Source/JavaScriptCore/ChangeLog

   1 2011-09-14  Alexis Menard  <alexis.menard@openbossa.org>
   2
   3         [Qt] Replace QT_GCC_X as they don't exist in Qt5 anymore.
   4         https://bugs.webkit.org/show_bug.cgi?id=68114
   5
   6         Reviewed by Kenneth Rohde Christiansen.
   7
   8         Use the new GCC_X variables defined in WebKit.pri to replace
   9         the usage of QT_GCC_X.
  10
  11         * JavaScriptCore.pro:
  12
  13 2011-09-14  Sheriff Bot  <webkit.review.bot@gmail.com>
  14
  15         Unreviewed, rolling out r95145.
  16         http://trac.webkit.org/changeset/95145
  17         https://bugs.webkit.org/show_bug.cgi?id=68139
  18
  19         The GTK+ build is working now, so revert this trial build fix.
  20         (Requested by mrobinson on #webkit).
  21
  22         * GNUmakefile.list.am:
  23
  24 2011-09-14  Patrick Gansterer  <paroga@webkit.org>
  25
  26         Port MachineStackMarker to Windows ARM and MIPS
  27         https://bugs.webkit.org/show_bug.cgi?id=68068
  28
  29         Reviewed by Geoffrey Garen.
  30
  31         Use the correct memeber of the CONTEXT struct for the stackpointer for CPU(ARM) and CPU(MIPS).
  32         Only query CONTEXT_INTEGER and CONTEXT_CONTROL, since CONTEXT_SEGMENTS isn't defined for
  33         CPU(ARM) and CPU(MIPS) and the stackpointer is defined in the CONTEXT_CONTROL section for
  34         CPU(ARM), CPU(X86) and CPU(X86_64) and in the CONTEXT_INTEGER section for CPU(MIPS).
  35
  36         * heap/MachineStackMarker.cpp:
  37         (JSC::getPlatformThreadRegisters):
  38         (JSC::otherThreadStackPointer):
  39
  40 2011-09-12  Filip Pizlo  <fpizlo@apple.com>
  41
  42         DFG JIT always speculates that ValueAdd is a numeric addition
  43         https://bugs.webkit.org/show_bug.cgi?id=67956
  44
  45         Reviewed by Geoffrey Garen.
  46
  47         * dfg/DFGJITCodeGenerator.cpp:
  48         (JSC::DFG::JITCodeGenerator::isKnownNotNumber):
  49         * dfg/DFGJITCodeGenerator.h:
  50         * dfg/DFGNonSpeculativeJIT.cpp:
  51         (JSC::DFG::NonSpeculativeJIT::knownConstantArithOp):
  52         (JSC::DFG::NonSpeculativeJIT::basicArithOp):
  53         * dfg/DFGOperations.cpp:
  54         * dfg/DFGOperations.h:
  55         * dfg/DFGSpeculativeJIT.cpp:
  56         (JSC::DFG::SpeculativeJIT::compile):
  57         * dfg/DFGSpeculativeJIT.h:
  58         (JSC::DFG::SpeculativeJIT::shouldSpeculateNumber):
  59
  60 2011-09-14  Anders Carlsson  <andersca@apple.com>
  61
  62         Stop building BinarySemaphore to see if that's what's breaking the GTK+ build.
  63
  64         * GNUmakefile.list.am:
  65
  66 2011-09-14  Anders Carlsson  <andersca@apple.com>
  67
  68         This is getting old. Yet another build fix attempt.
  69
  70         * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
  71
  72 2011-09-14  Anders Carlsson  <andersca@apple.com>
  73
  74         Yet another build fix attempt.
  75
  76         * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
  77
  78 2011-09-14  Anders Carlsson  <andersca@apple.com>
  79
  80         How I &quot;love&quot; Visual Studio...
  81
  82         Try to fix build again.
  83
  84         * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
  85
  86 2011-09-14  Anders Carlsson  <andersca@apple.com>
  87
  88         Try to fix Windows build.
  89
  90         * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops:
  91
  92 2011-09-14  Anders Carlsson  <andersca@apple.com>
  93
  94         Add BinarySemaphore class from WebKit2 to WTF
  95         https://bugs.webkit.org/show_bug.cgi?id=68132
  96
  97         Reviewed by Sam Weinig.
  98
  99         * GNUmakefile.list.am:
 100         * JavaScriptCore.gypi:
 101         * JavaScriptCore.vcproj/WTF/WTF.vcproj:
 102         * JavaScriptCore.xcodeproj/project.pbxproj:
 103         * wtf/CMakeLists.txt:
 104         Update build systems.
 105
 106         * wtf/threads: Added.
 107         * wtf/threads/BinarySemaphore.cpp: Copied from Source/WebKit2/Platform/CoreIPC/BinarySemaphore.cpp.
 108         * wtf/threads/BinarySemaphore.h: Copied from Source/WebKit2/Platform/CoreIPC/BinarySemaphore.h.
 109         * wtf/threads/win: Added.
 110         * wtf/threads/win/BinarySemaphoreWin.cpp: Copied from Source/WebKit2/Platform/CoreIPC/win/BinarySemaphoreWin.cpp.
 111
 112 2011-09-14  Filip Pizlo  <fpizlo@apple.com>
 113
 114         Unreviewed build fix for Interpreter.
 115
 116         * interpreter/Interpreter.cpp:
 117         (JSC::Interpreter::privateExecute):
 118
 119 2011-09-14  Anders Carlsson  <andersca@apple.com>
 120
 121         Add wtf/threads and wtf/threads/win, so we can be sure that the EWS
 122         bots can correctly build the patch in https://bugs.webkit.org/show_bug.cgi?id=68132
 123
 124         Rubber-stamped by Sam Weinig.
 125
 126         * wtf/threads: Added.
 127         * wtf/threads/win: Added.
 128
 129 2011-09-14  Filip Pizlo  <fpizlo@apple.com>
 130
 131         DFG JIT should not speculate integer if the value is always going to be
 132         used as a double anyway
 133         https://bugs.webkit.org/show_bug.cgi?id=68127
 134
 135         Reviewed by Oliver Hunt.
 136
 137         Added a ValueToDouble node, which is a variant of ValueToNumber that
 138         hints that it will only be used as a double and never as an integer.
 139         Thus, it turns off integer speculation even if the value profiler
 140         told us that the value source is an int. The logic for converting a
 141         ValueToNumber into a ValueToDouble is found in Propagator.
 142
 143         This appears to be a 22% speed-up in imaging-darkroom.
 144
 145         * dfg/DFGNode.h:
 146         * dfg/DFGNonSpeculativeJIT.cpp:
 147         (JSC::DFG::NonSpeculativeJIT::compile):
 148         * dfg/DFGPropagator.cpp:
 149         (JSC::DFG::Propagator::fixpoint):
 150         (JSC::DFG::Propagator::toDouble):
 151         (JSC::DFG::Propagator::fixupNode):
 152         (JSC::DFG::Propagator::fixup):
 153         * dfg/DFGSpeculativeJIT.cpp:
 154         (JSC::DFG::SpeculativeJIT::compile):
 155         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
 156
 157 2011-09-14  Filip Pizlo  <fpizlo@apple.com>
 158
 159         Tiered compilation heuristics do not account for value profile fullness
 160         https://bugs.webkit.org/show_bug.cgi?id=68116
 161
 162         Reviewed by Oliver Hunt.
 163
 164         Tiered compilation avoids invoking the DFG JIT if it finds that value
 165         profiles contain insufficient information. Instead, it produces a
 166         prediction from the current value profile, and then clears the value
 167         profile. This allows the value profile to heat up from scratch for
 168         some number of additional executions. The new profiles will then be
 169         merged with the previous prediction. Once the amount of information
 170         in predictions is enough according to heuristics in CodeBlock.cpp,
 171         DFG optimization is allowed to proceed.
 172
 173         * CMakeLists.txt:
 174         * GNUmakefile.list.am:
 175         * JavaScriptCore.pro:
 176         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
 177         * JavaScriptCore.xcodeproj/project.pbxproj:
 178         * bytecode/CodeBlock.cpp:
 179         (JSC::CodeBlock::CodeBlock):
 180         (JSC::CodeBlock::~CodeBlock):
 181         (JSC::CodeBlock::visitAggregate):
 182         (JSC::CodeBlock::visitWeakReferences):
 183         (JSC::CodeBlock::shouldOptimizeNow):
 184         (JSC::CodeBlock::dumpValueProfiles):
 185         * bytecode/CodeBlock.h:
 186         * bytecode/PredictedType.cpp:
 187         (JSC::predictionToString):
 188         * bytecode/PredictedType.h:
 189         * bytecode/ValueProfile.cpp: Added.
 190         (JSC::ValueProfile::computeStatistics):
 191         (JSC::ValueProfile::computeUpdatedPrediction):
 192         * bytecode/ValueProfile.h:
 193         (JSC::ValueProfile::ValueProfile):
 194         (JSC::ValueProfile::classInfo):
 195         (JSC::ValueProfile::numberOfSamples):
 196         (JSC::ValueProfile::totalNumberOfSamples):
 197         (JSC::ValueProfile::isLive):
 198         (JSC::ValueProfile::numberOfInt32s):
 199         (JSC::ValueProfile::numberOfDoubles):
 200         (JSC::ValueProfile::numberOfBooleans):
 201         (JSC::ValueProfile::dump):
 202         (JSC::getValueProfileBytecodeOffset):
 203         * dfg/DFGByteCodeParser.cpp:
 204         (JSC::DFG::ByteCodeParser::stronglyPredict):
 205         * dfg/DFGGraph.cpp:
 206         (JSC::DFG::Graph::predictArgumentTypes):
 207         * dfg/DFGJITCompiler.cpp:
 208         (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
 209         (JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
 210         * jit/JIT.cpp:
 211         (JSC::JIT::emitOptimizationCheck):
 212         * jit/JITInlineMethods.h:
 213         (JSC::JIT::emitValueProfilingSite):
 214         * jit/JITStubs.cpp:
 215         (JSC::DEFINE_STUB_FUNCTION):
 216
 217 2011-09-14  Filip Pizlo  <fpizlo@apple.com>
 218
 219         DFG should not speculate that the child of LogicalNot is a boolean if
 220         predictions tell us otherwise
 221         https://bugs.webkit.org/show_bug.cgi?id=68118
 222
 223         Reviewed by Geoffrey Garen.
 224
 225         * dfg/DFGJITCodeGenerator.cpp:
 226         (JSC::DFG::JITCodeGenerator::nonSpeculativeLogicalNot):
 227         * dfg/DFGJITCodeGenerator.h:
 228         * dfg/DFGNonSpeculativeJIT.cpp:
 229         (JSC::DFG::NonSpeculativeJIT::compile):
 230         * dfg/DFGSpeculativeJIT.cpp:
 231         (JSC::DFG::SpeculativeJIT::compile):
 232
 233 2011-09-14  Filip Pizlo  <fpizlo@apple.com>
 234
 235         Unreviewed build fix.  Turn off tiered compilation.
 236
 237         * wtf/Platform.h:
 238
 239 2011-09-13  Filip Pizlo  <fpizlo@apple.com>
 240
 241         Prediction tracking is not precise enough
 242         https://bugs.webkit.org/show_bug.cgi?id=67993
 243
 244         Reviewed by Oliver Hunt.
 245
 246         Added a richer set of type predictions, including JSFinalObject, JSString,
 247         object that is not a JSFinalObject or JSArray (ObjectOther), some object
 248         but we don't or care know what kind (SomeObject), definitely an object,
 249         cell that is not an object or JSString, an value that is none of the above
 250         (so either Undefined or Null). Made the propagator and value profiler work
 251         with the new types.
 252
 253         Performance is neutral, because the DFG JIT does not take advantage of this
 254         new knowledge yet.
 255
 256         In the process of writing predictionToString() (which is now considerably
 257         more complex) I decided to finally add a BoundsCheckedPointer, which
 258         should come in handy in other places, like at least the OSR scratch buffer
 259         and the CompactJITCodeMap. It's great for cases where you want to
 260         do pointer arithmetic, you want to have assertions about the
 261         pointer not going out of bounds, but you don't want to write those
 262         assertions yourself.
 263
 264         This also required refactoring inherits(), since the ValueProfiler may
 265         want to do the equivalent of inherits() but given two ClassInfo's.
 266
 267         * GNUmakefile.list.am:
 268         * JavaScriptCore.vcproj/WTF/WTF.vcproj:
 269         * JavaScriptCore.xcodeproj/project.pbxproj:
 270         * bytecode/PredictedType.cpp: Added.
 271         (JSC::predictionToString):
 272         (JSC::makePrediction):
 273         (JSC::predictionFromValue):
 274         * bytecode/PredictedType.h:
 275         (JSC::isCellPrediction):
 276         (JSC::isObjectPrediction):
 277         (JSC::isFinalObjectPrediction):
 278         (JSC::isStringPrediction):
 279         (JSC::mergePredictions):
 280         * bytecode/ValueProfile.h:
 281         (JSC::ValueProfile::numberOfObjects):
 282         (JSC::ValueProfile::numberOfFinalObjects):
 283         (JSC::ValueProfile::numberOfStrings):
 284         (JSC::ValueProfile::probabilityOfObject):
 285         (JSC::ValueProfile::probabilityOfFinalObject):
 286         (JSC::ValueProfile::probabilityOfString):
 287         (JSC::ValueProfile::dump):
 288         (JSC::ValueProfile::Statistics::Statistics):
 289         (JSC::ValueProfile::computeStatistics):
 290         * dfg/DFGByteCodeParser.cpp:
 291         (JSC::DFG::ByteCodeParser::stronglyPredict):
 292         * dfg/DFGGraph.cpp:
 293         (JSC::DFG::Graph::dump):
 294         (JSC::DFG::Graph::predictArgumentTypes):
 295         * dfg/DFGNode.h:
 296         (JSC::DFG::Node::predict):
 297         * dfg/DFGPropagator.cpp:
 298         (JSC::DFG::Propagator::propagateNode):
 299         * runtime/ClassInfo.h:
 300         (JSC::ClassInfo::isSubClassOf):
 301         * runtime/JSObject.h:
 302         (JSC::JSCell::inherits):
 303         * wtf/BoundsCheckedPointer.h: Added.
 304         (WTF::BoundsCheckedPointer::BoundsCheckedPointer):
 305         (WTF::BoundsCheckedPointer::operator=):
 306         (WTF::BoundsCheckedPointer::operator+=):
 307         (WTF::BoundsCheckedPointer::operator-=):
 308         (WTF::BoundsCheckedPointer::operator+):
 309         (WTF::BoundsCheckedPointer::operator-):
 310         (WTF::BoundsCheckedPointer::operator++):
 311         (WTF::BoundsCheckedPointer::operator--):
 312         (WTF::BoundsCheckedPointer::operator<):
 313         (WTF::BoundsCheckedPointer::operator<=):
 314         (WTF::BoundsCheckedPointer::operator>):
 315         (WTF::BoundsCheckedPointer::operator>=):
 316         (WTF::BoundsCheckedPointer::operator==):
 317         (WTF::BoundsCheckedPointer::operator!=):
 318         (WTF::BoundsCheckedPointer::operator!):
 319         (WTF::BoundsCheckedPointer::get):
 320         (WTF::BoundsCheckedPointer::operator*):
 321         (WTF::BoundsCheckedPointer::operator[]):
 322         (WTF::BoundsCheckedPointer::strcat):
 323         (WTF::BoundsCheckedPointer::validate):
 324         * wtf/CMakeLists.txt:
 325
 326 2011-09-14  Csaba Osztrogonác  <ossy@webkit.org>
 327
 328         [Qt] Win32 builds with threads turned off
 329         https://bugs.webkit.org/show_bug.cgi?id=67864
 330
 331         Reviewed by Geoffrey Garen.
 332
 333         * JavaScriptCore.pri: Link pthread library on Windows platform.
 334         * wtf/Platform.h: Enable multiple threads.
 335
 336 2011-09-14  Mark Hahnenberg  <mhahnenberg@apple.com>
 337
 338         Unzip initialization lists and constructors in JSCell hierarchy (6/7)
 339         https://bugs.webkit.org/show_bug.cgi?id=67692
 340
 341         Reviewed by Geoffrey Garen.
 342
 343         Completed the sixth level of the refactoring to add finishCreation()
 344         methods to all classes within the JSCell hierarchy with non-trivial
 345         constructor bodies.
 346
 347         This primarily consists of pushing the calls to finishCreation() down
 348         into the constructors of the subclasses of the fifth level of the hierarchy
 349         as well as pulling the finishCreation() calls out into the class's corresponding
 350         create() method if it has one.  Doing both simultaneously allows us to
 351         maintain the invariant that the finishCreation() method chain is called exactly
 352         once during the creation of an object, since calling it any other number of
 353         times (0, 2, or more) will cause an assertion failure.
 354
 355         * API/JSCallbackFunction.cpp:
 356         (JSC::JSCallbackFunction::JSCallbackFunction):
 357         * API/JSCallbackFunction.h:
 358         (JSC::JSCallbackFunction::create):
 359         * jsc.cpp:
 360         (GlobalObject::create):
 361         (GlobalObject::GlobalObject):
 362         * runtime/ArrayConstructor.cpp:
 363         (JSC::ArrayConstructor::ArrayConstructor):
 364         * runtime/ArrayConstructor.h:
 365         (JSC::ArrayConstructor::create):
 366         * runtime/BooleanConstructor.cpp:
 367         (JSC::BooleanConstructor::BooleanConstructor):
 368         * runtime/BooleanConstructor.h:
 369         (JSC::BooleanConstructor::create):
 370         * runtime/BooleanPrototype.cpp:
 371         (JSC::BooleanPrototype::BooleanPrototype):
 372         * runtime/BooleanPrototype.h:
 373         (JSC::BooleanPrototype::create):
 374         * runtime/DateConstructor.cpp:
 375         (JSC::DateConstructor::DateConstructor):
 376         * runtime/DateConstructor.h:
 377         (JSC::DateConstructor::create):
 378         * runtime/DatePrototype.cpp:
 379         (JSC::DatePrototype::DatePrototype):
 380         * runtime/DatePrototype.h:
 381         (JSC::DatePrototype::create):
 382         * runtime/Error.cpp:
 383         (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
 384         (JSC::StrictModeTypeErrorFunction::create):
 385         * runtime/ErrorConstructor.cpp:
 386         (JSC::ErrorConstructor::ErrorConstructor):
 387         * runtime/ErrorConstructor.h:
 388         (JSC::ErrorConstructor::create):
 389         * runtime/FunctionConstructor.cpp:
 390         (JSC::FunctionConstructor::FunctionConstructor):
 391         * runtime/FunctionConstructor.h:
 392         (JSC::FunctionConstructor::create):
 393         * runtime/FunctionPrototype.cpp:
 394         (JSC::FunctionPrototype::FunctionPrototype):
 395         * runtime/FunctionPrototype.h:
 396         (JSC::FunctionPrototype::create):
 397         * runtime/NativeErrorConstructor.cpp:
 398         (JSC::NativeErrorConstructor::NativeErrorConstructor):
 399         * runtime/NativeErrorConstructor.h:
 400         (JSC::NativeErrorConstructor::create):
 401         * runtime/NativeErrorPrototype.cpp:
 402         (JSC::NativeErrorPrototype::NativeErrorPrototype):
 403         (JSC::NativeErrorPrototype::finishCreation):
 404         * runtime/NativeErrorPrototype.h:
 405         (JSC::NativeErrorPrototype::create):
 406         * runtime/NumberConstructor.cpp:
 407         (JSC::NumberConstructor::NumberConstructor):
 408         * runtime/NumberConstructor.h:
 409         (JSC::NumberConstructor::create):
 410         * runtime/NumberPrototype.cpp:
 411         (JSC::NumberPrototype::NumberPrototype):
 412         * runtime/NumberPrototype.h:
 413         (JSC::NumberPrototype::create):
 414         * runtime/ObjectConstructor.cpp:
 415         (JSC::ObjectConstructor::ObjectConstructor):
 416         * runtime/ObjectConstructor.h:
 417         (JSC::ObjectConstructor::create):
 418         * runtime/RegExpConstructor.cpp:
 419         (JSC::RegExpConstructor::RegExpConstructor):
 420         * runtime/RegExpConstructor.h:
 421         (JSC::RegExpConstructor::create):
 422         * runtime/RegExpPrototype.cpp:
 423         (JSC::RegExpPrototype::RegExpPrototype):
 424         * runtime/RegExpPrototype.h:
 425         (JSC::RegExpPrototype::create):
 426         * runtime/StringConstructor.cpp:
 427         (JSC::StringConstructor::StringConstructor):
 428         * runtime/StringConstructor.h:
 429         (JSC::StringConstructor::create):
 430         * runtime/StringObjectThatMasqueradesAsUndefined.h:
 431         (JSC::StringObjectThatMasqueradesAsUndefined::create):
 432         (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
 433         * runtime/StringPrototype.cpp:
 434         (JSC::StringPrototype::StringPrototype):
 435         * runtime/StringPrototype.h:
 436         (JSC::StringPrototype::create):
 437
 438 2011-09-13  Eric Seidel  <eric@webkit.org>
 439
 440         Remove ENABLE_SVG_USE as <use> is required by HTML5
 441         https://bugs.webkit.org/show_bug.cgi?id=68019
 442
 443         Reviewed by Ryosuke Niwa.
 444
 445         * Configurations/FeatureDefines.xcconfig:
 446
 447 2011-09-14  Iain Merrick  <husky@google.com>
 448
 449         HashTraits.h should include template specialization for WTF::String
 450         https://bugs.webkit.org/show_bug.cgi?id=67851
 451
 452         Ensure that the template specialization for HashTraits<String> is always
 453         picked up. (Previously it was possible to include HashSet and String but
 454         not the correct HashTraits, so you would get an inefficient template
 455         instantiation.)
