTable::get):
3634
3635 2014-03-07  Andrew Trick  <atrick@apple.com>
3636
3637         FLT should call fmod directly on platforms where LLVM cannot relocate the libcall
3638         https://bugs.webkit.org/show_bug.cgi?id=129865
3639
3640         Reviewed by Filip Pizlo.
3641
3642         * ftl/FTLIntrinsicRepository.h:
3643         * ftl/FTLOutput.h:
3644         (JSC::FTL::Output::doubleRem):
3645
3646 2014-03-06  Filip Pizlo  <fpizlo@apple.com>
3647
3648         If the FTL is build-time enabled then it should be run-time enabled.
3649
3650         Rubber stamped by Geoffrey Garen.
3651
3652         * runtime/Options.cpp:
3653         (JSC::recomputeDependentOptions):
3654         * runtime/Options.h:
3655
3656 2014-03-06  Joseph Pecoraro  <pecoraro@apple.com>
3657
3658         [OS X] Web Inspector: Allow Apps using JavaScriptCore to access "com.apple.webinspector" mach port
3659         https://bugs.webkit.org/show_bug.cgi?id=129852
3660
3661         Reviewed by Geoffrey Garen.
3662
3663         * framework.sb: Added.
3664         Sandbox extension to allow access to "com.apple.webinspector".
3665
3666         * JavaScriptCore.xcodeproj/project.pbxproj:
3667         Add a Copy Resources build phase and include framework.sb.
3668
3669         * Configurations/JavaScriptCore.xcconfig:
3670         Do not copy framework.sb on iOS.
3671
3672 2014-03-06  Mark Hahnenberg  <mhahnenberg@apple.com>
3673
3674         JSGlobalContextRelease incorrectly handles saving/restoring IdentifierTable
3675         https://bugs.webkit.org/show_bug.cgi?id=129858
3676
3677         Reviewed by Mark Lam.
3678
3679         It was correct (but really ugly) prior to the combining of APIEntryShim and JSLock,
3680         but now it ends up overwriting the IdentifierTable that JSLock just restored.
3681
3682         * API/JSContextRef.cpp:
3683         (JSGlobalContextRelease):
3684
3685 2014-03-06  Oliver Hunt  <oliver@apple.com>
3686
3687         Fix FTL build.
3688
3689         * dfg/DFGConstantFoldingPhase.cpp:
3690         (JSC::DFG::ConstantFoldingPhase::foldConstants):
3691
3692 2014-03-06  Brent Fulgham  <bfulgham@apple.com>
3693
3694         Unreviewed build fix after r165128.
3695
3696         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: The SEH flag was not getting set when
3697         performing 'Production' and 'DebugSuffix' type builds.
3698
3699 2014-03-06  Julien Brianceau  <jbriance@cisco.com>
3700
3701         Unreviewed, fix style in my previous commit.
3702         https://bugs.webkit.org/show_bug.cgi?id=129833
3703
3704         * runtime/JSConsole.cpp:
3705
3706 2014-03-06  Julien Brianceau  <jbriance@cisco.com>
3707
3708         Build fix: add missing include in JSConole.cpp.
3709         https://bugs.webkit.org/show_bug.cgi?id=129833
3710
3711         Reviewed by Oliver Hunt.
3712
3713         * runtime/JSConsole.cpp:
3714
3715 2014-03-06  Oliver Hunt  <oliver@apple.com>
3716
3717         Fix ARMv7
3718
3719         * jit/CCallHelpers.h:
3720         (JSC::CCallHelpers::setupArgumentsWithExecState):
3721
3722 2014-03-06  Commit Queue  <commit-queue@webkit.org>
3723
3724         Unreviewed, rolling out r165196.
3725         http://trac.webkit.org/changeset/165196
3726         https://bugs.webkit.org/show_bug.cgi?id=129822
3727
3728         broke arm64 on hardware (Requested by bfulgham on #webkit).
3729
3730         * assembler/ARM64Assembler.h:
3731         (JSC::ARM64Assembler::lastRegister):
3732         * assembler/MacroAssembler.h:
3733         (JSC::MacroAssembler::isStackRelated):
3734         (JSC::MacroAssembler::firstRealRegister):
3735         (JSC::MacroAssembler::nextRegister):
3736         (JSC::MacroAssembler::secondRealRegister):
3737         * ftl/FTLLocation.cpp:
3738         (JSC::FTL::Location::restoreInto):
3739         * ftl/FTLSaveRestore.cpp:
3740         (JSC::FTL::saveAllRegisters):
3741         (JSC::FTL::restoreAllRegisters):
3742         * ftl/FTLSlowPathCall.cpp:
3743         * jit/RegisterSet.cpp:
3744         (JSC::RegisterSet::specialRegisters):
3745         (JSC::RegisterSet::calleeSaveRegisters):
3746         * jit/RegisterSet.h:
3747
3748 2014-03-06  Mark Lam  <mark.lam@apple.com>
3749
3750         REGRESSION(r165205): broke the CLOOP build (Requested by smfr on #webkit).
3751         <https://webkit.org/b/129813>
3752
3753         Reviewed by Michael Saboff.
3754
3755         Fixed broken C loop LLINT build.
3756
3757         * llint/LowLevelInterpreter.cpp:
3758         (JSC::CLoop::execute):
3759         * offlineasm/cloop.rb:
3760
3761 2014-03-03  Oliver Hunt  <oliver@apple.com>
3762
3763         Support caching of custom setters
3764         https://bugs.webkit.org/show_bug.cgi?id=129519
3765
3766         Reviewed by Filip Pizlo.
3767
3768         This patch adds caching of assignment to properties that
3769         are backed by C functions. This provides most of the leg
3770         work required to start supporting setters, and resolves
3771         the remaining regressions from moving DOM properties up
3772         the prototype chain.
3773
3774         * JavaScriptCore.xcodeproj/project.pbxproj:
3775         * bytecode/PolymorphicPutByIdList.cpp:
3776         (JSC::PutByIdAccess::visitWeak):
3777         (JSC::PolymorphicPutByIdList::PolymorphicPutByIdList):
3778         (JSC::PolymorphicPutByIdList::from):
3779         * bytecode/PolymorphicPutByIdList.h:
3780         (JSC::PutByIdAccess::transition):
3781         (JSC::PutByIdAccess::replace):
3782         (JSC::PutByIdAccess::customSetter):
3783         (JSC::PutByIdAccess::isCustom):
3784         (JSC::PutByIdAccess::oldStructure):
3785         (JSC::PutByIdAccess::chain):
3786         (JSC::PutByIdAccess::stubRoutine):
3787         * bytecode/PutByIdStatus.cpp:
3788         (JSC::PutByIdStatus::computeForStubInfo):
3789         (JSC::PutByIdStatus::computeFor):
3790         (JSC::PutByIdStatus::dump):
3791         * bytecode/PutByIdStatus.h:
3792         (JSC::PutByIdStatus::PutByIdStatus):
3793         (JSC::PutByIdStatus::takesSlowPath):
3794         (JSC::PutByIdStatus::makesCalls):
3795         * bytecode/StructureStubInfo.h:
3796         * dfg/DFGAbstractInterpreterInlines.h:
3797         (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
3798         * dfg/DFGByteCodeParser.cpp:
3799         (JSC::DFG::ByteCodeParser::emitPutById):
3800         (JSC::DFG::ByteCodeParser::handlePutById):
3801         * dfg/DFGClobberize.h:
3802         (JSC::DFG::clobberize):
3803         * dfg/DFGCommon.h:
3804         * dfg/DFGConstantFoldingPhase.cpp:
3805         (JSC::DFG::ConstantFoldingPhase::foldConstants):
3806         * dfg/DFGFixupPhase.cpp:
3807         (JSC::DFG::FixupPhase::fixupNode):
3808         * dfg/DFGNode.h:
3809         (JSC::DFG::Node::hasIdentifier):
3810         * dfg/DFGNodeType.h:
3811         * dfg/DFGPredictionPropagationPhase.cpp:
3812         (JSC::DFG::PredictionPropagationPhase::propagate):
3813         * dfg/DFGSafeToExecute.h:
3814         (JSC::DFG::safeToExecute):
3815         * dfg/DFGSpeculativeJIT.cpp:
3816         (JSC::DFG::SpeculativeJIT::compileIn):
3817         * dfg/DFGSpeculativeJIT.h:
3818         * dfg/DFGSpeculativeJIT32_64.cpp:
3819         (JSC::DFG::SpeculativeJIT::cachedGetById):
3820         (JSC::DFG::SpeculativeJIT::cachedPutById):
3821         (JSC::DFG::SpeculativeJIT::compile):
3822         * dfg/DFGSpeculativeJIT64.cpp:
3823         (JSC::DFG::SpeculativeJIT::cachedGetById):
3824         (JSC::DFG::SpeculativeJIT::cachedPutById):
3825         (JSC::DFG::SpeculativeJIT::compile):
3826         * jit/CCallHelpers.h:
3827         (JSC::CCallHelpers::setupArgumentsWithExecState):
3828         * jit/JITInlineCacheGenerator.cpp:
3829         (JSC::JITByIdGenerator::JITByIdGenerator):
3830         (JSC::JITPutByIdGenerator::JITPutByIdGenerator):
3831         * jit/JITInlineCacheGenerator.h:
3832         (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
3833         * jit/JITOperations.cpp:
3834         * jit/JITOperations.h:
3835         * jit/JITPropertyAccess.cpp:
3836         (JSC::JIT::emit_op_get_by_id):
3837         (JSC::JIT::emit_op_put_by_id):
3838         * jit/JITPropertyAccess32_64.cpp:
3839         (JSC::JIT::emit_op_get_by_id):
3840         (JSC::JIT::emit_op_put_by_id):
3841         * jit/Repatch.cpp:
3842         (JSC::tryCacheGetByID):
3843         (JSC::tryBuildGetByIDList):
3844         (JSC::emitCustomSetterStub):
3845         (JSC::tryCachePutByID):
3846         (JSC::tryBuildPutByIdList):
3847         * jit/SpillRegistersMode.h: Added.