 456
 457         Reviewed by Darin Adler.
 458
 459         * wtf/HashTraits.h:
 460         * wtf/text/StringHash.h:
 461
 462 2011-09-13  Filip Pizlo  <fpizlo@apple.com>
 463
 464         SpeculativeJIT::shouldSpeculateInteger(NodeIndex, NodeIndex) should
 465         return false if either node can be double
 466         https://bugs.webkit.org/show_bug.cgi?id=67985
 467
 468         Reviewed by Geoffrey Garen.
 469
 470         This is a 17% speed-up on 3d-cube.
 471
 472         This required allowing us to check if a constant is double but not
 473         integer, and making the shouldSpeculateInteger() check test for
 474         any hints of doubly-ness in its operands. This also required
 475         changing some terminology: previously "isDouble" often meant
 476         "isDouble or isInt32".  Now "isDouble" means exactly what the name
 477         suggests, and "isNumber" means "isDouble or isInt32".
 478
 479         * dfg/DFGByteCodeParser.cpp:
 480         (JSC::DFG::ByteCodeParser::toNumber):
 481         (JSC::DFG::ByteCodeParser::parseBlock):
 482         * dfg/DFGGenerationInfo.h:
 483         (JSC::DFG::isJSFormat):
 484         (JSC::DFG::isJSInteger):
 485         (JSC::DFG::isJSDouble):
 486         (JSC::DFG::isJSCell):
 487         (JSC::DFG::isJSBoolean):
 488         (JSC::DFG::GenerationInfo::isJSFormat):
 489         (JSC::DFG::GenerationInfo::isJSInteger):
 490         (JSC::DFG::GenerationInfo::isJSDouble):
 491         (JSC::DFG::GenerationInfo::isJSCell):
 492         (JSC::DFG::GenerationInfo::isJSBoolean):
 493         * dfg/DFGGraph.h:
 494         (JSC::DFG::Graph::isNumberConstant):
 495         (JSC::DFG::Graph::valueOfNumberConstant):
 496         * dfg/DFGJITCodeGenerator.cpp:
 497         (JSC::DFG::JITCodeGenerator::fillInteger):
 498         (JSC::DFG::JITCodeGenerator::fillDouble):
 499         (JSC::DFG::JITCodeGenerator::fillJSValue):
 500         (JSC::DFG::JITCodeGenerator::isKnownInteger):
 501         (JSC::DFG::JITCodeGenerator::isKnownNumeric):
 502         (JSC::DFG::JITCodeGenerator::isKnownCell):
 503         (JSC::DFG::JITCodeGenerator::isKnownNotInteger):
 504         (JSC::DFG::JITCodeGenerator::isKnownBoolean):
 505         * dfg/DFGJITCodeGenerator.h:
 506         (JSC::DFG::JITCodeGenerator::silentFillFPR):
 507         (JSC::DFG::JITCodeGenerator::isNumberConstant):
 508         (JSC::DFG::JITCodeGenerator::valueOfNumberConstant):
 509         (JSC::DFG::JITCodeGenerator::initConstantInfo):
 510         * dfg/DFGJITCompiler.cpp:
 511         (JSC::DFG::JITCompiler::fillNumericToDouble):
 512         (JSC::DFG::JITCompiler::fillToJS):
 513         * dfg/DFGJITCompiler.h:
 514         (JSC::DFG::JITCompiler::isNumberConstant):
 515         (JSC::DFG::JITCompiler::valueOfNumberConstant):
 516         * dfg/DFGNode.h:
 517         (JSC::DFG::Node::isDoubleConstant):
 518         (JSC::DFG::Node::isNumberConstant):
 519         (JSC::DFG::Node::valueOfNumberConstant):
 520         (JSC::DFG::Node::hasNumberResult):
 521         * dfg/DFGNonSpeculativeJIT.cpp:
 522         (JSC::DFG::NonSpeculativeJIT::knownConstantArithOp):
 523         (JSC::DFG::NonSpeculativeJIT::compile):
 524         * dfg/DFGSpeculativeJIT.cpp:
 525         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
 526         * dfg/DFGSpeculativeJIT.h:
 527         (JSC::DFG::SpeculativeJIT::isInteger):
 528         (JSC::DFG::SpeculativeJIT::shouldSpeculateDouble):
 529         (JSC::DFG::SpeculativeJIT::shouldNotSpeculateInteger):
 530         (JSC::DFG::SpeculativeJIT::shouldSpeculateInteger):
 531
 532 2011-09-13  Anders Carlsson  <andersca@apple.com>
 533
 534         Disable C++ exceptions when building with clang
 535         https://bugs.webkit.org/show_bug.cgi?id=68031
 536         <rdar://problem/9556880>
 537
 538         Reviewed by Mark Rowe.
 539
 540         * Configurations/Base.xcconfig:
 541
 542 2011-09-13  Eric Seidel  <eric@webkit.org>
 543
 544         Remove ENABLE_SVG_FOREIGN_OBJECT as it is a required part of HTML5
 545         https://bugs.webkit.org/show_bug.cgi?id=68018
 546
 547         Reviewed by Ryosuke Niwa.
 548
 549         * Configurations/FeatureDefines.xcconfig:
 550
 551 2011-09-13  Sam Weinig  <sam@webkit.org>
 552
 553         Object.getPrototypeOf should use JSValue::get()
 554         https://bugs.webkit.org/show_bug.cgi?id=67973
 555
 556         Reviewed by Darin Adler.
 557
 558         * runtime/ObjectConstructor.cpp:
 559         (JSC::objectConstructorGetPrototypeOf):
 560         Pipe through JSValue::get() to allow overrides.
 561
 562 2011-09-12  Filip Pizlo  <fpizlo@apple.com>
 563
 564         JavaScriptCore does not have baseline->speculative OSR
 565         https://bugs.webkit.org/show_bug.cgi?id=67920
 566
 567         Reviewed by Oliver Hunt.
 568
 569         This adds the ability to on-stack-replace (OSR) from code that is
 570         running hot in the old JIT to code compiled by the new JIT.  This
 571         ensures that long-running loops benefit from DFG optimization.
 572         It also ensures that if code experiences a speculation failure
 573         in DFG code, it has an opportunity to reenter the DFG once every
 574         1,000 loop iterations or so.
 575
 576         This results in a 2.88x speed-up on Kraken/imaging-desaturate,
 577         and is a pure win on the main three benchmark suites (SunSpider,
 578         V8, Kraken), when tiered compilation is enabled.
 579
 580         * JavaScriptCore.xcodeproj/project.pbxproj:
 581         * bytecode/CodeBlock.cpp:
 582         (JSC::CodeBlock::dump):
 583         (JSC::CodeBlock::CodeBlock):
 584         (JSC::ProgramCodeBlock::compileOptimized):
 585         (JSC::EvalCodeBlock::compileOptimized):
 586         (JSC::FunctionCodeBlock::compileOptimized):
 587         * bytecode/CodeBlock.h:
 588         * bytecode/Opcode.h:
 589         * bytecode/PredictedType.h: Added.
 590         (JSC::isCellPrediction):
 591         (JSC::isArrayPrediction):
 592         (JSC::isInt32Prediction):
 593         (JSC::isDoublePrediction):
 594         (JSC::isNumberPrediction):
 595         (JSC::isBooleanPrediction):
 596         (JSC::isStrongPrediction):
 597         (JSC::predictionToString):
 598         (JSC::mergePredictions):
 599         (JSC::mergePrediction):
 600         (JSC::makePrediction):
 601         * bytecode/PredictionTracker.h: Added.
 602         (JSC::operandIsArgument):
 603         (JSC::PredictionSlot::PredictionSlot):
 604         (JSC::PredictionTracker::PredictionTracker):
 605         (JSC::PredictionTracker::initializeSimilarTo):
 606         (JSC::PredictionTracker::copyLocalsFrom):
 607         (JSC::PredictionTracker::numberOfArguments):
 608         (JSC::PredictionTracker::numberOfVariables):
 609         (JSC::PredictionTracker::argumentIndexForOperand):
 610         (JSC::PredictionTracker::predictArgument):
 611         (JSC::PredictionTracker::predict):
 612         (JSC::PredictionTracker::predictGlobalVar):
 613         (JSC::PredictionTracker::getArgumentPrediction):
 614         (JSC::PredictionTracker::getPrediction):
 615         (JSC::PredictionTracker::getGlobalVarPrediction):
 616         * bytecompiler/BytecodeGenerator.cpp:
 617         (JSC::BytecodeGenerator::emitLoopHint):
 618         * bytecompiler/BytecodeGenerator.h:
 619         * bytecompiler/NodesCodegen.cpp:
 620         (JSC::DoWhileNode::emitBytecode):
 621         (JSC::WhileNode::emitBytecode):
 622         (JSC::ForNode::emitBytecode):
 623         (JSC::ForInNode::emitBytecode):
 624         * dfg/DFGByteCodeParser.cpp:
 625         (JSC::DFG::ByteCodeParser::parseBlock):
 626         * dfg/DFGCapabilities.h:
 627         (JSC::DFG::canCompileOpcode):
 628         * dfg/DFGDriver.cpp:
 629         (JSC::DFG::compile):
 630         * dfg/DFGGraph.cpp:
 631         (JSC::DFG::Graph::dump):
 632         * dfg/DFGGraph.h:
 633         (JSC::DFG::BasicBlock::BasicBlock):
 634         (JSC::DFG::Graph::predict):
 635         (JSC::DFG::Graph::getPrediction):
 636         * dfg/DFGJITCompiler.cpp:
 637         (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
 638         (JSC::DFG::JITCompiler::compileEntry):
 639         (JSC::DFG::JITCompiler::compileBody):
 640         * dfg/DFGJITCompiler.h:
 641         (JSC::DFG::JITCompiler::noticeOSREntry):
 642         * dfg/DFGNode.h:
 643         * dfg/DFGOSREntry.cpp: Added.
 644         (JSC::DFG::predictionIsValid):
 645         (JSC::DFG::prepareOSREntry):
 646         * dfg/DFGOSREntry.h: Added.
 647         (JSC::DFG::prepareOSREntry):
 648         * dfg/DFGPredictionTracker.h: Removed.
 649         * dfg/DFGPropagator.cpp:
 650         (JSC::DFG::Propagator::mergeUse):
 651         (JSC::DFG::Propagator::mergePrediction):
 652         * dfg/DFGSpeculativeJIT.cpp:
 653         (JSC::DFG::SpeculativeJIT::compile):
 654         * jit/CompactJITCodeMap.h:
 655         (JSC::CompactJITCodeMap::numberOfEntries):
 656         (JSC::CompactJITCodeMap::decode):
 657         (JSC::CompactJITCodeMap::Decoder::Decoder):
 658         (JSC::CompactJITCodeMap::Decoder::numberOfEntriesRemaining):
 659         (JSC::CompactJITCodeMap::Decoder::read):
 660         * jit/JIT.cpp:
 661         (JSC::JIT::emitOptimizationCheck):
 662         (JSC::JIT::emitTimeoutCheck):
 663         (JSC::JIT::privateCompileMainPass):
 664         * jit/JIT.h:
 665         (JSC::JIT::emit_op_loop_hint):
 666         * jit/JITStubs.cpp:
 667         (JSC::DEFINE_STUB_FUNCTION):
 668         * runtime/Executable.cpp:
 669         (JSC::EvalExecutable::compileInternal):
 670         (JSC::ProgramExecutable::compileInternal):
 671         (JSC::FunctionExecutable::compileForCallInternal):
 672         (JSC::FunctionExecutable::compileForConstructInternal):
 673
 674 2011-09-12  Sam Weinig  <sam@webkit.org>
 675
 676         Don't allow setting __proto__ to be a getter or setter
 677         https://bugs.webkit.org/show_bug.cgi?id=67982
 678
 679         Reviewed by Gavin Barraclough.
 680
 681         * runtime/JSObject.cpp:
 682         (JSC::JSObject::defineGetter):
 683         (JSC::JSObject::defineSetter):
 684         Disallow setting a getter or setter on __proto__.
 685
 686 2011-09-12  James Robinson  <jamesr@chromium.org>
 687
 688         Unreviewed build fix for chromium.
 689
 690         Guard access to UString::latin1() with USE(JSC) since it is defined in JavaScriptCore/runtime/UString.cpp, which
 691         is currently only compiled in by ports that use JavaScriptCore.  This code is currently unreachable in builds so
 692         no change in functionality.
 693
 694         * yarr/YarrInterpreter.cpp:
 695         (JSC::Yarr::Interpreter::CharAccess::CharAccess):
 696
 697 2011-09-09  Filip Pizlo  <fpizlo@apple.com>
 698
 699         JavaScriptCore does not have speculative->baseline OSR
 700         https://bugs.webkit.org/show_bug.cgi?id=67826
 701
 702         Reviewed by Oliver Hunt.
 703
 704         This adds the ability to bail out of DFG speculative JIT execution by
 705         performing an on-stack replacement (OSR) that results in the control
 706         flow going to the equivalent code generated by the old JIT.
 707
 708         This required a number of new features, as well as taking advantage of
 709         some features that happened to already be present:
 710
 711         We already had a policy of storing the bytecode index for which a DFG
 712         node was generated inside the DFG::Node class. This was previously
 713         called exceptionInfo. It's now renamed to codeOrigin to reflect that
 714         it's used for more than just excpetions. OSR uses this to figure out
 715         which bytecode index to use to look up the machine code location in
 716         the code generated by the old JIT that we should be jumping to.
 717
 718         CodeBlock now stores a mapping between bytecode indices and machine
 719         code offsets for code generated by the old JIT. This is implemented
 720         by CompactJITCodeMap, which tries to compress this data a bit.  The
 721         OSR compiler decodes this and uses it to find the machine code
 722         locations it should be jumping to.
 723
 724         We already had a mechanism that emitted SetLocal nodes in the DFG graph
 725         that told us the time at which the old JIT would have stored something
 726         into its register file, and the DFG::Node that corresponds to the value
 727         that it would have stored. These SetLocal's were mostly dead-code-
 728         eliminated, but our DCE leaves the nodes intact except for making them
 729         have 0 as the ref count. This allows the OSR compiler to construct a
 730         mapping between the state as it would have been seen by the old JIT
 731         and the state as the DFG JIT sees it. The OSR compiler uses this to
 732         generate code that reshapes the call frame so that it is like what the
 733         old JIT would expect.
 734
 735         Finally, when DFG_OSR is enabled (the default for TIERED_COMPILATION)
 736         we no longer emit the non-speculative path.
 737
 738         * JavaScriptCore.xcodeproj/project.pbxproj:
 739         * bytecode/CodeBlock.h:
 740         * dfg/DFGByteCodeParser.cpp:
 741         (JSC::DFG::ByteCodeParser::currentCodeOrigin):
 742         (JSC::DFG::ByteCodeParser::addToGraph):
 743         * dfg/DFGGPRInfo.h:
 744         * dfg/DFGGenerationInfo.h:
 745         (JSC::DFG::GenerationInfo::alive):
 746         * dfg/DFGGraph.cpp:
 747         (JSC::DFG::Graph::dump):
 748         * dfg/DFGJITCodeGenerator.cpp:
 749         (JSC::DFG::JITCodeGenerator::emitCall):
 750         * dfg/DFGJITCodeGenerator.h:
 751         (JSC::DFG::JITCodeGenerator::appendCallWithExceptionCheck):
 752         * dfg/DFGJITCompiler.cpp:
 753         (JSC::DFG::JITCompiler::exitSpeculativeWithOSR):
 754         (JSC::DFG::JITCompiler::linkOSRExits):
 755         (JSC::DFG::JITCompiler::compileBody):
 756         (JSC::DFG::JITCompiler::link):
 757         * dfg/DFGJITCompiler.h:
 758         (JSC::DFG::CallRecord::CallRecord):
 759         (JSC::DFG::JITCompiler::notifyCall):
 760         (JSC::DFG::JITCompiler::appendCallWithExceptionCheck):
 761         (JSC::DFG::JITCompiler::appendCallWithFastExceptionCheck):
 762         (JSC::DFG::JITCompiler::addJSCall):
 763         (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
 764         * dfg/DFGNode.h:
 765         (JSC::DFG::CodeOrigin::CodeOrigin):
 766         (JSC::DFG::CodeOrigin::isSet):
 767         (JSC::DFG::CodeOrigin::bytecodeIndex):
 768         (JSC::DFG::Node::Node):
 769         (JSC::DFG::Node::child1Unchecked):
 770         * dfg/DFGNonSpeculativeJIT.cpp:
 771         (JSC::DFG::NonSpeculativeJIT::compile):
 772         * dfg/DFGSpeculativeJIT.cpp:
 773         (JSC::DFG::ValueSource::dump):
 774         (JSC::DFG::ValueRecovery::dump):
 775         (JSC::DFG::OSRExit::OSRExit):
 776         (JSC::DFG::SpeculativeJIT::compile):
 777         (JSC::DFG::SpeculativeJIT::compileMovHint):
 778         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
 779         * dfg/DFGSpeculativeJIT.h:
 780         (JSC::DFG::ValueSource::ValueSource):
 781         (JSC::DFG::ValueSource::isSet):
 782         (JSC::DFG::ValueSource::nodeIndex):
 783         (JSC::DFG::ValueRecovery::ValueRecovery):
 784         (JSC::DFG::ValueRecovery::alreadyInRegisterFile):
 785         (JSC::DFG::ValueRecovery::inGPR):
 786         (JSC::DFG::ValueRecovery::inFPR):
 787         (JSC::DFG::ValueRecovery::displacedInRegisterFile):
 788         (JSC::DFG::ValueRecovery::constant):
 789         (JSC::DFG::ValueRecovery::technique):
 790         (JSC::DFG::ValueRecovery::gpr):
 791         (JSC::DFG::ValueRecovery::fpr):
 792         (JSC::DFG::ValueRecovery::virtualRegister):
 793         (JSC::DFG::OSRExit::numberOfRecoveries):
 794         (JSC::DFG::OSRExit::valueRecovery):
 795         (JSC::DFG::OSRExit::isArgument):
 796         (JSC::DFG::OSRExit::argumentForIndex):
 797         (JSC::DFG::OSRExit::variableForIndex):
 798         (JSC::DFG::OSRExit::operandForIndex):
 799         (JSC::DFG::SpeculativeJIT::osrExits):
 800         (JSC::DFG::SpeculativeJIT::speculationCheck):
 801         (JSC::DFG::SpeculativeJIT::valueSourceForOperand):
 802         (JSC::DFG::SpeculativeJIT::setNodeIndexForOperand):
 803         (JSC::DFG::SpeculativeJIT::valueSourceReferenceForOperand):
 804         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
 805         (JSC::DFG::SpeculationCheckIndexIterator::SpeculationCheckIndexIterator):
 806         (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
 807         * jit/CompactJITCodeMap.h: Added.
 808         (JSC::BytecodeAndMachineOffset::BytecodeAndMachineOffset):
 809         (JSC::BytecodeAndMachineOffset::getBytecodeIndex):
 810         (JSC::BytecodeAndMachineOffset::getMachineCodeOffset):
 811         (JSC::CompactJITCodeMap::~CompactJITCodeMap):
 812         (JSC::CompactJITCodeMap::decode):
 813         (JSC::CompactJITCodeMap::CompactJITCodeMap):
 814         (JSC::CompactJITCodeMap::at):
 815         (JSC::CompactJITCodeMap::decodeNumber):
 816         (JSC::CompactJITCodeMap::Encoder::Encoder):
 817         (JSC::CompactJITCodeMap::Encoder::~Encoder):
 818         (JSC::CompactJITCodeMap::Encoder::append):
 819         (JSC::CompactJITCodeMap::Encoder::finish):
 820         (JSC::CompactJITCodeMap::Encoder::appendByte):
 821         (JSC::CompactJITCodeMap::Encoder::encodeNumber):
 822         (JSC::CompactJITCodeMap::Encoder::ensureCapacityFor):
 823         * jit/JIT.cpp:
 824         (JSC::JIT::privateCompileMainPass):
 825         (JSC::JIT::privateCompile):
 826         * jit/JIT.h:
 827         * runtime/JSGlobalData.cpp:
 828         (JSC::JSGlobalData::JSGlobalData):
 829         (JSC::JSGlobalData::~JSGlobalData):
 830         * runtime/JSGlobalData.h:
 831         (JSC::JSGlobalData::osrScratchBufferForSize):
 832         * runtime/JSValue.cpp:
 833         (JSC::JSValue::description):
 834
 835 2011-09-12  Geoffrey Garen  <ggaren@apple.com>
 836
 837         Re-enabled ENABLE(LAZY_BLOCK_FREEING).
 838
 839         Reviewed by Stephanie Lewis.
 840
 841         I accidentally disabled this in r94890, causing a big performance regression.
 842
 843         * wtf/Platform.h:
 844
 845 2011-09-12  Michael Saboff  <msaboff@apple.com>
 846
 847         Broken Build for ARM - lshift32() needs TrustedImm32 arg
 848         https://bugs.webkit.org/show_bug.cgi?id=67965
 849
 850         Change lshift32(16, ARMRegisters::S1); to lshift32(TrustedImm32(16), ARMRegisters::S1);
 851
 852         Reviewed by Anders Carlsson.
 853
 854         * assembler/MacroAssemblerARM.h:
 855         (JSC::MacroAssemblerARM::branch16):
 856
 857 2011-09-12  Michael Saboff  <msaboff@apple.com>
 858
 859         Broken ARM build - missing semicolon in JavaScriptCore/assembler/MacroAssemblerARM.h
 860         https://bugs.webkit.org/show_bug.cgi?id=67961
 861
 862         Added missing semicolon.
 863
 864         Reviewed by Ryosuke Niwa.
 865
 866         * assembler/MacroAssemblerARM.h:
 867         (JSC::MacroAssemblerARM::branch16):
 868
 869 2011-09-12  Michael Saboff  <msaboff@apple.com>
 870
 871         Update RegExp and related classes to use 8 bit strings when available
 872         https://bugs.webkit.org/show_bug.cgi?id=67337
 873
 874         Modified both the Yarr interpreter and JIT to handle 8 bit subject strings.
 875         The code paths are triggered by the UString::is8bit() method which currently
 876         returns false.  Implemented JIT changes for all current architectures.
 877         Tested X86_64 and ARM v7.
 878
 879         This includes some code that will likely change as we complete the
 880         8 bit string changes.  This includes the way the raw buffer pointers
 881         are accessed as well as replacing the CharAccess class with a
 882         string interator returned from UString.
 883
 884         Fixed build breakage in testRegExp.cpp due to globalObject construction
 885         changes.
 886
 887         Reviewed by Gavin Barraclough.
 888
 889         * JavaScriptCore.exp:
 890         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 891         * testRegExp.cpp:
 892         (GlobalObject::finishCreation):
 893         (GlobalObject::GlobalObject):
 894         * assembler/ARMAssembler.cpp:
 895         (JSC::ARMAssembler::baseIndexTransfer32):
 896         * assembler/ARMAssembler.h:
 897         * assembler/ARMv7Assembler.h:
 898         (JSC::ARMv7Assembler::ubfx):
 899         (JSC::ARMv7Assembler::ARMInstructionFormatter::twoWordOp12Reg40Imm3Reg4Imm20Imm5):
 900         * assembler/MacroAssemblerARM.h:
 901         (JSC::MacroAssemblerARM::load8):
 902         (JSC::MacroAssemblerARM::branch8):
 903         (JSC::MacroAssemblerARM::branch16):
 904         * assembler/MacroAssemblerARMv7.h:
 905         (JSC::MacroAssemblerARMv7::load8):
 906         (JSC::MacroAssemblerARMv7::branch16):
 907         (JSC::MacroAssemblerARMv7::branch8):
 908         * assembler/MacroAssemblerMIPS.h:
 909         (JSC::MacroAssemblerMIPS::load8):
 910         (JSC::MacroAssemblerMIPS::branch8):
 911         (JSC::MacroAssemblerMIPS::branch16):
 912         * assembler/MacroAssemblerSH4.h:
 913         (JSC::MacroAssemblerSH4::load8):
 914         (JSC::MacroAssemblerSH4::branch8):
 915         (JSC::MacroAssemblerSH4::branch16):
 916         * assembler/MacroAssemblerX86Common.h:
 917         (JSC::MacroAssemblerX86Common::load8):
 918         (JSC::MacroAssemblerX86Common::branch16):
 919         (JSC::MacroAssemblerX86Common::branch8):
 920         * assembler/SH4Assembler.h:
 921         (JSC::SH4Assembler::extub):
 922         (JSC::SH4Assembler::printInstr):
 923         * assembler/X86Assembler.h:
 924         (JSC::X86Assembler::cmpw_ir):
 925         (JSC::X86Assembler::movzbl_mr):
 926         * runtime/RegExp.cpp:
 927         (JSC::RegExp::compile):
 928         (JSC::RegExp::compileIfNecessary):
 929         (JSC::RegExp::match):
 930         (JSC::RegExp::matchCompareWithInterpreter):
 931         * runtime/RegExp.h:
 932         * runtime/UString.h:
 933         (JSC::UString::is8Bit):
 934         * yarr/Yarr.h:
 935         * yarr/YarrInterpreter.cpp:
 936         (JSC::Yarr::Interpreter::CharAccess::CharAccess):
 937         (JSC::Yarr::Interpreter::CharAccess::~CharAccess):
 938         (JSC::Yarr::Interpreter::CharAccess::operator[]):
 939         (JSC::Yarr::Interpreter::InputStream::InputStream):
 940         (JSC::Yarr::Interpreter::Interpreter):
 941         (JSC::Yarr::interpret):
 942         * yarr/YarrJIT.cpp:
 943         (JSC::Yarr::YarrGenerator::jumpIfCharNotEquals):
 944         (JSC::Yarr::YarrGenerator::readCharacter):
 945         (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
 946         (JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
 947         (JSC::Yarr::YarrGenerator::generatePatternCharacterGreedy):
 948         (JSC::Yarr::YarrGenerator::backtrackPatternCharacterNonGreedy):
 949         (JSC::Yarr::YarrGenerator::generateCharacterClassFixed):
 950         (JSC::Yarr::YarrGenerator::generateDotStarEnclosure):
 951         (JSC::Yarr::YarrGenerator::YarrGenerator):
 952         (JSC::Yarr::YarrGenerator::compile):
 953         (JSC::Yarr::jitCompile):
 954         (JSC::Yarr::execute):
 955         * yarr/YarrJIT.h:
 956         (JSC::Yarr::YarrCodeBlock::has8BitCode):
 957         (JSC::Yarr::YarrCodeBlock::has16BitCode):
 958         (JSC::Yarr::YarrCodeBlock::set8BitCode):
 959         (JSC::Yarr::YarrCodeBlock::set16BitCode):
 960         (JSC::Yarr::YarrCodeBlock::execute):
 961         * yarr/YarrParser.h:
 962         (JSC::Yarr::Parser::Parser):
 963
 964 2011-09-12  Andras Becsi  <andras.becsi@nokia.com>
 965
 966         [Qt] Build fails after r94920 with strict compiler
 967         https://bugs.webkit.org/show_bug.cgi?id=67928
 968
 969         Reviewed by Csaba Osztrogonác.
 970
 971         * wtf/RedBlackTree.h:
 972         (WTF::RedBlackTree::insert): Remove dead variables updateStart and newSubTreeRoot.
 973
 974 2011-09-12  Patrick Gansterer  <paroga@webkit.org>
 975
 976         Unreviewed build fix after r94871.
 977
 978         * runtime/InitializeThreading.cpp:
 979         (JSC::initializeThreadingOnce):
 980         * wtf/FastMalloc.cpp:
 981         * wtf/RefCountedLeakCounter.h:
 982
 983 2011-09-11  Filip Pizlo  <fpizlo@apple.com>
 984
 985         DFGNode.h has macros that indicate the enabling of a feature, but
 986         they do not use the ENABLE() idiom.
 987         https://bugs.webkit.org/show_bug.cgi?id=67907
 988
 989         Reviewed by Oliver Hunt.
 990
 991         * dfg/DFGByteCodeParser.cpp:
 992         (JSC::DFG::ByteCodeParser::stronglyPredict):
 993         (JSC::DFG::ByteCodeParser::parse):
 994         * dfg/DFGGraph.cpp:
 995         (JSC::DFG::Graph::predictArgumentTypes):
 996         * dfg/DFGJITCodeGenerator.cpp:
 997         * dfg/DFGJITCodeGenerator.h:
 998         * dfg/DFGJITCompiler.cpp:
 999         (JSC::DFG::JITCompiler::fillInt32ToInteger):
1000         (JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
1001         (JSC::DFG::JITCompiler::compileBody):
1002         (JSC::DFG::JITCompiler::link):
1003         * dfg/DFGJITCompiler.h:
1004         * dfg/DFGNode.h:
1005         * dfg/DFGNonSpeculativeJIT.cpp:
1006         (JSC::DFG::NonSpeculativeJIT::compile):
1007         * dfg/DFGOperations.cpp:
1008         * dfg/DFGOperations.h:
1009         * dfg/DFGPropagator.cpp:
1010         (JSC::DFG::Propagator::fixpoint):
1011         (JSC::DFG::Propagator::propagateNode):
1012         (JSC::DFG::Propagator::propagateForward):
1013         (JSC::DFG::Propagator::propagateBackward):
1014         (JSC::DFG::propagate):
1015         * dfg/DFGScoreBoard.h:
1016         * dfg/DFGSpeculativeJIT.cpp:
1017         (JSC::DFG::SpeculativeJIT::compile):
1018         * dfg/DFGSpeculativeJIT.h:
1019         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
1020         * jit/JIT.cpp:
1021         (JSC::JIT::privateCompile):
1022
1023 2011-09-11  Fumitoshi Ukai  <ukai@chromium.org>
1024
1025         Unreviewed build fix for chromium/mac & clang.
1026
1027         Fix the macro redefinition error by r94927, because chromium set
1028         ENABLE_JSC_MULTIPLE_THREADS=0 in WebKit/chromium/features.gypi and
1029         it is not PLATFORM(QT).
1030          ../../JavaScriptCore/wtf/Platform.h:512:9: error: 'ENABLE_JSC_MULTIPLE_THREADS' macro redefined [-Werror]
1031          #define ENABLE_JSC_MULTIPLE_THREADS 1
1032          <command line>:43:9: note: previous definition is here
1033          #define ENABLE_JSC_MULTIPLE_THREADS 0
1034          1 error generated.
1035
1036         * wtf/Platform.h:
1037
1038 2011-09-11  Sam Weinig  <sam@webkit.org>
1039
1040         Remove JSCell::isPropertyNameIterator(), it is unused
1041         https://bugs.webkit.org/show_bug.cgi?id=67911
1042
1043         Reviewed by Oliver Hunt.
1044
1045         * runtime/JSCell.h:
1046         * runtime/JSPropertyNameIterator.h:
1047
1048 2011-09-11  Sam Weinig  <sam@webkit.org>
1049
1050         De-virtualize JSCell::isAPIValueWrapper
1051         https://bugs.webkit.org/show_bug.cgi?id=67909
1052
1053         Reviewed by Oliver Hunt.
1054
1055         * runtime/JSAPIValueWrapper.h:
1056         (JSC::JSAPIValueWrapper::createStructure):
1057         Set the correct type on structure creation.
1058
1059         * runtime/JSCell.h:
1060         Remove virtual keyword and default implementation.
1061
1062         * runtime/JSType.h:
1063         Add type for APIValueWrapper. It must come after CompoundType since
1064         the APIValueWrapper has children in need of marking.
1065
1066         * runtime/Structure.h:
1067         (JSC::JSCell::isAPIValueWrapper):
1068         Implement predicate using type info.
1069
1070 2011-09-10  Sam Weinig  <sam@webkit.org>
1071
1072         De-virtualize JSCell::isGetterSetter, type information is available for it
1073         https://bugs.webkit.org/show_bug.cgi?id=67902
1074
1075         Reviewed by Dan Bernstein.
1076
1077         * runtime/GetterSetter.cpp:
1078         * runtime/GetterSetter.h:
1079         Remove override of isGetterSetter.
1080
1081         * runtime/JSCell.cpp:
1082         * runtime/JSCell.h:
1083         De-virtualize and remove silly base implementation.
1084
1085         * runtime/Structure.h:
1086         (JSC::JSCell::isGetterSetter):
1087         Use type info to determine getter-setter-hood.
1088
1089 2011-09-09  Oliver Hunt  <oliver@apple.com>
1090
1091         Remove support for anonymous storage from jsobjects
1092         https://bugs.webkit.org/show_bug.cgi?id=67881
1093
1094         Reviewed by Sam Weinig.
1095
1096         Remove all use of anonymous slots, essentially a mechanical change
1097         in JavaScriptCore
1098
1099         * API/JSCallbackConstructor.h:
1100         (JSC::JSCallbackConstructor::createStructure):
1101         * API/JSCallbackFunction.h:
1102         (JSC::JSCallbackFunction::createStructure):
1103         * API/JSCallbackObject.h:
1104         (JSC::JSCallbackObject::createStructure):
1105         * JavaScriptCore.exp:
1106         * debugger/DebuggerActivation.h:
1107         (JSC::DebuggerActivation::createStructure):
1108         * heap/MarkStack.cpp:
1109         (JSC::MarkStack::validateValue):
1110         * heap/MarkStack.h:
1111         * runtime/Arguments.h:
1112         (JSC::Arguments::createStructure):
1113         * runtime/ArrayConstructor.h:
1114         (JSC::ArrayConstructor::createStructure):
1115         * runtime/ArrayPrototype.cpp:
1116         (JSC::ArrayPrototype::finishCreation):
1117         * runtime/ArrayPrototype.h:
1118         (JSC::ArrayPrototype::createStructure):
1119         * runtime/BooleanObject.h:
1120         (JSC::BooleanObject::createStructure):
1121         * runtime/BooleanPrototype.cpp:
1122         (JSC::BooleanPrototype::BooleanPrototype):
1123         * runtime/BooleanPrototype.h:
1124         (JSC::BooleanPrototype::createStructure):
1125         * runtime/DateConstructor.h:
1126         (JSC::DateConstructor::createStructure):
1127         * runtime/DateInstance.h:
1128         (JSC::DateInstance::createStructure):
1129         * runtime/DatePrototype.cpp:
1130         (JSC::DatePrototype::DatePrototype):
1131         * runtime/DatePrototype.h:
1132         (JSC::DatePrototype::createStructure):
1133         * runtime/ErrorInstance.h:
1134         (JSC::ErrorInstance::createStructure):
1135         * runtime/ErrorPrototype.cpp:
1136         (JSC::ErrorPrototype::finishCreation):
1137         * runtime/ErrorPrototype.h:
1138         (JSC::ErrorPrototype::createStructure):
1139         * runtime/ExceptionHelpers.h:
1140         (JSC::InterruptedExecutionError::createStructure):
1141         (JSC::TerminatedExecutionError::createStructure):
1142         * runtime/Executable.h:
1143         (JSC::ExecutableBase::createStructure):
1144         (JSC::NativeExecutable::createStructure):
1145         (JSC::EvalExecutable::createStructure):
1146         (JSC::ProgramExecutable::createStructure):
1147         (JSC::FunctionExecutable::createStructure):
1148         * runtime/FunctionPrototype.h:
1149         (JSC::FunctionPrototype::createStructure):
1150         * runtime/GetterSetter.h:
1151         (JSC::GetterSetter::createStructure):
1152         * runtime/InternalFunction.h:
1153         (JSC::InternalFunction::createStructure):
1154         * runtime/JSAPIValueWrapper.h:
1155         (JSC::JSAPIValueWrapper::createStructure):
1156         * runtime/JSActivation.h:
1157         (JSC::JSActivation::createStructure):
1158         * runtime/JSArray.h:
1159         (JSC::JSArray::createStructure):
1160         * runtime/JSByteArray.cpp:
1161         (JSC::JSByteArray::createStructure):
1162         * runtime/JSCell.h:
1163         * runtime/JSFunction.h:
1164         (JSC::JSFunction::createStructure):
1165         * runtime/JSGlobalObject.h:
1166         (JSC::JSGlobalObject::finishCreation):
1167         (JSC::JSGlobalObject::createStructure):
1168         * runtime/JSNotAnObject.h:
1169         (JSC::JSNotAnObject::createStructure):
1170         * runtime/JSONObject.h:
1171         (JSC::JSONObject::createStructure):
1172         * runtime/JSObject.h:
1173         (JSC::JSObject::createStructure):
1174         (JSC::JSNonFinalObject::createStructure):
1175         (JSC::JSFinalObject::createStructure):
1176         * runtime/JSPropertyNameIterator.cpp:
1177         (JSC::JSPropertyNameIterator::create):
1178         * runtime/JSPropertyNameIterator.h:
1179         (JSC::JSPropertyNameIterator::createStructure):
1180         * runtime/JSStaticScopeObject.h:
1181         (JSC::JSStaticScopeObject::createStructure):
1182         * runtime/JSString.h:
1183         (JSC::RopeBuilder::createStructure):
1184         * runtime/JSVariableObject.h:
1185         (JSC::JSVariableObject::createStructure):
1186         * runtime/JSWrapperObject.h:
1187         (JSC::JSWrapperObject::createStructure):
1188         * runtime/MathObject.h:
1189         (JSC::MathObject::createStructure):
1190         * runtime/NativeErrorConstructor.h:
1191         (JSC::NativeErrorConstructor::createStructure):
1192         * runtime/NumberConstructor.h:
1193         (JSC::NumberConstructor::createStructure):
1194         * runtime/NumberObject.h:
1195         (JSC::NumberObject::createStructure):
1196         * runtime/NumberPrototype.cpp:
1197         (JSC::NumberPrototype::NumberPrototype):
1198         * runtime/NumberPrototype.h:
1199         (JSC::NumberPrototype::createStructure):
1200         * runtime/ObjectConstructor.h:
1201         (JSC::ObjectConstructor::createStructure):
1202         * runtime/ObjectPrototype.cpp:
1203         (JSC::ObjectPrototype::finishCreation):
1204         * runtime/ObjectPrototype.h:
1205         (JSC::ObjectPrototype::createStructure):
1206         * runtime/RegExp.h:
1207         (JSC::RegExp::createStructure):
1208         * runtime/RegExpConstructor.h:
1209         (JSC::RegExpConstructor::createStructure):
1210         * runtime/RegExpObject.h:
1211         (JSC::RegExpObject::createStructure):
1212         * runtime/RegExpPrototype.h:
1213         (JSC::RegExpPrototype::createStructure):
1214         * runtime/ScopeChain.h:
1215         (JSC::ScopeChainNode::createStructure):
1216         * runtime/StrictEvalActivation.h:
1217         (JSC::StrictEvalActivation::createStructure):
1218         * runtime/StringConstructor.h:
1219         (JSC::StringConstructor::createStructure):
1220         * runtime/StringObject.h:
1221         (JSC::StringObject::createStructure):
1222         * runtime/StringObjectThatMasqueradesAsUndefined.h:
1223         (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
1224         * runtime/StringPrototype.cpp:
1225         (JSC::StringPrototype::StringPrototype):
1226         * runtime/StringPrototype.h:
1227         (JSC::StringPrototype::createStructure):
1228         * runtime/Structure.cpp:
1229         (JSC::Structure::Structure):
1230         (JSC::Structure::materializePropertyMap):
1231         (JSC::Structure::addPropertyTransitionToExistingStructure):
1232         (JSC::Structure::addPropertyTransition):
1233         (JSC::Structure::removePropertyTransition):
1234         (JSC::Structure::changePrototypeTransition):
1235         (JSC::Structure::despecifyFunctionTransition):
1236         (JSC::Structure::getterSetterTransition):
1237         (JSC::Structure::toDictionaryTransition):
1238         (JSC::Structure::preventExtensionsTransition):
1239         (JSC::Structure::flattenDictionaryStructure):
1240         (JSC::Structure::addPropertyWithoutTransition):
1241         (JSC::Structure::removePropertyWithoutTransition):
1242         (JSC::Structure::get):
1243         (JSC::Structure::putSpecificValue):
1244         (JSC::Structure::remove):
1245         (JSC::Structure::checkConsistency):
1246         * runtime/Structure.h:
1247         (JSC::Structure::create):
1248         (JSC::Structure::propertyStorageSize):
1249         (JSC::Structure::get):
1250         * runtime/StructureChain.h:
1251         (JSC::StructureChain::createStructure):
1252
1253 2011-09-11  Jarred Nicholls  <jarred@sencha.com>
1254
1255         [Qt] Win32 build broken due to MachineStackMarker.cpp/.o failing to link against pthreads library
1256         https://bugs.webkit.org/show_bug.cgi?id=67864
1257
1258         Qt Win32 is not pthread compatible and cannot participate in multithreaded JSC or it fails to build.
1259
1260         Reviewed by Csaba Osztrogonác.
1261
1262         * wtf/Platform.h:
1263
1264 2011-09-11  Filip Pizlo  <fpizlo@apple.com>
1265
1266         ARM and MIPS assemblers still refer to executable pools.
1267         https://bugs.webkit.org/show_bug.cgi?id=67903
1268
1269         Reviewed by Csaba Osztrogonác.
1270
1271         * assembler/ARMAssembler.cpp:
1272         (JSC::ARMAssembler::executableCopy):
1273         * assembler/ARMAssembler.h:
1274         * assembler/AssemblerBufferWithConstantPool.h:
1275         * assembler/MIPSAssembler.h:
1276         (JSC::MIPSAssembler::executableCopy):
1277
1278 2011-09-08  Filip Pizlo  <fpizlo@apple.com>
1279
1280         The executable allocator makes it difficult to free individual
1281         chunks of executable memory
1282         https://bugs.webkit.org/show_bug.cgi?id=66363
1283
1284         Reviewed by Oliver Hunt.
1285
1286         Introduced a best-fit, balanced-tree based allocator. The allocator
1287         required a balanced tree that does not allocate memory and that
1288         permits the removal of individual nodes directly (as opposed to by
1289         key); neither AVLTree nor WebCore's PODRedBlackTree supported this.
1290         Changed all references to executable code to use a reference counted
1291         handle.