3848         * llint/LLIntSlowPaths.cpp:
3849         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3850         * runtime/Lookup.h:
3851         (JSC::putEntry):
3852         * runtime/PutPropertySlot.h:
3853         (JSC::PutPropertySlot::setCacheableCustomProperty):
3854         (JSC::PutPropertySlot::customSetter):
3855         (JSC::PutPropertySlot::isCacheablePut):
3856         (JSC::PutPropertySlot::isCacheableCustomProperty):
3857         (JSC::PutPropertySlot::cachedOffset):
3858
3859 2014-03-06  Filip Pizlo  <fpizlo@apple.com>
3860
3861         FTL arity fixup should work on ARM64
3862         https://bugs.webkit.org/show_bug.cgi?id=129810
3863
3864         Reviewed by Michael Saboff.
3865
3866         - Using regT5 to pass the thunk return address to arityFixup is shady since that's a
3867           callee-save.
3868
3869         - The FTL path was assuming X86 conventions for where SP points at the top of the prologue.
3870
3871         This makes some more tests pass.
3872
3873         * dfg/DFGJITCompiler.cpp:
3874         (JSC::DFG::JITCompiler::compileFunction):
3875         * ftl/FTLLink.cpp:
3876         (JSC::FTL::link):
3877         * jit/AssemblyHelpers.h:
3878         (JSC::AssemblyHelpers::prologueStackPointerDelta):
3879         * jit/JIT.cpp:
3880         (JSC::JIT::privateCompile):
3881         * jit/ThunkGenerators.cpp:
3882         (JSC::arityFixup):
3883         * llint/LowLevelInterpreter64.asm:
3884         * offlineasm/arm64.rb:
3885         * offlineasm/x86.rb: In addition to the t7 change, make t6 agree with GPRInfo.h.
3886
3887 2014-03-06  Mark Hahnenberg  <mhahnenberg@apple.com>
3888
3889         Fix write barriers in Repatch.cpp for !ENABLE(DFG_JIT) platforms after r165128
3890         https://bugs.webkit.org/show_bug.cgi?id=129760
3891
3892         Reviewed by Geoffrey Garen.
3893
3894         r165128 disabled the write barrier fast path for inline caches on !ENABLE(DFG_JIT) platforms.
3895         The fix is to refactor the write barrier code into AssemblyHelpers and use that everywhere.
3896
3897         * dfg/DFGSpeculativeJIT.cpp:
3898         (JSC::DFG::SpeculativeJIT::writeBarrier):
3899         * dfg/DFGSpeculativeJIT.h:
3900         * dfg/DFGSpeculativeJIT32_64.cpp:
3901         (JSC::DFG::SpeculativeJIT::writeBarrier):
3902         * dfg/DFGSpeculativeJIT64.cpp:
3903         (JSC::DFG::SpeculativeJIT::writeBarrier):
3904         * jit/AssemblyHelpers.h:
3905         (JSC::AssemblyHelpers::checkMarkByte):
3906         * jit/JIT.h:
3907         * jit/JITPropertyAccess.cpp:
3908         * jit/Repatch.cpp:
3909         (JSC::writeBarrier):
3910
3911 2014-03-06  Joseph Pecoraro  <pecoraro@apple.com>
3912
3913         Web Inspector: Expose the console object in JSContexts to interact with Web Inspector
3914         https://bugs.webkit.org/show_bug.cgi?id=127944
3915
3916         Reviewed by Geoffrey Garen.
3917
3918         Always expose the Console object in JSContexts, just like we
3919         do for web pages. The default behavior will route to an
3920         attached JSContext inspector. This can be overriden by
3921         setting the ConsoleClient on the JSGlobalObject, which WebCore
3922         does to get slightly different behavior.