1292
1293         * GNUmakefile.list.am:
1294         * JavaScriptCore.exp:
1295         * JavaScriptCore.vcproj/WTF/WTF.vcproj:
1296         * JavaScriptCore.xcodeproj/project.pbxproj:
1297         * assembler/AssemblerBuffer.h:
1298         (JSC::AssemblerBuffer::executableCopy):
1299         * assembler/LinkBuffer.h:
1300         (JSC::LinkBuffer::LinkBuffer):
1301         (JSC::LinkBuffer::finalizeCode):
1302         (JSC::LinkBuffer::linkCode):
1303         * assembler/MacroAssemblerCodeRef.h:
1304         (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
1305         (JSC::MacroAssemblerCodeRef::createSelfManagedCodeRef):
1306         (JSC::MacroAssemblerCodeRef::executableMemory):
1307         (JSC::MacroAssemblerCodeRef::code):
1308         (JSC::MacroAssemblerCodeRef::size):
1309         (JSC::MacroAssemblerCodeRef::operator!):
1310         * assembler/X86Assembler.h:
1311         (JSC::X86Assembler::executableCopy):
1312         (JSC::X86Assembler::X86InstructionFormatter::executableCopy):
1313         * bytecode/CodeBlock.h:
1314         * bytecode/Instruction.h:
1315         * bytecode/StructureStubInfo.h:
1316         * dfg/DFGJITCompiler.cpp:
1317         (JSC::DFG::JITCompiler::compile):
1318         (JSC::DFG::JITCompiler::compileFunction):
1319         * dfg/DFGRepatch.cpp:
1320         (JSC::DFG::generateProtoChainAccessStub):
1321         (JSC::DFG::tryCacheGetByID):
1322         (JSC::DFG::tryBuildGetByIDList):
1323         (JSC::DFG::tryBuildGetByIDProtoList):
1324         (JSC::DFG::tryCachePutByID):
1325         * jit/ExecutableAllocator.cpp:
1326         (JSC::ExecutableAllocator::initializeAllocator):
1327         (JSC::ExecutableAllocator::ExecutableAllocator):
1328         (JSC::ExecutableAllocator::allocate):
1329         (JSC::ExecutableAllocator::committedByteCount):
1330         (JSC::ExecutableAllocator::dumpProfile):
1331         * jit/ExecutableAllocator.h:
1332         (JSC::ExecutableAllocator::dumpProfile):
1333         * jit/ExecutableAllocatorFixedVMPool.cpp:
1334         (JSC::ExecutableAllocator::initializeAllocator):
1335         (JSC::ExecutableAllocator::ExecutableAllocator):
1336         (JSC::ExecutableAllocator::isValid):
1337         (JSC::ExecutableAllocator::underMemoryPressure):
1338         (JSC::ExecutableAllocator::allocate):
1339         (JSC::ExecutableAllocator::committedByteCount):
1340         (JSC::ExecutableAllocator::dumpProfile):
1341         * jit/JIT.cpp:
1342         (JSC::JIT::privateCompile):
1343         * jit/JIT.h:
1344         (JSC::JIT::compileCTIMachineTrampolines):
1345         (JSC::JIT::compileCTINativeCall):
1346         * jit/JITCode.h:
1347         (JSC::JITCode::operator !):
1348         (JSC::JITCode::addressForCall):
1349         (JSC::JITCode::offsetOf):
1350         (JSC::JITCode::execute):
1351         (JSC::JITCode::start):
1352         (JSC::JITCode::size):
1353         (JSC::JITCode::getExecutableMemory):
1354         (JSC::JITCode::HostFunction):
1355         (JSC::JITCode::JITCode):
1356         * jit/JITOpcodes.cpp:
1357         (JSC::JIT::privateCompileCTIMachineTrampolines):
1358         (JSC::JIT::privateCompileCTINativeCall):
1359         * jit/JITOpcodes32_64.cpp:
1360         (JSC::JIT::privateCompileCTIMachineTrampolines):
1361         (JSC::JIT::privateCompileCTINativeCall):
1362         * jit/JITPropertyAccess.cpp:
1363         (JSC::JIT::stringGetByValStubGenerator):
1364         (JSC::JIT::emitSlow_op_get_by_val):
1365         (JSC::JIT::privateCompilePutByIdTransition):
1366         (JSC::JIT::privateCompilePatchGetArrayLength):
1367         (JSC::JIT::privateCompileGetByIdProto):
1368         (JSC::JIT::privateCompileGetByIdSelfList):
1369         (JSC::JIT::privateCompileGetByIdProtoList):
1370         (JSC::JIT::privateCompileGetByIdChainList):
1371         (JSC::JIT::privateCompileGetByIdChain):
1372         * jit/JITPropertyAccess32_64.cpp:
1373         (JSC::JIT::stringGetByValStubGenerator):
1374         (JSC::JIT::emitSlow_op_get_by_val):
1375         (JSC::JIT::privateCompilePutByIdTransition):
1376         (JSC::JIT::privateCompilePatchGetArrayLength):
1377         (JSC::JIT::privateCompileGetByIdProto):
1378         (JSC::JIT::privateCompileGetByIdSelfList):
1379         (JSC::JIT::privateCompileGetByIdProtoList):
1380         (JSC::JIT::privateCompileGetByIdChainList):
1381         (JSC::JIT::privateCompileGetByIdChain):
1382         * jit/JITStubs.cpp:
1383         (JSC::JITThunks::JITThunks):
1384         (JSC::DEFINE_STUB_FUNCTION):
1385         (JSC::getPolymorphicAccessStructureListSlot):
1386         (JSC::JITThunks::ctiStub):
1387         (JSC::JITThunks::hostFunctionStub):
1388         * jit/JITStubs.h:
1389         * jit/SpecializedThunkJIT.h:
1390         (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
1391         (JSC::SpecializedThunkJIT::finalize):
1392         * jit/ThunkGenerators.cpp:
1393         (JSC::charCodeAtThunkGenerator):
1394         (JSC::charAtThunkGenerator):
1395         (JSC::fromCharCodeThunkGenerator):
1396         (JSC::sqrtThunkGenerator):
1397         (JSC::floorThunkGenerator):
1398         (JSC::ceilThunkGenerator):
1399         (JSC::roundThunkGenerator):
1400         (JSC::expThunkGenerator):
1401         (JSC::logThunkGenerator):
1402         (JSC::absThunkGenerator):
1403         (JSC::powThunkGenerator):
1404         * jit/ThunkGenerators.h:
1405         * runtime/Executable.h:
1406         (JSC::NativeExecutable::create):
1407         * runtime/InitializeThreading.cpp:
1408         (JSC::initializeThreadingOnce):
1409         * runtime/JSGlobalData.cpp:
1410         (JSC::JSGlobalData::JSGlobalData):
1411         (JSC::JSGlobalData::dumpSampleData):
1412         * runtime/JSGlobalData.h:
1413         (JSC::JSGlobalData::getCTIStub):
1414         * wtf/CMakeLists.txt:
1415         * wtf/MetaAllocator.cpp: Added.
1416         (WTF::MetaAllocatorHandle::MetaAllocatorHandle):
1417         (WTF::MetaAllocatorHandle::~MetaAllocatorHandle):
1418         (WTF::MetaAllocatorHandle::shrink):
1419         (WTF::MetaAllocator::MetaAllocator):
1420         (WTF::MetaAllocator::allocate):
1421         (WTF::MetaAllocator::currentStatistics):
1422         (WTF::MetaAllocator::findAndRemoveFreeSpace):
1423         (WTF::MetaAllocator::addFreeSpaceFromReleasedHandle):
1424         (WTF::MetaAllocator::addFreshFreeSpace):
1425         (WTF::MetaAllocator::debugFreeSpaceSize):
1426         (WTF::MetaAllocator::addFreeSpace):
1427         (WTF::MetaAllocator::incrementPageOccupancy):
1428         (WTF::MetaAllocator::decrementPageOccupancy):
1429         (WTF::MetaAllocator::roundUp):
1430         (WTF::MetaAllocator::allocFreeSpaceNode):
1431         (WTF::MetaAllocator::freeFreeSpaceNode):
1432         (WTF::MetaAllocator::dumpProfile):
1433         * wtf/MetaAllocator.h: Added.
1434         (WTF::MetaAllocator::bytesAllocated):
1435         (WTF::MetaAllocator::bytesReserved):
1436         (WTF::MetaAllocator::bytesCommitted):
1437         (WTF::MetaAllocator::dumpProfile):
1438         (WTF::MetaAllocator::~MetaAllocator):
1439         * wtf/MetaAllocatorHandle.h: Added.
1440         * wtf/RedBlackTree.h: Added.
1441         (WTF::RedBlackTree::Node::Node):
1442         (WTF::RedBlackTree::Node::successor):
1443         (WTF::RedBlackTree::Node::predecessor):
1444         (WTF::RedBlackTree::Node::reset):
1445         (WTF::RedBlackTree::Node::parent):
1446         (WTF::RedBlackTree::Node::setParent):
1447         (WTF::RedBlackTree::Node::left):
1448         (WTF::RedBlackTree::Node::setLeft):
1449         (WTF::RedBlackTree::Node::right):
1450         (WTF::RedBlackTree::Node::setRight):
1451         (WTF::RedBlackTree::Node::color):
1452         (WTF::RedBlackTree::Node::setColor):
1453         (WTF::RedBlackTree::RedBlackTree):
1454         (WTF::RedBlackTree::insert):
1455         (WTF::RedBlackTree::remove):
1456         (WTF::RedBlackTree::findExact):
1457         (WTF::RedBlackTree::findLeastGreaterThanOrEqual):
1458         (WTF::RedBlackTree::findGreatestLessThanOrEqual):
1459         (WTF::RedBlackTree::first):
1460         (WTF::RedBlackTree::last):
1461         (WTF::RedBlackTree::size):
1462         (WTF::RedBlackTree::isEmpty):
1463         (WTF::RedBlackTree::treeMinimum):
1464         (WTF::RedBlackTree::treeMaximum):
1465         (WTF::RedBlackTree::treeInsert):
1466         (WTF::RedBlackTree::leftRotate):
1467         (WTF::RedBlackTree::rightRotate):
1468         (WTF::RedBlackTree::removeFixup):
1469         * wtf/wtf.pri:
1470         * yarr/YarrJIT.cpp:
1471         (JSC::Yarr::YarrGenerator::compile):
1472         * yarr/YarrJIT.h:
1473         (JSC::Yarr::YarrCodeBlock::execute):
1474         (JSC::Yarr::YarrCodeBlock::getAddr):
1475
1476 2011-09-10  Sam Weinig  <sam@webkit.org>
1477
1478         Remove JSC::isZombie() function, it did nothing and was called by no-one.
1479         https://bugs.webkit.org/show_bug.cgi?id=67901
1480
1481         Reviewed by Andy Estes.
1482
1483         * JavaScriptCore.exp:
1484         * runtime/JSCell.cpp:
1485         * runtime/JSValue.h:
1486
1487 2011-09-10  Sam Weinig  <sam@webkit.org>
1488
1489         Add isInterruptedExecutionException and isTerminatedExecutionException predicates
1490         https://bugs.webkit.org/show_bug.cgi?id=67892
1491
1492         Reviewed by Andy "First Time Reviewer" Estes.
1493
1494         * JavaScriptCore.exp:
1495         Add symbols.
1496
1497         * interpreter/Interpreter.cpp:
1498         (JSC::Interpreter::throwException):
1499         Use new predicates.
1500
1501         * runtime/ExceptionHelpers.cpp:
1502         (JSC::createInterruptedExecutionException):
1503         (JSC::isInterruptedExecutionException):
1504         (JSC::createTerminatedExecutionException):
1505         (JSC::isTerminatedExecutionException):
1506         * runtime/ExceptionHelpers.h:
1507         (JSC::InterruptedExecutionError::InterruptedExecutionError):
1508         Add predicates.
1509
1510 2011-09-10  Filip Pizlo  <fpizlo@apple.com>
1511
1512         DFG JIT completely undoes speculative compilation even in the case of
1513         a partial static speculation failure
1514         https://bugs.webkit.org/show_bug.cgi?id=67798
1515
1516         Reviewed by Geoffrey Garen.
1517
1518         This is a regression with static speculation, so it is turned off by
1519         default.  But it is a necessary prerequisite for further work on
1520         dynamic speculation.
1521
1522         * dfg/DFGJITCodeGenerator.cpp:
1523         (JSC::DFG::JITCodeGenerator::clearGenerationInfo):
1524         * dfg/DFGJITCodeGenerator.h:
1525         * dfg/DFGSpeculativeJIT.cpp:
1526         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
1527         (JSC::DFG::SpeculativeJIT::compile):
1528         * dfg/DFGSpeculativeJIT.h:
1529         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
1530
1531 2011-09-09  Chris Marrin  <cmarrin@apple.com>
1532
1533         requestAnimationFrame doesn't throttle on Mac
1534         https://bugs.webkit.org/show_bug.cgi?id=67171
1535
1536         Reviewed by Simon Fraser.
1537
1538         Added WTF_USE_REQUEST_ANIMATION_FRAME_TIMER to allow any platform to run
1539         requestAnimationFrame callbacks on a Timer defined in ScriptedAnimationController.
1540         Currently only enabled for PLATFORM(MAC)
1541
1542         * wtf/Platform.h:
1543
1544 2011-09-09  Geoffrey Garen  <ggaren@apple.com>
1545
1546         Reviewed by Dan Bernstein.
1547
1548         Removed ENABLE(SINGLE_THREADED) support, since it is always false
1549         https://bugs.webkit.org/show_bug.cgi?id=67862
1550
1551         Next step toward making the baseline platform assumption that threads exist.
1552
1553         * wtf/wtf.pri:
1554         * JavaScriptCore.gypi:
1555         * JavaScriptCore.vcproj/WTF/WTF.vcproj: Removed references to
1556         ThreadingNone.cpp, which was only compiled in single-threaded mode.
1557
1558         * wtf/Platform.h:
1559         * wtf/ThreadSpecific.h:
1560         (WTF::::destroy):
1561         * wtf/qt/ThreadingQt.cpp: Removed now-dead code.
1562
1563         * wtf/ThreadingNone.cpp: Removed.
1564
1565 2011-09-09  Mark Hahnenberg  <mhahnenberg@apple.com>
1566
1567         Unzip initialization lists and constructors in JSCell hierarchy (5/7)
1568         https://bugs.webkit.org/show_bug.cgi?id=67420
1569
1570         Reviewed by Geoffrey Garen.
1571
1572         Completed the fifth level of the refactoring to add finishCreation()
1573         methods to all classes within the JSCell hierarchy with non-trivial
1574         constructor bodies.
1575
1576         This primarily consists of pushing the calls to finishCreation() down
1577         into the constructors of the subclasses of the second level of the hierarchy
1578         as well as pulling the finishCreation() calls out into the class's corresponding
1579         create() method if it has one.  Doing both simultaneously allows us to
1580         maintain the invariant that the finishCreation() method chain is called exactly
1581         once during the creation of an object, since calling it any other number of
1582         times (0, 2, or more) will cause an assertion failure.
1583
1584         * API/JSCallbackConstructor.cpp:
1585         (JSC::JSCallbackConstructor::JSCallbackConstructor):
1586         * API/JSCallbackConstructor.h:
1587         (JSC::JSCallbackConstructor::create):
1588         * API/JSCallbackFunction.cpp:
1589         (JSC::JSCallbackFunction::JSCallbackFunction):
1590         (JSC::JSCallbackFunction::finishCreation):
1591         * API/JSCallbackFunction.h:
1592         * API/JSCallbackObject.h:
1593         * API/JSCallbackObjectFunctions.h:
1594         (JSC::::JSCallbackObject):
1595         (JSC::::finishCreation):
1596         * JavaScriptCore.exp:
1597         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1598         * debugger/DebuggerActivation.cpp:
1599         * debugger/DebuggerActivation.h:
1600         (JSC::DebuggerActivation::create):
1601         * jsc.cpp:
1602         (GlobalObject::finishCreation):
1603         (GlobalObject::GlobalObject):
1604         * runtime/ArrayConstructor.cpp:
1605         (JSC::ArrayConstructor::ArrayConstructor):
1606         (JSC::ArrayConstructor::finishCreation):
1607         * runtime/ArrayConstructor.h:
1608         * runtime/ArrayPrototype.cpp:
1609         (JSC::ArrayPrototype::ArrayPrototype):
1610         * runtime/ArrayPrototype.h:
1611         (JSC::ArrayPrototype::create):
1612         * runtime/BooleanConstructor.cpp:
1613         (JSC::BooleanConstructor::BooleanConstructor):
1614         (JSC::BooleanConstructor::finishCreation):
1615         * runtime/BooleanConstructor.h:
1616         * runtime/BooleanObject.cpp:
1617         (JSC::BooleanObject::BooleanObject):
1618         * runtime/BooleanObject.h:
1619         (JSC::BooleanObject::create):
1620         * runtime/BooleanPrototype.cpp:
1621         (JSC::BooleanPrototype::BooleanPrototype):
1622         (JSC::BooleanPrototype::finishCreation):
1623         * runtime/BooleanPrototype.h:
1624         * runtime/DateConstructor.cpp:
1625         (JSC::DateConstructor::DateConstructor):
1626         (JSC::DateConstructor::finishCreation):
1627         * runtime/DateConstructor.h:
1628         * runtime/DateInstance.cpp:
1629         (JSC::DateInstance::DateInstance):
1630         * runtime/DateInstance.h:
1631         (JSC::DateInstance::create):
1632         * runtime/DatePrototype.cpp:
1633         (JSC::DatePrototype::DatePrototype):
1634         (JSC::DatePrototype::finishCreation):
1635         * runtime/DatePrototype.h:
1636         * runtime/Error.cpp:
1637         (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
1638         * runtime/ErrorConstructor.cpp:
1639         (JSC::ErrorConstructor::ErrorConstructor):
1640         (JSC::ErrorConstructor::finishCreation):
1641         * runtime/ErrorConstructor.h:
1642         * runtime/ErrorPrototype.cpp:
1643         (JSC::ErrorPrototype::ErrorPrototype):
1644         * runtime/ErrorPrototype.h:
1645         (JSC::ErrorPrototype::create):
1646         * runtime/FunctionConstructor.cpp:
1647         (JSC::FunctionConstructor::FunctionConstructor):
1648         (JSC::FunctionConstructor::finishCreation):
1649         * runtime/FunctionConstructor.h:
1650         * runtime/FunctionPrototype.cpp:
1651         (JSC::FunctionPrototype::FunctionPrototype):
1652         (JSC::FunctionPrototype::finishCreation):
1653         * runtime/FunctionPrototype.h:
1654         * runtime/InternalFunction.cpp:
1655         (JSC::InternalFunction::InternalFunction):
1656         * runtime/InternalFunction.h:
1657         * runtime/JSActivation.cpp:
1658         (JSC::JSActivation::JSActivation):
1659         * runtime/JSActivation.h:
1660         (JSC::JSActivation::create):
1661         * runtime/JSGlobalObject.h:
1662         (JSC::JSGlobalObject::create):
1663         (JSC::JSGlobalObject::JSGlobalObject):
1664         * runtime/JSONObject.cpp:
1665         (JSC::JSONObject::JSONObject):
1666         * runtime/JSONObject.h:
1667         (JSC::JSONObject::create):
1668         * runtime/JSStaticScopeObject.h:
1669         (JSC::JSStaticScopeObject::create):
1670         (JSC::JSStaticScopeObject::JSStaticScopeObject):
1671         * runtime/JSString.cpp:
1672         (JSC::StringObject::create):
1673         * runtime/MathObject.cpp:
1674         (JSC::MathObject::MathObject):
1675         * runtime/MathObject.h:
1676         (JSC::MathObject::create):
1677         * runtime/NativeErrorConstructor.cpp:
1678         (JSC::NativeErrorConstructor::NativeErrorConstructor):
1679         * runtime/NativeErrorConstructor.h:
1680         (JSC::NativeErrorConstructor::finishCreation):
1681         * runtime/NativeErrorPrototype.cpp:
1682         (JSC::NativeErrorPrototype::NativeErrorPrototype):
1683         (JSC::NativeErrorPrototype::finishCreation):
1684         * runtime/NativeErrorPrototype.h:
1685         * runtime/NumberConstructor.cpp:
1686         (JSC::NumberConstructor::NumberConstructor):
1687         (JSC::NumberConstructor::finishCreation):
1688         * runtime/NumberConstructor.h:
1689         * runtime/NumberObject.cpp:
1690         (JSC::NumberObject::NumberObject):
1691         * runtime/NumberObject.h:
1692         (JSC::NumberObject::create):
1693         * runtime/NumberPrototype.cpp:
1694         (JSC::NumberPrototype::NumberPrototype):
1695         (JSC::NumberPrototype::finishCreation):
1696         * runtime/NumberPrototype.h:
1697         * runtime/ObjectConstructor.cpp:
1698         (JSC::ObjectConstructor::ObjectConstructor):
1699         (JSC::ObjectConstructor::finishCreation):
1700         * runtime/ObjectConstructor.h:
1701         * runtime/RegExpConstructor.cpp:
1702         (JSC::RegExpConstructor::RegExpConstructor):
1703         (JSC::RegExpConstructor::finishCreation):
1704         (JSC::RegExpMatchesArray::RegExpMatchesArray):
1705         * runtime/RegExpConstructor.h:
1706         * runtime/RegExpMatchesArray.h:
1707         (JSC::RegExpMatchesArray::create):
1708         * runtime/RegExpObject.cpp:
1709         (JSC::RegExpObject::RegExpObject):
1710         * runtime/RegExpObject.h:
1711         (JSC::RegExpObject::create):
1712         * runtime/RegExpPrototype.cpp:
1713         (JSC::RegExpPrototype::RegExpPrototype):
1714         * runtime/StringConstructor.cpp:
1715         (JSC::StringConstructor::StringConstructor):
1716         (JSC::StringConstructor::finishCreation):
1717         * runtime/StringConstructor.h:
1718         * runtime/StringObject.cpp:
1719         (JSC::StringObject::StringObject):
1720         * runtime/StringObject.h:
1721         (JSC::StringObject::create):
1722         * runtime/StringObjectThatMasqueradesAsUndefined.h:
1723         (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
1724         * runtime/StringPrototype.cpp:
1725         (JSC::StringPrototype::StringPrototype):
1726         (JSC::StringPrototype::finishCreation):
1727         * runtime/StringPrototype.h:
1728
1729 2011-09-09  Geoffrey Garen  <ggaren@apple.com>
1730
1731         Build fix: Guard against double-#define for something already #defined
1732         by the build system.
1733
1734         * wtf/Platform.h:
1735
1736 2011-09-09  Geoffrey Garen  <ggaren@apple.com>
1737
1738         Reviewed by Dan Bernstein.
1739
1740         Never #define ENABLE_SINGLE_THREADED, !ENABLE_JSC_MULTIPLE_THREADS, or
1741         !ENABLE_WTF_MULTIPLE_THREADS
1742         https://bugs.webkit.org/show_bug.cgi?id=67860
1743
1744         First step toward making the baseline platform assumption that threads
1745         exist: Never #define ENABLE_SINGLE_THREADED, !ENABLE_JSC_MULTIPLE_THREADS,
1746         or !ENABLE_WTF_MULTIPLE_THREADS.
1747
1748         * wtf/Platform.h:
1749
1750 2011-09-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
1751
1752         [Qt] Remove common.pri
1753         https://bugs.webkit.org/show_bug.cgi?id=67814
1754
1755         Reviewed by Andreas Kling.
1756
1757         * JavaScriptCore.pri:
1758
1759 2011-09-08  Mark Hahnenberg  <mhahnenberg@apple.com>
1760
1761         REGRESSION(r94811): Assertion failure in 2 worker tests
1762         https://bugs.webkit.org/show_bug.cgi?id=67829
1763
1764         Reviewed by Sam Weinig.
1765
1766         Fixing a couple tests that were broken due to the wrong values being
1767         set in the parent class pointers in the ClassInfo structs for
1768         TerminatedExecutionError and InterruptedExecutionError.
1769
1770         * runtime/ExceptionHelpers.cpp:
1771
1772 2011-09-08  Oliver Hunt  <oliver@apple.com>
1773
1774         Use bump allocator for initial property storage
1775         https://bugs.webkit.org/show_bug.cgi?id=67494
1776
1777         Reviewed by Geoffrey Garen.
1778
1779         Use a bump allocator for initial allocation of property storage,
1780         and promote to fastMalloc memory only if it survives a GC pass.
1781
1782         Comes out as a 1% win on v8, and is a useful step on the way to
1783         GC allocation of all property storage.
1784
1785         * JavaScriptCore.exp:
1786         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1787         * JavaScriptCore.xcodeproj/project.pbxproj:
1788         * heap/Heap.cpp:
1789         (JSC::Heap::collect):
1790         * heap/Heap.h:
1791         (JSC::Heap::allocatePropertyStorage):
1792         (JSC::Heap::inPropertyStorageNursery):
1793         * heap/MarkedBlock.h:
1794         * heap/NewSpace.cpp:
1795         (JSC::NewSpace::NewSpace):
1796         * heap/NewSpace.h:
1797         (JSC::NewSpace::resetPropertyStorageNursery):
1798         (JSC::NewSpace::allocatePropertyStorage):
1799         (JSC::NewSpace::inPropertyStorageNursery):
1800         * jit/JITStubs.cpp:
1801         (JSC::DEFINE_STUB_FUNCTION):
1802         * runtime/JSObject.cpp:
1803         (JSC::JSObject::allocatePropertyStorage):
1804         * runtime/JSObject.h:
1805         (JSC::JSObject::isUsingInlineStorage):
1806         (JSC::JSObject::JSObject):
1807         (JSC::JSObject::propertyStorage):
1808         (JSC::JSObject::~JSObject):
1809         (JSC::JSObject::putDirectInternal):
1810         (JSC::JSObject::putDirectWithoutTransition):
1811         (JSC::JSObject::putDirectFunctionWithoutTransition):
1812         (JSC::JSObject::transitionTo):
1813         (JSC::JSObject::visitChildrenDirect):
1814         * runtime/StorageBarrier.h: Added.
1815         (JSC::StorageBarrier::StorageBarrier):
1816         (JSC::StorageBarrier::set):
1817         (JSC::StorageBarrier::operator->):
1818         (JSC::StorageBarrier::operator*):
1819         (JSC::StorageBarrier::operator[]):
1820         (JSC::StorageBarrier::get):
1821
1822 2011-09-08  Sam Weinig  <sam@webkit.org>
1823
1824         Remove the Completion object from JSC, I have never liked it
1825         https://bugs.webkit.org/show_bug.cgi?id=67755
1826
1827         Reviewed by Gavin Barraclough.
1828
1829         - Removes the Completion object and replaces its use with out parameter exceptions.
1830         - Remove ComplType and virtual exceptionType() function on JSObject. Replace with
1831           ClassInfo for InterruptedExecutionError and TerminatedExecutionError.
1832
1833         * API/JSBase.cpp:
1834         (JSEvaluateScript):
1835         (JSCheckScriptSyntax):
1836         * JavaScriptCore.exp:
1837         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1838         * interpreter/Interpreter.cpp:
1839         (JSC::Interpreter::throwException):
1840         * jsc.cpp:
1841         (functionLoad):
1842         (functionCheckSyntax):
1843         (runWithScripts):
1844         (runInteractive):
1845         * runtime/Completion.cpp:
1846         (JSC::checkSyntax):
1847         (JSC::evaluate):
1848         * runtime/Completion.h:
1849         * runtime/ExceptionHelpers.cpp:
1850         (JSC::InterruptedExecutionError::toString):
1851         (JSC::TerminatedExecutionError::toString):
1852         (JSC::createInterruptedExecutionException):
1853         * runtime/ExceptionHelpers.h:
1854         (JSC::InterruptedExecutionError::InterruptedExecutionError):
1855         (JSC::InterruptedExecutionError::create):
1856         (JSC::InterruptedExecutionError::createStructure):
1857         (JSC::TerminatedExecutionError::TerminatedExecutionError):
1858         (JSC::TerminatedExecutionError::create):
1859         (JSC::TerminatedExecutionError::createStructure):
1860         * runtime/JSGlobalData.cpp:
1861         (JSC::JSGlobalData::JSGlobalData):
1862         * runtime/JSObject.h:
1863
1864 2011-09-08  Ryosuke Niwa  <rniwa@webkit.org>
1865
1866         Build fix.
1867
1868         * dfg/DFGCapabilities.cpp:
1869
1870 2011-09-08  Filip Pizlo  <fpizlo@apple.com>
1871
1872         Value profling and execution count profiling is performed even for
1873         code that cannot be optimized
1874         https://bugs.webkit.org/show_bug.cgi?id=67694
1875
1876         Reviewed by Gavin Barraclough.
1877
1878         This is a 2% speed-up on V8 when tiered compilation is enabled.
1879
1880         * JavaScriptCore.xcodeproj/project.pbxproj:
1881         * bytecode/CodeBlock.cpp:
1882         (JSC::ProgramCodeBlock::canCompileWithDFG):
1883         (JSC::EvalCodeBlock::canCompileWithDFG):
1884         (JSC::FunctionCodeBlock::canCompileWithDFG):
1885         * bytecode/CodeBlock.h:
1886         * dfg/DFGCapabilities.cpp: Added.
1887         (JSC::DFG::canCompileOpcodes):
1888         * dfg/DFGCapabilities.h: Added.
1889         (JSC::DFG::mightCompileEval):
1890         (JSC::DFG::mightCompileProgram):
1891         (JSC::DFG::mightCompileFunctionForCall):
1892         (JSC::DFG::mightCompileFunctionForConstruct):
1893         (JSC::DFG::canCompileOpcode):
1894         (JSC::DFG::canCompileEval):
1895         (JSC::DFG::canCompileProgram):
1896         (JSC::DFG::canCompileFunctionForCall):
1897         (JSC::DFG::canCompileFunctionForConstruct):
1898         * jit/JIT.cpp:
1899         (JSC::JIT::emitOptimizationCheck):
1900         (JSC::JIT::privateCompile):
1901         * jit/JIT.h:
1902         (JSC::JIT::shouldEmitProfiling):
1903         * jit/JITInlineMethods.h:
1904         (JSC::JIT::emitValueProfilingSite):
1905
1906 2011-09-08  Filip Pizlo  <fpizlo@apple.com>
1907
1908         DFG speculative JIT does not initialize integer tags for PredictInt32 temporaries
1909         https://bugs.webkit.org/show_bug.cgi?id=67840
1910
1911         Reviewed by Gavin Barraclough.
1912
1913         * dfg/DFGSpeculativeJIT.cpp:
1914         (JSC::DFG::SpeculativeJIT::initializeVariableTypes):
1915
1916 2011-09-08  Thouraya ANDOLSI  <thouraya.andolsi@st.com>
1917
1918         https://bugs.webkit.org/show_bug.cgi?id=67771
1919
1920         Fix sequenceGetByIdSlowCaseInstructionSpace, sequenceGetByIdSlowCaseConstantSpace
1921         and patchOffsetGetByIdSlowCaseCall
1922         and enables DOUBLE_CONVERSION_CORRECT_DOUBLE_OPERATIONS flag for SH4 platforms.
1923
1924         Reviewed by Gavin Barraclough.
1925
1926         * jit/JIT.h:
1927         * wtf/dtoa/utils.h:
1928
1929 2011-09-08  Mark Hahnenberg  <mhahnenberg@apple.com>
1930
1931         Remove getUInt32 from JSCell
1932         https://bugs.webkit.org/show_bug.cgi?id=67691
1933
1934         Reviewed by Oliver Hunt.
1935
1936          We don't use JSCell::getUInt32 anymore, so it has been removed.
1937
1938         * JavaScriptCore.exp:
1939         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1940         * runtime/JSCell.cpp:
1941         * runtime/JSCell.h:
1942
1943 2011-09-07  Filip Pizlo  <fpizlo@apple.com>
1944
1945         PPC build fix.
1946
1947         * bytecode/CodeBlock.cpp:
1948         (JSC::CodeBlock::~CodeBlock):
1949
1950 2011-09-07  Oliver Hunt  <oliver@apple.com>
1951
1952         Release mode build fix.
1953
1954         * API/JSCallbackObject.h:
1955         (JSC::JSCallbackObject::create):
1956
1957 2011-09-06  Oliver Hunt  <oliver@apple.com>
1958
1959         Remove JSObjectWithGlobalObject
1960         https://bugs.webkit.org/show_bug.cgi?id=67689
1961
1962         Reviewed by Geoff Garen.
1963
1964         Remove JSObjectWithGlobalObject, and update code to stop using anonymous
1965         storage to access the global object that a JSObject comes from.  Largely
1966         mechanical change to remove the use of anonymous storage and JSObjectWithGlobalObject.
1967
1968         * API/JSCallbackConstructor.cpp:
1969         (JSC::JSCallbackConstructor::JSCallbackConstructor):
1970         (JSC::JSCallbackConstructor::finishCreation):
1971         * API/JSCallbackConstructor.h:
1972         * API/JSCallbackObject.cpp:
1973         * API/JSCallbackObject.h:
1974         (JSC::JSCallbackObject::create):
1975         * API/JSCallbackObjectFunctions.h:
1976         (JSC::::JSCallbackObject):
1977         (JSC::::finishCreation):
1978         (JSC::::staticFunctionGetter):
1979         * API/JSClassRef.cpp:
1980         (OpaqueJSClass::prototype):
1981         * API/JSObjectRef.cpp:
1982         (JSObjectMake):
1983         (JSObjectGetPrivate):
1984         (JSObjectSetPrivate):
1985         (JSObjectGetPrivateProperty):
1986         (JSObjectSetPrivateProperty):
1987         (JSObjectDeletePrivateProperty):
1988         * API/JSValueRef.cpp:
1989         (JSValueIsObjectOfClass):
1990         * API/JSWeakObjectMapRefPrivate.cpp:
1991         * JavaScriptCore.exp:
1992         * JavaScriptCore.xcodeproj/project.pbxproj:
1993         * bytecode/CodeBlock.h:
1994         * dfg/DFGRepatch.cpp:
1995         (JSC::DFG::dfgRepatchGetMethodFast):
1996         (JSC::DFG::tryCacheGetMethod):
1997         * jit/JIT.h:
1998         * jit/JITInlineMethods.h:
1999         (JSC::JIT::emitAllocateJSFunction):
2000         * jit/JITPropertyAccess.cpp:
2001         (JSC::JIT::patchMethodCallProto):
2002         * jit/JITStubs.cpp:
2003         (JSC::DEFINE_STUB_FUNCTION):
2004         * runtime/DatePrototype.cpp:
2005         * runtime/InternalFunction.cpp:
2006         (JSC::InternalFunction::InternalFunction):
2007         (JSC::InternalFunction::finishCreation):
2008         * runtime/InternalFunction.h:
2009         * runtime/JSFunction.cpp:
2010         (JSC::JSFunction::JSFunction):
2011         (JSC::JSFunction::finishCreation):
2012         * runtime/JSFunction.h:
2013         (JSC::JSFunction::create):
2014         (JSC::JSFunction::createStructure):
2015         * runtime/JSGlobalObject.cpp:
2016         (JSC::JSGlobalObject::reset):
2017         * runtime/JSONObject.cpp:
2018         (JSC::JSONObject::JSONObject):
2019         (JSC::JSONObject::finishCreation):
2020         * runtime/JSONObject.h:
2021         * runtime/JSObject.h:
2022         (JSC::JSObject::globalObject):
2023         * runtime/JSObjectWithGlobalObject.cpp: Removed.
2024         * runtime/JSObjectWithGlobalObject.h: Removed.
2025         * runtime/JSValue.cpp:
2026         (JSC::JSValue::isValidCallee):
2027         * runtime/Lookup.cpp:
2028         (JSC::setUpStaticFunctionSlot):
2029         * runtime/Lookup.h:
2030         * runtime/MathObject.cpp:
2031         (JSC::MathObject::MathObject):
2032         (JSC::MathObject::finishCreation):
2033         * runtime/MathObject.h:
2034         * runtime/NumberPrototype.cpp:
2035         * runtime/RegExpObject.cpp:
2036         (JSC::RegExpObject::RegExpObject):
2037         (JSC::RegExpObject::finishCreation):
2038         * runtime/RegExpObject.h:
2039         * runtime/Structure.cpp:
2040         (JSC::Structure::Structure):
2041         * runtime/Structure.h:
2042         (JSC::Structure::create):
2043         (JSC::Structure::globalObject):
2044
2045 2011-09-07  Gavin Barraclough  <barraclough@apple.com>
2046
2047         Refactor JIT checks for ObjectType into helper functions.
2048
2049         Rubber stamped by Sam Weinig.
2050
2051         * dfg/DFGJITCompiler.h:
2052         (JSC::DFG::JITCompiler::branchIfNotObject):
2053         * dfg/DFGNonSpeculativeJIT.cpp:
2054         (JSC::DFG::NonSpeculativeJIT::compile):
2055         * dfg/DFGSpeculativeJIT.cpp:
2056         (JSC::DFG::SpeculativeJIT::compile):
2057         * jit/JIT.h:
2058         * jit/JITCall32_64.cpp:
2059         (JSC::JIT::emit_op_ret_object_or_this):
2060         * jit/JITInlineMethods.h:
2061         (JSC::JIT::emitJumpIfNotObject):
2062         * jit/JITOpcodes.cpp:
2063         (JSC::JIT::emit_op_instanceof):
2064         (JSC::JIT::emit_op_ret_object_or_this):
2065         (JSC::JIT::emit_op_get_pnames):
2066         (JSC::JIT::emit_op_create_this):
2067         * jit/JITOpcodes32_64.cpp:
2068         (JSC::JIT::emit_op_instanceof):
2069         (JSC::JIT::emit_op_get_pnames):
2070         (JSC::JIT::emit_op_create_this):
2071
2072 2011-09-07  Sheriff Bot  <webkit.review.bot@gmail.com>
2073
2074         Unreviewed, rolling out r94627 and r94632.
2075         http://trac.webkit.org/changeset/94627
2076         http://trac.webkit.org/changeset/94632
2077         https://bugs.webkit.org/show_bug.cgi?id=67698
2078
2079         It broke tests on GTK and Qt (Requested by Ossy on #webkit).
2080
2081         * API/JSCallbackConstructor.cpp:
2082         (JSC::JSCallbackConstructor::JSCallbackConstructor):
2083         * API/JSCallbackConstructor.h:
2084         (JSC::JSCallbackConstructor::create):
2085         * API/JSCallbackFunction.cpp:
2086         (JSC::JSCallbackFunction::JSCallbackFunction):
2087         * API/JSCallbackFunction.h:
2088         * JavaScriptCore.exp:
2089         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2090         * debugger/DebuggerActivation.cpp:
2091         (JSC::DebuggerActivation::create):
2092         * debugger/DebuggerActivation.h:
2093         * jsc.cpp:
2094         (GlobalObject::constructorBody):
2095         (GlobalObject::GlobalObject):
2096         * runtime/ArrayConstructor.cpp:
2097         (JSC::ArrayConstructor::ArrayConstructor):
2098         * runtime/ArrayConstructor.h:
2099         * runtime/ArrayPrototype.cpp:
2100         (JSC::ArrayPrototype::ArrayPrototype):
2101         * runtime/ArrayPrototype.h:
2102         (JSC::ArrayPrototype::create):
2103         * runtime/BooleanConstructor.cpp:
2104         (JSC::BooleanConstructor::BooleanConstructor):
2105         * runtime/BooleanConstructor.h:
2106         * runtime/BooleanObject.cpp:
2107         (JSC::BooleanObject::BooleanObject):
2108         * runtime/BooleanObject.h:
2109         (JSC::BooleanObject::create):
2110         * runtime/BooleanPrototype.cpp:
2111         (JSC::BooleanPrototype::BooleanPrototype):
2112         * runtime/BooleanPrototype.h:
2113         * runtime/DateConstructor.cpp:
2114         (JSC::DateConstructor::DateConstructor):
2115         * runtime/DateConstructor.h:
2116         * runtime/DateInstance.cpp:
2117         (JSC::DateInstance::DateInstance):
2118         * runtime/DateInstance.h:
2119         (JSC::DateInstance::create):
2120         * runtime/DatePrototype.cpp:
2121         (JSC::DatePrototype::DatePrototype):
2122         * runtime/DatePrototype.h:
2123         * runtime/Error.cpp:
2124         (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
2125         * runtime/ErrorConstructor.cpp:
2126         (JSC::ErrorConstructor::ErrorConstructor):
2127         * runtime/ErrorConstructor.h:
2128         (JSC::ErrorConstructor::create):
2129         * runtime/ErrorPrototype.cpp:
2130         (JSC::ErrorPrototype::ErrorPrototype):
2131         * runtime/ErrorPrototype.h:
2132         (JSC::ErrorPrototype::create):
2133         * runtime/FunctionConstructor.cpp:
2134         (JSC::FunctionConstructor::FunctionConstructor):
2135         * runtime/FunctionConstructor.h:
2136         * runtime/FunctionPrototype.cpp:
2137         (JSC::FunctionPrototype::FunctionPrototype):
2138         * runtime/FunctionPrototype.h:
2139         * runtime/InternalFunction.cpp:
2140         (JSC::InternalFunction::InternalFunction):
2141         * runtime/InternalFunction.h:
2142         * runtime/JSActivation.cpp:
2143         (JSC::JSActivation::JSActivation):
2144         * runtime/JSActivation.h:
2145         (JSC::JSActivation::create):
2146         * runtime/JSGlobalObject.h:
2147         (JSC::JSGlobalObject::create):
2148         (JSC::JSGlobalObject::JSGlobalObject):
2149         * runtime/JSONObject.cpp:
2150         (JSC::JSONObject::JSONObject):
2151         * runtime/JSONObject.h:
2152         (JSC::JSONObject::create):
2153         * runtime/JSStaticScopeObject.h:
2154         (JSC::JSStaticScopeObject::create):
2155         (JSC::JSStaticScopeObject::JSStaticScopeObject):
2156         * runtime/JSString.cpp:
2157         (JSC::StringObject::create):
2158         * runtime/MathObject.cpp:
2159         (JSC::MathObject::MathObject):
2160         * runtime/MathObject.h:
2161         (JSC::MathObject::create):
2162         * runtime/NativeErrorConstructor.cpp:
2163         (JSC::NativeErrorConstructor::NativeErrorConstructor):
2164         * runtime/NativeErrorConstructor.h:
2165         (JSC::NativeErrorConstructor::constructorBody):
2166         * runtime/NativeErrorPrototype.cpp:
2167         (JSC::NativeErrorPrototype::NativeErrorPrototype):
2168         (JSC::NativeErrorPrototype::constructorBody):
2169         * runtime/NativeErrorPrototype.h:
2170         * runtime/NumberConstructor.cpp:
2171         (JSC::NumberConstructor::NumberConstructor):
2172         * runtime/NumberConstructor.h:
2173         * runtime/NumberObject.cpp:
2174         (JSC::NumberObject::NumberObject):
2175         * runtime/NumberObject.h:
2176         (JSC::NumberObject::create):
2177         * runtime/NumberPrototype.cpp:
2178         (JSC::NumberPrototype::NumberPrototype):
2179         * runtime/NumberPrototype.h:
2180         * runtime/ObjectConstructor.cpp:
2181         (JSC::ObjectConstructor::ObjectConstructor):
2182         * runtime/ObjectConstructor.h:
2183         * runtime/RegExpConstructor.cpp:
2184         (JSC::RegExpConstructor::RegExpConstructor):
2185         (JSC::RegExpMatchesArray::RegExpMatchesArray):
2186         * runtime/RegExpConstructor.h:
2187         * runtime/RegExpMatchesArray.h:
2188         (JSC::RegExpMatchesArray::create):
2189         * runtime/RegExpObject.cpp:
2190         (JSC::RegExpObject::RegExpObject):
2191         * runtime/RegExpObject.h:
2192         (JSC::RegExpObject::create):
2193         * runtime/RegExpPrototype.cpp:
2194         (JSC::RegExpPrototype::RegExpPrototype):
2195         * runtime/StringConstructor.cpp:
2196         (JSC::StringConstructor::StringConstructor):
2197         * runtime/StringConstructor.h:
2198         * runtime/StringObject.cpp:
2199         (JSC::StringObject::StringObject):
2200         * runtime/StringObject.h:
2201         (JSC::StringObject::create):
2202         * runtime/StringObjectThatMasqueradesAsUndefined.h:
2203         (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
2204         * runtime/StringPrototype.cpp:
2205         (JSC::StringPrototype::StringPrototype):
2206         * runtime/StringPrototype.h:
2207
2208 2011-09-06  Xianzhu Wang  <wangxianzhu@chromium.org>
2209
2210         Replace usages of Vector<UChar> with existing StringBuilder
2211         https://bugs.webkit.org/show_bug.cgi?id=67079
2212
2213         Reviewed by Gavin Barraclough.
2214
2215         This is part of work to support 8-bit string buffers.
2216         Adds StringBuilder::characters() because the original Vector<UChar>::data()
2217         is widely used.