3923
3924         * CMakeLists.txt:
3925         * GNUmakefile.list.am:
3926         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
3927         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
3928         * JavaScriptCore.xcodeproj/project.pbxproj:
3929         Update build systems.
3930
3931         * API/tests/testapi.js:
3932         * API/tests/testapi.mm:
3933         Test that "console" exists in C and ObjC contexts.
3934
3935         * runtime/ConsoleClient.cpp: Added.
3936         (JSC::ConsoleClient::printURLAndPosition):
3937         (JSC::ConsoleClient::printMessagePrefix):
3938         (JSC::ConsoleClient::printConsoleMessage):
3939         (JSC::ConsoleClient::printConsoleMessageWithArguments):
3940         (JSC::ConsoleClient::internalMessageWithTypeAndLevel):
3941         (JSC::ConsoleClient::logWithLevel):
3942         (JSC::ConsoleClient::clear):
3943         (JSC::ConsoleClient::dir):
3944         (JSC::ConsoleClient::dirXML):
3945         (JSC::ConsoleClient::table):
3946         (JSC::ConsoleClient::trace):
3947         (JSC::ConsoleClient::assertCondition):
3948         (JSC::ConsoleClient::group):
3949         (JSC::ConsoleClient::groupCollapsed):
3950         (JSC::ConsoleClient::groupEnd):
3951         * runtime/ConsoleClient.h: Added.
3952         (JSC::ConsoleClient::~ConsoleClient):
3953         New private interface for handling the console object's methods.
3954         A lot of the methods funnel through messageWithTypeAndLevel.
3955
3956         * runtime/ConsoleTypes.h: Renamed from Source/JavaScriptCore/inspector/ConsoleTypes.h.
3957         Moved to JSC namespace.
3958
3959         * runtime/JSGlobalObject.cpp:
3960         (JSC::JSGlobalObject::JSGlobalObject):
3961         (JSC::JSGlobalObject::init):
3962         (JSC::JSGlobalObject::reset):
3963         (JSC::JSGlobalObject::visitChildren):
3964         Create the "console" object when initializing the environment.
3965         Also set the default console client to be the JS context inspector.
3966
3967         * runtime/JSGlobalObject.h:
3968         (JSC::JSGlobalObject::setConsoleClient):
3969         (JSC::JSGlobalObject::consoleClient):
3970         Ability to change the console client, so WebCore can set a custom client.
3971
3972         * runtime/ConsolePrototype.cpp: Added.
3973         (JSC::ConsolePrototype::finishCreation):
3974         (JSC::valueToStringWithUndefinedOrNullCheck):
3975         (JSC::consoleLogWithLevel):
3976         (JSC::consoleProtoFuncDebug):
3977         (JSC::consoleProtoFuncError):
3978         (JSC::consoleProtoFuncLog):
3979         (JSC::consoleProtoFuncWarn):
3980         (JSC::consoleProtoFuncClear):
3981         (JSC::consoleProtoFuncDir):
3982         (JSC::consoleProtoFuncDirXML):
3983         (JSC::consoleProtoFuncTable):
3984         (JSC::consoleProtoFuncTrace):
3985         (JSC::consoleProtoFuncAssert):
3986         (JSC::consoleProtoFuncCount):
3987         (JSC::consoleProtoFuncProfile):
3988         (JSC::consoleProtoFuncProfileEnd):
3989         (JSC::consoleProtoFuncTime):
3990         (JSC::consoleProtoFuncTimeEnd):
3991         (JSC::consoleProtoFuncTimeStamp):
3992         (JSC::consoleProtoFuncGroup):
3993         (JSC::consoleProtoFuncGroupCollapsed):
3994         (JSC::consoleProtoFuncGroupEnd):
3995         * runtime/ConsolePrototype.h: Added.
3996         (JSC::ConsolePrototype::create):
3997         (JSC::ConsolePrototype::createStructure):
3998         (JSC::ConsolePrototype::ConsolePrototype):
3999         Define the console object interface. Parse out required / expected
4000         arguments and throw expcetions when methods are misused.
4001
4002         * runtime/JSConsole.cpp: Added.
4003         * runtime/JSConsole.h: Added.
4004         (JSC::JSConsole::createStructure):
4005         (JSC::JSConsole::create):
4006         (JSC::JSConsole::JSConsole):
4007         Empty "console" object. Everything is in the prototype.
4008
4009         * inspector/JSConsoleClient.cpp: Added.
4010         (Inspector::JSConsoleClient::JSGlobalObjectConsole):
4011         (Inspector::JSConsoleClient::count):
4012         (Inspector::JSConsoleClient::profile):
4013         (Inspector::JSConsoleClient::profileEnd):
4014         (Inspector::JSConsoleClient::time):
4015         (Inspector::JSConsoleClient::timeEnd):
4016         (Inspector::JSConsoleClient::timeStamp):
4017