2218         Sets the minimum size of buffer to 16 to prevent possible performance
2219         regression. Further performance investigation should be done in
2220         https://bugs.webkit.org/show_bug.cgi?id=67084.
2221
2222         * wtf/Forward.h:
2223         * wtf/text/StringBuilder.cpp:
2224         (WTF::StringBuilder::appendUninitialized): Sets minimum buffer size to 16 bytes.
2225         * wtf/text/StringBuilder.h:
2226         (WTF::StringBuilder::operator[]):
2227         (WTF::StringBuilder::characters): Added.
2228
2229 2011-09-06  Mark Hahnenberg  <mhahnenberg@apple.com>
2230
2231         Fix broken snow leopard build
2232         https://bugs.webkit.org/show_bug.cgi?id=67693
2233
2234         Reviewed by Daniel Bates.
2235
2236         Removed unnecessary symbol export.
2237
2238         * JavaScriptCore.exp:
2239
2240 2011-09-06  Filip Pizlo  <fpizlo@apple.com>
2241
2242         DFG JIT does not optimize booleans
2243         https://bugs.webkit.org/show_bug.cgi?id=67670
2244
2245         Reviewed by Gavin Barraclough.
2246
2247         This adds boolean value profiling, boolean prediction in the DFG,
2248         boolean forward flow propagation in the DFGPropagator, boolean
2249         data format in DFG generation info, and comprehensive optimizations
2250         based on both boolean prediction and boolean generation info.
2251         This is brings the speed-up on v8-richards to 12%, and gives slight
2252         speed-ups elsewhere as well.
2253
2254         Making this work right required navigating some subtleties in
2255         value profiling.  Some functions get compiled with insufficient
2256         information because some important path of the function never
2257         executed.  In these cases, we wish to fall back on static
2258         speculation.  But to do so, we need to ensure that predictions that
2259         are inherent in the code (like that GetById almost certainly takes
2260         a cell operand) are reflected in predictions that we make in
2261         DFGPropagator.  Thus, DFGPropagator now does both backward and
2262         forward flow, using a both forward and backward fixpoint.
2263
2264         The backward flow in DFGPropagator is a separate static analysis,
2265         and needs to keep a set of backward flow abstract values for
2266         variables, arguments, and globals.  To make this easy, this patch
2267         factors out DFGGraph's prediction tracking capability into
2268         DFGPredictionTracker, which now gets used by both DFGGraph (for
2269         forward flow predictions) and DFGPropagator (for backward flow
2270         predictions).  Backward flow predictions eventually get merged
2271         into forward flow ones, but the two are not equivalent: a forward
2272         flow prediction is a superset of the backward flow prediction.
2273
2274         Debugging these prediction issues required a better understanding
2275         of where we fail speculation, and what our value predictions look
2276         like.  This patch also adds optional verbose speculation failure
2277         (so an informative printf fires whenever speculation failure occurs)
2278         and slight improvements to the verbosity in other places.
2279
2280         * bytecode/ValueProfile.h:
2281         (JSC::ValueProfile::numberOfBooleans):
2282         (JSC::ValueProfile::probabilityOfBoolean):
2283         (JSC::ValueProfile::dump):
2284         (JSC::ValueProfile::computeStatistics):
2285         * dfg/DFGByteCodeParser.cpp:
2286         (JSC::DFG::ByteCodeParser::stronglyPredict):
2287         (JSC::DFG::ByteCodeParser::parseBlock):
2288         * dfg/DFGGenerationInfo.h:
2289         (JSC::DFG::dataFormatToString):
2290         (JSC::DFG::needDataFormatConversion):
2291         * dfg/DFGGraph.cpp:
2292         (JSC::DFG::Graph::dump):
2293         (JSC::DFG::Graph::predictArgumentTypes):
2294         * dfg/DFGGraph.h:
2295         (JSC::DFG::Graph::Graph):
2296         (JSC::DFG::Graph::predictions):
2297         (JSC::DFG::Graph::predict):
2298         (JSC::DFG::Graph::predictGlobalVar):
2299         (JSC::DFG::Graph::getPrediction):
2300         (JSC::DFG::Graph::getGlobalVarPrediction):
2301         (JSC::DFG::Graph::isBooleanConstant):
2302         (JSC::DFG::Graph::valueOfBooleanConstant):
2303         * dfg/DFGJITCodeGenerator.cpp:
2304         (JSC::DFG::JITCodeGenerator::fillInteger):
2305         (JSC::DFG::JITCodeGenerator::fillDouble):
2306         (JSC::DFG::JITCodeGenerator::fillJSValue):
2307         (JSC::DFG::JITCodeGenerator::isKnownNotInteger):
2308         (JSC::DFG::JITCodeGenerator::isKnownBoolean):
2309         (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompareNull):
2310         (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeCompare):
2311         (JSC::DFG::JITCodeGenerator::nonSpeculativeNonPeepholeStrictEq):
2312         (JSC::DFG::JITCodeGenerator::emitBranch):
2313         (JSC::DFG::JITCodeGenerator::speculationCheck):
2314         (JSC::DFG::GPRTemporary::GPRTemporary):
2315         * dfg/DFGJITCodeGenerator.h:
2316         (JSC::DFG::JITCodeGenerator::isBooleanConstant):
2317         (JSC::DFG::JITCodeGenerator::valueOfBooleanConstant):
2318         * dfg/DFGJITCompiler.cpp:
2319         (JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
2320         (JSC::DFG::JITCompiler::link):
2321         * dfg/DFGJITCompiler.h:
2322         (JSC::DFG::JITCompiler::debugCall):
2323         (JSC::DFG::JITCompiler::isBooleanConstant):
2324         (JSC::DFG::JITCompiler::valueOfBooleanConstant):
2325         * dfg/DFGNode.h:
2326         (JSC::DFG::isBooleanPrediction):
2327         (JSC::DFG::predictionToString):
2328         (JSC::DFG::mergePredictions):
2329         (JSC::DFG::makePrediction):
2330         (JSC::DFG::Node::isBooleanConstant):
2331         (JSC::DFG::Node::valueOfBooleanConstant):
2332         (JSC::DFG::Node::hasBooleanResult):
2333         (JSC::DFG::Node::hasNumericResult):
2334         (JSC::DFG::Node::predict):
2335         * dfg/DFGOperations.cpp:
2336         * dfg/DFGOperations.h:
2337         * dfg/DFGPredictionTracker.h: Added.
2338         (JSC::DFG::operandIsArgument):
2339         (JSC::DFG::PredictionSlot::PredictionSlot):
2340         (JSC::DFG::PredictionTracker::PredictionTracker):
2341         (JSC::DFG::PredictionTracker::initializeSimilarTo):
2342         (JSC::DFG::PredictionTracker::numberOfArguments):
2343         (JSC::DFG::PredictionTracker::numberOfVariables):
2344         (JSC::DFG::PredictionTracker::argumentIndexForOperand):
2345         (JSC::DFG::PredictionTracker::predictArgument):
2346         (JSC::DFG::PredictionTracker::predict):
2347         (JSC::DFG::PredictionTracker::predictGlobalVar):
2348         (JSC::DFG::PredictionTracker::getArgumentPrediction):
2349         (JSC::DFG::PredictionTracker::getPrediction):
2350         (JSC::DFG::PredictionTracker::getGlobalVarPrediction):
2351         * dfg/DFGPropagator.cpp:
2352         (JSC::DFG::Propagator::Propagator):
2353         (JSC::DFG::Propagator::fixpoint):
2354         (JSC::DFG::Propagator::setPrediction):
2355         (JSC::DFG::Propagator::mergeUse):
2356         (JSC::DFG::Propagator::mergePrediction):
2357         (JSC::DFG::Propagator::propagateNode):
2358         * dfg/DFGSpeculativeJIT.cpp:
2359         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
2360         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
2361         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
2362         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
2363         (JSC::DFG::SpeculativeJIT::compare):
2364         (JSC::DFG::SpeculativeJIT::compile):
2365         * dfg/DFGSpeculativeJIT.h:
2366         (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
2367         (JSC::DFG::SpeculateBooleanOperand::~SpeculateBooleanOperand):
2368         (JSC::DFG::SpeculateBooleanOperand::index):
2369         (JSC::DFG::SpeculateBooleanOperand::gpr):
2370         (JSC::DFG::SpeculateBooleanOperand::use):
2371         * runtime/JSGlobalData.h:
2372         * runtime/JSValue.cpp:
2373         (JSC::JSValue::description):
2374
2375 2011-09-06  Mark Hahnenberg  <mhahnenberg@apple.com>
2376
2377         Unzip initialization lists and constructors in JSCell hierarchy (5/7)
2378         https://bugs.webkit.org/show_bug.cgi?id=67420
2379
2380         Reviewed by Geoffrey Garen.
2381
2382         Completed the fifth level of the refactoring to add finishCreation()
2383         methods to all classes within the JSCell hierarchy with non-trivial
2384         constructor bodies.
2385
2386         This primarily consists of pushing the calls to finishCreation() down
2387         into the constructors of the subclasses of the second level of the hierarchy
2388         as well as pulling the finishCreation() calls out into the class's corresponding
2389         create() method if it has one.  Doing both simultaneously allows us to
2390         maintain the invariant that the finishCreation() method chain is called exactly
2391         once during the creation of an object, since calling it any other number of
2392         times (0, 2, or more) will cause an assertion failure.
2393
2394         * API/JSCallbackConstructor.cpp:
2395         (JSC::JSCallbackConstructor::JSCallbackConstructor):
2396         * API/JSCallbackConstructor.h:
2397         (JSC::JSCallbackConstructor::create):
2398         * API/JSCallbackFunction.cpp:
2399         (JSC::JSCallbackFunction::JSCallbackFunction):
2400         (JSC::JSCallbackFunction::finishCreation):
2401         * API/JSCallbackFunction.h:
2402         * JavaScriptCore.exp:
2403         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2404         * debugger/DebuggerActivation.cpp:
2405         * debugger/DebuggerActivation.h:
2406         (JSC::DebuggerActivation::create):
2407         * jsc.cpp:
2408         (GlobalObject::finishCreation):
2409         (GlobalObject::GlobalObject):
2410         * runtime/ArrayConstructor.cpp:
2411         (JSC::ArrayConstructor::ArrayConstructor):
2412         (JSC::ArrayConstructor::finishCreation):
2413         * runtime/ArrayConstructor.h:
2414         * runtime/ArrayPrototype.cpp:
2415         (JSC::ArrayPrototype::ArrayPrototype):
2416         * runtime/ArrayPrototype.h:
2417         (JSC::ArrayPrototype::create):
2418         * runtime/BooleanConstructor.cpp:
2419         (JSC::BooleanConstructor::BooleanConstructor):
2420         (JSC::BooleanConstructor::finishCreation):
2421         * runtime/BooleanConstructor.h:
2422         * runtime/BooleanObject.cpp:
2423         (JSC::BooleanObject::BooleanObject):
2424         * runtime/BooleanObject.h:
2425         (JSC::BooleanObject::create):
2426         * runtime/BooleanPrototype.cpp:
2427         (JSC::BooleanPrototype::BooleanPrototype):
2428         (JSC::BooleanPrototype::finishCreation):
2429         * runtime/BooleanPrototype.h:
2430         * runtime/DateConstructor.cpp:
2431         (JSC::DateConstructor::DateConstructor):
2432         (JSC::DateConstructor::finishCreation):
2433         * runtime/DateConstructor.h:
2434         * runtime/DateInstance.cpp:
2435         (JSC::DateInstance::DateInstance):
2436         * runtime/DateInstance.h:
2437         (JSC::DateInstance::create):
2438         * runtime/DatePrototype.cpp:
2439         (JSC::DatePrototype::DatePrototype):
2440         (JSC::DatePrototype::finishCreation):
2441         * runtime/DatePrototype.h:
2442         * runtime/Error.cpp:
2443         (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
2444         * runtime/ErrorConstructor.cpp:
2445         (JSC::ErrorConstructor::ErrorConstructor):
2446         (JSC::ErrorConstructor::finishCreation):
2447         * runtime/ErrorConstructor.h:
2448         * runtime/ErrorPrototype.cpp:
2449         (JSC::ErrorPrototype::ErrorPrototype):
2450         * runtime/ErrorPrototype.h:
2451         (JSC::ErrorPrototype::create):
2452         * runtime/FunctionConstructor.cpp:
2453         (JSC::FunctionConstructor::FunctionConstructor):
2454         (JSC::FunctionConstructor::finishCreation):
2455         * runtime/FunctionConstructor.h:
2456         * runtime/FunctionPrototype.cpp:
2457         (JSC::FunctionPrototype::FunctionPrototype):
2458         (JSC::FunctionPrototype::finishCreation):
2459         * runtime/FunctionPrototype.h:
2460         * runtime/InternalFunction.cpp:
2461         (JSC::InternalFunction::InternalFunction):
2462         * runtime/InternalFunction.h:
2463         * runtime/JSActivation.cpp:
2464         (JSC::JSActivation::JSActivation):
2465         * runtime/JSActivation.h:
2466         (JSC::JSActivation::create):
2467         * runtime/JSGlobalObject.h:
2468         (JSC::JSGlobalObject::create):
2469         (JSC::JSGlobalObject::JSGlobalObject):
2470         * runtime/JSONObject.cpp:
2471         (JSC::JSONObject::JSONObject):
2472         * runtime/JSONObject.h:
2473         (JSC::JSONObject::create):
2474         * runtime/JSStaticScopeObject.h:
2475         (JSC::JSStaticScopeObject::create):
2476         (JSC::JSStaticScopeObject::JSStaticScopeObject):
2477         * runtime/JSString.cpp:
2478         (JSC::StringObject::create):
2479         * runtime/MathObject.cpp:
2480         (JSC::MathObject::MathObject):
2481         * runtime/MathObject.h:
2482         (JSC::MathObject::create):
2483         * runtime/NativeErrorConstructor.cpp:
2484         (JSC::NativeErrorConstructor::NativeErrorConstructor):
2485         * runtime/NativeErrorConstructor.h:
2486         (JSC::NativeErrorConstructor::finishCreation):
2487         * runtime/NativeErrorPrototype.cpp:
2488         (JSC::NativeErrorPrototype::NativeErrorPrototype):
2489         (JSC::NativeErrorPrototype::finishCreation):
2490         * runtime/NativeErrorPrototype.h:
2491         * runtime/NumberConstructor.cpp:
2492         (JSC::NumberConstructor::NumberConstructor):
2493         (JSC::NumberConstructor::finishCreation):
2494         * runtime/NumberConstructor.h:
2495         * runtime/NumberObject.cpp:
2496         (JSC::NumberObject::NumberObject):
2497         * runtime/NumberObject.h:
2498         (JSC::NumberObject::create):
2499         * runtime/NumberPrototype.cpp:
2500         (JSC::NumberPrototype::NumberPrototype):
2501         (JSC::NumberPrototype::finishCreation):
2502         * runtime/NumberPrototype.h:
2503         * runtime/ObjectConstructor.cpp:
2504         (JSC::ObjectConstructor::ObjectConstructor):
2505         (JSC::ObjectConstructor::finishCreation):
2506         * runtime/ObjectConstructor.h:
2507         * runtime/RegExpConstructor.cpp:
2508         (JSC::RegExpConstructor::RegExpConstructor):
2509         (JSC::RegExpConstructor::finishCreation):
2510         (JSC::RegExpMatchesArray::RegExpMatchesArray):
2511         * runtime/RegExpConstructor.h:
2512         * runtime/RegExpMatchesArray.h:
2513         (JSC::RegExpMatchesArray::create):
2514         * runtime/RegExpObject.cpp:
2515         (JSC::RegExpObject::RegExpObject):
2516         * runtime/RegExpObject.h:
2517         (JSC::RegExpObject::create):
2518         * runtime/RegExpPrototype.cpp:
2519         (JSC::RegExpPrototype::RegExpPrototype):
2520         * runtime/StringConstructor.cpp:
2521         (JSC::StringConstructor::StringConstructor):
2522         (JSC::StringConstructor::finishCreation):
2523         * runtime/StringConstructor.h:
2524         * runtime/StringObject.cpp:
2525         (JSC::StringObject::StringObject):
2526         * runtime/StringObject.h:
2527         (JSC::StringObject::create):
2528         * runtime/StringObjectThatMasqueradesAsUndefined.h:
2529         (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
2530         * runtime/StringPrototype.cpp:
2531         (JSC::StringPrototype::StringPrototype):
2532         (JSC::StringPrototype::finishCreation):
2533         * runtime/StringPrototype.h:
2534
2535 2011-09-06  Filip Pizlo  <fpizlo@apple.com>
2536
2537         Accessibility tests crashing in BasicRawSentinelNode code
2538         https://bugs.webkit.org/show_bug.cgi?id=67682
2539
2540         Reviewed by Geoffrey Garen.
2541
2542         A CodeBlock should ensure that no other CodeBlocks have references to it after
2543         it is destroyed.
2544
2545         * bytecode/CodeBlock.cpp:
2546         (JSC::CodeBlock::~CodeBlock):
2547
2548 2011-09-06  Yong Li  <yoli@rim.com>
2549
2550         https://bugs.webkit.org/show_bug.cgi?id=67486
2551         This reverts r65993 which gives wrong results for rshift
2552         in some corner cases (see the test).
2553
2554         Reviewed by Gavin Barraclough.
2555
2556         New test: fast/js/floating-point-truncate-rshift.html
2557
2558         * assembler/ARMAssembler.h:
2559         * assembler/MacroAssemblerARM.h:
2560         (JSC::MacroAssemblerARM::supportsFloatingPointTruncate):
2561         (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
2562
2563 2011-09-06  Filip Pizlo  <fpizlo@apple.com>
2564
2565         Unreviewed build fix for r94559.
2566
2567         Marked the relevant parameters as unused if !ENABLE(JIT), and surrounded
2568         new out-of-line JIT-specific method definitions with !ENABLE(JIT).
2569
2570         * bytecode/CodeBlock.cpp:
2571         * runtime/Executable.cpp:
2572         (JSC::EvalExecutable::compileInternal):
2573         (JSC::ProgramExecutable::compileInternal):
2574         (JSC::FunctionExecutable::compileForCallInternal):
2575
2576 2011-09-06  Mark Hahnenberg  <mhahnenberg@apple.com>
2577
2578         Fix broken PPC build due to new dtoa library
2579         https://bugs.webkit.org/show_bug.cgi?id=67654
2580
2581         Reviewed by Dan Bernstein.
2582
2583         Added condition for PPC in the new dtoa compatibility check so that
2584         building won't fail.
2585
2586         * wtf/dtoa/utils.h:
2587
2588 2011-09-05  Oliver Hunt  <oliver@apple.com>
2589
2590         An object's structure should reference the global object responsible for its creation
2591         https://bugs.webkit.org/show_bug.cgi?id=67624
2592
2593         Reviewed by Gavin Barraclough.
2594
2595         Add a reference to a GlobalObject to Structure, and update all calls to
2596         Structure::create() to pass the global object that is the origin for that
2597         structure.  For objects where the appropriate global object isn't available
2598         at construction time (global object prototypes, etc), or objects that
2599         logically don't have a global object (strings, etc) we just pass null.
2600
2601         This change is largely mechanical (passing a new globalObject parameter
2602         around).
2603
2604         * API/JSCallbackConstructor.h:
2605         (JSC::JSCallbackConstructor::createStructure):
2606         * API/JSCallbackFunction.h:
2607         (JSC::JSCallbackFunction::createStructure):
2608         * API/JSCallbackObject.h:
2609         (JSC::JSCallbackObject::createStructure):
2610         * API/JSContextRef.cpp:
2611         * JavaScriptCore.exp:
2612         * debugger/DebuggerActivation.h:
2613         (JSC::DebuggerActivation::createStructure):
2614         * runtime/Arguments.h:
2615         (JSC::Arguments::createStructure):
2616         * runtime/ArrayConstructor.h:
2617         (JSC::ArrayConstructor::createStructure):
2618         * runtime/ArrayPrototype.h:
2619         (JSC::ArrayPrototype::createStructure):
2620         * runtime/BooleanObject.h:
2621         (JSC::BooleanObject::createStructure):
2622         * runtime/BooleanPrototype.h:
2623         (JSC::BooleanPrototype::createStructure):
2624         * runtime/DateConstructor.h:
2625         (JSC::DateConstructor::createStructure):
2626         * runtime/DateInstance.h:
2627         (JSC::DateInstance::createStructure):
2628         * runtime/DatePrototype.h:
2629         (JSC::DatePrototype::createStructure):
2630         * runtime/ErrorInstance.h:
2631         (JSC::ErrorInstance::createStructure):
2632         * runtime/ErrorPrototype.h:
2633         (JSC::ErrorPrototype::createStructure):
2634         * runtime/Executable.h:
2635         (JSC::ExecutableBase::createStructure):
2636         (JSC::NativeExecutable::createStructure):
2637         (JSC::EvalExecutable::createStructure):
2638         (JSC::ProgramExecutable::createStructure):
2639         (JSC::FunctionExecutable::createStructure):
2640         * runtime/FunctionPrototype.h:
2641         (JSC::FunctionPrototype::createStructure):
2642         * runtime/GetterSetter.h:
2643         (JSC::GetterSetter::createStructure):
2644         * runtime/InternalFunction.h:
2645         (JSC::InternalFunction::createStructure):
2646         * runtime/JSAPIValueWrapper.h:
2647         (JSC::JSAPIValueWrapper::createStructure):
2648         * runtime/JSActivation.h:
2649         (JSC::JSActivation::createStructure):
2650         * runtime/JSArray.h:
2651         (JSC::JSArray::createStructure):
2652         * runtime/JSByteArray.cpp:
2653         (JSC::JSByteArray::createStructure):
2654         * runtime/JSByteArray.h:
2655         * runtime/JSFunction.h:
2656         (JSC::JSFunction::createStructure):
2657         * runtime/JSGlobalData.cpp:
2658         (JSC::JSGlobalData::JSGlobalData):
2659         * runtime/JSGlobalObject.cpp:
2660         (JSC::JSGlobalObject::reset):
2661         * runtime/JSGlobalObject.h:
2662         (JSC::JSGlobalObject::finishCreation):
2663         (JSC::JSGlobalObject::createStructure):
2664         * runtime/JSNotAnObject.h:
2665         (JSC::JSNotAnObject::createStructure):
2666         * runtime/JSONObject.h:
2667         (JSC::JSONObject::createStructure):
2668         * runtime/JSObject.cpp:
2669         (JSC::JSObject::createInheritorID):
2670         * runtime/JSObject.h:
2671         (JSC::JSObject::createStructure):
2672         (JSC::JSNonFinalObject::createStructure):
2673         (JSC::JSFinalObject::createStructure):
2674         (JSC::createEmptyObjectStructure):
2675         * runtime/JSObjectWithGlobalObject.h:
2676         (JSC::JSObjectWithGlobalObject::createStructure):
2677         * runtime/JSPropertyNameIterator.h:
2678         (JSC::JSPropertyNameIterator::createStructure):
2679         * runtime/JSStaticScopeObject.h:
2680         (JSC::JSStaticScopeObject::createStructure):
2681         * runtime/JSString.h:
2682         (JSC::RopeBuilder::createStructure):
2683         * runtime/JSVariableObject.h:
2684         (JSC::JSVariableObject::createStructure):
2685         * runtime/JSWrapperObject.h:
2686         (JSC::JSWrapperObject::createStructure):
2687         * runtime/MathObject.h:
2688         (JSC::MathObject::createStructure):
2689         * runtime/NativeErrorConstructor.h:
2690         (JSC::NativeErrorConstructor::createStructure):
2691         (JSC::NativeErrorConstructor::constructorBody):
2692         * runtime/NumberConstructor.h:
2693         (JSC::NumberConstructor::createStructure):
2694         * runtime/NumberObject.h:
2695         (JSC::NumberObject::createStructure):
2696         * runtime/NumberPrototype.h:
2697         (JSC::NumberPrototype::createStructure):
2698         * runtime/ObjectConstructor.h:
2699         (JSC::ObjectConstructor::createStructure):
2700         * runtime/ObjectPrototype.h:
2701         (JSC::ObjectPrototype::createStructure):
2702         * runtime/RegExp.h:
2703         (JSC::RegExp::createStructure):
2704         * runtime/RegExpConstructor.h:
2705         (JSC::RegExpConstructor::createStructure):
2706         * runtime/RegExpObject.h:
2707         (JSC::RegExpObject::createStructure):
2708         * runtime/RegExpPrototype.h:
2709         (JSC::RegExpPrototype::createStructure):
2710         * runtime/ScopeChain.h:
2711         (JSC::ScopeChainNode::createStructure):
2712         * runtime/StrictEvalActivation.h:
2713         (JSC::StrictEvalActivation::createStructure):
2714         * runtime/StringConstructor.h:
2715         (JSC::StringConstructor::createStructure):
2716         * runtime/StringObject.h:
2717         (JSC::StringObject::createStructure):
2718         * runtime/StringObjectThatMasqueradesAsUndefined.h:
2719         (JSC::StringObjectThatMasqueradesAsUndefined::create):
2720         (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
2721         * runtime/StringPrototype.h:
2722         (JSC::StringPrototype::createStructure):
2723         * runtime/Structure.cpp:
2724         (JSC::Structure::Structure):
2725         (JSC::Structure::visitChildren):
2726         * runtime/Structure.h:
2727         (JSC::Structure::create):
2728         (JSC::Structure::globalObject):
2729         (JSC::Structure::setGlobalObject):
2730         * runtime/StructureChain.h:
2731         (JSC::StructureChain::createStructure):
2732
2733 2011-09-06  Michael Saboff  <msaboff@apple.com>
2734
2735         Add windows changes for JSC:RegExp functional tests
2736         https://bugs.webkit.org/show_bug.cgi?id=67521
2737
2738         Windows build changes for regular expression functional test.
2739
2740         Rubber-stamped by Gavin Barraclough.
2741
2742         * JavaScriptCore.vcproj/JavaScriptCore.sln:
2743         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2744         * JavaScriptCore.vcproj/testRegExp: Added.
2745         * JavaScriptCore.vcproj/testRegExp/testRegExp.vcproj: Added.
2746         * JavaScriptCore.vcproj/testRegExp/testRegExpCommon.vsprops: Added.
2747         * JavaScriptCore.vcproj/testRegExp/testRegExpDebug.vsprops: Added.
2748         * JavaScriptCore.vcproj/testRegExp/testRegExpDebugAll.vsprops: Added.
2749         * JavaScriptCore.vcproj/testRegExp/testRegExpDebugCairoCFLite.vsprops: Added.
2750         * JavaScriptCore.vcproj/testRegExp/testRegExpPostBuild.cmd: Added.
2751         * JavaScriptCore.vcproj/testRegExp/testRegExpPreBuild.cmd: Added.
2752         * JavaScriptCore.vcproj/testRegExp/testRegExpPreLink.cmd: Added.
2753         * JavaScriptCore.vcproj/testRegExp/testRegExpProduction.vsprops: Added.
2754         * JavaScriptCore.vcproj/testRegExp/testRegExpRelease.vsprops: Added.
2755         * JavaScriptCore.vcproj/testRegExp/testRegExpReleaseCairoCFLite.vsprops: Added.
2756         * JavaScriptCore.vcproj/testRegExp/testRegExpReleasePGO.vsprops: Added.
2757
2758 2011-09-06  Filip Pizlo  <fpizlo@apple.com>
2759
2760         JavaScriptCore does not have tiered compilation
2761         https://bugs.webkit.org/show_bug.cgi?id=67176
2762
2763         Reviewed by Gavin Barraclough.
2764
2765         This adds the ability to have multiple CodeBlocks associated with
2766         a particular role in an Executable.  These are stored in
2767         descending order of compiler tier.  CodeBlocks are optimized when
2768         a counter (m_executeCounter) that is incremented in loops and
2769         epilogues becomes positive.  Optimizing means that all calls to
2770         the old CodeBlock are unlinked.
2771
2772         The DFG can now pull in predictions from ValueProfiles, and
2773         propagate them along the graph.  To support the new phase while
2774         maintaing some level of abstraction, a DFGDriver was introduced
2775         that encapsulates how to run the DFG compiler.
2776
2777         This is turned off by default because it's not yet a performance
2778         win on all benchmarks.  It speeds up crypto and richards by
2779         10% and 6% respectively, but still does not do as good of a job
2780         as it could.  Notably, the DFG backend has not changed, and
2781         is largely oblivious to the new information being made available
2782         to it.
2783
2784         When turned off (the default), this patch is performance neutral.
2785
2786         * CMakeLists.txt:
2787         * GNUmakefile.am:
2788         * GNUmakefile.list.am:
2789         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2790         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
2791         * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
2792         * JavaScriptCore.xcodeproj/project.pbxproj:
2793         * assembler/MacroAssemblerX86.h:
2794         (JSC::MacroAssemblerX86::branchAdd32):
2795         * assembler/MacroAssemblerX86_64.h:
2796         (JSC::MacroAssemblerX86_64::branchAdd32):
2797         * bytecode/CodeBlock.cpp:
2798         (JSC::CodeBlock::CodeBlock):
2799         (JSC::CodeBlock::~CodeBlock):
2800         (JSC::CodeBlock::visitAggregate):
2801         (JSC::CallLinkInfo::unlink):
2802         (JSC::CodeBlock::unlinkCalls):
2803         (JSC::CodeBlock::unlinkIncomingCalls):
2804         (JSC::CodeBlock::clearEvalCache):
2805         (JSC::replaceExistingEntries):
2806         (JSC::CodeBlock::copyDataFromAlternative):
2807         (JSC::ProgramCodeBlock::replacement):
2808         (JSC::EvalCodeBlock::replacement):
2809         (JSC::FunctionCodeBlock::replacement):
2810         (JSC::ProgramCodeBlock::compileOptimized):
2811         (JSC::EvalCodeBlock::compileOptimized):
2812         (JSC::FunctionCodeBlock::compileOptimized):
2813         * bytecode/CodeBlock.h:
2814         (JSC::GlobalCodeBlock::GlobalCodeBlock):
2815         (JSC::ProgramCodeBlock::ProgramCodeBlock):
2816         (JSC::EvalCodeBlock::EvalCodeBlock):
2817         (JSC::FunctionCodeBlock::FunctionCodeBlock):
2818         * bytecode/ValueProfile.h:
2819         (JSC::ValueProfile::dump):
2820         (JSC::ValueProfile::computeStatistics):
2821         * bytecompiler/BytecodeGenerator.cpp:
2822         (JSC::BytecodeGenerator::BytecodeGenerator):
2823         * bytecompiler/BytecodeGenerator.h:
2824         * dfg/DFGByteCodeParser.cpp:
2825         (JSC::DFG::ByteCodeParser::ByteCodeParser):
2826         (JSC::DFG::ByteCodeParser::addCall):
2827         (JSC::DFG::ByteCodeParser::dynamicallyPredict):
2828         (JSC::DFG::ByteCodeParser::parseBlock):
2829         (JSC::DFG::parse):
2830         * dfg/DFGDriver.cpp: Added.
2831         (JSC::DFG::compile):
2832         (JSC::DFG::tryCompile):
2833         (JSC::DFG::tryCompileFunction):
2834         * dfg/DFGDriver.h: Added.
2835         (JSC::DFG::tryCompile):
2836         (JSC::DFG::tryCompileFunction):
2837         * dfg/DFGGraph.cpp:
2838         (JSC::DFG::Graph::dump):
2839         (JSC::DFG::Graph::predictArgumentTypes):
2840         * dfg/DFGGraph.h:
2841         (JSC::DFG::Graph::predict):
2842         (JSC::DFG::Graph::predictGlobalVar):
2843         (JSC::DFG::Graph::isConstant):
2844         (JSC::DFG::Graph::isJSConstant):
2845         (JSC::DFG::Graph::isInt32Constant):
2846         (JSC::DFG::Graph::isDoubleConstant):
2847         (JSC::DFG::Graph::valueOfJSConstant):
2848         (JSC::DFG::Graph::valueOfInt32Constant):
2849         (JSC::DFG::Graph::valueOfDoubleConstant):
2850         * dfg/DFGJITCompiler.cpp:
2851         (JSC::DFG::JITCompiler::link):
2852         * dfg/DFGJITCompiler.h:
2853         (JSC::DFG::JITCompiler::isConstant):
2854         (JSC::DFG::JITCompiler::isJSConstant):
2855         (JSC::DFG::JITCompiler::isInt32Constant):
2856         (JSC::DFG::JITCompiler::isDoubleConstant):
2857         (JSC::DFG::JITCompiler::valueOfJSConstant):
2858         (JSC::DFG::JITCompiler::valueOfInt32Constant):
2859         (JSC::DFG::JITCompiler::valueOfDoubleConstant):
2860         * dfg/DFGNode.h:
2861         (JSC::DFG::isCellPrediction):
2862         (JSC::DFG::isNumberPrediction):
2863         (JSC::DFG::predictionToString):
2864         (JSC::DFG::mergePrediction):
2865         (JSC::DFG::makePrediction):
2866         (JSC::DFG::Node::valueOfJSConstant):
2867         (JSC::DFG::Node::isInt32Constant):
2868         (JSC::DFG::Node::isDoubleConstant):
2869         (JSC::DFG::Node::valueOfInt32Constant):
2870         (JSC::DFG::Node::valueOfDoubleConstant):
2871         (JSC::DFG::Node::predict):
2872         * dfg/DFGPropagation.cpp: Added.
2873         (JSC::DFG::Propagator::Propagator):
2874         (JSC::DFG::Propagator::fixpoint):
2875         (JSC::DFG::Propagator::setPrediction):
2876         (JSC::DFG::Propagator::mergePrediction):
2877         (JSC::DFG::Propagator::propagateNode):
2878         (JSC::DFG::Propagator::propagateForward):
2879         (JSC::DFG::Propagator::propagateBackward):
2880         (JSC::DFG::propagate):
2881         * dfg/DFGPropagation.h: Added.
2882         (JSC::DFG::propagate):
2883         * dfg/DFGRepatch.cpp:
2884         (JSC::DFG::dfgLinkFor):
2885         * heap/HandleHeap.h:
2886         (JSC::HandleHeap::Node::Node):
2887         * jit/JIT.cpp:
2888         (JSC::JIT::emitOptimizationCheck):
2889         (JSC::JIT::emitTimeoutCheck):
2890         (JSC::JIT::privateCompile):
2891         (JSC::JIT::linkFor):
2892         * jit/JIT.h:
2893         (JSC::JIT::emitOptimizationCheck):
2894         * jit/JITCall32_64.cpp:
2895         (JSC::JIT::emit_op_ret):
2896         (JSC::JIT::emit_op_ret_object_or_this):
2897         * jit/JITCode.h:
2898         (JSC::JITCode::JITCode):
2899         (JSC::JITCode::bottomTierJIT):
2900         (JSC::JITCode::topTierJIT):
2901         (JSC::JITCode::nextTierJIT):
2902         * jit/JITOpcodes.cpp:
2903         (JSC::JIT::emit_op_ret):
2904         (JSC::JIT::emit_op_ret_object_or_this):
2905         * jit/JITStubs.cpp:
2906         (JSC::DEFINE_STUB_FUNCTION):
2907         * jit/JITStubs.h:
2908         * runtime/Executable.cpp:
2909         (JSC::EvalExecutable::compileOptimized):
2910         (JSC::EvalExecutable::compileInternal):
2911         (JSC::ProgramExecutable::compileOptimized):
2912         (JSC::ProgramExecutable::compileInternal):
2913         (JSC::FunctionExecutable::compileOptimizedForCall):
2914         (JSC::FunctionExecutable::compileOptimizedForConstruct):
2915         (JSC::FunctionExecutable::compileForCallInternal):
2916         (JSC::FunctionExecutable::compileForConstructInternal):
2917         * runtime/Executable.h:
2918         (JSC::EvalExecutable::compile):
2919         (JSC::ProgramExecutable::compile):
2920         (JSC::FunctionExecutable::compileForCall):
2921         (JSC::FunctionExecutable::compileForConstruct):
2922         (JSC::FunctionExecutable::compileOptimizedFor):
2923         * wtf/Platform.h:
2924         * wtf/SentinelLinkedList.h:
2925         (WTF::BasicRawSentinelNode::BasicRawSentinelNode):
2926         (WTF::BasicRawSentinelNode::setPrev):
2927         (WTF::BasicRawSentinelNode::setNext):
2928         (WTF::BasicRawSentinelNode::prev):
2929         (WTF::BasicRawSentinelNode::next):
2930         (WTF::BasicRawSentinelNode::isOnList):
2931         (WTF::::remove):
2932         (WTF::::SentinelLinkedList):
2933         (WTF::::begin):
2934         (WTF::::end):
2935         (WTF::::push):
2936
2937 2011-09-05  Sheriff Bot  <webkit.review.bot@gmail.com>
2938
2939         Unreviewed, rolling out r94445 and r94448.
2940         http://trac.webkit.org/changeset/94445
2941         http://trac.webkit.org/changeset/94448
2942         https://bugs.webkit.org/show_bug.cgi?id=67595
2943
2944         It broke everything (Requested by ossy on #webkit).
2945
2946         * JavaScriptCore.exp:
2947         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2948         * heap/Heap.cpp:
2949         (JSC::Heap::collect):
2950         * heap/Heap.h:
2951         * heap/NewSpace.cpp:
2952         (JSC::NewSpace::NewSpace):
2953         * heap/NewSpace.h:
2954         * jit/JITStubs.cpp:
2955         (JSC::DEFINE_STUB_FUNCTION):
2956         * runtime/JSObject.cpp:
2957         (JSC::JSObject::allocatePropertyStorage):
2958         * runtime/JSObject.h:
2959         (JSC::JSObject::~JSObject):
2960         (JSC::JSObject::putDirectInternal):
2961         (JSC::JSObject::putDirectWithoutTransition):
2962         (JSC::JSObject::putDirectFunctionWithoutTransition):
2963         (JSC::JSObject::transitionTo):
2964         (JSC::JSObject::visitChildrenDirect):
2965
2966 2011-09-05  Patrick Gansterer  <paroga@webkit.org>
2967
2968         Unreviewed build fix for r94452.
2969
2970         Add config.h as the first header to the cc files as required by the coding style.
2971         Reuse macros from Assertions.h instead of adding addional #ifdefs.
2972
2973         * wtf/dtoa/bignum-dtoa.cc:
2974         * wtf/dtoa/bignum.cc:
2975         * wtf/dtoa/cached-powers.cc:
2976         * wtf/dtoa/diy-fp.cc:
2977         * wtf/dtoa/double-conversion.cc:
2978         * wtf/dtoa/fast-dtoa.cc:
2979         * wtf/dtoa/fixed-dtoa.cc:
2980         * wtf/dtoa/strtod.cc:
2981         * wtf/dtoa/utils.h:
2982
2983 2011-09-05  Andras Becsi  <andras.becsi@nokia.com>
2984
2985         [Qt][WK2] Fix the build
2986
2987         Rubber-stamped by Csaba Osztrogonác.
2988
2989         * wtf/dtoa/double-conversion.cc: Remove dead variable in file added in r94452.
2990         The variable fractional_part is only set but never used.
2991
2992 2011-09-04  Mark Hahnenberg  <mhahnenberg@apple.com>
2993
2994         REGRESSION (r94452): 20 http/tests tests failing on Qt Linux Release
2995         https://bugs.webkit.org/show_bug.cgi?id=67562
2996
2997         Reviewed by Darin Adler.
2998
2999         Fixing the build (again which was broken by the dtoa patch.  Needed
3000         to make sure WTF::double_conversion::initialize() is called for Qt
3001         as well as adding a check for WinCE in dtoa/utils.h
3002
3003         * runtime/InitializeThreading.cpp:
3004         (JSC::initializeThreadingOnce):
3005         * wtf/dtoa/cached-powers.cc:
3006         * wtf/dtoa/utils.h:
3007
3008 2011-09-03  Filip Pizlo  <fpizlo@apple.com>
3009
3010         ThunkGenerators does not convert positive double zero into integer zero
3011         https://bugs.webkit.org/show_bug.cgi?id=67553
3012
3013         Reviewed by Gavin Barraclough.
3014
3015         This is an 0.5% speed-up on V8 and neutral elsewhere.
3016
3017         * jit/SpecializedThunkJIT.h:
3018         (JSC::SpecializedThunkJIT::returnDouble):
3019
3020 2011-09-03  Kevin Ollivier  <kevino@theolliviers.com>
3021
3022         [wx] Unreviewed build fix. Add wtf/dtoa directory to build.
3023
3024         * wscript:
3025
3026 2011-09-03  Filip Pizlo  <fpizlo@apple.com>
3027
3028         DFG variable predictions only work for local variables, not temporaries
3029         https://bugs.webkit.org/show_bug.cgi?id=67554
3030
3031         Reviewed by Gavin Barraclough.
3032
3033         This appears to be a slight speed-up in Kraken (0.3% but significant)
3034         and neutral elsewhere.
3035
3036         * dfg/DFGGraph.h:
3037         (JSC::DFG::Graph::predict):
3038
3039 2011-09-02  Filip Pizlo  <fpizlo@apple.com>
3040
3041         DFG JIT speculation failure does recovery of additions in reverse and
3042         doesn't rebox
3043         https://bugs.webkit.org/show_bug.cgi?id=67551
3044
3045         Reviewed by Sam Weinig.
3046
3047         * dfg/DFGJITCompiler.cpp:
3048         (JSC::DFG::JITCompiler::jumpFromSpeculativeToNonSpeculative):
3049
3050 2011-09-02  Filip Pizlo  <fpizlo@apple.com>
3051
3052         ValueProfile does not make it safe to introspect cell values
3053         after garbage collection
3054         https://bugs.webkit.org/show_bug.cgi?id=67354
3055
3056         Reviewed by Gavin Barraclough.
3057
3058         ValueProfile buckets are now weak references, implemented using a
3059         light-weight weak reference mechanism that this patch also adds (the
3060         WeakReferenceHarvester).  If a cell stored in a ValueProfile bucket
3061         is not marked, then the bucket is transformed into a Structure
3062         pointer.  If the Structure is not marked either, then it is turned
3063         into a ClassInfo pointer.
3064
3065         * JavaScriptCore.xcodeproj/project.pbxproj:
3066         * bytecode/CodeBlock.cpp:
3067         (JSC::CodeBlock::~CodeBlock):
3068         (JSC::CodeBlock::visitAggregate):
3069         (JSC::CodeBlock::visitWeakReferences):
3070         * bytecode/CodeBlock.h:
3071         * bytecode/ValueProfile.h:
3072         (JSC::ValueProfile::ValueProfile):
3073         (JSC::ValueProfile::classInfo):
3074         (JSC::ValueProfile::numberOfInt32s):
3075         (JSC::ValueProfile::numberOfDoubles):
3076         (JSC::ValueProfile::numberOfCells):
3077         (JSC::ValueProfile::numberOfArrays):
3078         (JSC::ValueProfile::probabilityOfArray):
3079         (JSC::ValueProfile::WeakBucket::WeakBucket):
3080         (JSC::ValueProfile::WeakBucket::operator!):
3081         (JSC::ValueProfile::WeakBucket::isEmpty):
3082         (JSC::ValueProfile::WeakBucket::isClassInfo):
3083         (JSC::ValueProfile::WeakBucket::isStructure):
3084         (JSC::ValueProfile::WeakBucket::asStructure):
3085         (JSC::ValueProfile::WeakBucket::asClassInfo):
3086         (JSC::ValueProfile::WeakBucket::getClassInfo):
3087         * heap/Heap.cpp:
3088         (JSC::Heap::harvestWeakReferences):
3089         (JSC::Heap::markRoots):
3090         * heap/Heap.h:
3091         * heap/MarkStack.cpp:
3092         (JSC::SlotVisitor::drain):
3093         (JSC::SlotVisitor::harvestWeakReferences):
3094         * heap/MarkStack.h:
3095         (JSC::MarkStack::addWeakReferenceHarvester):
3096         (JSC::MarkStack::MarkStack):
3097         (JSC::MarkStack::appendUnbarrieredPointer):
3098         * heap/SlotVisitor.h:
3099         * heap/WeakReferenceHarvester.h: Added.
3100         (JSC::WeakReferenceHarvester::WeakReferenceHarvester):
3101         (JSC::WeakReferenceHarvester::~WeakReferenceHarvester):
3102
3103 2011-09-02  Michael Saboff  <msaboff@apple.com>
3104
3105         Replace local implementation of string equals() methods with UString versions
3106         https://bugs.webkit.org/show_bug.cgi?id=67342
3107
3108         In preparation to allowing StringImpl to be backed by 8 bit
3109         characters when appropriate, we need to eliminate or change the
3110         usage of StringImpl::characters(). Change the uses of characters()
3111         that are used to implement redundant equals() methods.
3112
3113         Reviewed by Gavin Barraclough.
3114
3115         * runtime/Identifier.cpp:
3116         (JSC::Identifier::equal):
3117         * runtime/Identifier.h:
3118         (JSC::Identifier::equal):
3119         * wtf/text/AtomicString.cpp:
3120         (WTF::CStringTranslator::equal): Moved an optimized method to here.
3121         (WTF::operator==):
3122         * wtf/text/StringImpl.cpp:
3123         (WTF::equal):
3124         * wtf/text/StringImpl.h:
3125
3126 2011-09-02  Michael Saboff  <msaboff@apple.com>
3127
3128         Add JSC:RegExp functional tests
3129         https://bugs.webkit.org/show_bug.cgi?id=67339
3130
3131         Added new test driver program (testRegExp) and corresponding data file
3132         along with build scripts changes.
3133
3134         Reviewed by Gavin Barraclough.
3135
3136         * JavaScriptCore.exp:
3137         * JavaScriptCore.xcodeproj/project.pbxproj:
3138         * testRegExp.cpp: Added.
3139         (Options::Options):
3140         (StopWatch::start):
3141         (StopWatch::stop):
3142         (StopWatch::getElapsedMS):
3143         (RegExpTest::RegExpTest):
3144         (GlobalObject::create):
3145         (GlobalObject::className):
3146         (GlobalObject::GlobalObject):
3147         (main):
3148         (cleanupGlobalData):
3149         (testOneRegExp):
3150         (scanString):
3151         (parseRegExpLine):
3152         (parseTestLine):
3153         (runFromFiles):
3154         (printUsageStatement):
3155         (parseArguments):
3156         (realMain):
3157         * tests/regexp: Added.
3158         * tests/regexp/RegExpTest.data: Added.
3159
3160 2011-09-02  Michael Saboff  <msaboff@apple.com>
3161
3162         Add JSC:RegExp functional test data generator
3163         https://bugs.webkit.org/show_bug.cgi?id=67519
3164
3165         Add a data generator for regular expressions.  To enable, change the
3166         #undef REGEXP_FUNC_TEST_DATA_GEN to #define.  Then compile and use
3167         regular expressions.  The resulting data will be in /tmp/RegExpTestsData.
3168
3169         Reviewed by Gavin Barraclough.
3170
3171         * runtime/RegExp.cpp:
3172         (JSC::regExpFlags):
3173         (JSC::RegExpFunctionalTestCollector::clearRegExp):
3174         (JSC::RegExpFunctionalTestCollector::get):
3175         (JSC::RegExpFunctionalTestCollector::outputOneTest):
3176         (JSC::RegExpFunctionalTestCollector::RegExpFunctionalTestCollector):
3177         (JSC::RegExpFunctionalTestCollector::~RegExpFunctionalTestCollector):
3178         (JSC::RegExpFunctionalTestCollector::outputEscapedUString):
3179         (JSC::RegExp::~RegExp):
3180         (JSC::RegExp::compile):
3181         (JSC::RegExp::match):
3182         (JSC::RegExp::matchCompareWithInterpreter):
3183
3184 2011-09-02  Mark Hahnenberg  <mhahnenberg@apple.com>
3185
3186         Fix the broken build due to dtoa patch
3187         https://bugs.webkit.org/show_bug.cgi?id=67534
3188
3189         Reviewed by Oliver Hunt.
3190
3191         Fixing the build.
3192
3193         * GNUmakefile.list.am:
3194         * wtf/dtoa/bignum.cc:
3195         * wtf/dtoa/fast-dtoa.cc:
3196         * wtf/dtoa/utils.h:
3197
3198 2011-09-02  Oliver Hunt  <oliver@apple.com>
3199
3200         Remove OldSpace classes
3201         https://bugs.webkit.org/show_bug.cgi?id=67533
3202
3203         Reviewed by Gavin Barraclough.
3204
3205         Remove the unused OldSpace classes
3206
3207         * CMakeLists.txt:
3208         * GNUmakefile.list.am:
3209         * JavaScriptCore.gypi:
3210         * JavaScriptCore.pro:
3211         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3212         * JavaScriptCore.xcodeproj/project.pbxproj:
3213         * heap/Heap.cpp:
3214         (JSC::Heap::writeBarrierSlowCase):
3215         * heap/MarkedBlock.h:
3216         * heap/OldSpace.cpp: Removed.
3217         * heap/OldSpace.h: Removed.
3218
3219 2011-09-02  James Robinson  <jamesr@chromium.org>
3220
3221         Compile fix for mac build.
3222
3223         * wtf/CheckedArithmetic.h:
3224         (WTF::operator+):
3225         (WTF::operator-):
3226         (WTF::operator*):
3227
3228 2011-08-30  Matthew Delaney  <mdelaney@apple.com>
3229
3230         Read out of bounds in sUnpremultiplyData_RGBA8888 / ImageBufferData::getData
3231         https://bugs.webkit.org/show_bug.cgi?id=65352
3232
3233         Reviewed by Simon Fraser.
3234
3235         New test: fast/canvas/canvas-getImageData-large-crash.html
3236
3237         This patch prevents overflows from happening in getImageData, createImageData, and canvas creation
3238         calls that specify widths and heights that end up overflowing the ints that we store those values in
3239         as well as derived values such as area and maxX / maxY of the bounding rects involved. Overflow of integer
3240         arithmetic is detected via the use of the new Checked type that was introduced in r94207. The change to JSC
3241         is just to add a new helper method described below.
3242
3243         * wtf/MathExtras.h:
3244         (isWithinIntRange): Reports if a float's value is within the range expressible by an int.
3245
3246 2011-09-02  Mark Hahnenberg  <mhahnenberg@apple.com>
3247
3248         Incorporate newer, faster dtoa library
3249         https://bugs.webkit.org/show_bug.cgi?id=66346
3250
3251         Reviewed by Oliver Hunt.
3252
3253         Added new dtoa library at http://code.google.com/p/double-conversion/.
3254         Replaced old call to dtoa.  The new library is much faster than the old one.
3255         We still use the old dtoa for some stuff in WebCore as well as the old strtod,
3256         but we can phase these out eventually as well.
3257
3258         * GNUmakefile.list.am:
3259         * JavaScriptCore.exp:
3260         * JavaScriptCore.gypi:
3261         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3262         * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
3263         * JavaScriptCore.vcproj/WTF/WTF.vcproj:
3264         * JavaScriptCore.xcodeproj/project.pbxproj:
3265         * runtime/InitializeThreading.cpp:
3266         * runtime/NumberPrototype.cpp:
3267         (JSC::numberProtoFuncToExponential):
3268         (JSC::numberProtoFuncToFixed):
3269         (JSC::numberProtoFuncToPrecision):
3270         * runtime/UString.cpp:
3271         (JSC::UString::number):
3272         * wtf/CMakeLists.txt:
3273         * wtf/ThreadingPthreads.cpp:
3274         (WTF::initializeThreading):
3275         * wtf/ThreadingWin.cpp:
3276         (WTF::initializeThreading):
3277         * wtf/dtoa.cpp:
3278         (WTF::dtoa):
3279         * wtf/dtoa.h:
3280         * wtf/dtoa/COPYING: Added.
3281         * wtf/dtoa/LICENSE: Added.
3282         * wtf/dtoa/README: Added.
3283         * wtf/dtoa/bignum-dtoa.cc: Added.
3284         * wtf/dtoa/bignum-dtoa.h: Added.
3285         * wtf/dtoa/bignum.cc: Added.
3286         * wtf/dtoa/bignum.h: Added.
3287         (WTF::double_conversion::Bignum::Times10):
3288         (WTF::double_conversion::Bignum::Equal):
3289         (WTF::double_conversion::Bignum::LessEqual):
3290         (WTF::double_conversion::Bignum::Less):
3291         (WTF::double_conversion::Bignum::PlusEqual):
3292         (WTF::double_conversion::Bignum::PlusLessEqual):
3293         (WTF::double_conversion::Bignum::PlusLess):
3294         (WTF::double_conversion::Bignum::EnsureCapacity):
3295         (WTF::double_conversion::Bignum::BigitLength):
3296         * wtf/dtoa/cached-powers.cc: Added.
3297         * wtf/dtoa/cached-powers.h: Added.
3298         * wtf/dtoa/diy-fp.cc: Added.
3299         * wtf/dtoa/diy-fp.h: Added.
3300         (WTF::double_conversion::DiyFp::DiyFp):
3301         (WTF::double_conversion::DiyFp::Subtract):
3302         (WTF::double_conversion::DiyFp::Minus):
3303         (WTF::double_conversion::DiyFp::Times):
3304         (WTF::double_conversion::DiyFp::Normalize):
3305         (WTF::double_conversion::DiyFp::f):
3306         (WTF::double_conversion::DiyFp::e):
3307         (WTF::double_conversion::DiyFp::set_f):
3308         (WTF::double_conversion::DiyFp::set_e):
3309         * wtf/dtoa/double-conversion.cc: Added.
3310         * wtf/dtoa/double-conversion.h: Added.
3311         (WTF::double_conversion::DoubleToStringConverter::DoubleToStringConverter):
3312         (WTF::double_conversion::StringToDoubleConverter::StringToDoubleConverter):
3313         * wtf/dtoa/double.h: Added.
3314         (WTF::double_conversion::double_to_uint64):
3315         (WTF::double_conversion::uint64_to_double):
3316         (WTF::double_conversion::Double::Double):
3317         (WTF::double_conversion::Double::AsDiyFp):
3318         (WTF::double_conversion::Double::AsNormalizedDiyFp):
3319         (WTF::double_conversion::Double::AsUint64):
3320         (WTF::double_conversion::Double::NextDouble):
3321         (WTF::double_conversion::Double::Exponent):
3322         (WTF::double_conversion::Double::Significand):
3323         (WTF::double_conversion::Double::IsDenormal):
3324         (WTF::double_conversion::Double::IsSpecial):
3325         (WTF::double_conversion::Double::IsNan):
3326         (WTF::double_conversion::Double::IsInfinite):
3327         (WTF::double_conversion::Double::Sign):
3328         (WTF::double_conversion::Double::UpperBoundary):
3329         (WTF::double_conversion::Double::NormalizedBoundaries):
3330         (WTF::double_conversion::Double::value):
3331         (WTF::double_conversion::Double::SignificandSizeForOrderOfMagnitude):
3332         (WTF::double_conversion::Double::Infinity):
3333         (WTF::double_conversion::Double::NaN):
3334         (WTF::double_conversion::Double::DiyFpToUint64):
3335         * wtf/dtoa/fast-dtoa.cc: Added.
3336         * wtf/dtoa/fast-dtoa.h: Added.
3337         * wtf/dtoa/fixed-dtoa.cc: Added.
3338         * wtf/dtoa/fixed-dtoa.h: Added.
3339         * wtf/dtoa/strtod.cc: Added.
3340         * wtf/dtoa/strtod.h: Added.
3341         * wtf/dtoa/utils.h: Added.
3342         (WTF::double_conversion::Max):
3343         (WTF::double_conversion::Min):
3344         (WTF::double_conversion::StrLength):
3345         (WTF::double_conversion::Vector::Vector):
3346         (WTF::double_conversion::Vector::SubVector):
3347         (WTF::double_conversion::Vector::length):
3348         (WTF::double_conversion::Vector::is_empty):
3349         (WTF::double_conversion::Vector::start):
3350         (WTF::double_conversion::Vector::operator[]):
3351         (WTF::double_conversion::Vector::first):
3352         (WTF::double_conversion::Vector::last):
3353         (WTF::double_conversion::StringBuilder::StringBuilder):
3354         (WTF::double_conversion::StringBuilder::~StringBuilder):
3355         (WTF::double_conversion::StringBuilder::size):
3356         (WTF::double_conversion::StringBuilder::position):
3357         (WTF::double_conversion::StringBuilder::Reset):
3358         (WTF::double_conversion::StringBuilder::AddCharacter):
3359         (WTF::double_conversion::StringBuilder::AddString):
3360         (WTF::double_conversion::StringBuilder::AddSubstring):
3361         (WTF::double_conversion::StringBuilder::AddPadding):
3362         (WTF::double_conversion::StringBuilder::Finalize):
3363         (WTF::double_conversion::StringBuilder::is_finalized):
3364         (WTF::double_conversion::BitCast):
3365         * wtf/wtf.pri:
3366
3367 2011-09-02  Filip Pizlo  <fpizlo@apple.com>
3368
3369         DFG graph has no way of distinguishing or reconciling between static
3370         and dynamic predictions
3371         https://bugs.webkit.org/show_bug.cgi?id=67343
3372
3373         Reviewed by Gavin Barraclough.
3374
3375         PredictedType now stores the source of the prediction.  Merging predictions,
3376         which was previously done with a bitwise or, is now done via the
3377         mergePredictions (equivalent to |) and mergePrediction (equivalent to |=)
3378         functions, which correctly handle combinations of static and dynamic.
3379
3380         This is performance-neutral, since all predictions are currently static and
3381         so the code has no visible effects.
3382
3383         * dfg/DFGByteCodeParser.cpp:
3384         (JSC::DFG::ByteCodeParser::set):
3385         (JSC::DFG::ByteCodeParser::staticallyPredictArray):
3386         (JSC::DFG::ByteCodeParser::staticallyPredictInt32):
3387         (JSC::DFG::ByteCodeParser::parseBlock):
3388         * dfg/DFGGraph.h:
3389         (JSC::DFG::Graph::predict):
3390         (JSC::DFG::Graph::predictGlobalVar):
3391         * dfg/DFGNode.h:
3392         (JSC::DFG::isArrayPrediction):
3393         (JSC::DFG::isInt32Prediction):
3394         (JSC::DFG::isDoublePrediction):
3395         (JSC::DFG::isDynamicPrediction):
3396         (JSC::DFG::mergePredictions):
3397         (JSC::DFG::mergePrediction):
3398         (JSC::DFG::makePrediction):
3399         (JSC::DFG::Node::predict):
3400
3401 2011-09-02  Oliver Hunt  <oliver@apple.com>
3402
3403         Fix 32bit build.
3404
3405         * heap/NewSpace.h:
3406         (JSC::NewSpace::allocatePropertyStorage):
3407         (JSC::NewSpace::inPropertyStorageNursery):
3408
3409 2011-09-02  Oliver Hunt  <oliver@apple.com>
3410
3411         Use bump allocator for initial property storage
3412         https://bugs.webkit.org/show_bug.cgi?id=67494
3413
3414         Reviewed by Gavin Barraclough.
3415
3416         Switch to a bump allocator for the initial out of line
3417         property storage.  This gives us slightly faster allocation
3418         for short lived objects that need out of line storage at
3419         the cost of an additional memcpy when the object survives
3420         a GC pass.
3421
3422         No performance impact.
3423
3424         * JavaScriptCore.exp:
3425         * heap/Heap.cpp:
3426         (JSC::Heap::collect):
3427         * heap/Heap.h:
3428         (JSC::Heap::allocatePropertyStorage):
3429         (JSC::Heap::inPropertyStorageNursary):
3430         * heap/NewSpace.cpp:
3431         (JSC::NewSpace::NewSpace):
3432         * heap/NewSpace.h:
3433         (JSC::NewSpace::resetPropertyStorageNursary):
3434         (JSC::NewSpace::allocatePropertyStorage):
3435         (JSC::NewSpace::inPropertyStorageNursary):
3436         * jit/JITStubs.cpp:
3437         (JSC::DEFINE_STUB_FUNCTION):
3438         * runtime/JSObject.cpp:
3439         (JSC::JSObject::allocatePropertyStorage):
3440         * runtime/JSObject.h:
3441         (JSC::JSObject::~JSObject):
3442         (JSC::JSObject::putDirectInternal):
3443         (JSC::JSObject::putDirectWithoutTransition):
3444         (JSC::JSObject::putDirectFunctionWithoutTransition):
3445         (JSC::JSObject::transitionTo):
3446         (JSC::JSObject::visitChildrenDirect):
3447
3448 2011-09-01  Mark Rowe  <mrowe@apple.com>
3449
3450         Fix the build.
3451
3452         * JavaScriptCore.JSVALUE32_64only.exp:
3453         * JavaScriptCore.JSVALUE64only.exp:
3454         * JavaScriptCore.exp:
3455
3456 2011-09-01  Mark Hahnenberg  <mhahnenberg@apple.com>
3457
3458         Unzip initialization lists and constructors in JSCell hierarchy (4/7)
3459         https://bugs.webkit.org/show_bug.cgi?id=67174
3460
3461         Reviewed by Oliver Hunt.
3462
3463         Completed the fourth level of the refactoring to add finishCreation()
3464         methods to all classes within the JSCell hierarchy with non-trivial
3465         constructor bodies.
3466
3467         This primarily consists of pushing the calls to finishCreation() down
3468         into the constructors of the subclasses of the second level of the hierarchy
3469         as well as pulling the finishCreation() calls out into the class's corresponding
3470         create() method if it has one.  Doing both simultaneously allows us to
3471         maintain the invariant that the finishCreation() method chain is called exactly
3472         once during the creation of an object, since calling it any other number of
3473         times (0, 2, or more) will cause an assertion failure.
3474
3475         * API/JSCallbackConstructor.cpp:
3476         (JSC::JSCallbackConstructor::JSCallbackConstructor):
3477         (JSC::JSCallbackConstructor::finishCreation):
3478         * API/JSCallbackConstructor.h:
3479         * API/JSCallbackObject.h:
3480         (JSC::JSCallbackObject::create):
3481         * API/JSCallbackObjectFunctions.h:
3482         (JSC::::JSCallbackObject):
3483         (JSC::::finishCreation):
3484         * JavaScriptCore.JSVALUE64only.exp:
3485         * JavaScriptCore.exp:
3486         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3487         * debugger/DebuggerActivation.cpp:
3488         (JSC::DebuggerActivation::DebuggerActivation):
3489         (JSC::DebuggerActivation::create):
3490         * debugger/DebuggerActivation.h:
3491         * runtime/Arguments.h:
3492         (JSC::Arguments::create):
3493         (JSC::Arguments::createNoParameters):
3494         (JSC::Arguments::Arguments):
3495         * runtime/ArrayPrototype.cpp:
3496         (JSC::ArrayPrototype::ArrayPrototype):
3497         (JSC::ArrayPrototype::finishCreation):
3498         * runtime/ArrayPrototype.h: