ChangeLog-2013-04-24

   1 2013-04-23  Filip Pizlo  <fpizlo@apple.com>
   2
   3         DFG CFA filters CheckFunction in a really weird way, and assumes that the function's structure won't change
   4         https://bugs.webkit.org/show_bug.cgi?id=115077
   5
   6         Reviewed by Oliver Hunt.
   7
   8         The filtering did three things that are unusual:
   9
  10         1) AbstractValue::filterByValue() assumed that the passed value's structure wouldn't change, in
  11            the sense that at it assumed it could use that value's *current* structure to do structure
  12            filtering. Filtering by structure only makes sense if you can prove that the given value will
  13            always have that structure (for example by either using a watchpoing or emitting code that
  14            checks that structure at run-time).
  15
  16         2) AbstractValue::filterByValue() and the CheckFunction case in AbstractState::executeEffects()
  17            tried to invalidate the CFA based on whether the filtration led to an empty value. This is
  18            well-intentioned, but it's not how the CFA currently works. It's inconsistent with other
  19            parts of the CFA. We shouldn't introduce this feature into just one kind of filtration and
  20            not have it elsewhere.
  21
  22         3) The attempt to detect when the value was empty was actually implemented incorrectly. It
  23            relied on AbstractValue::validate(). That method says that a concrete value does not belong
  24            to the abstract value if it has a different structure. This makes sense for the other place
  25            where AbstractValue::validate() is called: during OSR entry, where we are talking about a
  26            JSValue that we see *right now*. It doesn't make sense in the CFA, since in the CFA any
  27            value we observe in the code is a value whose structure may change when the code starts
  28            running, and so we cannot use the value's current structure to infer things about the code
  29            when it starts running.
  30
  31         I fixed the above problems by (1) changing filterByValue() to not filter the structure, (2)
  32         changing filterByValue() and the CheckFunction case to not invalidate the CFA, and (3)
  33         making sure that nobody else was misusing AbstractValue::validate() (they weren't).
  34
  35         * dfg/DFGAbstractState.cpp:
  36         (JSC::DFG::AbstractState::executeEffects):
  37         * dfg/DFGAbstractValue.h:
  38         (JSC::DFG::AbstractValue::filterByValue):
  39
  40 2013-04-23  Oliver Hunt  <oliver@apple.com>
  41
  42         Default ParserError() initialiser doesn't initialise all fields
  43         https://bugs.webkit.org/show_bug.cgi?id=115074
  44
  45         Reviewed by Joseph Pecoraro.
  46
  47         Only the jsc command prompt depended on this, but we'll fix it to
  48         be on the safe side.
  49
  50         * parser/ParserError.h:
  51         (JSC::ParserError::ParserError):
  52
  53 2013-04-23  Christophe Dumez  <ch.dumez@sisa.samsung.com>
  54
  55         Global constructors should be configurable and not enumerable
  56         https://bugs.webkit.org/show_bug.cgi?id=110573
  57
  58         Reviewed by Geoffrey Garen.
  59
  60         Update JSObject::deleteProperty() so that mark to set the property
  61         value to undefined if it is in static hashtable of properties. The
  62         previous code was not doing anything in this case and this meant
  63         we could not remove builtin DOMWindow properties such as
  64         "ProgressEvent" even if marked as Deletable.
  65
  66         * runtime/JSObject.cpp:
  67         (JSC::JSObject::deleteProperty):
  68         * runtime/Lookup.h:
  69         (JSC):
  70         (JSC::putEntry):
  71         (JSC::lookupPut):
  72
  73 2013-04-23  Geoffrey Garen  <ggaren@apple.com>
  74
  75         Filled out more cases of branch folding in bytecode when emitting
  76         expressions into a branching context
  77         https://bugs.webkit.org/show_bug.cgi?id=115057
  78
  79         Reviewed by Filip Pizlo.
  80
  81         This covers a few cases like:
  82
  83             - while (true) { }
  84             - while (1) { }
  85             - if (x) break;
  86             - if (x) continue;
  87             - if (boolean_expr == boolean_const) { }
  88             - if (boolean_expr == 1_or_0) { }
  89             - if (bitop == 1_or_0) { }
  90
  91         This also works, but will bring shame on your family:
  92
  93             - while ("hello world") { }
  94
  95         No change on the benchmarks we track, but a 2.5X speedup on a microbenchmark
  96         that uses these techniques.
  97
  98         * JavaScriptCore.order: Order!
  99
 100         * bytecompiler/BytecodeGenerator.cpp:
 101         (JSC::BytecodeGenerator::emitNewArray):
 102         (JSC::BytecodeGenerator::emitThrowReferenceError):
 103         (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
 104         * bytecompiler/BytecodeGenerator.h:
 105         (JSC::BytecodeGenerator::shouldEmitDebugHooks): Updated ancillary code
 106         for interface simplifications.
 107
 108         * bytecompiler/NodesCodegen.cpp:
 109         (JSC::ConstantNode::emitBytecodeInConditionContext): Constants can
 110         jump unconditionally when used within a condition context.
 111
 112         (JSC::ConstantNode::emitBytecode):
 113         (JSC::StringNode::jsValue): Gave constants a common base class so I
 114         could implement their codegen just once.
 115
 116         (JSC::BinaryOpNode::emitBytecodeInConditionContext):
 117         (JSC::canFoldToBranch):
 118         (JSC::BinaryOpNode::tryFoldToBranch): Fold (!/=)= and (!/=)== where
 119         appropriate. A lot of cases are not appropriate because of the surprising
 120         type conversion semantics of ==. For example, if (number == true) { } is
 121         not the same as if (number) { } because the former will up-convert true
 122         to number and then do numeric comparison.
 123
 124         (JSC::singleStatement):
 125         (JSC::IfElseNode::tryFoldBreakAndContinue):
 126         (JSC::IfElseNode::emitBytecode):
 127         (JSC::ContinueNode::trivialTarget):
 128         (JSC::BreakNode::trivialTarget): Fold "if (expression) break" and
 129         "if (expression) continue" into direct jumps from expression.
 130
 131         * parser/ASTBuilder.h:
 132         (ASTBuilder):
 133         (JSC::ASTBuilder::createIfStatement):
 134         * parser/NodeConstructors.h:
 135         (JSC::ConstantNode::ConstantNode):
 136         (JSC):
 137         (JSC::NullNode::NullNode):
 138         (JSC::BooleanNode::BooleanNode):
 139         (JSC::NumberNode::NumberNode):
 140         (JSC::StringNode::StringNode):
 141         (JSC::IfElseNode::IfElseNode):
 142         * parser/Nodes.h:
 143         (JSC::ExpressionNode::isConstant):
 144         (JSC::ExpressionNode::isBoolean):
 145         (JSC::StatementNode::isBreak):
 146         (JSC::StatementNode::isContinue):
 147         (ConstantNode):
 148         (JSC::ConstantNode::isPure):
 149         (JSC::ConstantNode::isConstant):
 150         (NullNode):
 151         (JSC::NullNode::jsValue):
 152         (JSC::BooleanNode::value):
 153         (JSC::BooleanNode::isBoolean):
 154         (JSC::BooleanNode::jsValue):
 155         (JSC::NumberNode::value):
 156         (NumberNode):
 157         (JSC::NumberNode::jsValue):
 158         (StringNode):
 159         (BinaryOpNode):
 160         (IfElseNode):
 161         (ContinueNode):
 162         (JSC::ContinueNode::isContinue):
 163         (BreakNode):
 164         (JSC::BreakNode::isBreak):
 165         * parser/Parser.cpp:
 166         (JSC::::parseIfStatement):
 167         * parser/ResultType.h:
 168         (JSC::ResultType::definitelyIsBoolean):
 169         (ResultType):
 170         * runtime/JSCJSValueInlines.h:
 171         (JSC::JSValue::pureToBoolean):
 172         * runtime/JSCell.h:
 173         * runtime/JSCellInlines.h:
 174         (JSC::JSCell::pureToBoolean): Updated for interface changes above.
 175
 176 2013-04-23  Mark Lam  <mark.lam@apple.com>
 177
 178         Simplify the baseline JIT loop hint call site.
 179         https://bugs.webkit.org/show_bug.cgi?id=115052.
 180
 181         Reviewed by Geoffrey Garen.
 182
 183         Moved the watchdog timer check after the JIT optimization check. This
 184         ensures that the JIT opimization counter is incremented on every loop
 185         hint even if the watchdog timer fires.
 186
 187         Removed the code that allows the JIT OSR to happen if the watchdog
 188         timer fires but does not result in a termination. It is extremely rare
 189         that the JIT optimization counter would trigger an OSR on the same pass
 190         as when the watchdog timer fire. If it does happen, we'll simply hold
 191         off on servicing the watchdog timer until the next pass (because it's
 192         not time critical).
 193
 194         * jit/JITOpcodes.cpp:
 195         (JSC::JIT::emit_op_loop_hint):
 196         (JSC::JIT::emitSlow_op_loop_hint):
 197
 198 2013-04-23  Roger Fong  <roger_fong@apple.com>
 199
 200         AppleWin build fix.
 201
 202         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
 203
 204 2013-04-18  Mark Hahnenberg  <mhahnenberg@apple.com>
 205
 206         Objective-C API: Update public header documentation
 207         https://bugs.webkit.org/show_bug.cgi?id=114841
 208
 209         Reviewed by Geoffrey Garen.
 210
 211         Added documentation for the newly added object lifetime-related stuff.
 212
 213         * API/JSManagedValue.h:
 214         * API/JSVirtualMachine.h:
 215
 216 2013-04-22  Mark Lam  <mark.lam@apple.com>
 217
 218         Fix a typo in MacroAssemblerARMv7.h.
 219         https://bugs.webkit.org/show_bug.cgi?id=115011.
 220
 221         Reviewed by Geoffrey Garen.
 222
 223         * assembler/ARMAssembler.h: Fix a comment.
 224         * assembler/ARMv7Assembler.h: Added some comments.
 225         * assembler/MacroAssemblerARMv7.h:
 226           - ARMAssembler::PL should be ARMv7Assembler::ConditionPL.
 227
 228 2013-04-22  Julien Brianceau  <jbrianceau@nds.com>
 229
 230         Add branchAdd32 missing implementation in SH4 base JIT.
 231         This should fix SH4 build, broken since r148893.
 232         https://bugs.webkit.org/show_bug.cgi?id=114993.
 233
 234         Reviewed by Oliver Hunt.
 235
 236         * assembler/MacroAssemblerSH4.h:
 237         (JSC::MacroAssemblerSH4::branchAdd32):
 238         (MacroAssemblerSH4):
 239
 240 2013-04-22  Benjamin Poulain  <bpoulain@apple.com>
 241
 242         Windows build fix after r148921
 243
 244         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
 245         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
 246
 247 2013-04-22  Benjamin Poulain  <benjamin@webkit.org>
 248
 249         Remove the memory instrumentation code
 250         https://bugs.webkit.org/show_bug.cgi?id=114931
 251
 252         Reviewed by Andreas Kling.
 253
 254         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
 255         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
 256
 257 2013-04-22  Mark Lam  <mark.lam@apple.com>
 258
 259         Fix broken 32-bit build to green the bots.
 260         https://bugs.webkit.org/show_bug.cgi?id=114968.
 261
 262         Unreviewed.
 263
 264         Basically, I moved a JIT::emit_op_loop_hint() and JIT::emitSlow_op_loop_hint()
 265         into common code where they belong, instead of the 64-bit specific section.
 266
 267         Also fixed some SH4 assertions failures which were also caused by
 268         https://bugs.webkit.org/show_bug.cgi?id=114963. Thanks to Julien Brianceau
 269         for pointing this out.
 270
 271         * assembler/MacroAssemblerSH4.h:
 272         (JSC::MacroAssemblerSH4::branchAdd32):
 273         * jit/JITOpcodes.cpp:
 274         (JSC):
 275         (JSC::JIT::emit_op_loop_hint):
 276         (JSC::JIT::emitSlow_op_loop_hint):
 277
 278 2013-04-22  Oliver Hunt  <oliver@apple.com>
 279
 280         Perform null check before trying to use the result of readline()
 281
 282         RS=Gavin
 283
 284         * jsc.cpp:
 285         (runInteractive):
 286
 287 2013-04-22  Oliver Hunt  <oliver@apple.com>
 288
 289         Fix assertions to account for new Vector layout
 290
 291         RS=Gavin
 292
 293         * llint/LLIntData.cpp:
 294         (JSC::LLInt::Data::performAssertions):
 295
 296 2013-04-22  Mark Lam  <mark.lam@apple.com>
 297
 298         Change baseline JIT watchdog timer check to use the proper fast slow path
 299         infrastructure.
 300         https://bugs.webkit.org/show_bug.cgi?id=114963.
 301
 302         Reviewed by Oliver Hunt.
 303
 304         Edit: The PositiveOrZero condition is added because it is needed for
 305         the JIT optimization check. Previously, the JIT check branches around
 306         the slow path if the test result is 'Signed' i.e. negative. Since we
 307         now need to test for a condition that branches to the slow path (not
 308         around it), we need the complement of 'Signed / Negative' i.e. Positive
 309         or zero.
 310
 311         SH4 parts contributed by Julien Brianceau.
 312
 313         * assembler/ARMAssembler.h:
 314         * assembler/MacroAssemblerARM.h:
 315         * assembler/MacroAssemblerARMv7.h:
 316         * assembler/MacroAssemblerMIPS.h:
 317         (JSC::MacroAssemblerMIPS::branchAdd32):
 318         * assembler/MacroAssemblerSH4.h:
 319         (JSC::MacroAssemblerSH4::branchAdd32):
 320         * assembler/MacroAssemblerX86Common.h:
 321         * assembler/SH4Assembler.h:
 322         * jit/JIT.cpp:
 323         (JSC::JIT::emitEnterOptimizationCheck):
 324         (JSC::JIT::privateCompileSlowCases):
 325         * jit/JIT.h:
 326         (JSC::JIT::emitEnterOptimizationCheck):
 327         * jit/JITOpcodes.cpp:
 328         (JSC::JIT::emit_op_loop_hint):
 329         (JSC::JIT::emitSlow_op_loop_hint):
 330         (JSC::JIT::emit_op_enter):
 331         * jit/JITOpcodes32_64.cpp:
 332         (JSC::JIT::emit_op_enter):
 333
 334 2013-04-22  Andreas Kling  <akling@apple.com>
 335
 336         Shrink baseline size of WTF::Vector on 64-bit by switching to unsigned capacity and size.
 337         <http://webkit.org/b/97268>
 338         <rdar://problem/12376519>
 339
 340         Reviewed by Sam Weinig.
 341
 342         Update LLInt WTF::Vector offset constants to match the new memory layout.
 343
 344         * llint/LowLevelInterpreter.asm:
 345
 346 2013-04-21  Oliver Hunt  <oliver@apple.com>
 347
 348         JS Lexer and Parser should be more informative when they encounter errors
 349         https://bugs.webkit.org/show_bug.cgi?id=114924
 350
 351         Reviewed by Filip Pizlo.
 352
 353         Add new tokens to represent the various ways that parsing and lexing have failed.
 354         This gives us the ability to produce better error messages in some cases,
 355         and to indicate whether or not the failure was due to invalid source, or simply
 356         early termination.
 357
 358         The jsc prompt now makes use of this so that you can write functions that
 359         are more than one line long.
 360
 361         * bytecompiler/BytecodeGenerator.cpp:
 362         (JSC::BytecodeGenerator::generate):
 363         * jsc.cpp:
 364         (stringFromUTF):
 365         (jscSource):
 366         (runInteractive):
 367         * parser/Lexer.cpp:
 368         (JSC::::parseFourDigitUnicodeHex):
 369         (JSC::::parseIdentifierSlowCase):
 370         (JSC::::parseString):
 371         (JSC::::parseStringSlowCase):
 372         (JSC::::lex):
 373         * parser/Lexer.h:
 374         (UnicodeHexValue):
 375         (JSC::Lexer::UnicodeHexValue::UnicodeHexValue):
 376         (JSC::Lexer::UnicodeHexValue::valueType):
 377         (JSC::Lexer::UnicodeHexValue::isValid):
 378         (JSC::Lexer::UnicodeHexValue::value):
 379         (Lexer):
 380         * parser/Parser.h:
 381         (JSC::Parser::getTokenName):
 382         (JSC::Parser::updateErrorMessageSpecialCase):
 383         (JSC::::parse):
 384         * parser/ParserError.h:
 385         (ParserError):
 386         (JSC::ParserError::ParserError):
 387         * parser/ParserTokens.h:
 388         * runtime/Completion.cpp:
 389         (JSC):
 390         (JSC::checkSyntax):
 391         * runtime/Completion.h:
 392         (JSC):
 393
 394 2013-04-21  Mark Lam  <mark.lam@apple.com>
 395
 396         Refactor identical inline functions in JSVALUE64 and JSVALUE32_64 sections
 397         out into the common section.
 398         https://bugs.webkit.org/show_bug.cgi?id=114910.
 399
 400         Reviewed by Filip Pizlo.
 401
 402         * dfg/DFGSpeculativeJIT.h:
 403         (SpeculativeJIT):
 404         (JSC::DFG::SpeculativeJIT::callOperation):
 405
 406 2013-04-20  Allan Sandfeld Jensen  <allan.jensen@digia.com>
 407
 408         LLint should be able to use x87 instead of SSE for floating pointer
 409         https://bugs.webkit.org/show_bug.cgi?id=112239
 410
 411         Reviewed by Filip Pizlo.
 412
 413         Implements LLInt floating point operations in x87, to ensure we support
 414         x86 without SSE2.
 415
 416         X86 (except 64bit) now defaults to using x87 instructions in order to
 417         support all 32bit x86 back to i686. The implementation uses the fucomi
 418         instruction from i686 which sets the new minimum.
 419
 420         The FPU registers must always be empty on entering or exiting a function.
 421         We make sure to only use two X87 registers, and they are always emptied
 422         before calling deeper functions or returning from the LLInt.
 423
 424         * jit/JITStubs.cpp:
 425         (JSC): Empty FPU registers before exiting.
 426         * llint/LowLevelInterpreter32_64.asm:
 427         * llint/LowLevelInterpreter64.asm:
 428         * offlineasm/instructions.rb:
 429         * offlineasm/x86.rb:
 430
 431 2013-04-19  Roger Fong  <roger_fong@apple.com>
 432
 433         Remove uses of WebKit_Source from AppleWin build in JavaScriptCore.
 434
 435         * JavaScriptCore.vcxproj/JavaScriptCore.make:
 436         * JavaScriptCore.vcxproj/build-generated-files.sh:
 437         * JavaScriptCore.vcxproj/copy-files.cmd:
 438         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
 439
 440 2013-04-19  Benjamin Poulain  <bpoulain@apple.com>
 441
 442         Rename JSStringJoiner::build() to join()
 443         https://bugs.webkit.org/show_bug.cgi?id=114845
 444
 445         Reviewed by Geoffrey Garen.
 446
 447         The method name build() came from StringBuilder history. It does not make much
 448         sense on the StringJoiner.
 449
 450         * runtime/ArrayPrototype.cpp:
 451         (JSC::arrayProtoFuncToString):
 452         (JSC::arrayProtoFuncToLocaleString):
 453         (JSC::arrayProtoFuncJoin):
 454         * runtime/JSStringJoiner.cpp:
 455         (JSC::JSStringJoiner::join):
 456         * runtime/JSStringJoiner.h:
 457         (JSStringJoiner):
 458
 459 2013-04-19  Roger Fong  <roger_fong@apple.com>
 460
 461         Unreviewed. WebKit_Source is incorrectly set.
 462
 463         * JavaScriptCore.vcxproj/JavaScriptCore.make:
 464
 465 2013-04-19  Martin Robinson  <mrobinson@igalia.com>
 466
 467         [GTK] JSCore.gir.in has a few problems
 468         https://bugs.webkit.org/show_bug.cgi?id=114710
 469
 470         Reviewed by Philippe Normand.
 471
 472         * GNUmakefile.am: Add the gobject introspection steps for JavaScriptCore here,
 473         because they are shared between WebKit1 and WebKit2.
 474         * JavaScriptCore.gir.in: Added. Moved from the WebKit1 directory. Now written
 475         as foreign interfaces and referencing the javascriptcoregtk library.
 476
 477 2013-04-18  Benjamin Poulain  <bpoulain@apple.com>
 478
 479         Use StringJoiner to create the JSString of arrayProtoFuncToString
 480         https://bugs.webkit.org/show_bug.cgi?id=114779
 481
 482         Reviewed by Geoffrey Garen.
 483
 484         The function arrayProtoFuncToString was just a glorified JSStringJoiner.
 485         This patch replaces it by JSStringJoiner to simplify the code and enjoy any optimization
 486         made on JSStringJoiner.
 487
 488         For some reason, this makes the execution 3.4% faster, despite having almost identical code.
 489
 490         * runtime/ArrayPrototype.cpp:
 491         (JSC::arrayProtoFuncToString):
 492
 493 2013-04-18  Oliver Hunt  <oliver@apple.com>
 494
 495         StackFrame::column() returning bogus value
 496         https://bugs.webkit.org/show_bug.cgi?id=114840
 497
 498         Reviewed by Gavin Barraclough.
 499
 500         Don't add one part of the expression offset to the other part of the expression.
 501         Make StackFrame::toString() include the column info.
 502
 503         * interpreter/Interpreter.cpp:
 504         (JSC::StackFrame::expressionInfo):
 505         (JSC::StackFrame::toString):
 506
 507 2013-04-18  Mark Hahnenberg  <mhahnenberg@apple.com>
 508
 509         Crash beneath JSC::JIT::privateCompileSlowCases @ stephenrdonaldson.com
 510         https://bugs.webkit.org/show_bug.cgi?id=114774
 511
 512         Reviewed by Geoffrey Garen.
 513
 514         We're not linking up all of the slow cases in the baseline JIT when compiling put_to_base.
 515
 516         * jit/JITOpcodes.cpp:
 517         (JSC::JIT::emitSlow_op_put_to_base):
 518
 519 2013-04-18  Mark Lam  <mark.lam@apple.com>
 520
 521         Interpreter entry points should throw the TerminatedExecutionException from the caller frame.
 522         https://bugs.webkit.org/show_bug.cgi?id=114816.
 523
 524         Reviewed by Oliver Hunt.
 525
 526         * interpreter/Interpreter.cpp:
 527         (JSC::Interpreter::execute):
 528         (JSC::Interpreter::executeCall):
 529         (JSC::Interpreter::executeConstruct):
 530
 531 2013-04-18  Gabor Rapcsanyi  <rgabor@webkit.org>
 532
 533         LLInt ARM backend should not use the d8 register as scratch register
 534         https://bugs.webkit.org/show_bug.cgi?id=114811
 535
 536         Reviewed by Filip Pizlo.
 537
 538         The d8 register must preserved across function calls and should
 539         not used as scratch register. Changing it to d6.
 540
 541         * offlineasm/arm.rb:
 542
 543 2013-04-18  Geoffrey Garen  <ggaren@apple.com>
 544
 545         Removed HeapTimer::synchronize
 546         https://bugs.webkit.org/show_bug.cgi?id=114832
 547
 548         Reviewed by Mark Hahnenberg.
 549
 550         HeapTimer::synchronize was a flawed attempt to make HeapTimer thread-safe.
 551         Instead, we use proper locking now.
 552
 553         This is a slight API change, since the GC timer will now only fire in the
 554         run loop that created the JS VM, even if another run loop later executes
 555         some JS.
 556
 557         * API/APIShims.h:
 558         (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
 559         * heap/HeapTimer.cpp:
 560         (JSC):
 561         * heap/HeapTimer.h:
 562         (HeapTimer):
 563
 564 2013-04-17  Geoffrey Garen  <ggaren@apple.com>
 565
 566         Renamed JSGlobalData to VM
 567         https://bugs.webkit.org/show_bug.cgi?id=114777
 568
 569         Reviewed by Phil Pizlo.
 570
 571         * API/APICast.h:
 572         (JSC):
 573         (toJS):
 574         (toRef):
 575         * API/APIShims.h:
 576         (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
 577         (APIEntryShimWithoutLock):
 578         (JSC::APIEntryShim::APIEntryShim):
 579         (APIEntryShim):
 580         (JSC::APIEntryShim::~APIEntryShim):
 581         (JSC::APICallbackShim::APICallbackShim):
 582         (JSC::APICallbackShim::~APICallbackShim):
 583         (APICallbackShim):
 584         * API/JSAPIWrapperObject.h:
 585         (JSAPIWrapperObject):
 586         * API/JSAPIWrapperObject.mm:
 587         (JSC::::createStructure):
 588         (JSC::JSAPIWrapperObject::JSAPIWrapperObject):
 589         (JSC::JSAPIWrapperObject::finishCreation):
 590         (JSC::JSAPIWrapperObject::visitChildren):
 591         * API/JSBase.cpp:
 592         (JSGarbageCollect):
 593         (JSReportExtraMemoryCost):
 594         (JSSynchronousGarbageCollectForDebugging):
 595         * API/JSCallbackConstructor.cpp:
 596         (JSC::JSCallbackConstructor::JSCallbackConstructor):
 597         (JSC::JSCallbackConstructor::finishCreation):
 598         * API/JSCallbackConstructor.h:
 599         (JSC::JSCallbackConstructor::createStructure):
 600         * API/JSCallbackFunction.cpp:
 601         (JSC::JSCallbackFunction::finishCreation):
 602         (JSC::JSCallbackFunction::create):
 603         * API/JSCallbackFunction.h:
 604         (JSCallbackFunction):
 605         (JSC::JSCallbackFunction::createStructure):
 606         * API/JSCallbackObject.cpp:
 607         (JSC::::create):
 608         (JSC::::createStructure):
 609         * API/JSCallbackObject.h:
 610         (JSC::JSCallbackObjectData::setPrivateProperty):
 611         (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
 612         (JSCallbackObject):
 613         (JSC::JSCallbackObject::setPrivateProperty):
 614         * API/JSCallbackObjectFunctions.h:
 615         (JSC::::JSCallbackObject):
 616         (JSC::::finishCreation):
 617         (JSC::::put):
 618         (JSC::::staticFunctionGetter):
 619         * API/JSClassRef.cpp:
 620         (OpaqueJSClassContextData::OpaqueJSClassContextData):
 621         (OpaqueJSClass::contextData):
 622         (OpaqueJSClass::prototype):
 623         * API/JSClassRef.h:
 624         (OpaqueJSClassContextData):
 625         * API/JSContext.mm:
 626         (-[JSContext setException:]):
 627         (-[JSContext initWithGlobalContextRef:]):
 628         (+[JSContext contextWithGlobalContextRef:]):
 629         * API/JSContextRef.cpp:
 630         (JSContextGroupCreate):
 631         (JSContextGroupRelease):
 632         (JSGlobalContextCreate):
 633         (JSGlobalContextCreateInGroup):
 634         (JSGlobalContextRetain):
 635         (JSGlobalContextRelease):
 636         (JSContextGetGroup):
 637         (JSContextCreateBacktrace):
 638         * API/JSObjectRef.cpp:
 639         (JSObjectMake):
 640         (JSObjectMakeConstructor):
 641         (JSObjectMakeFunction):
 642         (JSObjectSetPrototype):
 643         (JSObjectHasProperty):
 644         (JSObjectGetProperty):
 645         (JSObjectSetProperty):
 646         (JSObjectDeleteProperty):
 647         (JSObjectGetPrivateProperty):
 648         (JSObjectSetPrivateProperty):
 649         (JSObjectDeletePrivateProperty):
 650         (OpaqueJSPropertyNameArray::OpaqueJSPropertyNameArray):
 651         (OpaqueJSPropertyNameArray):
 652         (JSObjectCopyPropertyNames):
 653         (JSPropertyNameArrayRelease):
 654         (JSPropertyNameAccumulatorAddName):
 655         * API/JSScriptRef.cpp:
 656         (OpaqueJSScript::create):
 657         (OpaqueJSScript::vm):
 658         (OpaqueJSScript::OpaqueJSScript):
 659         (OpaqueJSScript):
 660         (parseScript):
 661         * API/JSVirtualMachine.mm:
 662         (scanExternalObjectGraph):
 663         * API/JSVirtualMachineInternal.h:
 664         (JSC):
 665         * API/JSWrapperMap.mm:
 666         (makeWrapper):
 667         * API/ObjCCallbackFunction.h:
 668         (JSC::ObjCCallbackFunction::createStructure):
 669         * API/ObjCCallbackFunction.mm:
 670         (JSC::ObjCCallbackFunction::create):
 671         * API/OpaqueJSString.cpp:
 672         (OpaqueJSString::identifier):
 673         * API/OpaqueJSString.h:
 674         (JSC):
 675         (OpaqueJSString):
 676         * GNUmakefile.list.am:
 677         * JSCTypedArrayStubs.h:
 678         (JSC):
 679         * JavaScriptCore.order:
 680         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
 681         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
 682         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
 683         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
 684         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
 685         * JavaScriptCore.xcodeproj/project.pbxproj:
 686         * KeywordLookupGenerator.py:
 687         (Trie.printSubTreeAsC):
 688         * Target.pri:
 689         * assembler/ARMAssembler.cpp:
 690         (JSC::ARMAssembler::executableCopy):
 691         * assembler/ARMAssembler.h:
 692         (ARMAssembler):
 693         * assembler/AssemblerBuffer.h:
 694         (JSC::AssemblerBuffer::executableCopy):
 695         * assembler/AssemblerBufferWithConstantPool.h:
 696         (JSC::AssemblerBufferWithConstantPool::executableCopy):
 697         * assembler/LinkBuffer.cpp:
 698         (JSC::LinkBuffer::linkCode):
 699         * assembler/LinkBuffer.h:
 700         (JSC):
 701         (JSC::LinkBuffer::LinkBuffer):
 702         (LinkBuffer):
 703         * assembler/MIPSAssembler.h:
 704         (JSC::MIPSAssembler::executableCopy):
 705         * assembler/SH4Assembler.h:
 706         (JSC::SH4Assembler::executableCopy):
 707         * assembler/X86Assembler.h:
 708         (JSC::X86Assembler::executableCopy):
 709         (JSC::X86Assembler::X86InstructionFormatter::executableCopy):
 710         * bytecode/CallLinkInfo.cpp:
 711         (JSC::CallLinkInfo::unlink):
 712         * bytecode/CallLinkInfo.h:
 713         (CallLinkInfo):
 714         * bytecode/CodeBlock.cpp:
 715         (JSC::dumpStructure):
 716         (JSC::CodeBlock::printStructures):
 717         (JSC::CodeBlock::CodeBlock):
 718         (JSC::CodeBlock::~CodeBlock):
 719         (JSC::CodeBlock::visitStructures):
 720         (JSC::CodeBlock::finalizeUnconditionally):
 721         (JSC::CodeBlock::createActivation):
 722         (JSC::CodeBlock::unlinkCalls):
 723         (JSC::CodeBlock::unlinkIncomingCalls):
 724         (JSC::CodeBlock::findClosureCallForReturnPC):
 725         (JSC::ProgramCodeBlock::jettisonImpl):
 726         (JSC::EvalCodeBlock::jettisonImpl):
 727         (JSC::FunctionCodeBlock::jettisonImpl):
 728         (JSC::CodeBlock::predictedMachineCodeSize):
 729         (JSC::CodeBlock::usesOpcode):
 730         * bytecode/CodeBlock.h:
 731         (JSC::CodeBlock::appendWeakReference):
 732         (JSC::CodeBlock::appendWeakReferenceTransition):
 733         (JSC::CodeBlock::setJITCode):
 734         (JSC::CodeBlock::setGlobalData):
 735         (JSC::CodeBlock::vm):
 736         (JSC::CodeBlock::valueProfileForBytecodeOffset):
 737         (JSC::CodeBlock::addConstant):
 738         (JSC::CodeBlock::setConstantRegisters):
 739         (CodeBlock):
 740         (JSC::CodeBlock::WeakReferenceTransition::WeakReferenceTransition):
 741         * bytecode/EvalCodeCache.h:
 742         (JSC::EvalCodeCache::getSlow):
 743         * bytecode/GetByIdStatus.cpp:
 744         (JSC::GetByIdStatus::computeFromLLInt):
 745         (JSC::GetByIdStatus::computeForChain):
 746         (JSC::GetByIdStatus::computeFor):
 747         * bytecode/GetByIdStatus.h:
 748         (GetByIdStatus):
 749         * bytecode/Instruction.h:
 750         (JSC::Instruction::Instruction):
 751         * bytecode/ObjectAllocationProfile.h:
 752         (JSC::ObjectAllocationProfile::initialize):
 753         (JSC::ObjectAllocationProfile::possibleDefaultPropertyCount):
 754         * bytecode/PolymorphicAccessStructureList.h:
 755         (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
 756         (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
 757         * bytecode/PolymorphicPutByIdList.h:
 758         (JSC::PutByIdAccess::transition):
 759         (JSC::PutByIdAccess::replace):
 760         * bytecode/PreciseJumpTargets.cpp:
 761         (JSC::computePreciseJumpTargets):
 762         * bytecode/PutByIdStatus.cpp:
 763         (JSC::PutByIdStatus::computeFromLLInt):
 764         (JSC::PutByIdStatus::computeFor):
 765         * bytecode/PutByIdStatus.h:
 766         (JSC):
 767         (PutByIdStatus):
 768         * bytecode/ResolveGlobalStatus.cpp:
 769         (JSC::computeForStructure):
 770         * bytecode/SamplingTool.cpp:
 771         (JSC::SamplingTool::notifyOfScope):
 772         * bytecode/SamplingTool.h:
 773         (JSC::ScriptSampleRecord::ScriptSampleRecord):
 774         (SamplingTool):
 775         * bytecode/StructureStubInfo.h:
 776         (JSC::StructureStubInfo::initGetByIdSelf):
 777         (JSC::StructureStubInfo::initGetByIdProto):
 778         (JSC::StructureStubInfo::initGetByIdChain):
 779         (JSC::StructureStubInfo::initPutByIdTransition):
 780         (JSC::StructureStubInfo::initPutByIdReplace):
 781         * bytecode/UnlinkedCodeBlock.cpp:
 782         (JSC::generateFunctionCodeBlock):
 783         (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
 784         (JSC::UnlinkedFunctionExecutable::link):
 785         (JSC::UnlinkedFunctionExecutable::fromGlobalCode):
 786         (JSC::UnlinkedFunctionExecutable::codeBlockFor):
 787         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
 788         * bytecode/UnlinkedCodeBlock.h:
 789         (JSC::UnlinkedFunctionExecutable::create):
 790         (UnlinkedFunctionExecutable):
 791         (JSC::UnlinkedFunctionExecutable::finishCreation):
 792         (JSC::UnlinkedFunctionExecutable::createStructure):
 793         (JSC::UnlinkedCodeBlock::addRegExp):
 794         (JSC::UnlinkedCodeBlock::addConstant):
 795         (JSC::UnlinkedCodeBlock::addFunctionDecl):
 796         (JSC::UnlinkedCodeBlock::addFunctionExpr):
 797         (JSC::UnlinkedCodeBlock::vm):
 798         (UnlinkedCodeBlock):
 799         (JSC::UnlinkedCodeBlock::finishCreation):
 800         (JSC::UnlinkedGlobalCodeBlock::UnlinkedGlobalCodeBlock):
 801         (JSC::UnlinkedProgramCodeBlock::create):
 802         (JSC::UnlinkedProgramCodeBlock::addFunctionDeclaration):
 803         (JSC::UnlinkedProgramCodeBlock::UnlinkedProgramCodeBlock):
 804         (JSC::UnlinkedProgramCodeBlock::createStructure):
 805         (JSC::UnlinkedEvalCodeBlock::create):
 806         (JSC::UnlinkedEvalCodeBlock::UnlinkedEvalCodeBlock):
 807         (JSC::UnlinkedEvalCodeBlock::createStructure):
 808         (JSC::UnlinkedFunctionCodeBlock::create):
 809         (JSC::UnlinkedFunctionCodeBlock::UnlinkedFunctionCodeBlock):
 810         (JSC::UnlinkedFunctionCodeBlock::createStructure):
 811         * bytecompiler/BytecodeGenerator.cpp:
 812         (JSC::BytecodeGenerator::BytecodeGenerator):
 813         (JSC::BytecodeGenerator::addConstant):
 814         (JSC::BytecodeGenerator::emitLoad):
 815         (JSC::BytecodeGenerator::emitDirectPutById):
 816         (JSC::BytecodeGenerator::addStringConstant):
 817         (JSC::BytecodeGenerator::expectedFunctionForIdentifier):
 818         (JSC::BytecodeGenerator::emitThrowReferenceError):
 819         (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded):
 820         * bytecompiler/BytecodeGenerator.h:
 821         (BytecodeGenerator):
 822         (JSC::BytecodeGenerator::vm):
 823         (JSC::BytecodeGenerator::propertyNames):
 824         (JSC::BytecodeGenerator::makeFunction):
 825         * bytecompiler/NodesCodegen.cpp:
 826         (JSC::RegExpNode::emitBytecode):
 827         (JSC::ArrayNode::toArgumentList):
 828         (JSC::ApplyFunctionCallDotNode::emitBytecode):
 829         (JSC::InstanceOfNode::emitBytecode):
 830         * debugger/Debugger.cpp:
 831         (JSC::Debugger::recompileAllJSFunctions):
 832         (JSC::evaluateInGlobalCallFrame):
 833         * debugger/Debugger.h:
 834         (JSC):
 835         * debugger/DebuggerActivation.cpp:
 836         (JSC::DebuggerActivation::DebuggerActivation):
 837         (JSC::DebuggerActivation::finishCreation):
 838         * debugger/DebuggerActivation.h:
 839         (JSC::DebuggerActivation::create):
 840         (JSC::DebuggerActivation::createStructure):
 841         (DebuggerActivation):
 842         * debugger/DebuggerCallFrame.cpp:
 843         (JSC::DebuggerCallFrame::evaluate):
 844         * dfg/DFGAbstractState.cpp:
 845         (JSC::DFG::AbstractState::executeEffects):
 846         * dfg/DFGAssemblyHelpers.h:
 847         (JSC::DFG::AssemblyHelpers::AssemblyHelpers):
 848         (JSC::DFG::AssemblyHelpers::vm):
 849         (JSC::DFG::AssemblyHelpers::debugCall):
 850         (JSC::DFG::AssemblyHelpers::emitExceptionCheck):
 851         (AssemblyHelpers):
 852         * dfg/DFGByteCodeParser.cpp:
 853         (JSC::DFG::ByteCodeParser::ByteCodeParser):
 854         (ByteCodeParser):
 855         (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
 856         (JSC::DFG::ByteCodeParser::parseBlock):
 857         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
 858         (JSC::DFG::ByteCodeParser::parseCodeBlock):
 859         * dfg/DFGByteCodeParser.h:
 860         (JSC):
 861         * dfg/DFGCCallHelpers.h:
 862         (JSC::DFG::CCallHelpers::CCallHelpers):
 863         * dfg/DFGCapabilities.cpp:
 864         (JSC::DFG::canHandleOpcodes):
 865         * dfg/DFGConstantFoldingPhase.cpp:
 866         (JSC::DFG::ConstantFoldingPhase::foldConstants):
 867         * dfg/DFGDisassembler.cpp:
 868         (JSC::DFG::Disassembler::reportToProfiler):
 869         * dfg/DFGDriver.cpp:
 870         (JSC::DFG::compile):
 871         * dfg/DFGDriver.h:
 872         (JSC):
 873         * dfg/DFGFixupPhase.cpp:
 874         (JSC::DFG::FixupPhase::fixupNode):
 875         (JSC::DFG::FixupPhase::isStringPrototypeMethodSane):
 876         (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
 877         * dfg/DFGGraph.cpp:
 878         (JSC::DFG::Graph::Graph):
 879         * dfg/DFGGraph.h:
 880         (Graph):
 881         * dfg/DFGJITCompiler.cpp:
 882         (JSC::DFG::JITCompiler::JITCompiler):
 883         (JSC::DFG::JITCompiler::linkOSRExits):
 884         (JSC::DFG::JITCompiler::link):
 885         (JSC::DFG::JITCompiler::compile):
 886         (JSC::DFG::JITCompiler::compileFunction):
 887         * dfg/DFGJITCompiler.h:
 888         (JSC):
 889         * dfg/DFGOSREntry.cpp:
 890         (JSC::DFG::prepareOSREntry):
 891         * dfg/DFGOSRExitCompiler.cpp:
 892         * dfg/DFGOSRExitCompiler32_64.cpp:
 893         (JSC::DFG::OSRExitCompiler::compileExit):
 894         * dfg/DFGOSRExitCompiler64.cpp:
 895         (JSC::DFG::OSRExitCompiler::compileExit):
 896         * dfg/DFGOperations.cpp:
 897         (JSC::DFG::putByVal):
 898         (JSC::DFG::operationPutByValInternal):
 899         (JSC::getHostCallReturnValueWithExecState):
 900         * dfg/DFGPhase.h:
 901         (JSC::DFG::Phase::vm):
 902         * dfg/DFGRepatch.cpp:
 903         (JSC::DFG::generateProtoChainAccessStub):
 904         (JSC::DFG::tryCacheGetByID):
 905         (JSC::DFG::tryBuildGetByIDList):
 906         (JSC::DFG::tryBuildGetByIDProtoList):
 907         (JSC::DFG::emitPutReplaceStub):
 908         (JSC::DFG::emitPutTransitionStub):
 909         (JSC::DFG::tryCachePutByID):
 910         (JSC::DFG::tryBuildPutByIdList):
 911         (JSC::DFG::linkSlowFor):
 912         (JSC::DFG::dfgLinkFor):
 913         (JSC::DFG::dfgLinkSlowFor):
 914         (JSC::DFG::dfgLinkClosureCall):
 915         * dfg/DFGSpeculativeJIT.cpp:
 916         (JSC::DFG::SpeculativeJIT::typedArrayDescriptor):
 917         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
 918         (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
 919         (JSC::DFG::SpeculativeJIT::compileFromCharCode):
 920         (JSC::DFG::SpeculativeJIT::compileMakeRope):
 921         (JSC::DFG::SpeculativeJIT::compileStringEquality):
 922         (JSC::DFG::SpeculativeJIT::compileToStringOnCell):
 923         (JSC::DFG::SpeculativeJIT::speculateObject):
 924         (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
 925         (JSC::DFG::SpeculativeJIT::speculateString):
 926         (JSC::DFG::SpeculativeJIT::speculateStringOrStringObject):
 927         * dfg/DFGSpeculativeJIT.h:
 928         (JSC::DFG::SpeculativeJIT::prepareForExternalCall):
 929         (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
 930         (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
 931         * dfg/DFGSpeculativeJIT32_64.cpp:
 932         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
 933         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
 934         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
 935         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
 936         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
 937         (JSC::DFG::SpeculativeJIT::compile):
 938         * dfg/DFGSpeculativeJIT64.cpp:
 939         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
 940         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
 941         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
 942         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
 943         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
 944         (JSC::DFG::SpeculativeJIT::compile):
 945         * dfg/DFGThunks.cpp:
 946         (JSC::DFG::osrExitGenerationThunkGenerator):
 947         (JSC::DFG::throwExceptionFromCallSlowPathGenerator):
 948         (JSC::DFG::slowPathFor):
 949         (JSC::DFG::linkForThunkGenerator):
 950         (JSC::DFG::linkCallThunkGenerator):
 951         (JSC::DFG::linkConstructThunkGenerator):
 952         (JSC::DFG::linkClosureCallThunkGenerator):
 953         (JSC::DFG::virtualForThunkGenerator):
 954         (JSC::DFG::virtualCallThunkGenerator):
 955         (JSC::DFG::virtualConstructThunkGenerator):
 956         * dfg/DFGThunks.h:
 957         (JSC):
 958         (DFG):
 959         * heap/BlockAllocator.h:
 960         (JSC):
 961         * heap/CopiedSpace.cpp:
 962         (JSC::CopiedSpace::tryAllocateSlowCase):
 963         (JSC::CopiedSpace::tryReallocate):
 964         * heap/CopiedSpaceInlines.h:
 965         (JSC::CopiedSpace::tryAllocate):
 966         * heap/GCThreadSharedData.cpp:
 967         (JSC::GCThreadSharedData::GCThreadSharedData):
 968         (JSC::GCThreadSharedData::reset):
 969         * heap/GCThreadSharedData.h:
 970         (JSC):
 971         (GCThreadSharedData):
 972         * heap/HandleSet.cpp:
 973         (JSC::HandleSet::HandleSet):
 974         (JSC::HandleSet::~HandleSet):
 975         (JSC::HandleSet::grow):
 976         * heap/HandleSet.h:
 977         (JSC):
 978         (HandleSet):
 979         (JSC::HandleSet::vm):
 980         * heap/Heap.cpp:
 981         (JSC::Heap::Heap):
 982         (JSC):
 983         (JSC::Heap::lastChanceToFinalize):
 984         (JSC::Heap::protect):
 985         (JSC::Heap::unprotect):
 986         (JSC::Heap::stack):
 987         (JSC::Heap::getConservativeRegisterRoots):
 988         (JSC::Heap::markRoots):
 989         (JSC::Heap::deleteAllCompiledCode):
 990         (JSC::Heap::collect):
 991         (JSC::Heap::isValidAllocation):
 992         * heap/Heap.h:
 993         (JSC):
 994         (Heap):
 995         (JSC::Heap::vm):
 996         * heap/HeapTimer.cpp:
 997         (JSC::HeapTimer::HeapTimer):
 998         (JSC::HeapTimer::timerDidFire):
 999         (JSC::HeapTimer::timerEvent):
1000         * heap/HeapTimer.h:
1001         (JSC):
1002         (HeapTimer):
1003         * heap/IncrementalSweeper.cpp:
1004         (JSC::IncrementalSweeper::IncrementalSweeper):
1005         (JSC::IncrementalSweeper::sweepNextBlock):
1006         (JSC::IncrementalSweeper::willFinishSweeping):
1007         (JSC::IncrementalSweeper::create):
1008         * heap/IncrementalSweeper.h:
1009         (IncrementalSweeper):
1010         * heap/Local.h:
1011         (Local):
1012         (JSC::::Local):
1013         (JSC::LocalStack::LocalStack):
1014         (JSC::LocalStack::push):
1015         (LocalStack):
1016         * heap/LocalScope.h:
1017         (JSC):
1018         (LocalScope):
1019         (JSC::LocalScope::LocalScope):
1020         * heap/MachineStackMarker.cpp:
1021         (JSC::MachineThreads::addCurrentThread):
1022         * heap/MarkedAllocator.cpp:
1023         (JSC::MarkedAllocator::allocateSlowCase):
1024         * heap/MarkedBlock.cpp:
1025         (JSC::MarkedBlock::MarkedBlock):
1026         * heap/MarkedBlock.h:
1027         (JSC::MarkedBlock::vm):
1028         * heap/SlotVisitor.cpp:
1029         (JSC::SlotVisitor::SlotVisitor):
1030         (JSC::SlotVisitor::setup):
1031         * heap/Strong.h:
1032         (JSC):
1033         (Strong):
1034         (JSC::Strong::operator=):
1035         * heap/StrongInlines.h:
1036         (JSC::::Strong):
1037         (JSC::::set):
1038         * heap/SuperRegion.h:
1039         (JSC):
1040         * heap/WeakSet.cpp:
1041         * heap/WeakSet.h:
1042         (WeakSet):
1043         (JSC::WeakSet::WeakSet):
1044         (JSC::WeakSet::vm):
1045         * interpreter/AbstractPC.cpp:
1046         (JSC::AbstractPC::AbstractPC):
1047         * interpreter/AbstractPC.h:
1048         (JSC):
1049         (AbstractPC):
1050         * interpreter/CachedCall.h:
1051         (JSC::CachedCall::CachedCall):
1052         * interpreter/CallFrame.h:
1053         (ExecState):
1054         (JSC::ExecState::clearException):
1055         (JSC::ExecState::clearSupplementaryExceptionInfo):
1056         (JSC::ExecState::exception):
1057         (JSC::ExecState::hadException):
1058         (JSC::ExecState::propertyNames):
1059         (JSC::ExecState::emptyList):
1060         (JSC::ExecState::interpreter):
1061         (JSC::ExecState::heap):
1062         (JSC::ExecState::arrayConstructorTable):
1063         (JSC::ExecState::arrayPrototypeTable):
1064         (JSC::ExecState::booleanPrototypeTable):
1065         (JSC::ExecState::dateTable):
1066         (JSC::ExecState::dateConstructorTable):
1067         (JSC::ExecState::errorPrototypeTable):
1068         (JSC::ExecState::globalObjectTable):
1069         (JSC::ExecState::jsonTable):
1070         (JSC::ExecState::mathTable):
1071         (JSC::ExecState::numberConstructorTable):
1072         (JSC::ExecState::numberPrototypeTable):
1073         (JSC::ExecState::objectConstructorTable):
1074         (JSC::ExecState::privateNamePrototypeTable):
1075         (JSC::ExecState::regExpTable):
1076         (JSC::ExecState::regExpConstructorTable):
1077         (JSC::ExecState::regExpPrototypeTable):
1078         (JSC::ExecState::stringConstructorTable):
1079         (JSC::ExecState::abstractReturnPC):
1080         * interpreter/CallFrameClosure.h:
1081         (CallFrameClosure):
1082         * interpreter/Interpreter.cpp:
1083         (JSC):
1084         (JSC::eval):
1085         (JSC::loadVarargs):
1086         (JSC::Interpreter::Interpreter):
1087         (JSC::Interpreter::dumpRegisters):
1088         (JSC::Interpreter::unwindCallFrame):
1089         (JSC::appendSourceToError):
1090         (JSC::getCallerInfo):
1091         (JSC::Interpreter::getStackTrace):
1092         (JSC::Interpreter::addStackTraceIfNecessary):
1093         (JSC::Interpreter::throwException):
1094         (JSC::Interpreter::execute):
1095         (JSC::Interpreter::executeCall):
1096         (JSC::Interpreter::executeConstruct):
1097         (JSC::Interpreter::prepareForRepeatCall):
1098         (JSC::Interpreter::retrieveArgumentsFromVMCode):
1099         (JSC::Interpreter::retrieveCallerFromVMCode):
1100         * interpreter/Interpreter.h:
1101         (JSC):
1102         (JSC::TopCallFrameSetter::TopCallFrameSetter):
1103         (JSC::TopCallFrameSetter::~TopCallFrameSetter):
1104         (TopCallFrameSetter):
1105         (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
1106         (Interpreter):
1107         * interpreter/JSStack.cpp:
1108         (JSC::JSStack::JSStack):
1109         * interpreter/JSStack.h:
1110         (JSC):
1111         * jit/ClosureCallStubRoutine.cpp:
1112         (JSC::ClosureCallStubRoutine::ClosureCallStubRoutine):
1113         * jit/ClosureCallStubRoutine.h:
1114         (ClosureCallStubRoutine):
1115         * jit/ExecutableAllocator.cpp:
1116         (JSC::ExecutableAllocator::ExecutableAllocator):
1117         (JSC::ExecutableAllocator::allocate):
1118         * jit/ExecutableAllocator.h:
1119         (JSC):
1120         (ExecutableAllocator):
1121         * jit/ExecutableAllocatorFixedVMPool.cpp:
1122         (JSC::ExecutableAllocator::ExecutableAllocator):
1123         (JSC::ExecutableAllocator::allocate):
1124         * jit/GCAwareJITStubRoutine.cpp:
1125         (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
1126         (JSC::MarkingGCAwareJITStubRoutineWithOneObject::MarkingGCAwareJITStubRoutineWithOneObject):
1127         (JSC::createJITStubRoutine):
1128         * jit/GCAwareJITStubRoutine.h:
1129         (GCAwareJITStubRoutine):
1130         (MarkingGCAwareJITStubRoutineWithOneObject):
1131         (JSC):
1132         * jit/JIT.cpp:
1133         (JSC::JIT::JIT):
1134         (JSC::JIT::privateCompile):
1135         (JSC::JIT::linkFor):
1136         (JSC::JIT::linkSlowCall):
1137         * jit/JIT.h:
1138         (JSC::JIT::compile):
1139         (JSC::JIT::compileClosureCall):
1140         (JSC::JIT::compileGetByIdProto):
1141         (JSC::JIT::compileGetByIdSelfList):
1142         (JSC::JIT::compileGetByIdProtoList):
1143         (JSC::JIT::compileGetByIdChainList):
1144         (JSC::JIT::compileGetByIdChain):
1145         (JSC::JIT::compilePutByIdTransition):
1146         (JSC::JIT::compileGetByVal):
1147         (JSC::JIT::compilePutByVal):
1148         (JSC::JIT::compileCTINativeCall):
1149         (JSC::JIT::compilePatchGetArrayLength):
1150         (JIT):
1151         * jit/JITCall.cpp:
1152         (JSC::JIT::compileLoadVarargs):
1153         (JSC::JIT::compileCallEvalSlowCase):
1154         (JSC::JIT::compileOpCallSlowCase):
1155         (JSC::JIT::privateCompileClosureCall):
1156         * jit/JITCall32_64.cpp:
1157         (JSC::JIT::compileLoadVarargs):
1158         (JSC::JIT::compileCallEvalSlowCase):
1159         (JSC::JIT::compileOpCallSlowCase):
1160         (JSC::JIT::privateCompileClosureCall):
1161         * jit/JITCode.h:
1162         (JSC):
1163         (JSC::JITCode::execute):
1164         * jit/JITDriver.h:
1165         (JSC::jitCompileIfAppropriate):
1166         (JSC::jitCompileFunctionIfAppropriate):
1167         * jit/JITExceptions.cpp:
1168         (JSC::genericThrow):
1169         (JSC::jitThrow):
1170         * jit/JITExceptions.h:
1171         (JSC):
1172         * jit/JITInlines.h:
1173         (JSC::JIT::emitLoadCharacterString):
1174         (JSC::JIT::updateTopCallFrame):
1175         * jit/JITOpcodes.cpp:
1176         (JSC::JIT::privateCompileCTINativeCall):
1177         (JSC::JIT::emit_op_new_object):
1178         (JSC::JIT::emit_op_to_primitive):
1179         (JSC::JIT::emit_op_catch):
1180         (JSC::JIT::emit_op_convert_this):
1181         (JSC::JIT::emitSlow_op_convert_this):
1182         * jit/JITOpcodes32_64.cpp:
1183         (JSC::JIT::privateCompileCTINativeCall):
1184         (JSC::JIT::emit_op_new_object):
1185         (JSC::JIT::emit_op_to_primitive):
1186         (JSC::JIT::emitSlow_op_eq):
1187         (JSC::JIT::emitSlow_op_neq):
1188         (JSC::JIT::compileOpStrictEq):
1189         (JSC::JIT::emit_op_catch):
1190         (JSC::JIT::emit_op_convert_this):
1191         (JSC::JIT::emitSlow_op_convert_this):
1192         * jit/JITPropertyAccess.cpp:
1193         (JSC::JIT::stringGetByValStubGenerator):
1194         (JSC::JIT::emitSlow_op_get_by_val):
1195         (JSC::JIT::compileGetByIdHotPath):
1196         (JSC::JIT::privateCompilePutByIdTransition):
1197         (JSC::JIT::privateCompilePatchGetArrayLength):
1198         (JSC::JIT::privateCompileGetByIdProto):
1199         (JSC::JIT::privateCompileGetByIdSelfList):
1200         (JSC::JIT::privateCompileGetByIdProtoList):
1201         (JSC::JIT::privateCompileGetByIdChainList):
1202         (JSC::JIT::privateCompileGetByIdChain):
1203         (JSC::JIT::privateCompileGetByVal):
1204         (JSC::JIT::privateCompilePutByVal):
1205         * jit/JITPropertyAccess32_64.cpp:
1206         (JSC::JIT::stringGetByValStubGenerator):
1207         (JSC::JIT::emitSlow_op_get_by_val):
1208         (JSC::JIT::compileGetByIdHotPath):
1209         (JSC::JIT::privateCompilePutByIdTransition):
1210         (JSC::JIT::privateCompilePatchGetArrayLength):
1211         (JSC::JIT::privateCompileGetByIdProto):
1212         (JSC::JIT::privateCompileGetByIdSelfList):
1213         (JSC::JIT::privateCompileGetByIdProtoList):
1214         (JSC::JIT::privateCompileGetByIdChainList):
1215         (JSC::JIT::privateCompileGetByIdChain):
1216         * jit/JITStubs.cpp:
1217         (JSC::ctiTrampoline):
1218         (JSC):
1219         (JSC::performPlatformSpecificJITAssertions):
1220         (JSC::tryCachePutByID):
1221         (JSC::tryCacheGetByID):
1222         (JSC::returnToThrowTrampoline):
1223         (JSC::throwExceptionFromOpCall):
1224         (JSC::DEFINE_STUB_FUNCTION):
1225         (JSC::getPolymorphicAccessStructureListSlot):
1226         (JSC::jitCompileFor):
1227         (JSC::lazyLinkFor):
1228         (JSC::putByVal):
1229         * jit/JITStubs.h:
1230         (JSC):
1231         (JITStackFrame):
1232         * jit/JITThunks.cpp:
1233         (JSC::JITThunks::ctiNativeCall):
1234         (JSC::JITThunks::ctiNativeConstruct):
1235         (JSC::JITThunks::ctiStub):
1236         (JSC::JITThunks::hostFunctionStub):
1237         * jit/JITThunks.h:
1238         (JSC):
1239         (JITThunks):
1240         * jit/JITWriteBarrier.h:
1241         (JSC):
1242         (JSC::JITWriteBarrierBase::set):
1243         (JSC::JITWriteBarrier::set):
1244         * jit/SpecializedThunkJIT.h:
1245         (JSC::SpecializedThunkJIT::loadJSStringArgument):
1246         (JSC::SpecializedThunkJIT::finalize):
1247         * jit/ThunkGenerator.h:
1248         (JSC):
1249         * jit/ThunkGenerators.cpp:
1250         (JSC::generateSlowCaseFor):
1251         (JSC::linkForGenerator):
1252         (JSC::linkCallGenerator):
1253         (JSC::linkConstructGenerator):
1254         (JSC::linkClosureCallGenerator):
1255         (JSC::virtualForGenerator):
1256         (JSC::virtualCallGenerator):
1257         (JSC::virtualConstructGenerator):
1258         (JSC::stringLengthTrampolineGenerator):
1259         (JSC::nativeForGenerator):
1260         (JSC::nativeCallGenerator):
1261         (JSC::nativeConstructGenerator):
1262         (JSC::stringCharLoad):
1263         (JSC::charToString):
1264         (JSC::charCodeAtThunkGenerator):
1265         (JSC::charAtThunkGenerator):
1266         (JSC::fromCharCodeThunkGenerator):
1267         (JSC::sqrtThunkGenerator):
1268         (JSC::floorThunkGenerator):
1269         (JSC::ceilThunkGenerator):
1270         (JSC::roundThunkGenerator):
1271         (JSC::expThunkGenerator):
1272         (JSC::logThunkGenerator):
1273         (JSC::absThunkGenerator):
1274         (JSC::powThunkGenerator):
1275         * jit/ThunkGenerators.h:
1276         (JSC):
1277         * jsc.cpp:
1278         (GlobalObject):
1279         (GlobalObject::create):
1280         (GlobalObject::createStructure):
1281         (GlobalObject::finishCreation):
1282         (GlobalObject::addFunction):
1283         (GlobalObject::addConstructableFunction):
1284         (functionDumpCallFrame):
1285         (functionJSCStack):
1286         (functionReleaseExecutableMemory):
1287         (functionRun):
1288         (main):
1289         (runWithScripts):
1290         (jscmain):
1291         * llint/LLIntData.cpp:
1292         (JSC::LLInt::Data::performAssertions):
1293         * llint/LLIntData.h:
1294         (JSC):
1295         (Data):
1296         (JSC::LLInt::Data::performAssertions):
1297         * llint/LLIntEntrypoints.cpp:
1298         (JSC::LLInt::getFunctionEntrypoint):
1299         (JSC::LLInt::getEvalEntrypoint):
1300         (JSC::LLInt::getProgramEntrypoint):
1301         * llint/LLIntEntrypoints.h:
1302         (JSC):
1303         (LLInt):
1304         (JSC::LLInt::getEntrypoint):
1305         * llint/LLIntExceptions.cpp:
1306         (JSC::LLInt::interpreterThrowInCaller):
1307         (JSC::LLInt::returnToThrow):
1308         (JSC::LLInt::callToThrow):
1309         * llint/LLIntOffsetsExtractor.cpp:
1310         * llint/LLIntSlowPaths.cpp:
1311         (LLInt):
1312         (JSC::LLInt::llint_trace_operand):
1313         (JSC::LLInt::llint_trace_value):
1314         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1315         (JSC::LLInt::shouldJIT):
1316         (JSC::LLInt::handleHostCall):
1317         (JSC::LLInt::setUpCall):
1318         * llint/LLIntThunks.cpp:
1319         (JSC::LLInt::generateThunkWithJumpTo):
1320         (JSC::LLInt::functionForCallEntryThunkGenerator):
1321         (JSC::LLInt::functionForConstructEntryThunkGenerator):
1322         (JSC::LLInt::functionForCallArityCheckThunkGenerator):
1323         (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
1324         (JSC::LLInt::evalEntryThunkGenerator):
1325         (JSC::LLInt::programEntryThunkGenerator):
1326         * llint/LLIntThunks.h:
1327         (JSC):
1328         (LLInt):
1329         * llint/LowLevelInterpreter.asm:
1330         * llint/LowLevelInterpreter.cpp:
1331         (JSC::CLoop::execute):
1332         * llint/LowLevelInterpreter32_64.asm:
1333         * llint/LowLevelInterpreter64.asm:
1334         * offlineasm/cloop.rb:
1335         * parser/ASTBuilder.h:
1336         (JSC::ASTBuilder::ASTBuilder):
1337         (JSC::ASTBuilder::createSourceElements):
1338         (JSC::ASTBuilder::createCommaExpr):
1339         (JSC::ASTBuilder::createLogicalNot):
1340         (JSC::ASTBuilder::createUnaryPlus):
1341         (JSC::ASTBuilder::createVoid):
1342         (JSC::ASTBuilder::thisExpr):
1343         (JSC::ASTBuilder::createResolve):
1344         (JSC::ASTBuilder::createObjectLiteral):
1345         (JSC::ASTBuilder::createArray):
1346         (JSC::ASTBuilder::createNumberExpr):
1347         (JSC::ASTBuilder::createString):
1348         (JSC::ASTBuilder::createBoolean):
1349         (JSC::ASTBuilder::createNull):
1350         (JSC::ASTBuilder::createBracketAccess):
1351         (JSC::ASTBuilder::createDotAccess):
1352         (JSC::ASTBuilder::createRegExp):
1353         (JSC::ASTBuilder::createNewExpr):
1354         (JSC::ASTBuilder::createConditionalExpr):
1355         (JSC::ASTBuilder::createAssignResolve):
1356         (JSC::ASTBuilder::createFunctionExpr):
1357         (JSC::ASTBuilder::createFunctionBody):
1358         (JSC::ASTBuilder::createGetterOrSetterProperty):
1359         (JSC::ASTBuilder::createArguments):
1360         (JSC::ASTBuilder::createArgumentsList):
1361         (JSC::ASTBuilder::createProperty):
1362         (JSC::ASTBuilder::createPropertyList):
1363         (JSC::ASTBuilder::createElementList):
1364         (JSC::ASTBuilder::createFormalParameterList):
1365         (JSC::ASTBuilder::createClause):
1366         (JSC::ASTBuilder::createClauseList):
1367         (JSC::ASTBuilder::createFuncDeclStatement):
1368         (JSC::ASTBuilder::createBlockStatement):
1369         (JSC::ASTBuilder::createExprStatement):
1370         (JSC::ASTBuilder::createIfStatement):
1371         (JSC::ASTBuilder::createForLoop):
1372         (JSC::ASTBuilder::createForInLoop):
1373         (JSC::ASTBuilder::createEmptyStatement):
1374         (JSC::ASTBuilder::createVarStatement):
1375         (JSC::ASTBuilder::createReturnStatement):
1376         (JSC::ASTBuilder::createBreakStatement):
1377         (JSC::ASTBuilder::createContinueStatement):
1378         (JSC::ASTBuilder::createTryStatement):
1379         (JSC::ASTBuilder::createSwitchStatement):
1380         (JSC::ASTBuilder::createWhileStatement):
1381         (JSC::ASTBuilder::createDoWhileStatement):
1382         (JSC::ASTBuilder::createLabelStatement):
1383         (JSC::ASTBuilder::createWithStatement):
1384         (JSC::ASTBuilder::createThrowStatement):
1385         (JSC::ASTBuilder::createDebugger):
1386         (JSC::ASTBuilder::createConstStatement):
1387         (JSC::ASTBuilder::appendConstDecl):
1388         (JSC::ASTBuilder::addVar):
1389         (JSC::ASTBuilder::combineCommaNodes):
1390         (JSC::ASTBuilder::Scope::Scope):
1391         (JSC::ASTBuilder::createNumber):
1392         (ASTBuilder):
1393         (JSC::ASTBuilder::makeTypeOfNode):
1394         (JSC::ASTBuilder::makeDeleteNode):
1395         (JSC::ASTBuilder::makeNegateNode):
1396         (JSC::ASTBuilder::makeBitwiseNotNode):
1397         (JSC::ASTBuilder::makeMultNode):
1398         (JSC::ASTBuilder::makeDivNode):
1399         (JSC::ASTBuilder::makeModNode):
1400         (JSC::ASTBuilder::makeAddNode):
1401         (JSC::ASTBuilder::makeSubNode):
1402         (JSC::ASTBuilder::makeLeftShiftNode):
1403         (JSC::ASTBuilder::makeRightShiftNode):
1404         (JSC::ASTBuilder::makeURightShiftNode):
1405         (JSC::ASTBuilder::makeBitOrNode):
1406         (JSC::ASTBuilder::makeBitAndNode):
1407         (JSC::ASTBuilder::makeBitXOrNode):
1408         (JSC::ASTBuilder::makeFunctionCallNode):
1409         (JSC::ASTBuilder::makeBinaryNode):
1410         (JSC::ASTBuilder::makeAssignNode):
1411         (JSC::ASTBuilder::makePrefixNode):
1412         (JSC::ASTBuilder::makePostfixNode):
1413         * parser/Lexer.cpp:
1414         (JSC::Keywords::Keywords):
1415         (JSC::::Lexer):
1416         (JSC::::parseIdentifier):
1417         (JSC::::parseIdentifierSlowCase):
1418         * parser/Lexer.h:
1419         (JSC::Keywords::isKeyword):
1420         (JSC::Keywords::getKeyword):
1421         (Keywords):
1422         (Lexer):
1423         (JSC::::makeIdentifier):
1424         (JSC::::makeRightSizedIdentifier):
1425         (JSC::::makeIdentifierLCharFromUChar):
1426         (JSC::::makeLCharIdentifier):
1427         * parser/NodeConstructors.h:
1428         (JSC::ParserArenaFreeable::operator new):
1429         (JSC::ParserArenaDeletable::operator new):
1430         (JSC::ParserArenaRefCounted::ParserArenaRefCounted):
1431         (JSC::PropertyNode::PropertyNode):
1432         (JSC::ContinueNode::ContinueNode):
1433         (JSC::BreakNode::BreakNode):
1434         (JSC::ForInNode::ForInNode):
1435         * parser/Nodes.cpp:
1436         (JSC::ScopeNode::ScopeNode):
1437         (JSC::ProgramNode::ProgramNode):
1438         (JSC::ProgramNode::create):
1439         (JSC::EvalNode::EvalNode):
1440         (JSC::EvalNode::create):
1441         (JSC::FunctionBodyNode::FunctionBodyNode):
1442         (JSC::FunctionBodyNode::create):
1443         * parser/Nodes.h:
1444         (ParserArenaFreeable):
1445         (ParserArenaDeletable):
1446         (ParserArenaRefCounted):
1447         (ArrayNode):
1448         (ForInNode):
1449         (ContinueNode):
1450         (BreakNode):
1451         (ScopeNode):
1452         (ProgramNode):
1453         (EvalNode):
1454         (FunctionBodyNode):
1455         * parser/Parser.cpp:
1456         (JSC::::Parser):
1457         (JSC::::parseInner):
1458         (JSC::::parseSourceElements):
1459         (JSC::::parseTryStatement):
1460         (JSC::::parseFunctionBody):
1461         (JSC::::parseFunctionInfo):
1462         (JSC::::parseAssignmentExpression):
1463         (JSC::::parseProperty):
1464         (JSC::::parsePrimaryExpression):
1465         (JSC::::parseMemberExpression):
1466         (JSC::::parseUnaryExpression):
1467         * parser/Parser.h:
1468         (JSC):
1469         (JSC::Scope::Scope):
1470         (JSC::Scope::declareVariable):
1471         (JSC::Scope::declareParameter):
1472         (Scope):
1473         (Parser):
1474         (JSC::Parser::pushScope):
1475         (JSC::::parse):
1476         (JSC::parse):
1477         * parser/ParserArena.h:
1478         (IdentifierArena):
1479         (JSC::IdentifierArena::makeIdentifier):
1480         (JSC::IdentifierArena::makeIdentifierLCharFromUChar):
1481         (JSC::IdentifierArena::makeNumericIdentifier):
1482         * parser/SyntaxChecker.h:
1483         (JSC::SyntaxChecker::SyntaxChecker):
1484         (JSC::SyntaxChecker::createProperty):
1485         (JSC::SyntaxChecker::createGetterOrSetterProperty):
1486         * profiler/LegacyProfiler.cpp:
1487         (JSC::LegacyProfiler::startProfiling):
1488         (JSC::LegacyProfiler::stopProfiling):
1489         * profiler/LegacyProfiler.h:
1490         (JSC):
1491         * profiler/ProfilerBytecode.cpp:
1492         (JSC::Profiler::Bytecode::toJS):
1493         * profiler/ProfilerBytecodeSequence.cpp:
1494         (JSC::Profiler::BytecodeSequence::BytecodeSequence):
1495         (JSC::Profiler::BytecodeSequence::addSequenceProperties):
1496         * profiler/ProfilerBytecodes.cpp:
1497         (JSC::Profiler::Bytecodes::toJS):
1498         * profiler/ProfilerCompilation.cpp:
1499         (JSC::Profiler::Compilation::toJS):
1500         * profiler/ProfilerCompiledBytecode.cpp:
1501         (JSC::Profiler::CompiledBytecode::toJS):
1502         * profiler/ProfilerDatabase.cpp:
1503         (JSC::Profiler::Database::Database):
1504         (JSC::Profiler::Database::toJS):
1505         (JSC::Profiler::Database::toJSON):
1506         * profiler/ProfilerDatabase.h:
1507         (Database):
1508         * profiler/ProfilerOSRExit.cpp:
1509         (JSC::Profiler::OSRExit::toJS):
1510         * profiler/ProfilerOrigin.cpp:
1511         (JSC::Profiler::Origin::toJS):
1512         * profiler/ProfilerProfiledBytecodes.cpp:
1513         (JSC::Profiler::ProfiledBytecodes::toJS):
1514         * runtime/ArgList.h:
1515         (MarkedArgumentBuffer):
1516         * runtime/Arguments.cpp:
1517         (JSC::Arguments::putByIndex):
1518         (JSC::Arguments::put):
1519         (JSC::Arguments::deleteProperty):
1520         (JSC::Arguments::defineOwnProperty):
1521         (JSC::Arguments::tearOff):
1522         (JSC::Arguments::didTearOffActivation):
1523         (JSC::Arguments::tearOffForInlineCallFrame):
1524         * runtime/Arguments.h:
1525         (JSC::Arguments::create):
1526         (JSC::Arguments::createStructure):
1527         (Arguments):
1528         (JSC::Arguments::Arguments):
1529         (JSC::Arguments::trySetArgument):
1530         (JSC::Arguments::finishCreation):
1531         * runtime/ArrayConstructor.cpp:
1532         (JSC::ArrayConstructor::finishCreation):
1533         * runtime/ArrayConstructor.h:
1534         (JSC::ArrayConstructor::createStructure):
1535         * runtime/ArrayPrototype.cpp:
1536         (JSC::ArrayPrototype::ArrayPrototype):
1537         (JSC::ArrayPrototype::finishCreation):
1538         (JSC::arrayProtoFuncSort):
1539         (JSC::arrayProtoFuncSplice):
1540         * runtime/ArrayPrototype.h:
1541         (JSC::ArrayPrototype::createStructure):
1542         * runtime/BatchedTransitionOptimizer.h:
1543         (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
1544         (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
1545         (BatchedTransitionOptimizer):
1546         * runtime/BooleanConstructor.cpp:
1547         (JSC::BooleanConstructor::finishCreation):
1548         (JSC::constructBoolean):
1549         (JSC::constructBooleanFromImmediateBoolean):
1550         * runtime/BooleanConstructor.h:
1551         (JSC::BooleanConstructor::createStructure):
1552         * runtime/BooleanObject.cpp:
1553         (JSC::BooleanObject::BooleanObject):
1554         (JSC::BooleanObject::finishCreation):
1555         * runtime/BooleanObject.h:
1556         (BooleanObject):
1557         (JSC::BooleanObject::create):
1558         (JSC::BooleanObject::createStructure):
1559         * runtime/BooleanPrototype.cpp:
1560         (JSC::BooleanPrototype::BooleanPrototype):
1561         (JSC::BooleanPrototype::finishCreation):
1562         (JSC::booleanProtoFuncToString):
1563         * runtime/BooleanPrototype.h:
1564         (JSC::BooleanPrototype::createStructure):
1565         * runtime/Butterfly.h:
1566         (JSC):
1567         (Butterfly):
1568         * runtime/ButterflyInlines.h:
1569         (JSC::Butterfly::createUninitialized):
1570         (JSC::Butterfly::create):
1571         (JSC::Butterfly::growPropertyStorage):
1572         (JSC::Butterfly::createOrGrowArrayRight):
1573         (JSC::Butterfly::growArrayRight):
1574         (JSC::Butterfly::resizeArray):
1575         * runtime/CodeCache.cpp:
1576         (JSC::CodeCache::getCodeBlock):
1577         (JSC::CodeCache::getProgramCodeBlock):
1578         (JSC::CodeCache::getEvalCodeBlock):
1579         (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
1580         * runtime/CodeCache.h:
1581         (JSC):
1582         (JSC::SourceCodeValue::SourceCodeValue):
1583         (CodeCache):
1584         * runtime/CommonIdentifiers.cpp:
1585         (JSC):
1586         (JSC::CommonIdentifiers::CommonIdentifiers):
1587         * runtime/CommonIdentifiers.h:
1588         (CommonIdentifiers):
1589         * runtime/CommonSlowPaths.h:
1590         (JSC::CommonSlowPaths::opIn):
1591         * runtime/Completion.cpp:
1592         (JSC::checkSyntax):
1593         (JSC::evaluate):
1594         * runtime/DateConstructor.cpp:
1595         (JSC::DateConstructor::finishCreation):
1596         * runtime/DateConstructor.h:
1597         (JSC::DateConstructor::createStructure):
1598         * runtime/DateInstance.cpp:
1599         (JSC::DateInstance::DateInstance):
1600         (JSC::DateInstance::finishCreation):
1601         (JSC::DateInstance::calculateGregorianDateTime):
1602         (JSC::DateInstance::calculateGregorianDateTimeUTC):
1603         * runtime/DateInstance.h:
1604         (DateInstance):
1605         (JSC::DateInstance::create):
1606         (JSC::DateInstance::createStructure):
1607         * runtime/DatePrototype.cpp:
1608         (JSC::DatePrototype::finishCreation):
1609         (JSC::dateProtoFuncSetTime):
1610         (JSC::setNewValueFromTimeArgs):
1611         (JSC::setNewValueFromDateArgs):
1612         (JSC::dateProtoFuncSetYear):
1613         (JSC::dateProtoFuncToJSON):
1614         * runtime/DatePrototype.h:
1615         (JSC::DatePrototype::createStructure):
1616         * runtime/Error.cpp:
1617         (JSC::createError):
1618         (JSC::createEvalError):
1619         (JSC::createRangeError):
1620         (JSC::createReferenceError):
1621         (JSC::createSyntaxError):
1622         (JSC::createTypeError):
1623         (JSC::createURIError):
1624         (JSC::addErrorInfo):
1625         (JSC::throwError):
1626         * runtime/Error.h:
1627         (JSC):
1628         (JSC::StrictModeTypeErrorFunction::create):
1629         (JSC::StrictModeTypeErrorFunction::createStructure):
1630         * runtime/ErrorConstructor.cpp:
1631         (JSC::ErrorConstructor::finishCreation):
1632         * runtime/ErrorConstructor.h:
1633         (JSC::ErrorConstructor::createStructure):
1634         * runtime/ErrorInstance.cpp:
1635         (JSC::ErrorInstance::ErrorInstance):
1636         * runtime/ErrorInstance.h:
1637         (JSC::ErrorInstance::createStructure):
1638         (JSC::ErrorInstance::create):
1639         (ErrorInstance):
1640         (JSC::ErrorInstance::finishCreation):
1641         * runtime/ErrorPrototype.cpp:
1642         (JSC::ErrorPrototype::ErrorPrototype):
1643         (JSC::ErrorPrototype::finishCreation):
1644         * runtime/ErrorPrototype.h:
1645         (JSC::ErrorPrototype::createStructure):
1646         * runtime/ExceptionHelpers.cpp:
1647         (JSC::createInterruptedExecutionException):
1648         (JSC::createTerminatedExecutionException):
1649         * runtime/ExceptionHelpers.h:
1650         (JSC):
1651         (JSC::InterruptedExecutionError::InterruptedExecutionError):
1652         (JSC::InterruptedExecutionError::create):
1653         (JSC::InterruptedExecutionError::createStructure):
1654         (JSC::TerminatedExecutionError::TerminatedExecutionError):
1655         (JSC::TerminatedExecutionError::create):
1656         (JSC::TerminatedExecutionError::createStructure):
1657         * runtime/Executable.cpp:
1658         (JSC::jettisonCodeBlock):
1659         (JSC::EvalExecutable::EvalExecutable):
1660         (JSC::ProgramExecutable::ProgramExecutable):
1661         (JSC::FunctionExecutable::FunctionExecutable):
1662         (JSC::EvalExecutable::compileOptimized):
1663         (JSC::EvalExecutable::compileInternal):
1664         (JSC::EvalExecutable::jettisonOptimizedCode):
1665         (JSC::ProgramExecutable::checkSyntax):
1666         (JSC::ProgramExecutable::compileOptimized):
1667         (JSC::ProgramExecutable::jettisonOptimizedCode):
1668         (JSC::ProgramExecutable::initializeGlobalProperties):
1669         (JSC::FunctionExecutable::compileOptimizedForCall):
1670         (JSC::FunctionExecutable::compileOptimizedForConstruct):
1671         (JSC::FunctionExecutable::produceCodeBlockFor):
1672         (JSC::FunctionExecutable::jettisonOptimizedCodeForCall):
1673         (JSC::FunctionExecutable::jettisonOptimizedCodeForConstruct):
1674         (JSC::FunctionExecutable::fromGlobalCode):
1675         * runtime/Executable.h:
1676         (JSC::ExecutableBase::ExecutableBase):
1677         (JSC::ExecutableBase::finishCreation):
1678         (JSC::ExecutableBase::createStructure):
1679         (JSC::NativeExecutable::create):
1680         (JSC::NativeExecutable::createStructure):
1681         (JSC::NativeExecutable::finishCreation):
1682         (JSC::NativeExecutable::NativeExecutable):
1683         (JSC::ScriptExecutable::ScriptExecutable):
1684         (JSC::ScriptExecutable::finishCreation):
1685         (JSC::EvalExecutable::compile):
1686         (EvalExecutable):
1687         (JSC::EvalExecutable::create):
1688         (JSC::EvalExecutable::createStructure):
1689         (JSC::ProgramExecutable::create):
1690         (ProgramExecutable):
1691         (JSC::ProgramExecutable::compile):
1692         (JSC::ProgramExecutable::createStructure):
1693         (JSC::FunctionExecutable::create):
1694         (JSC::FunctionExecutable::compileForCall):
1695         (FunctionExecutable):
1696         (JSC::FunctionExecutable::compileForConstruct):
1697         (JSC::FunctionExecutable::jettisonOptimizedCodeFor):
1698         (JSC::FunctionExecutable::createStructure):
1699         (JSC::JSFunction::JSFunction):
1700         * runtime/ExecutionHarness.h:
1701         (JSC::prepareForExecution):
1702         (JSC::prepareFunctionForExecution):
1703         * runtime/FunctionConstructor.cpp:
1704         (JSC::FunctionConstructor::finishCreation):
1705         * runtime/FunctionConstructor.h:
1706         (JSC::FunctionConstructor::createStructure):
1707         * runtime/FunctionPrototype.cpp:
1708         (JSC::FunctionPrototype::finishCreation):
1709         (JSC::FunctionPrototype::addFunctionProperties):
1710         (JSC::functionProtoFuncBind):
1711         * runtime/FunctionPrototype.h:
1712         (JSC::FunctionPrototype::createStructure):
1713         * runtime/GCActivityCallback.cpp:
1714         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
1715         (JSC::DefaultGCActivityCallback::doWork):
1716         (JSC::DefaultGCActivityCallback::didAllocate):
1717         * runtime/GCActivityCallback.h:
1718         (JSC::GCActivityCallback::GCActivityCallback):
1719         * runtime/GCActivityCallbackBlackBerry.cpp:
1720         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
1721         (JSC::DefaultGCActivityCallback::doWork):
1722         (JSC::DefaultGCActivityCallback::didAllocate):
1723         * runtime/GetterSetter.h:
1724         (JSC::GetterSetter::GetterSetter):
1725         (JSC::GetterSetter::create):
1726         (JSC::GetterSetter::setGetter):
1727         (JSC::GetterSetter::setSetter):
1728         (JSC::GetterSetter::createStructure):
1729         * runtime/Identifier.cpp:
1730         (JSC::Identifier::add):
1731         (JSC::Identifier::add8):
1732         (JSC::Identifier::addSlowCase):
1733         (JSC::Identifier::from):
1734         (JSC::Identifier::checkCurrentIdentifierTable):
1735         * runtime/Identifier.h:
1736         (JSC::Identifier::Identifier):
1737         (JSC::Identifier::createLCharFromUChar):
1738         (Identifier):
1739         (JSC::Identifier::add):
1740         * runtime/InternalFunction.cpp:
1741         (JSC::InternalFunction::InternalFunction):
1742         (JSC::InternalFunction::finishCreation):
1743         (JSC::InternalFunction::name):
1744         (JSC::InternalFunction::displayName):
1745         * runtime/InternalFunction.h:
1746         (JSC::InternalFunction::createStructure):
1747         (InternalFunction):
1748         * runtime/JSAPIValueWrapper.h:
1749         (JSC::JSAPIValueWrapper::createStructure):
1750         (JSC::JSAPIValueWrapper::finishCreation):
1751         (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
1752         * runtime/JSActivation.cpp:
1753         (JSC::JSActivation::symbolTablePut):
1754         (JSC::JSActivation::symbolTablePutWithAttributes):
1755         (JSC::JSActivation::getOwnPropertySlot):
1756         (JSC::JSActivation::put):
1757         (JSC::JSActivation::putDirectVirtual):
1758         (JSC::JSActivation::argumentsGetter):
1759         * runtime/JSActivation.h:
1760         (JSActivation):
1761         (JSC::JSActivation::create):
1762         (JSC::JSActivation::createStructure):
1763         (JSC::JSActivation::JSActivation):
1764         (JSC::JSActivation::tearOff):
1765         * runtime/JSArray.cpp:
1766         (JSC::createArrayButterflyInDictionaryIndexingMode):
1767         (JSC::JSArray::setLengthWritable):
1768         (JSC::JSArray::unshiftCountSlowCase):
1769         (JSC::JSArray::setLength):
1770         (JSC::JSArray::push):
1771         (JSC::JSArray::shiftCountWithAnyIndexingType):
1772         (JSC::JSArray::unshiftCountWithArrayStorage):
1773         (JSC::JSArray::unshiftCountWithAnyIndexingType):
1774         (JSC::ContiguousTypeAccessor::setWithValue):
1775         (JSC::JSArray::sortCompactedVector):
1776         (JSC::JSArray::sortVector):
1777         * runtime/JSArray.h:
1778         (JSC::JSArray::JSArray):
1779         (JSArray):
1780         (JSC::JSArray::shiftCountForShift):
1781         (JSC::JSArray::unshiftCountForShift):
1782         (JSC::JSArray::createStructure):
1783         (JSC::createContiguousArrayButterfly):
1784         (JSC::createArrayButterfly):
1785         (JSC):
1786         (JSC::JSArray::create):
1787         (JSC::JSArray::tryCreateUninitialized):
1788         (JSC::constructArray):
1789         * runtime/JSBoundFunction.cpp:
1790         (JSC::JSBoundFunction::create):
1791         (JSC::JSBoundFunction::JSBoundFunction):
1792         * runtime/JSBoundFunction.h:
1793         (JSC::JSBoundFunction::createStructure):
1794         * runtime/JSCJSValue.cpp:
1795         (JSC::JSValue::putToPrimitive):
1796         (JSC::JSValue::toStringSlowCase):
1797         * runtime/JSCJSValue.h:
1798         (JSC):
1799         * runtime/JSCell.h:
1800         (JSCell):
1801         * runtime/JSCellInlines.h:
1802         (JSC::JSCell::JSCell):
1803         (JSC::JSCell::finishCreation):
1804         (JSC::allocateCell):
1805         (JSC::JSCell::setStructure):
1806         (JSC::JSCell::fastGetOwnProperty):
1807         * runtime/JSDateMath.cpp:
1808         (JSC::getDSTOffset):
1809         (JSC::getUTCOffset):
1810         (JSC::parseDate):
1811         * runtime/JSDestructibleObject.h:
1812         (JSC::JSDestructibleObject::JSDestructibleObject):
1813         * runtime/JSFunction.cpp:
1814         (JSC::JSFunction::create):
1815         (JSC::JSFunction::JSFunction):
1816         (JSC::JSFunction::finishCreation):
1817         (JSC::JSFunction::createAllocationProfile):
1818         (JSC::JSFunction::name):
1819         (JSC::JSFunction::displayName):
1820         (JSC::JSFunction::getOwnPropertySlot):
1821         (JSC::JSFunction::deleteProperty):
1822         * runtime/JSFunction.h:
1823         (JSFunction):
1824         (JSC::JSFunction::create):
1825         (JSC::JSFunction::setScope):
1826         (JSC::JSFunction::createStructure):
1827         * runtime/JSGlobalData.cpp: Removed.
1828         * runtime/JSGlobalData.h: Removed.
1829         * runtime/JSGlobalObject.cpp:
1830         (JSC::JSGlobalObject::JSGlobalObject):
1831         (JSC::JSGlobalObject::~JSGlobalObject):
1832         (JSC::JSGlobalObject::setGlobalThis):
1833         (JSC::JSGlobalObject::init):
1834         (JSC::JSGlobalObject::putDirectVirtual):
1835         (JSC::JSGlobalObject::reset):
1836         (JSC):
1837         (JSC::JSGlobalObject::haveABadTime):
1838         (JSC::JSGlobalObject::createThrowTypeError):
1839         (JSC::JSGlobalObject::resetPrototype):
1840         (JSC::JSGlobalObject::addStaticGlobals):
1841         (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
1842         (JSC::JSGlobalObject::createProgramCodeBlock):
1843         (JSC::JSGlobalObject::createEvalCodeBlock):
1844         * runtime/JSGlobalObject.h:
1845         (JSC::JSGlobalObject::create):
1846         (JSGlobalObject):
1847         (JSC::JSGlobalObject::finishCreation):
1848         (JSC::JSGlobalObject::vm):
1849         (JSC::JSGlobalObject::createStructure):
1850         (JSC::ExecState::dynamicGlobalObject):
1851         (JSC::constructEmptyArray):
1852         (DynamicGlobalObjectScope):
1853         * runtime/JSGlobalObjectFunctions.cpp:
1854         (JSC::globalFuncProtoSetter):
1855         * runtime/JSLock.cpp:
1856         (JSC::JSLockHolder::JSLockHolder):
1857         (JSC::JSLockHolder::init):
1858         (JSC::JSLockHolder::~JSLockHolder):
1859         (JSC::JSLock::JSLock):
1860         (JSC::JSLock::willDestroyGlobalData):
1861         (JSC::JSLock::lock):
1862         (JSC::JSLock::unlock):
1863         (JSC::JSLock::DropAllLocks::DropAllLocks):
1864         (JSC::JSLock::DropAllLocks::~DropAllLocks):
1865         * runtime/JSLock.h:
1866         (JSC):
1867         (JSLockHolder):
1868         (JSLock):
1869         (JSC::JSLock::vm):
1870         (DropAllLocks):
1871         * runtime/JSNameScope.h:
1872         (JSC::JSNameScope::createStructure):
1873         (JSC::JSNameScope::finishCreation):
1874         (JSC::JSNameScope::JSNameScope):
1875         * runtime/JSNotAnObject.h:
1876         (JSC::JSNotAnObject::JSNotAnObject):
1877         (JSC::JSNotAnObject::create):
1878         (JSC::JSNotAnObject::createStructure):
1879         * runtime/JSONObject.cpp:
1880         (JSC::JSONObject::JSONObject):
1881         (JSC::JSONObject::finishCreation):
1882         (Holder):
1883         (JSC::Stringifier::Stringifier):
1884         (JSC::Stringifier::stringify):
1885         (JSC::Stringifier::toJSON):
1886         (JSC::Stringifier::appendStringifiedValue):
1887         (JSC::Stringifier::Holder::Holder):
1888         (JSC::Stringifier::Holder::appendNextProperty):
1889         (JSC::Walker::Walker):
1890         (JSC::Walker::walk):
1891         (JSC::JSONProtoFuncParse):
1892         (JSC::JSONProtoFuncStringify):
1893         (JSC::JSONStringify):
1894         * runtime/JSONObject.h:
1895         (JSC::JSONObject::createStructure):
1896         * runtime/JSObject.cpp:
1897         (JSC::JSObject::put):
1898         (JSC::JSObject::putByIndex):
1899         (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
1900         (JSC::JSObject::enterDictionaryIndexingMode):
1901         (JSC::JSObject::notifyPresenceOfIndexedAccessors):
1902         (JSC::JSObject::createInitialIndexedStorage):
1903         (JSC::JSObject::createInitialUndecided):
1904         (JSC::JSObject::createInitialInt32):
1905         (JSC::JSObject::createInitialDouble):
1906         (JSC::JSObject::createInitialContiguous):
1907         (JSC::JSObject::createArrayStorage):
1908         (JSC::JSObject::createInitialArrayStorage):
1909         (JSC::JSObject::convertUndecidedToInt32):
1910         (JSC::JSObject::convertUndecidedToDouble):
1911         (JSC::JSObject::convertUndecidedToContiguous):
1912         (JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
1913         (JSC::JSObject::convertUndecidedToArrayStorage):
1914         (JSC::JSObject::convertInt32ToDouble):
1915         (JSC::JSObject::convertInt32ToContiguous):
1916         (JSC::JSObject::convertInt32ToArrayStorage):
1917         (JSC::JSObject::genericConvertDoubleToContiguous):
1918         (JSC::JSObject::convertDoubleToContiguous):
1919         (JSC::JSObject::rageConvertDoubleToContiguous):
1920         (JSC::JSObject::convertDoubleToArrayStorage):
1921         (JSC::JSObject::convertContiguousToArrayStorage):
1922         (JSC::JSObject::convertUndecidedForValue):
1923         (JSC::JSObject::convertInt32ForValue):
1924         (JSC::JSObject::setIndexQuicklyToUndecided):
1925         (JSC::JSObject::convertInt32ToDoubleOrContiguousWhilePerformingSetIndex):
1926         (JSC::JSObject::convertDoubleToContiguousWhilePerformingSetIndex):
1927         (JSC::JSObject::ensureInt32Slow):
1928         (JSC::JSObject::ensureDoubleSlow):
1929         (JSC::JSObject::ensureContiguousSlow):
1930         (JSC::JSObject::rageEnsureContiguousSlow):
1931         (JSC::JSObject::ensureArrayStorageSlow):
1932         (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
1933         (JSC::JSObject::switchToSlowPutArrayStorage):
1934         (JSC::JSObject::putDirectVirtual):
1935         (JSC::JSObject::setPrototype):
1936         (JSC::JSObject::setPrototypeWithCycleCheck):
1937         (JSC::JSObject::putDirectAccessor):
1938         (JSC::JSObject::deleteProperty):
1939         (JSC::JSObject::getPropertySpecificValue):
1940         (JSC::JSObject::getOwnNonIndexPropertyNames):
1941         (JSC::JSObject::seal):
1942         (JSC::JSObject::freeze):
1943         (JSC::JSObject::preventExtensions):
1944         (JSC::JSObject::reifyStaticFunctionsForDelete):
1945         (JSC::JSObject::removeDirect):
1946         (JSC::JSObject::putIndexedDescriptor):
1947         (JSC::JSObject::defineOwnIndexedProperty):
1948         (JSC::JSObject::allocateSparseIndexMap):
1949         (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
1950         (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
1951         (JSC::JSObject::putByIndexBeyondVectorLength):
1952         (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
1953         (JSC::JSObject::putDirectIndexBeyondVectorLength):
1954         (JSC::JSObject::putDirectNativeFunction):
1955         (JSC::JSObject::increaseVectorLength):
1956         (JSC::JSObject::ensureLengthSlow):
1957         (JSC::JSObject::growOutOfLineStorage):
1958         (JSC::JSObject::getOwnPropertyDescriptor):
1959         (JSC::putDescriptor):
1960         (JSC::JSObject::putDirectMayBeIndex):
1961         (JSC::DefineOwnPropertyScope::DefineOwnPropertyScope):
1962         (JSC::DefineOwnPropertyScope::~DefineOwnPropertyScope):
1963         (DefineOwnPropertyScope):
1964         (JSC::JSObject::defineOwnNonIndexProperty):
1965         * runtime/JSObject.h:
1966         (JSObject):
1967         (JSC::JSObject::putByIndexInline):
1968         (JSC::JSObject::putDirectIndex):
1969         (JSC::JSObject::setIndexQuickly):
1970         (JSC::JSObject::initializeIndex):
1971         (JSC::JSObject::getDirect):
1972         (JSC::JSObject::getDirectOffset):
1973         (JSC::JSObject::putDirect):
1974         (JSC::JSObject::isSealed):
1975         (JSC::JSObject::isFrozen):
1976         (JSC::JSObject::flattenDictionaryObject):
1977         (JSC::JSObject::ensureInt32):
1978         (JSC::JSObject::ensureDouble):
1979         (JSC::JSObject::ensureContiguous):
1980         (JSC::JSObject::rageEnsureContiguous):
1981         (JSC::JSObject::ensureArrayStorage):
1982         (JSC::JSObject::finishCreation):
1983         (JSC::JSObject::createStructure):
1984         (JSC::JSObject::ensureLength):
1985         (JSC::JSNonFinalObject::createStructure):
1986         (JSC::JSNonFinalObject::JSNonFinalObject):
1987         (JSC::JSNonFinalObject::finishCreation):
1988         (JSC::JSFinalObject::createStructure):
1989         (JSC::JSFinalObject::finishCreation):
1990         (JSC::JSFinalObject::JSFinalObject):
1991         (JSC::JSFinalObject::create):
1992         (JSC::JSObject::setButterfly):
1993         (JSC::JSObject::JSObject):
1994         (JSC::JSObject::inlineGetOwnPropertySlot):
1995         (JSC::JSObject::putDirectInternal):
1996         (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
1997         (JSC::JSObject::putOwnDataProperty):
1998         (JSC::JSObject::putDirectWithoutTransition):
1999         (JSC):
2000         * runtime/JSPropertyNameIterator.cpp:
2001         (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
2002         (JSC::JSPropertyNameIterator::create):
2003         * runtime/JSPropertyNameIterator.h:
2004         (JSC::JSPropertyNameIterator::createStructure):
2005         (JSC::JSPropertyNameIterator::setCachedStructure):
2006         (JSC::JSPropertyNameIterator::setCachedPrototypeChain):
2007         (JSC::JSPropertyNameIterator::finishCreation):
2008         (JSC::StructureRareData::setEnumerationCache):
2009         * runtime/JSProxy.cpp:
2010         (JSC::JSProxy::setTarget):
2011         * runtime/JSProxy.h:
2012         (JSC::JSProxy::create):
2013         (JSC::JSProxy::createStructure):
2014         (JSC::JSProxy::JSProxy):
2015         (JSC::JSProxy::finishCreation):
2016         (JSProxy):
2017         * runtime/JSScope.cpp:
2018         (JSC::executeResolveOperations):
2019         (JSC::JSScope::resolveContainingScopeInternal):
2020         (JSC::JSScope::resolveWithBase):
2021         (JSC::JSScope::resolveWithThis):
2022         (JSC::JSScope::resolvePut):
2023         * runtime/JSScope.h:
2024         (JSScope):
2025         (JSC::JSScope::JSScope):
2026         (JSC::JSScope::vm):
2027         (JSC::ExecState::vm):
2028         * runtime/JSSegmentedVariableObject.h:
2029         (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
2030         (JSC::JSSegmentedVariableObject::finishCreation):
2031         * runtime/JSString.cpp:
2032         (JSC::JSRopeString::RopeBuilder::expand):
2033         (JSC::StringObject::create):
2034         * runtime/JSString.h:
2035         (JSC):
2036         (JSString):
2037         (JSC::JSString::JSString):
2038         (JSC::JSString::finishCreation):
2039         (JSC::JSString::create):
2040         (JSC::JSString::createHasOtherOwner):
2041         (JSC::JSString::createStructure):
2042         (JSRopeString):
2043         (JSC::JSRopeString::RopeBuilder::RopeBuilder):
2044         (JSC::JSRopeString::RopeBuilder::append):
2045         (RopeBuilder):
2046         (JSC::JSRopeString::JSRopeString):
2047         (JSC::JSRopeString::finishCreation):
2048         (JSC::JSRopeString::append):
2049         (JSC::JSRopeString::createNull):
2050         (JSC::JSRopeString::create):
2051         (JSC::jsEmptyString):
2052         (JSC::jsSingleCharacterString):
2053         (JSC::jsSingleCharacterSubstring):
2054         (JSC::jsNontrivialString):
2055         (JSC::jsString):
2056         (JSC::jsSubstring):
2057         (JSC::jsSubstring8):
2058         (JSC::jsOwnedString):
2059         (JSC::jsStringBuilder):
2060         (JSC::inlineJSValueNotStringtoString):
2061         * runtime/JSStringJoiner.cpp:
2062         (JSC::JSStringJoiner::build):
2063         * runtime/JSSymbolTableObject.h:
2064         (JSC::JSSymbolTableObject::JSSymbolTableObject):
2065         (JSC::JSSymbolTableObject::finishCreation):
2066         (JSC::symbolTablePut):
2067         (JSC::symbolTablePutWithAttributes):
2068         * runtime/JSVariableObject.h:
2069         (JSC::JSVariableObject::JSVariableObject):
2070         * runtime/JSWithScope.h:
2071         (JSC::JSWithScope::create):
2072         (JSC::JSWithScope::createStructure):
2073         (JSC::JSWithScope::JSWithScope):
2074         * runtime/JSWrapperObject.h:
2075         (JSWrapperObject):
2076         (JSC::JSWrapperObject::createStructure):
2077         (JSC::JSWrapperObject::JSWrapperObject):
2078         (JSC::JSWrapperObject::setInternalValue):
2079         * runtime/LiteralParser.cpp:
2080         (JSC::::tryJSONPParse):
2081         (JSC::::makeIdentifier):
2082         (JSC::::parse):
2083         * runtime/Lookup.cpp:
2084         (JSC::HashTable::createTable):
2085         (JSC::setUpStaticFunctionSlot):
2086         * runtime/Lookup.h:
2087         (JSC::HashTable::initializeIfNeeded):
2088         (JSC::HashTable::entry):
2089         (JSC::HashTable::begin):
2090         (JSC::HashTable::end):
2091         (HashTable):
2092         (JSC::lookupPut):
2093         * runtime/MathObject.cpp:
2094         (JSC::MathObject::MathObject):
2095         (JSC::MathObject::finishCreation):
2096         (JSC::mathProtoFuncSin):
2097         * runtime/MathObject.h:
2098         (JSC::MathObject::createStructure):
2099         * runtime/MemoryStatistics.cpp:
2100         * runtime/MemoryStatistics.h:
2101         * runtime/NameConstructor.cpp:
2102         (JSC::NameConstructor::finishCreation):
2103         (JSC::constructPrivateName):
2104         * runtime/NameConstructor.h:
2105         (JSC::NameConstructor::createStructure):
2106         * runtime/NameInstance.cpp:
2107         (JSC::NameInstance::NameInstance):
2108         * runtime/NameInstance.h:
2109         (JSC::NameInstance::createStructure):
2110         (JSC::NameInstance::create):
2111         (NameInstance):
2112         (JSC::NameInstance::finishCreation):
2113         * runtime/NamePrototype.cpp:
2114         (JSC::NamePrototype::NamePrototype):
2115         (JSC::NamePrototype::finishCreation):
2116         * runtime/NamePrototype.h:
2117         (JSC::NamePrototype::createStructure):
2118         * runtime/NativeErrorConstructor.h:
2119         (JSC::NativeErrorConstructor::createStructure):
2120         (JSC::NativeErrorConstructor::finishCreation):
2121         * runtime/NativeErrorPrototype.cpp:
2122         (JSC::NativeErrorPrototype::finishCreation):
2123         * runtime/NumberConstructor.cpp:
2124         (JSC::NumberConstructor::finishCreation):
2125         (JSC::constructWithNumberConstructor):
2126         * runtime/NumberConstructor.h:
2127         (JSC::NumberConstructor::createStructure):
2128         * runtime/NumberObject.cpp:
2129         (JSC::NumberObject::NumberObject):
2130         (JSC::NumberObject::finishCreation):
2131         (JSC::constructNumber):
2132         * runtime/NumberObject.h:
2133         (NumberObject):
2134         (JSC::NumberObject::create):
2135         (JSC::NumberObject::createStructure):
2136         * runtime/NumberPrototype.cpp:
2137         (JSC::NumberPrototype::NumberPrototype):
2138         (JSC::NumberPrototype::finishCreation):
2139         (JSC::integerValueToString):
2140         (JSC::numberProtoFuncToString):
2141         * runtime/NumberPrototype.h:
2142         (JSC::NumberPrototype::createStructure):
2143         * runtime/ObjectConstructor.cpp:
2144         (JSC::ObjectConstructor::finishCreation):
2145         (JSC::objectConstructorGetOwnPropertyDescriptor):
2146         (JSC::objectConstructorSeal):
2147         (JSC::objectConstructorFreeze):
2148         (JSC::objectConstructorPreventExtensions):
2149         (JSC::objectConstructorIsSealed):
2150         (JSC::objectConstructorIsFrozen):
2151         * runtime/ObjectConstructor.h:
2152         (JSC::ObjectConstructor::createStructure):
2153         (JSC::constructEmptyObject):
2154         * runtime/ObjectPrototype.cpp:
2155         (JSC::ObjectPrototype::ObjectPrototype):
2156         (JSC::ObjectPrototype::finishCreation):
2157         (JSC::objectProtoFuncToString):
2158         * runtime/ObjectPrototype.h:
2159         (JSC::ObjectPrototype::createStructure):
2160         * runtime/Operations.cpp:
2161         (JSC::jsTypeStringForValue):
2162         * runtime/Operations.h:
2163         (JSC):
2164         (JSC::jsString):
2165         (JSC::jsStringFromArguments):
2166         (JSC::normalizePrototypeChainForChainAccess):
2167         (JSC::normalizePrototypeChain):
2168         * runtime/PropertyMapHashTable.h:
2169         (JSC::PropertyMapEntry::PropertyMapEntry):
2170         (JSC::PropertyTable::createStructure):
2171         (PropertyTable):
2172         (JSC::PropertyTable::copy):
2173         * runtime/PropertyNameArray.h:
2174         (JSC::PropertyNameArray::PropertyNameArray):
2175         (JSC::PropertyNameArray::vm):
2176         (JSC::PropertyNameArray::addKnownUnique):
2177         (PropertyNameArray):
2178         * runtime/PropertyTable.cpp:
2179         (JSC::PropertyTable::create):
2180         (JSC::PropertyTable::clone):
2181         (JSC::PropertyTable::PropertyTable):
2182         * runtime/PrototypeMap.cpp:
2183         (JSC::PrototypeMap::emptyObjectStructureForPrototype):
2184         * runtime/RegExp.cpp:
2185         (JSC::RegExp::RegExp):
2186         (JSC::RegExp::finishCreation):
2187         (JSC::RegExp::createWithoutCaching):
2188         (JSC::RegExp::create):
2189         (JSC::RegExp::compile):
2190         (JSC::RegExp::compileIfNecessary):
2191         (JSC::RegExp::match):
2192         (JSC::RegExp::compileMatchOnly):
2193         (JSC::RegExp::compileIfNecessaryMatchOnly):
2194         * runtime/RegExp.h:
2195         (JSC):
2196         (RegExp):
2197         (JSC::RegExp::createStructure):
2198         * runtime/RegExpCache.cpp:
2199         (JSC::RegExpCache::lookupOrCreate):
2200         (JSC::RegExpCache::RegExpCache):
2201         (JSC::RegExpCache::addToStrongCache):
2202         * runtime/RegExpCache.h:
2203         (RegExpCache):
2204         * runtime/RegExpCachedResult.cpp:
2205         (JSC::RegExpCachedResult::lastResult):
2206         (JSC::RegExpCachedResult::setInput):
2207         * runtime/RegExpCachedResult.h:
2208         (JSC::RegExpCachedResult::RegExpCachedResult):
2209         (JSC::RegExpCachedResult::record):
2210         * runtime/RegExpConstructor.cpp:
2211         (JSC::RegExpConstructor::RegExpConstructor):
2212         (JSC::RegExpConstructor::finishCreation):
2213         (JSC::constructRegExp):
2214         * runtime/RegExpConstructor.h:
2215         (JSC::RegExpConstructor::createStructure):
2216         (RegExpConstructor):
2217         (JSC::RegExpConstructor::performMatch):
2218         * runtime/RegExpMatchesArray.cpp:
2219         (JSC::RegExpMatchesArray::RegExpMatchesArray):
2220         (JSC::RegExpMatchesArray::create):
2221         (JSC::RegExpMatchesArray::finishCreation):
2222         (JSC::RegExpMatchesArray::reifyAllProperties):
2223         * runtime/RegExpMatchesArray.h:
2224         (RegExpMatchesArray):
2225         (JSC::RegExpMatchesArray::createStructure):
2226         * runtime/RegExpObject.cpp:
2227         (JSC::RegExpObject::RegExpObject):
2228         (JSC::RegExpObject::finishCreation):
2229         (JSC::RegExpObject::match):
2230         * runtime/RegExpObject.h:
2231         (JSC::RegExpObject::create):
2232         (JSC::RegExpObject::setRegExp):
2233         (JSC::RegExpObject::setLastIndex):
2234         (JSC::RegExpObject::createStructure):
2235         * runtime/RegExpPrototype.cpp:
2236         (JSC::regExpProtoFuncCompile):
2237         * runtime/RegExpPrototype.h:
2238         (JSC::RegExpPrototype::createStructure):
2239         * runtime/SmallStrings.cpp:
2240         (JSC::SmallStrings::initializeCommonStrings):
2241         (JSC::SmallStrings::createEmptyString):
2242         (JSC::SmallStrings::createSingleCharacterString):
2243         (JSC::SmallStrings::initialize):
2244         * runtime/SmallStrings.h:
2245         (JSC):
2246         (JSC::SmallStrings::singleCharacterString):
2247         (SmallStrings):
2248         * runtime/SparseArrayValueMap.cpp:
2249         (JSC::SparseArrayValueMap::SparseArrayValueMap):
2250         (JSC::SparseArrayValueMap::finishCreation):
2251         (JSC::SparseArrayValueMap::create):
2252         (JSC::SparseArrayValueMap::createStructure):
2253         (JSC::SparseArrayValueMap::putDirect):
2254         (JSC::SparseArrayEntry::put):
2255         * runtime/SparseArrayValueMap.h:
2256         * runtime/StrictEvalActivation.cpp:
2257         (JSC::StrictEvalActivation::StrictEvalActivation):
2258         * runtime/StrictEvalActivation.h:
2259         (JSC::StrictEvalActivation::create):
2260         (JSC::StrictEvalActivation::createStructure):
2261         * runtime/StringConstructor.cpp:
2262         (JSC::StringConstructor::finishCreation):
2263         * runtime/StringConstructor.h:
2264         (JSC::StringConstructor::createStructure):
2265         * runtime/StringObject.cpp:
2266         (JSC::StringObject::StringObject):
2267         (JSC::StringObject::finishCreation):
2268         (JSC::constructString):
2269         * runtime/StringObject.h:
2270         (JSC::StringObject::create):
2271         (JSC::StringObject::createStructure):
2272         (StringObject):
2273         * runtime/StringPrototype.cpp:
2274         (JSC::StringPrototype::StringPrototype):
2275         (JSC::StringPrototype::finishCreation):
2276         (JSC::removeUsingRegExpSearch):
2277         (JSC::replaceUsingRegExpSearch):
2278         (JSC::stringProtoFuncMatch):
2279         (JSC::stringProtoFuncSearch):
2280         (JSC::stringProtoFuncSplit):
2281         * runtime/StringPrototype.h:
2282         (JSC::StringPrototype::createStructure):
2283         * runtime/StringRecursionChecker.h:
2284         (JSC::StringRecursionChecker::performCheck):
2285         (JSC::StringRecursionChecker::~StringRecursionChecker):
2286         * runtime/Structure.cpp:
2287         (JSC::StructureTransitionTable::add):
2288         (JSC::Structure::Structure):
2289         (JSC::Structure::materializePropertyMap):
2290         (JSC::Structure::despecifyDictionaryFunction):
2291         (JSC::Structure::addPropertyTransition):
2292         (JSC::Structure::removePropertyTransition):
2293         (JSC::Structure::changePrototypeTransition):
2294         (JSC::Structure::despecifyFunctionTransition):
2295         (JSC::Structure::attributeChangeTransition):
2296         (JSC::Structure::toDictionaryTransition):
2297         (JSC::Structure::toCacheableDictionaryTransition):
2298         (JSC::Structure::toUncacheableDictionaryTransition):
2299         (JSC::Structure::sealTransition):
2300         (JSC::Structure::freezeTransition):
2301         (JSC::Structure::preventExtensionsTransition):
2302         (JSC::Structure::takePropertyTableOrCloneIfPinned):
2303         (JSC::Structure::nonPropertyTransition):
2304         (JSC::Structure::isSealed):
2305         (JSC::Structure::isFrozen):
2306         (JSC::Structure::flattenDictionaryStructure):
2307         (JSC::Structure::addPropertyWithoutTransition):
2308         (JSC::Structure::removePropertyWithoutTransition):
2309         (JSC::Structure::allocateRareData):
2310         (JSC::Structure::cloneRareDataFrom):
2311         (JSC::Structure::copyPropertyTable):
2312         (JSC::Structure::copyPropertyTableForPinning):
2313         (JSC::Structure::get):
2314         (JSC::Structure::despecifyFunction):
2315         (JSC::Structure::despecifyAllFunctions):
2316         (JSC::Structure::putSpecificValue):
2317         (JSC::Structure::createPropertyMap):
2318         (JSC::Structure::getPropertyNamesFromStructure):
2319         (JSC::Structure::prototypeChainMayInterceptStoreTo):
2320         * runtime/Structure.h:
2321         (Structure):
2322         (JSC::Structure::finishCreation):
2323         (JSC::Structure::setPrototypeWithoutTransition):
2324         (JSC::Structure::setGlobalObject):
2325         (JSC::Structure::setObjectToStringValue):
2326         (JSC::Structure::materializePropertyMapIfNecessary):
2327         (JSC::Structure::materializePropertyMapIfNecessaryForPinning):
2328         (JSC::Structure::setPreviousID):
2329         * runtime/StructureChain.cpp:
2330         (JSC::StructureChain::StructureChain):
2331         * runtime/StructureChain.h:
2332         (JSC::StructureChain::create):
2333         (JSC::StructureChain::createStructure):
2334         (JSC::StructureChain::finishCreation):
2335         (StructureChain):
2336         * runtime/StructureInlines.h:
2337         (JSC::Structure::create):
2338         (JSC::Structure::createStructure):
2339         (JSC::Structure::get):
2340         (JSC::Structure::setEnumerationCache):
2341         (JSC::Structure::prototypeChain):
2342         (JSC::Structure::propertyTable):
2343         * runtime/StructureRareData.cpp:
2344         (JSC::StructureRareData::createStructure):
2345         (JSC::StructureRareData::create):
2346         (JSC::StructureRareData::clone):
2347         (JSC::StructureRareData::StructureRareData):
2348         * runtime/StructureRareData.h:
2349         (StructureRareData):
2350         * runtime/StructureRareDataInlines.h:
2351         (JSC::StructureRareData::setPreviousID):
2352         (JSC::StructureRareData::setObjectToStringValue):
2353         * runtime/StructureTransitionTable.h:
2354         (StructureTransitionTable):
2355         (JSC::StructureTransitionTable::setSingleTransition):
2356         * runtime/SymbolTable.h:
2357         (JSC::SharedSymbolTable::create):
2358         (JSC::SharedSymbolTable::createStructure):
2359         (JSC::SharedSymbolTable::SharedSymbolTable):
2360         * runtime/VM.cpp: Copied from Source/JavaScriptCore/runtime/JSGlobalData.cpp.
2361         (JSC::VM::VM):
2362         (JSC::VM::~VM):
2363         (JSC::VM::createContextGroup):
2364         (JSC::VM::create):
2365         (JSC::VM::createLeaked):
2366         (JSC::VM::sharedInstanceExists):
2367         (JSC::VM::sharedInstance):
2368         (JSC::VM::sharedInstanceInternal):
2369         (JSC::VM::getHostFunction):
2370         (JSC::VM::ClientData::~ClientData):
2371         (JSC::VM::resetDateCache):
2372         (JSC::VM::startSampling):
2373         (JSC::VM::stopSampling):
2374         (JSC::VM::discardAllCode):
2375         (JSC::VM::dumpSampleData):
2376         (JSC::VM::addSourceProviderCache):
2377         (JSC::VM::clearSourceProviderCaches):
2378         (JSC::VM::releaseExecutableMemory):
2379         (JSC::releaseExecutableMemory):
2380         (JSC::VM::gatherConservativeRoots):
2381         (JSC::VM::addRegExpToTrace):
2382         (JSC::VM::dumpRegExpTrace):
2383         * runtime/VM.h: Copied from Source/JavaScriptCore/runtime/JSGlobalData.h.
2384         (VM):
2385         (JSC::VM::isSharedInstance):
2386         (JSC::VM::usingAPI):
2387         (JSC::VM::isInitializingObject):
2388         (JSC::VM::setInitializingObjectClass):
2389         (JSC::WeakSet::heap):
2390         * runtime/WriteBarrier.h:
2391         (JSC):
2392         (JSC::WriteBarrierBase::set):
2393         (JSC::WriteBarrierBase::setMayBeNull):
2394         (JSC::WriteBarrierBase::setEarlyValue):
2395         (JSC::WriteBarrier::WriteBarrier):
2396         * testRegExp.cpp:
2397         (GlobalObject):
2398         (GlobalObject::create):
2399         (GlobalObject::createStructure):
2400         (GlobalObject::finishCreation):
2401         (main):
2402         (testOneRegExp):
2403         (parseRegExpLine):
2404         (runFromFiles):
2405         (realMain):
2406         * yarr/YarrInterpreter.h:
2407         (BytecodePattern):
2408         * yarr/YarrJIT.cpp:
2409         (YarrGenerator):
2410         (JSC::Yarr::YarrGenerator::compile):
2411         (JSC::Yarr::jitCompile):
2412         * yarr/YarrJIT.h:
2413         (JSC):
2414
2415 2013-04-18  Xuefei Ren  <xren@blackberry.com>
2416
2417         remove build warning(unused parameter)
2418         https://bugs.webkit.org/show_bug.cgi?id=114670
2419
2420         Reviewed by Rob Buis.
2421
2422         remove warning in Source/JavaScriptCore/runtime/GCActivityCallbackBlackBerry.cpp
2423
2424         * runtime/GCActivityCallbackBlackBerry.cpp:
2425         (JSC::DefaultGCActivityCallback::didAllocate):
2426
2427 2013-04-18  Jonathan Liu  <net147@gmail.com>
2428
2429         Implement JIT for MinGW-w64 64-bit
2430         https://bugs.webkit.org/show_bug.cgi?id=114580
2431
2432         Reviewed by Jocelyn Turcotte.
2433
2434         * jit/JITStubs.cpp:
2435         (JSC):
2436
2437 2013-04-17  Mark Lam  <mark.lam@apple.com>
2438
2439         Avoid using a branch range that is too far for some CPU architectures.
2440         https://bugs.webkit.org/show_bug.cgi?id=114782.
2441
2442         Reviewed by David Kilzer.
2443
2444         * llint/LowLevelInterpreter.asm:
2445         * llint/LowLevelInterpreter32_64.asm:
2446         * llint/LowLevelInterpreter64.asm:
2447
2448 2013-04-17  Julien Brianceau  <jbrianceau@nds.com>
2449
2450         Fix SH4 build (broken since r148639).
2451         https://bugs.webkit.org/show_bug.cgi?id=114773.
2452
2453         Allow longer displacements for specific branches in SH4 LLINT.
2454
2455         Reviewed by Oliver Hunt.
2456
2457         * offlineasm/sh4.rb:
2458
2459 2013-04-14  Roger Fong  <roger_fong@apple.com>
2460
2461         Unreviewed. More Windows build fix.
2462
2463         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
2464         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
2465
2466 2013-04-14  Roger Fong  <roger_fong@apple.com>
2467
2468         Unreviewed. Windows build fix.
2469
2470         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
2471         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
2472
2473 2013-04-17  Mark Lam  <mark.lam@apple.com>
2474
2475         Fix broken build. Replaced a static const with a #define.
2476         https://bugs.webkit.org/show_bug.cgi?id=114577.
2477
2478         Unreviewed.
2479
2480         * runtime/Watchdog.cpp:
2481         (JSC::Watchdog::Watchdog):
2482         (JSC::Watchdog::isEnabled):
2483
2484 2013-04-17  Mark Lam  <mark.lam@apple.com>
2485
2486         Add LLINT and baseline JIT support for timing out scripts.
2487         https://bugs.webkit.org/show_bug.cgi?id=114577.
2488
2489         Reviewed by Geoffrey Garen.
2490
2491         Introduces the new Watchdog class which is used to track script
2492         execution time, and initiate script termination if needed.
2493
2494         * API/JSContextRef.cpp:
2495         (internalScriptTimeoutCallback):
2496         (JSContextGroupSetExecutionTimeLimit):
2497         (JSContextGroupClearExecutionTimeLimit):
2498         * API/JSContextRefPrivate.h:
2499         - Added new script execution time limit APIs.
2500         * API/tests/testapi.c:
2501         (currentCPUTime):
2502         (shouldTerminateCallback):
2503         (cancelTerminateCallback):
2504         (extendTerminateCallback):
2505         (main):
2506         - Added new API tests for script execution time limit.
2507         * CMakeLists.txt:
2508         * GNUmakefile.list.am:
2509         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2510         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2511         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
2512         * JavaScriptCore.xcodeproj/project.pbxproj:
2513         * Target.pri:
2514         * bytecompiler/BytecodeGenerator.cpp:
2515         (JSC::BytecodeGenerator::emitLoopHint):
2516         - loop hints are needed for the llint as well. Hence, it will be
2517           emitted unconditionally.
2518         * interpreter/Interpreter.cpp:
2519         (JSC::Interpreter::addStackTraceIfNecessary):
2520         (JSC::Interpreter::throwException):
2521         (JSC::Interpreter::execute):
2522         (JSC::Interpreter::executeCall):
2523         (JSC::Interpreter::executeConstruct):
2524         - Added checks for script termination before entering script code.
2525         * jit/JIT.cpp:
2526         (JSC::JIT::emitWatchdogTimerCheck):
2527         * jit/JIT.h:
2528         (JSC::JIT::emit_op_loop_hint):
2529         * jit/JITStubs.cpp:
2530         (JSC::DEFINE_STUB_FUNCTION(void, handle_watchdog_timer)):
2531         * jit/JITStubs.h:
2532         * llint/LLIntExceptions.cpp:
2533         (JSC::LLInt::doThrow):
2534         - Factored out some common code from returnToThrow() and callToThrow().
2535         (JSC::LLInt::returnToThrow):
2536         (JSC::LLInt::callToThrow):
2537         * llint/LLIntSlowPaths.cpp:
2538         (JSC::LLInt::LLINT_SLOW_PATH_DECL(slow_path_handle_watchdog_timer)):
2539         * llint/LLIntSlowPaths.h:
2540         * llint/LowLevelInterpreter.asm:
2541         * llint/LowLevelInterpreter32_64.asm:
2542         * llint/LowLevelInterpreter64.asm:
2543         * runtime/ExceptionHelpers.cpp:
2544         (JSC::throwTerminatedExecutionException):
2545         - Also removed the now unused InterruptedExecutionException.
2546         * runtime/ExceptionHelpers.h:
2547         * runtime/JSGlobalData.cpp:
2548         (JSC::JSGlobalData::JSGlobalData):
2549         * runtime/JSGlobalData.h:
2550         - Added watchdog, and removed the now obsolete Terminator.
2551         * runtime/Terminator.h: Removed.
2552         * runtime/Watchdog.cpp: Added.
2553         (JSC::Watchdog::Watchdog):
2554         (JSC::Watchdog::~Watchdog):
2555         (JSC::Watchdog::setTimeLimit):
2556         (JSC::Watchdog::didFire):
2557         (JSC::Watchdog::isEnabled):
2558         (JSC::Watchdog::fire):
2559         (JSC::Watchdog::arm):
2560         (JSC::Watchdog::disarm):
2561         (JSC::Watchdog::startCountdownIfNeeded):
2562         (JSC::Watchdog::startCountdown):
2563         (JSC::Watchdog::stopCountdown):
2564         (JSC::Watchdog::Scope::Scope):
2565         (JSC::Watchdog::Scope::~Scope):
2566         * runtime/Watchdog.h: Added.
2567         (Watchdog):
2568         (JSC::Watchdog::didFire):
2569         (JSC::Watchdog::timerDidFireAddress):
2570         (JSC::Watchdog::isArmed):
2571         (Watchdog::Scope):
2572         * runtime/WatchdogMac.cpp: Added.
2573         (JSC::Watchdog::initTimer):
2574         (JSC::Watchdog::destroyTimer):
2575         (JSC::Watchdog::startTimer):
2576         (JSC::Watchdog::stopTimer):
2577         * runtime/WatchdogNone.cpp: Added.
2578         (JSC::Watchdog::initTimer):
2579         (JSC::Watchdog::destroyTimer):
2580         (JSC::Watchdog::startTimer):
2581         (JSC::Watchdog::stopTimer):
2582
2583 2013-04-14  Roger Fong  <roger_fong@apple.com>
2584
2585         Unreviewed. VS2010 Windows build fix.
2586
2587         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd:
2588
2589 2013-04-14  Roger Fong  <roger_fong@apple.com>
2590
2591         Copy make-file-export-generator script to the the Source folders of the projects that use it.
2592         <rdar://problem/13675604>
2593
2594         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj:
2595         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.filters:
2596         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorBuildCmd.cmd:
2597         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/make-export-file-generator: Copied from Source/WebCore/make-export-file-generator.
2598
2599 2013-04-17  Brent Fulgham  <bfulgham@webkit.org>
2600
2601         [Windows, WinCairo] Stop individually building WTF files in JSC.
2602         https://bugs.webkit.org/show_bug.cgi?id=114705
2603
2604         Reviewed by Anders Carlsson.
2605
2606         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
2607         Export additional String/fastMalloc symbols needed by JSC program.
2608         * JavaScriptCore.vcproj/jsc/jsc.vcproj: Don't manually build
2609         WTF implementation files (a second time!) in this project.
2610         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
2611         Export additional String/fastMalloc symbols needed by JSC program.
2612         * JavaScriptCore.vcxproj/jsc/jsc.vcxproj: Don't manually
2613         build WTF implementation files (a second time!) in this project.
2614         * JavaScriptCore.vcxproj/jsc/jsc.vcxproj.filters: Ditto.
2615
2616 2013-04-17  Mark Lam  <mark.lam@apple.com>
2617
2618         releaseExecutableMemory() should canonicalize cell liveness data before
2619         it scans the GC roots.
2620         https://bugs.webkit.org/show_bug.cgi?id=114733.
2621
2622         Reviewed by Mark Hahnenberg.
2623
2624         * heap/Heap.cpp:
2625         (JSC::Heap::canonicalizeCellLivenessData):
2626         * heap/Heap.h:
2627         * runtime/JSGlobalData.cpp:
2628         (JSC::JSGlobalData::releaseExecutableMemory):
2629
2630 2013-04-16  Commit Queue  <rniwa@webkit.org>
2631
2632         Unreviewed, rolling out r148576.
2633         http://trac.webkit.org/changeset/148576
2634         https://bugs.webkit.org/show_bug.cgi?id=114714
2635
2636         WebCore is building some of these same files (Requested by
2637         bfulgham on #webkit).
2638
2639         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
2640         * JavaScriptCore.vcproj/jsc/jsc.vcproj:
2641         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
2642         * JavaScriptCore.vcxproj/jsc/jsc.vcxproj:
2643         * JavaScriptCore.vcxproj/jsc/jsc.vcxproj.filters:
2644
2645 2013-04-16  Brent Fulgham  <bfulgham@webkit.org>
2646
2647         [Windows, WinCairo] Stop individually building WTF files in JSC.
2648         https://bugs.webkit.org/show_bug.cgi?id=114705
2649
2650         Reviewed by Anders Carlsson.
2651
2652         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
2653         Export additional String/fastMalloc symbols needed by JSC program.
2654         * JavaScriptCore.vcproj/jsc/jsc.vcproj: Don't manually build
2655         WTF implementation files (a second time!) in this project.
2656         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
2657         Export additional String/fastMalloc symbols needed by JSC program.
2658         * JavaScriptCore.vcxproj/jsc/jsc.vcxproj: Don't manually
2659         build WTF implementation files (a second time!) in this project.
2660         * JavaScriptCore.vcxproj/jsc/jsc.vcxproj.filters: Ditto.
2661
2662 2013-04-16  Patrick Gansterer  <paroga@webkit.org>
2663
2664         [CMake] Do not use JAVASCRIPTCORE_DIR in add_custom_command() of JavaScriptCore project
2665         https://bugs.webkit.org/show_bug.cgi?id=114265
2666
2667         Reviewed by Brent Fulgham.
2668
2669         Use CMAKE_CURRENT_SOURCE_DIR instead, since it provides the same value and is more
2670         understandable. Also move the GENERATE_HASH_LUT macro into the CMakeLists.txt
2671         of JavaScriptCore to avoid the usage of JAVASCRIPTCORE_DIR there too.
2672
2673         * CMakeLists.txt:
2674
2675 2013-04-16  Anders Carlsson  <andersca@apple.com>
2676
2677         Another Windows build fix attempt.
2678
2679         * runtime/JSGlobalData.h:
2680         (JSGlobalData):
2681
2682 2013-04-16  Anders Carlsson  <andersca@apple.com>
2683
2684         Try to fix the Windows build.
2685
2686         * runtime/JSGlobalData.h:
2687
2688 2013-04-16  Brent Fulgham  <bfulgham@webkit.org>
2689
2690         [Windows] Unreviewed VS2010 build correction.
2691
2692         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props:
2693         Specify proper link library to avoid mixture of ICU 4.0 and 4.6
2694         symbols during link.
2695
2696 2013-04-15  Ryosuke Niwa  <rniwa@webkit.org>
2697
2698         Windows clean build fix after r148479.
2699
2700         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
2701         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
2702
2703 2013-04-15  Anders Carlsson  <andersca@apple.com>
2704
2705         ScriptWrappable subclasses shouldn't have to include WeakInlines.h
2706         https://bugs.webkit.org/show_bug.cgi?id=114641
2707
2708         Reviewed by Alexey Proskuryakov.
2709
2710         Move back the Weak constructor, destructor and clear() to Weak.h. Add a new weakClearSlowCase function
2711         and put it in Weak.cpp.
2712
2713         * CMakeLists.txt:
2714         * GNUmakefile.list.am:
2715         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2716         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
2717         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
2718         * JavaScriptCore.xcodeproj/project.pbxproj:
2719         * Target.pri:
2720         * heap/Weak.cpp: Added.
2721         * heap/Weak.h:
2722         * heap/WeakInlines.h:
2723         * heap/WeakSetInlines.h:
2724
2725 2013-04-15  Mark Hahnenberg  <mhahnenberg@apple.com>
2726
2727         HeapTimer lifetime should be less complicated
2728         https://bugs.webkit.org/show_bug.cgi?id=114529
2729
2730         Reviewed by Oliver Hunt.
2731
2732         Right now our HeapTimer lifetime is rather complicated. HeapTimers are "owned" by the JSGlobalData,
2733         but there's an issue in that there can be races between a thread that is trying to tear down a JSGlobalData
2734         and the HeapTimer's fire function. Our current code for tearing down HeapTimers is an intricate and delicate
2735         dance which probably contains subtle bugs.
2736
2737         We can make our lives easier by changing things around a bit.
2738
2739         1) We should free the API lock from being solely owned by the JSGlobalData so we don't have to worry about
2740            grabbing the lock out of invalid memory when our HeapTimer callback fires.
2741
2742         2) We should also make it so that we deref the JSGlobalData first, then unlock the API lock so that when we
2743            have the lock, the JSGlobalData is in one of two states: fully valid or completely destroyed, and we know exactly which one.
2744
2745         3) The JSLock can tell us this information by keeping a back pointer to the JSGlobalData. When the JSGlobalData's
2746            destructor is called, it clears this pointer in the JSLock. Other clients of the API lock can then check
2747            this pointer to determine whether or not the JSGlobalData is still around.
2748
2749         4) The CFRunLoopTimer will use the API lock as its context rather than the HeapTimer itself. The only way
2750            the HeapTimer's callback can get to the HeapTimer is through the API lock's JSGlobalData pointer.
2751
2752         5) The CFRunLoopTimerContext struct has two fields for retain and release callbacks for the context's info field.
2753            We'll provide these callbacks to ref() and deref() the JSLock as necessary. Thus, the timer becomes the other
2754            owner of the JSLock apart from the JSGlobalData.
2755
2756         * API/APIShims.h: Remove the cruft that was required by the previous design, such as RefGlobalDataTag.
2757         (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
2758         (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
2759         (APIEntryShimWithoutLock):
2760         (JSC::APIEntryShim::APIEntryShim):
2761         (JSC::APIEntryShim::~APIEntryShim): Protect the API lock with a RefPtr, deref the JSGlobalData, which could destroy it,
2762         then unlock the API lock. This ordering prevents others from obtaining the API lock while the JSGlobalData is in the
2763         middle of being torn down.
2764         (JSC::APIEntryShim::init): We now take the lock, then ref the JSGlobalData, which is the opposite order of when we
2765         tear down the shim.
2766         * heap/Heap.cpp:
2767         (JSC::Heap::setActivityCallback): Use PassOwnPtr now.
2768         (JSC::Heap::activityCallback): Ditto.
2769         (JSC::Heap::sweeper): Ditto.
2770         (JSC):
2771         * heap/Heap.h:
2772         (Heap):
2773         * heap/HeapTimer.cpp:
2774         (JSC::retainAPILock): Retain callback for CFRunLoopTimerContext struct.
2775         (JSC::releaseAPILock): Release callback for the CFRunLoopTimerContext struct.
2776         (JSC::HeapTimer::HeapTimer): Use the API lock as the context's info field rather than the HeapTimer.
2777         (JSC::HeapTimer::timerDidFire): Grab the API lock. Return early if the JSGlobalData has already been destroyed.
2778         Otherwise, figure out which kind of HeapTimer we are based on the CFRunLoopTimerRef passed to the callback and
2779         call the HeapTimer's callback.
2780         * heap/HeapTimer.h:
2781         (HeapTimer):
2782         * heap/IncrementalSweeper.cpp:
2783         (JSC::IncrementalSweeper::create): PassOwnPtr all the things.
2784         * heap/IncrementalSweeper.h:
2785         (IncrementalSweeper):
2786         * jsc.cpp:
2787         (jscmain): We use an APIEntryShim instead of a RefPtr for the JSGlobalData because we need to
2788         tear down the JSGlobalData while we still hold the lock, which the APIEntryShim handles correctly.
2789         * runtime/GCActivityCallback.h:
2790         (DefaultGCActivityCallback):
2791         (JSC::DefaultGCActivityCallback::create):
2792         * runtime/JSGlobalData.cpp:
2793         (JSC::JSGlobalData::JSGlobalData):
2794         (JSC::JSGlobalData::~JSGlobalData): Notify the API lock that the JSGlobalData is being torn down.
2795         * runtime/JSGlobalData.h:
2796         (JSGlobalData):
2797         (JSC::JSGlobalData::apiLock):
2798         * runtime/JSLock.cpp:
2799         (JSC::JSLockHolder::JSLockHolder): Ref, then lock (just like the API shim).
2800         (JSC):
2801         (JSC::JSLock::willDestroyGlobalData):
2802         (JSC::JSLockHolder::init):
2803         (JSC::JSLockHolder::~JSLockHolder): Protect, deref, then unlock (just like the API shim).
2804         (JSC::JSLock::JSLock):
2805         * runtime/JSLock.h: Add back pointer to the JSGlobalData and a callback for when the JSGlobalData is being
2806         torn down that clears this pointer to notify other clients (i.e. timer callbacks) that the JSGlobalData is no
2807         longer valid.
2808         (JSLockHolder):
2809         (JSLock):
2810         (JSC::JSLock::globalData):
2811         * testRegExp.cpp:
2812         (realMain): We use an APIEntryShim instead of a RefPtr for the JSGlobalData because we need to
2813         tear down the JSGlobalData while we still hold the lock, which the APIEntryShim handles correctly.
2814
2815 2013-04-15  Julien Brianceau  <jbrianceau@nds.com>
2816
2817         LLInt SH4 backend implementation
2818         https://bugs.webkit.org/show_bug.cgi?id=112886
2819
2820         Reviewed by Oliver Hunt.
2821
2822         * dfg/DFGOperations.cpp:
2823         (JSC):
2824         * jit/JITStubs.cpp:
2825         * llint/LLIntOfflineAsmConfig.h:
2826         * llint/LowLevelInterpreter.asm:
2827         * llint/LowLevelInterpreter32_64.asm:
2828         * offlineasm/arm.rb:
2829         * offlineasm/ast.rb:
2830         * offlineasm/backends.rb:
2831         * offlineasm/instructions.rb:
2832         * offlineasm/mips.rb:
2833         * offlineasm/risc.rb:
2834         * offlineasm/sh4.rb: Added.
2835
2836 2013-04-15  Patrick Gansterer  <paroga@webkit.org>
2837
2838         [CMake] Add WTF_USE_*_UNICODE variables
2839         https://bugs.webkit.org/show_bug.cgi?id=114556
2840
2841         Reviewed by Brent Fulgham.
2842
2843         WTF_USE_ICU_UNICODE and WTF_USE_WCHAR_UNICODE are used to
2844         reduce duplication in the platform specific CMake files.
2845
2846         * CMakeLists.txt:
2847         * PlatformEfl.cmake:
2848
2849 2013-04-13  Patrick Gansterer  <paroga@webkit.org>
2850
2851         Add missing export macro to SymbolTableEntry::freeFatEntrySlow()
2852
2853         * runtime/SymbolTable.h:
2854         (SymbolTableEntry):
2855
2856 2013-04-12  Mark Hahnenberg  <mhahnenberg@apple.com>
2857
2858         Block freeing thread should call Region::destroy instead of delete
2859         https://bugs.webkit.org/show_bug.cgi?id=114544
2860
2861         Reviewed by Oliver Hunt.
2862
2863         Since Region doesn't have a virtual destructor, calling delete will not properly clean up all of
2864         the state of the Region. We should call destroy() instead.
2865
2866         * heap/BlockAllocator.cpp:
2867         (JSC::BlockAllocator::releaseFreeRegions):
2868         (JSC::BlockAllocator::blockFreeingThreadMain):
2869
2870 2013-04-11  Benjamin Poulain  <bpoulain@apple.com>
2871
2872         Merge CharacterClassTable into CharacterClass
2873         https://bugs.webkit.org/show_bug.cgi?id=114409
2874
2875         Reviewed by Darin Adler.
2876
2877         CharacterClassTable is only a pointer and a boolean.
2878         It is a little overkill to make a separate allocation
2879         for that.
2880
2881         * create_regex_tables:
2882         * yarr/YarrJIT.cpp:
2883         (JSC::Yarr::YarrGenerator::matchCharacterClass):
2884         * yarr/YarrPattern.cpp:
2885         (JSC::Yarr::CharacterClassConstructor::charClass):
2886         * yarr/YarrPattern.h:
2887         (CharacterClass):
2888         (JSC::Yarr::CharacterClass::CharacterClass):
2889
2890 2013-04-11  Michael Saboff  <msaboff@apple.com>
2891
2892         Added UNLIKELY() suggested in https://bugs.webkit.org/show_bug.cgi?id=114366
2893         after checking in the original change.
2894
2895         Rubber-stamped by Jessie Berlin.
2896
2897         * dfg/DFGOperations.cpp:
2898
2899 2013-04-10  Benjamin Poulain  <benjamin@webkit.org>
2900
2901         Unify JSC Parser's error and error message
2902         https://bugs.webkit.org/show_bug.cgi?id=114363
2903
2904         Reviewed by Geoffrey Garen.
2905
2906         The parser kept the error state over two attributes:
2907         error and errorMessage. They were changed in sync,
2908         but had some discrepancy (for example, the error message
2909         was always defined to something).
2910
2911         This patch unifies the two. There is an error if
2912         if the error message is non-null or if the parsing finished
2913         before the end.
2914
2915         This also gets rid of the allocation of the error message
2916         when instantiating a parser.
2917
2918         * parser/Parser.cpp:
2919         (JSC::::Parser):
2920         (JSC::::parseInner):
2921         (JSC::::parseSourceElements):
2922         (JSC::::parseVarDeclaration):
2923         (JSC::::parseConstDeclaration):
2924         (JSC::::parseForStatement):
2925         (JSC::::parseSwitchStatement):
2926         (JSC::::parsePrimaryExpression):
2927         * parser/Parser.h:
2928         (JSC::Parser::updateErrorMessage):
2929         (JSC::Parser::updateErrorWithNameAndMessage):
2930         (JSC::Parser::hasError):
2931         (Parser):
2932
2933 2013-04-10  Oliver Hunt  <oliver@apple.com>
2934
2935         Set trap is not being called for API objects
2936         https://bugs.webkit.org/show_bug.cgi?id=114403
2937
2938         Reviewed by Anders Carlsson.
2939
2940         Intercept putByIndex on the callback object and add tests
2941         to make sure we don't regress in future.
2942
2943         * API/JSCallbackObject.h:
2944         (JSCallbackObject):
2945         * API/JSCallbackObjectFunctions.h:
2946         (JSC::::putByIndex):
2947         (JSC):
2948         * API/tests/testapi.c:
2949         (PropertyCatchalls_setProperty):
2950         * API/tests/testapi.js:
2951
2952 2013-04-10  Benjamin Poulain  <bpoulain@apple.com>
2953
2954         Mass remove all the empty directories
2955
2956         Rubberstamped by Ryosuke Niwa.
2957
2958         * qt/api: Removed.
2959         * qt/benchmarks/qscriptengine: Removed.
2960         * qt/benchmarks/qscriptvalue: Removed.
2961         * qt/tests/qscriptengine: Removed.
2962         * qt/tests/qscriptstring: Removed.
2963         * qt/tests/qscriptvalue: Removed.
2964         * qt/tests/qscriptvalueiterator: Removed.
2965
2966 2013-04-10  Mark Hahnenberg  <mhahnenberg@apple.com>
2967
2968         JSObject::getOwnNonIndexPropertyNames calculates numCacheableSlots incorrectly
2969         https://bugs.webkit.org/show_bug.cgi?id=114235
2970
2971         Reviewed by Filip Pizlo.
2972
2973         If the object doesn't have any properties but the prototype does, we'll assume those prototype properties are
2974         accessible in the base object's backing store, which is bad.
2975
2976         * runtime/JSObject.cpp:
2977         (JSC::JSObject::getPropertyNames):
2978         (JSC::JSObject::getOwnNonIndexPropertyNames):
2979         * runtime/PropertyNameArray.h:
2980         (JSC::PropertyNameArray::PropertyNameArray):
2981         (JSC::PropertyNameArray::setNumCacheableSlotsForObject):
2982         (JSC::PropertyNameArray::setBaseObject):
2983         (PropertyNameArray):
2984
2985 2013-04-10  Patrick Gansterer  <paroga@webkit.org>
2986
2987         Remove code duplicates from MacroAssemblerARM
2988         https://bugs.webkit.org/show_bug.cgi?id=104457
2989
2990         Reviewed by Oliver Hunt.
2991
2992         Reuse some existing methods to avoid duplicated code.
2993
2994         * assembler/MacroAssemblerARM.h:
2995         (JSC::MacroAssemblerARM::store8):
2996         (JSC::MacroAssemblerARM::store32):
2997         (JSC::MacroAssemblerARM::swap):
2998         (JSC::MacroAssemblerARM::add32):
2999         (JSC::MacroAssemblerARM::sub32):
3000
3001 2013-04-10  Michael Saboff  <msaboff@apple.com>
3002
3003         DFG: Negative size for new Array() interpreted as large unsigned int
3004         https://bugs.webkit.org/show_bug.cgi?id=114366
3005
3006         Reviewed by Oliver Hunt.
3007
3008         Added new check in operationNewArrayWithSize() for a negative
3009         size.  If size is negative throw a "RangeError: Array size is not a
3010         small enough positive integer" exception.
3011
3012         * dfg/DFGOperations.cpp:
3013
3014 2013-04-10  peavo@outlook.com  <peavo@outlook.com>
3015
3016         WinCairo build fails to link.
3017         https://bugs.webkit.org/show_bug.cgi?id=114358
3018
3019         Reviewed by Brent Fulgham.
3020
3021         Export the symbol WTF::MD5::checksum().
3022
3023         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
3024         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
3025
3026 2013-04-08  Anders Carlsson  <andersca@apple.com>
3027
3028         Remove unneeded headers from FrameLoader.h
3029         https://bugs.webkit.org/show_bug.cgi?id=114223
3030
3031         Reviewed by Geoffrey Garen.
3032
3033         Update for WTF changes.
3034
3035         * bytecode/SpeculatedType.h:
3036         * runtime/JSCJSValue.h:
3037
3038 2013-04-09  Geoffrey Garen  <ggaren@apple.com>
3039
3040         Removed bitrotted TimeoutChecker code
3041         https://bugs.webkit.org/show_bug.cgi?id=114336
3042
3043         Reviewed by Alexey Proskuryakov.
3044
3045         This mechanism hasn't worked for a while.
3046
3047         MarkL is working on a new version of this feature with a distinct
3048         implementation.
3049
3050         * API/APIShims.h:
3051         (JSC::APIEntryShim::~APIEntryShim):
3052         (JSC::APIEntryShim::init):
3053         * GNUmakefile.list.am:
3054         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3055         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
3056         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
3057         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
3058         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
3059         * JavaScriptCore.xcodeproj/project.pbxproj:
3060         * Target.pri:
3061         * dfg/DFGGPRInfo.h:
3062         * jit/JIT.cpp:
3063         * jit/JIT.h:
3064         * jit/JITStubs.cpp:
3065         * jit/JITStubs.h:
3066         * jit/JSInterfaceJIT.h:
3067         (JSInterfaceJIT):
3068         * runtime/JSGlobalData.cpp:
3069         (JSC::JSGlobalData::JSGlobalData):
3070         * runtime/JSGlobalData.h:
3071         * runtime/JSGlobalObject.cpp:
3072         * runtime/JSONObject.cpp:
3073         (JSC::Stringifier::appendStringifiedValue):
3074         (JSC::Walker::walk):
3075         * runtime/TimeoutChecker.cpp: Removed.
3076         * runtime/TimeoutChecker.h: Removed.
3077
3078 2013-04-10  Oliver Hunt  <oliver@apple.com>
3079
3080         REGRESSION (r148073): WebKit Nightly r148082 crashes on launch in JSObjectSetPrivate
3081         https://bugs.webkit.org/show_bug.cgi?id=114341
3082
3083         Reviewed by Alexey Proskuryakov.
3084
3085         Make JSObjectSetPrivate use uncheckedToJS as some clients
3086         clear their private data during finalization for some reason.
3087
3088         * API/JSObjectRef.cpp:
3089         (JSObjectSetPrivate):
3090
3091 2013-04-09  Oliver Hunt  <oliver@apple.com>
3092
3093         Add liveness tests to JSC API entry points
3094         https://bugs.webkit.org/show_bug.cgi?id=114318
3095
3096         Reviewed by Geoffrey Garen.
3097
3098         Add simple checks for the existence of a method table on any
3099         JSCells passed across the API.  This in turn forces a structure
3100         validity test.
3101
3102         * API/APICast.h:
3103         (toJS):
3104         (toJSForGC):
3105         (unsafeToJS):
3106         * API/JSObjectRef.cpp:
3107         (JSObjectGetPrivate):
3108
3109 2013-04-09  Oliver Hunt  <oliver@apple.com>
3110
3111         Rollout last patch as it destroyed everything
3112
3113         * API/APICast.h:
3114         (toJS):
3115         (toJSForGC):
3116
3117 2013-04-09  Oliver Hunt  <oliver@apple.com>
3118
3119         Add liveness tests to JSC API entry points
3120         https://bugs.webkit.org/show_bug.cgi?id=114318
3121
3122         Reviewed by Filip Pizlo.
3123
3124         Add simple checks for the existence of a method table on any
3125         JSCells passed across the API.  This in turn forces a structure
3126         validity test.
3127
3128         * API/APICast.h:
3129         (toJS):
3130         (toJSForGC):
3131
3132 2013-04-09  Balazs Kilvady  <kilvadyb@homejinni.com>
3133
3134         LLInt conditional branch compilation fault on MIPS.
3135         https://bugs.webkit.org/show_bug.cgi?id=114264
3136
3137         Reviewed by Filip Pizlo.
3138
3139         Fix conditional branch compilation in LLInt offlineasm.
3140
3141         * offlineasm/mips.rb:
3142
3143 2013-04-08  Mark Hahnenberg  <mhahnenberg@apple.com>
3144
3145         JSObject::getOwnNonIndexPropertyNames calculates numCacheableSlots incorrectly
3146         https://bugs.webkit.org/show_bug.cgi?id=114235
3147
3148         Reviewed by Geoffrey Garen.
3149
3150         Due to the way that numCacheableSlots is currently calculated, checking an object's prototype for enumerable
3151         properties causes us not to cache any properties at all. We should only cache properties on the object itself
3152         since we currently don't take advantage of any sort of name caching for properties in the prototype chain.
3153         This fix undoes a ~2% SunSpider regression caused by http://trac.webkit.org/changeset/147570.
3154
3155         * runtime/JSObject.cpp:
3156         (JSC::JSObject::getOwnNonIndexPropertyNames):
3157
3158 2013-04-09  Ryosuke Niwa  <rniwa@webkit.org>
3159
3160         Remove yarr.gyp
3161         https://bugs.webkit.org/show_bug.cgi?id=114247
3162
3163         Reviewed by Benjamin Poulain.
3164
3165         * yarr/yarr.gyp: Removed.
3166
3167 2013-04-08  Ryosuke Niwa  <rniwa@webkit.org>
3168
3169         Remove JavaScriptCore.gyp/gypi
3170         https://bugs.webkit.org/show_bug.cgi?id=114238
3171
3172         Reviewed by Benjamin Poulain.
3173
3174         * JavaScriptCore.gyp: Removed.
3175         * JavaScriptCore.gyp/.gitignore: Removed.
3176         * JavaScriptCore.gypi: Removed.
3177
3178 2013-04-08  Vahag Vardanyan  <vaag@ispras.ru>
3179
3180         Adds fromCharCode intrinsic support.
3181         https://bugs.webkit.org/show_bug.cgi?id=104807
3182
3183         Reviewed by Oliver Hunt.
3184
3185         Switch to using fromCharCode intrinsic instead of call operation in some cases.
3186
3187         * dfg/DFGAbstractState.cpp:
3188         (JSC::DFG::AbstractState::executeEffects):
3189         * dfg/DFGByteCodeParser.cpp:
3190         (JSC::DFG::ByteCodeParser::handleIntrinsic):
3191         * dfg/DFGFixupPhase.cpp:
3192         (JSC::DFG::FixupPhase::fixupNode):
3193         * dfg/DFGNodeType.h:
3194         (DFG):
3195         * dfg/DFGOperations.cpp:
3196         * dfg/DFGOperations.h:
3197         * dfg/DFGPredictionPropagationPhase.cpp:
3198         (JSC::DFG::PredictionPropagationPhase::propagate):
3199         * dfg/DFGSpeculativeJIT.cpp:
3200         (JSC::DFG::SpeculativeJIT::compileFromCharCode):
3201         (DFG):
3202         * dfg/DFGSpeculativeJIT.h:
3203         (JSC::DFG::SpeculativeJIT::callOperation):
3204         (SpeculativeJIT):
3205         * dfg/DFGSpeculativeJIT32_64.cpp:
3206         (JSC::DFG::SpeculativeJIT::compile):
3207         * dfg/DFGSpeculativeJIT64.cpp:
3208         (JSC::DFG::SpeculativeJIT::compile):
3209         * runtime/StringConstructor.cpp:
3210         (JSC::stringFromCharCode):
3211         (JSC):
3212         * runtime/StringConstructor.h:
3213         (JSC):
3214
3215 2013-04-08  Benjamin Poulain  <benjamin@webkit.org>
3216
3217         Remove HTML Notification
3218         https://bugs.webkit.org/show_bug.cgi?id=114231
3219
3220         Reviewed by Ryosuke Niwa.
3221
3222         * Configurations/FeatureDefines.xcconfig:
3223
3224 2013-04-05  Roger Fong  <roger_fong@apple.com>
3225
3226         Build fix.
3227
3228         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
3229         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
3230
3231 2013-04-08  Filip Pizlo  <fpizlo@apple.com>
3232
3233         DFG should be able to inline string equality comparisons
3234         https://bugs.webkit.org/show_bug.cgi?id=114224
3235
3236         Reviewed by Oliver Hunt.
3237
3238         Inline 8-bit string equality, go to slow path for 16-bit strings. 2x speed-up for string equality
3239         comparisons on 8-bit strings. 20-50% speed-up on JSRegress/HashMap tests. 30% speed-up on
3240         string-fasta. 2% speed-up on SunSpider overall. Some small speed-ups elsewhere.
3241
3242         This is a gnarly change but we have loads of test coverage already between the HashMap tests and
3243         preexisting DFG string equality tests (which appear to have been designed to test OSR exits, but
3244         also give us good overall coverage on string equality behavior).
3245
3246         * dfg/DFGFixupPhase.cpp:
3247         (JSC::DFG::FixupPhase::fixupNode):
3248         * dfg/DFGOperations.cpp:
3249         * dfg/DFGOperations.h:
3250         * dfg/DFGSpeculativeJIT.cpp:
3251         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
3252         (JSC::DFG::SpeculativeJIT::compare):
3253         (JSC::DFG::SpeculativeJIT::compileStrictEq):
3254         (JSC::DFG::SpeculativeJIT::compileStringEquality):
3255         (DFG):
3256         * dfg/DFGSpeculativeJIT.h:
3257         (SpeculativeJIT):
3258
3259 2013-04-08  Geoffrey Garen  <ggaren@apple.com>
3260
3261         Stop #include-ing all of JavaScriptCore in every DOM-related file
3262         https://bugs.webkit.org/show_bug.cgi?id=114220
3263
3264         Reviewed by Sam Weinig.
3265
3266         I separated WeakInlines.h from Weak.h so WebCore data types that need
3267         to declare a Weak<T> data member don't have to #include all of the
3268         infrastructure for accessing that data member.
3269
3270         This also required separating Weak<T> from PassWeak<T> by removing the
3271         WeakImplAccessor class template and pushing code down into its subclasses.
3272
3273         * API/JSWeakObjectMapRefPrivate.cpp:
3274         * JavaScriptCore.xcodeproj/project.pbxproj:
3275         * bytecode/UnlinkedCodeBlock.h:
3276         * heap/PassWeak.h:
3277         (JSC):
3278         (PassWeak):
3279         (JSC::::PassWeak):
3280         (JSC::::operator):
3281         (JSC::::get):
3282         * heap/SlotVisitorInlines.h:
3283         * heap/Weak.h:
3284         (JSC):
3285         (Weak):
3286         * heap/WeakInlines.h: Copied from Source/JavaScriptCore/heap/Weak.h.
3287         (JSC):
3288         (JSC::::Weak):
3289         (JSC::::operator):
3290         (JSC::::get):
3291         (JSC::::was):
3292         (JSC::weakClear):
3293         * jit/JITThunks.h:
3294         * runtime/RegExpCache.h:
3295         * runtime/Structure.h:
3296         * runtime/WeakGCMap.h:
3297
3298 2013-04-05  Roger Fong  <roger_fong@apple.com>
3299
3300         Windows build fix fix.
3301
3302         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
3303
3304 2013-04-05  Roger Fong  <roger_fong@apple.com>
3305
3306         Windows build fix.
3307
3308         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
3309         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
3310
3311 2013-04-08  Oliver Hunt  <oliver@apple.com>
3312
3313         Make resolve more robust in the face of lookup misses
3314         https://bugs.webkit.org/show_bug.cgi?id=114211
3315
3316         Reviewed by Filip Pizlo.
3317
3318         This simply short circuits the resolve operations in the
3319         event that we don't find a path to a property.  There's no
3320         repro case for this happening unfortunately.
3321
3322         * llint/LLIntSlowPaths.cpp:
3323         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3324
3325 2013-04-08  Oliver Hunt  <oliver@apple.com>
3326
3327         Build fix.
3328
3329         * assembler/ARMv7Assembler.h:
3330         (ARMv7Assembler):
3331
3332 2013-04-08  Justin Haygood  <jhaygood@reaktix.com>
3333
3334         Allow KeywordLookupGenerator.py to work on Windows with Windows style line endings
3335         https://bugs.webkit.org/show_bug.cgi?id=63234
3336
3337         Reviewed by Oliver Hunt.
3338
3339         * KeywordLookupGenerator.py:
3340         (parseKeywords):
3341
3342 2013-04-08  Filip Pizlo  <fpizlo@apple.com>
3343
3344         REGRESSION(r146669): Assertion hit in JSC::DFG::SpeculativeJIT::fillSpeculateCell() running webgl tests
3345         https://bugs.webkit.org/show_bug.cgi?id=114129
3346         <rdar://problem/13594898>
3347
3348         Reviewed by Darin Adler.
3349
3350         The check to see if we need a cell check when simplifying a GetById or PutById needs to be hoisted to
3351         above where we abstractly execute the instruction, since after we abstracting execute it, it will
3352         seem like it no longer needs the cell check.
3353
3354         * dfg/DFGConstantFoldingPhase.cpp:
3355         (JSC::DFG::ConstantFoldingPhase::foldConstants):
3356
3357 2013-04-07  Oliver Hunt  <oliver@apple.com>
3358
3359         Add bounds checking for WTF::Vector::operator[]
3360         https://bugs.webkit.org/show_bug.cgi?id=89600
3361
3362         Reviewed by Filip Pizlo.
3363
3364         Make a few JSC classes opt-out of release mode bounds checking.
3365
3366         * assembler/AssemblerBuffer.h:
3367         (AssemblerBuffer):
3368         * assembler/AssemblerBufferWithConstantPool.h:
3369         (AssemblerBufferWithConstantPool):
3370         * bytecode/CodeBlock.cpp:
3371         (JSC::CodeBlock::CodeBlock):
3372         (JSC::CodeBlock::bytecodeOffset):
3373         (JSC):
3374         (JSC::replaceExistingEntries):
3375         * bytecode/CodeBlock.h:
3376         (JSC::CodeBlock::bytecodeOffsetForCallAtIndex):
3377         (JSC::CodeBlock::callReturnIndexVector):
3378         (JSC::CodeBlock::codeOrigins):
3379         (RareData):
3380         * bytecode/UnlinkedCodeBlock.h:
3381         (JSC::UnlinkedEvalCodeBlock::adoptVariables):
3382         (UnlinkedEvalCodeBlock):
3383         * bytecompiler/BytecodeGenerator.cpp:
3384         (JSC::BytecodeGenerator::BytecodeGenerator):
3385         (JSC::BytecodeGenerator::emitNewArray):
3386         (JSC::BytecodeGenerator::emitCall):
3387         (JSC::BytecodeGenerator::emitConstruct):
3388         * bytecompiler/BytecodeGenerator.h:
3389         (CallArguments):
3390         (JSC::BytecodeGenerator::instructions):
3391         (BytecodeGenerator):
3392         * bytecompiler/StaticPropertyAnalysis.h:
3393         (JSC::StaticPropertyAnalysis::create):
3394         (JSC::StaticPropertyAnalysis::StaticPropertyAnalysis):
3395         (StaticPropertyAnalysis):
3396         * bytecompiler/StaticPropertyAnalyzer.h:
3397         (StaticPropertyAnalyzer):
3398         (JSC::StaticPropertyAnalyzer::StaticPropertyAnalyzer):
3399         * dfg/DFGJITCompiler.cpp:
3400         (JSC::DFG::JITCompiler::link):
3401         * parser/ASTBuilder.h:
3402         (ASTBuilder):
3403         * runtime/ArgList.h:
3404         (MarkedArgumentBuffer):
3405         * runtime/ArrayPrototype.cpp:
3406         (JSC::arrayProtoFuncSort):
3407
3408 2013-04-07  Benjamin Poulain  <benjamin@webkit.org>
3409
3410         Use Vector::reserveInitialCapacity() when possible in JavaScriptCore runtime
3411         https://bugs.webkit.org/show_bug.cgi?id=114111
3412
3413         Reviewed by Andreas Kling.
3414
3415         Almost all the code was already using Vector::reserveInitialCapacity()
3416         and Vector::uncheckedAppend(). Fix the remaining parts.
3417
3418         * runtime/ArgList.h:
3419         (MarkedArgumentBuffer): The type VectorType is unused.
3420
3421         * runtime/ArrayPrototype.cpp:
3422         (JSC::arrayProtoFuncSort):
3423         Move the variable closer to where it is needed.
3424
3425         * runtime/JSArray.cpp:
3426         (JSC::JSArray::setLengthWithArrayStorage):
3427         * runtime/JSObject.cpp:
3428         (JSC::JSObject::getOwnPropertyNames):
3429
3430 2013-04-07  Patrick Gansterer  <paroga@webkit.org>
3431
3432         Remove references to Skia and V8 from CMake files
3433         https://bugs.webkit.org/show_bug.cgi?id=114130
3434
3435         Reviewed by Geoffrey Garen.
3436
3437         * shell/PlatformBlackBerry.cmake:
3438
3439 2013-04-07  David Kilzer  <ddkilzer@apple.com>
3440
3441         Remove the rest of SVG_DOM_OBJC_BINDINGS
3442         <http://webkit.org/b/114112>
3443
3444         Reviewed by Geoffrey Garen.
3445
3446         * Configurations/FeatureDefines.xcconfig:
3447         - Remove ENABLE_SVG_DOM_OBJC_BINDINGS macro.
3448
3449 2013-04-07  Oliver Hunt  <oliver@apple.com>
3450
3451         Inspector should display information about non-object exceptions
3452         https://bugs.webkit.org/show_bug.cgi?id=114123
3453
3454         Reviewed by Adele Peterson.
3455
3456         Make sure we store the right stack information, even when throwing
3457         a primitive.
3458
3459         * interpreter/CallFrame.h:
3460         (JSC::ExecState::clearSupplementaryExceptionInfo):
3461         (ExecState):
3462         * interpreter/Interpreter.cpp:
3463         (JSC::Interpreter::addStackTraceIfNecessary):
3464         (JSC::Interpreter::throwException):
3465
3466 2013-04-06  Oliver Hunt  <oliver@apple.com>
3467
3468         Unify the many and varied stack trace mechanisms, and make the result sane.
3469         https://bugs.webkit.org/show_bug.cgi?id=114072
3470
3471         Reviewed by Filip Pizlo.
3472
3473         Makes JSC::StackFrame record the bytecode offset and other necessary data
3474         rather than requiring us to perform eager evaluation of the line number, etc.
3475         Then remove most of the users of retrieveLastCaller, as most of them were
3476         using it to create a stack trace in a fairly incomplete and inefficient way.
3477
3478         StackFrame now also has a couple of helpers to get the line and column info.
3479
3480         * API/JSContextRef.cpp:
3481         (JSContextCreateBacktrace):
3482         * bytecompiler/BytecodeGenerator.cpp:
3483         (JSC::BytecodeGenerator::emitDebugHook):
3484         * interpreter/Interpreter.cpp:
3485         (JSC):
3486         (JSC::Interpreter::dumpRegisters):
3487         (JSC::Interpreter::unwindCallFrame):
3488         (JSC::getBytecodeOffsetForCallFrame):
3489         (JSC::getCallerInfo):
3490         (JSC::StackFrame::line):
3491         (JSC::StackFrame::column):
3492         (JSC::StackFrame::expressionInfo):
3493         (JSC::StackFrame::toString):
3494         (JSC::Interpreter::getStackTrace):
3495         (JSC::Interpreter::addStackTraceIfNecessary):
3496         (JSC::Interpreter::retrieveCallerFromVMCode):
3497         * interpreter/Interpreter.h:
3498         (StackFrame):
3499         (Interpreter):
3500         * runtime/Error.cpp:
3501         (JSC::throwError):
3502         * runtime/JSGlobalData.h:
3503         (JSC):
3504         (JSGlobalData):
3505         * runtime/JSGlobalObject.cpp:
3506         (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
3507
3508 2013-04-06  Geoffrey Garen  <ggaren@apple.com>
3509
3510         Removed v8 bindings hooks from IDL files
3511         https://bugs.webkit.org/show_bug.cgi?id=114091
3512
3513         Reviewed by Anders Carlsson and Sam Weinig.
3514
3515         * heap/HeapStatistics.h:
3516
3517 2013-04-03  Roger Fong  <roger_fong@apple.com>
3518
3519         Windows VS2010 build fix.
3520
3521         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
3522
3523 2013-04-06  Zan Dobersek  <zdobersek@igalia.com>
3524
3525         Remove the remaining PLATFORM(CHROMIUM) guard in JavaScriptCore
3526         https://bugs.webkit.org/show_bug.cgi?id=114082
3527
3528         Reviewed by Ryosuke Niwa.
3529
3530         * runtime/JSExportMacros.h: Remove the remaining PLATFORM(CHROMIUM) guard.
3531
3532 2013-04-06  Ed Bartosh  <bartosh@gmail.com>
3533
3534         --minimal build fails with error: control reaches end of non-void function
3535         https://bugs.webkit.org/show_bug.cgi?id=114085
3536
3537         Reviewed by Oliver Hunt.
3538
3539         * interpreter/Interpreter.cpp: return 0 if JIT is not enabled
3540         (JSC::getBytecodeOffsetForCallFrame):
3541
3542 2013-04-06  Geoffrey Garen  <ggaren@apple.com>
3543
3544         Try to fix the Windows build.
3545
3546         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
3547         Added back a symbol that is exported.
3548
3549 2013-04-06  Geoffrey Garen  <ggaren@apple.com>
3550
3551         Try to fix the Windows build.
3552
3553         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
3554         Removed symbols that aren't exported.
3555
3556 2013-04-06  Geoffrey Garen  <ggaren@apple.com>
3557
3558         Rolled out 147820 and 147818 because they caused plugins tests to ASSERT
3559         https://bugs.webkit.org/show_bug.cgi?id=114094
3560
3561         Reviewed by Anders Carlsson.
3562
3563         * API/JSContextRef.cpp:
3564         (JSContextCreateBacktrace):
3565         * bytecompiler/BytecodeGenerator.cpp:
3566         (JSC::BytecodeGenerator::emitDebugHook):
3567         * interpreter/Interpreter.cpp:
3568         (JSC):
3569         (JSC::Interpreter::dumpRegisters):
3570         (JSC::Interpreter::unwindCallFrame):
3571         (JSC::getLineNumberForCallFrame):
3572         (JSC::getCallerInfo):
3573         (JSC::Interpreter::getStackTrace):
3574         (JSC::Interpreter::addStackTraceIfNecessary):
3575         (JSC::Interpreter::retrieveCallerFromVMCode):
3576         * interpreter/Interpreter.h:
3577         (StackFrame):
3578         (JSC::StackFrame::toString):
3579         (JSC::StackFrame::friendlyLineNumber):
3580         (Interpreter):
3581         * runtime/Error.cpp:
3582         (JSC::throwError):
3583         * runtime/JSGlobalData.h:
3584         (JSC):
3585         (JSGlobalData):
3586         * runtime/JSGlobalObject.cpp:
3587         (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
3588
3589 2013-04-06  Patrick Gansterer  <paroga@webkit.org>
3590
3591         Unreviewed build fix after r146932.
3592
3593         * profiler/ProfilerDatabase.cpp:
3594         (Profiler):
3595
3596 2013-04-06  Patrick Gansterer  <paroga@webkit.org>
3597
3598         Do not call getenv() on Windows CE where it does not exist.
3599
3600         * runtime/JSGlobalData.cpp:
3601         (JSC::JSGlobalData::JSGlobalData):
3602
3603 2013-04-05  Benjamin Poulain  <benjamin@webkit.org>
3604
3605         Second attempt to fix the Windows bot
3606
3607         Unreviewed.
3608
3609         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
3610         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
3611
3612 2013-04-05  Benjamin Poulain  <bpoulain@apple.com>
3613
3614         Attempt to fix the Windows bot
3615
3616         Unreviewed.
3617
3618         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
3619         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
3620         r147825 removed the symbol for nullptr_t. Add it back.
3621
3622 2013-04-02  Roger Fong  <roger_fong@apple.com>
3623
3624         Build fix.
3625
3626         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
3627         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
3628
3629 2013-04-05  Oliver Hunt  <oliver@apple.com>
3630
3631         Build fix.
3632
3633         * interpreter/Interpreter.cpp:
3634         (JSC::getBytecodeOffsetForCallFrame):
3635
3636 2013-04-05  Oliver Hunt  <oliver@apple.com>
3637
3638         Unify the many and varied stack trace mechanisms, and make the result sane.
3639         https://bugs.webkit.org/show_bug.cgi?id=114072
3640
3641         Reviewed by Filip Pizlo.
3642
3643         Makes JSC::StackFrame record the bytecode offset and other necessary data
3644         rather than requiring us to perform eager evaluation of the line number, etc.
3645         Then remove most of the users of retrieveLastCaller, as most of them were
3646         using it to create a stack trace in a fairly incomplete and inefficient way.
3647
3648         StackFrame now also has a couple of helpers to get the line and column info.
3649
3650         * API/JSContextRef.cpp:
3651         (JSContextCreateBacktrace):
3652         * bytecompiler/BytecodeGenerator.cpp:
3653         (JSC::BytecodeGenerator::emitDebugHook):
3654         * interpreter/Interpreter.cpp:
3655         (JSC):
3656         (JSC::Interpreter::dumpRegisters):
3657         (JSC::Interpreter::unwindCallFrame):
3658         (JSC::getBytecodeOffsetForCallFrame):
3659         (JSC::getCallerInfo):
3660         (JSC::StackFrame::line):
3661         (JSC::StackFrame::column):
3662         (JSC::StackFrame::expressionInfo):
3663         (JSC::StackFrame::toString):
3664         (JSC::Interpreter::getStackTrace):
3665         (JSC::Interpreter::addStackTraceIfNecessary):
3666         (JSC::Interpreter::retrieveCallerFromVMCode):
3667         * interpreter/Interpreter.h:
3668         (StackFrame):
3669         (Interpreter):
3670         * runtime/Error.cpp:
3671         (JSC::throwError):
3672         * runtime/JSGlobalData.h:
3673         (JSC):
3674         (JSGlobalData):
3675         * runtime/JSGlobalObject.cpp:
3676         (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
3677
3678 2013-04-05  Mark Hahnenberg  <mhahnenberg@apple.com>
3679
3680         tryCacheGetByID sets StructureStubInfo accessType to an incorrect value
3681         https://bugs.webkit.org/show_bug.cgi?id=114068
3682
3683         Reviewed by Geoffrey Garen.
3684
3685         In the case where we have a non-Value cacheable property, we set the StructureStubInfo accessType to
3686         get_by_id_self, but then we don't patch self and instead patch in a get_by_id_self_fail. This leads to
3687         incorrect profiling data so when the DFG compiles the function, it uses a GetByOffset rather than a GetById,
3688         which leads to loading a GetterSetter directly out of an object.
3689
3690         * jit/JITStubs.cpp:
3691         (JSC::tryCacheGetByID):
3692         (JSC::DEFINE_STUB_FUNCTION):
3693
3694 2013-04-05  Filip Pizlo  <fpizlo@apple.com>
3695
3696         If CallFrame::trueCallFrame() knows that it's about to read garbage instead of a valid CodeOrigin/InlineCallFrame, then it should give up and return 0 and all callers should be robust against this
3697         https://bugs.webkit.org/show_bug.cgi?id=114062
3698
3699         Reviewed by Oliver Hunt.
3700
3701         * bytecode/CodeBlock.h:
3702         (JSC::CodeBlock::canGetCodeOrigin):
3703         (CodeBlock):
3704         * interpreter/CallFrame.cpp:
3705         (JSC::CallFrame::trueCallFrame):
3706         * interpreter/Interpreter.cpp:
3707         (JSC::Interpreter::getStackTrace):
3708
3709 2013-04-05  Geoffrey Garen  <ggaren@apple.com>
3710
3711         Made USE(JSC) unconditional
3712         https://bugs.webkit.org/show_bug.cgi?id=114058
3713
3714         Reviewed by Anders Carlsson.
3715
3716         * config.h:
3717
3718 2013-04-05  Filip Pizlo  <fpizlo@apple.com>
3719
3720         Unreviewed, rolling out http://trac.webkit.org/changeset/147729
3721
3722         It's causing a bunch of breakage on some more strict compilers:
3723         <inline asm>:1267:2: error: ambiguous instructions require an explicit suffix (could be 'ficomps', or 'ficompl')
3724
3725         * offlineasm/x86.rb:
3726
3727 2013-04-05  Roger Fong  <roger_fong@apple.com>
3728
3729         More VS2010 solution makefile fixes.
3730         <rdar://problem/13588964>
3731
3732         * JavaScriptCore.vcxproj/JavaScriptCore.make:
3733
3734 2013-04-05  Allan Sandfeld Jensen  <allan.jensen@digia.com>
3735
3736         LLint should be able to use x87 instead of SSE for floating pointer
3737
3738         https://bugs.webkit.org/show_bug.cgi?id=112239
3739
3740         Reviewed by Filip Pizlo.
3741
3742         Implements LLInt floating point operations in x87, to ensure we support
3743         x86 without SSE2.
3744
3745         X86 (except 64bit) now defaults to using x87 instructions in order to
3746         support all 32bit x86 back to i686. The implementation uses the fucomi
3747         instruction from i686 which sets the new minimum.
3748
3749         * offlineasm/x86.rb:
3750
3751 2013-04-04  Christophe Dumez  <ch.dumez@sisa.samsung.com>
3752
3753         Unreviewed EFL build fix.
3754
3755         We had undefined reference to `JSC::CodeOrigin::maximumBytecodeIndex'.
3756
3757         * bytecode/CodeBlock.cpp:
3758         (JSC::CodeBlock::findClosureCallForReturnPC):
3759         (JSC::CodeBlock::bytecodeOffset):
3760
3761 2013-04-04  Geoffrey Garen  <ggaren@apple.com>
3762
3763         Stop pretending that statements return a value
3764         https://bugs.webkit.org/show_bug.cgi?id=113969
3765
3766         Reviewed by Oliver Hunt.
3767
3768         Expressions have an intrinsic value, which they return to their parent
3769         in the AST.
3770
3771         Statements just execute for effect in sequence.
3772
3773         This patch moves emitBytecode into the ExpressionNode and StatementNode
3774         subclasses, and changes the SatementNode subclass to return void. This
3775         eliminates some cruft where we used to return 0, or try to save a bogus
3776         register and return it, as if a statement had a consuming parent in the
3777         AST.
3778
3779         * bytecompiler/BytecodeGenerator.h:
3780         (JSC::BytecodeGenerator::emitNode):
3781         (BytecodeGenerator):
3782         (JSC::BytecodeGenerator::emitNodeInConditionContext):
3783         * bytecompiler/NodesCodegen.cpp:
3784         (JSC::ConstStatementNode::emitBytecode):
3785         (JSC::BlockNode::emitBytecode):
3786         (JSC::EmptyStatementNode::emitBytecode):
3787         (JSC::DebuggerStatementNode::emitBytecode):
3788         (JSC::ExprStatementNode::emitBytecode):
3789         (JSC::VarStatementNode::emitBytecode):
3790         (JSC::IfNode::emitBytecode):
3791         (JSC::IfElseNode::emitBytecode):
3792         (JSC::DoWhileNode::emitBytecode):
3793         (JSC::WhileNode::emitBytecode):
3794         (JSC::ForNode::emitBytecode):
3795         (JSC::ForInNode::emitBytecode):
3796         (JSC::ContinueNode::emitBytecode):
3797         (JSC::BreakNode::emitBytecode):
3798         (JSC::ReturnNode::emitBytecode):
3799         (JSC::WithNode::emitBytecode):
3800         (JSC::CaseClauseNode::emitBytecode):
3801         (JSC::CaseBlockNode::emitBytecodeForBlock):
3802         (JSC::SwitchNode::emitBytecode):
3803         (JSC::LabelNode::emitBytecode):
3804         (JSC::ThrowNode::emitBytecode):
3805         (JSC::TryNode::emitBytecode):
3806         (JSC::ScopeNode::emitStatementsBytecode):
3807         (JSC::ProgramNode::emitBytecode):
3808         (JSC::EvalNode::emitBytecode):
3809         (JSC::FunctionBodyNode::emitBytecode):
3810         (JSC::FuncDeclNode::emitBytecode):
3811         * parser/NodeConstructors.h:
3812         (JSC::PropertyListNode::PropertyListNode):
3813         (JSC::ArgumentListNode::ArgumentListNode):
3814         * parser/Nodes.h:
3815         (Node):
3816         (ExpressionNode):
3817         (StatementNode):
3818         (ConstStatementNode):
3819         (BlockNode):
3820         (EmptyStatementNode):
3821         (DebuggerStatementNode):
3822         (ExprStatementNode):
3823         (VarStatementNode):
3824         (IfNode):
3825         (IfElseNode):
3826         (DoWhileNode):
3827         (WhileNode):
3828         (ForNode):
3829         (ForInNode):
3830         (ContinueNode):
3831         (BreakNode):
3832         (ReturnNode):
3833         (WithNode):
3834         (LabelNode):
3835         (ThrowNode):
3836         (TryNode):
3837         (ProgramNode):
3838         (EvalNode):
3839         (FunctionBodyNode):
3840         (FuncDeclNode):
3841         (CaseBlockNode):
3842         (SwitchNode):
3843
3844 2013-04-04  Oliver Hunt  <oliver@apple.com>
3845
3846         Exception stack unwinding doesn't handle inline callframes correctly
3847         https://bugs.webkit.org/show_bug.cgi?id=113952
3848
3849         Reviewed by Geoffrey Garen.
3850
3851         The basic problem here is that the exception stack unwinding was
3852         attempting to be "clever" and avoid doing a correct stack walk
3853         as it "knew" inline callframes couldn't have exception handlers.
3854
3855         This used to be safe as the exception handling machinery was
3856         designed to fail gently and just claim that no handler existed.
3857         This was "safe" and even "correct" inasmuch as we currently
3858         don't run any code with exception handlers through the dfg.
3859
3860         This patch fixes the logic by simply making everything uniformly
3861         use the safe stack walking machinery, and making the correct
3862         boundary checks occur everywhere that they should.
3863
3864         * bytecode/CodeBlock.cpp:
3865         (JSC::CodeBlock::findClosureCallForReturnPC):
3866         (JSC::CodeBlock::bytecodeOffset):
3867         * interpreter/Interpreter.cpp:
3868         (JSC):
3869         (JSC::Interpreter::dumpRegisters):
3870         (JSC::Interpreter::unwindCallFrame):
3871         (JSC::getCallerInfo):
3872         (JSC::Interpreter::getStackTrace):
3873         (JSC::Interpreter::retrieveCallerFromVMCode):
3874
3875 2013-04-04  Geoffrey Garen  <ggaren@apple.com>
3876
3877         Removed a defunct comment
3878         https://bugs.webkit.org/show_bug.cgi?id=113948
3879
3880         Reviewed by Oliver Hunt.
3881
3882         This is also a convenient way to test the EWS.
3883
3884         * bytecompiler/BytecodeGenerator.cpp:
3885         (JSC):
3886
3887 2013-04-04  Martin Robinson  <mrobinson@igalia.com>
3888
3889         [GTK] Remove the gyp build
3890         https://bugs.webkit.org/show_bug.cgi?id=113942
3891
3892         Reviewed by Gustavo Noronha Silva.
3893
3894         * JavaScriptCore.gyp/JavaScriptCoreGTK.gyp: Removed.
3895         * JavaScriptCore.gyp/redirect-stdout.sh: Removed.
3896
3897 2013-04-04  Geoffrey Garen  <ggaren@apple.com>
3898
3899         Simplified bytecode generation by merging prefix and postfix nodes
3900         https://bugs.webkit.org/show_bug.cgi?id=113925
3901
3902         Reviewed by Filip Pizlo.
3903
3904         PostfixNode now inherits from PrefixNode, so when we detect that we're
3905         in a context where postifx and prefix are equivalent, PostFixNode can
3906         just call through to PrefixNode codegen, instead of duplicating the
3907         logic.
3908
3909         * bytecompiler/NodesCodegen.cpp:
3910         (JSC::PostfixNode::emitResolve):
3911         (JSC::PostfixNode::emitBracket):
3912         (JSC::PostfixNode::emitDot):
3913         * parser/NodeConstructors.h:
3914         (JSC::PostfixNode::PostfixNode):
3915         * parser/Nodes.h:
3916         (JSC):
3917         (PrefixNode):
3918         (PostfixNode):
3919
3920 2013-04-04  Andras Becsi  <andras.becsi@digia.com>
3921
3922         Fix the build with GCC 4.8
3923         https://bugs.webkit.org/show_bug.cgi?id=113147
3924
3925         Reviewed by Allan Sandfeld Jensen.
3926
3927         Initialize JSObject* exception to suppress warnings that make
3928         the build fail because of -Werror=maybe-uninitialized.
3929
3930         * runtime/Executable.cpp:
3931         (JSC::FunctionExecutable::compileForCallInternal):
3932         (JSC::FunctionExecutable::compileForConstructInternal):
3933
3934 2013-04-02  Mark Hahnenberg  <mhahnenberg@apple.com>
3935
3936         get_by_pname can become confused when iterating over objects with static properties
3937         https://bugs.webkit.org/show_bug.cgi?id=113831
3938
3939         Reviewed by Geoffrey Garen.
3940
3941         get_by_pname doesn't take static properties into account when using a JSPropertyNameIterator to directly
3942         access an object's backing store. One way to fix this is to not cache any properties when iterating over
3943         objects with static properties. This patch fixes the bug that was originally reported on swisscom.ch.
3944
3945         * runtime/JSObject.cpp:
3946         (JSC::JSObject::getOwnNonIndexPropertyNames):
3947         * runtime/JSPropertyNameIterator.cpp:
3948         (JSC::JSPropertyNameIterator::create):
3949         * runtime/PropertyNameArray.h:
3950         (JSC::PropertyNameArray::PropertyNameArray):
3951         (JSC::PropertyNameArray::numCacheableSlots):
3952         (JSC::PropertyNameArray::setNumCacheableSlots):
3953         (PropertyNameArray):
3954
3955 2013-04-02  Geoffrey Garen  <ggaren@apple.com>
3956
3957         DFG should compile a little sooner
3958         https://bugs.webkit.org/show_bug.cgi?id=113835
3959
3960         Unreviewed.
3961
3962         Rolled out r147511 because it was based on incorrect performance
3963         measurement.
3964
3965         * bytecode/CodeBlock.cpp:
3966         (JSC::CodeBlock::optimizationThresholdScalingFactor):
3967
3968 2013-04-02  Geoffrey Garen  <ggaren@apple.com>
3969
3970         DFG should compile a little sooner
3971         https://bugs.webkit.org/show_bug.cgi?id=113835
3972
3973         Reviewed by Michael Saboff.
3974
3975         2% speedup on SunSpider.
3976
3977         2% speedup on JSRegress.
3978
3979         Neutral on Octane, v8, and Kraken.
3980
3981         The worst-hit single sub-test is kraken-stanford-crypto-ccm.js, which gets
3982         18% slower. Since Kraken is neutral overall in its preferred mean, I
3983         think that's OK for now.
3984
3985         (Our array indexing speculation fails pathologically on
3986         kraken-stanford-crypto-ccm.js. Compiling sooner is a regression because
3987         it triggers those failures sooner. I'm going to file some follow-up bugs
3988         explaining how to fix our speculations on this sub-test, at which point
3989         compiling earlier should become a slight speedup on Kraken overall.)
3990
3991         * bytecode/CodeBlock.cpp:
3992         (JSC::CodeBlock::optimizationThresholdScalingFactor): I experimented
3993         with a few different options, including reducing the coefficient 'a'.
3994         A simple linear reduction on instruction count worked best.
3995
3996 2013-04-01  Benjamin Poulain  <benjamin@webkit.org>
3997
3998         Use Vector::reserveInitialCapacity and Vector::uncheckedAppend for JSC's APIs
3999         https://bugs.webkit.org/show_bug.cgi?id=113651
4000
4001         Reviewed by Andreas Kling.
4002
4003         This removes a bunch of branches on initialization and when
4004         filling the vector.
4005
4006         * API/JSCallbackConstructor.cpp:
4007         (JSC::constructJSCallback):
4008         * API/JSCallbackFunction.cpp:
4009         (JSC::JSCallbackFunction::call):
4010         * API/JSCallbackObjectFunctions.h:
4011         (JSC::::construct):
4012         (JSC::::call):
4013         * API/JSObjectRef.cpp:
4014         (JSObjectCopyPropertyNames):
4015
4016 2013-04-01  Mark Hahnenberg  <mhahnenberg@apple.com>
4017
4018         Fixing borked VS 2010 project file
4019
4020         Unreviewed bot greening.
4021
4022         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
4023         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
4024
4025 2013-04-01  Mark Hahnenberg  <mhahnenberg@apple.com>
4026
4027         One more Windows build fix
4028
4029         Unreviewed.
4030
4031         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
4032
4033 2013-04-01  Mark Hahnenberg  <mhahnenberg@apple.com>
4034
4035         More build fallout fixes.
4036
4037         Unreviewed build fix.
4038
4039         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def: Add new export symbols.
4040         * heap/SuperRegion.cpp: Windows didn't like "LLU".
4041
4042 2013-04-01  Mark Hahnenberg  <mhahnenberg@apple.com>
4043
4044         r147324 broke the world
4045         https://bugs.webkit.org/show_bug.cgi?id=113704
4046
4047         Unreviewed build fix.
4048
4049         Remove a bunch of unused variables and use the correctly sized types for 32-bit platforms.
4050
4051         * heap/BlockAllocator.cpp:
4052         (JSC::BlockAllocator::BlockAllocator):
4053         * heap/BlockAllocator.h:
4054         (BlockAllocator):
4055         * heap/Heap.cpp:
4056         (JSC::Heap::Heap):
4057         * heap/SuperRegion.cpp:
4058         (JSC::SuperRegion::SuperRegion):
4059         * heap/SuperRegion.h:
4060         (SuperRegion):
4061
4062 2013-04-01  Mark Hahnenberg  <mhahnenberg@apple.com>
4063
4064         32-bit Windows build fix
4065
4066         Unreviewed build fix.
4067
4068         * heap/SuperRegion.cpp:
4069         * heap/SuperRegion.h: Use uint64_t instead of size_t.
4070         (SuperRegion):
4071
4072 2013-04-01  Mark Hahnenberg  <mhahnenberg@apple.com>
4073
4074         EFL build fix
4075
4076         Unreviewed build fix.
4077
4078         * CMakeLists.txt:
4079
4080 2013-03-31  Mark Hahnenberg  <mhahnenberg@apple.com>
4081
4082         Regions should be allocated from the same contiguous segment of virtual memory
4083         https://bugs.webkit.org/show_bug.cgi?id=113662
4084
4085         Reviewed by Filip Pizlo.
4086
4087         Instead of letting the OS spread our Regions all over the place, we should allocate them all within
4088         some range of each other. This change will open the door to some other optimizations, e.g. doing simple
4089         range checks for our write barriers and compressing JSCell pointers to 32-bits.
4090
4091         Added new SuperRegion class that encapsulates allocating Regions from a contiguous reserved chunk of
4092         virtual address space. It functions very similarly to the FixedVMPoolExecutableAllocator class used by the JIT.
4093
4094         Also added two new subclasses of Region, NormalRegion and ExcessRegion.
4095
4096         NormalRegion is the type of Region that is normally allocated when there is available space remaining
4097         in the SuperRegion. If we ever run out of space in the SuperRegion, we fall back to allocating
4098         ExcessRegions, which are identical to how Regions have behaved up until now, i.e. they contain a
4099         PageAllocationAligned.
4100
4101         We only use the SuperRegion (and NormalRegions) on 64-bit systems, since it doesn't make sense to reserve the
4102         entire 4 GB address space on 32-bit systems just for the JS heap.
4103
4104         * GNUmakefile.list.am:
4105         * JavaScriptCore.gypi:
4106         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
4107         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
4108         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
4109         * JavaScriptCore.xcodeproj/project.pbxproj:
4110         * Target.pri:
4111         * heap/BlockAllocator.cpp:
4112         (JSC::BlockAllocator::BlockAllocator):
4113         * heap/BlockAllocator.h:
4114         (JSC):
4115         (BlockAllocator):
4116         (JSC::BlockAllocator::allocate):
4117         (JSC::BlockAllocator::allocateCustomSize):
4118         (JSC::BlockAllocator::deallocateCustomSize):
4119         * heap/Heap.cpp:
4120         (JSC::Heap::Heap):
4121         (JSC):
4122         (JSC::Heap::didExceedFixedHeapSizeLimit):
4123         * heap/Heap.h:
4124         (Heap):
4125         * heap/MarkedBlock.cpp:
4126         (JSC::MarkedBlock::create):
4127         * heap/Region.h:
4128         (Region):
4129         (JSC):
4130         (NormalRegion):
4131         (JSC::NormalRegion::base):
4132         (JSC::NormalRegion::size):
4133         (ExcessRegion):
4134         (JSC::ExcessRegion::base):
4135         (JSC::ExcessRegion::size):
4136         (JSC::NormalRegion::NormalRegion):
4137         (JSC::NormalRegion::tryCreate):
4138         (JSC::NormalRegion::tryCreateCustomSize):
4139         (JSC::NormalRegion::reset):
4140         (JSC::ExcessRegion::ExcessRegion):
4141         (JSC::ExcessRegion::~ExcessRegion):
4142         (JSC::ExcessRegion::create):
4143         (JSC::ExcessRegion::createCustomSize):
4144         (JSC::ExcessRegion::reset):
4145         (JSC::Region::Region):
4146         (JSC::Region::initializeBlockList):
4147         (JSC::Region::create):
4148         (JSC::Region::createCustomSize):
4149         (JSC::Region::~Region):
4150         (JSC::Region::destroy):
4151         (JSC::Region::reset):
4152         (JSC::Region::deallocate):
4153         (JSC::Region::base):
4154         (JSC::Region::size):
4155         * heap/SuperRegion.cpp: Added.
4156         (JSC):
4157         (JSC::SuperRegion::SuperRegion):
4158         (JSC::SuperRegion::getAlignedBase):
4159         (JSC::SuperRegion::allocateNewSpace):
4160         (JSC::SuperRegion::notifyNeedPage):
4161         (JSC::SuperRegion::notifyPageIsFree):
4162         * heap/SuperRegion.h: Added.
4163         (JSC):
4164         (SuperRegion):
4165
4166 2013-04-01  Benjamin Poulain  <benjamin@webkit.org>
4167
4168         Remove an unused variable from the ARMv7 Assembler
4169         https://bugs.webkit.org/show_bug.cgi?id=113653
4170
4171         Reviewed by Andreas Kling.
4172
4173         * assembler/ARMv7Assembler.h:
4174         (ARMv7Assembler):
4175
4176 2013-03-31  Adam Barth  <abarth@webkit.org>
4177
4178         [Chromium] Yarr should build using a separate GYP file from JavaScriptCore
4179         https://bugs.webkit.org/show_bug.cgi?id=113652
4180
4181         Reviewed by Nico Weber.
4182
4183         This patch moves JavaScriptCore.gyp to yarr.gyp because Chromium only
4184         uses this GYP file to build yarr.
4185
4186         * JavaScriptCore.gyp/JavaScriptCoreGTK.gyp:
4187         * JavaScriptCore.gypi:
4188         * yarr/yarr.gyp: Renamed from Source/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp.
4189
4190 2013-03-31  Filip Pizlo  <fpizlo@apple.com>
4191
4192         Unreviewed, fix a comment. While thinking about TBAA for array accesses,
4193         I realized that we have to be super careful about aliasing of typed arrays.
4194
4195         * dfg/DFGCSEPhase.cpp:
4196         (JSC::DFG::CSEPhase::getByValLoadElimination):
4197
4198 2013-03-30  Mark Hahnenberg  <mhahnenberg@apple.com>
4199
4200         Move Region into its own header
4201         https://bugs.webkit.org/show_bug.cgi?id=113617
4202
4203         Reviewed by Geoffrey Garen.
4204
4205         BlockAllocator.h is getting a little crowded. We should move the Region class into its own
4206         header, since it's pretty independent from the BlockAllocator.
4207
4208         * GNUmakefile.list.am:
4209         * JavaScriptCore.gypi:
4210         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
4211         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
4212         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
4213         * JavaScriptCore.xcodeproj/project.pbxproj:
4214         * heap/BlockAllocator.h:
4215         (JSC):
4216         * heap/Region.h: Added.
4217         (JSC):
4218         (DeadBlock):
4219         (JSC::DeadBlock::DeadBlock):
4220         (Region):
4221         (JSC::Region::blockSize):
4222         (JSC::Region::isFull):
4223         (JSC::Region::isEmpty):
4224         (JSC::Region::isCustomSize):
4225         (JSC::Region::create):
4226         (JSC::Region::createCustomSize):
4227         (JSC::Region::Region):
4228         (JSC::Region::~Region):
4229         (JSC::Region::reset):
4230         (JSC::Region::allocate):
4231         (JSC::Region::deallocate):
4232
4233 2013-03-29  Mark Hahnenberg  <mhahnenberg@apple.com>
4234
4235         Objective-C API: Remove -[JSManagedValue managedValueWithValue:owner:]
4236         https://bugs.webkit.org/show_bug.cgi?id=113602
4237
4238         Reviewed by Geoffrey Garen.
4239
4240         Since we put the primary way of keeping track of external object graphs (i.e. "managed" references)
4241         in JSVirtualMachine, there is some overlap in the functionality of that interface and JSManagedValue.
4242         Specifically, we no longer need the methods that include an owner, since ownership is now tracked
4243         by JSVirtualMachine. These JSManagedValues will become weak pointers unless they are used
4244         with [JSVirtualMachine addManagedReference:withOwner:], in which case their lifetime is tied to that
4245         of their owner.
4246
4247         * API/JSManagedValue.h:
4248         * API/JSManagedValue.mm:
4249         (-[JSManagedValue init]):
4250         (-[JSManagedValue initWithValue:]):
4251         (JSManagedValueHandleOwner::isReachableFromOpaqueRoots):
4252         * API/JSVirtualMachine.mm:
4253         (getInternalObjcObject):
4254         * API/tests/testapi.mm:
4255         (-[TextXYZ setOnclick:]):
4256         (-[TextXYZ dealloc]):
4257
4258 2013-03-29  Geoffrey Garen  <ggaren@apple.com>
4259
4260         Simplified bytecode generation by unforking "condition context" codegen
4261         https://bugs.webkit.org/show_bug.cgi?id=113554
4262
4263         Reviewed by Mark Hahnenberg.
4264
4265         Now, a node that establishes a condition context can always ask its child
4266         nodes to generate into that context.
4267
4268         This has a few advantages:
4269
4270         (*) Removes a bunch of code;
4271
4272         (*) Optimizes a few missed cases like "if (!(x < 2))", "if (!!x)", and
4273         "if (!x || !y)";
4274
4275         (*) Paves the way to removing more opcodes.
4276
4277         * bytecode/Opcode.h:
4278         (JSC): Separated out the branching opcodes for clarity.
4279         * bytecompiler/NodesCodegen.cpp:
4280         (JSC::ExpressionNode::emitBytecodeInConditionContext): All expressions
4281         can be emitted in a condition context now -- the default behavior is
4282         to branch based on the expression's value.
4283
4284         (JSC::LogicalNotNode::emitBytecodeInConditionContext):
4285         (JSC::LogicalOpNode::emitBytecodeInConditionContext):
4286         (JSC::ConditionalNode::emitBytecode):
4287         (JSC::IfNode::emitBytecode):
4288         (JSC::IfElseNode::emitBytecode):
4289         (JSC::DoWhileNode::emitBytecode):
4290         (JSC::WhileNode::emitBytecode):
4291         (JSC::ForNode::emitBytecode):
4292         * parser/Nodes.h:
4293         (JSC::ExpressionNode::isSubtract):
4294         (ExpressionNode):
4295         (LogicalNotNode):
4296         (LogicalOpNode): Removed lots of code for handling expressions
4297         that couldn't generate into a condition context because all expressions
4298         can now.
4299
4300 2013-03-28  Geoffrey Garen  <ggaren@apple.com>
4301
4302         Simplified the bytecode by removing op_loop and op_loop_if_*
4303         https://bugs.webkit.org/show_bug.cgi?id=113548
4304
4305         Reviewed by Filip Pizlo.
4306
4307         Regular jumps will suffice.
4308
4309         These opcodes are identical to branches, except they also do timeout
4310         checking. That style of timeout checking has been broken for a long
4311         time, and when we add back timeout checking, it won't use these opcodes.
4312
4313         * JavaScriptCore.order:
4314         * bytecode/CodeBlock.cpp:
4315         (JSC::CodeBlock::dumpBytecode):
4316         * bytecode/Opcode.h:
4317         (JSC):
4318         (JSC::padOpcodeName):
4319         * bytecode/PreciseJumpTargets.cpp:
4320         (JSC::computePreciseJumpTargets):
4321         * bytecompiler/BytecodeGenerator.cpp:
4322         (JSC::BytecodeGenerator::emitJump):
4323         (JSC::BytecodeGenerator::emitJumpIfTrue):
4324         (JSC::BytecodeGenerator::emitJumpIfFalse):
4325         * dfg/DFGByteCodeParser.cpp:
4326         (JSC::DFG::ByteCodeParser::parseBlock):
4327         * dfg/DFGCapabilities.h:
4328         (JSC::DFG::canCompileOpcode):
4329         * jit/JIT.cpp:
4330         (JSC::JIT::privateCompileMainPass):
4331         (JSC::JIT::privateCompileSlowCases):
4332         * jit/JIT.h:
4333         (JIT):
4334         (JSC):
4335         * llint/LowLevelInterpreter.asm:
4336         * llint/LowLevelInterpreter32_64.asm:
4337         * llint/LowLevelInterpreter64.asm:
4338
4339 2013-03-28  Geoffrey Garen  <ggaren@apple.com>
4340
4341         Simplified the bytecode by removing op_jmp_scopes
4342         https://bugs.webkit.org/show_bug.cgi?id=113545
4343
4344         Reviewed by Filip Pizlo.
4345
4346         We already have op_pop_scope and op_jmp, so we don't need op_jmp_scopes.
4347         Using op_jmp_scopes was also adding a "jump to self" to codegen for
4348         return statements, which was pretty silly.
4349
4350         * JavaScriptCore.order:
4351         * bytecode/CodeBlock.cpp:
4352         (JSC::CodeBlock::dumpBytecode):
4353         * bytecode/Opcode.h:
4354         (JSC::padOpcodeName):
4355         * bytecode/PreciseJumpTargets.cpp:
4356         (JSC::computePreciseJumpTargets):
4357         * bytecompiler/BytecodeGenerator.cpp:
4358         (JSC::BytecodeGenerator::emitComplexPopScopes):
4359         (JSC::BytecodeGenerator::emitPopScopes):
4360         * bytecompiler/BytecodeGenerator.h:
4361         (BytecodeGenerator):
4362         * bytecompiler/NodesCodegen.cpp:
4363         (JSC::ContinueNode::emitBytecode):
4364         (JSC::BreakNode::emitBytecode):
4365         (JSC::ReturnNode::emitBytecode):
4366         * jit/JIT.cpp:
4367         (JSC::JIT::privateCompileMainPass):
4368         * jit/JIT.h:
4369         * jit/JITOpcodes.cpp:
4370         * jit/JITOpcodes32_64.cpp:
4371         * jit/JITStubs.cpp:
4372         * jit/JITStubs.h:
4373         * llint/LLIntSlowPaths.cpp:
4374         * llint/LLIntSlowPaths.h:
4375         * llint/LowLevelInterpreter.asm:
4376
4377 2013-03-28  Mark Hahnenberg  <mhahnenberg@apple.com>
4378
4379         Safari hangs during test262 run in CodeCache::pruneSlowCase
4380         https://bugs.webkit.org/show_bug.cgi?id=113469
4381
4382         Reviewed by Geoffrey Garen.
4383
4384         We can end up hanging for quite some time if we add a lot of small keys to the CodeCache.
4385         By the time we get around to pruning the cache, we have a potentially tens or hundreds of
4386         thousands of small entries, which can cause a noticeable hang when pruning them.
4387
4388         To fix this issue we added a hard cap to the number of entries in the cache because we
4389         could potentially have to remove every element in the map.
4390
4391         * runtime/CodeCache.cpp:
4392         (JSC::CodeCacheMap::pruneSlowCase): We need to prune until we're both under the hard cap and the
4393         capacity in bytes.
4394         * runtime/CodeCache.h:
4395         (CodeCacheMap):
4396         (JSC::CodeCacheMap::numberOfEntries): Convenience accessor function to the number of entries in
4397         the map that does the cast to size_t of m_map.size() for us.
4398         (JSC::CodeCacheMap::canPruneQuickly): Checks that the total number is under the hard cap. We put this
4399         check inside a function to more accurately describe why we're doing the check and to abstract out
4400         the actual calculation in case we want to coalesce calls to pruneSlowCase in the future.
4401         (JSC::CodeCacheMap::prune): Check the number of entries against our hard cap. If it's greater than
4402         the cap then we need to drop down to pruneSlowCase.
4403
4404 2013-03-28  Zan Dobersek  <zdobersek@igalia.com>
4405
4406         Unreviewed build fix for the EFL and GTK ports.
4407
4408         * runtime/CodeCache.cpp:
4409         (JSC::CodeCacheMap::pruneSlowCase): Pass a 0 casted to the int64_t type instead of 0LL
4410         to the std::max call so the arguments' types match.
4411
4412 2013-03-27  Geoffrey Garen  <ggaren@apple.com>
4413
4414         Unreviewed build fix: Removed a dead field.
4415
4416         Pointed out by Mark Lam.
4417
4418         * dfg/DFGByteCodeParser.cpp:
4419         (JSC::DFG::ByteCodeParser::ByteCodeParser):
4420         (ByteCodeParser):
4421
4422 2013-03-27  Geoffrey Garen  <ggaren@apple.com>
4423
4424         Unreviewed build fix: Removed a dead field.
4425
4426         * dfg/DFGByteCodeParser.cpp:
4427         (JSC::DFG::ByteCodeParser::ByteCodeParser):
4428         (ByteCodeParser):
4429
4430 2013-03-27  Geoffrey Garen  <ggaren@apple.com>
4431
4432         Removed some dead code in the DFG bytecode parser
4433         https://bugs.webkit.org/show_bug.cgi?id=113472
4434
4435         Reviewed by Sam Weinig.
4436
4437         Now that Phi creation and liveness analysis are separate passes, we can
4438         remove the vestiges of code that used to do that in the bytecode
4439         parser.
4440
4441         * dfg/DFGByteCodeParser.cpp:
4442         (ByteCodeParser):
4443         (JSC::DFG::ByteCodeParser::addToGraph):
4444         (JSC::DFG::ByteCodeParser::parse):
4445
4446 2013-03-27  Filip Pizlo  <fpizlo@apple.com>
4447
4448         JIT and DFG should NaN-check loads from Float32 arrays
4449         https://bugs.webkit.org/show_bug.cgi?id=113462
4450         <rdar://problem/13490804>
4451
4452         Reviewed by Mark Hahnenberg.
4453
4454         * dfg/DFGSpeculativeJIT.cpp:
4455         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
4456         * jit/JITPropertyAccess.cpp:
4457         (JSC::JIT::emitFloatTypedArrayGetByVal):
4458
4459 2013-03-27  Mark Hahnenberg  <mhahnenberg@apple.com>
4460
4461         CodeCache::m_capacity can becoming negative, producing undefined results in pruneSlowCase
4462         https://bugs.webkit.org/show_bug.cgi?id=113453
4463
4464         Reviewed by Geoffrey Garen.
4465
4466         * runtime/CodeCache.cpp:
4467         (JSC::CodeCacheMap::pruneSlowCase): We make sure that m_minCapacity doesn't drop below zero now.
4468         This prevents m_capacity from doing the same.
4469
4470 2013-03-27  Filip Pizlo  <fpizlo@apple.com>
4471
4472         DFG should use CheckStructure for typed array checks whenever possible
4473         https://bugs.webkit.org/show_bug.cgi?id=113374
4474
4475         Reviewed by Geoffrey Garen.
4476
4477         We used to do the right thing, but it appears that this regressed at some point. Since the
4478         FixupPhase now has the ability to outright remove spurious CheckStructures on array
4479         operations, it is profitable for the ByteCodeParser to insert CheckStructures whenver there
4480         is a chance that it might be profitable, and when the profiling tells us what structure to
4481         check.
4482
4483         Also added some code for doing ArrayProfile debugging.
4484
4485         This is a slightly speed-up. Maybe 3% on Mandreel.
4486
4487         * bytecode/ArrayProfile.cpp:
4488         (JSC::ArrayProfile::computeUpdatedPrediction):
4489         * dfg/DFGArrayMode.h:
4490         (JSC::DFG::ArrayMode::benefitsFromStructureCheck):
4491
4492 2013-03-27  Zeno Albisser  <zeno@webkit.org>
4493
4494         [Qt] Remove Qt specific WorkQueueItem definitions.
4495         https://bugs.webkit.org/show_bug.cgi?id=112891
4496
4497         This patch is preparation work for removing
4498         WorkQueue related code from TestRunnerQt and
4499         replacing it with generic TestRunner code.
4500
4501         Reviewed by Benjamin Poulain.
4502
4503         * API/JSStringRefQt.cpp:
4504         (JSStringCreateWithQString):
4505             Adding a convenience function to create a
4506             JSStringRef from a QString.
4507         * API/JSStringRefQt.h:
4508
4509 2013-03-26  Filip Pizlo  <fpizlo@apple.com>
4510
4511         REGRESSION: Sometimes, operations on proven strings ignore changes to the string prototype
4512         https://bugs.webkit.org/show_bug.cgi?id=113353
4513         <rdar://problem/13510778>
4514
4515         Reviewed by Mark Hahnenberg and Geoffrey Garen.
4516
4517         ToString should call speculateStringObject() even if you know that it's a string object, since
4518         it calls it to also get the watchpoint. Note that even with this change, if you do
4519         Phantom(Check:StringObject:@a), it might get eliminated just because we proved that @a is a
4520         string object (thereby eliminating the prototype watchpoint); that's fine since ToString is
4521         MustGenerate and never decays to Phantom.
4522
4523         * dfg/DFGSpeculativeJIT.cpp:
4524         (JSC::DFG::SpeculativeJIT::compileToStringOnCell):
4525         (JSC::DFG::SpeculativeJIT::speculateStringObject):
4526         (JSC::DFG::SpeculativeJIT::speculateStringOrStringObject):
4527         * dfg/DFGSpeculativeJIT.h:
4528         (SpeculativeJIT):
4529         (JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):
4530
4531 2013-03-26  Mark Hahnenberg  <mhahnenberg@apple.com>
4532
4533         REGRESSION(r144131): It made fast/js/regress/string-repeat-arith.html assert on 32 bit
4534         https://bugs.webkit.org/show_bug.cgi?id=112106
4535
4536         Rubber stamped by Filip Pizlo.
4537
4538         * dfg/DFGSpeculativeJIT.cpp:
4539         (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32): Get rid of the case for constants because
4540         we would have done constant folding anyways on a ValueToInt32.
4541         * dfg/DFGSpeculativeJIT32_64.cpp:
4542         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): Fixed a random compile error with this flag enabled.
4543
4544 2013-03-26  Filip Pizlo  <fpizlo@apple.com>
4545
4546         JSC_enableProfiler=true should also cause JSGlobalData to save the profiler output somewhere
4547         https://bugs.webkit.org/show_bug.cgi?id=113144
4548
4549         Reviewed by Geoffrey Garen.
4550
4551         Forgot to include Geoff's requested change in the original commit.
4552
4553         * profiler/ProfilerDatabase.cpp:
4554         (Profiler):
4555
4556 2013-03-25  Filip Pizlo  <fpizlo@apple.com>
4557
4558         JSC_enableProfiler=true should also cause JSGlobalData to save the profiler output somewhere
4559         https://bugs.webkit.org/show_bug.cgi?id=113144
4560
4561         Reviewed by Geoffrey Garen.
4562
4563         Added the ability to save profiler output with JSC_enableProfiler=true. It will save it
4564         to the current directory, or JSC_PROFILER_PATH if the latter was specified.
4565
4566         This works by saving the Profiler::Database either when it is destroyed or atexit(),
4567         whichever happens first.
4568
4569         This allows use of the profiler from any WebKit client.
4570
4571         * jsc.cpp:
4572         (jscmain):
4573         * profiler/ProfilerDatabase.cpp:
4574         (Profiler):
4575         (JSC::Profiler::Database::Database):
4576         (JSC::Profiler::Database::~Database):
4577         (JSC::Profiler::Database::registerToSaveAtExit):
4578         (JSC::Profiler::Database::addDatabaseToAtExit):
4579         (JSC::Profiler::Database::removeDatabaseFromAtExit):
4580         (JSC::Profiler::Database::performAtExitSave):
4581         (JSC::Profiler::Database::removeFirstAtExitDatabase):
4582         (JSC::Profiler::Database::atExitCallback):
4583         * profiler/ProfilerDatabase.h:
4584         (JSC::Profiler::Database::databaseID):
4585         (Database):
4586         * runtime/JSGlobalData.cpp:
4587         (JSC::JSGlobalData::JSGlobalData):
4588
4589 2013-03-25  Filip Pizlo  <fpizlo@apple.com>
4590
4591         ArrayMode should not consider SpecOther when refining the base
4592         https://bugs.webkit.org/show_bug.cgi?id=113271
4593
4594         Reviewed by Geoffrey Garen.
4595
4596         9% speed-up on Octane/pdfjs.
4597
4598         * dfg/DFGArrayMode.cpp:
4599         (JSC::DFG::ArrayMode::refine):
4600
4601 2013-03-26  Csaba Osztrogonác  <ossy@webkit.org>
4602
4603         Fix unused parameter warnings in JITInlines.h
4604         https://bugs.webkit.org/show_bug.cgi?id=112560
4605
4606         Reviewed by Zoltan Herczeg.
4607
4608         * jit/JITInlines.h:
4609         (JSC::JIT::beginUninterruptedSequence):
4610         (JSC::JIT::endUninterruptedSequence):
4611         (JSC):
4612
4613 2013-03-25  Kent Tamura  <tkent@chromium.org>
4614
4615         Rename ENABLE_INPUT_TYPE_DATETIME
4616         https://bugs.webkit.org/show_bug.cgi?id=113254
4617
4618         Reviewed by Kentaro Hara.
4619
4620         Rename ENABLE_INPUT_TYPE_DATETIME to ENABLE_INPUT_TYPE_DATETIME_INCOMPLETE.
4621         Actually I'd like to remove the code, but we shouldn't remove it yet
4622         because we shipped products with it on some platforms.
4623
4624         * Configurations/FeatureDefines.xcconfig:
4625
4626 2013-03-25  Mark Lam  <mark.lam@apple.com>
4627
4628         Offlineasm cloop backend compiles op+branch incorrectly.
4629         https://bugs.webkit.org/show_bug.cgi?id=113146.
4630
4631         Reviewed by Geoffrey Garen.
4632
4633         * dfg/DFGRepatch.h:
4634         (JSC::DFG::dfgResetGetByID):
4635         (JSC::DFG::dfgResetPutByID):
4636         - These functions never return when the DFG is dsiabled, not just when
4637           asserts are enabled. Changing the attribute from NO_RETURN_DUE_TO_ASSERT
4638           to NO_RETURN.
4639         * llint/LLIntOfflineAsmConfig.h:
4640         - Added some #defines needed to get the cloop building again.
4641         * offlineasm/cloop.rb:
4642         - Fix cloopEmitOpAndBranchIfOverflow() and cloopEmitOpAndBranch() to
4643           emit code that unconditionally executes the specified operation before
4644           doing the conditional branch.
4645
4646 2013-03-25  Mark Hahnenberg  <mhahnenberg@apple.com>
4647
4648         JSObject::enterDictionaryIndexingMode doesn't have a case for ALL_BLANK_INDEXING_TYPES
4649         https://bugs.webkit.org/show_bug.cgi?id=113236
4650
4651         Reviewed by Geoffrey Garen.
4652
4653         * runtime/JSObject.cpp:
4654         (JSC::JSObject::enterDictionaryIndexingMode): We forgot blank indexing types.
4655
4656 2013-03-23  Mark Hahnenberg  <mhahnenberg@apple.com>
4657
4658         HandleSet should use HeapBlocks for storing handles
4659         https://bugs.webkit.org/show_bug.cgi?id=113145
4660
4661         Reviewed by Geoffrey Garen.
4662
4663         * GNUmakefile.list.am: Build project changes.
4664         * JavaScriptCore.gypi: Ditto.
4665         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
4666         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Ditto.
4667         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
4668         * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
4669         * heap/BlockAllocator.cpp: Rename the RegionSet to m_fourKBBlockRegionSet because there are
4670         too many block types to include them all in the name now.
4671         (JSC::BlockAllocator::BlockAllocator):
4672         * heap/BlockAllocator.h:
4673         (BlockAllocator): Add the appropriate override for regionSetFor.
4674         (JSC::WeakBlock):
4675         (JSC::MarkStackSegment):
4676         (JSC::HandleBlock):
4677         * heap/HandleBlock.h: Added.
4678         (HandleBlock): New class for HandleBlocks.
4679         (JSC::HandleBlock::blockFor): Static method to get the block of the given HandleNode pointer. Allows
4680         us to quickly figure out which HandleSet the HandleNode belongs to without storing the pointer to it
4681         in the HandleNode.
4682         (JSC::HandleBlock::handleSet): Getter.
4683         * heap/HandleBlockInlines.h: Added.
4684         (JSC::HandleBlock::create):
4685         (JSC::HandleBlock::HandleBlock):
4686         (JSC::HandleBlock::payloadEnd):
4687         (JSC::HandleBlock::payload):
4688         (JSC::HandleBlock::nodes):
4689         (JSC::HandleBlock::nodeAtIndex):
4690         (JSC::HandleBlock::nodeCapacity):
4691         * heap/HandleSet.cpp:
4692         (JSC::HandleSet::~HandleSet):
4693         (JSC::HandleSet::grow):
4694         * heap/HandleSet.h:
4695         (HandleNode): Move the internal Node class from HandleSet to be its own public class so it can be
4696         used by HandleBlock.
4697         (HandleSet): Add a typedef so that Node refers to the new HandleNode class.
4698         (JSC::HandleSet::toHandle):
4699         (JSC::HandleSet::toNode):
4700         (JSC::HandleSet::allocate):
4701         (JSC::HandleSet::deallocate):
4702         (JSC::HandleNode::HandleNode):
4703         (JSC::HandleNode::slot):
4704         (JSC::HandleNode::handleSet): Use the new blockFor static function to get the right HandleBlock and lookup
4705         the HandleSet.
4706         (JSC::HandleNode::setPrev):
4707         (JSC::HandleNode::prev):
4708         (JSC::HandleNode::setNext):
4709         (JSC::HandleNode::next):
4710         (JSC::HandleSet::forEachStrongHandle):
4711         * heap/Heap.h: Friend HandleSet so that it can access the BlockAllocator when allocating HandleBlocks.
4712
4713 2013-03-22  David Kilzer  <ddkilzer@apple.com>
4714
4715         BUILD FIX (r145119): Make JSValue* properties default to (assign)
4716         <rdar://problem/13380794>
4717
4718         Reviewed by Mark Hahnenberg.
4719
4720         Fixes the following build failures:
4721
4722             Source/JavaScriptCore/API/tests/testapi.mm:106:1: error: no 'assign', 'retain', or 'copy' attribute is specified - 'assign' is assumed [-Werror,-Wobjc-property-no-attribute]
4723             @property JSValue *onclick;
4724             ^
4725             Source/JavaScriptCore/API/tests/testapi.mm:106:1: error: default property attrib ute 'assign' not appropriate for non-GC object [-Werror,-Wobjc-property-no-attribute]
4726             Source/JavaScriptCore/API/tests/testapi.mm:107:1: error: no 'assign', 'retain', or 'copy' attribute is specified - 'assign' is assumed [-Werror,-Wobjc-property-no-attribute]
4727             @property JSValue *weakOnclick;
4728             ^
4729             Source/JavaScriptCore/API/tests/testapi.mm:107:1: error: default property attribute 'assign' not appropriate for non-GC object [-Werror,-Wobjc-property-no-attribute]
4730             4 errors generated.
4731
4732         * API/tests/testapi.mm: Default to (assign) for JSValue*
4733         properties.
4734
4735 2013-03-22  Ryosuke Niwa  <rniwa@webkit.org>
4736
4737         testLeakingPrototypesAcrossContexts added in r146682 doesn't compile on Win and fails on Mac
4738         https://bugs.webkit.org/show_bug.cgi?id=113125
4739
4740         Reviewed by Mark Hahnenberg
4741
4742         Remove the test added in r146682 as it's now failing on Mac.
4743         This is the test that was causing a compilation failure on Windows.
4744
4745         * API/tests/testapi.c:
4746         (main):
4747
4748 2013-03-22  Ryosuke Niwa  <rniwa@webkit.org>
4749
4750         Fix the typo: WIN -> WINDOWS.
4751
4752         * API/tests/testapi.c:
4753         (main):
4754
4755 2013-03-22  Ryosuke Niwa  <rniwa@webkit.org>
4756
4757         I really can't figure out what's wrong with this one.
4758         Temporarily disable the test added by r146682 on Windows since it doesn't compile.
4759
4760         * API/tests/testapi.c:
4761         (main):
4762
4763 2013-03-22  Ryosuke Niwa  <rniwa@webkit.org>
4764
4765         Another build fix (after r146693) for r146682.
4766
4767         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
4768         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
4769
4770 2013-03-22  Roger Fong  <roger_fong@apple.com>
4771
4772         Unreviewed. AppleWin build fix.
4773
4774         * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
4775         * JavaScriptCore.vcxproj/copy-files.cmd:
4776
4777 2013-03-22  Mark Hahnenberg  <mhahnenberg@apple.com>
4778
4779         -[TinyDOMNode dealloc] should call [super dealloc] when ARC is not enabled
4780         https://bugs.webkit.org/show_bug.cgi?id=113054
4781
4782         Reviewed by Geoffrey Garen.
4783
4784         * API/tests/testapi.mm:
4785         (-[TinyDOMNode dealloc]):
4786
4787 2013-03-22  Mark Hahnenberg  <mhahnenberg@apple.com>
4788
4789         opaqueJSClassData should be cached on JSGlobalObject, not the JSGlobalData
4790         https://bugs.webkit.org/show_bug.cgi?id=113086
4791
4792         Reviewed by Geoffrey Garen.
4793
4794         opaqueJSClassData stores cached prototypes for JSClassRefs in the C API. It doesn't make sense to
4795         share these prototypes within a JSGlobalData across JSGlobalObjects, and in fact doing so will cause
4796         a leak of the original JSGlobalObject that these prototypes were created in. Therefore we should move
4797         this cache to JSGlobalObject where it belongs and where it won't cause memory leaks.
4798
4799         * API/JSBase.cpp: Needed to add an extern "C" so that testapi.c can use the super secret GC function.
4800         * API/JSClassRef.cpp: We now grab the cached context data from the global object rather than the global data.
4801         (OpaqueJSClass::contextData):
4802         * API/JSClassRef.h: Remove this header because it's unnecessary and causes circular dependencies.
4803         * API/tests/testapi.c: Added a new test that makes sure that using the same JSClassRef in two different contexts
4804         doesn't cause leaks of the original global object.
4805         (leakFinalize):
4806         (nestedAllocateObject): This is a hack to bypass the conservative scan of the GC, which was unnecessarily marking
4807         objects and keeping them alive, ruining the test result.
4808         (testLeakingPrototypesAcrossContexts):
4809         (main):
4810         * API/tests/testapi.mm: extern "C" this so we can continue using it here.
4811         * runtime/JSGlobalData.cpp: Remove JSClassRef related stuff.
4812         (JSC::JSGlobalData::~JSGlobalData):
4813         * runtime/JSGlobalData.h:
4814         (JSGlobalData):
4815         * runtime/JSGlobalObject.h: Add the stuff that JSGlobalData had. We add it to JSGlobalObjectRareData so that
4816         clients who don't use the C API don't have to pay the memory cost of this extra HashMap.
4817         (JSGlobalObject):
4818         (JSGlobalObjectRareData):
4819         (JSC::JSGlobalObject::opaqueJSClassData):
4820
4821 2013-03-19  Martin Robinson  <mrobinson@igalia.com>
4822
4823         [GTK] Add support for building the WebCore bindings to the gyp build
4824         https://bugs.webkit.org/show_bug.cgi?id=112638
4825
4826         Reviewed by Nico Weber.
4827
4828         * JavaScriptCore.gyp/JavaScriptCoreGTK.gyp: Export all include directories to direct
4829         dependents and fix the indentation of the libjavascriptcore target.
4830
4831 2013-03-21  Filip Pizlo  <fpizlo@apple.com>
4832
4833         Fix some minor issues in the DFG's profiling of heap accesses
4834         https://bugs.webkit.org/show_bug.cgi?id=113010
4835
4836         Reviewed by Goeffrey Garen.
4837
4838         1) If a CodeBlock gets jettisoned by GC, we should count the exit sites.
4839
4840         2) If a CodeBlock clears a structure stub during GC, it should record this, and
4841         the DFG should prefer to not inline that access (i.e. treat it as if it had an
4842         exit site).
4843
4844         3) If a PutById was seen by the baseline JIT, and the JIT attempted to cache it,
4845         but it chose not to, then assume that it will take slow path.
4846
4847         4) If we frequently exited because of a structure check on a weak constant,
4848         don't try to inline that access in the future.
4849
4850         5) Treat all exits that were counted as being frequent.
4851
4852         81% speed-up on Octane/gbemu. Small speed-ups elsewhere, and no regressions.
4853
4854         * bytecode/CodeBlock.cpp:
4855         (JSC::CodeBlock::finalizeUnconditionally):
4856         (JSC):
4857         (JSC::CodeBlock::resetStubDuringGCInternal):
4858         (JSC::CodeBlock::reoptimize):
4859         (JSC::CodeBlock::jettison):
4860         (JSC::ProgramCodeBlock::jettisonImpl):
4861         (JSC::EvalCodeBlock::jettisonImpl):
4862         (JSC::FunctionCodeBlock::jettisonImpl):
4863         (JSC::CodeBlock::tallyFrequentExitSites):
4864         * bytecode/CodeBlock.h:
4865         (CodeBlock):
4866         (JSC::CodeBlock::tallyFrequentExitSites):
4867         (ProgramCodeBlock):
4868         (EvalCodeBlock):
4869         (FunctionCodeBlock):
4870         * bytecode/GetByIdStatus.cpp:
4871         (JSC::GetByIdStatus::computeFor):
4872         * bytecode/PutByIdStatus.cpp:
4873         (JSC::PutByIdStatus::computeFor):
4874         * bytecode/StructureStubInfo.h:
4875         (JSC::StructureStubInfo::StructureStubInfo):
4876         (StructureStubInfo):
4877         * dfg/DFGByteCodeParser.cpp:
4878         (JSC::DFG::ByteCodeParser::handleGetById):
4879         (JSC::DFG::ByteCodeParser::parseBlock):
4880         * dfg/DFGOSRExit.cpp:
4881         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
4882         * dfg/DFGOSRExit.h:
4883         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSite):
4884         (OSRExit):
4885         * jit/JITStubs.cpp:
4886         (JSC::DEFINE_STUB_FUNCTION):
4887         * runtime/Options.h:
4888         (JSC):
4889
4890 2013-03-22  Filip Pizlo  <fpizlo@apple.com>
4891
4892         DFG folding of PutById to SimpleReplace should consider the specialized function case
4893         https://bugs.webkit.org/show_bug.cgi?id=113093
4894
4895         Reviewed by Geoffrey Garen and Mark Hahnenberg.
4896
4897         * bytecode/PutByIdStatus.cpp:
4898         (JSC::PutByIdStatus::computeFor):
4899
4900 2013-03-22  David Kilzer  <ddkilzer@apple.com>
4901
4902         BUILD FIX (r146558): Build testapi.mm with ARC enabled for armv7s
4903         <http://webkit.org/b/112608>
4904
4905         Fixes the following build failure:
4906
4907             Source/JavaScriptCore/API/tests/testapi.mm:205:1: error: method possibly missing a [super dealloc] call [-Werror,-Wobjc-missing-super-calls]
4908             }
4909             ^
4910             1 error generated.
4911
4912         * Configurations/ToolExecutable.xcconfig: Enable ARC for armv7s
4913         architecture.
4914
4915 2013-03-22  David Kilzer  <ddkilzer@apple.com>
4916
4917         Revert "BUILD FIX (r146558): Call [super dealloc] from -[TinyDOMNode dealloc]"
4918
4919         This fixes a build failure introduced by this change:
4920
4921             Source/JavaScriptCore/API/tests/testapi.mm:206:6: error: ARC forbids explicit message send of 'dealloc'
4922                 [super dealloc];
4923                  ^     ~~~~~~~
4924             1 error generated.
4925
4926         Not sure why this didn't fail locally on my Mac Pro.
4927
4928         * API/tests/testapi.mm:
4929         (-[TinyDOMNode dealloc]): Remove call to [super dealloc].
4930
4931 2013-03-22  David Kilzer  <ddkilzer@apple.com>
4932
4933         BUILD FIX (r146558): Call [super dealloc] from -[TinyDOMNode dealloc]
4934         <http://webkit.org/b/112608>
4935
4936         Fixes the following build failure:
4937
4938             Source/JavaScriptCore/API/tests/testapi.mm:205:1: error: method possibly missing a [super dealloc] call [-Werror,-Wobjc-missing-super-calls]
4939             }
4940             ^
4941             1 error generated.
4942
4943         * API/tests/testapi.mm:
4944         (-[TinyDOMNode dealloc]): Call [super dealloc].
4945
4946 2013-03-22  Ryosuke Niwa  <rniwa@webkit.org>
4947
4948         Leak bots erroneously report JSC::WatchpointSet as leaking
4949         https://bugs.webkit.org/show_bug.cgi?id=107781
4950
4951         Reviewed by Filip Pizlo.
4952
4953         Since leaks doesn't support tagged pointers, avoid using it by flipping the bit flag to indicate
4954         the entry is "fat". We set the flag when the entry is NOT fat; i.e. slim.
4955
4956         Replaced FatFlag by SlimFlag and initialized m_bits with this flag to indicate that the entry is
4957         initially "slim".
4958
4959         * runtime/SymbolTable.cpp:
4960         (JSC::SymbolTableEntry::copySlow): Don't set FatFlag since it has been replaced by SlimFlag.
4961         (JSC::SymbolTableEntry::inflateSlow): Ditto.
4962
4963         * runtime/SymbolTable.h:
4964         (JSC::SymbolTableEntry::Fast::Fast): Set SlimFlag by default.
4965         (JSC::SymbolTableEntry::Fast::isNull): Ignore SlimFlag.
4966         (JSC::SymbolTableEntry::Fast::isFat): An entry is fat when m_bits is not entirely zero and SlimFlag
4967         is not set.
4968
4969         (JSC::SymbolTableEntry::SymbolTableEntry): Set SlimFlag by default.
4970         (JSC::SymbolTableEntry::SymbolTableEntry::getFast): Set SlimFlag when creating Fast from a fat entry.
4971         (JSC::SymbolTableEntry::isNull): Ignore SlimFlag.
4972         (JSC::SymbolTableEntry::FatEntry::FatEntry): Strip SlimFlag.
4973         (JSC::SymbolTableEntry::isFat): An entry is fat when m_bits is not entirely zero and SlimFlag is unset.
4974         (JSC::SymbolTableEntry::fatEntry): Don't strip FatFlag as this flag doesn't exist anymore.
4975         (JSC::SymbolTableEntry::pack): Preserve SlimFlag.
4976
4977         (JSC::SymbolTableIndexHashTraits): empty value is no longer zero so don't set emptyValueIsZero true.
4978
4979 2013-03-21  Mark Hahnenberg  <mhahnenberg@apple.com>
4980
4981         Objective-C API: Need a good way to preserve custom properties on JS wrappers
4982         https://bugs.webkit.org/show_bug.cgi?id=112608
4983
4984         Reviewed by Geoffrey Garen.
4985
4986         Currently, we just use a weak map, which means that garbage collection can cause a wrapper to
4987         disappear if it isn't directly exported to JavaScript.
4988
4989         The most straightforward and safe way (with respect to garbage collection and concurrency) is to have
4990         clients add and remove their external references along with their owners. Effectively, the client is
4991         recording the structure of the external object graph so that the garbage collector can make sure to
4992         mark any wrappers that are reachable through either the JS object graph of the external Obj-C object
4993         graph. By keeping these wrappers alive, this has the effect that custom properties on these wrappers
4994         will also remain alive.
4995
4996         The rule for if an object needs to be tracked by the runtime (and therefore whether the client should report it) is as follows:
4997         For a particular object, its references to its children should be added if:
4998         1. The child is referenced from JavaScript.
4999         2. The child contains references to other objects for which (1) or (2) are true.
5000
5001         * API/JSAPIWrapperObject.mm:
5002         (JSAPIWrapperObjectHandleOwner::finalize):
5003         (JSAPIWrapperObjectHandleOwner::isReachableFromOpaqueRoots): A wrapper object is kept alive only if its JSGlobalObject
5004         is marked and its corresponding Objective-C object was added to the set of opaque roots.
5005         (JSC::JSAPIWrapperObject::visitChildren): We now call out to scanExternalObjectGraph, which handles adding all Objective-C
5006         objects to the set of opaque roots.
5007         * API/JSAPIWrapperObject.h:
5008         (JSAPIWrapperObject):
5009         * API/JSContext.mm: Moved dealloc to its proper place in the main implementation.
5010         (-[JSContext dealloc]):
5011         * API/JSVirtualMachine.h:
5012         * API/JSVirtualMachine.mm:
5013         (-[JSVirtualMachine initWithContextGroupRef:]):
5014         (-[JSVirtualMachine dealloc]):
5015         (getInternalObjcObject): Helper funciton to get the Objective-C object out of JSManagedValues or JSValues if there is one.
5016         (-[JSVirtualMachine addManagedReference:withOwner:]): Adds the Objective-C object to the set of objects
5017         owned by the owner object in that particular virtual machine.
5018         (-[JSVirtualMachine removeManagedReference:withOwner:]): Removes the relationship between the two objects.
5019         (-[JSVirtualMachine externalObjectGraph]):
5020         (scanExternalObjectGraph): Does a depth-first search of the external object graph in a particular virtual machine starting at
5021         the specified root. Each new object it encounters it adds to the set of opaque roots. These opaque roots will keep their
5022         corresponding wrapper objects alive if they have them.
5023         * API/JSManagedReferenceInternal.h: Added.
5024         * API/JSVirtualMachine.mm: Added the per-JSVirtualMachine map between objects and the objects they own, which is more formally
5025         known as that virtual machine's external object graph.
5026         * API/JSWrapperMap.mm:
5027         (-[JSWrapperMap dealloc]): We were leaking this before :-(
5028         (-[JSVirtualMachine initWithContextGroupRef:]):
5029         (-[JSVirtualMachine dealloc]):
5030         (-[JSVirtualMachine externalObjectGraph]):
5031         * API/JSVirtualMachineInternal.h:
5032         * API/tests/testapi.mm: Added two new tests using the TinyDOMNode class. The first tests that a custom property added to a wrapper
5033         doesn't vanish after GC, even though that wrapper isn't directly accessible to the JS garbage collector but is accessible through
5034         the external Objective-C object graph. The second test makes sure that adding an object to the external object graph with the same
5035         owner doesn't cause any sort of problems.
5036         (+[TinyDOMNode sharedVirtualMachine]):
5037         (-[TinyDOMNode init]):
5038         (-[TinyDOMNode dealloc]):
5039         (-[TinyDOMNode appendChild:]):
5040         (-[TinyDOMNode numberOfChildren]):
5041         (-[TinyDOMNode childAtIndex:]):
5042         (-[TinyDOMNode removeChildAtIndex:]):
5043         * JavaScriptCore.xcodeproj/project.pbxproj:
5044         * heap/SlotVisitor.h:
5045         (SlotVisitor):
5046         * heap/SlotVisitorInlines.h:
5047         (JSC::SlotVisitor::containsOpaqueRootTriState): Added a new method to SlotVisitor to allow scanExternalObjectGraph to have a
5048         thread-safe view of opaque roots during parallel marking. The set of opaque roots available to any one SlotVisitor isn't guaranteed
5049         to be 100% correct, but that just results in a small duplication of work in scanExternalObjectGraph. To indicate this change for
5050         false negatives we return a TriState that's either true or mixed, but never false.
5051
5052 2013-03-21  Mark Lam  <mark.lam@apple.com>
5053
5054         Fix O(n^2) op_debug bytecode charPosition to column computation.
5055         https://bugs.webkit.org/show_bug.cgi?id=112957.
5056
5057         Reviewed by Geoffrey Garen.
5058
5059         The previous algorithm does a linear reverse scan of the source string
5060         to find the line start for any given char position. This results in a
5061         O(n^2) algortithm when the source string has no line breaks.
5062
5063         The new algorithm computes a line start column table for a
5064         SourceProvider on first use. This line start table is used to fix up
5065         op_debug's charPosition operand into a column operand when an
5066         UnlinkedCodeBlock is linked into a CodeBlock. The initialization of
5067         the line start table is O(n), and the CodeBlock column fix up is
5068         O(log(n)).
5069
5070         * bytecode/CodeBlock.cpp:
5071         (JSC::CodeBlock::dumpBytecode):
5072         (JSC::CodeBlock::CodeBlock): - do column fix up.
5073         * interpreter/Interpreter.cpp:
5074         (JSC::Interpreter::debug): - no need to do column fixup anymore.
5075         * interpreter/Interpreter.h:
5076         * jit/JITStubs.cpp:
5077         (JSC::DEFINE_STUB_FUNCTION):
5078         * llint/LLIntSlowPaths.cpp:
5079         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
5080         * parser/SourceProvider.cpp:
5081         (JSC::SourceProvider::lineStarts):
5082         (JSC::charPositionExtractor):
5083         (JSC::SourceProvider::charPositionToColumnNumber):
5084         - initialize line start column table if needed.
5085         - look up line start for the given char position.
5086         * parser/SourceProvider.h:
5087
5088 2013-03-21  Filip Pizlo  <fpizlo@apple.com>
5089
5090         JSC profiler should have an at-a-glance report of the success of DFG optimization
5091         https://bugs.webkit.org/show_bug.cgi?id=112988
5092
5093         Reviewed by Geoffrey Garen.
5094
5095         * dfg/DFGByteCodeParser.cpp:
5096         (JSC::DFG::ByteCodeParser::handleCall):
5097         (JSC::DFG::ByteCodeParser::handleGetById):
5098         (JSC::DFG::ByteCodeParser::parseBlock):
5099         * profiler/ProfilerCompilation.cpp:
5100         (JSC::Profiler::Compilation::Compilation):
5101         (JSC::Profiler::Compilation::toJS):
5102         * profiler/ProfilerCompilation.h:
5103         (JSC::Profiler::Compilation::noticeInlinedGetById):
5104         (JSC::Profiler::Compilation::noticeInlinedPutById):
5105         (JSC::Profiler::Compilation::noticeInlinedCall):
5106         (Compilation):
5107         * runtime/CommonIdentifiers.h:
5108
5109 2013-03-21  Mark Lam  <mark.lam@apple.com>
5110
5111         Fix lexer charPosition computation when "rewind"ing the lexer.
5112         https://bugs.webkit.org/show_bug.cgi?id=112952.
5113
5114         Reviewed by Michael Saboff.
5115
5116         Changed the Lexer to no longer keep a m_charPosition. Instead, we compute
5117         currentCharPosition() from m_code and m_codeStartPlusOffset, where
5118         m_codeStartPlusOffset is the SourceProvider m_codeStart + the SourceCode
5119         start offset. This ensures that the charPosition is always in sync with
5120         m_code.
5121
5122         * parser/Lexer.cpp:
5123         (JSC::::setCode):
5124         (JSC::::internalShift):
5125         (JSC::::shift):
5126         (JSC::::lex):
5127         * parser/Lexer.h:
5128         (JSC::Lexer::currentCharPosition):
5129         (JSC::::lexExpectIdentifier):
5130
5131 2013-03-21  Alberto Garcia  <agarcia@igalia.com>
5132
5133         [BlackBerry] GCActivityCallback: replace JSLock with JSLockHolder
5134         https://bugs.webkit.org/show_bug.cgi?id=112448
5135
5136         Reviewed by Xan Lopez.
5137
5138         This changed in r121381.
5139
5140         * runtime/GCActivityCallbackBlackBerry.cpp:
5141         (JSC::DefaultGCActivityCallback::doWork):
5142
5143 2013-03-21  Mark Hahnenberg  <mhahnenberg@apple.com>
5144
5145         Objective-C API: wrapperClass holds a static JSClassRef, which causes JSGlobalObjects to leak
5146         https://bugs.webkit.org/show_bug.cgi?id=112856
5147
5148         Reviewed by Geoffrey Garen.
5149
5150         Through a very convoluted path that involves the caching of prototypes on the JSClassRef, we can leak
5151         JSGlobalObjects when inserting an Objective-C object into multiple independent JSContexts.
5152
5153         * API/JSAPIWrapperObject.cpp: Removed.
5154         * API/JSAPIWrapperObject.h:
5155         (JSAPIWrapperObject):
5156         * API/JSAPIWrapperObject.mm: Copied from Source/JavaScriptCore/API/JSAPIWrapperObject.cpp. Made this an
5157         Objective-C++ file so that we can call release on the wrappedObject. Also added a WeakHandleOwner for
5158         JSAPIWrapperObjects. This will also be used in a future patch for https://bugs.webkit.org/show_bug.cgi?id=112608.
5159         (JSAPIWrapperObjectHandleOwner):
5160         (jsAPIWrapperObjectHandleOwner):
5161         (JSAPIWrapperObjectHandleOwner::finalize): This finalize replaces the old finalize that was done through
5162         the C API.
5163         (JSC::JSAPIWrapperObject::finishCreation): Allocate the WeakImpl. Balanced in finalize.
5164         (JSC::JSAPIWrapperObject::setWrappedObject): We now do the retain of the wrappedObject here rather than in random
5165         places scattered around JSWrapperMap.mm
5166         * API/JSObjectRef.cpp: Added some ifdefs for platforms that don't support the Obj-C API.
5167         (JSObjectGetPrivate): Ditto.
5168         (JSObjectSetPrivate): Ditto.
5169         (JSObjectGetPrivateProperty): Ditto.
5170         (JSObjectSetPrivateProperty): Ditto.
5171         (JSObjectDeletePrivateProperty): Ditto.
5172         * API/JSValueRef.cpp: Ditto.
5173         (JSValueIsObjectOfClass): Ditto.
5174         * API/JSWrapperMap.mm: Remove wrapperClass().
5175         (objectWithCustomBrand): Change to no longer use a parent class, which was only used to give the ability to
5176         finalize wrapper objects.
5177         (-[JSObjCClassInfo initWithContext:forClass:superClassInfo:]): Change to no longer use wrapperClass().
5178         (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]): Ditto.
5179         (tryUnwrapObjcObject): We now check if the object inherits from JSAPIWrapperObject.
5180         * API/tests/testapi.mm: Added a test that exports an Objective-C object to two different JSContexts and makes
5181         sure that the first one is collected properly by using a weak JSManagedValue for the wrapper in the first JSContext.
5182         * CMakeLists.txt: Build file modifications.
5183         * GNUmakefile.list.am: Ditto.
5184         * JavaScriptCore.gypi: Ditto.
5185         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
5186         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Ditto.
5187         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
5188         * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
5189         * runtime/JSGlobalObject.cpp: More ifdefs for unsupported platforms.
5190         (JSC::JSGlobalObject::reset): Ditto.
5191         (JSC::JSGlobalObject::visitChildren): Ditto.
5192         * runtime/JSGlobalObject.h: Ditto.
5193         (JSGlobalObject): Ditto.
5194         (JSC::JSGlobalObject::objcCallbackFunctionStructure): Ditto.
5195
5196 2013-03-21  Anton Muhin  <antonm@chromium.org>
5197
5198         Unreviewed, rolling out r146483.
5199         http://trac.webkit.org/changeset/146483
5200         https://bugs.webkit.org/show_bug.cgi?id=111695
5201
5202         Breaks debug builds.
5203
5204         * bytecode/GlobalResolveInfo.h: Removed property svn:mergeinfo.
5205
5206 2013-03-21  Gabor Rapcsanyi  <rgabor@webkit.org>
5207
5208         Implement LLInt for CPU(ARM_TRADITIONAL)
5209         https://bugs.webkit.org/show_bug.cgi?id=97589
5210
5211         Reviewed by Zoltan Herczeg.
5212
5213         Enable LLInt for ARMv5 and ARMv7 traditional as well.
5214
5215         * llint/LLIntOfflineAsmConfig.h:
5216         * llint/LowLevelInterpreter.asm:
5217         * llint/LowLevelInterpreter32_64.asm:
5218         * offlineasm/arm.rb:
5219         * offlineasm/backends.rb:
5220         * offlineasm/instructions.rb:
5221
5222 2013-03-20  Cosmin Truta  <ctruta@blackberry.com>
5223
5224         [QNX][ARM] REGRESSION(r135330): Various failures in Octane
5225         https://bugs.webkit.org/show_bug.cgi?id=112863
5226
5227         Reviewed by Yong Li.
5228
5229         This was fixed in http://trac.webkit.org/changeset/146396 on Linux only.
5230         Enable this fix on QNX.
5231
5232         * assembler/ARMv7Assembler.h:
5233         (ARMv7Assembler):
5234         (JSC::ARMv7Assembler::replaceWithJump):
5235         (JSC::ARMv7Assembler::maxJumpReplacementSize):
5236         * assembler/MacroAssemblerARMv7.h:
5237         (JSC::MacroAssemblerARMv7::revertJumpReplacementToBranchPtrWithPatch):
5238
5239 2013-03-20  Filip Pizlo  <fpizlo@apple.com>
5240
5241         Fix indentation of JSString.h
5242
5243         Rubber stamped by Mark Hahnenberg.
5244
5245         * runtime/JSString.h:
5246
5247 2013-03-20  Filip Pizlo  <fpizlo@apple.com>
5248
5249         "" + x where x is not a string should be optimized by the DFG to some manner of ToString conversion
5250         https://bugs.webkit.org/show_bug.cgi?id=112845
5251
5252         Reviewed by Mark Hahnenberg.
5253
5254         I like to do "" + x. So I decided to make DFG recognize it, and related idioms.
5255
5256         * dfg/DFGFixupPhase.cpp:
5257         (JSC::DFG::FixupPhase::fixupNode):
5258         (JSC::DFG::FixupPhase::fixupToPrimitive):
5259         (FixupPhase):
5260         (JSC::DFG::FixupPhase::fixupToString):
5261         (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
5262         * dfg/DFGPredictionPropagationPhase.cpp:
5263         (JSC::DFG::resultOfToPrimitive):
5264         (DFG):
5265         (JSC::DFG::PredictionPropagationPhase::propagate):
5266         * dfg/DFGPredictionPropagationPhase.h:
5267         (DFG):
5268
5269 2013-03-20  Zoltan Herczeg  <zherczeg@webkit.org>
5270
5271         ARMv7 replaceWithJump ASSERT failure after r135330.
5272         https://bugs.webkit.org/show_bug.cgi?id=103146
5273
5274         Reviewed by Filip Pizlo.
5275
5276         On Linux, the 24 bit distance range of jumps sometimes does not
5277         enough to cover all targets addresses. This patch supports jumps
5278         outside of this range using a mov/movt/bx 10 byte long sequence.
5279
5280         * assembler/ARMv7Assembler.h:
5281         (ARMv7Assembler):
5282         (JSC::ARMv7Assembler::revertJumpTo_movT3movtcmpT2):
5283         (JSC::ARMv7Assembler::nopw):
5284         (JSC::ARMv7Assembler::label):
5285         (JSC::ARMv7Assembler::replaceWithJump):
5286         (JSC::ARMv7Assembler::maxJumpReplacementSize):
5287         * assembler/MacroAssemblerARMv7.h:
5288         (JSC::MacroAssemblerARMv7::revertJumpReplacementToBranchPtrWithPatch):
5289
5290 2013-03-20  Mark Hahnenberg  <mhahnenberg@apple.com>
5291
5292         Objective-C API: Fix over-releasing in allocateConstructorAndPrototypeWithSuperClassInfo:
5293         https://bugs.webkit.org/show_bug.cgi?id=112832
5294
5295         Reviewed by Geoffrey Garen.
5296
5297         If either the m_constructor or m_prototype (but not both) is collected, we will call
5298         allocateConstructorAndPrototypeWithSuperClassInfo, which will create a new object to replace the one
5299         that was collected, but at the end of the method we call release on both of them.
5300         This is incorrect since we autorelease the JSValue in the case that the object doesn't need to be
5301         reallocated. Thus we'll end up overreleasing later during the drain of the autorelease pool.
5302
5303         * API/JSWrapperMap.mm:
5304         (objectWithCustomBrand): We no longer alloc here. We instead call the JSValue valueWithValue class method,
5305         which autoreleases for us.
5306         (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]): We no longer call release on the
5307         constructor or prototype JSValues.
5308         * API/tests/testapi.mm: Added a new test that crashes on ToT due to over-releasing.
5309
5310 2013-03-19  Filip Pizlo  <fpizlo@apple.com>
5311
5312         It's called "Hash Consing" not "Hash Consting"
5313         https://bugs.webkit.org/show_bug.cgi?id=112768
5314
5315         Rubber stamped by Mark Hahnenberg.
5316
5317         See http://en.wikipedia.org/wiki/Hash_consing
5318
5319         * heap/GCThreadSharedData.cpp:
5320         (JSC::GCThreadSharedData::GCThreadSharedData):
5321         (JSC::GCThreadSharedData::reset):
5322         * heap/GCThreadSharedData.h:
5323         (GCThreadSharedData):
5324         * heap/SlotVisitor.cpp:
5325         (JSC::SlotVisitor::SlotVisitor):
5326         (JSC::SlotVisitor::setup):
5327         (JSC::SlotVisitor::reset):
5328         (JSC::JSString::tryHashConsLock):
5329         (JSC::JSString::releaseHashConsLock):
5330         (JSC::JSString::shouldTryHashCons):
5331         (JSC::SlotVisitor::internalAppend):
5332         * heap/SlotVisitor.h:
5333         (SlotVisitor):
5334         * runtime/JSGlobalData.cpp:
5335         (JSC::JSGlobalData::JSGlobalData):
5336         * runtime/JSGlobalData.h:
5337         (JSGlobalData):
5338         (JSC::JSGlobalData::haveEnoughNewStringsToHashCons):
5339         (JSC::JSGlobalData::resetNewStringsSinceLastHashCons):
5340         * runtime/JSString.h:
5341         (JSC::JSString::finishCreation):
5342         (JSString):
5343         (JSC::JSString::isHashConsSingleton):
5344         (JSC::JSString::clearHashConsSingleton):
5345         (JSC::JSString::setHashConsSingleton):
5346
5347 2013-03-20  Filip Pizlo  <fpizlo@apple.com>
5348
5349         DFG implementation of op_strcat should inline rope allocations
5350         https://bugs.webkit.org/show_bug.cgi?id=112780
5351
5352         Reviewed by Oliver Hunt.
5353
5354         This gets rid of the StrCat node and adds a MakeRope node. The MakeRope node can
5355         take either two or three operands, and allocates a rope string with either two or
5356         three fibers. (The magic choice of three children for non-VarArg nodes happens to
5357         match exactly with the magic choice of three fibers for rope strings.)
5358
5359         ValueAdd on KnownString is replaced with MakeRope with two children.
5360
5361         StrCat gets replaced by an appropriate sequence of MakeRope's.
5362
5363         MakeRope does not do the dynamic check to see if its children are empty strings.
5364         This is replaced by a static check, instead. The downside is that we may use more
5365         memory if the strings passed to MakeRope turn out to dynamically be empty. The
5366         upside is that we do fewer checks in the cases where either the strings are not
5367         empty, or where the strings are statically known to be empty. I suspect both of
5368         those cases are more common, than the case where the string is dynamically empty.
5369
5370         This also results in some badness for X86. MakeRope needs six registers if it is
5371         allocating a three-rope. We don't have six registers to spare on X86. Currently,
5372         the code side-steps this problem by just never usign three-ropes in optimized
5373         code on X86. All other architectures, including X86_64, don't have this problem.
5374
5375         This is a shocking speed-up. 9% progressions on both V8/splay and
5376         SunSpider/date-format-xparb. 1% progression on V8v7 overall, and ~0.5% progression
5377         on SunSpider. 2x speed-up on microbenchmarks that test op_strcat.
5378
5379         * dfg/DFGAbstractState.cpp:
5380         (JSC::DFG::AbstractState::executeEffects):
5381         * dfg/DFGAdjacencyList.h:
5382         (AdjacencyList):
5383         (JSC::DFG::AdjacencyList::removeEdge):
5384         * dfg/DFGArgumentsSimplificationPhase.cpp:
5385         (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
5386         * dfg/DFGBackwardsPropagationPhase.cpp:
5387         (JSC::DFG::BackwardsPropagationPhase::propagate):
5388         * dfg/DFGByteCodeParser.cpp:
5389         (JSC::DFG::ByteCodeParser::parseBlock):
5390         * dfg/DFGCSEPhase.cpp:
5391         (JSC::DFG::CSEPhase::putStructureStoreElimination):
5392         (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
5393         (JSC::DFG::CSEPhase::performNodeCSE):
5394         * dfg/DFGDCEPhase.cpp:
5395         (JSC::DFG::DCEPhase::eliminateIrrelevantPhantomChildren):
5396         * dfg/DFGFixupPhase.cpp:
5397         (JSC::DFG::FixupPhase::fixupNode):
5398         (JSC::DFG::FixupPhase::createToString):
5399         (JSC::DFG::FixupPhase::attemptToForceStringArrayModeByToStringConversion):
5400         (JSC::DFG::FixupPhase::convertStringAddUse):
5401         (FixupPhase):
5402         (JSC::DFG::FixupPhase::convertToMakeRope):
5403         (JSC::DFG::FixupPhase::fixupMakeRope):
5404         (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
5405         * dfg/DFGNodeType.h:
5406         (DFG):
5407         * dfg/DFGOperations.cpp:
5408         * dfg/DFGOperations.h:
5409         * dfg/DFGPredictionPropagationPhase.cpp:
5410         (JSC::DFG::PredictionPropagationPhase::propagate):
5411         * dfg/DFGSpeculativeJIT.cpp:
5412         (JSC::DFG::SpeculativeJIT::compileAdd):
5413         (JSC::DFG::SpeculativeJIT::compileMakeRope):
5414         (DFG):
5415         * dfg/DFGSpeculativeJIT.h:
5416         (JSC::DFG::SpeculativeJIT::callOperation):
5417         (SpeculativeJIT):
5418         (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
5419         (JSC::DFG::SpeculateCellOperand::~SpeculateCellOperand):
5420         (JSC::DFG::SpeculateCellOperand::gpr):
5421         (JSC::DFG::SpeculateCellOperand::use):
5422         * dfg/DFGSpeculativeJIT32_64.cpp:
5423         (JSC::DFG::SpeculativeJIT::compile):
5424         * dfg/DFGSpeculativeJIT64.cpp:
5425         (JSC::DFG::SpeculativeJIT::compile):
5426         * runtime/JSString.h:
5427         (JSRopeString):
5428
5429 2013-03-20  Peter Gal  <galpeter@inf.u-szeged.hu>
5430
5431         Implement and32 on MIPS platform
5432         https://bugs.webkit.org/show_bug.cgi?id=112665
5433
5434         Reviewed by Zoltan Herczeg.
5435
5436         * assembler/MacroAssemblerMIPS.h:
5437         (JSC::MacroAssemblerMIPS::and32): Added missing method.
5438         (MacroAssemblerMIPS):
5439
5440 2013-03-20  Mark Lam  <mark.lam@apple.com>
5441
5442         Fix incorrect debugger column number value.
5443         https://bugs.webkit.org/show_bug.cgi?id=112741.
5444
5445         Reviewed by Oliver Hunt.
5446
5447         1. In lexer, parser, and debugger code, renamed column to charPosition.
5448         2. Convert the charPosition to the equivalent column number before
5449            passing it to the debugger.
5450         3. Changed ScopeNodes to take both a startLocation and an endLocation.
5451            This allows FunctionBodyNodes, ProgramNodes, and EvalNodess to emit
5452            correct debug hooks with correct starting line and column numbers.
5453         4. Fixed the Lexer to not reset the charPosition (previously
5454            columnNumber) in Lexer::lex().
5455
5456         * JavaScriptCore.order:
5457         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
5458         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
5459         * bytecode/CodeBlock.cpp:
5460         (JSC::CodeBlock::dumpBytecode):
5461         * bytecompiler/BytecodeGenerator.cpp:
5462         (JSC::BytecodeGenerator::emitDebugHook):
5463         * bytecompiler/BytecodeGenerator.h:
5464         (JSC::BytecodeGenerator::emitExpressionInfo):
5465         * bytecompiler/NodesCodegen.cpp:
5466         (JSC::ArrayNode::toArgumentList):
5467         (JSC::ConstStatementNode::emitBytecode):
5468         (JSC::EmptyStatementNode::emitBytecode):
5469         (JSC::DebuggerStatementNode::emitBytecode):
5470         (JSC::ExprStatementNode::emitBytecode):
5471         (JSC::VarStatementNode::emitBytecode):
5472         (JSC::IfNode::emitBytecode):
5473         (JSC::IfElseNode::emitBytecode):
5474         (JSC::DoWhileNode::emitBytecode):
5475         (JSC::WhileNode::emitBytecode):
5476         (JSC::ForNode::emitBytecode):
5477         (JSC::ForInNode::emitBytecode):
5478         (JSC::ContinueNode::emitBytecode):
5479         (JSC::BreakNode::emitBytecode):
5480         (JSC::ReturnNode::emitBytecode):
5481         (JSC::WithNode::emitBytecode):
5482         (JSC::SwitchNode::emitBytecode):
5483         (JSC::LabelNode::emitBytecode):
5484         (JSC::ThrowNode::emitBytecode):
5485         (JSC::TryNode::emitBytecode):
5486         (JSC::ProgramNode::emitBytecode):
5487         (JSC::EvalNode::emitBytecode):
5488         (JSC::FunctionBodyNode::emitBytecode):
5489         * interpreter/Interpreter.cpp:
5490         (JSC::Interpreter::debug):
5491         - convert charPosition to column for the debugger.
5492         * interpreter/Interpreter.h:
5493         * jit/JITStubs.cpp:
5494         (DEFINE_STUB_FUNCTION(void, op_debug)):
5495         * llint/LLIntSlowPaths.cpp:
5496         (LLINT_SLOW_PATH_DECL(slow_op_debug)):
5497         * parser/ASTBuilder.h:
5498         (JSC::ASTBuilder::createFunctionExpr):
5499         (JSC::ASTBuilder::createFunctionBody):
5500         (JSC::ASTBuilder::createGetterOrSetterProperty):
5501         (JSC::ASTBuilder::createFuncDeclStatement):
5502         (JSC::ASTBuilder::createBlockStatement):
5503         (JSC::ASTBuilder::createExprStatement):
5504         (JSC::ASTBuilder::createIfStatement):
5505         (JSC::ASTBuilder::createForLoop):
5506         (JSC::ASTBuilder::createForInLoop):
5507         (JSC::ASTBuilder::createVarStatement):
5508         (JSC::ASTBuilder::createReturnStatement):
5509         (JSC::ASTBuilder::createBreakStatement):
5510         (JSC::ASTBuilder::createContinueStatement):
5511         (JSC::ASTBuilder::createTryStatement):
5512         (JSC::ASTBuilder::createSwitchStatement):
5513         (JSC::ASTBuilder::createWhileStatement):
5514         (JSC::ASTBuilder::createDoWhileStatement):
5515         (JSC::ASTBuilder::createWithStatement):
5516         (JSC::ASTBuilder::createThrowStatement):
5517         (JSC::ASTBuilder::createDebugger):
5518         (JSC::ASTBuilder::createConstStatement):
5519         * parser/Lexer.cpp:
5520         (JSC::::setCode):
5521         (JSC::::internalShift):
5522         (JSC::::shift):
5523         (JSC::::lex):
5524         * parser/Lexer.h:
5525         (JSC::Lexer::currentCharPosition):
5526         (Lexer):
5527         (JSC::::lexExpectIdentifier):
5528         * parser/NodeConstructors.h:
5529         (JSC::Node::Node):
5530         * parser/Nodes.cpp:
5531         (JSC::StatementNode::setLoc):
5532         (JSC::ScopeNode::ScopeNode):
5533         (JSC::ProgramNode::ProgramNode):
5534         (JSC::ProgramNode::create):
5535         (JSC::EvalNode::EvalNode):
5536         (JSC::EvalNode::create):
5537         (JSC::FunctionBodyNode::FunctionBodyNode):
5538         (JSC::FunctionBodyNode::create):
5539         * parser/Nodes.h:
5540         (JSC::Node::charPosition):
5541         (Node):
5542         (StatementNode):
5543         (JSC::StatementNode::lastLine):
5544         (ScopeNode):
5545         (JSC::ScopeNode::startLine):
5546         (JSC::ScopeNode::startCharPosition):
5547         (ProgramNode):
5548         (EvalNode):
5549         (FunctionBodyNode):
5550         * parser/Parser.cpp:
5551         (JSC::::Parser):
5552         (JSC::::parseFunctionBody):
5553         (JSC::::parseFunctionInfo):
5554         * parser/Parser.h:
5555         (JSC::::parse):
5556         * parser/ParserTokens.h:
5557         (JSC::JSTokenLocation::JSTokenLocation):
5558         (JSTokenLocation):
5559         * parser/SyntaxChecker.h:
5560         (JSC::SyntaxChecker::createFunctionBody):
5561
5562 2013-03-20  Csaba Osztrogonác  <ossy@webkit.org>
5563
5564         REGRESSION(r146089): It broke 20 sputnik tests on ARM traditional and Thumb2
5565         https://bugs.webkit.org/show_bug.cgi?id=112676
5566
5567         Rubber-stamped by Filip Pizlo.
5568
5569         Add one more EABI_32BIT_DUMMY_ARG to make DFG JIT ARM EABI compatible
5570         again after r146089 similar to https://bugs.webkit.org/show_bug.cgi?id=84449
5571
5572         * dfg/DFGSpeculativeJIT.h:
5573         (JSC::DFG::SpeculativeJIT::callOperation):
5574
5575 2013-03-19  Michael Saboff  <msaboff@apple.com>
5576
5577         Crash when loading http://www.jqchart.com/jquery/gauges/RadialGauge/LiveData
5578         https://bugs.webkit.org/show_bug.cgi?id=112694
5579
5580         Reviewed by Filip Pizlo.
5581
5582         We were trying to convert an NewArray to a Phantom, but convertToPhantom doesn't handle
5583         nodes with variable arguments.  Added code to insert a Phantom node in front of all the
5584         live children of a var args node.  Added ASSERT not var args for convertToPhantom to
5585         catch any other similar cases.  Added a new convertToPhantomUnchecked() for converting
5586         var arg nodes.
5587
5588         * dfg/DFGDCEPhase.cpp:
5589         (JSC::DFG::DCEPhase::run):
5590         * dfg/DFGNode.h:
5591         (Node):
5592         (JSC::DFG::Node::setOpAndDefaultNonExitFlags): Added ASSERT(!(m_flags & NodeHasVarArgs))
5593         (JSC::DFG::Node::setOpAndDefaultNonExitFlagsUnchecked):
5594         (JSC::DFG::Node::convertToPhantomUnchecked):
5595
5596 2013-03-19  Mark Hahnenberg  <mhahnenberg@apple.com>
5597
5598         Crash in SpeculativeJIT::fillSpeculateIntInternal<false> on http://bellard.org/jslinux
5599         https://bugs.webkit.org/show_bug.cgi?id=112738
5600
5601         Reviewed by Filip Pizlo.
5602
5603         * dfg/DFGFixupPhase.cpp:
5604         (JSC::DFG::FixupPhase::fixIntEdge): We shouldn't be killing this node because it could be
5605         referenced by other people.
5606
5607 2013-03-19  Oliver Hunt  <oliver@apple.com>
5608
5609         RELEASE_ASSERT fires in exception handler lookup
5610
5611         RS=Geoff Garen.
5612
5613         Temporarily switch this RELEASE_ASSERT into a regular ASSERT
5614         as currently this is producing fairly bad crashiness.
5615
5616         * bytecode/CodeBlock.cpp:
5617         (JSC::CodeBlock::handlerForBytecodeOffset):
5618
5619 2013-03-18  Filip Pizlo  <fpizlo@apple.com>
5620
5621         DFG should optimize StringObject.length and StringOrStringObject.length
5622         https://bugs.webkit.org/show_bug.cgi?id=112658
5623
5624         Reviewed by Mark Hahnenberg.
5625
5626         Implemented by injecting a ToString(StringObject:@a) or ToString(StringOrStringObject:@a) prior
5627         to GetArrayLength with ArrayMode(Array::String) if @a is predicted StringObject or
5628         StringOrStringObject.
5629
5630         * dfg/DFGFixupPhase.cpp:
5631         (JSC::DFG::FixupPhase::fixupNode):
5632         (JSC::DFG::FixupPhase::createToString):
5633         (FixupPhase):
5634         (JSC::DFG::FixupPhase::attemptToForceStringArrayModeByToStringConversion):
5635         (JSC::DFG::FixupPhase::convertStringAddUse):
5636
5637 2013-03-19  Gabor Rapcsanyi  <rgabor@webkit.org>
5638
5639         Implement and32 on ARMv7 and ARM traditional platforms
5640         https://bugs.webkit.org/show_bug.cgi?id=112663
5641
5642         Reviewed by Zoltan Herczeg.
5643
5644         * assembler/MacroAssemblerARM.h:
5645         (JSC::MacroAssemblerARM::and32): Add missing method.
5646         (MacroAssemblerARM):
5647         * assembler/MacroAssemblerARMv7.h:
5648         (JSC::MacroAssemblerARMv7::and32): Add missing method.
5649         (MacroAssemblerARMv7):
5650
5651 2013-03-18  Filip Pizlo  <fpizlo@apple.com>
5652
5653         DFG ToString generic cases should work correctly
5654         https://bugs.webkit.org/show_bug.cgi?id=112654
5655         <rdar://problem/13447250>
5656
5657         Reviewed by Geoffrey Garen.
5658
5659         * dfg/DFGSpeculativeJIT.cpp:
5660         (JSC::DFG::SpeculativeJIT::compileToStringOnCell):
5661         * dfg/DFGSpeculativeJIT32_64.cpp:
5662         (JSC::DFG::SpeculativeJIT::compile):
5663         * dfg/DFGSpeculativeJIT64.cpp:
5664         (JSC::DFG::SpeculativeJIT::compile):
5665
5666 2013-03-18  Michael Saboff  <msaboff@apple.com>
5667
5668         Unreviewed build fix for 32 bit builds.
5669
5670         * dfg/DFGSpeculativeJIT32_64.cpp:
5671         (JSC::DFG::SpeculativeJIT::compile):
5672
5673 2013-03-18  Michael Saboff  <msaboff@apple.com>
5674
5675         EFL: Unsafe branch detected in compilePutByValForFloatTypedArray()
5676         https://bugs.webkit.org/show_bug.cgi?id=112609
5677
5678         Reviewed by Geoffrey Garen.
5679
5680         Created local valueFPR and scratchFPR and filled them with valueOp.fpr() and scratch.fpr()
5681         respectively so that if valueOp.fpr() causes a spill during allocation, it occurs before the
5682         branch and also to follow convention.  Added register allocation checks to FPRTemporary.
5683         Cleaned up a couple of other places to follow the "AllocatVirtualRegType foo, get machine
5684         reg from foo" pattern.
5685
5686         * dfg/DFGSpeculativeJIT.cpp:
5687         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
5688         * dfg/DFGSpeculativeJIT.h:
5689         (JSC::DFG::SpeculativeJIT::fprAllocate):
5690         * dfg/DFGSpeculativeJIT32_64.cpp:
5691         (JSC::DFG::SpeculativeJIT::convertToDouble):
5692         (JSC::DFG::SpeculativeJIT::compile):
5693         * dfg/DFGSpeculativeJIT64.cpp:
5694         (JSC::DFG::SpeculativeJIT::compile):
5695
5696 2013-03-18  Filip Pizlo  <fpizlo@apple.com>
5697
5698         DFG should inline binary string concatenations (i.e. ValueAdd with string children)
5699         https://bugs.webkit.org/show_bug.cgi?id=112599
5700
5701         Reviewed by Oliver Hunt.
5702
5703         This does as advertised: if you do x + y where x and y are strings, you'll get
5704         a fast inlined JSRopeString allocation (along with whatever checks are necessary).
5705         It also does good things if either x or y (or both) are StringObjects, or some
5706         other thing like StringOrStringObject. It also lays the groundwork for making this
5707         fast if either x or y are numbers, or some other reasonably-cheap-to-convert
5708         value.
5709
5710         * dfg/DFGAbstractState.cpp:
5711         (JSC::DFG::AbstractState::executeEffects):
5712         * dfg/DFGFixupPhase.cpp:
5713         (JSC::DFG::FixupPhase::fixupNode):
5714         (FixupPhase):
5715         (JSC::DFG::FixupPhase::isStringObjectUse):
5716         (JSC::DFG::FixupPhase::convertStringAddUse):
5717         (JSC::DFG::FixupPhase::attemptToMakeFastStringAdd):
5718         * dfg/DFGOperations.cpp:
5719         * dfg/DFGOperations.h:
5720         * dfg/DFGSpeculativeJIT.cpp:
5721         (JSC::DFG::SpeculativeJIT::compileAdd):
5722         * dfg/DFGSpeculativeJIT.h:
5723         (JSC::DFG::SpeculativeJIT::callOperation):
5724         (SpeculativeJIT):
5725         (JSC::DFG::SpeculativeJIT::emitAllocateJSCell):
5726         (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
5727         * runtime/JSString.h:
5728         (JSC::JSString::offsetOfFlags):
5729         (JSString):
5730         (JSRopeString):
5731         (JSC::JSRopeString::offsetOfFibers):
5732
5733 2013-03-18  Filip Pizlo  <fpizlo@apple.com>
5734
5735         JSC_NATIVE_FUNCTION() takes an identifier for the name and then uses #name, which is unsafe if name was already #define'd to something else
5736         https://bugs.webkit.org/show_bug.cgi?id=112639
5737
5738         Reviewed by Michael Saboff.
5739
5740         Change it to take a string instead.
5741
5742         * runtime/JSObject.h:
5743         (JSC):
5744         * runtime/ObjectPrototype.cpp:
5745         (JSC::ObjectPrototype::finishCreation):
5746         * runtime/StringPrototype.cpp:
5747         (JSC::StringPrototype::finishCreation):
5748
5749 2013-03-18  Brent Fulgham  <bfulgham@webkit.org>
5750
5751         [WinCairo] Get build working under VS2010.
5752         https://bugs.webkit.org/show_bug.cgi?id=112604
5753
5754         Reviewed by Tim Horton.
5755
5756         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj: Use CFLite-specific
5757         build target (standard version links against CoreFoundation.lib
5758         instead of CFLite.lib).
5759         * JavaScriptCore.vcxproj/testapi/testapiCommonCFLite.props: Added.
5760         * JavaScriptCore.vcxproj/testapi/testapiDebugCFLite.props: Added.
5761         * JavaScriptCore.vcxproj/testapi/testapiReleaseCFLite.props: Added.
5762
5763 2013-03-18  Roger Fong  <roger_fong@apple.com>
5764
5765         AppleWin VS2010 Debug configuration build fix..
5766
5767         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
5768
5769 2013-03-18  Brent Fulgham  <bfulgham@webkit.org>
5770
5771         [WinCairo] Get build working under VS2010.
5772         https://bugs.webkit.org/show_bug.cgi?id=112604
5773
5774         Reviewed by Tim Horton.
5775
5776         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Add build targets for
5777         Debug_WinCairo and Release_WinCairo using CFLite.
5778         * JavaScriptCore.vcxproj/JavaScriptCoreCFLite.props: Added.
5779         * JavaScriptCore.vcxproj/JavaScriptCoreDebugCFLite.props: Added.
5780         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj:
5781         Add Debug_WinCairo and Release_WinCairo build targets to
5782         make sure headers are copied to proper build folder.
5783         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj: Ditto.
5784         * JavaScriptCore.vcxproj/JavaScriptCoreReleaseCFLite.props: Added.
5785         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj:
5786         Add Debug_WinCairo and Release_WinCairo build targets to
5787         make sure headers are copied to proper build folder.
5788         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj:
5789         Ditto.
5790         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj:
5791         Ditto.
5792         * JavaScriptCore.vcxproj/jsc/jsc.vcxproj: Ditto.
5793         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj: Ditto.
5794         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj: Ditto.
5795
5796 2013-03-18  Michael Saboff  <msaboff@apple.com>
5797
5798         Potentially unsafe register allocations in DFG code generation
5799         https://bugs.webkit.org/show_bug.cgi?id=112477
5800
5801         Reviewed by Geoffrey Garen.
5802
5803         Moved allocation of temporary GPRs to be before any generated branches in the functions below.
5804
5805         * dfg/DFGSpeculativeJIT32_64.cpp:
5806         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
5807         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
5808         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
5809         * dfg/DFGSpeculativeJIT64.cpp:
5810         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
5811         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
5812         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
5813
5814 2013-03-15  Filip Pizlo  <fpizlo@apple.com>
5815
5816         DFG string conversions and allocations should be inlined
5817         https://bugs.webkit.org/show_bug.cgi?id=112376
5818
5819         Reviewed by Geoffrey Garen.
5820
5821         This turns new String(), String(), String.prototype.valueOf(), and
5822         String.prototype.toString() into intrinsics. It gives the DFG the ability to handle
5823         conversions from StringObject to JSString and vice-versa, and also gives it the
5824         ability to handle cases where a variable may be either a StringObject or a JSString.
5825         To do this, I added StringObject to value profiling (and removed the stale
5826         distinction between Myarguments and Foreignarguments). I also cleaned up ToPrimitive
5827         handling, using some of the new functionality but also taking advantage of the
5828         existence of Identity(String:@a).
5829
5830         This is a 2% SunSpider speed-up. Also there are some speed-ups on V8v7 and Kraken.
5831         On microbenchmarks that stress new String() this is a 14x speed-up.
5832
5833         * CMakeLists.txt:
5834         * DerivedSources.make:
5835         * DerivedSources.pri:
5836         * GNUmakefile.list.am:
5837         * bytecode/CodeBlock.h:
5838         (CodeBlock):
5839         (JSC::CodeBlock::hasExitSite):
5840         (JSC):
5841         * bytecode/DFGExitProfile.cpp:
5842         (JSC::DFG::ExitProfile::hasExitSite):
5843         (DFG):
5844         * bytecode/DFGExitProfile.h:
5845         (ExitProfile):
5846         (JSC::DFG::ExitProfile::hasExitSite):
5847         * bytecode/ExitKind.cpp:
5848         (JSC::exitKindToString):
5849         * bytecode/ExitKind.h:
5850         * bytecode/SpeculatedType.cpp:
5851         (JSC::dumpSpeculation):
5852         (JSC::speculationToAbbreviatedString):
5853         (JSC::speculationFromClassInfo):
5854         * bytecode/SpeculatedType.h:
5855         (JSC):
5856         (JSC::isStringObjectSpeculation):
5857         (JSC::isStringOrStringObjectSpeculation):
5858         * create_hash_table:
5859         * dfg/DFGAbstractState.cpp:
5860         (JSC::DFG::AbstractState::executeEffects):
5861         * dfg/DFGAbstractState.h:
5862         (JSC::DFG::AbstractState::filterEdgeByUse):
5863         * dfg/DFGByteCodeParser.cpp:
5864         (ByteCodeParser):
5865         (JSC::DFG::ByteCodeParser::handleCall):
5866         (JSC::DFG::ByteCodeParser::emitArgumentPhantoms):
5867         (DFG):
5868         (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
5869         * dfg/DFGCSEPhase.cpp:
5870         (JSC::DFG::CSEPhase::putStructureStoreElimination):
5871         * dfg/DFGEdge.h:
5872         (JSC::DFG::Edge::shift):
5873         * dfg/DFGFixupPhase.cpp:
5874         (JSC::DFG::FixupPhase::fixupNode):
5875         (JSC::DFG::FixupPhase::isStringPrototypeMethodSane):
5876         (FixupPhase):
5877         (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
5878         (JSC::DFG::FixupPhase::observeUseKindOnNode):
5879         * dfg/DFGGraph.h:
5880         (JSC::DFG::Graph::hasGlobalExitSite):
5881         (Graph):
5882         (JSC::DFG::Graph::hasExitSite):
5883         (JSC::DFG::Graph::clobbersWorld):
5884         * dfg/DFGNode.h:
5885         (JSC::DFG::Node::convertToToString):
5886         (Node):
5887         (JSC::DFG::Node::hasStructure):
5888         (JSC::DFG::Node::shouldSpeculateStringObject):
5889         (JSC::DFG::Node::shouldSpeculateStringOrStringObject):
5890         * dfg/DFGNodeType.h:
5891         (DFG):
5892         * dfg/DFGOperations.cpp:
5893         * dfg/DFGOperations.h:
5894         * dfg/DFGPredictionPropagationPhase.cpp:
5895         (JSC::DFG::PredictionPropagationPhase::propagate):
5896         * dfg/DFGSpeculativeJIT.cpp:
5897         (JSC::DFG::SpeculativeJIT::compileToStringOnCell):
5898         (DFG):
5899         (JSC::DFG::SpeculativeJIT::compileNewStringObject):
5900         (JSC::DFG::SpeculativeJIT::speculateObject):
5901         (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
5902         (JSC::DFG::SpeculativeJIT::speculateString):
5903         (JSC::DFG::SpeculativeJIT::speculateStringObject):
5904         (JSC::DFG::SpeculativeJIT::speculateStringOrStringObject):
5905         (JSC::DFG::SpeculativeJIT::speculate):
5906         * dfg/DFGSpeculativeJIT.h:
5907         (JSC::DFG::SpeculativeJIT::callOperation):
5908         (SpeculativeJIT):
5909         (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
5910         (DFG):
5911         (JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):
5912         * dfg/DFGSpeculativeJIT32_64.cpp:
5913         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
5914         (JSC::DFG::SpeculativeJIT::compile):
5915         * dfg/DFGSpeculativeJIT64.cpp:
5916         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
5917         (JSC::DFG::SpeculativeJIT::compile):
5918         * dfg/DFGUseKind.cpp:
5919         (WTF::printInternal):
5920         * dfg/DFGUseKind.h:
5921         (JSC::DFG::typeFilterFor):
5922         * interpreter/CallFrame.h:
5923         (JSC::ExecState::regExpPrototypeTable):
5924         * runtime/CommonIdentifiers.h:
5925         * runtime/Intrinsic.h:
5926         * runtime/JSDestructibleObject.h:
5927         (JSDestructibleObject):
5928         (JSC::JSDestructibleObject::classInfoOffset):
5929         * runtime/JSGlobalData.cpp:
5930         (JSC):
5931         (JSC::JSGlobalData::JSGlobalData):
5932         (JSC::JSGlobalData::~JSGlobalData):
5933         * runtime/JSGlobalData.h:
5934         (JSGlobalData):
5935         * runtime/JSObject.cpp:
5936         * runtime/JSObject.h:
5937         (JSC):
5938         * runtime/JSWrapperObject.h:
5939         (JSC::JSWrapperObject::allocationSize):
5940         (JSWrapperObject):
5941         (JSC::JSWrapperObject::internalValueOffset):
5942         (JSC::JSWrapperObject::internalValueCellOffset):
5943         * runtime/StringPrototype.cpp:
5944         (JSC):
5945         (JSC::StringPrototype::finishCreation):
5946         (JSC::StringPrototype::create):
5947         * runtime/StringPrototype.h:
5948         (StringPrototype):
5949
5950 2013-03-18  Filip Pizlo  <fpizlo@apple.com>
5951
5952         ObjectPrototype properties should be eagerly created rather than lazily via static tables
5953         https://bugs.webkit.org/show_bug.cgi?id=112539
5954
5955         Reviewed by Oliver Hunt.
5956
5957         This is the first part of https://bugs.webkit.org/show_bug.cgi?id=112233. Rolling this
5958         in first since it's the less-likely-to-be-broken part.
5959
5960         * CMakeLists.txt:
5961         * DerivedSources.make:
5962         * DerivedSources.pri:
5963         * GNUmakefile.list.am:
5964         * interpreter/CallFrame.h:
5965         (JSC::ExecState::objectConstructorTable):
5966         * runtime/CommonIdentifiers.h:
5967         * runtime/JSGlobalData.cpp:
5968         (JSC):
5969         (JSC::JSGlobalData::JSGlobalData):
5970         (JSC::JSGlobalData::~JSGlobalData):
5971         * runtime/JSGlobalData.h:
5972         (JSGlobalData):
5973         * runtime/JSObject.cpp:
5974         (JSC::JSObject::putDirectNativeFunction):
5975         (JSC):
5976         * runtime/JSObject.h:
5977         (JSObject):
5978         (JSC):
5979         * runtime/Lookup.cpp:
5980         (JSC::setUpStaticFunctionSlot):
5981         * runtime/ObjectPrototype.cpp:
5982         (JSC):
5983         (JSC::ObjectPrototype::finishCreation):
5984         (JSC::ObjectPrototype::create):
5985         * runtime/ObjectPrototype.h:
5986         (ObjectPrototype):
5987
5988 2013-03-16  Pratik Solanki  <psolanki@apple.com>
5989
5990         Disable High DPI Canvas on iOS
5991         https://bugs.webkit.org/show_bug.cgi?id=112511
5992
5993         Reviewed by Joseph Pecoraro.
5994
5995         * Configurations/FeatureDefines.xcconfig:
5996
5997 2013-03-15  Andreas Kling  <akling@apple.com>
5998
5999         Don't also clone StructureRareData when cloning Structure.
6000         <http://webkit.org/b/111672>
6001
6002         Reviewed by Mark Hahnenberg.
6003
6004         We were cloning a lot of StructureRareData with only the previousID pointer set since
6005         the enumerationCache is not shared between clones.
6006
6007         Let the Structure copy constructor decide whether it wants to clone the rare data.
6008         The decision is made by StructureRareData::needsCloning() and will currently always
6009         return false, since StructureRareData only holds on to caches at present.
6010         This may change in the future as more members are added to StructureRareData.
6011
6012         * runtime/Structure.cpp:
6013         (JSC::Structure::Structure):
6014         (JSC::Structure::cloneRareDataFrom):
6015         * runtime/StructureInlines.h:
6016         (JSC::Structure::create):
6017
6018 2013-03-15  Mark Hahnenberg  <mhahnenberg@apple.com>
6019
6020         Roll out r145838
6021         https://bugs.webkit.org/show_bug.cgi?id=112458
6022
6023         Unreviewed. Requested by Filip Pizlo.
6024
6025         * CMakeLists.txt:
6026         * DerivedSources.make:
6027         * DerivedSources.pri:
6028         * GNUmakefile.list.am:
6029         * dfg/DFGOperations.cpp:
6030         * interpreter/CallFrame.h:
6031         (JSC::ExecState::objectPrototypeTable):
6032         * jit/JITStubs.cpp:
6033         (JSC::getByVal):
6034         * llint/LLIntSlowPaths.cpp:
6035         (JSC::LLInt::getByVal):
6036         * runtime/CommonIdentifiers.h:
6037         * runtime/JSCell.cpp:
6038         (JSC):
6039         * runtime/JSCell.h:
6040         (JSCell):
6041         * runtime/JSCellInlines.h:
6042         (JSC):
6043         (JSC::JSCell::fastGetOwnProperty):
6044         * runtime/JSGlobalData.cpp:
6045         (JSC):
6046         (JSC::JSGlobalData::JSGlobalData):
6047         (JSC::JSGlobalData::~JSGlobalData):
6048         * runtime/JSGlobalData.h:
6049         (JSGlobalData):
6050         * runtime/JSObject.cpp:
6051         (JSC):
6052         * runtime/JSObject.h:
6053         (JSObject):
6054         (JSC):
6055         * runtime/Lookup.cpp:
6056         (JSC::setUpStaticFunctionSlot):
6057         * runtime/ObjectPrototype.cpp:
6058         (JSC):
6059         (JSC::ObjectPrototype::finishCreation):
6060         (JSC::ObjectPrototype::getOwnPropertySlot):
6061         (JSC::ObjectPrototype::getOwnPropertyDescriptor):
6062         * runtime/ObjectPrototype.h:
6063         (JSC::ObjectPrototype::create):
6064         (ObjectPrototype):
6065         * runtime/PropertyMapHashTable.h:
6066         (JSC::PropertyTable::findWithString):
6067         * runtime/Structure.h:
6068         (Structure):
6069         * runtime/StructureInlines.h:
6070         (JSC::Structure::get):
6071
6072 2013-03-15  Michael Saboff  <msaboff@apple.com>
6073
6074         Cleanup of DFG and Baseline JIT debugging code
6075         https://bugs.webkit.org/show_bug.cgi?id=111871
6076
6077         Reviewed by Geoffrey Garen.
6078
6079         Fixed various debug related issue in baseline and DFG JITs. See below.
6080
6081         * dfg/DFGRepatch.cpp:
6082         (JSC::DFG::dfgLinkClosureCall): Used pointerDump() to handle when calleeCodeBlock is NULL.
6083         * dfg/DFGScratchRegisterAllocator.h: Now use ScratchBuffer::activeLengthPtr() to get
6084         pointer to scratch register length.
6085         (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
6086         (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
6087         * dfg/DFGSpeculativeJIT.cpp:
6088         (JSC::DFG::SpeculativeJIT::checkConsistency): Added missing case labels for DataFormatOSRMarker,
6089         DataFormatDead, and DataFormatArguments and made them RELEASE_ASSERT_NOT_REACHED();
6090         * jit/JITCall.cpp:
6091         (JSC::JIT::privateCompileClosureCall): Used pointerDump() to handle when calleeCodeBlock is NULL.
6092         * jit/JITCall32_64.cpp:
6093         (JSC::JIT::privateCompileClosureCall): Used pointerDump() to handle when calleeCodeBlock is NULL.
6094         * runtime/JSGlobalData.h:
6095         (JSC::ScratchBuffer::ScratchBuffer): Fixed buffer allocation alignment to
6096         be on a double boundary.
6097         (JSC::ScratchBuffer::setActiveLength):
6098         (JSC::ScratchBuffer::activeLength):
6099         (JSC::ScratchBuffer::activeLengthPtr):
6100
6101 2013-03-15  Michael Saboff  <msaboff@apple.com>
6102
6103         Add runtime check for improper register allocations in DFG
6104         https://bugs.webkit.org/show_bug.cgi?id=112380
6105
6106         Reviewed by Geoffrey Garen.
6107
6108         Added framework to check for register allocation within a branch source - target range.  All register allocations
6109         are saved using the offset in the code stream where the allocation occurred.  Later when a jump is linked, the
6110         currently saved register allocations are checked to make sure that they didn't occur in the range of code that was
6111         jumped over.  This protects against the case where an allocation could have spilled register contents to free up
6112         a register and that spill only occurs on one path of a many through the code.  A subsequent fill of the spilled
6113         register may load garbage.  See https://bugs.webkit.org/show_bug.cgi?id=111777 for one such bug.
6114         This code is protected by the compile time check of #if ENABLE(DFG_REGISTER_ALLOCATION_VALIDATION).
6115         The check is only done during the processing of SpeculativeJIT::compile(Node* node) and its callees.
6116
6117         * assembler/AbstractMacroAssembler.h:
6118         (JSC::AbstractMacroAssembler::Jump::link): Invoke register allocation checks using source and target of link.
6119         (JSC::AbstractMacroAssembler::Jump::linkTo): Invoke register allocation checks using source and target of link.
6120         (AbstractMacroAssembler):
6121         (RegisterAllocationOffset): New helper class to store the instruction stream offset and compare against a
6122         jump range.
6123         (JSC::AbstractMacroAssembler::RegisterAllocationOffset::RegisterAllocationOffset):
6124         (JSC::AbstractMacroAssembler::RegisterAllocationOffset::check):
6125         (JSC::AbstractMacroAssembler::addRegisterAllocationAtOffset):
6126         (JSC::AbstractMacroAssembler::clearRegisterAllocationOffsets):
6127         (JSC::AbstractMacroAssembler::checkRegisterAllocationAgainstBranchRange):
6128         * dfg/DFGSpeculativeJIT.h:
6129         (JSC::DFG::SpeculativeJIT::allocate):
6130         * dfg/DFGSpeculativeJIT32_64.cpp:
6131         (JSC::DFG::SpeculativeJIT::compile):
6132         * dfg/DFGSpeculativeJIT64.cpp:
6133         (JSC::DFG::SpeculativeJIT::compile):
6134
6135 2013-03-14  Oliver Hunt  <oliver@apple.com>
6136
6137         REGRESSION(r145000): Crash loading arstechnica.com when Safari Web Inspector is open
6138         https://bugs.webkit.org/show_bug.cgi?id=111868
6139
6140         Reviewed by Antti Koivisto.
6141
6142         Don't allow non-local property lookup when the debugger is enabled.
6143
6144         * bytecompiler/BytecodeGenerator.cpp:
6145         (JSC::BytecodeGenerator::resolve):
6146
6147 2013-03-11  Mark Hahnenberg  <mhahnenberg@apple.com>
6148
6149         Objective-C API: Objective-C functions exposed to JavaScript have the wrong type (object instead of function)
6150         https://bugs.webkit.org/show_bug.cgi?id=105892
6151
6152         Reviewed by Geoffrey Garen.
6153
6154         Changed ObjCCallbackFunction to subclass JSCallbackFunction which already has all of the machinery to call
6155         functions using the C API. Since ObjCCallbackFunction is now a JSCell, we changed the old implementation of
6156         ObjCCallbackFunction to be the internal implementation and keep track of all the proper data so that we
6157         don't have to put all of that in the header, which will now be included from C++ files (e.g. JSGlobalObject.cpp).
6158
6159         * API/JSCallbackFunction.cpp: Change JSCallbackFunction to allow subclassing. Originally it was internally
6160         passing its own Structure up the chain of constructors, but we now want to be able to pass other Structures as well.
6161         (JSC::JSCallbackFunction::JSCallbackFunction):
6162         (JSC::JSCallbackFunction::create):
6163         * API/JSCallbackFunction.h:
6164         (JSCallbackFunction):
6165         * API/JSWrapperMap.mm: Changed interface to tryUnwrapBlock.
6166         (tryUnwrapObjcObject):
6167         * API/ObjCCallbackFunction.h:
6168         (ObjCCallbackFunction): Moved into the JSC namespace, just like JSCallbackFunction.
6169         (JSC::ObjCCallbackFunction::createStructure): Overridden so that the correct ClassInfo gets used since we have
6170         a destructor.
6171         (JSC::ObjCCallbackFunction::impl): Getter for the internal impl.
6172         * API/ObjCCallbackFunction.mm:
6173         (JSC::ObjCCallbackFunctionImpl::ObjCCallbackFunctionImpl): What used to be ObjCCallbackFunction is now
6174         ObjCCallbackFunctionImpl. It handles the Objective-C specific parts of managing callback functions.
6175         (JSC::ObjCCallbackFunctionImpl::~ObjCCallbackFunctionImpl):
6176         (JSC::objCCallbackFunctionCallAsFunction): Same as the old one, but now it casts to ObjCCallbackFunction and grabs the impl
6177         rather than using JSObjectGetPrivate.
6178         (JSC::ObjCCallbackFunction::ObjCCallbackFunction): New bits to allow being part of the JSCell hierarchy.
6179         (JSC::ObjCCallbackFunction::create):
6180         (JSC::ObjCCallbackFunction::destroy):
6181         (JSC::ObjCCallbackFunctionImpl::call): Handles the actual invocation, just like it used to.
6182         (objCCallbackFunctionForInvocation):
6183         (tryUnwrapBlock): Changed to check the ClassInfo for inheritance directly, rather than going through the C API call.
6184         * API/tests/testapi.mm: Added new test to make sure that doing Function.prototype.toString.call(f) won't result in
6185         an error when f is an Objective-C method or block underneath the covers.
6186         * runtime/JSGlobalObject.cpp: Added new Structure for ObjCCallbackFunction.
6187         (JSC::JSGlobalObject::reset):
6188         (JSC::JSGlobalObject::visitChildren):
6189         * runtime/JSGlobalObject.h:
6190         (JSGlobalObject):
6191         (JSC::JSGlobalObject::objcCallbackFunctionStructure):
6192
6193 2013-03-14  Mark Hahnenberg  <mhahnenberg@apple.com>
6194
6195         Objective-C API: Nested dictionaries are not converted properly in the Objective-C binding
6196         https://bugs.webkit.org/show_bug.cgi?id=112377
6197
6198         Reviewed by Oliver Hunt.
6199
6200         Accidental reassignment of the root task in the container conversion logic was causing the last
6201         array or dictionary processed to be returned in the case of nested containers.
6202
6203         * API/JSValue.mm:
6204         (containerValueToObject):
6205         * API/tests/testapi.mm:
6206
6207 2013-03-13  Filip Pizlo  <fpizlo@apple.com>
6208
6209         JSObject fast by-string access optimizations should work even on the prototype chain, and even when the result is undefined
6210         https://bugs.webkit.org/show_bug.cgi?id=112233
6211
6212         Reviewed by Oliver Hunt.
6213
6214         Extended the existing fast access path for String keys to work over the entire prototype chain,
6215         not just the self access case. This will fail as soon as it sees an object that intercepts
6216         getOwnPropertySlot, so this patch also ensures that ObjectPrototype does not fall into that
6217         category. This is accomplished by making ObjectPrototype eagerly reify all of its properties.
6218         This is safe for ObjectPrototype because it's so common and we expect all of its properties to
6219         be reified for any interesting programs anyway. A new idiom for adding native functions to
6220         prototypes is introduced, which ought to work well for any other prototypes that we wish to do
6221         this conversion for.
6222
6223         This is a >60% speed-up in the case that you frequently do by-string lookups that "miss", i.e.
6224         they don't turn up anything.
6225
6226         * CMakeLists.txt:
6227         * DerivedSources.make:
6228         * DerivedSources.pri:
6229         * GNUmakefile.list.am:
6230         * dfg/DFGOperations.cpp:
6231         * interpreter/CallFrame.h:
6232         (JSC::ExecState::objectConstructorTable):
6233         * jit/JITStubs.cpp:
6234         (JSC::getByVal):
6235         * llint/LLIntSlowPaths.cpp:
6236         (JSC::LLInt::getByVal):
6237         * runtime/CommonIdentifiers.h:
6238         * runtime/JSCell.cpp:
6239         (JSC::JSCell::getByStringSlow):
6240         (JSC):
6241         * runtime/JSCell.h:
6242         (JSCell):
6243         * runtime/JSCellInlines.h:
6244         (JSC):
6245         (JSC::JSCell::getByStringAndKey):
6246         (JSC::JSCell::getByString):
6247         * runtime/JSGlobalData.cpp:
6248         (JSC):
6249         (JSC::JSGlobalData::JSGlobalData):
6250         (JSC::JSGlobalData::~JSGlobalData):
6251         * runtime/JSGlobalData.h:
6252         (JSGlobalData):
6253         * runtime/JSObject.cpp:
6254         (JSC::JSObject::putDirectNativeFunction):
6255         (JSC):
6256         * runtime/JSObject.h:
6257         (JSObject):
6258         (JSC):
6259         * runtime/Lookup.cpp:
6260         (JSC::setUpStaticFunctionSlot):
6261         * runtime/ObjectPrototype.cpp:
6262         (JSC):
6263         (JSC::ObjectPrototype::finishCreation):
6264         (JSC::ObjectPrototype::create):
6265         * runtime/ObjectPrototype.h:
6266         (ObjectPrototype):
6267         * runtime/PropertyMapHashTable.h:
6268         (JSC::PropertyTable::findWithString):
6269         * runtime/Structure.h:
6270         (Structure):
6271         * runtime/StructureInlines.h:
6272         (JSC::Structure::get):
6273         (JSC):
6274
6275 2013-03-13  Filip Pizlo  <fpizlo@apple.com>
6276
6277         DFG bytecode parser is too aggressive about getting rid of GetLocals on captured variables
6278         https://bugs.webkit.org/show_bug.cgi?id=112287
6279         <rdar://problem/13342340>
6280
6281         Reviewed by Oliver Hunt.
6282
6283         * bytecode/CodeBlock.cpp:
6284         (JSC::CodeBlock::dumpBytecode):
6285         (JSC::CodeBlock::finalizeUnconditionally):
6286         * dfg/DFGByteCodeParser.cpp:
6287         (JSC::DFG::ByteCodeParser::getLocal):
6288
6289 2013-03-13  Ryosuke Niwa  <rniwa@webkit.org>
6290
6291         Threaded HTML Parser is missing feature define flags in all but Chromium port's build files
6292         https://bugs.webkit.org/show_bug.cgi?id=112277
6293
6294         Reviewed by Adam Barth.
6295
6296         * Configurations/FeatureDefines.xcconfig:
6297
6298 2013-03-13  Csaba Osztrogonác  <ossy@webkit.org>
6299
6300         LLINT C loop warning fix for GCC
6301         https://bugs.webkit.org/show_bug.cgi?id=112145
6302
6303         Reviewed by Filip Pizlo.
6304
6305         * llint/LowLevelInterpreter.cpp:
6306         (JSC::CLoop::execute):
6307
6308 2013-02-13  Simon Hausmann  <simon.hausmann@digia.com>
6309
6310         Add support for convenient conversion from JSStringRef to QString
6311         https://bugs.webkit.org/show_bug.cgi?id=109694
6312
6313         Reviewed by Allan Sandfeld Jensen.
6314
6315         Add JSStringCopyQString helper function that allows for the convenient
6316         extraction of a QString out of a JSStringRef.
6317
6318         * API/JSStringRefQt.cpp: Added.
6319         (JSStringCopyQString):
6320         * API/JSStringRefQt.h: Added.
6321         * API/OpaqueJSString.h:
6322         (OpaqueJSString):
6323         (OpaqueJSString::qString):
6324         (OpaqueJSString::OpaqueJSString):
6325         * Target.pri:
6326
6327 2013-03-13  Peter Gal  <galpeter@inf.u-szeged.hu>
6328
6329         Token 'not' is ignored in the offlineasm.
6330         https://bugs.webkit.org/show_bug.cgi?id=111568
6331
6332         Reviewed by Filip Pizlo.
6333
6334         * offlineasm/parser.rb: Build the Not AST node if the 'not' token is found.
6335
6336 2013-03-12  Tim Horton  <timothy_horton@apple.com>
6337
6338         WTF uses macros for exports. Try to fix the Windows build. Unreviewed.
6339
6340         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
6341         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
6342
6343 2013-03-12  Filip Pizlo  <fpizlo@apple.com>
6344
6345         Array.prototype.sort should at least try to be PTIME even when the array is in some bizarre mode
6346         https://bugs.webkit.org/show_bug.cgi?id=112187
6347         <rdar://problem/13393550>
6348
6349         Reviewed by Michael Saboff and Gavin Barraclough.
6350
6351         If we have an array-like object in crazy mode passed into Array.prototype.sort, and its length is large,
6352         then first copy all elements into a separate, compact, un-holy array and sort that. Then copy back.
6353         This means that sorting will be at worst O(n^2) in the actual number of things in the array, rather than
6354         O(n^2) in the array's length.
6355
6356         * runtime/ArrayPrototype.cpp:
6357         (JSC::attemptFastSort):
6358         (JSC::performSlowSort):
6359         (JSC):
6360         (JSC::arrayProtoFuncSort):
6361
6362 2013-03-12  Tim Horton  <timothy_horton@apple.com>
6363
6364         Try to fix the Windows build.
6365
6366         Not reviewed.
6367
6368         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
6369
6370 2013-03-12  Geoffrey Garen  <ggaren@apple.com>
6371
6372         Try to fix the Windows build.
6373
6374         Not reviewed.
6375
6376         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
6377         Export a thing.
6378
6379 2013-03-11  Oliver Hunt  <oliver@apple.com>
6380
6381         Harden JSStringJoiner
6382         https://bugs.webkit.org/show_bug.cgi?id=112093
6383
6384         Reviewed by Filip Pizlo.
6385
6386         Harden JSStringJoiner, make it use our CheckedArithmetic
6387         class to simplify everything.
6388
6389         * runtime/JSStringJoiner.cpp:
6390         (JSC::JSStringJoiner::build):
6391         * runtime/JSStringJoiner.h:
6392         (JSStringJoiner):
6393         (JSC::JSStringJoiner::JSStringJoiner):
6394         (JSC::JSStringJoiner::append):
6395
6396 2013-03-12  Filip Pizlo  <fpizlo@apple.com>
6397
6398         DFG generic array access cases should not be guarded by CheckStructure even of the profiling tells us that it could be
6399         https://bugs.webkit.org/show_bug.cgi?id=112183
6400
6401         Reviewed by Oliver Hunt.
6402
6403         Slight speed-up on string-unpack-code.
6404
6405         * dfg/DFGFixupPhase.cpp:
6406         (JSC::DFG::FixupPhase::findAndRemoveUnnecessaryStructureCheck):
6407         (FixupPhase):
6408         (JSC::DFG::FixupPhase::checkArray):
6409         (JSC::DFG::FixupPhase::blessArrayOperation):
6410
6411 2013-03-12  Gabor Rapcsanyi  <rgabor@webkit.org>
6412
6413         https://bugs.webkit.org/show_bug.cgi?id=112141
6414         LLInt CLoop backend misses Double2Ints() on 32bit architectures
6415
6416         Reviewed by Filip Pizlo.
6417
6418         Implement Double2Ints() in CLoop backend of LLInt on 32bit architectures.
6419
6420         * llint/LowLevelInterpreter.cpp:
6421         (LLInt):
6422         (JSC::LLInt::Double2Ints):
6423         * offlineasm/cloop.rb:
6424
6425 2013-03-12  Gabor Rapcsanyi  <rgabor@webkit.org>
6426
6427         Making more sophisticated cache flush on ARM Linux platform
6428         https://bugs.webkit.org/show_bug.cgi?id=111854
6429
6430         Reviewed by Zoltan Herczeg.
6431
6432         The cache flush on ARM Linux invalidates whole pages
6433         instead of just the required area.
6434
6435         * assembler/ARMAssembler.h:
6436         (ARMAssembler):
6437         (JSC::ARMAssembler::linuxPageFlush):
6438         (JSC::ARMAssembler::cacheFlush):
6439         * assembler/ARMv7Assembler.h:
6440         (ARMv7Assembler):
6441         (JSC::ARMv7Assembler::linuxPageFlush):
6442         (JSC::ARMv7Assembler::cacheFlush):
6443
6444 2013-03-12  Gabor Rapcsanyi  <rgabor@webkit.org>
6445
6446         Renaming the armv7.rb LLINT backend to arm.rb
6447         https://bugs.webkit.org/show_bug.cgi?id=110565
6448
6449         Reviewed by Zoltan Herczeg.
6450
6451         This is the first step of a unified ARM backend for
6452         all ARM 32 bit architectures in LLInt.
6453
6454         * CMakeLists.txt:
6455         * GNUmakefile.list.am:
6456         * JavaScriptCore.gypi:
6457         * LLIntOffsetsExtractor.pro:
6458         * offlineasm/arm.rb: Copied from Source/JavaScriptCore/offlineasm/armv7.rb.
6459         * offlineasm/armv7.rb: Removed.
6460         * offlineasm/backends.rb:
6461         * offlineasm/risc.rb:
6462
6463 2013-03-12  Csaba Osztrogonác  <ossy@webkit.org>
6464
6465         REGRESSION(r145482): It broke 33 jsc tests and zillion layout tests on all platform
6466         https://bugs.webkit.org/show_bug.cgi?id=112112
6467
6468         Reviewed by Oliver Hunt.
6469
6470         Rolling out https://trac.webkit.org/changeset/145482 to unbreak the bots.
6471
6472         * runtime/JSStringJoiner.cpp:
6473         (JSC::JSStringJoiner::build):
6474         * runtime/JSStringJoiner.h:
6475         (JSStringJoiner):
6476         (JSC::JSStringJoiner::JSStringJoiner):
6477         (JSC::JSStringJoiner::append):
6478
6479 2013-03-12  Filip Pizlo  <fpizlo@apple.com>
6480
6481         DFG prediction propagation phase should not rerun forward propagation if double voting has already converged
6482         https://bugs.webkit.org/show_bug.cgi?id=111920
6483
6484         Reviewed by Oliver Hunt.
6485
6486         I don't know why we weren't exiting early after double voting if !m_changed.
6487
6488         This change also removes backwards propagation from the voting fixpoint, since at that
6489         point short-circuiting loops is probably not particularly profitable. Profiling shows
6490         that this reduces the time spent in prediction propagation even further.
6491
6492         This change appears to be a 1% SunSpider speed-up.
6493
6494         * dfg/DFGPredictionPropagationPhase.cpp:
6495         (JSC::DFG::PredictionPropagationPhase::run):
6496
6497 2013-03-11  Filip Pizlo  <fpizlo@apple.com>
6498
6499         DFG overflow check elimination is too smart for its own good
6500         https://bugs.webkit.org/show_bug.cgi?id=111832
6501
6502         Reviewed by Oliver Hunt and Gavin Barraclough.
6503
6504         Rolling this back in after fixing accidental misuse of JSValue. The code was doing value < someInt
6505         rather than value.asInt32() < someInt. This "worked" when isWithinPowerOfTwo wasn't templatized.
6506         It worked by always being false and always disabling the relvant optimization.
6507
6508         This improves overflow check elimination in three ways:
6509
6510         1) It reduces the amount of time the compiler will spend doing it.
6511
6512         2) It fixes bugs where overflow check elimination was overzealous. Precisely, for a binary operation
6513            over @a and @b where both @a and @b will type check that their inputs (@a->children, @b->children)
6514            are int32's and then perform a possibly-overflowing operation, we must be careful not to assume
6515            that @a's non-int32 parts don't matter if at the point that @a runs we have as yet not proved that
6516            @b->children are int32's and that hence @b might produce a large enough result that doubles would
6517            start chopping low bits. The specific implication of this is that for a binary operation to not
6518            propagate that it cares about non-int32 parts (NodeUsedAsNumber), we must prove that at least one
6519            of the inputs is guaranteed to produce a result within 2^32 and that there won't be a tower of such
6520            operations large enough to ultimately produce a double greater than 2^52 (roughly). We achieve the
6521            latter by disabling this optimization for very large basic blocks. It's noteworthy that blocks that
6522            large won't even make it into the DFG currently.
6523
6524         3) It makes the overflow check elimination more precise for cases where the inputs to an Add or Sub
6525            are the outputs of a bit-op. For example in (@a + (@b | 0)) | 0, we don't need to propagate
6526            NodeUsedAsNumber to either @a or @b.
6527
6528         This is neutral on V8v7 and a slight speed-up on compile time benchmarks.
6529
6530         * CMakeLists.txt:
6531         * GNUmakefile.list.am:
6532         * JavaScriptCore.xcodeproj/project.pbxproj:
6533         * Target.pri:
6534         * dfg/DFGArrayMode.cpp:
6535         (JSC::DFG::ArrayMode::refine):
6536         * dfg/DFGBackwardsPropagationPhase.cpp: Added.
6537         (DFG):
6538         (BackwardsPropagationPhase):
6539         (JSC::DFG::BackwardsPropagationPhase::BackwardsPropagationPhase):
6540         (JSC::DFG::BackwardsPropagationPhase::run):
6541         (JSC::DFG::BackwardsPropagationPhase::isNotNegZero):
6542         (JSC::DFG::BackwardsPropagationPhase::isNotZero):
6543         (JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwoForConstant):
6544         (JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwoNonRecursive):
6545         (JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwo):
6546         (JSC::DFG::BackwardsPropagationPhase::mergeDefaultFlags):
6547         (JSC::DFG::BackwardsPropagationPhase::propagate):
6548         (JSC::DFG::performBackwardsPropagation):
6549         * dfg/DFGBackwardsPropagationPhase.h: Added.
6550         (DFG):
6551         * dfg/DFGCPSRethreadingPhase.cpp:
6552         (JSC::DFG::CPSRethreadingPhase::run):
6553         (JSC::DFG::CPSRethreadingPhase::clearIsLoadedFrom):
6554         (CPSRethreadingPhase):
6555         (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
6556         (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
6557         * dfg/DFGDriver.cpp:
6558         (JSC::DFG::compile):
6559         * dfg/DFGGraph.cpp:
6560         (JSC::DFG::Graph::dump):
6561         * dfg/DFGNodeFlags.cpp:
6562         (JSC::DFG::dumpNodeFlags):
6563         (DFG):
6564         * dfg/DFGNodeFlags.h:
6565         (DFG):
6566         * dfg/DFGPredictionPropagationPhase.cpp:
6567         (PredictionPropagationPhase):
6568         (JSC::DFG::PredictionPropagationPhase::propagate):
6569         * dfg/DFGUnificationPhase.cpp:
6570         (JSC::DFG::UnificationPhase::run):
6571         * dfg/DFGVariableAccessData.h:
6572         (JSC::DFG::VariableAccessData::VariableAccessData):
6573         (JSC::DFG::VariableAccessData::mergeIsLoadedFrom):
6574         (VariableAccessData):
6575         (JSC::DFG::VariableAccessData::setIsLoadedFrom):
6576         (JSC::DFG::VariableAccessData::isLoadedFrom):
6577
6578 2013-03-11  Oliver Hunt  <oliver@apple.com>
6579
6580         Harden JSStringJoiner
6581         https://bugs.webkit.org/show_bug.cgi?id=112093
6582
6583         Reviewed by Filip Pizlo.
6584
6585         Harden JSStringJoiner, make it use our CheckedArithmetic
6586         class to simplify everything.
6587
6588         * runtime/JSStringJoiner.cpp:
6589         (JSC::JSStringJoiner::build):
6590         * runtime/JSStringJoiner.h:
6591         (JSStringJoiner):
6592         (JSC::JSStringJoiner::JSStringJoiner):
6593         (JSC::JSStringJoiner::append):
6594
6595 2013-03-11  Michael Saboff  <msaboff@apple.com>
6596
6597         Crash beneath operationCreateInlinedArguments running fast/js/dfg-create-inlined-arguments-in-closure-inline.html (32-bit only)
6598         https://bugs.webkit.org/show_bug.cgi?id=112067
6599
6600         Reviewed by Geoffrey Garen.
6601
6602         We weren't setting the tag in SetCallee.  Therefore set it to CellTag.
6603
6604         * dfg/DFGSpeculativeJIT32_64.cpp:
6605         (JSC::DFG::SpeculativeJIT::compile):
6606
6607 2013-03-11  Oliver Hunt  <oliver@apple.com>
6608
6609         Make SegmentedVector Noncopyable
6610         https://bugs.webkit.org/show_bug.cgi?id=112059
6611
6612         Reviewed by Geoffrey Garen.
6613
6614         Copying a SegmentedVector is very expensive, and really shouldn't
6615         be necessary.  So I've taken the one place where we currently copy
6616         and replaced it with a regular Vector, and replaced the address
6617         dependent logic with a indexing ref instead.
6618
6619         * bytecompiler/BytecodeGenerator.cpp:
6620         (JSC::BytecodeGenerator::newLabelScope):
6621         (JSC::BytecodeGenerator::emitComplexJumpScopes):
6622         * bytecompiler/BytecodeGenerator.h:
6623         (BytecodeGenerator):
6624         * bytecompiler/LabelScope.h:
6625         (JSC):
6626         (JSC::LabelScopePtr::LabelScopePtr):
6627         (LabelScopePtr):
6628         (JSC::LabelScopePtr::operator=):
6629         (JSC::LabelScopePtr::~LabelScopePtr):
6630         (JSC::LabelScopePtr::operator*):
6631         (JSC::LabelScopePtr::operator->):
6632         * bytecompiler/NodesCodegen.cpp:
6633         (JSC::DoWhileNode::emitBytecode):
6634         (JSC::WhileNode::emitBytecode):
6635         (JSC::ForNode::emitBytecode):
6636         (JSC::ForInNode::emitBytecode):
6637         (JSC::SwitchNode::emitBytecode):
6638         (JSC::LabelNode::emitBytecode):
6639
6640 2013-03-10  Andreas Kling  <akling@apple.com>
6641
6642         SpeculativeJIT should use OwnPtr<SlowPathGenerator>.
6643         <http://webkit.org/b/111942>
6644
6645         Reviewed by Anders Carlsson.
6646
6647         There's no need to include DFGSlowPathGenerator.h from the header as long as the destructor is out-of-line,
6648         so let's use OwnPtr instead of raw pointers + deleteAllValues().
6649
6650         * dfg/DFGSpeculativeJIT.cpp:
6651         (JSC::DFG::SpeculativeJIT::~SpeculativeJIT):
6652         (JSC::DFG::SpeculativeJIT::addSlowPathGenerator):
6653         * dfg/DFGSpeculativeJIT.h:
6654         (SpeculativeJIT):
6655
6656 2013-03-09  Sheriff Bot  <webkit.review.bot@gmail.com>
6657
6658         Unreviewed, rolling out r145299.
6659         http://trac.webkit.org/changeset/145299
6660         https://bugs.webkit.org/show_bug.cgi?id=111928
6661
6662         compilation failure with recent clang
6663         (DFGBackwardsPropagationPhase.cpp:132:35: error: comparison of
6664         constant 10 with expression of type 'bool' is always false)
6665         (Requested by thorton on #webkit).
6666
6667         * CMakeLists.txt:
6668         * GNUmakefile.list.am:
6669         * JavaScriptCore.xcodeproj/project.pbxproj:
6670         * Target.pri:
6671         * dfg/DFGArrayMode.cpp:
6672         (JSC::DFG::ArrayMode::refine):
6673         * dfg/DFGBackwardsPropagationPhase.cpp: Removed.
6674         * dfg/DFGBackwardsPropagationPhase.h: Removed.
6675         * dfg/DFGCPSRethreadingPhase.cpp:
6676         (JSC::DFG::CPSRethreadingPhase::run):
6677         (CPSRethreadingPhase):
6678         (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
6679         (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
6680         * dfg/DFGDriver.cpp:
6681         (JSC::DFG::compile):
6682         * dfg/DFGGraph.cpp:
6683         (JSC::DFG::Graph::dump):
6684         * dfg/DFGNodeFlags.cpp:
6685         (JSC::DFG::nodeFlagsAsString):
6686         (DFG):
6687         * dfg/DFGNodeFlags.h:
6688         (DFG):
6689         * dfg/DFGPredictionPropagationPhase.cpp:
6690         (JSC::DFG::PredictionPropagationPhase::isNotNegZero):
6691         (PredictionPropagationPhase):
6692         (JSC::DFG::PredictionPropagationPhase::isNotZero):
6693         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoForConstant):
6694         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoNonRecursive):
6695         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwo):
6696         (JSC::DFG::PredictionPropagationPhase::propagate):
6697         (JSC::DFG::PredictionPropagationPhase::mergeDefaultFlags):
6698         * dfg/DFGUnificationPhase.cpp:
6699         (JSC::DFG::UnificationPhase::run):
6700         * dfg/DFGVariableAccessData.h:
6701         (JSC::DFG::VariableAccessData::VariableAccessData):
6702         (VariableAccessData):
6703
6704 2013-03-08  Filip Pizlo  <fpizlo@apple.com>
6705
6706         DFG overflow check elimination is too smart for its own good
6707         https://bugs.webkit.org/show_bug.cgi?id=111832
6708
6709         Reviewed by Oliver Hunt and Gavin Barraclough.
6710
6711         This improves overflow check elimination in three ways:
6712
6713         1) It reduces the amount of time the compiler will spend doing it.
6714
6715         2) It fixes bugs where overflow check elimination was overzealous. Precisely, for a binary operation
6716            over @a and @b where both @a and @b will type check that their inputs (@a->children, @b->children)
6717            are int32's and then perform a possibly-overflowing operation, we must be careful not to assume
6718            that @a's non-int32 parts don't matter if at the point that @a runs we have as yet not proved that
6719            @b->children are int32's and that hence @b might produce a large enough result that doubles would
6720            start chopping low bits. The specific implication of this is that for a binary operation to not
6721            propagate that it cares about non-int32 parts (NodeUsedAsNumber), we must prove that at least one
6722            of the inputs is guaranteed to produce a result within 2^32 and that there won't be a tower of such
6723            operations large enough to ultimately produce a double greater than 2^52 (roughly). We achieve the
6724            latter by disabling this optimization for very large basic blocks. It's noteworthy that blocks that
6725            large won't even make it into the DFG currently.
6726
6727         3) It makes the overflow check elimination more precise for cases where the inputs to an Add or Sub
6728            are the outputs of a bit-op. For example in (@a + (@b | 0)) | 0, we don't need to propagate
6729            NodeUsedAsNumber to either @a or @b.
6730
6731         This is neutral on V8v7 and a slight speed-up on compile time benchmarks.
6732
6733         * CMakeLists.txt:
6734         * GNUmakefile.list.am:
6735         * JavaScriptCore.xcodeproj/project.pbxproj:
6736         * Target.pri:
6737         * dfg/DFGArrayMode.cpp:
6738         (JSC::DFG::ArrayMode::refine):
6739         * dfg/DFGBackwardsPropagationPhase.cpp: Added.
6740         (DFG):
6741         (BackwardsPropagationPhase):
6742         (JSC::DFG::BackwardsPropagationPhase::BackwardsPropagationPhase):
6743         (JSC::DFG::BackwardsPropagationPhase::run):
6744         (JSC::DFG::BackwardsPropagationPhase::isNotNegZero):
6745         (JSC::DFG::BackwardsPropagationPhase::isNotZero):
6746         (JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwoForConstant):
6747         (JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwoNonRecursive):
6748         (JSC::DFG::BackwardsPropagationPhase::isWithinPowerOfTwo):
6749         (JSC::DFG::BackwardsPropagationPhase::mergeDefaultFlags):
6750         (JSC::DFG::BackwardsPropagationPhase::propagate):
6751         (JSC::DFG::performBackwardsPropagation):
6752         * dfg/DFGBackwardsPropagationPhase.h: Added.
6753         (DFG):
6754         * dfg/DFGCPSRethreadingPhase.cpp:
6755         (JSC::DFG::CPSRethreadingPhase::run):
6756         (JSC::DFG::CPSRethreadingPhase::clearIsLoadedFrom):
6757         (CPSRethreadingPhase):
6758         (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
6759         (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
6760         * dfg/DFGDriver.cpp:
6761         (JSC::DFG::compile):
6762         * dfg/DFGGraph.cpp:
6763         (JSC::DFG::Graph::dump):
6764         * dfg/DFGNodeFlags.cpp:
6765         (JSC::DFG::dumpNodeFlags):
6766         (DFG):
6767         * dfg/DFGNodeFlags.h:
6768         (DFG):
6769         * dfg/DFGPredictionPropagationPhase.cpp:
6770         (PredictionPropagationPhase):
6771         (JSC::DFG::PredictionPropagationPhase::propagate):
6772         * dfg/DFGUnificationPhase.cpp:
6773         (JSC::DFG::UnificationPhase::run):
6774         * dfg/DFGVariableAccessData.h:
6775         (JSC::DFG::VariableAccessData::VariableAccessData):
6776         (JSC::DFG::VariableAccessData::mergeIsLoadedFrom):
6777         (VariableAccessData):
6778         (JSC::DFG::VariableAccessData::setIsLoadedFrom):
6779         (JSC::DFG::VariableAccessData::isLoadedFrom):
6780
6781 2013-03-08  Roger Fong  <roger_fong@apple.com>
6782
6783         Makefile fixes.
6784
6785         * JavaScriptCore.vcxproj/JavaScriptCore.make:
6786
6787 2013-03-08  Gabor Rapcsanyi  <rgabor@webkit.org>
6788
6789         Cache flush problem on ARMv7 JSC
6790         https://bugs.webkit.org/show_bug.cgi?id=111441
6791
6792         Reviewed by Zoltan Herczeg.
6793
6794         Not proper cache flush causing random crashes on ARMv7 Linux with V8 tests.
6795         The problem is similar to https://bugs.webkit.org/show_bug.cgi?id=77712.
6796         Change the cache fulsh mechanism similar to ARM traditinal and revert the
6797         temporary fix.
6798
6799         * assembler/ARMv7Assembler.h:
6800         (JSC::ARMv7Assembler::cacheFlush):
6801
6802 2013-03-07  Geoffrey Garen  <ggaren@apple.com>
6803
6804         REGRESSION (r143759): 40% JSBench regression, 20% Octane/closure regression, 40% Octane/jquery regression, 2% Octane regression
6805         https://bugs.webkit.org/show_bug.cgi?id=111797
6806
6807         Reviewed by Oliver Hunt.
6808
6809         The bot's testing configuration stresses the cache's starting guess
6810         of 1MB.
6811
6812         This patch removes any starting guess, and just uses wall clock time
6813         to discover the initial working set size of an app, in code size.
6814
6815         * runtime/CodeCache.cpp:
6816         (JSC::CodeCacheMap::pruneSlowCase): Update our timer as we go.
6817
6818         Also fixed a bug where pruning from 0 to 0 would hang -- that case is
6819         a possibility now that we start with a capacity of 0.
6820
6821         * runtime/CodeCache.h:
6822         (CodeCacheMap):
6823         (JSC::CodeCacheMap::CodeCacheMap):
6824         (JSC::CodeCacheMap::add):
6825         (JSC::CodeCacheMap::prune): Don't prune if we're in the middle of
6826         discovering the working set size of an app, in code size.
6827
6828 2013-03-07  Michael Saboff  <msaboff@apple.com>
6829
6830         Crash when updating predictions below JSC::arrayProtoFuncForEach on tuaw.com article
6831         https://bugs.webkit.org/show_bug.cgi?id=111777
6832
6833         Reviewed by Filip Pizlo.
6834
6835         Moved register allocations to be above any generated control flow so that any
6836         resulting spill would be visible to all subsequently generated code.
6837
6838         * dfg/DFGSpeculativeJIT32_64.cpp:
6839         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
6840         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
6841         (JSC::DFG::SpeculativeJIT::compile):
6842         * dfg/DFGSpeculativeJIT64.cpp:
6843         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
6844         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
6845         (JSC::DFG::SpeculativeJIT::compile):
6846
6847 2013-03-07  Filip Pizlo  <fpizlo@apple.com>
6848
6849         DFG should not get corrupted IR in the case of code that is dead, unreachable, and contains a chain of nodes that use each other in an untyped way
6850         https://bugs.webkit.org/show_bug.cgi?id=111783
6851
6852         Reviewed by Mark Hahnenberg.
6853
6854         Unreachable code is not touched by CFA and so thinks that even untyped uses are checked.
6855         But dead untyped uses don't need checks and hence don't need to be Phantom'd. The DCE knew
6856         this in findTypeCheckRoot() but not in eliminateIrrelevantPhantomChildren(), leading to a
6857         Phantom node that had another Phantom node as one of its kids.
6858
6859         * dfg/DFGDCEPhase.cpp:
6860         (JSC::DFG::DCEPhase::eliminateIrrelevantPhantomChildren):
6861
6862 2013-03-07  Filip Pizlo  <fpizlo@apple.com>
6863
6864         The DFG fixpoint is not strictly profitable, and should be straight-lined
6865         https://bugs.webkit.org/show_bug.cgi?id=111764
6866
6867         Reviewed by Oliver Hunt and Geoffrey Garen.
6868
6869         The DFG previously ran optimizations to fixpoint because there exists a circular dependency:
6870
6871         CSE depends on CFG simplification: CFG simplification merges blocks, and CSE is block-local.
6872
6873         CFG simplification depends on CFA and constant folding: constant folding reveals branches on
6874         constants.
6875
6876         CFA depends on CSE: CSE reveals must-alias relationships by proving that two operations
6877         always produce identical values.
6878
6879         Arguments simplification also depends on CSE, but it ought not depend on anything else.
6880
6881         Hence we get a cycle like: CFA -> folding -> CFG -> CSE -> CFA.
6882
6883         Note that before we had sparse conditional CFA, we also had CFA depending on CFG. This ought
6884         not be the case anymore: CFG simplification should not by itself lead to better CFA results.
6885
6886         My guess is that the weakest link in this cycle is CFG -> CSE. CSE cuts both ways: if you
6887         CSE too much then you increase register pressure. Hence it's not clear that you always want
6888         to CSE after simplifying control flow. This leads to an order of optimization as follows:
6889
6890         CSE -> arguments -> CFA -> folding -> CFG
6891
6892         This is a 2.5% speed-up on SunSpider, a 4% speed-up on V8Spider, a possible 0.3% slow-down
6893         on V8v7, nothing on Kraken, and 1.2% speed-up in the JSRegress geomean. I'll take a 2.5%
6894         speed-up over a 0.3% V8v7 speed-up.
6895
6896         * dfg/DFGDriver.cpp:
6897         (JSC::DFG::compile):
6898
6899 2013-03-07  Roger Fong  <roger_fong@apple.com>
6900
6901         Build fix for AppleWin VS2010.
6902
6903         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
6904         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
6905
6906 2013-03-05  Mark Hahnenberg  <mhahnenberg@apple.com>
6907
6908         Objective-C API: Need a good way to reference event handlers without causing cycles
6909         https://bugs.webkit.org/show_bug.cgi?id=111088
6910
6911         Reviewed by Geoffrey Garen.
6912
6913         JSManagedValue is like a special kind of weak value. When you create a JSManagedValue, you can
6914         supply an Objective-C object as its "owner". As long as the Objective-C owner object remains
6915         alive and its wrapper remains accessible to the JSC garbage collector (e.g. by being marked by
6916         the global object), the reference to the JavaScript value is strong. As soon as the Objective-C
6917         owner is deallocated or its wrapper becomes inaccessible to the garbage collector, the reference
6918         becomes weak.
6919
6920         If you do not supply an owner or you use the weakValueWithValue: convenience class method, the
6921         returned JSManagedValue behaves as a normal weak reference.
6922
6923         This new class allows clients to maintain references to JavaScript values in the Objective-C
6924         heap without creating reference cycles/leaking memory.
6925
6926         * API/JSAPIWrapperObject.cpp: Added.
6927         (JSC):
6928         (JSC::::createStructure):
6929         (JSC::JSAPIWrapperObject::JSAPIWrapperObject): This is a special JSObject for the Objective-C API that knows
6930         for the purposes of garbage collection/marking that it wraps an opaque Objective-C object.
6931         (JSC::JSAPIWrapperObject::visitChildren): We add the pointer to the wrapped Objective-C object to the set of
6932         opaque roots so that the weak handle owner for JSManagedValues can find it later.
6933         * API/JSAPIWrapperObject.h: Added.
6934         (JSC):
6935         (JSAPIWrapperObject):
6936         (JSC::JSAPIWrapperObject::wrappedObject):
6937         (JSC::JSAPIWrapperObject::setWrappedObject):
6938         * API/JSBase.cpp:
6939         (JSSynchronousGarbageCollect):
6940         * API/JSBasePrivate.h:
6941         * API/JSCallbackObject.cpp:
6942         (JSC):
6943         * API/JSCallbackObject.h:
6944         (JSC::JSCallbackObject::destroy): Moved this to the header so that we don't get link errors with JSAPIWrapperObject.
6945         * API/JSContext.mm:
6946         (-[JSContext initWithVirtualMachine:]): We weren't adding manually allocated/initialized JSVirtualMachine objects to
6947         the global cache of virtual machines. The init methods handle this now rather than contextWithGlobalContextRef, since
6948         not everyone is guaranteed to use the latter.
6949         (-[JSContext initWithGlobalContextRef:]):
6950         (+[JSContext contextWithGlobalContextRef:]):
6951         * API/JSManagedValue.h: Added.
6952         * API/JSManagedValue.mm: Added.
6953         (JSManagedValueHandleOwner):
6954         (managedValueHandleOwner):
6955         (+[JSManagedValue weakValueWithValue:]):
6956         (+[JSManagedValue managedValueWithValue:owner:]):
6957         (-[JSManagedValue init]): We explicitly call the ARC entrypoints to initialize/get the weak owner field since we don't
6958         use ARC when building our framework.
6959         (-[JSManagedValue initWithValue:]):
6960         (-[JSManagedValue initWithValue:owner:]):
6961         (-[JSManagedValue dealloc]):
6962         (-[JSManagedValue value]):
6963         (-[JSManagedValue weakOwner]):
6964         (JSManagedValueHandleOwner::isReachableFromOpaqueRoots): If the Objective-C owner is still alive (i.e. loading the weak field
6965         returns non-nil) and that value was added to the set of opaque roots by the wrapper for that Objective-C owner, then the the
6966         JSObject to which the JSManagedObject refers is still alive.
6967         * API/JSObjectRef.cpp: We have to add explicit checks for the JSAPIWrapperObject, just like the other types of JSCallbackObjects.
6968         (JSObjectGetPrivate):
6969         (JSObjectSetPrivate):
6970         (JSObjectGetPrivateProperty):
6971         (JSObjectSetPrivateProperty):
6972         (JSObjectDeletePrivateProperty):
6973         * API/JSValue.mm:
6974         (objectToValueWithoutCopy):
6975         * API/JSValueRef.cpp:
6976         (JSValueIsObjectOfClass):
6977         * API/JSVirtualMachine.mm:
6978         (-[JSVirtualMachine initWithContextGroupRef:]):
6979         (+[JSVirtualMachine virtualMachineWithContextGroupRef:]):
6980         * API/JSWrapperMap.mm:
6981         (wrapperFinalize):
6982         (makeWrapper): This is our own internal version of JSObjectMake which creates JSAPIWrapperObjects, the Obj-C API
6983         version of JSCallbackObjects.
6984         (createObjectWithCustomBrand):
6985         (-[JSObjCClassInfo wrapperForObject:]):
6986         (tryUnwrapObjcObject):
6987         * API/JavaScriptCore.h:
6988         * API/tests/testapi.mm: Added new tests for the strong and weak uses of JSManagedValue in the context of an
6989         onclick handler for an Objective-C object inserted into a JSContext.
6990         (-[TextXYZ setWeakOnclick:]):
6991         (-[TextXYZ setOnclick:]):
6992         (-[TextXYZ weakOnclick]):
6993         (-[TextXYZ onclick]):
6994         (-[TextXYZ click]):
6995         * CMakeLists.txt: Various build system additions.
6996         * GNUmakefile.list.am:
6997         * JavaScriptCore.gypi:
6998         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6999         * JavaScriptCore.xcodeproj/project.pbxproj:
7000         * runtime/JSGlobalObject.cpp: Added the new canonical Structure for the JSAPIWrapperObject class.
7001         (JSC::JSGlobalObject::reset):
7002         (JSC):
7003         (JSC::JSGlobalObject::visitChildren):
7004         * runtime/JSGlobalObject.h:
7005         (JSGlobalObject):
7006         (JSC::JSGlobalObject::objcWrapperObjectStructure):
7007
7008 2013-03-06  Filip Pizlo  <fpizlo@apple.com>
7009
7010         ConvertThis should be turned into Identity based on predictions in Fixup, rather than based on proofs in ConstantFolding
7011         https://bugs.webkit.org/show_bug.cgi?id=111674
7012
7013         Reviewed by Oliver Hunt.
7014
7015         This gets rid of the speculated forms of ConvertThis in the backend, and has Fixup
7016         convert them to either Identity(Object:@child) if the child is predicted object, or
7017         Phantom(Other:@child) ; WeakJSConstant(global this object) if it's predicted Other.
7018
7019         The goal of this is to ensure that the optimization fixpoint doesn't create
7020         Identity's, since doing so requires a rerun of CSE. So far this isn't a speed-up
7021         but I'm hoping this will be a step towards reducing the need to rerun the fixpoint
7022         so as to ultimately reduce compile times.
7023
7024         * dfg/DFGAbstractState.cpp:
7025         (JSC::DFG::AbstractState::executeEffects):
7026         * dfg/DFGAssemblyHelpers.h:
7027         (AssemblyHelpers):
7028         * dfg/DFGConstantFoldingPhase.cpp:
7029         (JSC::DFG::ConstantFoldingPhase::foldConstants):
7030         * dfg/DFGFixupPhase.cpp:
7031         (JSC::DFG::FixupPhase::fixupNode):
7032         (FixupPhase):
7033         (JSC::DFG::FixupPhase::observeUseKindOnNode):
7034         (JSC::DFG::FixupPhase::setUseKindAndUnboxIfProfitable):
7035         * dfg/DFGGraph.h:
7036         (JSC::DFG::Graph::globalThisObjectFor):
7037         (Graph):
7038         * dfg/DFGNode.h:
7039         (Node):
7040         (JSC::DFG::Node::convertToIdentity):
7041         (JSC::DFG::Node::convertToWeakConstant):
7042         * dfg/DFGSpeculativeJIT32_64.cpp:
7043         (JSC::DFG::SpeculativeJIT::compile):
7044         * dfg/DFGSpeculativeJIT64.cpp:
7045         (JSC::DFG::SpeculativeJIT::compile):
7046
7047 2013-03-07  Peter Gal  <galpeter@inf.u-szeged.hu>
7048
7049         Children method in LLINT AST Not class should return [@child]
7050         https://bugs.webkit.org/show_bug.cgi?id=90740
7051
7052         Reviewed by Filip Pizlo.
7053
7054         * offlineasm/ast.rb: Fixed the return value of the children method in the Not AST class.
7055
7056 2013-03-05  Oliver Hunt  <oliver@apple.com>
7057
7058         Bring back eager resolution of function scoped variables
7059         https://bugs.webkit.org/show_bug.cgi?id=111497
7060
7061         Reviewed by Geoffrey Garen.
7062
7063         This reverts the get/put_scoped_var part of the great non-local
7064         variable resolution refactoring.  This still leaves all the lazy
7065         variable resolution logic as it's necessary for global property
7066         resolution, and i don't want to make the patch bigger than it
7067         already is.
7068
7069         * bytecode/CodeBlock.cpp:
7070         (JSC::CodeBlock::dumpBytecode):
7071         (JSC::CodeBlock::CodeBlock):
7072         * bytecode/CodeBlock.h:
7073         (CodeBlock):
7074         * bytecode/Opcode.h:
7075         (JSC):
7076         (JSC::padOpcodeName):
7077         * bytecode/UnlinkedCodeBlock.cpp:
7078         (JSC::generateFunctionCodeBlock):
7079         (JSC::UnlinkedFunctionExecutable::codeBlockFor):
7080         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
7081         * bytecode/UnlinkedCodeBlock.h:
7082         (JSC):
7083         (UnlinkedFunctionExecutable):
7084         (UnlinkedCodeBlock):
7085         (JSC::UnlinkedCodeBlock::usesGlobalObject):
7086         (JSC::UnlinkedCodeBlock::setGlobalObjectRegister):
7087         (JSC::UnlinkedCodeBlock::globalObjectRegister):
7088         * bytecompiler/BytecodeGenerator.cpp:
7089         (JSC::ResolveResult::checkValidity):
7090         (JSC::BytecodeGenerator::BytecodeGenerator):
7091         (JSC::BytecodeGenerator::emitLoadGlobalObject):
7092         (JSC):
7093         (JSC::BytecodeGenerator::resolve):
7094         (JSC::BytecodeGenerator::resolveConstDecl):
7095         (JSC::BytecodeGenerator::emitResolve):
7096         (JSC::BytecodeGenerator::emitResolveBase):
7097         (JSC::BytecodeGenerator::emitResolveBaseForPut):
7098         (JSC::BytecodeGenerator::emitResolveWithBaseForPut):
7099         (JSC::BytecodeGenerator::emitResolveWithThis):
7100         (JSC::BytecodeGenerator::emitGetStaticVar):
7101         (JSC::BytecodeGenerator::emitPutStaticVar):
7102         * bytecompiler/BytecodeGenerator.h:
7103         (JSC::ResolveResult::lexicalResolve):
7104         (JSC::ResolveResult::isStatic):
7105         (JSC::ResolveResult::depth):
7106         (JSC::ResolveResult::index):
7107         (ResolveResult):
7108         (JSC::ResolveResult::ResolveResult):
7109         (BytecodeGenerator):
7110         * bytecompiler/NodesCodegen.cpp:
7111         (JSC::ResolveNode::isPure):
7112         (JSC::FunctionCallResolveNode::emitBytecode):
7113         (JSC::PostfixNode::emitResolve):
7114         (JSC::TypeOfResolveNode::emitBytecode):
7115         (JSC::PrefixNode::emitResolve):
7116         (JSC::ReadModifyResolveNode::emitBytecode):
7117         (JSC::AssignResolveNode::emitBytecode):
7118         (JSC::ConstDeclNode::emitCodeSingle):
7119         * dfg/DFGByteCodeParser.cpp:
7120         (JSC::DFG::ByteCodeParser::parseBlock):
7121         * dfg/DFGCapabilities.cpp:
7122         (JSC::DFG::debugFail):
7123         * dfg/DFGCapabilities.h:
7124         (JSC::DFG::canCompileOpcode):
7125         (JSC::DFG::canInlineOpcode):
7126         * jit/JIT.cpp:
7127         (JSC::JIT::privateCompileMainPass):
7128         * jit/JIT.h:
7129         (JIT):
7130         * jit/JITPropertyAccess.cpp:
7131         (JSC::JIT::emit_op_get_scoped_var):
7132         (JSC):
7133         (JSC::JIT::emit_op_put_scoped_var):
7134         * jit/JITPropertyAccess32_64.cpp:
7135         (JSC::JIT::emit_op_get_scoped_var):
7136         (JSC):
7137         (JSC::JIT::emit_op_put_scoped_var):
7138         * llint/LowLevelInterpreter32_64.asm:
7139         * llint/LowLevelInterpreter64.asm:
7140         * runtime/CodeCache.cpp:
7141         (JSC::CodeCache::getCodeBlock):
7142         (JSC::CodeCache::getProgramCodeBlock):
7143         (JSC::CodeCache::getEvalCodeBlock):
7144         * runtime/CodeCache.h:
7145         (JSC):
7146         (CodeCache):
7147         * runtime/Executable.cpp:
7148         (JSC::EvalExecutable::compileInternal):
7149         (JSC::FunctionExecutable::produceCodeBlockFor):
7150         * runtime/JSGlobalObject.cpp:
7151         (JSC::JSGlobalObject::createEvalCodeBlock):
7152         * runtime/JSGlobalObject.h:
7153         (JSGlobalObject):
7154         * runtime/Options.cpp:
7155         (JSC::Options::initialize):
7156
7157 2013-03-06  Filip Pizlo  <fpizlo@apple.com>
7158
7159         Unreviewed, roll out http://trac.webkit.org/changeset/144989
7160
7161         I think we want the assertion that I removed.
7162
7163         * dfg/DFGAbstractState.cpp:
7164         (JSC::DFG::AbstractState::merge):
7165         (JSC::DFG::AbstractState::mergeVariableBetweenBlocks):
7166         * dfg/DFGAbstractState.h:
7167         (AbstractState):
7168
7169 2013-03-06  Filip Pizlo  <fpizlo@apple.com>
7170
7171         DFG::AbstractState::merge() is still more complicated than it needs to be
7172         https://bugs.webkit.org/show_bug.cgi?id=111619
7173
7174         Reviewed by Mark Hahnenberg.
7175
7176         This method is the one place where we still do some minimal amount of liveness pruning, but the style with
7177         which it is written is awkward, and it makes an assertion about variablesAtTail that will be invalidated
7178         by https://bugs.webkit.org/show_bug.cgi?id=111539.
7179
7180         * dfg/DFGAbstractState.cpp:
7181         (JSC::DFG::AbstractState::merge):
7182         (JSC::DFG::AbstractState::mergeVariableBetweenBlocks):
7183         * dfg/DFGAbstractState.h:
7184         (AbstractState):
7185
7186 2013-03-06  Filip Pizlo  <fpizlo@apple.com>
7187
7188         DFG should not run full CSE after the optimization fixpoint, since it really just wants store elimination
7189         https://bugs.webkit.org/show_bug.cgi?id=111536
7190
7191         Reviewed by Oliver Hunt and Mark Hahnenberg.
7192
7193         The fixpoint will do aggressive load elimination and pure CSE. There's no need to do it after the fixpoint.
7194         On the other hand, the fixpoint does not profit from doing store elimination (except for SetLocal/Flush).
7195         Previously we had CSE do both, and had it avoid doing some store elimination during the fixpoint by querying
7196         the fixpoint state. This changes CSE to be templated on mode - either NormalCSE or StoreElimination - so
7197         that we explicitly put it into one of those modes depending on where we call it from. The goal is to reduce
7198         time spent doing load elimination after the fixpoint, since that is just wasted cycles.
7199
7200         * dfg/DFGCSEPhase.cpp:
7201         (JSC::DFG::CSEPhase::CSEPhase):
7202         (JSC::DFG::CSEPhase::run):
7203         (JSC::DFG::CSEPhase::performNodeCSE):
7204         (JSC::DFG::CSEPhase::performBlockCSE):
7205         (JSC::DFG::performCSE):
7206         (DFG):
7207         (JSC::DFG::performStoreElimination):
7208         * dfg/DFGCSEPhase.h:
7209         (DFG):
7210         * dfg/DFGDriver.cpp:
7211         (JSC::DFG::compile):
7212
7213 2013-03-06  Andreas Kling  <akling@apple.com>
7214
7215         Pack Structure members better.
7216         <http://webkit.org/b/111593>
7217         <rdar://problem/13359200>
7218
7219         Reviewed by Mark Hahnenberg.
7220
7221         Shrink Structure by 8 bytes (now at 104 bytes) on 64-bit by packing the members better.
7222
7223         * runtime/Structure.cpp:
7224         (JSC::Structure::Structure):
7225         * runtime/Structure.h:
7226         (Structure):
7227
7228 2013-03-06  Andreas Kling  <akling@apple.com>
7229
7230         Unreviewed, fix Windows build after r144910.
7231
7232         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
7233
7234 2013-03-05  Filip Pizlo  <fpizlo@apple.com>
7235
7236         DFG should not check if nodes are shouldGenerate prior to DCE
7237         https://bugs.webkit.org/show_bug.cgi?id=111520
7238
7239         Reviewed by Geoffrey Garen.
7240
7241         All nodes are live before DCE. We don't need to check that they aren't, because they
7242         definitely will be.
7243
7244         * dfg/DFGArgumentsSimplificationPhase.cpp:
7245         (JSC::DFG::ArgumentsSimplificationPhase::run):
7246         * dfg/DFGCFAPhase.cpp:
7247         (JSC::DFG::CFAPhase::performBlockCFA):
7248         * dfg/DFGCFGSimplificationPhase.cpp:
7249         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
7250         * dfg/DFGCSEPhase.cpp:
7251         (JSC::DFG::CSEPhase::pureCSE):
7252         (JSC::DFG::CSEPhase::int32ToDoubleCSE):
7253         (JSC::DFG::CSEPhase::constantCSE):
7254         (JSC::DFG::CSEPhase::weakConstantCSE):
7255         (JSC::DFG::CSEPhase::getCalleeLoadElimination):
7256         (JSC::DFG::CSEPhase::getArrayLengthElimination):
7257         (JSC::DFG::CSEPhase::globalVarLoadElimination):
7258         (JSC::DFG::CSEPhase::scopedVarLoadElimination):
7259         (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
7260         (JSC::DFG::CSEPhase::globalVarStoreElimination):
7261         (JSC::DFG::CSEPhase::scopedVarStoreElimination):
7262         (JSC::DFG::CSEPhase::getByValLoadElimination):
7263         (JSC::DFG::CSEPhase::checkStructureElimination):
7264         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
7265         (JSC::DFG::CSEPhase::putStructureStoreElimination):
7266         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
7267         (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
7268         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
7269         (JSC::DFG::CSEPhase::checkArrayElimination):
7270         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
7271         (JSC::DFG::CSEPhase::getMyScopeLoadElimination):
7272         (JSC::DFG::CSEPhase::getLocalLoadElimination):
7273         (JSC::DFG::CSEPhase::setLocalStoreElimination):
7274         (JSC::DFG::CSEPhase::performNodeCSE):
7275         * dfg/DFGFixupPhase.cpp:
7276         (JSC::DFG::FixupPhase::fixupNode):
7277         (JSC::DFG::FixupPhase::fixupSetLocalsInBlock):
7278         * dfg/DFGPredictionPropagationPhase.cpp:
7279         (JSC::DFG::PredictionPropagationPhase::propagate):
7280         * dfg/DFGStructureCheckHoistingPhase.cpp:
7281         (JSC::DFG::StructureCheckHoistingPhase::run):
7282
7283 2013-03-06  Csaba Osztrogonác  <ossy@webkit.org>
7284
7285         Fix unused parameter warnings in ARM assembler
7286         https://bugs.webkit.org/show_bug.cgi?id=111433
7287
7288         Reviewed by Kentaro Hara.
7289
7290         * assembler/ARMAssembler.h: Remove unreachable revertJump() after r143346.
7291         * assembler/MacroAssemblerARM.h:
7292         (JSC::MacroAssemblerARM::moveIntsToDouble): Remove unused scratch parameter instead of UNUSED_PARAM.
7293         (JSC::MacroAssemblerARM::branchConvertDoubleToInt32): Remove unused fpTemp parameter.
7294         (JSC::MacroAssemblerARM::revertJumpReplacementToPatchableBranchPtrWithPatch): Remove unused parameters.
7295
7296 2013-03-06  Andreas Kling  <akling@apple.com>
7297
7298         Unused Structure property tables waste 14MB on Membuster.
7299         <http://webkit.org/b/110854>
7300         <rdar://problem/13292104>
7301
7302         Reviewed by Geoffrey Garen.
7303
7304         Turn PropertyTable into a GC object and have Structure drop unpinned tables when marking.
7305         14 MB progression on Membuster3.
7306
7307         This time it should stick; I've been through all the tests with COLLECT_ON_EVERY_ALLOCATION.
7308         The issue with the last version was that Structure::m_offset could be used uninitialized
7309         when re-materializing a previously GC'd property table, causing some sanity checks to fail.
7310
7311         * CMakeLists.txt:
7312         * GNUmakefile.list.am:
7313         * JavaScriptCore.gypi:
7314         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
7315         * JavaScriptCore.xcodeproj/project.pbxproj:
7316         * Target.pri:
7317
7318             Added PropertyTable.cpp.
7319
7320         * runtime/PropertyTable.cpp: Added.
7321         (JSC::PropertyTable::create):
7322         (JSC::PropertyTable::clone):
7323         (JSC::PropertyTable::PropertyTable):
7324         (JSC::PropertyTable::destroy):
7325         (JSC::PropertyTable::~PropertyTable):
7326         (JSC::PropertyTable::visitChildren):
7327
7328             Moved marking of property table values here from Structure::visitChildren().
7329
7330         * runtime/WriteBarrier.h:
7331         (JSC::WriteBarrierBase::get):
7332
7333             Move m_cell to a local before using it multiple times. This avoids a multiple-access race when
7334             Structure::checkOffsetConsistency() is used in assertions on the main thread while a marking thread
7335             zaps the property table.
7336
7337         * runtime/Structure.h:
7338         (JSC::Structure::materializePropertyMapIfNecessary):
7339         (JSC::Structure::materializePropertyMapIfNecessaryForPinning):
7340         * runtime/StructureInlines.h:
7341         (JSC::Structure::propertyTable):
7342
7343             Added a getter for the Structure's PropertyTable that ASSERTs GC currently isn't active.
7344             Because GC can zap an unpinned property table at any time, it's not entirely safe to access it.
7345             Renamed the variable itself to m_propertyTableUnsafe to force call sites into explaining themselves.
7346
7347         (JSC::Structure::putWillGrowOutOfLineStorage):
7348         (JSC::Structure::checkOffsetConsistency):
7349
7350             Moved these out of Structure.h to break header dependency cycle between Structure/PropertyTable.
7351
7352         * runtime/Structure.cpp:
7353         (JSC::Structure::visitChildren):
7354
7355             Null out m_propertyTable if the table is unpinned. This'll cause the table to get GC'd.
7356
7357         (JSC::Structure::takePropertyTableOrCloneIfPinned):
7358
7359             Added for setting up the property table in a new transition, this code is now shared between
7360             addPropertyTransition() and nonPropertyTransition().
7361
7362         * runtime/JSGlobalData.h:
7363         * runtime/JSGlobalData.cpp:
7364         (JSC::JSGlobalData::JSGlobalData):
7365
7366             Add a global propertyTableStructure.
7367
7368         * runtime/PropertyMapHashTable.h:
7369         (PropertyTable):
7370         (JSC::PropertyTable::createStructure):
7371         (JSC::PropertyTable::copy):
7372
7373             Make PropertyTable a GC object.
7374
7375         * runtime/Structure.cpp:
7376         (JSC::Structure::dumpStatistics):
7377         (JSC::Structure::materializePropertyMap):
7378         (JSC::Structure::despecifyDictionaryFunction):
7379         (JSC::Structure::addPropertyTransition):
7380         (JSC::Structure::changePrototypeTransition):
7381         (JSC::Structure::despecifyFunctionTransition):
7382         (JSC::Structure::attributeChangeTransition):
7383         (JSC::Structure::toDictionaryTransition):
7384         (JSC::Structure::sealTransition):
7385         (JSC::Structure::freezeTransition):
7386         (JSC::Structure::preventExtensionsTransition):
7387         (JSC::Structure::nonPropertyTransition):
7388         (JSC::Structure::isSealed):
7389         (JSC::Structure::isFrozen):
7390         (JSC::Structure::flattenDictionaryStructure):
7391         (JSC::Structure::pin):
7392         (JSC::Structure::copyPropertyTable):
7393         (JSC::Structure::copyPropertyTableForPinning):
7394         (JSC::Structure::get):
7395         (JSC::Structure::despecifyFunction):
7396         (JSC::Structure::despecifyAllFunctions):
7397         (JSC::Structure::putSpecificValue):
7398         (JSC::Structure::remove):
7399         (JSC::Structure::createPropertyMap):
7400         (JSC::Structure::getPropertyNamesFromStructure):
7401         (JSC::Structure::checkConsistency):
7402
7403 2013-03-05  Filip Pizlo  <fpizlo@apple.com>
7404
7405         Get rid of the invert argument to SpeculativeJIT::jumpSlowForUnwantedArrayMode
7406         https://bugs.webkit.org/show_bug.cgi?id=105624
7407
7408         Reviewed by Oliver Hunt.
7409
7410         All callers pass invert = false, which is the default value of the argument. So, get
7411         rid of the argument and fold away all code that checks it.
7412
7413         * dfg/DFGSpeculativeJIT.cpp:
7414         (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
7415         * dfg/DFGSpeculativeJIT.h:
7416         (SpeculativeJIT):
7417
7418 2013-03-05  Filip Pizlo  <fpizlo@apple.com>
7419
7420         Unreviewed, fix an incorrect comment. The comment was a holdover from a work-in-progress version of this code.
7421
7422         * dfg/DFGDCEPhase.cpp:
7423         (JSC::DFG::DCEPhase::run):
7424
7425 2013-03-04  Filip Pizlo  <fpizlo@apple.com>
7426
7427         DFG DCE might eliminate checks unsoundly
7428         https://bugs.webkit.org/show_bug.cgi?id=109389
7429
7430         Reviewed by Oliver Hunt.
7431
7432         This gets rid of all eager reference counting, and does all dead code elimination
7433         in one phase - the DCEPhase. This phase also sets up the node reference counts,
7434         which are then used not just for DCE but also register allocation and stack slot
7435         allocation.
7436
7437         Doing this required a number of surgical changes in places that previously relied
7438         on always having liveness information. For example, the structure check hoisting
7439         phase must now consult whether a VariableAccessData is profitable for unboxing to
7440         make sure that it doesn't try to do hoisting on set SetLocals. The arguments
7441         simplification phase employs its own light-weight liveness analysis. Both phases
7442         previously just used reference counts.
7443
7444         The largest change is that now, dead nodes get turned into Phantoms. Those
7445         Phantoms will retain those child edges that are not proven. This ensures that any
7446         type checks performed by a dead node remain even after the node is killed. On the
7447         other hand, this Phantom conversion means that we need special handling for
7448         SetLocal. I decided to make the four forms of SetLocal explicit:
7449
7450         MovHint(@a, rK): Just indicates that node @a contains the value that would have
7451              now been placed into virtual register rK. Does not actually cause @a to be
7452              stored into rK. This would have previously been a dead SetLocal with @a
7453              being live. MovHints are always dead.
7454
7455         ZombieHint(rK): Indicates that at this point, register rK will contain a dead
7456              value and OSR should put Undefined into it. This would have previously been
7457              a dead SetLocal with @a being dead also. ZombieHints are always dead.
7458
7459         MovHintAndCheck(@a, rK): Identical to MovHint except @a is also type checked,
7460              according to whatever UseKind the edge to @a has. The type check is always a
7461              forward exit. MovHintAndChecks are always live, since they are
7462              NodeMustGenerate. Previously this would have been a dead SetLocal with a
7463              live @a, and the check would have disappeared. This is one of the bugs that
7464              this patch solves.
7465
7466         SetLocal(@a, rK): This still does exactly what it does now, if the SetLocal is
7467              live.
7468
7469         Basically this patch makes it so that dead SetLocals eventually decay to MovHint,
7470         ZombieHint, or MovHintAndCheck depending on the situation. If the child @a is
7471         also dead, then you get a ZombieHint. If the child @a is live but the SetLocal
7472         has a type check and @a's type hasn't been proven to have that type then you get
7473         a MovHintAndCheck. Otherwise you get a MovHint.
7474
7475         This is performance neutral.
7476
7477         * CMakeLists.txt:
7478         * GNUmakefile.list.am:
7479         * JavaScriptCore.xcodeproj/project.pbxproj:
7480         * Target.pri:
7481         * dfg/DFGAbstractState.cpp:
7482         (JSC::DFG::AbstractState::executeEffects):
7483         (JSC::DFG::AbstractState::mergeStateAtTail):
7484         * dfg/DFGArgumentsSimplificationPhase.cpp:
7485         (JSC::DFG::ArgumentsSimplificationPhase::run):
7486         (ArgumentsSimplificationPhase):
7487         (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
7488         * dfg/DFGBasicBlock.h:
7489         (BasicBlock):
7490         * dfg/DFGBasicBlockInlines.h:
7491         (DFG):
7492         * dfg/DFGByteCodeParser.cpp:
7493         (JSC::DFG::ByteCodeParser::addToGraph):
7494         (JSC::DFG::ByteCodeParser::insertPhiNode):
7495         (JSC::DFG::ByteCodeParser::emitFunctionChecks):
7496         * dfg/DFGCFAPhase.cpp:
7497         (JSC::DFG::CFAPhase::run):
7498         * dfg/DFGCFGSimplificationPhase.cpp:
7499         (JSC::DFG::CFGSimplificationPhase::run):
7500         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
7501         * dfg/DFGCPSRethreadingPhase.cpp:
7502         (JSC::DFG::CPSRethreadingPhase::run):
7503         (JSC::DFG::CPSRethreadingPhase::addPhiSilently):
7504         * dfg/DFGCSEPhase.cpp:
7505         (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
7506         (JSC::DFG::CSEPhase::setReplacement):
7507         (JSC::DFG::CSEPhase::performNodeCSE):
7508         * dfg/DFGCommon.cpp:
7509         (WTF::printInternal):
7510         (WTF):
7511         * dfg/DFGCommon.h:
7512         (WTF):
7513         * dfg/DFGConstantFoldingPhase.cpp:
7514         (JSC::DFG::ConstantFoldingPhase::foldConstants):
7515         (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
7516         (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
7517         * dfg/DFGDCEPhase.cpp: Added.
7518         (DFG):
7519         (DCEPhase):
7520         (JSC::DFG::DCEPhase::DCEPhase):
7521         (JSC::DFG::DCEPhase::run):
7522         (JSC::DFG::DCEPhase::findTypeCheckRoot):
7523         (JSC::DFG::DCEPhase::countEdge):
7524         (JSC::DFG::DCEPhase::eliminateIrrelevantPhantomChildren):
7525         (JSC::DFG::performDCE):
7526         * dfg/DFGDCEPhase.h: Added.
7527         (DFG):
7528         * dfg/DFGDriver.cpp:
7529         (JSC::DFG::compile):
7530         * dfg/DFGFixupPhase.cpp:
7531         (JSC::DFG::FixupPhase::fixupNode):
7532         (JSC::DFG::FixupPhase::checkArray):
7533         (JSC::DFG::FixupPhase::blessArrayOperation):
7534         (JSC::DFG::FixupPhase::fixIntEdge):
7535         (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
7536         (JSC::DFG::FixupPhase::truncateConstantToInt32):
7537         * dfg/DFGGraph.cpp:
7538         (JSC::DFG::Graph::Graph):
7539         (JSC::DFG::Graph::dump):
7540         (DFG):
7541         * dfg/DFGGraph.h:
7542         (JSC::DFG::Graph::changeChild):
7543         (JSC::DFG::Graph::changeEdge):
7544         (JSC::DFG::Graph::compareAndSwap):
7545         (JSC::DFG::Graph::clearAndDerefChild):
7546         (JSC::DFG::Graph::performSubstitution):
7547         (JSC::DFG::Graph::performSubstitutionForEdge):
7548         (Graph):
7549         (JSC::DFG::Graph::substitute):
7550         * dfg/DFGInsertionSet.h:
7551         (InsertionSet):
7552         * dfg/DFGNode.h:
7553         (JSC::DFG::Node::Node):
7554         (JSC::DFG::Node::convertToConstant):
7555         (JSC::DFG::Node::convertToGetLocalUnlinked):
7556         (JSC::DFG::Node::containsMovHint):
7557         (Node):
7558         (JSC::DFG::Node::hasVariableAccessData):
7559         (JSC::DFG::Node::willHaveCodeGenOrOSR):
7560         * dfg/DFGNodeType.h:
7561         (DFG):
7562         * dfg/DFGPredictionPropagationPhase.cpp:
7563         (JSC::DFG::PredictionPropagationPhase::propagate):
7564         * dfg/DFGSpeculativeJIT.cpp:
7565         (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
7566         (JSC::DFG::SpeculativeJIT::compileMovHint):
7567         (JSC::DFG::SpeculativeJIT::compileMovHintAndCheck):
7568         (DFG):
7569         (JSC::DFG::SpeculativeJIT::compileInlineStart):
7570         (JSC::DFG::SpeculativeJIT::compile):
7571         * dfg/DFGSpeculativeJIT.h:
7572         (SpeculativeJIT):
7573         * dfg/DFGSpeculativeJIT32_64.cpp:
7574         (JSC::DFG::SpeculativeJIT::compile):
7575         * dfg/DFGSpeculativeJIT64.cpp:
7576         (JSC::DFG::SpeculativeJIT::compile):
7577         * dfg/DFGStructureCheckHoistingPhase.cpp:
7578         (JSC::DFG::StructureCheckHoistingPhase::run):
7579         (JSC::DFG::StructureCheckHoistingPhase::shouldConsiderForHoisting):
7580         (StructureCheckHoistingPhase):
7581         * dfg/DFGValidate.cpp:
7582         (JSC::DFG::Validate::validate):
7583
7584 2013-03-05  Mark Hahnenberg  <mhahnenberg@apple.com>
7585
7586         Objective-C API: JSValue should implement init and return nil in exceptional cases
7587         https://bugs.webkit.org/show_bug.cgi?id=111487
7588
7589         Reviewed by Darin Adler.
7590
7591         * API/JSValue.mm:
7592         (-[JSValue init]): We return nil here because there is no way to get the instance into a coherent state
7593         without a JSContext.
7594         (-[JSValue initWithValue:inContext:]): Similarly, we should also return nil here if either of the arguments is 0.
7595
7596 2013-03-05  Sheriff Bot  <webkit.review.bot@gmail.com>
7597
7598         Unreviewed, rolling out r144708.
7599         http://trac.webkit.org/changeset/144708
7600         https://bugs.webkit.org/show_bug.cgi?id=111447
7601
7602         random assertion crashes in inspector tests on qt+mac bots
7603         (Requested by kling on #webkit).
7604
7605         * CMakeLists.txt:
7606         * GNUmakefile.list.am:
7607         * JavaScriptCore.gypi:
7608         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
7609         * JavaScriptCore.xcodeproj/project.pbxproj:
7610         * Target.pri:
7611         * runtime/JSGlobalData.cpp:
7612         (JSC::JSGlobalData::JSGlobalData):
7613         * runtime/JSGlobalData.h:
7614         (JSGlobalData):
7615         * runtime/PropertyMapHashTable.h:
7616         (PropertyTable):
7617         (JSC::PropertyTable::PropertyTable):
7618         (JSC):
7619         (JSC::PropertyTable::~PropertyTable):
7620         (JSC::PropertyTable::copy):
7621         * runtime/PropertyTable.cpp: Removed.
7622         * runtime/Structure.cpp:
7623         (JSC::Structure::dumpStatistics):
7624         (JSC::Structure::materializePropertyMap):
7625         (JSC::Structure::despecifyDictionaryFunction):
7626         (JSC::Structure::addPropertyTransition):
7627         (JSC::Structure::changePrototypeTransition):
7628         (JSC::Structure::despecifyFunctionTransition):
7629         (JSC::Structure::attributeChangeTransition):
7630         (JSC::Structure::toDictionaryTransition):
7631         (JSC::Structure::sealTransition):
7632         (JSC::Structure::freezeTransition):
7633         (JSC::Structure::preventExtensionsTransition):
7634         (JSC::Structure::nonPropertyTransition):
7635         (JSC::Structure::isSealed):
7636         (JSC::Structure::isFrozen):
7637         (JSC::Structure::flattenDictionaryStructure):
7638         (JSC::Structure::pin):
7639         (JSC::Structure::copyPropertyTable):
7640         (JSC::Structure::copyPropertyTableForPinning):
7641         (JSC::Structure::get):
7642         (JSC::Structure::despecifyFunction):
7643         (JSC::Structure::despecifyAllFunctions):
7644         (JSC::Structure::putSpecificValue):
7645         (JSC::Structure::remove):
7646         (JSC::Structure::createPropertyMap):
7647         (JSC::Structure::getPropertyNamesFromStructure):
7648         (JSC::Structure::visitChildren):
7649         (JSC::Structure::checkConsistency):
7650         * runtime/Structure.h:
7651         (JSC):
7652         (JSC::Structure::putWillGrowOutOfLineStorage):
7653         (JSC::Structure::materializePropertyMapIfNecessary):
7654         (JSC::Structure::materializePropertyMapIfNecessaryForPinning):
7655         (JSC::Structure::checkOffsetConsistency):
7656         (Structure):
7657         * runtime/StructureInlines.h:
7658         (JSC::Structure::get):
7659         * runtime/WriteBarrier.h:
7660         (JSC::WriteBarrierBase::get):
7661
7662 2013-03-05  David Kilzer  <ddkilzer@apple.com>
7663
7664         BUILD FIX (r144698): Only enable SPEECH_SYNTHESIS for Mac
7665         <http://webkit.org/b/106742>
7666
7667         Fixes the following build failures:
7668
7669             Undefined symbols for architecture i386:
7670               "__ZTVN7WebCore25PlatformSpeechSynthesizerE", referenced from:
7671                   __ZN7WebCore25PlatformSpeechSynthesizerC2EPNS_31PlatformSpeechSynthesizerClientE in PlatformSpeechSynthesizer.o
7672               NOTE: a missing vtable usually means the first non-inline virtual member function has no definition.
7673               "__ZN7WebCore25PlatformSpeechSynthesizer19initializeVoiceListEv", referenced from:
7674                   __ZN7WebCore25PlatformSpeechSynthesizerC2EPNS_31PlatformSpeechSynthesizerClientE in PlatformSpeechSynthesizer.o
7675             ld: symbol(s) not found for architecture i386
7676
7677         * Configurations/FeatureDefines.xcconfig:
7678         - Fix definition of ENABLE_ENCRYPTED_MEDIA_V2_macosx to match
7679           other FeatureDefines.xcconfig files.
7680         - Only set ENABLE_SPEECH_SYNTHESIS for the macosx platform.
7681
7682 2013-03-04  Andreas Kling  <akling@apple.com>
7683
7684         Unused Structure property tables waste 14MB on Membuster.
7685         <http://webkit.org/b/110854>
7686         <rdar://problem/13292104>
7687
7688         Reviewed by Geoffrey Garen.
7689
7690         Turn PropertyTable into a GC object and have Structure drop unpinned tables when marking.
7691         14 MB progression on Membuster3.
7692
7693         * CMakeLists.txt:
7694         * GNUmakefile.list.am:
7695         * JavaScriptCore.gypi:
7696         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
7697         * JavaScriptCore.xcodeproj/project.pbxproj:
7698         * Target.pri:
7699
7700             Added PropertyTable.cpp.
7701
7702         * runtime/PropertyTable.cpp: Added.
7703         (JSC::PropertyTable::create):
7704         (JSC::PropertyTable::clone):
7705         (JSC::PropertyTable::PropertyTable):
7706         (JSC::PropertyTable::destroy):
7707         (JSC::PropertyTable::~PropertyTable):
7708         (JSC::PropertyTable::visitChildren):
7709
7710             Moved marking of property table values here from Structure::visitChildren().
7711
7712         * runtime/WriteBarrier.h:
7713         (JSC::WriteBarrierBase::get):
7714
7715             Move m_cell to a local before using it multiple times. This avoids a multiple-access race when
7716             Structure::checkOffsetConsistency() is used in assertions on the main thread while a marking thread
7717             zaps the property table.
7718
7719         * runtime/Structure.h:
7720         (JSC::Structure::materializePropertyMapIfNecessary):
7721         (JSC::Structure::materializePropertyMapIfNecessaryForPinning):
7722         * runtime/StructureInlines.h:
7723         (JSC::Structure::propertyTable):
7724
7725             Added a getter for the Structure's PropertyTable that ASSERTs GC currently isn't active.
7726             Because GC can zap an unpinned property table at any time, it's not entirely safe to access it.
7727             Renamed the variable itself to m_propertyTableUnsafe to force call sites into explaining themselves.
7728
7729         (JSC::Structure::putWillGrowOutOfLineStorage):
7730         (JSC::Structure::checkOffsetConsistency):
7731
7732             Moved these out of Structure.h to break header dependency cycle between Structure/PropertyTable.
7733
7734         * runtime/Structure.cpp:
7735         (JSC::Structure::visitChildren):
7736
7737             Null out m_propertyTable if the table is unpinned. This'll cause the table to get GC'd.
7738
7739         * runtime/JSGlobalData.h:
7740         * runtime/JSGlobalData.cpp:
7741         (JSC::JSGlobalData::JSGlobalData):
7742
7743             Add a global propertyTableStructure.
7744
7745         * runtime/PropertyMapHashTable.h:
7746         (PropertyTable):
7747         (JSC::PropertyTable::createStructure):
7748         (JSC::PropertyTable::copy):
7749
7750             Make PropertyTable a GC object.
7751
7752         * runtime/Structure.cpp:
7753         (JSC::Structure::dumpStatistics):
7754         (JSC::Structure::materializePropertyMap):
7755         (JSC::Structure::despecifyDictionaryFunction):
7756         (JSC::Structure::addPropertyTransition):
7757         (JSC::Structure::changePrototypeTransition):
7758         (JSC::Structure::despecifyFunctionTransition):
7759         (JSC::Structure::attributeChangeTransition):
7760         (JSC::Structure::toDictionaryTransition):
7761         (JSC::Structure::sealTransition):
7762         (JSC::Structure::freezeTransition):
7763         (JSC::Structure::preventExtensionsTransition):
7764         (JSC::Structure::nonPropertyTransition):
7765         (JSC::Structure::isSealed):
7766         (JSC::Structure::isFrozen):
7767         (JSC::Structure::flattenDictionaryStructure):
7768         (JSC::Structure::pin):
7769         (JSC::Structure::copyPropertyTable):
7770         (JSC::Structure::copyPropertyTableForPinning):
7771         (JSC::Structure::get):
7772         (JSC::Structure::despecifyFunction):
7773         (JSC::Structure::despecifyAllFunctions):
7774         (JSC::Structure::putSpecificValue):
7775         (JSC::Structure::remove):
7776         (JSC::Structure::createPropertyMap):
7777         (JSC::Structure::getPropertyNamesFromStructure):
7778         (JSC::Structure::checkConsistency):
7779
7780 2013-03-04  Chris Fleizach  <cfleizach@apple.com>
7781
7782         Support WebSpeech - Speech Synthesis
7783         https://bugs.webkit.org/show_bug.cgi?id=106742
7784
7785         Reviewed by Simon Fraser.
7786
7787         Enable speech synthesis for the Mac.
7788
7789         * Configurations/FeatureDefines.xcconfig:
7790
7791 2013-03-04  Mark Hahnenberg  <mhahnenberg@apple.com>
7792
7793         Remove contextInternalContext from JSContextInternal.h
7794         https://bugs.webkit.org/show_bug.cgi?id=111356
7795
7796         Reviewed by Geoffrey Garen.
7797
7798         We don't need it any more since we have globalContextRef in JSContext.
7799
7800         * API/JSContext.mm:
7801         * API/JSContextInternal.h:
7802         * API/JSValue.mm:
7803         (+[JSValue valueWithBool:inContext:]):
7804         (+[JSValue valueWithDouble:inContext:]):
7805         (+[JSValue valueWithInt32:inContext:]):
7806         (+[JSValue valueWithUInt32:inContext:]):
7807         (+[JSValue valueWithNewObjectInContext:]):
7808         (+[JSValue valueWithNewArrayInContext:]):
7809         (+[JSValue valueWithNewRegularExpressionFromPattern:flags:inContext:]):
7810         (+[JSValue valueWithNewErrorFromMessage:inContext:]):
7811         (+[JSValue valueWithNullInContext:]):
7812         (+[JSValue valueWithUndefinedInContext:]):
7813         (-[JSValue toBool]):
7814         (-[JSValue toDouble]):
7815         (-[JSValue toNumber]):
7816         (-[JSValue toString]):
7817         (-[JSValue toDate]):
7818         (-[JSValue toArray]):
7819         (-[JSValue toDictionary]):
7820         (-[JSValue valueForProperty:]):
7821         (-[JSValue setValue:forProperty:]):
7822         (-[JSValue deleteProperty:]):
7823         (-[JSValue hasProperty:]):
7824         (-[JSValue valueAtIndex:]):
7825         (-[JSValue setValue:atIndex:]):
7826         (-[JSValue isUndefined]):
7827         (-[JSValue isNull]):
7828         (-[JSValue isBoolean]):
7829         (-[JSValue isNumber]):
7830         (-[JSValue isString]):
7831         (-[JSValue isObject]):
7832         (-[JSValue isEqualToObject:]):
7833         (-[JSValue isEqualWithTypeCoercionToObject:]):
7834         (-[JSValue isInstanceOf:]):
7835         (-[JSValue callWithArguments:]):
7836         (-[JSValue constructWithArguments:]):
7837         (-[JSValue invokeMethod:withArguments:]):
7838         (valueToObject):
7839         (objectToValueWithoutCopy):
7840         (objectToValue):
7841         (-[JSValue initWithValue:inContext:]):
7842         (-[JSValue dealloc]):
7843         (-[JSValue description]):
7844         * API/JSWrapperMap.mm:
7845         (createObjectWithCustomBrand):
7846         (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]):
7847         (-[JSObjCClassInfo wrapperForObject:]):
7848         (-[JSWrapperMap jsWrapperForObject:]):
7849         * API/ObjCCallbackFunction.mm:
7850         (ObjCCallbackFunction::call):
7851         (objCCallbackFunctionForInvocation):
7852
7853 2013-03-04  Andreas Kling  <akling@apple.com>
7854
7855         Add simple vector traits for JSC::Identifier.
7856         <http://webkit.org/b/111323>
7857
7858         Reviewed by Geoffrey Garen.
7859
7860         Identifiers are really just Strings, giving them simple vector traits makes
7861         Vector move them with memcpy() instead of churning the refcounts.
7862
7863         * runtime/Identifier.h:
7864         (WTF):
7865
7866 2013-03-04  Kunihiko Sakamoto  <ksakamoto@chromium.org>
7867
7868         Add build flag for FontLoader
7869         https://bugs.webkit.org/show_bug.cgi?id=111289
7870
7871         Reviewed by Benjamin Poulain.
7872
7873         Add ENABLE_FONT_LOAD_EVENTS build flag (disabled by default).
7874
7875         * Configurations/FeatureDefines.xcconfig:
7876
7877 2013-03-03  Andreas Kling  <akling@apple.com>
7878
7879         Shrink JSC::HashTable entries.
7880         <http://webkit.org/b/111275>
7881         <rdar://problem/13333511>
7882
7883         Reviewed by Anders Carlsson.
7884
7885         Move the Intrinsic value out of the function-specific part of the union,
7886         and store it next to m_attributes. Reduces the size of HashEntry by 8 bytes.
7887
7888         990 kB progression on Membuster3. (PTUS: 797 kB)
7889
7890         * runtime/Lookup.h:
7891         (JSC::HashEntry::initialize):
7892         (JSC::HashEntry::intrinsic):
7893         (HashEntry):
7894
7895 2013-03-01  David Kilzer  <ddkilzer@apple.com>
7896
7897         BUILD FIX: testapi should link to Foundation, not CoreFoundation
7898
7899         * JavaScriptCore.xcodeproj/project.pbxproj: Change testapi to
7900         link to Foundation.framework instead of CoreFoundation.framework
7901         since it uses NS types.
7902
7903 2013-03-01  Mark Hahnenberg  <mhahnenberg@apple.com>
7904
7905         Objective-C API: Passing JS functions to Objective-C callbacks causes JSValue to leak
7906         https://bugs.webkit.org/show_bug.cgi?id=107836
7907
7908         Reviewed by Oliver Hunt.
7909
7910         We've decided to remove support for this feature from the API because there's no way to automatically manage
7911         the memory for clients in a satisfactory manner. Clients can still pass JS functions to Objective-C methods,
7912         but the methods must accept plain JSValues instead of Objective-C blocks.
7913
7914         We now ignore functions that are part of a protocol that inherits from JSExport that accept blocks as arguments.
7915
7916         * API/JSBlockAdaptor.h: Removed.
7917         * API/JSBlockAdaptor.mm: Removed.
7918         * API/ObjCCallbackFunction.mm:
7919         (ArgumentTypeDelegate::typeBlock): Return nil to signal that we want to ignore this function when copying it
7920         to the object from the protocol.
7921         * API/tests/testapi.mm: Added a test to make sure that we ignore methods declared as part of a JSExport-ed protocol
7922         that have block arguments.
7923         (-[TestObject bogusCallback:]):
7924         * JavaScriptCore.gypi: Updated build files.
7925         * JavaScriptCore.xcodeproj/project.pbxproj:
7926
7927 2013-03-01  Filip Pizlo  <fpizlo@apple.com>
7928
7929         DFG Branch(LogicalNot) peephole should not try to optimize and work-around the case where LogicalNot may be otherwise live
7930         https://bugs.webkit.org/show_bug.cgi?id=111209
7931
7932         Reviewed by Oliver Hunt.
7933
7934         Even if it is then everything will work just fine. It's not necessary to check the ref count here.
7935
7936         * dfg/DFGFixupPhase.cpp:
7937         (JSC::DFG::FixupPhase::fixupNode):
7938
7939 2013-03-01  Filip Pizlo  <fpizlo@apple.com>
7940
7941         DFG CSE phase shouldn't rely on ref count of nodes, since it doesn't have to
7942         https://bugs.webkit.org/show_bug.cgi?id=111205
7943
7944         Reviewed by Oliver Hunt.
7945
7946         I don't understand the intuition behind setLocalStoreElimination() validating that the SetLocal's ref count
7947         is 1. I believe this is a hold-over from when setLocalStoreElimination() would match one SetLocal to another,
7948         and then try to eliminate the first SetLocal. But that's not how it works now. Now, setLocalStoreElimination()
7949         is actually Flush elimination: it eliminates any Flush that anchors a SetLocal if it proves that every path
7950         from the SetLocal to the Flush is devoid of operations that may observe the local. It doesn't actually kill
7951         the SetLocal itself: if the SetLocal is live because of other things (other Flushes or GetLocals in other
7952         basic blocks), then the SetLocal will naturally still be alive because th Flush was only keeping the SetLocal
7953         alive by one count rather than being solely responsible for its liveness.
7954
7955         * dfg/DFGCSEPhase.cpp:
7956         (JSC::DFG::CSEPhase::setLocalStoreElimination):
7957         (JSC::DFG::CSEPhase::eliminate):
7958         (JSC::DFG::CSEPhase::performNodeCSE):
7959
7960 2013-03-01  Filip Pizlo  <fpizlo@apple.com>
7961
7962         Rename MovHint to MovHintEvent so I can create a NodeType called MovHint
7963
7964         Rubber stamped by Mark Hahnenberg.
7965
7966         This is similar to the SetLocal/SetLocalEvent naming scheme, where SetLocal is the
7967         NodeType and SetLocalEvent is the VariableEventKind.
7968
7969         * dfg/DFGVariableEvent.cpp:
7970         (JSC::DFG::VariableEvent::dump):
7971         * dfg/DFGVariableEvent.h:
7972         (JSC::DFG::VariableEvent::movHint):
7973         (JSC::DFG::VariableEvent::id):
7974         (JSC::DFG::VariableEvent::operand):
7975         (VariableEvent):
7976         * dfg/DFGVariableEventStream.cpp:
7977         (JSC::DFG::VariableEventStream::reconstruct):
7978
7979 2013-03-01  Raphael Kubo da Costa  <raphael.kubo.da.costa@intel.com>
7980
7981         [JSC] Fix sign comparison warning/error after r144340.
7982         https://bugs.webkit.org/show_bug.cgi?id=111164
7983
7984         Reviewed by Mark Hahnenberg.
7985
7986         gcc (both 4.2.1 and 4.7.2) complain about comparing signed and
7987         unsigned terms (clang accepts it just fine).
7988
7989         Work around that by casting the 1 to an uintptr_t as well.
7990
7991         * dfg/DFGEdge.h:
7992         (JSC::DFG::Edge::makeWord):
7993
7994 2013-02-28  Filip Pizlo  <fpizlo@apple.com>
7995
7996         DFG CFA should not do liveness pruning
7997         https://bugs.webkit.org/show_bug.cgi?id=111119
7998
7999         Reviewed by Mark Hahnenberg.
8000
8001         It adds complexity and probably buys nothing.  Moreover, I'm transitioning to having
8002         liveness only available at the bitter end of compilation, so this will stop working
8003         after https://bugs.webkit.org/show_bug.cgi?id=109389 anyway.
8004
8005         * dfg/DFGAbstractState.cpp:
8006         (JSC::DFG::AbstractState::initialize):
8007         (JSC::DFG::AbstractState::mergeStateAtTail):
8008
8009 2013-02-28  Filip Pizlo  <fpizlo@apple.com>
8010
8011         Don't try to emit profiling if you don't have the DFG JIT.
8012
8013         Rubber stamped by Mark Hahnenberg.
8014
8015         * jit/JIT.h:
8016         (JSC::JIT::shouldEmitProfiling):
8017
8018 2013-02-28  Filip Pizlo  <fpizlo@apple.com>
8019
8020         DFG Phantom node should be honest about the fact that it can exit
8021         https://bugs.webkit.org/show_bug.cgi?id=111115
8022
8023         Reviewed by Mark Hahnenberg.
8024
8025         The chances of this having cause serious issues are low, since most clients of the
8026         NodeDoesNotExit flag run after CFA and CFA updates this properly. But one possible
8027         case of badness is if the ByteCodeParser inserted a Phantom with a type check in
8028         between a LogicalNot and a Branch; then that peephole optimization in Fixup might
8029         go slightly wrong.
8030
8031         * dfg/DFGNodeType.h:
8032         (DFG):
8033
8034 2013-02-28  Mark Hahnenberg  <mhahnenberg@apple.com>
8035
8036         Add casts in DFGGPRInfo.h to suppress warnings
8037         https://bugs.webkit.org/show_bug.cgi?id=111104
8038
8039         Reviewed by Filip Pizlo.
8040
8041         With certain flags on, we get compiler warnings on ARM. We should do the proper casts to make these warnings go away.
8042
8043         * dfg/DFGGPRInfo.h:
8044         (JSC::DFG::GPRInfo::toIndex):
8045         (JSC::DFG::GPRInfo::debugName):
8046
8047 2013-02-28  Filip Pizlo  <fpizlo@apple.com>
8048
8049         It should be easy to determine if a DFG node exits forward or backward when doing type checks
8050         https://bugs.webkit.org/show_bug.cgi?id=111102
8051
8052         Reviewed by Mark Hahnenberg.
8053
8054         This adds a NodeExitsForward flag, which tells you the exit directionality of
8055         type checks performed by the node. Even if you convert the node to a Phantom
8056         and use the Edge UseKind for type checks, you'll still get the same exit
8057         directionality that the original node would have wanted.
8058
8059         * dfg/DFGArgumentsSimplificationPhase.cpp:
8060         (JSC::DFG::ArgumentsSimplificationPhase::run):
8061         * dfg/DFGArrayifySlowPathGenerator.h:
8062         (JSC::DFG::ArrayifySlowPathGenerator::ArrayifySlowPathGenerator):
8063         * dfg/DFGCFGSimplificationPhase.cpp:
8064         (JSC::DFG::CFGSimplificationPhase::run):
8065         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
8066         * dfg/DFGCPSRethreadingPhase.cpp:
8067         (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
8068         * dfg/DFGCSEPhase.cpp:
8069         (JSC::DFG::CSEPhase::setReplacement):
8070         (JSC::DFG::CSEPhase::eliminate):
8071         (JSC::DFG::CSEPhase::performNodeCSE):
8072         * dfg/DFGConstantFoldingPhase.cpp:
8073         (JSC::DFG::ConstantFoldingPhase::foldConstants):
8074         * dfg/DFGFixupPhase.cpp:
8075         (JSC::DFG::FixupPhase::checkArray):
8076         * dfg/DFGNode.h:
8077         (Node):
8078         (JSC::DFG::Node::setOpAndDefaultNonExitFlags):
8079         (JSC::DFG::Node::convertToPhantom):
8080         * dfg/DFGNodeFlags.cpp:
8081         (JSC::DFG::nodeFlagsAsString):
8082         * dfg/DFGNodeFlags.h:
8083         (DFG):
8084         * dfg/DFGNodeType.h:
8085         (DFG):
8086         * dfg/DFGSpeculativeJIT.cpp:
8087         (JSC::DFG::SpeculativeJIT::backwardSpeculationCheck):
8088         (DFG):
8089         (JSC::DFG::SpeculativeJIT::speculationCheck):
8090         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
8091         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
8092         (JSC::DFG::SpeculativeJIT::backwardTypeCheck):
8093         (JSC::DFG::SpeculativeJIT::typeCheck):
8094         (JSC::DFG::SpeculativeJIT::forwardTypeCheck):
8095         (JSC::DFG::SpeculativeJIT::fillStorage):
8096         (JSC::DFG::SpeculativeJIT::compile):
8097         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
8098         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
8099         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
8100         * dfg/DFGSpeculativeJIT.h:
8101         (SpeculativeJIT):
8102         (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
8103         (JSC::DFG::SpeculateIntegerOperand::gpr):
8104         (SpeculateIntegerOperand):
8105         (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
8106         (JSC::DFG::SpeculateDoubleOperand::fpr):
8107         (SpeculateDoubleOperand):
8108         (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
8109         (JSC::DFG::SpeculateCellOperand::gpr):
8110         (SpeculateCellOperand):
8111         (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
8112         (JSC::DFG::SpeculateBooleanOperand::gpr):
8113         (SpeculateBooleanOperand):
8114         * dfg/DFGSpeculativeJIT32_64.cpp:
8115         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
8116         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
8117         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
8118         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
8119         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
8120         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
8121         (JSC::DFG::SpeculativeJIT::compile):
8122         * dfg/DFGSpeculativeJIT64.cpp:
8123         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
8124         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
8125         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
8126         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
8127         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
8128         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
8129         (JSC::DFG::SpeculativeJIT::compile):
8130
8131 2013-02-28  Filip Pizlo  <fpizlo@apple.com>
8132
8133         CodeBlock::valueProfile() has a bogus assertion
8134         https://bugs.webkit.org/show_bug.cgi?id=111106
8135         <rdar://problem/13131427>
8136
8137         Reviewed by Mark Hahnenberg.
8138
8139         This was just a bad assertion: m_bytecodeOffset == -1 means that the value profile is constructed but not initialized.
8140         ValueProfile constructs itself in a safe way; you can call any method you want on a constructed but not initialized
8141         ValueProfile. CodeBlock first constructs all ValueProfiles (by growing the ValueProfile vector) and then initializes
8142         their m_bytecodeOffset later. This is necessary because the initialization is linking bytecode instructions to their
8143         ValueProfiles, so at that point we don't want the ValueProfile vector to resize, which implies that we want all of
8144         them to already be constructed. A GC can happen during this phase, and the GC may want to walk all ValueProfiles.
8145         This is safe, but one of the ValueProfile getters (CodeBlock::valueProfile()) was asserting that any value profile
8146         you get has had its m_bytecodeOffset initialized. This need not be the case and nothing will go wrong if it isn't.
8147
8148         The solution is to remove the assertion, which I believe was put there to ensure that my m_valueProfiles refactoring
8149         a long time ago was sound: it used to be that a ValueProfile with m_bytecodeOffset == -1 was an argument profile; now
8150         all argument profiles are in m_argumentValueProfiles instead. I think it's safe to say that this refactoring was done
8151         soundly since it was a long time ago. So we should kill the assertion - I don't see an easy way to make the assertion
8152         sound with respect to the GC-during-CodeBlock-construction issue, and I don't believe that the assertion is buying us
8153         anything at this point.
8154
8155         * bytecode/CodeBlock.h:
8156         (JSC::CodeBlock::valueProfile):
8157
8158 2013-02-27  Filip Pizlo  <fpizlo@apple.com>
8159
8160         DFG CFA should leave behind information in Edge that says if the Edge's type check is proven to succeed
8161         https://bugs.webkit.org/show_bug.cgi?id=110840
8162
8163         Reviewed by Mark Hahnenberg.
8164
8165         This doesn't add any observable functionality to the compiler, yet. But it does give
8166         every phase that runs after CFA the ability to know, in O(1) time, whether an edge
8167         will need to execute a type check.
8168
8169         * dfg/DFGAbstractState.h:
8170         (JSC::DFG::AbstractState::filterEdgeByUse):
8171         (JSC::DFG::AbstractState::filterByType):
8172         * dfg/DFGCommon.cpp:
8173         (WTF):
8174         (WTF::printInternal):
8175         * dfg/DFGCommon.h:
8176         (JSC::DFG::isProved):
8177         (DFG):
8178         (JSC::DFG::proofStatusForIsProved):
8179         (WTF):
8180         * dfg/DFGEdge.cpp:
8181         (JSC::DFG::Edge::dump):
8182         * dfg/DFGEdge.h:
8183         (JSC::DFG::Edge::Edge):
8184         (JSC::DFG::Edge::setNode):
8185         (JSC::DFG::Edge::useKindUnchecked):
8186         (JSC::DFG::Edge::setUseKind):
8187         (Edge):
8188         (JSC::DFG::Edge::proofStatusUnchecked):
8189         (JSC::DFG::Edge::proofStatus):
8190         (JSC::DFG::Edge::setProofStatus):
8191         (JSC::DFG::Edge::isProved):
8192         (JSC::DFG::Edge::needsCheck):
8193         (JSC::DFG::Edge::shift):
8194         (JSC::DFG::Edge::makeWord):
8195
8196 2013-02-28  Simon Hausmann  <simon.hausmann@digia.com>
8197
8198         [Qt][Mac] Fix massive parallel builds
8199
8200         Reviewed by Tor Arne Vestbø.
8201
8202         There exists a race condition that LLIntDesiredOffsets.h is written to
8203         by two parllel instances of the ruby script. This patch ensures that similar to the output file,
8204         the generated file is also prefixed according to the build configuration.
8205
8206         * LLIntOffsetsExtractor.pro:
8207
8208 2013-02-27  Sheriff Bot  <webkit.review.bot@gmail.com>
8209
8210         Unreviewed, rolling out r144168.
8211         http://trac.webkit.org/changeset/144168
8212         https://bugs.webkit.org/show_bug.cgi?id=111019
8213
8214         It broke the build and tronical is unavailable (Requested by
8215         Ossy_night on #webkit).
8216
8217         * LLIntOffsetsExtractor.pro:
8218
8219 2013-02-26  Filip Pizlo  <fpizlo@apple.com>
8220
8221         Disable some unsound DFG DCE
8222         https://bugs.webkit.org/show_bug.cgi?id=110948
8223
8224         Reviewed by Michael Saboff.
8225
8226         DCE of bitops is not sound since the bitops might call some variant of valueOf.
8227
8228         This used to work right because ValueToInt32 was MustGenerate. From the DFG IR
8229         standpoint it feels weird to make ValueToInt32 be MustGenerate since that node is
8230         implemented entirely as a pure conversion. If we ever gave the DFG the ability to
8231         do effectful bitops, we would most likely implement them as special nodes not
8232         related to the ValueToInt32 and bitop nodes we have now.
8233
8234         This change is performance neutral.
8235
8236         * dfg/DFGNodeType.h:
8237         (DFG):
8238
8239 2013-02-27  Glenn Adams  <glenn@skynav.com>
8240
8241         Add ENABLE_CSS3_TEXT_LINE_BREAK flag.
8242         https://bugs.webkit.org/show_bug.cgi?id=110944
8243
8244         Reviewed by Dean Jackson.
8245
8246         * Configurations/FeatureDefines.xcconfig:
8247
8248 2013-02-27  Julien Brianceau   <jbrianceau@nds.com>
8249
8250         Fix build when DFG_JIT is not enabled
8251         https://bugs.webkit.org/show_bug.cgi?id=110991
8252
8253         Reviewed by Csaba Osztrogonác.
8254
8255         * jit/JIT.h:
8256         (JSC::JIT::canBeOptimizedOrInlined):
8257
8258 2013-02-27  Simon Hausmann  <simon.hausmann@digia.com>
8259
8260         [Qt][Mac] Fix massive parallel builds
8261
8262         Reviewed by Tor Arne Vestbø.
8263
8264         There exists a race condition that LLIntDesiredOffsets.h is written to
8265         by two parllel instances of the ruby script. This patch ensures that similar to the output file,
8266         the generated file is also prefixed according to the build configuration.
8267
8268         * LLIntOffsetsExtractor.pro:
8269
8270 2013-02-26  Filip Pizlo  <fpizlo@apple.com>
8271
8272         DFG OSR exit doesn't know which virtual register to use for the last result register for post_inc and post_dec
8273         https://bugs.webkit.org/show_bug.cgi?id=109036
8274         <rdar://problem/13292139>
8275
8276         Reviewed by Gavin Barraclough.
8277
8278         This was a two-fold problem:
8279
8280         1) post_inc/dec has two results - the new value of the variable, and the old value of the variable. DFG OSR exit
8281            assumed that the "last result" used for the Baseline JIT's register allocation would be the new value. It was
8282            wrong in this assumption.
8283
8284         2) The Baseline JIT knew to disable its last result optimization in cases where it might confuse the DFG. But it
8285            was doing this only for code blocks that could be totally optimized, but not code blocks that could only be
8286            optimized when inlined.
8287
8288         This patch introduces a more rigorous notion of when the Baseline JIT emits profiling, when it does extra work
8289         to account for the possibility of OSR exit, and when it does extra work to account for the possibility of OSR
8290         entry. These notions are called shouldEmitProfiling(), canBeOptimizedOrInlined(), and canBeOptimized(),
8291         respectively.
8292
8293         This is performance-neutral and fixes the reported bug. It probably fixes other bugs as well, since previously
8294         we for example weren't doing the more conservative implementation of op_mov in the Baseline JIT for code blocks
8295         that could be inlined but not optimized. So, if such a code block OSR exited at just the right point, you'd get
8296         symptoms similar to this bug.
8297
8298         * dfg/DFGCapabilities.h:
8299         (JSC::DFG::canCompileOpcode):
8300         * dfg/DFGCommon.h:
8301         * jit/JIT.cpp:
8302         (JSC::JIT::privateCompile):
8303         * jit/JIT.h:
8304         (JSC::JIT::compilePatchGetArrayLength):
8305         (JSC::JIT::canBeOptimizedOrInlined):
8306         (JIT):
8307         * jit/JITArithmetic.cpp:
8308         (JSC::JIT::emit_op_post_inc):
8309         (JSC::JIT::emit_op_post_dec):
8310         * jit/JITArithmetic32_64.cpp:
8311         (JSC::JIT::emit_op_post_inc):
8312         (JSC::JIT::emit_op_post_dec):
8313         * jit/JITCall.cpp:
8314         (JSC::JIT::emit_op_call_put_result):
8315         (JSC::JIT::compileOpCall):
8316         * jit/JITCall32_64.cpp:
8317         (JSC::JIT::compileOpCall):
8318         * jit/JITInlines.h:
8319         (JSC::JIT::emitArrayProfilingSite):
8320         (JSC::JIT::map):
8321         * jit/JITOpcodes.cpp:
8322         (JSC::JIT::emit_op_mov):
8323         * jit/JITPropertyAccess.cpp:
8324         (JSC::JIT::compileGetByIdHotPath):
8325         (JSC::JIT::privateCompilePutByIdTransition):
8326         * jit/JITPropertyAccess32_64.cpp:
8327         (JSC::JIT::compileGetByIdHotPath):
8328         (JSC::JIT::privateCompilePutByIdTransition):
8329
8330 2013-02-26  Roger Fong  <roger_fong@apple.com>
8331
8332         Unreviewed. AppleWin VS2010 build fix.
8333
8334         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
8335
8336 2013-02-25  Filip Pizlo  <fpizlo@apple.com>
8337
8338         The DFG backend's and OSR's decision to unbox a variable should be based on whether it's used in a typed context
8339         https://bugs.webkit.org/show_bug.cgi?id=110433
8340
8341         Reviewed by Oliver Hunt and Mark Hahnenberg.
8342
8343         This introduces the equivalent of a liveness analysis, except for type checking.
8344         A variable is said to be "profitable for unboxing" (i.e. live at a type check)
8345         if there exists a type check on a GetLocal of that variable, and the type check
8346         is consistent with the variable's prediction. Variables that are not profitable
8347         for unboxing aren't unboxed. Previously they would have been.
8348
8349         This is a slight speed-up on some things but mostly neutral.
8350
8351         * dfg/DFGArgumentPosition.h:
8352         (JSC::DFG::ArgumentPosition::ArgumentPosition):
8353         (JSC::DFG::ArgumentPosition::mergeShouldNeverUnbox):
8354         (JSC::DFG::ArgumentPosition::mergeArgumentPredictionAwareness):
8355         (JSC::DFG::ArgumentPosition::mergeArgumentUnboxingAwareness):
8356         (ArgumentPosition):
8357         (JSC::DFG::ArgumentPosition::isProfitableToUnbox):
8358         (JSC::DFG::ArgumentPosition::shouldUseDoubleFormat):
8359         * dfg/DFGCommon.h:
8360         (JSC::DFG::checkAndSet):
8361         (DFG):
8362         * dfg/DFGFixupPhase.cpp:
8363         (JSC::DFG::FixupPhase::run):
8364         (JSC::DFG::FixupPhase::fixupNode):
8365         (JSC::DFG::FixupPhase::fixupSetLocalsInBlock):
8366         (FixupPhase):
8367         (JSC::DFG::FixupPhase::alwaysUnboxSimplePrimitives):
8368         (JSC::DFG::FixupPhase::setUseKindAndUnboxIfProfitable):
8369         * dfg/DFGPredictionPropagationPhase.cpp:
8370         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
8371         * dfg/DFGSpeculativeJIT.cpp:
8372         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
8373         * dfg/DFGVariableAccessData.h:
8374         (JSC::DFG::VariableAccessData::VariableAccessData):
8375         (JSC::DFG::VariableAccessData::mergeIsCaptured):
8376         (JSC::DFG::VariableAccessData::mergeIsProfitableToUnbox):
8377         (VariableAccessData):
8378         (JSC::DFG::VariableAccessData::isProfitableToUnbox):
8379         (JSC::DFG::VariableAccessData::shouldUnboxIfPossible):
8380         (JSC::DFG::VariableAccessData::mergeStructureCheckHoistingFailed):
8381         (JSC::DFG::VariableAccessData::mergeIsArgumentsAlias):
8382         (JSC::DFG::VariableAccessData::shouldUseDoubleFormat):
8383         (JSC::DFG::VariableAccessData::mergeFlags):
8384
8385 2013-02-26  Oliver Hunt  <oliver@apple.com>
8386
8387         Fix windows build.
8388
8389         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
8390
8391 2013-02-26  Oliver Hunt  <oliver@apple.com>
8392
8393         Web Inspector: REGRESSION: [JSC] SourceProvider reuses IDs
8394         https://bugs.webkit.org/show_bug.cgi?id=99674
8395
8396         Reviewed by Gavin Barraclough.
8397
8398         Simple incrementing counter for SourceProvider IDs.  Uses a
8399         lock to incrementing the counter so we don't increment reuse
8400         counter values or reassign the ID for a given SourceProvider.
8401
8402         * parser/SourceProvider.cpp:
8403         (JSC::SourceProvider::SourceProvider):
8404         (JSC):
8405         (JSC::SourceProvider::getID):
8406         * parser/SourceProvider.h:
8407         (JSC::SourceProvider::asID):
8408         (SourceProvider):
8409
8410 2013-02-26  Sheriff Bot  <webkit.review.bot@gmail.com>
8411
8412         Unreviewed, rolling out r144074.
8413         http://trac.webkit.org/changeset/144074
8414         https://bugs.webkit.org/show_bug.cgi?id=110897
8415
8416         Causing 20+ crashes on Mac (Requested by bradee-oh on
8417         #webkit).
8418
8419         * CMakeLists.txt:
8420         * GNUmakefile.list.am:
8421         * JavaScriptCore.gypi:
8422         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
8423         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
8424         * JavaScriptCore.xcodeproj/project.pbxproj:
8425         * Target.pri:
8426         * runtime/JSGlobalData.cpp:
8427         (JSC::JSGlobalData::JSGlobalData):
8428         * runtime/JSGlobalData.h:
8429         (JSGlobalData):
8430         * runtime/PropertyMapHashTable.h:
8431         (PropertyTable):
8432         (JSC::PropertyTable::PropertyTable):
8433         (JSC):
8434         (JSC::PropertyTable::~PropertyTable):
8435         (JSC::PropertyTable::copy):
8436         * runtime/PropertyTable.cpp: Removed.
8437         * runtime/Structure.cpp:
8438         (JSC::Structure::materializePropertyMap):
8439         (JSC::Structure::addPropertyTransition):
8440         (JSC::Structure::changePrototypeTransition):
8441         (JSC::Structure::despecifyFunctionTransition):
8442         (JSC::Structure::attributeChangeTransition):
8443         (JSC::Structure::toDictionaryTransition):
8444         (JSC::Structure::preventExtensionsTransition):
8445         (JSC::Structure::nonPropertyTransition):
8446         (JSC::Structure::copyPropertyTable):
8447         (JSC::Structure::copyPropertyTableForPinning):
8448         (JSC::Structure::putSpecificValue):
8449         (JSC::Structure::createPropertyMap):
8450         (JSC::Structure::visitChildren):
8451         * runtime/Structure.h:
8452         (JSC):
8453         (JSC::Structure::putWillGrowOutOfLineStorage):
8454         (JSC::Structure::checkOffsetConsistency):
8455         (Structure):
8456         * runtime/StructureInlines.h:
8457
8458 2013-02-26  Roger Fong  <roger_fong@apple.com>
8459
8460         Unreviewed. AppleWin VS2010 build fix.
8461
8462         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props:
8463
8464 2013-02-26  Jer Noble  <jer.noble@apple.com>
8465
8466         Unreviewed build fix; use correct macro for platform name in FeatureDefines.xcconfig.
8467
8468         * Configurations/FeatureDefines.xcconfig:
8469
8470 2013-02-26  Michael Saboff  <msaboff@apple.com>
8471
8472         Potential crash in YARR JIT generated code when building 64 bit
8473         https://bugs.webkit.org/show_bug.cgi?id=110893
8474
8475         Reviewed by Gavin Barraclough.
8476
8477         The ABI doesn't define the behavior for the upper bits of a value that takes less than 64 bits.
8478         Therefore, we zero extend both the count and length registers to assure that these unsigned values
8479         don't have garbage upper bits.
8480
8481         * yarr/YarrJIT.cpp:
8482         (JSC::Yarr::YarrGenerator::generateEnter):
8483
8484 2013-02-26  Andreas Kling  <akling@apple.com>
8485
8486         Unused Structure property tables waste 14MB on Membuster.
8487         <http://webkit.org/b/110854>
8488         <rdar://problem/13292104>
8489
8490         Reviewed by Filip Pizlo.
8491
8492         Turn PropertyTable into a GC object and have Structure drop unpinned tables when marking.
8493         14 MB progression on Membuster3.
8494
8495         * CMakeLists.txt:
8496         * GNUmakefile.list.am:
8497         * JavaScriptCore.gypi:
8498         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
8499         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
8500         * JavaScriptCore.xcodeproj/project.pbxproj:
8501         * Target.pri:
8502
8503             Added PropertyTable.cpp.
8504
8505         * runtime/PropertyTable.cpp: Added.
8506         (JSC::PropertyTable::create):
8507         (JSC::PropertyTable::clone):
8508         (JSC::PropertyTable::PropertyTable):
8509         (JSC::PropertyTable::destroy):
8510         (JSC::PropertyTable::~PropertyTable):
8511         (JSC::PropertyTable::visitChildren):
8512
8513             Moved marking of property table values here from Structure::visitChildren().
8514
8515         * runtime/StructureInlines.h:
8516         (JSC::Structure::putWillGrowOutOfLineStorage):
8517         (JSC::Structure::checkOffsetConsistency):
8518
8519             Moved these to StructureInlines.h to break header dependency cycle between Structure/PropertyTable.
8520
8521         * runtime/Structure.cpp:
8522         (JSC::Structure::visitChildren):
8523
8524             Null out m_propertyTable if the table is unpinned. This'll cause the table to get GC'd.
8525
8526         (JSC::Structure::materializePropertyMap):
8527         (JSC::Structure::addPropertyTransition):
8528         (JSC::Structure::changePrototypeTransition):
8529         (JSC::Structure::despecifyFunctionTransition):
8530         (JSC::Structure::attributeChangeTransition):
8531         (JSC::Structure::toDictionaryTransition):
8532         (JSC::Structure::preventExtensionsTransition):
8533         (JSC::Structure::nonPropertyTransition):
8534         (JSC::Structure::copyPropertyTable):
8535         (JSC::Structure::copyPropertyTableForPinning):
8536         (JSC::Structure::putSpecificValue):
8537         (JSC::Structure::createPropertyMap):
8538         * runtime/Structure.h:
8539         (Structure):
8540         * runtime/JSGlobalData.cpp:
8541         (JSC::JSGlobalData::JSGlobalData):
8542         * runtime/JSGlobalData.h:
8543         (JSGlobalData):
8544         * runtime/PropertyMapHashTable.h:
8545         (PropertyTable):
8546         (JSC::PropertyTable::createStructure):
8547         (JSC::PropertyTable::copy):
8548
8549 2013-02-26  Andreas Kling  <akling@apple.com>
8550
8551         Unreviewed, rolling out r144054.
8552         http://trac.webkit.org/changeset/144054
8553         https://bugs.webkit.org/show_bug.cgi?id=110854
8554
8555         broke builds
8556
8557         * CMakeLists.txt:
8558         * GNUmakefile.list.am:
8559         * JavaScriptCore.gypi:
8560         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
8561         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
8562         * JavaScriptCore.xcodeproj/project.pbxproj:
8563         * Target.pri:
8564         * runtime/JSGlobalData.cpp:
8565         (JSC::JSGlobalData::JSGlobalData):
8566         * runtime/JSGlobalData.h:
8567         (JSGlobalData):
8568         * runtime/PropertyMapHashTable.h:
8569         (PropertyTable):
8570         (JSC::PropertyTable::PropertyTable):
8571         (JSC):
8572         (JSC::PropertyTable::~PropertyTable):
8573         (JSC::PropertyTable::copy):
8574         * runtime/PropertyTable.cpp: Removed.
8575         * runtime/Structure.cpp:
8576         (JSC::Structure::materializePropertyMap):
8577         (JSC::Structure::addPropertyTransition):
8578         (JSC::Structure::changePrototypeTransition):
8579         (JSC::Structure::despecifyFunctionTransition):
8580         (JSC::Structure::attributeChangeTransition):
8581         (JSC::Structure::toDictionaryTransition):
8582         (JSC::Structure::preventExtensionsTransition):
8583         (JSC::Structure::nonPropertyTransition):
8584         (JSC::Structure::copyPropertyTable):
8585         (JSC::Structure::copyPropertyTableForPinning):
8586         (JSC::Structure::putSpecificValue):
8587         (JSC::Structure::createPropertyMap):
8588         (JSC::Structure::visitChildren):
8589         * runtime/Structure.h:
8590         (JSC):
8591         (JSC::Structure::putWillGrowOutOfLineStorage):
8592         (JSC::Structure::checkOffsetConsistency):
8593         (Structure):
8594         * runtime/StructureInlines.h:
8595
8596 2013-02-26  Andreas Kling  <akling@apple.com>
8597
8598         Unused Structure property tables waste 14MB on Membuster.
8599         <http://webkit.org/b/110854>
8600         <rdar://problem/13292104>
8601
8602         Reviewed by Filip Pizlo.
8603
8604         Turn PropertyTable into a GC object and have Structure drop unpinned tables when marking.
8605         14 MB progression on Membuster3.
8606
8607         * CMakeLists.txt:
8608         * GNUmakefile.list.am:
8609         * JavaScriptCore.gypi:
8610         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
8611         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
8612         * JavaScriptCore.xcodeproj/project.pbxproj:
8613         * Target.pri:
8614
8615             Added PropertyTable.cpp.
8616
8617         * runtime/PropertyTable.cpp: Added.
8618         (JSC::PropertyTable::create):
8619         (JSC::PropertyTable::clone):
8620         (JSC::PropertyTable::PropertyTable):
8621         (JSC::PropertyTable::destroy):
8622         (JSC::PropertyTable::~PropertyTable):
8623         (JSC::PropertyTable::visitChildren):
8624
8625             Moved marking of property table values here from Structure::visitChildren().
8626
8627         * runtime/StructureInlines.h:
8628         (JSC::Structure::putWillGrowOutOfLineStorage):
8629         (JSC::Structure::checkOffsetConsistency):
8630
8631             Moved these to StructureInlines.h to break header dependency cycle between Structure/PropertyTable.
8632
8633         * runtime/Structure.cpp:
8634         (JSC::Structure::visitChildren):
8635
8636             Null out m_propertyTable if the table is unpinned. This'll cause the table to get GC'd.
8637
8638         (JSC::Structure::materializePropertyMap):
8639         (JSC::Structure::addPropertyTransition):
8640         (JSC::Structure::changePrototypeTransition):
8641         (JSC::Structure::despecifyFunctionTransition):
8642         (JSC::Structure::attributeChangeTransition):
8643         (JSC::Structure::toDictionaryTransition):
8644         (JSC::Structure::preventExtensionsTransition):
8645         (JSC::Structure::nonPropertyTransition):
8646         (JSC::Structure::copyPropertyTable):
8647         (JSC::Structure::copyPropertyTableForPinning):
8648         (JSC::Structure::putSpecificValue):
8649         (JSC::Structure::createPropertyMap):
8650         * runtime/Structure.h:
8651         (Structure):
8652         * runtime/JSGlobalData.cpp:
8653         (JSC::JSGlobalData::JSGlobalData):
8654         * runtime/JSGlobalData.h:
8655         (JSGlobalData):
8656         * runtime/PropertyMapHashTable.h:
8657         (PropertyTable):
8658         (JSC::PropertyTable::createStructure):
8659         (JSC::PropertyTable::copy):
8660
8661 2013-02-26  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
8662
8663         Implement JIT on Windows 64 bits
8664         https://bugs.webkit.org/show_bug.cgi?id=107965
8665
8666         Reviewed by Simon Hausmann.
8667
8668         1. MSVC doesn't support inline assembly for 64 bits, implements the trampoline in a separate ASM file.
8669
8670         2. Windows 64 bits has a different calling convention than other OSes following the AMD64 ABI.
8671         Differences that we have to handle here:
8672         - Registers passed parameters are RCX, RDX, R8 and R9 instead of RDI, RSI, RDX, RCX, R8 and R9
8673         - RDI and RSI must be preserved by callee
8674         - Only return values <= 8 bytes can be returned by register (RDX can't be used to return a second word)
8675         - There is no red-zone after RIP on the stack, but instead 4 reserved words before it
8676
8677         * Target.pri:
8678         * jit/JITStubs.cpp:
8679         * jit/JITStubs.h:
8680         (JSC):
8681         (JITStackFrame):
8682         (JSC::JITStackFrame::returnAddressSlot):
8683         * jit/JITStubsMSVC64.asm: Added.
8684         * jit/JSInterfaceJIT.h:
8685         (JSInterfaceJIT):
8686         * jit/ThunkGenerators.cpp:
8687         (JSC::nativeForGenerator):
8688         * yarr/YarrJIT.cpp:
8689         (YarrGenerator):
8690         (JSC::Yarr::YarrGenerator::generateEnter):
8691         (JSC::Yarr::YarrGenerator::generateReturn):
8692
8693 2013-02-26  Oliver Hunt  <oliver@apple.com>
8694
8695         Kill another analyzer warning in javascriptcore
8696         https://bugs.webkit.org/show_bug.cgi?id=110802
8697
8698         Reviewed by Benjamin Poulain.
8699
8700         Add null checks.
8701
8702         * profiler/LegacyProfiler.cpp:
8703         (JSC::LegacyProfiler::startProfiling):
8704         (JSC::LegacyProfiler::stopProfiling):
8705
8706 2013-02-26  Sheriff Bot  <webkit.review.bot@gmail.com>
8707
8708         Unreviewed, rolling out r144004.
8709         http://trac.webkit.org/changeset/144004
8710         https://bugs.webkit.org/show_bug.cgi?id=110858
8711
8712         This iOS change is outdated (Requested by notbenjamin on
8713         #webkit).
8714
8715         * bytecompiler/BytecodeGenerator.cpp:
8716         (JSC::BytecodeGenerator::BytecodeGenerator):
8717         * bytecompiler/BytecodeGenerator.h:
8718         (JSC::BytecodeGenerator::emitNode):
8719         (JSC::BytecodeGenerator::emitNodeInConditionContext):
8720         (BytecodeGenerator):
8721         * parser/Parser.cpp:
8722         (JSC::::Parser):
8723         * parser/Parser.h:
8724         (JSC::Parser::canRecurse):
8725         (Parser):
8726
8727 2013-02-25  Filip Pizlo  <fpizlo@apple.com>
8728
8729         REGRESSION(r143654): some jquery test asserts on 32 bit debug build
8730         https://bugs.webkit.org/show_bug.cgi?id=110756
8731
8732         Reviewed by Geoffrey Garen.
8733
8734         TypeOf does speculations manually, so it should mark its JSValueOperand as doing ManualOperandSpeculation.
8735
8736         * dfg/DFGSpeculativeJIT32_64.cpp:
8737         (JSC::DFG::SpeculativeJIT::compile):
8738
8739 2013-02-25  Benjamin Poulain  <bpoulain@apple.com>
8740
8741         [JSC] Upstream iOS Stack bound checking
8742         https://bugs.webkit.org/show_bug.cgi?id=110813
8743
8744         Reviewed by Filip Pizlo.
8745
8746         On iOS, the StackBounds cannot be cached because the stack
8747         can be in one of two threads (the web thread or the UI thread).
8748
8749         We simply always consider the current stack bound when testing
8750         stack boundaries.
8751
8752         * bytecompiler/BytecodeGenerator.cpp:
8753         (JSC::BytecodeGenerator::BytecodeGenerator):
8754         * bytecompiler/BytecodeGenerator.h:
8755         (JSC::BytecodeGenerator::emitNode):
8756         (JSC::BytecodeGenerator::emitNodeInConditionContext):
8757         (BytecodeGenerator):
8758         * parser/Parser.cpp:
8759         (JSC::::Parser):
8760         * parser/Parser.h:
8761         (JSC::Parser::canRecurse):
8762         (Parser):
8763
8764 2013-02-25  Michael Saboff  <msaboff@apple.com>
8765
8766         For JSVALUE32_64, maxOffsetRelativeToPatchedStorage() doesn't compute the maximum negative offset
8767         https://bugs.webkit.org/show_bug.cgi?id=110828
8768
8769         Reviewed by Oliver Hunt.
8770
8771         * runtime/JSObject.h:
8772         (JSC::maxOffsetRelativeToPatchedStorage): Only add the OBJECT_OFFSETOF(tag) for positive offsets.
8773         That way this function will return the offset farthest from 0 needed to access either the payload
8774         or tag.
8775
8776 2013-02-25  Jeffrey Pfau  <jpfau@apple.com>
8777
8778         Optionally partition cache to prevent using cache for tracking
8779         https://bugs.webkit.org/show_bug.cgi?id=110269
8780
8781         Reviewed by Maciej Stachowiak.
8782
8783         * Configurations/FeatureDefines.xcconfig: Add defines for cache partitioning and public suffix list usage
8784
8785 2013-02-25  Roger Fong  <roger_fong@apple.com>
8786
8787         Unreviewed. VS2010 solution build fix.
8788
8789         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props:
8790
8791 2013-02-24  Filip Pizlo  <fpizlo@apple.com>
8792
8793         DFG::Edge should have more bits for UseKind, and DFG::Allocator should be simpler
8794         https://bugs.webkit.org/show_bug.cgi?id=110722
8795
8796         Reviewed by Oliver Hunt.
8797
8798         This rolls out the DFG::Allocator part of http://trac.webkit.org/changeset/143654,
8799         and changes Edge to have more room for UseKinds and possibly other things.
8800
8801         This is performance-neutral on both 32-bit and 64-bit. It reduces the size of
8802         DFG::Node on 64-bit (by virtue of getting rid of the 16-byte alignment of Node)
8803         and increases it slightly on 32-bit (by 4 bytes total - 16-byte alignment led to
8804         80 bytes, but the base size of Node plus the 12 bytes of new m_encodedWords in
8805         Edge gets 84 bytes). But, it will mean that we don't have to increase Node by
8806         another 16 bytes if we ever want to add more UseKinds or other things to Edge.
8807
8808         * dfg/DFGAllocator.h:
8809         (DFG):
8810         (Allocator):
8811         (JSC::DFG::Allocator::Region::headerSize):
8812         (JSC::DFG::Allocator::Region::numberOfThingsPerRegion):
8813         (JSC::DFG::Allocator::Region::data):
8814         (JSC::DFG::Allocator::Region::isInThisRegion):
8815         (JSC::DFG::::Allocator):
8816         (JSC::DFG::::~Allocator):
8817         (JSC::DFG::::allocate):
8818         (JSC::DFG::::free):
8819         (JSC::DFG::::freeAll):
8820         (JSC::DFG::::reset):
8821         (JSC::DFG::::indexOf):
8822         (JSC::DFG::::allocatorOf):
8823         (JSC::DFG::::bumpAllocate):
8824         (JSC::DFG::::freeListAllocate):
8825         (JSC::DFG::::allocateSlow):
8826         (JSC::DFG::::freeRegionsStartingAt):
8827         (JSC::DFG::::startBumpingIn):
8828         * dfg/DFGEdge.h:
8829         (JSC::DFG::Edge::Edge):
8830         (Edge):
8831         (JSC::DFG::Edge::node):
8832         (JSC::DFG::Edge::setNode):
8833         (JSC::DFG::Edge::useKindUnchecked):
8834         (JSC::DFG::Edge::setUseKind):
8835         (JSC::DFG::Edge::operator==):
8836         (JSC::DFG::Edge::operator!=):
8837         (JSC::DFG::Edge::makeWord):
8838         * dfg/DFGNodeAllocator.h:
8839         (DFG):
8840
8841 2013-02-22  Filip Pizlo  <fpizlo@apple.com>
8842
8843         The DFG special case checks for isCreatedThisArgument are fragile
8844         https://bugs.webkit.org/show_bug.cgi?id=110535
8845
8846         Reviewed by Oliver Hunt.
8847
8848         There may be many situations in which we want to force a variable to never be
8849         unboxed. Capturing is one such case, and the created this argument is another.
8850         Previously all code that dealt with this issue had to query both scenarios.
8851
8852         Now DFG::VariableAccessData knows these things. You just have to ask
8853         VariableAccessData for whether a variable should be unboxed. Anyone wishing to
8854         force a variable to never be unboxed just tells VariableAccessData.
8855
8856         * dfg/DFGAbstractState.cpp:
8857         (JSC::DFG::AbstractState::initialize):
8858         * dfg/DFGByteCodeParser.cpp:
8859         (JSC::DFG::ByteCodeParser::parseBlock):
8860         (DFG):
8861         * dfg/DFGCFGSimplificationPhase.cpp:
8862         (CFGSimplificationPhase):
8863         * dfg/DFGFixupPhase.cpp:
8864         (JSC::DFG::FixupPhase::fixupNode):
8865         * dfg/DFGGraph.h:
8866         (Graph):
8867         * dfg/DFGPredictionPropagationPhase.cpp:
8868         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
8869         * dfg/DFGSpeculativeJIT.cpp:
8870         (JSC::DFG::SpeculativeJIT::compile):
8871         * dfg/DFGSpeculativeJIT32_64.cpp:
8872         (JSC::DFG::SpeculativeJIT::compile):
8873         * dfg/DFGSpeculativeJIT64.cpp:
8874         (JSC::DFG::SpeculativeJIT::compile):
8875         * dfg/DFGUnificationPhase.cpp:
8876         (JSC::DFG::UnificationPhase::run):
8877         * dfg/DFGVariableAccessData.h:
8878         (JSC::DFG::VariableAccessData::VariableAccessData):
8879         (JSC::DFG::VariableAccessData::mergeIsCaptured):
8880         (JSC::DFG::VariableAccessData::mergeShouldNeverUnbox):
8881         (VariableAccessData):
8882         (JSC::DFG::VariableAccessData::shouldNeverUnbox):
8883         (JSC::DFG::VariableAccessData::shouldUnboxIfPossible):
8884         (JSC::DFG::VariableAccessData::shouldUseDoubleFormat):
8885         (JSC::DFG::VariableAccessData::tallyVotesForShouldUseDoubleFormat):
8886
8887 2013-02-25  Geoffrey Garen  <ggaren@apple.com>
8888
8889         Do one lookup per code cache insertion instead of two
8890         https://bugs.webkit.org/show_bug.cgi?id=110674
8891
8892         Reviewed by Sam Weinig.
8893
8894         Deployed the idiomatic "add null value" trick to avoid a second hash
8895         lookup when inserting an item.
8896
8897         * runtime/CodeCache.cpp:
8898         (JSC::CodeCacheMap::pruneSlowCase): Factored this into a helper function
8899         to improve clarity and get some code off the hot path.
8900
8901         (JSC::CodeCache::getCodeBlock):
8902         (JSC::CodeCache::getFunctionExecutableFromGlobalCode): Use the add() API
8903         to avoid two hash lookups. Be sure to remove items if parsing fails,
8904         otherwise we'll leave nulls in the table. (I'm guessing that caching parse
8905         errors is not a win.)
8906
8907         * runtime/CodeCache.h:
8908         (JSC::SourceCodeValue::SourceCodeValue):
8909         (CodeCacheMap):
8910         (JSC::CodeCacheMap::add): Combined find() and set() into add().
8911
8912         (JSC::CodeCacheMap::remove):
8913         (JSC::CodeCacheMap::age):
8914         (JSC::CodeCacheMap::prune): Refactored to support above changes.
8915
8916 2013-02-25  Carlos Garcia Campos  <cgarcia@igalia.com>
8917
8918         [BlackBerry][ARM] Fix cast-align warnings in JavaScriptCore
8919         https://bugs.webkit.org/show_bug.cgi?id=110738
8920
8921         Reviewed by Rob Buis.
8922
8923         Use reinterpret_cast_ptr instead of reinterpret_cast for
8924         pointers.
8925
8926         * dfg/DFGOperations.cpp:
8927         * heap/CopiedBlock.h:
8928         (JSC::CopiedBlock::zeroFillWilderness):
8929         * heap/WeakBlock.h:
8930         (JSC::WeakBlock::asWeakImpl):
8931         (JSC::WeakBlock::asFreeCell):
8932         (JSC::WeakBlock::weakImpls):
8933         * heap/WeakImpl.h:
8934         (JSC::WeakImpl::asWeakImpl):
8935         * interpreter/JSStack.cpp:
8936         (JSC::JSStack::disableErrorStackReserve):
8937         * interpreter/JSStack.h:
8938         (JSC::JSStack::reservationEnd):
8939         * runtime/ArrayStorage.h:
8940         (JSC::ArrayStorage::from):
8941         * runtime/Butterfly.h:
8942         (JSC::Butterfly::indexingPayload):
8943         * runtime/IndexingHeader.h:
8944         (JSC::IndexingHeader::propertyStorage):
8945         * runtime/JSActivation.h:
8946         (JSC::JSActivation::tearOff):
8947         (JSC::JSActivation::isTornOff):
8948         (JSC::JSActivation::storage):
8949
8950 2013-02-22  Filip Pizlo  <fpizlo@apple.com>
8951
8952         DFG::SpeculativeJIT::speculateNumber() should just use SpeculateDoubleOperand instead of doing its own thing
8953         https://bugs.webkit.org/show_bug.cgi?id=110659
8954
8955         Reviewed by Oliver Hunt and Mark Hahnenberg.
8956
8957         This simplifies the code, and also has the effect that if speculateNumber() is called
8958         prior to someone actually using the number in a double context, then the number will
8959         already be up-converted to double and ready to go.
8960
8961         Previously if this ever came up, the subsequent use would have to again branch to see
8962         if the value is tagged as int or tagged as double.
8963
8964         On the other hand, if you ever did speculateNumber() and then used the value as a
8965         JSValue, this will be a slow down now.
8966
8967         I suspect that the former (speculateNumber() and then use as number) is more likely
8968         than the latter (speculateNumber() and then use as JSValue).
8969
8970         * dfg/DFGSpeculativeJIT.cpp:
8971         (JSC::DFG::SpeculativeJIT::speculateNumber):
8972
8973 2013-02-22  Filip Pizlo  <fpizlo@apple.com>
8974
8975         DFG FixupPhase should have one common hook for knowing if a node is ever being speculated a certain way
8976         https://bugs.webkit.org/show_bug.cgi?id=110650
8977
8978         Reviewed by Mark Hahnenberg.
8979
8980         Changes almost all calls to edge.setUseKind(kind) to be
8981         setUseKindAndUnboxIfProfitable<kind>(edge). This will allow us to use the latter
8982         as a hook for deciding which locals to unbox (webkit.org/b/110433).
8983
8984         * dfg/DFGFixupPhase.cpp:
8985         (JSC::DFG::FixupPhase::fixupNode):
8986         (FixupPhase):
8987         (JSC::DFG::FixupPhase::setUseKindAndUnboxIfProfitable):
8988         (JSC::DFG::FixupPhase::fixIntEdge):
8989         (JSC::DFG::FixupPhase::fixDoubleEdge):
8990         (JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
8991
8992 2013-02-22  Filip Pizlo  <fpizlo@apple.com>
8993
8994         REGRESSION(r143654): some fast/js test crashes on 32 bit build
8995         https://bugs.webkit.org/show_bug.cgi?id=110590
8996
8997         Reviewed by Mark Hahnenberg.
8998
8999         In compileValueToInt32, the refactoring in r143654 undid one of the fixes from
9000         r143314 due to a merge goof.
9001
9002         In speculateNumber, we were simply forgetting to indicate that we need a
9003         ManualOperandSpeculation on a JSValueOperand. ManualOperandSpeculation should
9004         be passed whenever you will be performing the type checks yourself rather than
9005         using the operand class to do it for you.
9006
9007         * dfg/DFGSpeculativeJIT.cpp:
9008         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
9009         (JSC::DFG::SpeculativeJIT::speculateNumber):
9010
9011 2013-02-22  Geoffrey Garen  <ggaren@apple.com>
9012
9013         Not reviewed.
9014
9015         Fix the 32-bit build by using the right data type in more places.
9016
9017         * runtime/CodeCache.h:
9018         (CodeCacheMap):
9019
9020 2013-02-22  Geoffrey Garen  <ggaren@apple.com>
9021
9022         Not reviewed.
9023
9024         Fix the 32-bit build by using the right data type.
9025
9026         * runtime/CodeCache.h:
9027         (JSC::CodeCacheMap::find):
9028
9029 2013-02-21  Geoffrey Garen  <ggaren@apple.com>
9030
9031         Code cache size should adapt to workload
9032         https://bugs.webkit.org/show_bug.cgi?id=110560
9033
9034         Reviewed by Antti Koivisto.
9035
9036         (*) 5% PLT arithmetic mean speedup
9037         (*) 10% PLT geometric mean speedup
9038         (*) 3.4X microbenchmark speedup
9039         (*) Reduces initial cache capacity by 16X
9040
9041         * runtime/CodeCache.cpp:
9042         (JSC::CodeCache::CodeCache): Updated for interface change.
9043
9044         * runtime/CodeCache.h:
9045         (JSC::SourceCodeValue::SourceCodeValue):
9046         (SourceCodeValue): Turned the cache value into a struct so it can track its age.
9047
9048         (CodeCacheMap):
9049         (JSC::CodeCacheMap::CodeCacheMap):
9050         (JSC::CodeCacheMap::find):
9051         (JSC::CodeCacheMap::set):
9052         (JSC::CodeCacheMap::clear):
9053         (JSC::CodeCacheMap::pruneIfNeeded):
9054         (CodeCache): Grow and shrink in response to usage.
9055
9056 2013-02-21  Jessie Berlin  <jberlin@apple.com>
9057
9058         Fix a typo that broke the 32 bit build.
9059
9060         * dfg/DFGSpeculativeJIT32_64.cpp:
9061         (JSC::DFG::SpeculativeJIT::compile):
9062
9063 2013-02-21  Michael Saboff  <msaboff@apple.com>
9064
9065         25-30% regression in V8 RayTrace test in 32 bit builds with JIT disabled
9066         https://bugs.webkit.org/show_bug.cgi?id=110539
9067
9068         Reviewed by Filip Pizlo.
9069
9070         Change the scale used to lookup pointers in JSGlobalObject::m_specialPointers to be 4 bytes for
9071         the 32 bit version of the interpreter.
9072
9073         * llint/LowLevelInterpreter32_64.asm:
9074
9075 2013-02-21  Roger Fong  <roger_fong@apple.com>
9076
9077         Unreviewed. Add executable property to cmd file.
9078         Required for executable files to maintain their executable permissions over svn.
9079
9080         * JavaScriptCore.vcxproj/copy-files.cmd: Added property svn:executable.
9081
9082 2013-02-21  Filip Pizlo  <fpizlo@apple.com>
9083
9084         Object allocation profiling will refuse to create objects with more than JSFinalObject::maxInlineCapacity() inline slots, but JSFunction::allocationProfile() asserts that the number of inline slots is always what it asked for
9085         https://bugs.webkit.org/show_bug.cgi?id=110519
9086         <rdar://problem/13218566>
9087
9088         Reviewed by Geoffrey Garen.
9089
9090         * runtime/JSFunction.h:
9091         (JSC::JSFunction::allocationProfile):
9092
9093 2013-02-21  Roger Fong  <roger_fong@apple.com>
9094
9095         Unreviewed. Build fix for VS2010 WebKit solution.
9096
9097         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
9098
9099 2013-02-20  Filip Pizlo  <fpizlo@apple.com>
9100
9101         DFG should not change its mind about what type speculations a node does, by encoding the checks in the NodeType, UseKind, and ArrayMode
9102         https://bugs.webkit.org/show_bug.cgi?id=109371
9103
9104         Reviewed by Oliver Hunt.
9105
9106         FixupPhase now locks in the speculations that each node will do. The DFG then
9107         remembers those speculations, and doesn't change its mind about them even if the
9108         graph is transformed - for example if a node's child is repointed to a different
9109         node as part of CSE, CFG simplification, or folding. Each node ensures that it
9110         executes the speculations promised by its edges. This is true even for Phantom
9111         nodes.
9112
9113         This still leaves some craziness on the table for future work, like the
9114         elimination of speculating SetLocal's due to CFG simplification
9115         (webkit.org/b/109388) and elimination of nodes via DCE (webkit.org/b/109389).
9116
9117         In all, this allows for a huge simplification of the DFG. Instead of having to
9118         execute the right speculation heuristic each time you want to decide what a node
9119         does (for example Node::shouldSpeculateInteger(child1, child2) &&
9120         node->canSpeculateInteger()), you just ask for the use kinds of its children
9121         (typically node->binaryUseKind() == Int32Use). Because the use kinds are
9122         discrete, you can often just switch over them. This makes many parts of the code
9123         more clear than they were before.
9124
9125         Having UseKinds describe the speculations being performed also makes it far
9126         easier to perform analyses that need to know what speculations are done. This is
9127         so far only used to simplify large parts of the CFA.
9128
9129         To have a larger vocabulary of UseKinds, this also changes the node allocator to
9130         be able to round up Node sizes to the nearest multiple of 16.
9131
9132         This appears to be neutral on benchmarks, except for some goofy speed-ups, like
9133         8% on Octane/box2d.
9134
9135         * CMakeLists.txt:
9136         * GNUmakefile.list.am:
9137         * JavaScriptCore.xcodeproj/project.pbxproj:
9138         * Target.pri:
9139         * dfg/DFGAbstractState.cpp:
9140         (JSC::DFG::AbstractState::startExecuting):
9141         (DFG):
9142         (JSC::DFG::AbstractState::executeEdges):
9143         (JSC::DFG::AbstractState::verifyEdge):
9144         (JSC::DFG::AbstractState::verifyEdges):
9145         (JSC::DFG::AbstractState::executeEffects):
9146         (JSC::DFG::AbstractState::execute):
9147         * dfg/DFGAbstractState.h:
9148         (AbstractState):
9149         (JSC::DFG::AbstractState::filterEdgeByUse):
9150         (JSC::DFG::AbstractState::filterByType):
9151         * dfg/DFGAbstractValue.h:
9152         (JSC::DFG::AbstractValue::filter):
9153         * dfg/DFGAdjacencyList.h:
9154         (JSC::DFG::AdjacencyList::AdjacencyList):
9155         (JSC::DFG::AdjacencyList::child):
9156         (JSC::DFG::AdjacencyList::setChild):
9157         (JSC::DFG::AdjacencyList::reset):
9158         (JSC::DFG::AdjacencyList::firstChild):
9159         (JSC::DFG::AdjacencyList::setFirstChild):
9160         (JSC::DFG::AdjacencyList::numChildren):
9161         (JSC::DFG::AdjacencyList::setNumChildren):
9162         (AdjacencyList):
9163         * dfg/DFGAllocator.h:
9164         (DFG):
9165         (Allocator):
9166         (JSC::DFG::Allocator::cellSize):
9167         (JSC::DFG::Allocator::Region::headerSize):
9168         (JSC::DFG::Allocator::Region::numberOfThingsPerRegion):
9169         (JSC::DFG::Allocator::Region::payloadSize):
9170         (JSC::DFG::Allocator::Region::payloadBegin):
9171         (JSC::DFG::Allocator::Region::payloadEnd):
9172         (JSC::DFG::Allocator::Region::isInThisRegion):
9173         (JSC::DFG::::Allocator):
9174         (JSC::DFG::::~Allocator):
9175         (JSC::DFG::::allocate):
9176         (JSC::DFG::::free):
9177         (JSC::DFG::::freeAll):
9178         (JSC::DFG::::reset):
9179         (JSC::DFG::::indexOf):
9180         (JSC::DFG::::allocatorOf):
9181         (JSC::DFG::::bumpAllocate):
9182         (JSC::DFG::::freeListAllocate):
9183         (JSC::DFG::::allocateSlow):
9184         (JSC::DFG::::freeRegionsStartingAt):
9185         (JSC::DFG::::startBumpingIn):
9186         * dfg/DFGByteCodeParser.cpp:
9187         (JSC::DFG::ByteCodeParser::addToGraph):
9188         (JSC::DFG::ByteCodeParser::handleMinMax):
9189         * dfg/DFGCSEPhase.cpp:
9190         (JSC::DFG::CSEPhase::setLocalStoreElimination):
9191         (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
9192         (JSC::DFG::CSEPhase::setReplacement):
9193         (JSC::DFG::CSEPhase::performNodeCSE):
9194         * dfg/DFGCommon.h:
9195         (DFG):
9196         * dfg/DFGConstantFoldingPhase.cpp:
9197         (JSC::DFG::ConstantFoldingPhase::foldConstants):
9198         (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
9199         * dfg/DFGDriver.cpp:
9200         (JSC::DFG::compile):
9201         * dfg/DFGEdge.cpp:
9202         (JSC::DFG::Edge::dump):
9203         * dfg/DFGEdge.h:
9204         (JSC::DFG::Edge::useKindUnchecked):
9205         (JSC::DFG::Edge::useKind):
9206         (JSC::DFG::Edge::shift):
9207         * dfg/DFGFixupPhase.cpp:
9208         (JSC::DFG::FixupPhase::run):
9209         (JSC::DFG::FixupPhase::fixupNode):
9210         (JSC::DFG::FixupPhase::checkArray):
9211         (JSC::DFG::FixupPhase::blessArrayOperation):
9212         (JSC::DFG::FixupPhase::fixIntEdge):
9213         (JSC::DFG::FixupPhase::fixDoubleEdge):
9214         (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
9215         (FixupPhase):
9216         (JSC::DFG::FixupPhase::truncateConstantToInt32):
9217         (JSC::DFG::FixupPhase::truncateConstantsIfNecessary):
9218         (JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
9219         * dfg/DFGGraph.cpp:
9220         (DFG):
9221         (JSC::DFG::Graph::refChildren):
9222         (JSC::DFG::Graph::derefChildren):
9223         * dfg/DFGGraph.h:
9224         (JSC::DFG::Graph::ref):
9225         (JSC::DFG::Graph::deref):
9226         (JSC::DFG::Graph::performSubstitution):
9227         (JSC::DFG::Graph::isPredictedNumerical):
9228         (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
9229         (DFG):
9230         * dfg/DFGNode.h:
9231         (JSC::DFG::Node::Node):
9232         (JSC::DFG::Node::convertToGetByOffset):
9233         (JSC::DFG::Node::convertToPutByOffset):
9234         (JSC::DFG::Node::willHaveCodeGenOrOSR):
9235         (JSC::DFG::Node::child1):
9236         (JSC::DFG::Node::child2):
9237         (JSC::DFG::Node::child3):
9238         (JSC::DFG::Node::binaryUseKind):
9239         (Node):
9240         (JSC::DFG::Node::isBinaryUseKind):
9241         * dfg/DFGNodeAllocator.h:
9242         (DFG):
9243         * dfg/DFGNodeFlags.cpp:
9244         (JSC::DFG::nodeFlagsAsString):
9245         * dfg/DFGNodeType.h:
9246         (DFG):
9247         * dfg/DFGPredictionPropagationPhase.cpp:
9248         (JSC::DFG::PredictionPropagationPhase::propagate):
9249         * dfg/DFGSpeculativeJIT.cpp:
9250         (JSC::DFG::SpeculativeJIT::speculationCheck):
9251         (DFG):
9252         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
9253         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
9254         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
9255         (JSC::DFG::SpeculativeJIT::typeCheck):
9256         (JSC::DFG::SpeculativeJIT::forwardTypeCheck):
9257         (JSC::DFG::SpeculativeJIT::fillStorage):
9258         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
9259         (JSC::DFG::SpeculativeJIT::compile):
9260         (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
9261         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
9262         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
9263         (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
9264         (JSC::DFG::SpeculativeJIT::compileInstanceOf):
9265         (JSC::DFG::SpeculativeJIT::compileAdd):
9266         (JSC::DFG::SpeculativeJIT::compileArithSub):
9267         (JSC::DFG::SpeculativeJIT::compileArithNegate):
9268         (JSC::DFG::SpeculativeJIT::compileArithMul):
9269         (JSC::DFG::SpeculativeJIT::compileArithMod):
9270         (JSC::DFG::SpeculativeJIT::compare):
9271         (JSC::DFG::SpeculativeJIT::compileStrictEq):
9272         (JSC::DFG::SpeculativeJIT::speculateInt32):
9273         (JSC::DFG::SpeculativeJIT::speculateNumber):
9274         (JSC::DFG::SpeculativeJIT::speculateRealNumber):
9275         (JSC::DFG::SpeculativeJIT::speculateBoolean):
9276         (JSC::DFG::SpeculativeJIT::speculateCell):
9277         (JSC::DFG::SpeculativeJIT::speculateObject):
9278         (JSC::DFG::SpeculativeJIT::speculateObjectOrOther):
9279         (JSC::DFG::SpeculativeJIT::speculateString):
9280         (JSC::DFG::SpeculativeJIT::speculateNotCell):
9281         (JSC::DFG::SpeculativeJIT::speculateOther):
9282         (JSC::DFG::SpeculativeJIT::speculate):
9283         * dfg/DFGSpeculativeJIT.h:
9284         (SpeculativeJIT):
9285         (JSC::DFG::SpeculativeJIT::valueOfNumberConstant):
9286         (JSC::DFG::SpeculativeJIT::needsTypeCheck):
9287         (JSC::DFG::IntegerOperand::IntegerOperand):
9288         (JSC::DFG::IntegerOperand::edge):
9289         (IntegerOperand):
9290         (JSC::DFG::IntegerOperand::node):
9291         (JSC::DFG::IntegerOperand::gpr):
9292         (JSC::DFG::IntegerOperand::use):
9293         (JSC::DFG::JSValueOperand::JSValueOperand):
9294         (JSValueOperand):
9295         (JSC::DFG::JSValueOperand::edge):
9296         (JSC::DFG::JSValueOperand::node):
9297         (JSC::DFG::JSValueOperand::gpr):
9298         (JSC::DFG::JSValueOperand::fill):
9299         (JSC::DFG::JSValueOperand::use):
9300         (JSC::DFG::StorageOperand::StorageOperand):
9301         (JSC::DFG::StorageOperand::edge):
9302         (StorageOperand):
9303         (JSC::DFG::StorageOperand::node):
9304         (JSC::DFG::StorageOperand::gpr):
9305         (JSC::DFG::StorageOperand::use):
9306         (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
9307         (SpeculateIntegerOperand):
9308         (JSC::DFG::SpeculateIntegerOperand::edge):
9309         (JSC::DFG::SpeculateIntegerOperand::node):
9310         (JSC::DFG::SpeculateIntegerOperand::gpr):
9311         (JSC::DFG::SpeculateIntegerOperand::use):
9312         (JSC::DFG::SpeculateStrictInt32Operand::SpeculateStrictInt32Operand):
9313         (SpeculateStrictInt32Operand):
9314         (JSC::DFG::SpeculateStrictInt32Operand::edge):
9315         (JSC::DFG::SpeculateStrictInt32Operand::node):
9316         (JSC::DFG::SpeculateStrictInt32Operand::gpr):
9317         (JSC::DFG::SpeculateStrictInt32Operand::use):
9318         (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
9319         (SpeculateDoubleOperand):
9320         (JSC::DFG::SpeculateDoubleOperand::edge):
9321         (JSC::DFG::SpeculateDoubleOperand::node):
9322         (JSC::DFG::SpeculateDoubleOperand::fpr):
9323         (JSC::DFG::SpeculateDoubleOperand::use):
9324         (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
9325         (SpeculateCellOperand):
9326         (JSC::DFG::SpeculateCellOperand::edge):
9327         (JSC::DFG::SpeculateCellOperand::node):
9328         (JSC::DFG::SpeculateCellOperand::gpr):
9329         (JSC::DFG::SpeculateCellOperand::use):
9330         (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
9331         (JSC::DFG::SpeculateBooleanOperand::edge):
9332         (SpeculateBooleanOperand):
9333         (JSC::DFG::SpeculateBooleanOperand::node):
9334         (JSC::DFG::SpeculateBooleanOperand::gpr):
9335         (JSC::DFG::SpeculateBooleanOperand::use):
9336         (DFG):
9337         * dfg/DFGSpeculativeJIT32_64.cpp:
9338         (JSC::DFG::SpeculativeJIT::fillInteger):
9339         (JSC::DFG::SpeculativeJIT::fillJSValue):
9340         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
9341         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
9342         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
9343         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
9344         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
9345         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
9346         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
9347         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
9348         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
9349         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
9350         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
9351         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
9352         (JSC::DFG::SpeculativeJIT::emitBranch):
9353         (JSC::DFG::SpeculativeJIT::compile):
9354         * dfg/DFGSpeculativeJIT64.cpp:
9355         (JSC::DFG::SpeculativeJIT::fillInteger):
9356         (JSC::DFG::SpeculativeJIT::fillJSValue):
9357         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
9358         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
9359         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
9360         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
9361         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
9362         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
9363         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
9364         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
9365         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
9366         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
9367         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
9368         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
9369         (JSC::DFG::SpeculativeJIT::emitBranch):
9370         (JSC::DFG::SpeculativeJIT::compile):
9371         * dfg/DFGStructureCheckHoistingPhase.cpp:
9372         (JSC::DFG::StructureCheckHoistingPhase::run):
9373         * dfg/DFGUseKind.cpp: Added.
9374         (WTF):
9375         (WTF::printInternal):
9376         * dfg/DFGUseKind.h: Added.
9377         (DFG):
9378         (JSC::DFG::typeFilterFor):
9379         (JSC::DFG::isNumerical):
9380         (WTF):
9381         * dfg/DFGValidate.cpp:
9382         (JSC::DFG::Validate::reportValidationContext):
9383
9384 2013-02-20  Mark Hahnenberg  <mhahnenberg@apple.com>
9385
9386         Objective-C API: Need a way to use the Objective-C JavaScript API with WebKit
9387         https://bugs.webkit.org/show_bug.cgi?id=106059
9388
9389         Reviewed by Geoffrey Garen.
9390
9391         * API/JSBase.h: Renamed enable flag for API.
9392         * API/JSBlockAdaptor.h: Using new flag.
9393         * API/JSBlockAdaptor.mm: Ditto.
9394         * API/JSContext.h: Add convenience C API conversion function for JSGlobalContextRef.
9395         * API/JSContext.mm:
9396         (-[JSContext JSGlobalContextRef]): Implementation of C API convenience function.
9397         (-[JSContext initWithVirtualMachine:]): We don't use the m_apiData field any more.
9398         (-[JSContext initWithGlobalContextRef:]): init method for allocating new JSContexts given a JSGlobalContextRef.
9399         (-[JSContext dealloc]): No more m_apiData.
9400         (-[JSContext wrapperForObjCObject:]): Renamed wrapperForObject.
9401         (-[JSContext wrapperForJSObject:]): Fetches or allocates the JSValue for the specified JSValueRef in this JSContext.
9402         (+[JSContext contextWithGlobalContextRef:]): Helper function to grab the lightweight JSContext wrapper for a given
9403         JSGlobalContextRef from the global wrapper cache or allocate a new one if there isn't already one.
9404         * API/JSContextInternal.h: New flag, new method declaration for initWithGlobalContextRef.
9405         * API/JSExport.h: New flag.
9406         * API/JSValue.h: New flag and new C API convenience method.
9407         * API/JSValue.mm:
9408         (-[JSValue JSValueRef]): Implementation of the C API convenience method.
9409         (objectToValueWithoutCopy):
9410         (+[JSValue valueWithValue:inContext:]): We now ask the JSContext for an Objective-C JSValue wrapper, which it can cache
9411         in its internal JSWrapperMap.
9412         * API/JSValueInternal.h:
9413         * API/JSVirtualMachine.h:
9414         * API/JSVirtualMachine.mm: Added global cache that maps JSContextGroupRef -> JSVirtualMachine lightweight wrappers.
9415         (wrapperCacheLock):
9416         (initWrapperCache):
9417         (+[JSVMWrapperCache addWrapper:forJSContextGroupRef:]):
9418         (+[JSVMWrapperCache wrapperForJSContextGroupRef:]):
9419         (-[JSVirtualMachine init]):
9420         (-[JSVirtualMachine initWithContextGroupRef:]):
9421         (-[JSVirtualMachine dealloc]):
9422         (+[JSVirtualMachine virtualMachineWithContextGroupRef:]):
9423         (-[JSVirtualMachine contextForGlobalContextRef:]):
9424         (-[JSVirtualMachine addContext:forGlobalContextRef:]):
9425         * API/JSVirtualMachineInternal.h:
9426         * API/JSWrapperMap.h:
9427         * API/JSWrapperMap.mm:
9428         (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]): We use the JSObjectSetPrototype C API call because
9429         setting the __proto__ property causes all sorts of bad things to happen behind the scenes, which can cause crashes based on
9430         when it gets called.
9431         (-[JSWrapperMap initWithContext:]):
9432         (-[JSWrapperMap jsWrapperForObject:]):
9433         (-[JSWrapperMap objcWrapperForJSValueRef:]):
9434         * API/JavaScriptCore.h:
9435         * API/ObjCCallbackFunction.h:
9436         * API/ObjCCallbackFunction.mm:
9437         (ObjCCallbackFunction::ObjCCallbackFunction): We never actually should have retained the target in the case that we had a
9438         block as a callback. Blocks are initially allocated on the stack and are only moved to the heap if we call their copy method.
9439         Retaining the block on the stack was a bad idea because if that stack frame ever went away and we called the block later,
9440         we'd crash and burn.
9441         (ObjCCallbackFunction::setContext): We need a new setter for when the weak reference to a JSContext inside an ObjCCallbackFunction
9442         disappears, we can allocate a new one in its place.
9443         (ObjCCallbackFunction):
9444         (objCCallbackFunctionCallAsFunction): Reset the callback's context if it's ever destroyed.
9445         (objCCallbackFunctionForInvocation): Again, don't set the __proto__ property because it uses black magic that can cause us to crash
9446         depending on when this is called.
9447         (objCCallbackFunctionForBlock): Here is where we copy the block to the heap when we're first creating the callback object for it.
9448         * API/tests/testapi.c:
9449         (main):
9450         * API/tests/testapi.mm: We're going to get rid of the automatic block conversion, since that is causing leaks. I changed it
9451         here in this test just so that it wouldn't mask any other potential leaks. Also modified some of the tests since JSContexts are
9452         just lightweight wrappers now, we're not guaranteed to get the same pointer back from the call to [JSValue context] as the one
9453         that the value was created in.
9454         (-[TestObject callback:]):
9455         * JavaScriptCore.xcodeproj/project.pbxproj:
9456         * runtime/JSGlobalData.cpp:
9457         (JSC::JSGlobalData::JSGlobalData): No more m_apiData.
9458         * runtime/JSGlobalData.h: Ditto.
9459         * runtime/JSGlobalObject.cpp:
9460         (JSC::JSGlobalObject::JSGlobalObject): Ditto.
9461         * runtime/JSGlobalObject.h:
9462
9463 2013-02-19  Filip Pizlo  <fpizlo@apple.com>
9464
9465         DFG::SpeculativeJIT::compileInt32ToDouble() has an unnecessary case for constant operands
9466         https://bugs.webkit.org/show_bug.cgi?id=110309
9467
9468         Reviewed by Sam Weinig.
9469
9470         It used to be necessary, back when we didn't have constant folding. Now we have
9471         constant folding. So we don't need it.
9472
9473         * dfg/DFGSpeculativeJIT.cpp:
9474         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
9475
9476 2013-02-20  Filip Pizlo  <fpizlo@apple.com>
9477
9478         DFG inlines Resolves that it doesn't know how to handle correctly
9479         https://bugs.webkit.org/show_bug.cgi?id=110405
9480
9481         Reviewed by Geoffrey Garen.
9482
9483         Don't try to be clever: if there's a failing resolve, we can't inline it, period.
9484
9485         * dfg/DFGCapabilities.h:
9486         (JSC::DFG::canInlineResolveOperations):
9487         (JSC::DFG::canInlineOpcode):
9488
9489 2013-02-20  Roger Fong  <roger_fong@apple.com>
9490
9491         Get VS2010 Solution B&I ready.
9492         <rdar://problem/1322988>
9493
9494         Rubberstamped by Timothy Horton.
9495
9496         Add Production configuration.
9497         Add a JavaScriptCore submit solution with a DebugSuffix configuration.
9498         Modify JavaScriptCore.make as necessary.
9499
9500         * JavaScriptCore.vcxproj/JavaScriptCore.make: Added.
9501         * JavaScriptCore.vcxproj/JavaScriptCore.sln: Removed.
9502         * JavaScriptCore.vcxproj/JavaScriptCore.submit.sln: Copied from Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.sln.
9503         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
9504         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
9505         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj:
9506         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props:
9507         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd:
9508         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPreBuild.cmd:
9509         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorProduction.props: Added.
9510         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorRelease.props:
9511         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj:
9512         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj.filters:
9513         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedProduction.props: Added.
9514         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedRelease.props:
9515         * JavaScriptCore.vcxproj/JavaScriptCoreProduction.props: Added.
9516         * JavaScriptCore.vcxproj/JavaScriptCoreRelease.props:
9517         * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/LLIntAssembly.vcxproj:
9518         * JavaScriptCore.vcxproj/LLInt/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj:
9519         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj:
9520         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
9521         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props:
9522         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorProduction.props: Added.
9523         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.props:
9524         * JavaScriptCore.vcxproj/jsc/jsc.vcxproj:
9525         * JavaScriptCore.vcxproj/jsc/jscCommon.props:
9526         * JavaScriptCore.vcxproj/jsc/jscProduction.props: Added.
9527         * JavaScriptCore.vcxproj/jsc/jscRelease.props:
9528         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
9529         * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props:
9530         * JavaScriptCore.vcxproj/testRegExp/testRegExpProduction.props: Added.
9531         * JavaScriptCore.vcxproj/testRegExp/testRegExpRelease.props:
9532         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj:
9533         * JavaScriptCore.vcxproj/testapi/testapiCommon.props:
9534         * JavaScriptCore.vcxproj/testapi/testapiProduction.props: Added.
9535         * JavaScriptCore.vcxproj/testapi/testapiRelease.props:
9536
9537 2013-02-19  Jer Noble  <jer.noble@apple.com>
9538
9539         EME: Enable both ENCRYPTED_MEDIA and ENCRYPTED_MEDIA_V2 until clients transition to the new API.
9540         https://bugs.webkit.org/show_bug.cgi?id=110284
9541
9542         Reviewed by Eric Carlson.
9543
9544         Re-enable the ENCRYPTED_MEDIA flag.
9545
9546         * Configurations/FeatureDefines.xcconfig:
9547
9548 2013-02-20  Dirk Schulze  <krit@webkit.org>
9549
9550         Enable CANVAS_PATH flag
9551         https://bugs.webkit.org/show_bug.cgi?id=108508
9552
9553         Reviewed by Simon Fraser.
9554
9555         Enable CANVAS_PATH flag on trunk.
9556
9557         Existing tests cover the feature.
9558
9559         * Configurations/FeatureDefines.xcconfig:
9560
9561 2013-02-19  Mark Rowe  <mrowe@apple.com>
9562
9563         Unreviewed, uninteresting change to test a theory about bad dependency handling.
9564
9565         * API/JSStringRefCF.cpp:
9566         (JSStringCreateWithCFString): Remove an unnecessary else clause.
9567
9568 2013-02-19  Oliver Hunt  <oliver@apple.com>
9569
9570         Silence some analyzer warnings
9571         https://bugs.webkit.org/show_bug.cgi?id=110281
9572
9573         Reviewed by Mark Hahnenberg.
9574
9575         The static analyzer believes that callerCodeBlock can be null,
9576         based on other code performing null tests.  This should not
9577         ever be the case, but we'll add RELEASE_ASSERTs to make it
9578         obvious if we're ever wrong.
9579
9580         * interpreter/Interpreter.cpp:
9581         (JSC::getCallerInfo):
9582
9583 2013-02-19  Oliver Hunt  <oliver@apple.com>
9584
9585         Don't force everything to be blinded in debug builds
9586         https://bugs.webkit.org/show_bug.cgi?id=110279
9587
9588         Reviewed by Mark Hahnenberg.
9589
9590         Switch to an explicit flag for indicating that we want
9591         every constant to be blinded.
9592
9593         * assembler/MacroAssembler.h:
9594         (JSC::MacroAssembler::shouldBlind):
9595
9596 2013-02-19  Filip Pizlo  <fpizlo@apple.com>
9597
9598         Fix indentation of Opcode.h
9599
9600         Rubber stamped by Mark Hahnenberg.
9601
9602         * bytecode/Opcode.h:
9603
9604 2013-02-19  Filip Pizlo  <fpizlo@apple.com>
9605
9606         Moved PolymorphicAccessStructureList into its own file.
9607
9608         Rubber stamped by Mark Hahnenberg.
9609
9610         * GNUmakefile.list.am:
9611         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
9612         * JavaScriptCore.xcodeproj/project.pbxproj:
9613         * bytecode/Instruction.h:
9614         (JSC):
9615         * bytecode/PolymorphicAccessStructureList.h: Added.
9616         (JSC):
9617         (PolymorphicAccessStructureList):
9618         (PolymorphicStubInfo):
9619         (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::PolymorphicStubInfo):
9620         (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
9621         (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
9622         (JSC::PolymorphicAccessStructureList::visitWeak):
9623         * bytecode/StructureStubInfo.h:
9624
9625 2013-02-19  Filip Pizlo  <fpizlo@apple.com>
9626
9627         Fix indentation of Instruction.h
9628
9629         Rubber stamped by Mark Hahnenberg.
9630
9631         * bytecode/Instruction.h:
9632
9633 2013-02-18  Geoffrey Garen  <ggaren@apple.com>
9634
9635         Unreviewed, rolling in r143348.
9636         http://trac.webkit.org/changeset/143348
9637         https://bugs.webkit.org/show_bug.cgi?id=110242
9638
9639         The bug was that isEmptyValue() was returning true for the deleted value.
9640         Fixed this and simplified things further by delegating to m_sourceCode
9641         for both isNull() and isHashTableDeletedValue(), so they can't be out of
9642         sync.
9643
9644         * runtime/CodeCache.cpp:
9645         (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
9646         * runtime/CodeCache.h:
9647         (JSC::SourceCodeKey::SourceCodeKey):
9648         (JSC::SourceCodeKey::isHashTableDeletedValue):
9649         (JSC::SourceCodeKey::hash):
9650         (JSC::SourceCodeKey::length):
9651         (JSC::SourceCodeKey::isNull):
9652         (JSC::SourceCodeKey::operator==):
9653         (SourceCodeKey):
9654
9655 2013-02-15  Martin Robinson  <mrobinson@igalia.com>
9656
9657         [GTK] Improve gyp build JavaScriptCore code generation
9658         https://bugs.webkit.org/show_bug.cgi?id=109969
9659
9660         Reviewed by Dirk Pranke.
9661
9662         Switch away from using DerivedSources.make when building JavaScriptCore generated
9663         sources. This bring a couple advantages, such as building the sources in parallel,
9664         but requires us to list the generated sources more than once.
9665
9666         * JavaScriptCore.gyp/JavaScriptCoreGTK.gyp: Add rules for generating JavaScriptCore sources.
9667         * JavaScriptCore.gyp/generate-derived-sources.sh: Added.
9668         * JavaScriptCore.gyp/redirect-stdout.sh: Added.
9669
9670 2013-02-19  Sheriff Bot  <webkit.review.bot@gmail.com>
9671
9672         Unreviewed, rolling out r143348.
9673         http://trac.webkit.org/changeset/143348
9674         https://bugs.webkit.org/show_bug.cgi?id=110242
9675
9676         "Caused a deleted value sentinel crash on the layout tests"
9677         (Requested by ggaren on #webkit).
9678
9679         * runtime/CodeCache.cpp:
9680         (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
9681         * runtime/CodeCache.h:
9682         (JSC::SourceCodeKey::SourceCodeKey):
9683         (JSC::SourceCodeKey::isHashTableDeletedValue):
9684         (JSC::SourceCodeKey::hash):
9685         (JSC::SourceCodeKey::length):
9686         (JSC::SourceCodeKey::isNull):
9687         (JSC::SourceCodeKey::operator==):
9688         (SourceCodeKey):
9689
9690 2013-02-19  Mark Hahnenberg  <mhahnenberg@apple.com>
9691
9692         HeapBlock::destroy should issue warning if result is unused
9693         https://bugs.webkit.org/show_bug.cgi?id=110233
9694
9695         Reviewed by Oliver Hunt.
9696
9697         To enforce the fact that we need to return blocks to the BlockAllocator after calling destroy,
9698         we should add WARN_UNUSED_RETURN to HeapBlock::destroy and any other destroy functions in its subclasses.
9699
9700         * heap/HeapBlock.h:
9701
9702 2013-02-19  Mark Hahnenberg  <mhahnenberg@apple.com>
9703
9704         WeakSet::removeAllocator leaks WeakBlocks
9705         https://bugs.webkit.org/show_bug.cgi?id=110228
9706
9707         Reviewed by Geoffrey Garen.
9708
9709         We need to return the WeakBlock to the BlockAllocator after the call to WeakBlock::destroy.
9710
9711         * heap/WeakSet.cpp:
9712         (JSC::WeakSet::removeAllocator):
9713
9714 2013-02-18  Geoffrey Garen  <ggaren@apple.com>
9715
9716         Save space on keys in the CodeCache
9717         https://bugs.webkit.org/show_bug.cgi?id=110179
9718
9719         Reviewed by Oliver Hunt.
9720
9721         Share the SourceProvider's string instead of making our own copy. This
9722         chops off 16MB - 32MB from the CodeCache's memory footprint when full.
9723         (It's 16MB when the strings are LChar, and 32MB when they're UChar.)
9724
9725         * runtime/CodeCache.cpp:
9726         (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
9727         * runtime/CodeCache.h: Removed a defunct enum value.
9728
9729         (JSC::SourceCodeKey::SourceCodeKey):
9730         (JSC::SourceCodeKey::isHashTableDeletedValue):
9731         (SourceCodeKey):
9732         (JSC::SourceCodeKey::hash):
9733         (JSC::SourceCodeKey::length):
9734         (JSC::SourceCodeKey::isNull):
9735         (JSC::SourceCodeKey::string):
9736         (JSC::SourceCodeKey::operator==): Store a SourceCode instead of a String
9737         so we can share our string with our SourceProvider. Cache our hash so
9738         we don't have to re-decode our string just to re-hash the table.
9739
9740 2013-02-19  Zoltan Herczeg  <zherczeg@webkit.org>
9741
9742         revertBranchPtrWithPatch is incorrect on ARM traditional
9743         https://bugs.webkit.org/show_bug.cgi?id=110201
9744
9745         Reviewed by Oliver Hunt.
9746
9747         Revert two instructions back to their original value.
9748
9749         * assembler/ARMAssembler.h:
9750         (JSC::ARMAssembler::revertBranchPtrWithPatch):
9751         (ARMAssembler):
9752         * assembler/MacroAssemblerARM.h:
9753         (JSC::MacroAssemblerARM::branchPtrWithPatch):
9754         (JSC::MacroAssemblerARM::revertJumpReplacementToBranchPtrWithPatch):
9755
9756 2013-02-19  Filip Pizlo  <fpizlo@apple.com>
9757
9758         REGRESSION(r143241): It made 27 layout tests crash on 32 bit platforms
9759         https://bugs.webkit.org/show_bug.cgi?id=110184
9760
9761         Reviewed by Zoltan Herczeg.
9762
9763         32-bit backend was making all sorts of crazy assumptions, which happened to mostly
9764         not break things prior to http://trac.webkit.org/changeset/143241. This brings the
9765         32-bit backend's type speculation fully into compliance with what the 64-bit
9766         backend does.
9767
9768         * dfg/DFGSpeculativeJIT.cpp:
9769         (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
9770         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
9771         * dfg/DFGSpeculativeJIT32_64.cpp:
9772         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
9773         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
9774         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
9775         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
9776
9777 2013-02-18  Ilya Tikhonovsky  <loislo@chromium.org>
9778
9779         Unreviewed build fix for Apple Windows. Second stage.
9780         Add missed export statement.
9781
9782         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
9783
9784 2013-02-18  Roger Fong  <roger_fong@apple.com>
9785
9786         Unreviewed Windows build fix.
9787
9788         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
9789         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
9790
9791 2013-02-18  Darin Adler  <darin@apple.com>
9792
9793         Remove unneeded explicit function template arguments.
9794         https://bugs.webkit.org/show_bug.cgi?id=110043
9795
9796         Reviewed by Ryosuke Niwa.
9797
9798         * runtime/Identifier.cpp:
9799         (JSC::IdentifierASCIIStringTranslator::hash): Let the compiler deduce the type
9800         when calling computeHashAndMaskTop8Bits.
9801         (JSC::IdentifierLCharFromUCharTranslator::hash): Ditto.
9802         * runtime/Identifier.h:
9803         (JSC::IdentifierCharBufferTranslator::hash): Ditto.
9804 2013-02-18  Geoffrey Garen  <ggaren@apple.com>
9805
9806         Shrank the SourceProvider cache
9807         https://bugs.webkit.org/show_bug.cgi?id=110158
9808
9809         Reviewed by Oliver Hunt.
9810
9811         CodeCache is now our primary source cache, so a long-lived SourceProvider
9812         cache is a waste. I measured this as a 10MB Membuster win; with more
9813         precise instrumentation, Andreas estimated it as up to 30MB.
9814
9815         I didn't eliminate the SourceProvider cache because it's still useful
9816         in speeding up uncached parsing of scripts with large nested functions
9817         (i.e., all scripts).
9818
9819         * heap/Heap.cpp:
9820         (JSC::Heap::collect): Discard all source provider caches after GC. This
9821         is a convenient place to do so because it's reasonably soon after initial
9822         parsing without being immediate.
9823
9824         * parser/Parser.cpp:
9825         (JSC::::Parser): Updated for interface change: The heap now owns the
9826         source provider cache, since most SourceProviders are not expected to
9827         have one by default, and the heap is responsible for throwing them away.
9828
9829         (JSC::::parseInner): No need to update statistics on cache size, since
9830         we're going to throw it away no matter what.
9831
9832         (JSC::::parseFunctionInfo): Reduced the minimum function size to 16. This
9833         is a 27% win on a new parsing micro-benchmark I've added. Now that the
9834         cache is temporary, we don't have to worry so much about its memory
9835         footprint.
9836
9837         * parser/Parser.h:
9838         (Parser): Updated for interface changes.
9839
9840         * parser/SourceProvider.cpp:
9841         (JSC::SourceProvider::SourceProvider):
9842         (JSC::SourceProvider::~SourceProvider):
9843         * parser/SourceProvider.h:
9844         (JSC):
9845         (SourceProvider): SourceProvider doesn't own its cache anymore because
9846         the cache is temporary.
9847
9848         * parser/SourceProviderCache.cpp:
9849         (JSC::SourceProviderCache::clear):
9850         (JSC::SourceProviderCache::add):
9851         * parser/SourceProviderCache.h:
9852         (JSC::SourceProviderCache::SourceProviderCache):
9853         (SourceProviderCache):
9854         * parser/SourceProviderCacheItem.h:
9855         (SourceProviderCacheItem): No need to update statistics on cache size,
9856         since we're going to throw it away no matter what.
9857
9858         * runtime/JSGlobalData.cpp:
9859         (JSC::JSGlobalData::addSourceProviderCache):
9860         (JSC):
9861         (JSC::JSGlobalData::clearSourceProviderCaches):
9862         * runtime/JSGlobalData.h:
9863         (JSC):
9864         (JSGlobalData): Moved the cache here so it's easier to throw away.
9865
9866 2013-02-18  Filip Pizlo  <fpizlo@apple.com>
9867
9868         DFG backend Branch handling has duplicate code and dead code
9869         https://bugs.webkit.org/show_bug.cgi?id=110162
9870
9871         Reviewed by Mark Hahnenberg.
9872
9873         Streamline the code, and make the 64 backend's optimizations make more sense
9874         (i.e. not be dead code).
9875
9876         * dfg/DFGSpeculativeJIT32_64.cpp:
9877         (JSC::DFG::SpeculativeJIT::compile):
9878         * dfg/DFGSpeculativeJIT64.cpp:
9879         (JSC::DFG::SpeculativeJIT::emitBranch):
9880         (JSC::DFG::SpeculativeJIT::compile):
9881
9882 2013-02-18  Brent Fulgham  <bfulgham@webkit.org>
9883
9884         [Windows] Unreviewed VS2010 build correction after r143273.
9885
9886         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Add missing source
9887         file SourceProvider.cpp.
9888         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
9889         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in: Add missing exports.
9890
9891 2013-02-18  Filip Pizlo  <fpizlo@apple.com>
9892
9893         Structure::flattenDictionaryStructure should compute max offset in a manner that soundly handles the case where the property list becomes empty
9894         https://bugs.webkit.org/show_bug.cgi?id=110155
9895         <rdar://problem/13233773>
9896
9897         Reviewed by Mark Rowe.
9898
9899         This was a rookie mistake.  It was doing:
9900
9901         for (blah) {
9902             m_offset = foo // foo's monotonically increase in the loop
9903         }
9904
9905         as a way of computing max offset for all of the properties.  Except what if the loop doesn't
9906         execute because there are no properties?  Well, then, you're going to have a bogus m_offset.
9907
9908         The solution is to initialize m_offset at the top of the loop.
9909
9910         * runtime/Structure.cpp:
9911         (JSC::Structure::flattenDictionaryStructure):
9912
9913 2013-02-18  Balazs Kilvady  <kilvadyb@homejinni.com>
9914
9915         MIPS DFG implementation.
9916         https://bugs.webkit.org/show_bug.cgi?id=101328
9917
9918         Reviewed by Oliver Hunt.
9919
9920         DFG implementation for MIPS.
9921
9922         * assembler/MIPSAssembler.h:
9923         (JSC::MIPSAssembler::MIPSAssembler):
9924         (JSC::MIPSAssembler::sllv):
9925         (JSC::MIPSAssembler::movd):
9926         (MIPSAssembler):
9927         (JSC::MIPSAssembler::negd):
9928         (JSC::MIPSAssembler::labelForWatchpoint):
9929         (JSC::MIPSAssembler::label):
9930         (JSC::MIPSAssembler::vmov):
9931         (JSC::MIPSAssembler::linkDirectJump):
9932         (JSC::MIPSAssembler::maxJumpReplacementSize):
9933         (JSC::MIPSAssembler::revertJumpToMove):
9934         (JSC::MIPSAssembler::replaceWithJump):
9935         * assembler/MacroAssembler.h:
9936         (MacroAssembler):
9937         (JSC::MacroAssembler::poke):
9938         * assembler/MacroAssemblerMIPS.h:
9939         (JSC::MacroAssemblerMIPS::add32):
9940         (MacroAssemblerMIPS):
9941         (JSC::MacroAssemblerMIPS::and32):
9942         (JSC::MacroAssemblerMIPS::lshift32):
9943         (JSC::MacroAssemblerMIPS::mul32):
9944         (JSC::MacroAssemblerMIPS::or32):
9945         (JSC::MacroAssemblerMIPS::rshift32):
9946         (JSC::MacroAssemblerMIPS::urshift32):
9947         (JSC::MacroAssemblerMIPS::sub32):
9948         (JSC::MacroAssemblerMIPS::xor32):
9949         (JSC::MacroAssemblerMIPS::store32):
9950         (JSC::MacroAssemblerMIPS::jump):
9951         (JSC::MacroAssemblerMIPS::branchAdd32):
9952         (JSC::MacroAssemblerMIPS::branchMul32):
9953         (JSC::MacroAssemblerMIPS::branchSub32):
9954         (JSC::MacroAssemblerMIPS::branchNeg32):
9955         (JSC::MacroAssemblerMIPS::call):
9956         (JSC::MacroAssemblerMIPS::loadDouble):
9957         (JSC::MacroAssemblerMIPS::moveDouble):
9958         (JSC::MacroAssemblerMIPS::swapDouble):
9959         (JSC::MacroAssemblerMIPS::subDouble):
9960         (JSC::MacroAssemblerMIPS::mulDouble):
9961         (JSC::MacroAssemblerMIPS::divDouble):
9962         (JSC::MacroAssemblerMIPS::negateDouble):
9963         (JSC::MacroAssemblerMIPS::branchEqual):
9964         (JSC::MacroAssemblerMIPS::branchNotEqual):
9965         (JSC::MacroAssemblerMIPS::branchTruncateDoubleToInt32):
9966         (JSC::MacroAssemblerMIPS::branchTruncateDoubleToUint32):
9967         (JSC::MacroAssemblerMIPS::truncateDoubleToInt32):
9968         (JSC::MacroAssemblerMIPS::truncateDoubleToUint32):
9969         (JSC::MacroAssemblerMIPS::branchDoubleNonZero):
9970         (JSC::MacroAssemblerMIPS::branchDoubleZeroOrNaN):
9971         (JSC::MacroAssemblerMIPS::invert):
9972         (JSC::MacroAssemblerMIPS::replaceWithJump):
9973         (JSC::MacroAssemblerMIPS::maxJumpReplacementSize):
9974         * dfg/DFGAssemblyHelpers.h:
9975         (AssemblyHelpers):
9976         (JSC::DFG::AssemblyHelpers::preserveReturnAddressAfterCall):
9977         (JSC::DFG::AssemblyHelpers::restoreReturnAddressBeforeReturn):
9978         (JSC::DFG::AssemblyHelpers::debugCall):
9979         * dfg/DFGCCallHelpers.h:
9980         (CCallHelpers):
9981         (JSC::DFG::CCallHelpers::setupArguments):
9982         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
9983         * dfg/DFGFPRInfo.h:
9984         (DFG):
9985         (FPRInfo):
9986         (JSC::DFG::FPRInfo::toRegister):
9987         (JSC::DFG::FPRInfo::toIndex):
9988         (JSC::DFG::FPRInfo::debugName):
9989         * dfg/DFGGPRInfo.h:
9990         (DFG):
9991         (GPRInfo):
9992         (JSC::DFG::GPRInfo::toRegister):
9993         (JSC::DFG::GPRInfo::toIndex):
9994         (JSC::DFG::GPRInfo::debugName):
9995         * dfg/DFGSpeculativeJIT.h:
9996         (SpeculativeJIT):
9997         * jit/JSInterfaceJIT.h:
9998         (JSInterfaceJIT):
9999         * runtime/JSGlobalData.h:
10000         (JSC::ScratchBuffer::allocationSize):
10001         (ScratchBuffer):
10002
10003 2013-02-18  Filip Pizlo  <fpizlo@apple.com>
10004
10005         DFG::SpeculativeJIT::isKnownXYZ methods should use CFA rather than other things
10006         https://bugs.webkit.org/show_bug.cgi?id=110092
10007
10008         Reviewed by Geoffrey Garen.
10009
10010         These methods were previously using GenerationInfo and other things to try to
10011         gain information that the CFA could give away for free, if you asked kindly
10012         enough.
10013
10014         Also fixed CallLinkStatus's dump() method since it was making an invalid
10015         assertion: we most certainly can have a status where the structure is non-null
10016         and the executable is null, like if we're dealing with an InternalFunction.
10017
10018         Also removed calls to isKnownNotXYZ from fillSpeculateABC methods in 32_64. I
10019         don't know why that was there. But it was causing asserts if the value was
10020         empty - i.e. we had already exited unconditionally but we didn't know it. I
10021         could have fixed this by introducing another form of isKnownNotXYZ which was
10022         tolerant of empty values, but I didn't feel like fixing code that I knew to be
10023         unnecessary. (More deeply, isKnownNotCell, for example, really asks: "do you
10024         know that this value can never be a cell?" while some of the previous uses
10025         wanted to ask: "do you know that this is a value that is not a cell?". The
10026         former is "true" if the value is a contradiction [i.e. BOTTOM], while the
10027         latter is "false" for contradictions, since contradictions are not values.)
10028
10029         * bytecode/CallLinkStatus.cpp:
10030         (JSC::CallLinkStatus::dump):
10031         * bytecode/CallLinkStatus.h:
10032         (JSC::CallLinkStatus::CallLinkStatus):
10033         * dfg/DFGSpeculativeJIT.cpp:
10034         (DFG):
10035         * dfg/DFGSpeculativeJIT.h:
10036         (JSC::DFG::SpeculativeJIT::isKnownInteger):
10037         (JSC::DFG::SpeculativeJIT::isKnownCell):
10038         (JSC::DFG::SpeculativeJIT::isKnownNotInteger):
10039         (JSC::DFG::SpeculativeJIT::isKnownNotNumber):
10040         (JSC::DFG::SpeculativeJIT::isKnownNotCell):
10041         * dfg/DFGSpeculativeJIT32_64.cpp:
10042         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
10043         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
10044         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
10045         * dfg/DFGStructureAbstractValue.h:
10046         (JSC::DFG::StructureAbstractValue::dump):
10047
10048 2013-02-17  Filip Pizlo  <fpizlo@apple.com>
10049
10050         Get rid of DFG::DoubleOperand and simplify ValueToInt32
10051         https://bugs.webkit.org/show_bug.cgi?id=110072
10052
10053         Reviewed by Geoffrey Garen.
10054
10055         ValueToInt32 had a side-effecting path, which was not OSR-friendly: an OSR after
10056         the side-effect would lead to the side-effect re-executing. I got rid of that path
10057         and replaced it with an optimization for the case where the input is speculated
10058         number-or-other. This makes idioms like null|0 and true|0 work as expected, and
10059         get optimized appropriately.
10060
10061         Also got rid of DoubleOperand. Replaced all remaining uses of it with
10062         SpeculateDoubleOperand. Because the latter asserts that the Edge is a DoubleUse
10063         edge and the remaining uses of DoubleOperand are all for untyped uses, I worked
10064         around the assertion by setting the UseKind to DoubleUse by force. This is sound,
10065         since all existing assertions for DoubleUse are actually asserting that we're not
10066         converting a value to double unexpectedly. But all of these calls to
10067         SpeculateDoubleOperand are when the operand is already known to be represented as
10068         double, so there is no conversion.
10069
10070         This is neutral on benchmarks, except stanford-crypto-ccm, which speeds up a
10071         little. Mostly, this is intended to delete a bunch of code. DoubleOperand was
10072         equivalent to the replace-edge-with-DoubleUse trick that I'm using now, except it
10073         involved a _lot_ more code.
10074
10075         * dfg/DFGAbstractState.cpp:
10076         (JSC::DFG::AbstractState::execute):
10077         * dfg/DFGCSEPhase.cpp:
10078         (JSC::DFG::CSEPhase::performNodeCSE):
10079         * dfg/DFGFixupPhase.cpp:
10080         (JSC::DFG::FixupPhase::fixupNode):
10081         * dfg/DFGNodeType.h:
10082         (DFG):
10083         * dfg/DFGSpeculativeJIT.cpp:
10084         (DFG):
10085         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
10086         * dfg/DFGSpeculativeJIT.h:
10087         (SpeculativeJIT):
10088         (DFG):
10089         (FPRTemporary):
10090         * dfg/DFGSpeculativeJIT32_64.cpp:
10091         (DFG):
10092         (JSC::DFG::SpeculativeJIT::compile):
10093         * dfg/DFGSpeculativeJIT64.cpp:
10094         (DFG):
10095
10096 2013-02-18  Ádám Kallai  <kadam@inf.u-szeged.hu>
10097
10098         [Qt] Mountain Lion buildfix after r143147.
10099
10100         Reviewed by Csaba Osztrogonác.
10101
10102         * runtime/DateConstructor.cpp:
10103
10104 2013-02-18  Zan Dobersek  <zdobersek@igalia.com>
10105
10106         Stop placing std::isfinite and std::signbit inside the global scope
10107         https://bugs.webkit.org/show_bug.cgi?id=109817
10108
10109         Reviewed by Darin Adler.
10110
10111         Prefix calls to the isfinite and signbit methods with std:: as the two
10112         methods are no longer being imported into the global scope.
10113
10114         * assembler/MacroAssembler.h:
10115         (JSC::MacroAssembler::shouldBlindDouble):
10116         * offlineasm/cloop.rb:
10117         * runtime/BigInteger.h:
10118         (JSC::BigInteger::BigInteger):
10119         * runtime/DateConstructor.cpp:
10120         (JSC::constructDate):
10121         * runtime/DatePrototype.cpp:
10122         (JSC::fillStructuresUsingTimeArgs):
10123         (JSC::fillStructuresUsingDateArgs):
10124         (JSC::dateProtoFuncToISOString):
10125         (JSC::dateProtoFuncSetYear):
10126         * runtime/JSCJSValueInlines.h:
10127         (JSC::JSValue::JSValue):
10128         * runtime/JSGlobalObjectFunctions.cpp:
10129         (JSC::globalFuncIsFinite):
10130         * runtime/JSONObject.cpp:
10131         (JSC::Stringifier::appendStringifiedValue):
10132         * runtime/MathObject.cpp:
10133         (JSC::mathProtoFuncMax): Also include an opportunistic style fix.
10134         (JSC::mathProtoFuncMin): Ditto.
10135         * runtime/NumberPrototype.cpp:
10136         (JSC::toStringWithRadix):
10137         (JSC::numberProtoFuncToExponential):
10138         (JSC::numberProtoFuncToFixed):
10139         (JSC::numberProtoFuncToPrecision):
10140         (JSC::numberProtoFuncToString):
10141         * runtime/Uint16WithFraction.h:
10142         (JSC::Uint16WithFraction::Uint16WithFraction):
10143
10144 2013-02-18  Ádám Kallai  <kadam@inf.u-szeged.hu>
10145
10146         [Qt] Mountain Lion buildfix after r143147.
10147
10148         Reviewed by Csaba Osztrogonác.
10149
10150         * runtime/DateInstance.cpp:
10151
10152 2013-02-18  Ilya Tikhonovsky  <loislo@chromium.org>
10153
10154         Unreviewed speculative build fix for Apple Win bots.
10155
10156         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
10157
10158 2013-02-18  Filip Pizlo  <fpizlo@apple.com>
10159
10160         Fix indentation of StructureStubInfo.h
10161
10162         Rubber stamped by Mark Hahnenberg.
10163
10164         * bytecode/StructureStubInfo.h:
10165
10166 2013-02-18  Filip Pizlo  <fpizlo@apple.com>
10167
10168         Fix indentation of JSGlobalObject.h and JSGlobalObjectFunctions.h
10169
10170         Rubber stamped by Mark Hahnenberg.
10171
10172         * runtime/JSGlobalObject.h:
10173         * runtime/JSGlobalObjectFunctions.h:
10174
10175 2013-02-18  Filip Pizlo  <fpizlo@apple.com>
10176
10177         Fix indention of Operations.h
10178
10179         Rubber stamped by Mark Hahnenberg.
10180
10181         * runtime/Operations.h:
10182
10183 2013-02-18  Filip Pizlo  <fpizlo@apple.com>
10184
10185         Remove DFG::SpeculativeJIT::isKnownNumeric(), since it's not called from anywhere.
10186
10187         Rubber stamped by Andy Estes.
10188
10189         * dfg/DFGSpeculativeJIT.cpp:
10190         (DFG):
10191         * dfg/DFGSpeculativeJIT.h:
10192         (SpeculativeJIT):
10193
10194 2013-02-18  Filip Pizlo  <fpizlo@apple.com>
10195
10196         Remove DFG::SpeculativeJIT::isStrictInt32(), since it's not called from anywhere.
10197
10198         Rubber stampted by Andy Estes.
10199
10200         * dfg/DFGSpeculativeJIT.cpp:
10201         (DFG):
10202         * dfg/DFGSpeculativeJIT.h:
10203         (SpeculativeJIT):
10204
10205 2013-02-18  Filip Pizlo  <fpizlo@apple.com>
10206
10207         Remove dead code for ValueToNumber from the DFG.
10208
10209         Rubber stamped by Andy Estes.
10210
10211         We killed ValueToNumber at some point, but forgot to kill all of the backend support
10212         for it.
10213
10214         * dfg/DFGByteCodeParser.cpp:
10215         (JSC::DFG::ByteCodeParser::handleMinMax):
10216         * dfg/DFGOperations.cpp:
10217         * dfg/DFGOperations.h:
10218         * dfg/DFGSpeculativeJIT.h:
10219         (SpeculativeJIT):
10220         * dfg/DFGSpeculativeJIT32_64.cpp:
10221         * dfg/DFGSpeculativeJIT64.cpp:
10222
10223 2013-02-17  Csaba Osztrogonác  <ossy@webkit.org>
10224
10225         Unreviewed buildfix for JSVALUE32_64 builds after r143147.
10226
10227         * jit/JIT.h:
10228
10229 2013-02-17  Filip Pizlo  <fpizlo@apple.com>
10230
10231         Move all Structure out-of-line inline methods to StructureInlines.h
10232         https://bugs.webkit.org/show_bug.cgi?id=110024
10233
10234         Rubber stamped by Mark Hahnenberg and Sam Weinig.
10235
10236         This was supposed to be easy.
10237
10238         But, initially, there was a Structure inline method in CodeBlock.h, and moving that
10239         into StructureInlines.h meant that Operations.h included CodeBlock.h. This would
10240         cause WebCore build failures, because CodeBlock.h transitively included the JSC
10241         parser (via many, many paths), and the JSC parser defines tokens using enumeration
10242         elements that CSSGrammar.cpp (generated by bison) would #define. For example,
10243         bison would give CSSGrammar.cpp a #define FUNCTION 123, and would do so before
10244         including anything interesting. The JSC parser would have an enum that included
10245         FUNCTION as an element. Hence the JSC parser included into CSSGrammar.cpp would have
10246         a token element called FUNCTION declared in an enumeration, but FUNCTION was
10247         #define'd to 123, leading to a parser error.
10248
10249         Wow.
10250
10251         So I removed all transitive include paths from CodeBlock.h to the JSC Parser. I
10252         believe I was able to do so without out-of-lining anything interesting or performance
10253         critical. This is probably a purely good thing to have done: it will be nice to be
10254         able to make changes to the parser without having to compile the universe.
10255
10256         Of course, doing this caused a bunch of other things to not compile, since a bunch of
10257         headers relied on things being implicitly included for them when they transitively
10258         included the parser. I fixed a lot of that.
10259
10260         Finally, I ended up removing the method that depended on CodeBlock.h from
10261         StructureInlines.h, and putting it in Structure.cpp. That might seem like all of this
10262         was a waste of time, except that I suspect it was a worthwhile forcing function for
10263         cleaning up a bunch of cruft.
10264
10265         * API/JSCallbackFunction.cpp:
10266         * CMakeLists.txt:
10267         * GNUmakefile.list.am:
10268         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
10269         * JavaScriptCore.xcodeproj/project.pbxproj:
10270         * Target.pri:
10271         * bytecode/CodeBlock.h:
10272         (JSC):
10273         * bytecode/EvalCodeCache.h:
10274         * bytecode/SamplingTool.h:
10275         * bytecode/UnlinkedCodeBlock.cpp:
10276         (JSC::UnlinkedFunctionExecutable::parameterCount):
10277         (JSC):
10278         * bytecode/UnlinkedCodeBlock.h:
10279         (UnlinkedFunctionExecutable):
10280         * bytecompiler/BytecodeGenerator.h:
10281         * bytecompiler/Label.h:
10282         (JSC):
10283         * dfg/DFGByteCodeParser.cpp:
10284         * dfg/DFGByteCodeParser.h:
10285         * dfg/DFGFPRInfo.h:
10286         * dfg/DFGRegisterBank.h:
10287         * heap/HandleStack.cpp:
10288         * jit/JITWriteBarrier.h:
10289         * parser/Nodes.h:
10290         (JSC):
10291         * parser/Parser.h:
10292         * parser/ParserError.h: Added.
10293         (JSC):
10294         (JSC::ParserError::ParserError):
10295         (ParserError):
10296         (JSC::ParserError::toErrorObject):
10297         * parser/ParserModes.h:
10298         * parser/SourceProvider.cpp: Added.
10299         (JSC):
10300         (JSC::SourceProvider::SourceProvider):
10301         (JSC::SourceProvider::~SourceProvider):
10302         * parser/SourceProvider.h:
10303         (JSC):
10304         (SourceProvider):
10305         * runtime/ArrayPrototype.cpp:
10306         * runtime/DatePrototype.cpp:
10307         * runtime/Executable.h:
10308         * runtime/JSGlobalObject.cpp:
10309         * runtime/JSGlobalObject.h:
10310         (JSC):
10311         * runtime/Operations.h:
10312         * runtime/Structure.cpp:
10313         (JSC::Structure::prototypeForLookup):
10314         (JSC):
10315         * runtime/Structure.h:
10316         (JSC):
10317         * runtime/StructureInlines.h: Added.
10318         (JSC):
10319         (JSC::Structure::create):
10320         (JSC::Structure::createStructure):
10321         (JSC::Structure::get):
10322         (JSC::Structure::masqueradesAsUndefined):
10323         (JSC::SlotVisitor::internalAppend):
10324         (JSC::Structure::transitivelyTransitionedFrom):
10325         (JSC::Structure::setEnumerationCache):
10326         (JSC::Structure::enumerationCache):
10327         (JSC::Structure::prototypeForLookup):
10328         (JSC::Structure::prototypeChain):
10329         (JSC::Structure::isValid):
10330         * runtime/StructureRareData.cpp:
10331
10332 2013-02-17  Roger Fong  <roger_fong@apple.com>
10333
10334         Unreviewed. Windows build fix.
10335
10336         * runtime/CodeCache.h:
10337         (CodeCacheMap):
10338
10339 2013-02-16  Geoffrey Garen  <ggaren@apple.com>
10340
10341         Code cache should be explicit about what it caches
10342         https://bugs.webkit.org/show_bug.cgi?id=110039
10343
10344         Reviewed by Oliver Hunt.
10345
10346         This patch makes the code cache more explicit in two ways:
10347
10348         (1) The cache caches top-level scripts. Any sub-functions executed as a
10349         part of a script are cached with it and evicted with it.
10350
10351         This simplifies things by eliminating out-of-band sub-function tracking,
10352         and fixes pathological cases where functions for live scripts would be
10353         evicted in favor of functions for dead scripts, and/or high probability
10354         functions executed early in script lifetime would be evicted in favor of
10355         low probability functions executed late in script lifetime, due to LRU.
10356
10357         Statistical data from general browsing and PLT confirms that caching
10358         functions independently of scripts is not profitable.
10359
10360         (2) The cache tracks script size, not script count.
10361
10362         This reduces the worst-case cache size by a factor of infinity.
10363
10364         Script size is a reasonable first-order estimate of in-memory footprint
10365         for a cached script because there are no syntactic constructs that have
10366         super-linear memory footprint.
10367
10368         * bytecode/UnlinkedCodeBlock.cpp:
10369         (JSC::generateFunctionCodeBlock): Moved this function out of the cache
10370         because it does not consult the cache, and is not managed by it.
10371
10372         (JSC::UnlinkedFunctionExecutable::visitChildren): Visit our code blocks
10373         because they are strong references now, rather than weak, a la (1).
10374
10375         (JSC::UnlinkedFunctionExecutable::codeBlockFor): Updated for interface changes.
10376
10377         * bytecode/UnlinkedCodeBlock.h:
10378         (UnlinkedFunctionExecutable):
10379         (UnlinkedFunctionCodeBlock): Strong now, not weak, a la (1).
10380
10381         * runtime/CodeCache.cpp:
10382         (JSC::CodeCache::CodeCache):
10383         * runtime/CodeCache.h:
10384         (JSC::SourceCodeKey::length):
10385         (SourceCodeKey):
10386         (CodeCacheMap):
10387         (JSC::CodeCacheMap::CodeCacheMap):
10388         (JSC::CodeCacheMap::find):
10389         (JSC::CodeCacheMap::set):
10390         (JSC::CodeCacheMap::clear):
10391         (CodeCache):
10392         (JSC::CodeCache::clear): Removed individual function tracking, due to (1).
10393         Added explicit character counting, for (2).
10394
10395         You might think 16000000 characters is a lot. It is. But this patch
10396         didn't establish that limit -- it just took the existing limit and
10397         made it more visible. I intend to reduce the size of the cache in a
10398         future patch.
10399
10400 2013-02-16  Filip Pizlo  <fpizlo@apple.com>
10401
10402         Remove support for bytecode comments, since it doesn't build, and hasn't been used in a while.
10403         https://bugs.webkit.org/show_bug.cgi?id=110035
10404
10405         Rubber stamped by Andreas Kling.
10406
10407         There are other ways of achieving the same effect, like adding print statements to the bytecode generator.
10408         The fact that this feature doesn't build and nobody noticed implies that it's probably not a popular
10409         feature. As well, the amount of wiring that was required for it was quite big considering its relatively
10410         modest utility.
10411
10412         * GNUmakefile.list.am:
10413         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
10414         * JavaScriptCore.xcodeproj/project.pbxproj:
10415         * bytecode/CodeBlock.cpp:
10416         (JSC):
10417         (JSC::CodeBlock::dumpBytecode):
10418         (JSC::CodeBlock::CodeBlock):
10419         * bytecode/CodeBlock.h:
10420         (CodeBlock):
10421         * bytecode/Comment.h: Removed.
10422         * bytecompiler/BytecodeGenerator.cpp:
10423         (JSC::BytecodeGenerator::BytecodeGenerator):
10424         (JSC::BytecodeGenerator::emitOpcode):
10425         (JSC):
10426         * bytecompiler/BytecodeGenerator.h:
10427         (BytecodeGenerator):
10428         (JSC::BytecodeGenerator::symbolTable):
10429
10430 2013-02-16  Brent Fulgham  <bfulgham@webkit.org>
10431
10432         [Windows] Unreviewed Visual Studio 2010 build fix after r143117
10433
10434         * JavaScriptCore.vcxproj/LLInt/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props: Reference new path to property sheets.
10435         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
10436         Build correction after new operator == added.
10437
10438 2013-02-16  Filip Pizlo  <fpizlo@apple.com>
10439
10440         Fix indentation of Structure.h
10441
10442         Rubber stamped by Mark Hahnenberg.
10443
10444         * runtime/Structure.h:
10445
10446 2013-02-16  Christophe Dumez  <ch.dumez@sisa.samsung.com>
10447
10448         Unreviewed build fix.
10449
10450         Export symbol for new CString operator== operator to fix Windows build.
10451
10452         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
10453
10454 2013-02-15  Filip Pizlo  <fpizlo@apple.com>
10455
10456         Structure should be more methodical about the relationship between m_offset and m_propertyTable
10457         https://bugs.webkit.org/show_bug.cgi?id=109978
10458
10459         Reviewed by Mark Hahnenberg.
10460
10461         Allegedly, the previous relationship was that either m_propertyTable or m_offset
10462         would be set, and if m_propertyTable was not set you could rebuild it.  In reality,
10463         we would sometimes "reset" both: some transitions wouldn't set m_offset, and other
10464         transitions would clear the previous structure's m_propertyTable.  So, in a
10465         structure transition chain of A->B->C you could have:
10466
10467         A transitions to B: B doesn't copy m_offset but does copy m_propertyTable, because
10468             that seemed like a good idea at the time (this was a common idiom in the code).
10469         B transitions to C: C steals B's m_propertyTable, leaving B with neither a
10470             m_propertyTable nor a m_offset.
10471
10472         Then we would ask for the size of the property storage of B and get the answer
10473         "none".  That's not good.
10474
10475         Now, there is a new relationship, which, hopefully, should fix things: m_offset is
10476         always set and always refers to the maximum offset ever used by the property table.
10477         From this, you can infer both the inline and out-of-line property size, and
10478         capacity.  This is accomplished by having PropertyTable::add() take a
10479         PropertyOffset reference, which must be Structure::m_offset.  It will update this
10480         offset.  As well, all transitions now copy m_offset.  And we frequently assert
10481         (using RELEASE_ASSERT) that the m_offset matches what m_propertyTable would tell
10482         you.  Hence if you ever modify the m_propertyTable, you'll also update the offset.
10483         If you ever copy the property table, you'll also copy the offset.  Life should be
10484         good, I think.
10485
10486         * runtime/PropertyMapHashTable.h:
10487         (JSC::PropertyTable::add):
10488         * runtime/Structure.cpp:
10489         (JSC::Structure::materializePropertyMap):
10490         (JSC::Structure::addPropertyTransition):
10491         (JSC::Structure::removePropertyTransition):
10492         (JSC::Structure::changePrototypeTransition):
10493         (JSC::Structure::despecifyFunctionTransition):
10494         (JSC::Structure::attributeChangeTransition):
10495         (JSC::Structure::toDictionaryTransition):
10496         (JSC::Structure::sealTransition):
10497         (JSC::Structure::freezeTransition):
10498         (JSC::Structure::preventExtensionsTransition):
10499         (JSC::Structure::nonPropertyTransition):
10500         (JSC::Structure::flattenDictionaryStructure):
10501         (JSC::Structure::checkConsistency):
10502         (JSC::Structure::putSpecificValue):
10503         (JSC::Structure::createPropertyMap):
10504         (JSC::PropertyTable::checkConsistency):
10505         * runtime/Structure.h:
10506         (JSC):
10507         (JSC::Structure::putWillGrowOutOfLineStorage):
10508         (JSC::Structure::outOfLineCapacity):
10509         (JSC::Structure::outOfLineSize):
10510         (JSC::Structure::isEmpty):
10511         (JSC::Structure::materializePropertyMapIfNecessary):
10512         (JSC::Structure::materializePropertyMapIfNecessaryForPinning):
10513         (Structure):
10514         (JSC::Structure::checkOffsetConsistency):
10515
10516 2013-02-15  Martin Robinson  <mrobinson@igalia.com>
10517
10518         [GTK] Spread the gyp build files throughout the tree
10519         https://bugs.webkit.org/show_bug.cgi?id=109960
10520
10521         Reviewed by Dirk Pranke.
10522
10523         * JavaScriptCore.gyp/JavaScriptCoreGTK.gyp: Renamed from Source/WebKit/gtk/gyp/JavaScriptCore.gyp.
10524         * JavaScriptCore.gyp/generate-derived-sources.sh: Renamed from Source/WebKit/gtk/gyp/generate-derived-sources.sh.
10525
10526 2013-02-15  Filip Pizlo  <fpizlo@apple.com>
10527
10528         DFG SpeculativeJIT64 should be more precise about when it's dealing with a cell (even though it probably doesn't matter)
10529         https://bugs.webkit.org/show_bug.cgi?id=109625
10530
10531         Reviewed by Mark Hahnenberg.
10532
10533         * dfg/DFGSpeculativeJIT64.cpp:
10534         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
10535         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
10536         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
10537         (JSC::DFG::SpeculativeJIT::compile):
10538
10539 2013-02-15  Geoffrey Garen  <ggaren@apple.com>
10540
10541         Merged the global function cache into the source code cache
10542         https://bugs.webkit.org/show_bug.cgi?id=108660
10543
10544         Reviewed by Sam Weinig.
10545
10546         Responding to review comments by Darin Adler.
10547
10548         * runtime/CodeCache.h:
10549         (JSC::SourceCodeKey::SourceCodeKey): Don't initialize m_name and m_flags
10550         in the hash table deleted value because they're meaningless.
10551
10552 2013-02-14  Filip Pizlo  <fpizlo@apple.com>
10553
10554         DFG AbstractState should filter operands to NewArray more precisely
10555         https://bugs.webkit.org/show_bug.cgi?id=109900
10556
10557         Reviewed by Mark Hahnenberg.
10558
10559         NewArray for primitive indexing types speculates that the inputs are the appropriate
10560         primitives. Now, the CFA filters the abstract state accordingly, as well.
10561
10562         * dfg/DFGAbstractState.cpp:
10563         (JSC::DFG::AbstractState::execute):
10564
10565 2013-02-15  Andreas Kling  <akling@apple.com>
10566
10567         Yarr: Use OwnPtr to make pattern/disjunction/character-class ownership clearer.
10568         <http://webkit.org/b/109218>
10569
10570         Reviewed by Benjamin Poulain.
10571
10572         - Let classes that manage lifetime of other objects hold on to them with OwnPtr instead of raw pointers.
10573         - Placed some strategic Vector::shrinkToFit(), ::reserveInitialCapacity() and ::swap().
10574
10575         668 kB progression on Membuster3.
10576
10577         * yarr/YarrInterpreter.cpp:
10578         (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
10579         (JSC::Yarr::ByteCompiler::emitDisjunction):
10580         (ByteCompiler):
10581         * yarr/YarrInterpreter.h:
10582         (JSC::Yarr::BytecodePattern::BytecodePattern):
10583         (BytecodePattern):
10584         * yarr/YarrJIT.cpp:
10585         (JSC::Yarr::YarrGenerator::opCompileParenthesesSubpattern):
10586         (JSC::Yarr::YarrGenerator::opCompileParentheticalAssertion):
10587         (JSC::Yarr::YarrGenerator::opCompileBody):
10588         * yarr/YarrPattern.cpp:
10589         (JSC::Yarr::CharacterClassConstructor::charClass):
10590         (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor):
10591         (JSC::Yarr::YarrPatternConstructor::reset):
10592         (JSC::Yarr::YarrPatternConstructor::atomPatternCharacter):
10593         (JSC::Yarr::YarrPatternConstructor::atomCharacterClassEnd):
10594         (JSC::Yarr::YarrPatternConstructor::copyDisjunction):
10595         (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets):
10596         (JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):
10597         (JSC::Yarr::YarrPatternConstructor::optimizeBOL):
10598         (JSC::Yarr::YarrPatternConstructor::containsCapturingTerms):
10599         (JSC::Yarr::YarrPatternConstructor::optimizeDotStarWrappedExpressions):
10600         * yarr/YarrPattern.h:
10601         (JSC::Yarr::PatternDisjunction::addNewAlternative):
10602         (PatternDisjunction):
10603         (YarrPattern):
10604         (JSC::Yarr::YarrPattern::reset):
10605         (JSC::Yarr::YarrPattern::newlineCharacterClass):
10606         (JSC::Yarr::YarrPattern::digitsCharacterClass):
10607         (JSC::Yarr::YarrPattern::spacesCharacterClass):
10608         (JSC::Yarr::YarrPattern::wordcharCharacterClass):
10609         (JSC::Yarr::YarrPattern::nondigitsCharacterClass):
10610         (JSC::Yarr::YarrPattern::nonspacesCharacterClass):
10611         (JSC::Yarr::YarrPattern::nonwordcharCharacterClass):
10612
10613 2013-02-14  Geoffrey Garen  <ggaren@apple.com>
10614
10615         Merged the global function cache into the source code cache
10616         https://bugs.webkit.org/show_bug.cgi?id=108660
10617
10618         Reviewed by Sam Weinig.
10619
10620         This has a few benefits:
10621
10622             (*) Saves a few kB by removing a second cache data structure.
10623
10624             (*) Reduces the worst case memory usage of the cache by 1.75X. (Heavy
10625             use of 'new Function' and other techniques could cause us to fill
10626             both root caches, and they didn't trade off against each other.)
10627
10628             (*) Paves the way for future improvements based on a non-trivial
10629             cache key (for example, shrinkable pointer to the key string, and
10630             more precise cache size accounting).
10631
10632         Also cleaned up the cache implementation and simplified it a bit.
10633
10634         * heap/Handle.h:
10635         (HandleBase):
10636         * heap/Strong.h:
10637         (Strong): Build!
10638
10639         * runtime/CodeCache.cpp:
10640         (JSC):
10641         (JSC::CodeCache::getCodeBlock):
10642         (JSC::CodeCache::generateFunctionCodeBlock):
10643         (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
10644         (JSC::CodeCache::usedFunctionCode): Updated for three interface changes:
10645
10646             (*) SourceCodeKey is a class, not a pair.
10647
10648             (*) Table values are abstract pointers, since they can be executables
10649             or code blocks. (In a future patch, I'd like to change this so we
10650             always store only code blocks. But that's too much for one patch.)
10651
10652             (*) The cache function is named "set" because it always overwrites
10653             unconditionally.
10654
10655         * runtime/CodeCache.h:
10656         (CacheMap):
10657         (JSC::CacheMap::find):
10658         (JSC::CacheMap::set):
10659         (JSC::CacheMap::clear): Added support for specifying hash traits, so we
10660         can use a SourceCodeKey.
10661
10662         Removed side table and random number generator to save space and reduce
10663         complexity. Hash tables are already random, so we don't need another source
10664         of randomness.
10665
10666         (SourceCodeKey):
10667         (JSC::SourceCodeKey::SourceCodeKey):
10668         (JSC::SourceCodeKey::isHashTableDeletedValue):
10669         (JSC::SourceCodeKey::hash):
10670         (JSC::SourceCodeKey::isNull):
10671         (JSC::SourceCodeKey::operator==):
10672         (JSC::SourceCodeKeyHash::hash):
10673         (JSC::SourceCodeKeyHash::equal):
10674         (SourceCodeKeyHash):
10675         (SourceCodeKeyHashTraits):
10676         (JSC::SourceCodeKeyHashTraits::isEmptyValue): A SourceCodeKey is just a
10677         fancy triplet: source code string; function name (or null, for non-functions);
10678         and flags. Flags and function name distinguish between functions and programs
10679         with identical code, so they can live in the same cache.
10680
10681         I chose to use the source code string as the primary hashing reference
10682         because it's likely to be unique. We can use profiling to choose another
10683         technique in future, if collisions between functions and programs prove
10684         to be hot. I suspect they won't.
10685
10686         (JSC::CodeCache::clear):
10687         (CodeCache): Removed the second cache.
10688
10689         * heap/Handle.h:
10690         (HandleBase):
10691         * heap/Strong.h:
10692         (Strong):
10693         * runtime/CodeCache.cpp:
10694         (JSC):
10695         (JSC::CodeCache::getCodeBlock):
10696         (JSC::CodeCache::generateFunctionCodeBlock):
10697         (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
10698         (JSC::CodeCache::usedFunctionCode):
10699         * runtime/CodeCache.h:
10700         (JSC):
10701         (CacheMap):
10702         (JSC::CacheMap::find):
10703         (JSC::CacheMap::set):
10704         (JSC::CacheMap::clear):
10705         (SourceCodeKey):
10706         (JSC::SourceCodeKey::SourceCodeKey):
10707         (JSC::SourceCodeKey::isHashTableDeletedValue):
10708         (JSC::SourceCodeKey::hash):
10709         (JSC::SourceCodeKey::isNull):
10710         (JSC::SourceCodeKey::operator==):
10711         (JSC::SourceCodeKeyHash::hash):
10712         (JSC::SourceCodeKeyHash::equal):
10713         (SourceCodeKeyHash):
10714         (SourceCodeKeyHashTraits):
10715         (JSC::SourceCodeKeyHashTraits::isEmptyValue):
10716         (JSC::CodeCache::clear):
10717         (CodeCache):
10718
10719 2013-02-14  Tony Chang  <tony@chromium.org>
10720
10721         Unreviewed, set svn:eol-style native for .sln, .vcproj, and .vsprops files.
10722         https://bugs.webkit.org/show_bug.cgi?id=96934
10723
10724         * JavaScriptCore.vcproj/JavaScriptCore.sln: Modified property svn:eol-style.
10725         * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Modified property svn:eol-style.
10726         * JavaScriptCore.vcproj/testRegExp/testRegExpCommon.vsprops: Added property svn:eol-style.
10727         * JavaScriptCore.vcproj/testRegExp/testRegExpDebug.vsprops: Added property svn:eol-style.
10728         * JavaScriptCore.vcproj/testRegExp/testRegExpDebugAll.vsprops: Added property svn:eol-style.
10729         * JavaScriptCore.vcproj/testRegExp/testRegExpDebugCairoCFLite.vsprops: Added property svn:eol-style.
10730         * JavaScriptCore.vcproj/testRegExp/testRegExpProduction.vsprops: Added property svn:eol-style.
10731         * JavaScriptCore.vcproj/testRegExp/testRegExpRelease.vsprops: Added property svn:eol-style.
10732         * JavaScriptCore.vcproj/testRegExp/testRegExpReleaseCairoCFLite.vsprops: Added property svn:eol-style.
10733         * JavaScriptCore.vcproj/testRegExp/testRegExpReleasePGO.vsprops: Added property svn:eol-style.
10734
10735 2013-02-14  Tony Chang  <tony@chromium.org>
10736
10737         Unreviewed, set svn:eol-style CRLF for .sln files.
10738
10739         * JavaScriptCore.vcproj/JavaScriptCore.sln: Modified property svn:eol-style.
10740         * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Modified property svn:eol-style.
10741
10742 2013-02-14  David Kilzer  <ddkilzer@apple.com>
10743
10744         [Mac] Clean up WARNING_CFLAGS
10745         <http://webkit.org/b/109747>
10746         <rdar://problem/13208373>
10747
10748         Reviewed by Mark Rowe.
10749
10750         * Configurations/Base.xcconfig: Use
10751         GCC_WARN_64_TO_32_BIT_CONVERSION to enable and disable
10752         -Wshorten-64-to-32 rather than WARNING_CFLAGS.
10753
10754         * JavaScriptCore.vcproj/JavaScriptCore.sln: Modified property svn:eol-style.
10755         * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Modified property svn:eol-style.
10756
10757 2013-02-13  Anders Carlsson  <andersca@apple.com>
10758
10759         Better build fix.
10760
10761         * API/tests/testapi.c:
10762         (assertEqualsAsNumber):
10763         (main):
10764
10765 2013-02-13  Roger Fong  <roger_fong@apple.com>
10766
10767         Unreviewed. Build fix.
10768
10769         * API/tests/testapi.c:
10770         (assertEqualsAsNumber):
10771         (main):
10772
10773 2013-02-13  Oliver Hunt  <oliver@apple.com>
10774
10775         Yet another build fix
10776
10777         * bytecode/CodeBlock.cpp:
10778         (JSC::CodeBlock::CodeBlock):
10779
10780 2013-02-13  Zan Dobersek  <zdobersek@igalia.com>
10781
10782         The 'global isinf/isnan' compiler quirk required when using clang with libstdc++
10783         https://bugs.webkit.org/show_bug.cgi?id=109325
10784
10785         Reviewed by Anders Carlsson.
10786
10787         Prefix calls to the isinf and isnan methods with std::, declaring we want to use the
10788         two methods as they're provided by the C++ standard library being used.
10789
10790         * API/JSValueRef.cpp:
10791         (JSValueMakeNumber):
10792         * JSCTypedArrayStubs.h:
10793         (JSC):
10794         * bytecompiler/BytecodeGenerator.cpp:
10795         (JSC::BytecodeGenerator::emitLoad):
10796         * dfg/DFGByteCodeParser.cpp:
10797         (JSC::DFG::ByteCodeParser::constantNaN):
10798         * offlineasm/cloop.rb:
10799         * runtime/DateConstructor.cpp:
10800         (JSC::dateUTC): Also include an opportunistic style fix.
10801         * runtime/DateInstance.cpp:
10802         (JSC::DateInstance::calculateGregorianDateTime):
10803         (JSC::DateInstance::calculateGregorianDateTimeUTC):
10804         * runtime/DatePrototype.cpp:
10805         (JSC::dateProtoFuncGetMilliSeconds):
10806         (JSC::dateProtoFuncGetUTCMilliseconds):
10807         (JSC::setNewValueFromTimeArgs):
10808         (JSC::setNewValueFromDateArgs):
10809         (JSC::dateProtoFuncSetYear):
10810         * runtime/JSCJSValue.cpp:
10811         (JSC::JSValue::toInteger):
10812         * runtime/JSDateMath.cpp:
10813         (JSC::getUTCOffset):
10814         (JSC::parseDateFromNullTerminatedCharacters):
10815         (JSC::parseDate):
10816         * runtime/JSGlobalObjectFunctions.cpp:
10817         (JSC::globalFuncIsNaN):
10818         * runtime/MathObject.cpp:
10819         (JSC::mathProtoFuncMax):
10820         (JSC::mathProtoFuncMin):
10821         (JSC::mathProtoFuncPow):
10822         * runtime/PropertyDescriptor.cpp:
10823         (JSC::sameValue):
10824
10825 2013-02-13  Filip Pizlo  <fpizlo@apple.com>
10826
10827         Change another use of (SpecCell & ~SpecString) to SpecObject.
10828
10829         Reviewed by Mark Hahnenberg.
10830
10831         * dfg/DFGAbstractState.cpp:
10832         (JSC::DFG::AbstractState::execute):
10833
10834 2013-02-13  Filip Pizlo  <fpizlo@apple.com>
10835
10836         ForwardInt32ToDouble is not in DFG::MinifiedNode's list of relevant node types
10837         https://bugs.webkit.org/show_bug.cgi?id=109726
10838
10839         Reviewed by Mark Hahnenberg.
10840
10841         If you add it to the list of relevant node types, you also need to make sure
10842         it's listed as either hasChild or one of the other kinds. Otherwise you get
10843         an assertion. This is causing test failures in run-javascriptcore-tests.
10844
10845         * dfg/DFGMinifiedNode.h:
10846         (JSC::DFG::MinifiedNode::hasChild):
10847
10848 2013-02-13  Oliver Hunt  <oliver@apple.com>
10849
10850         Build fix.
10851
10852         Rearranged the code somewhat to reduce the number of
10853         DFG related ifdefs.
10854
10855         * bytecode/CodeBlock.cpp:
10856         (JSC::CodeBlock::CodeBlock):
10857
10858 2013-02-13  Filip Pizlo  <fpizlo@apple.com>
10859
10860         ForwardInt32ToDouble is not in DFG::MinifiedNode's list of relevant node types
10861         https://bugs.webkit.org/show_bug.cgi?id=109726
10862
10863         Reviewed by Gavin Barraclough.
10864
10865         This is asymptomatic because ForwardInt32ToDouble is only used in SetLocals, in
10866         which case the value is already stored to the stack.  Still, we should fix this.
10867
10868         * dfg/DFGMinifiedNode.h:
10869         (JSC::DFG::belongsInMinifiedGraph):
10870
10871 2013-02-12  Filip Pizlo  <fpizlo@apple.com>
10872
10873         DFG LogicalNot/Branch peephole removal and inversion ignores the possibility of things exiting
10874         https://bugs.webkit.org/show_bug.cgi?id=109489
10875
10876         Reviewed by Mark Hahnenberg.
10877
10878         If things can exit between the LogicalNot and the Branch then don't peephole.
10879
10880         * dfg/DFGFixupPhase.cpp:
10881         (JSC::DFG::FixupPhase::fixupNode):
10882
10883 2013-02-13  Oliver Hunt  <oliver@apple.com>
10884
10885         Remove unnecessary indirection to non-local variable access operations
10886         https://bugs.webkit.org/show_bug.cgi?id=109724
10887
10888         Reviewed by Filip Pizlo.
10889
10890         Linked bytecode now stores a direct pointer to the resolve operation
10891         vectors, so the interpreter no longer needs a bunch of indirection to
10892         to perform non-local lookup.
10893
10894         * bytecode/CodeBlock.cpp:
10895         (JSC::CodeBlock::CodeBlock):
10896         * bytecode/CodeBlock.h:
10897         (CodeBlock):
10898         * bytecode/Instruction.h:
10899         * dfg/DFGByteCodeParser.cpp:
10900         (ByteCodeParser):
10901         (InlineStackEntry):
10902         (JSC::DFG::ByteCodeParser::parseResolveOperations):
10903         (JSC::DFG::ByteCodeParser::parseBlock):
10904         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
10905         * dfg/DFGCapabilities.h:
10906         (JSC::DFG::canInlineOpcode):
10907         * dfg/DFGGraph.h:
10908         (ResolveGlobalData):
10909         (ResolveOperationData):
10910         (PutToBaseOperationData):
10911         * dfg/DFGSpeculativeJIT.h:
10912         * dfg/DFGSpeculativeJIT32_64.cpp:
10913         (JSC::DFG::SpeculativeJIT::compile):
10914         * dfg/DFGSpeculativeJIT64.cpp:
10915         (JSC::DFG::SpeculativeJIT::compile):
10916         * jit/JITOpcodes.cpp:
10917         (JSC::JIT::emit_op_put_to_base):
10918         (JSC::JIT::emit_op_resolve):
10919         (JSC::JIT::emitSlow_op_resolve):
10920         (JSC::JIT::emit_op_resolve_base):
10921         (JSC::JIT::emitSlow_op_resolve_base):
10922         (JSC::JIT::emit_op_resolve_with_base):
10923         (JSC::JIT::emitSlow_op_resolve_with_base):
10924         (JSC::JIT::emit_op_resolve_with_this):
10925         (JSC::JIT::emitSlow_op_resolve_with_this):
10926         (JSC::JIT::emitSlow_op_put_to_base):
10927         * jit/JITOpcodes32_64.cpp:
10928         (JSC::JIT::emit_op_put_to_base):
10929         * llint/LLIntSlowPaths.cpp:
10930         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
10931         * llint/LowLevelInterpreter.asm:
10932
10933 2013-02-13  Zoltan Herczeg  <zherczeg@webkit.org>
10934
10935         replaceWithJump should not decrease the offset by 1 on ARM traditional.
10936         https://bugs.webkit.org/show_bug.cgi?id=109689
10937
10938         Reviewed by Oliver Hunt.
10939
10940         * assembler/ARMAssembler.h:
10941         (JSC::ARMAssembler::replaceWithJump):
10942
10943 2013-02-12  Joseph Pecoraro  <pecoraro@apple.com>
10944
10945         [iOS] Enable PAGE_VISIBILITY_API
10946         https://bugs.webkit.org/show_bug.cgi?id=109399
10947
10948         Reviewed by David Kilzer.
10949
10950         * Configurations/FeatureDefines.xcconfig:
10951
10952 2013-02-12  Filip Pizlo  <fpizlo@apple.com>
10953
10954         Renamed SpecObjectMask to SpecObject.
10955
10956         Rubber stamped by Mark Hahnenberg.
10957
10958         "SpecObjectMask" is a weird name considering that a bunch of the other speculated
10959         types are also masks, but don't have "Mask" in the name.
10960
10961         * bytecode/SpeculatedType.h:
10962         (JSC):
10963         (JSC::isObjectSpeculation):
10964         (JSC::isObjectOrOtherSpeculation):
10965         * dfg/DFGAbstractState.cpp:
10966         (JSC::DFG::AbstractState::execute):
10967         * dfg/DFGPredictionPropagationPhase.cpp:
10968         (JSC::DFG::PredictionPropagationPhase::propagate):
10969         * dfg/DFGSpeculativeJIT.cpp:
10970         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
10971         * dfg/DFGSpeculativeJIT32_64.cpp:
10972         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
10973         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
10974         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
10975         * dfg/DFGSpeculativeJIT64.cpp:
10976         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
10977         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
10978         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
10979
10980 2013-02-12  Filip Pizlo  <fpizlo@apple.com>
10981
10982         DFG CFA doesn't filter precisely enough for CompareStrictEq
10983         https://bugs.webkit.org/show_bug.cgi?id=109618
10984
10985         Reviewed by Mark Hahnenberg.
10986
10987         The backend speculates object for this case, but the CFA was filtering on
10988         (SpecCell & ~SpecString) | SpecOther.
10989
10990         * dfg/DFGAbstractState.cpp:
10991         (JSC::DFG::AbstractState::execute):
10992
10993 2013-02-12  Martin Robinson  <mrobinson@igalia.com>
10994
10995         Fix the gyp build of JavaScriptCore.
10996
10997         * JavaScriptCore.gypi: Added some missing DFG files to the source list.
10998
10999 2013-02-12  Sheriff Bot  <webkit.review.bot@gmail.com>
11000
11001         Unreviewed, rolling out r142387.
11002         http://trac.webkit.org/changeset/142387
11003         https://bugs.webkit.org/show_bug.cgi?id=109601
11004
11005         caused all layout and jscore tests on windows to fail
11006         (Requested by kling on #webkit).
11007
11008         * bytecode/UnlinkedCodeBlock.cpp:
11009         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
11010         * bytecode/UnlinkedCodeBlock.h:
11011         (UnlinkedCodeBlock):
11012
11013 2013-02-11  Filip Pizlo  <fpizlo@apple.com>
11014
11015         DFG CompareEq optimization should be retuned
11016         https://bugs.webkit.org/show_bug.cgi?id=109545
11017
11018         Reviewed by Mark Hahnenberg.
11019
11020         - Made the object-to-object equality case work again by hoisting the if statement
11021           for it. Previously, object-to-object equality would be compiled as
11022           object-to-object-or-other.
11023
11024         - Added AbstractState guards for most of the type checks that the object equality
11025           code uses.
11026
11027         Looks like a hint of a speed-up on all of the things.
11028
11029         * dfg/DFGAbstractState.cpp:
11030         (JSC::DFG::AbstractState::execute):
11031         * dfg/DFGSpeculativeJIT.cpp:
11032         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
11033         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
11034         (JSC::DFG::SpeculativeJIT::compare):
11035         * dfg/DFGSpeculativeJIT32_64.cpp:
11036         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
11037         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
11038         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
11039         * dfg/DFGSpeculativeJIT64.cpp:
11040         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
11041         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
11042         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
11043
11044 2013-02-12  Gabor Rapcsanyi  <rgabor@webkit.org>
11045
11046         JSC asserting with long parameter list functions in debug mode on ARM traditional
11047         https://bugs.webkit.org/show_bug.cgi?id=109565
11048
11049         Reviewed by Zoltan Herczeg.
11050
11051         Increase the value of sequenceGetByIdSlowCaseInstructionSpace to 80.
11052
11053         * jit/JIT.h:
11054
11055 2013-02-11  Oliver Hunt  <oliver@apple.com>
11056
11057         Make JSC API more NULL tolerant
11058         https://bugs.webkit.org/show_bug.cgi?id=109515
11059
11060         Reviewed by Mark Hahnenberg.
11061
11062         We do so much marshalling for the C API these days anyway that a single null
11063         check isn't a performance issue.  Yet the existing "null is unsafe" behaviour
11064         leads to crashes in embedding applications whenever there's an untested code
11065         path, so it seems having defined behaviour is superior.
11066
11067         * API/APICast.h:
11068         (toJS):
11069         (toJSForGC):
11070         * API/JSObjectRef.cpp:
11071         (JSObjectIsFunction):
11072         (JSObjectCallAsFunction):
11073         (JSObjectIsConstructor):
11074         (JSObjectCallAsConstructor):
11075         * API/tests/testapi.c:
11076         (main):
11077
11078 2013-02-11  Filip Pizlo  <fpizlo@apple.com>
11079
11080         Unreviewed, adding a FIXME to remind ourselves of a bug.
11081         https://bugs.webkit.org/show_bug.cgi?id=109487
11082
11083         * dfg/DFGSpeculativeJIT.cpp:
11084         (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
11085
11086 2013-02-11  Filip Pizlo  <fpizlo@apple.com>
11087
11088         Strange bug in DFG OSR in JSC
11089         https://bugs.webkit.org/show_bug.cgi?id=109491
11090
11091         Reviewed by Mark Hahnenberg.
11092
11093         Int32ToDouble was being injected after a side-effecting operation and before a SetLocal. Anytime we
11094         inject something just before a SetLocal we should be aware that the previous operation may have been
11095         a side-effect associated with the current code origin. Hence, we should use a forward exit.
11096         Int32ToDouble does not do forward exits by default.
11097
11098         This patch adds a forward-exiting form of Int32ToDouble, for use in SetLocal Int32ToDouble injections.
11099         Changed the CSE and other things to treat these nodes identically, but for the exit strategy to be
11100         distinct (Int32ToDouble -> backward, ForwardInt32ToDouble -> forward). The use of the NodeType for
11101         signaling exit direction is not "great" but it's what we use in other places already (like
11102         ForwardCheckStructure).
11103
11104         * dfg/DFGAbstractState.cpp:
11105         (JSC::DFG::AbstractState::execute):
11106         * dfg/DFGCSEPhase.cpp:
11107         (JSC::DFG::CSEPhase::int32ToDoubleCSE):
11108         (CSEPhase):
11109         (JSC::DFG::CSEPhase::performNodeCSE):
11110         * dfg/DFGCommon.h:
11111         * dfg/DFGFixupPhase.cpp:
11112         (JSC::DFG::FixupPhase::fixupNode):
11113         (JSC::DFG::FixupPhase::fixDoubleEdge):
11114         (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
11115         * dfg/DFGNode.h:
11116         (JSC::DFG::Node::willHaveCodeGenOrOSR):
11117         * dfg/DFGNodeType.h:
11118         (DFG):
11119         * dfg/DFGPredictionPropagationPhase.cpp:
11120         (JSC::DFG::PredictionPropagationPhase::propagate):
11121         * dfg/DFGSpeculativeJIT.cpp:
11122         (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
11123         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
11124         * dfg/DFGSpeculativeJIT.h:
11125         * dfg/DFGSpeculativeJIT32_64.cpp:
11126         (JSC::DFG::SpeculativeJIT::compile):
11127         * dfg/DFGSpeculativeJIT64.cpp:
11128         (JSC::DFG::SpeculativeJIT::compile):
11129         * dfg/DFGVariableEventStream.cpp:
11130         (JSC::DFG::VariableEventStream::reconstruct):
11131
11132 2013-02-11  Filip Pizlo  <fpizlo@apple.com>
11133
11134         NonStringCell and Object are practically the same thing for the purpose of speculation
11135         https://bugs.webkit.org/show_bug.cgi?id=109492
11136
11137         Reviewed by Mark Hahnenberg.
11138
11139         Removed isNonStringCellSpeculation, and made all callers use isObjectSpeculation.
11140
11141         Changed isNonStringCellOrOtherSpeculation to be isObjectOrOtherSpeculation.
11142
11143         I believe this is correct because even weird object types like JSNotAnObject end up
11144         being "objects" from the standpoint of our typesystem. Anyway, the assumption that
11145         "is cell but not a string" equates to "object" is an assumption that is already made
11146         in other places in the system so there's little value in being paranoid about it.
11147
11148         * bytecode/SpeculatedType.h:
11149         (JSC::isObjectSpeculation):
11150         (JSC::isObjectOrOtherSpeculation):
11151         * dfg/DFGAbstractState.cpp:
11152         (JSC::DFG::AbstractState::execute):
11153         * dfg/DFGNode.h:
11154         (Node):
11155         (JSC::DFG::Node::shouldSpeculateObjectOrOther):
11156         * dfg/DFGSpeculativeJIT.cpp:
11157         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
11158         (JSC::DFG::SpeculativeJIT::compare):
11159         (JSC::DFG::SpeculativeJIT::compileStrictEq):
11160         * dfg/DFGSpeculativeJIT.h:
11161         (SpeculativeJIT):
11162         * dfg/DFGSpeculativeJIT32_64.cpp:
11163         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
11164         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
11165         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
11166         (JSC::DFG::SpeculativeJIT::emitBranch):
11167         (JSC::DFG::SpeculativeJIT::compile):
11168         * dfg/DFGSpeculativeJIT64.cpp:
11169         (JSC::DFG::SpeculativeJIT::compileObjectOrOtherLogicalNot):
11170         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
11171         (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
11172         (JSC::DFG::SpeculativeJIT::emitBranch):
11173         (JSC::DFG::SpeculativeJIT::compile):
11174
11175 2013-02-10  Filip Pizlo  <fpizlo@apple.com>
11176
11177         DFG CompareEq(a, null) and CompareStrictEq(a, const) are unsound with respect to constant folding
11178         https://bugs.webkit.org/show_bug.cgi?id=109387
11179
11180         Reviewed by Oliver Hunt and Mark Hahnenberg.
11181
11182         Lock in the decision to use a non-speculative constant comparison as early as possible
11183         and don't let the CFA change it by folding constants. This might be a performance
11184         penalty on some really weird code (FWIW, I haven't seen this on benchmarks), but on
11185         the other hand it completely side-steps the unsoundness that the bug speaks of.
11186
11187         Rolling back in after adding 32-bit path.
11188
11189         * dfg/DFGAbstractState.cpp:
11190         (JSC::DFG::AbstractState::execute):
11191         * dfg/DFGByteCodeParser.cpp:
11192         (JSC::DFG::ByteCodeParser::isConstantForCompareStrictEq):
11193         (ByteCodeParser):
11194         (JSC::DFG::ByteCodeParser::parseBlock):
11195         * dfg/DFGCSEPhase.cpp:
11196         (JSC::DFG::CSEPhase::performNodeCSE):
11197         * dfg/DFGNodeType.h:
11198         (DFG):
11199         * dfg/DFGPredictionPropagationPhase.cpp:
11200         (JSC::DFG::PredictionPropagationPhase::propagate):
11201         * dfg/DFGSpeculativeJIT.cpp:
11202         (JSC::DFG::SpeculativeJIT::compileStrictEq):
11203         * dfg/DFGSpeculativeJIT32_64.cpp:
11204         (JSC::DFG::SpeculativeJIT::compile):
11205         * dfg/DFGSpeculativeJIT64.cpp:
11206         (JSC::DFG::SpeculativeJIT::compile):
11207
11208 2013-02-10  Filip Pizlo  <fpizlo@apple.com>
11209
11210         DFG TypeOf implementation should have its backend code aligned to what the CFA does
11211         https://bugs.webkit.org/show_bug.cgi?id=109385
11212
11213         Reviewed by Sam Weinig.
11214
11215         The problem was that if we ended up trying to constant fold, but didn't succeed
11216         because of prediction mismatches, then we would also fail to do filtration.
11217
11218         Rearranged the control flow in the CFA to fix that.
11219
11220         As far as I know, this is asymptomatic - it's sort of OK for the CFA to prove less
11221         things, which is what the bug was.
11222
11223         * dfg/DFGAbstractState.cpp:
11224         (JSC::DFG::AbstractState::execute):
11225
11226 2013-02-11  Sheriff Bot  <webkit.review.bot@gmail.com>
11227
11228         Unreviewed, rolling out r142491.
11229         http://trac.webkit.org/changeset/142491
11230         https://bugs.webkit.org/show_bug.cgi?id=109470
11231
11232         broke the 32 bit build (Requested by jessieberlin on #webkit).
11233
11234         * dfg/DFGAbstractState.cpp:
11235         (JSC::DFG::AbstractState::execute):
11236         * dfg/DFGByteCodeParser.cpp:
11237         (JSC::DFG::ByteCodeParser::parseBlock):
11238         * dfg/DFGCSEPhase.cpp:
11239         (JSC::DFG::CSEPhase::performNodeCSE):
11240         * dfg/DFGNodeType.h:
11241         (DFG):
11242         * dfg/DFGPredictionPropagationPhase.cpp:
11243         (JSC::DFG::PredictionPropagationPhase::propagate):
11244         * dfg/DFGSpeculativeJIT.cpp:
11245         (JSC::DFG::SpeculativeJIT::compileStrictEq):
11246         * dfg/DFGSpeculativeJIT64.cpp:
11247         (JSC::DFG::SpeculativeJIT::compile):
11248
11249 2013-02-10  Filip Pizlo  <fpizlo@apple.com>
11250
11251         DFG CompareEq(a, null) and CompareStrictEq(a, const) are unsound with respect to constant folding
11252         https://bugs.webkit.org/show_bug.cgi?id=109387
11253
11254         Reviewed by Oliver Hunt.
11255
11256         Lock in the decision to use a non-speculative constant comparison as early as possible
11257         and don't let the CFA change it by folding constants. This might be a performance
11258         penalty on some really weird code (FWIW, I haven't seen this on benchmarks), but on
11259         the other hand it completely side-steps the unsoundness that the bug speaks of.
11260
11261         * dfg/DFGAbstractState.cpp:
11262         (JSC::DFG::AbstractState::execute):
11263         * dfg/DFGByteCodeParser.cpp:
11264         (JSC::DFG::ByteCodeParser::isConstantForCompareStrictEq):
11265         (ByteCodeParser):
11266         (JSC::DFG::ByteCodeParser::parseBlock):
11267         * dfg/DFGCSEPhase.cpp:
11268         (JSC::DFG::CSEPhase::performNodeCSE):
11269         * dfg/DFGNodeType.h:
11270         (DFG):
11271         * dfg/DFGPredictionPropagationPhase.cpp:
11272         (JSC::DFG::PredictionPropagationPhase::propagate):
11273         * dfg/DFGSpeculativeJIT.cpp:
11274         (JSC::DFG::SpeculativeJIT::compileStrictEq):
11275         * dfg/DFGSpeculativeJIT64.cpp:
11276         (JSC::DFG::SpeculativeJIT::compile):
11277
11278 2013-02-11  Csaba Osztrogonác  <ossy@webkit.org>
11279
11280         Unreviewed fix after r13954 for !ENABLE(JIT) builds.
11281
11282         * llint/LowLevelInterpreter.cpp:
11283
11284 2013-02-11  Gabor Rapcsanyi  <rgabor@webkit.org>
11285
11286         JSC build failing with verbose debug mode
11287         https://bugs.webkit.org/show_bug.cgi?id=109441
11288
11289         Reviewed by Darin Adler.
11290
11291         Fixing some verbose messages which caused build errors.
11292
11293         * dfg/DFGAbstractState.cpp:
11294         (JSC::DFG::AbstractState::mergeToSuccessors):
11295         * dfg/DFGCFAPhase.cpp:
11296         (JSC::DFG::CFAPhase::performBlockCFA):
11297         * dfg/DFGCSEPhase.cpp:
11298         (JSC::DFG::CSEPhase::setReplacement):
11299         (JSC::DFG::CSEPhase::eliminate):
11300         * dfg/DFGPredictionInjectionPhase.cpp:
11301         (JSC::DFG::PredictionInjectionPhase::run):
11302
11303 2013-02-10  Martin Robinson  <mrobinson@igalia.com>
11304
11305         Fix the GTK+ gyp build
11306
11307         * JavaScriptCore.gypi: Update the source list to accurately
11308         reflect what's in the repository and remove the offsets extractor
11309         from the list of JavaScriptCore files. It's only used to build
11310         the extractor binary.
11311
11312 2013-02-09  Andreas Kling  <akling@apple.com>
11313
11314         Shrink-wrap UnlinkedCodeBlock members.
11315         <http://webkit.org/b/109368>
11316
11317         Reviewed by Oliver Hunt.
11318
11319         Rearrange the members of UnlinkedCodeBlock to avoid unnecessary padding on 64-bit.
11320         Knocks ~600 KB off of the Membuster3 peak.
11321
11322         * bytecode/UnlinkedCodeBlock.cpp:
11323         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
11324         * bytecode/UnlinkedCodeBlock.h:
11325         (UnlinkedCodeBlock):
11326
11327 2013-02-08  Filip Pizlo  <fpizlo@apple.com>
11328
11329         DFG should allow phases to break Phi's and then have one phase to rebuild them
11330         https://bugs.webkit.org/show_bug.cgi?id=108414
11331
11332         Reviewed by Mark Hahnenberg.
11333
11334         Introduces two new DFG forms: LoadStore and ThreadedCPS. These are described in
11335         detail in DFGCommon.h.
11336
11337         Consequently, DFG phases no longer have to worry about preserving data flow
11338         links between basic blocks. It is generally always safe to request that the
11339         graph be dethreaded (Graph::dethread), which brings it into LoadStore form, where
11340         the data flow is implicit. In this form, only liveness-at-head needs to be
11341         preserved.
11342
11343         All of the machinery for "threading" the graph to introduce data flow between
11344         blocks is now moved out of the bytecode parser and into the CPSRethreadingPhase.
11345         All phases that previously did this maintenance themselves now just rely on
11346         being able to dethread the graph. The one exception is the structure check
11347         hoising phase, which operates over a threaded graph and preserves it, for the
11348         sake of performance.
11349
11350         Also moved two other things into their own phases: unification (previously found
11351         in the parser) and prediction injection (previously found in various places).
11352
11353         * CMakeLists.txt:
11354         * GNUmakefile.list.am:
11355         * JavaScriptCore.xcodeproj/project.pbxproj:
11356         * Target.pri:
11357         * bytecode/Operands.h:
11358         (Operands):
11359         (JSC::Operands::sizeFor):
11360         (JSC::Operands::atFor):
11361         * dfg/DFGAbstractState.cpp:
11362         (JSC::DFG::AbstractState::execute):
11363         (JSC::DFG::AbstractState::mergeStateAtTail):
11364         * dfg/DFGAllocator.h:
11365         (JSC::DFG::::allocateSlow):
11366         * dfg/DFGArgumentsSimplificationPhase.cpp:
11367         (JSC::DFG::ArgumentsSimplificationPhase::run):
11368         * dfg/DFGBasicBlockInlines.h:
11369         (DFG):
11370         * dfg/DFGByteCodeParser.cpp:
11371         (JSC::DFG::ByteCodeParser::getLocal):
11372         (JSC::DFG::ByteCodeParser::getArgument):
11373         (JSC::DFG::ByteCodeParser::flushDirect):
11374         (JSC::DFG::ByteCodeParser::parseBlock):
11375         (DFG):
11376         (JSC::DFG::ByteCodeParser::parse):
11377         * dfg/DFGCFGSimplificationPhase.cpp:
11378         (JSC::DFG::CFGSimplificationPhase::run):
11379         (JSC::DFG::CFGSimplificationPhase::killUnreachable):
11380         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
11381         (CFGSimplificationPhase):
11382         (JSC::DFG::CFGSimplificationPhase::fixJettisonedPredecessors):
11383         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
11384         * dfg/DFGCPSRethreadingPhase.cpp: Added.
11385         (DFG):
11386         (CPSRethreadingPhase):
11387         (JSC::DFG::CPSRethreadingPhase::CPSRethreadingPhase):
11388         (JSC::DFG::CPSRethreadingPhase::run):
11389         (JSC::DFG::CPSRethreadingPhase::freeUnnecessaryNodes):
11390         (JSC::DFG::CPSRethreadingPhase::clearVariablesAtHeadAndTail):
11391         (JSC::DFG::CPSRethreadingPhase::addPhiSilently):
11392         (JSC::DFG::CPSRethreadingPhase::addPhi):
11393         (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
11394         (JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocal):
11395         (JSC::DFG::CPSRethreadingPhase::canonicalizeSetLocal):
11396         (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
11397         (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocal):
11398         (JSC::DFG::CPSRethreadingPhase::canonicalizeSetArgument):
11399         (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
11400         (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlocks):
11401         (JSC::DFG::CPSRethreadingPhase::propagatePhis):
11402         (JSC::DFG::CPSRethreadingPhase::PhiStackEntry::PhiStackEntry):
11403         (PhiStackEntry):
11404         (JSC::DFG::CPSRethreadingPhase::phiStackFor):
11405         (JSC::DFG::performCPSRethreading):
11406         * dfg/DFGCPSRethreadingPhase.h: Added.
11407         (DFG):
11408         * dfg/DFGCSEPhase.cpp:
11409         (CSEPhase):
11410         (JSC::DFG::CSEPhase::performNodeCSE):
11411         * dfg/DFGCommon.cpp:
11412         (WTF):
11413         (WTF::printInternal):
11414         * dfg/DFGCommon.h:
11415         (JSC::DFG::logCompilationChanges):
11416         (DFG):
11417         (WTF):
11418         * dfg/DFGConstantFoldingPhase.cpp:
11419         (JSC::DFG::ConstantFoldingPhase::foldConstants):
11420         * dfg/DFGDriver.cpp:
11421         (JSC::DFG::compile):
11422         * dfg/DFGGraph.cpp:
11423         (JSC::DFG::Graph::Graph):
11424         (JSC::DFG::Graph::dump):
11425         (JSC::DFG::Graph::dethread):
11426         (JSC::DFG::Graph::collectGarbage):
11427         * dfg/DFGGraph.h:
11428         (JSC::DFG::Graph::performSubstitution):
11429         (Graph):
11430         (JSC::DFG::Graph::performSubstitutionForEdge):
11431         (JSC::DFG::Graph::convertToConstant):
11432         * dfg/DFGNode.h:
11433         (JSC::DFG::Node::convertToPhantomLocal):
11434         (Node):
11435         (JSC::DFG::Node::convertToGetLocal):
11436         (JSC::DFG::Node::hasVariableAccessData):
11437         * dfg/DFGNodeType.h:
11438         (DFG):
11439         * dfg/DFGPhase.cpp:
11440         (JSC::DFG::Phase::beginPhase):
11441         * dfg/DFGPhase.h:
11442         (JSC::DFG::runAndLog):
11443         * dfg/DFGPredictionInjectionPhase.cpp: Added.
11444         (DFG):
11445         (PredictionInjectionPhase):
11446         (JSC::DFG::PredictionInjectionPhase::PredictionInjectionPhase):
11447         (JSC::DFG::PredictionInjectionPhase::run):
11448         (JSC::DFG::performPredictionInjection):
11449         * dfg/DFGPredictionInjectionPhase.h: Added.
11450         (DFG):
11451         * dfg/DFGPredictionPropagationPhase.cpp:
11452         (JSC::DFG::PredictionPropagationPhase::run):
11453         (JSC::DFG::PredictionPropagationPhase::propagate):
11454         * dfg/DFGSpeculativeJIT32_64.cpp:
11455         (JSC::DFG::SpeculativeJIT::compile):
11456         * dfg/DFGSpeculativeJIT64.cpp:
11457         (JSC::DFG::SpeculativeJIT::compile):
11458         * dfg/DFGStructureCheckHoistingPhase.cpp:
11459         (JSC::DFG::StructureCheckHoistingPhase::run):
11460         * dfg/DFGUnificationPhase.cpp: Added.
11461         (DFG):
11462         (UnificationPhase):
11463         (JSC::DFG::UnificationPhase::UnificationPhase):
11464         (JSC::DFG::UnificationPhase::run):
11465         (JSC::DFG::performUnification):
11466         * dfg/DFGUnificationPhase.h: Added.
11467         (DFG):
11468         * dfg/DFGValidate.cpp:
11469         (JSC::DFG::Validate::validate):
11470         (JSC::DFG::Validate::dumpGraphIfAppropriate):
11471         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
11472         (JSC::DFG::VirtualRegisterAllocationPhase::run):
11473         * llint/LLIntSlowPaths.cpp:
11474         (JSC::LLInt::setUpCall):
11475         * runtime/JSCJSValue.cpp:
11476         (JSC::JSValue::dump):
11477         * runtime/JSString.h:
11478         (JSString):
11479         * runtime/Options.h:
11480         (JSC):
11481
11482 2013-02-08  Jer Noble  <jer.noble@apple.com>
11483
11484         Bring WebKit up to speed with latest Encrypted Media spec.
11485         https://bugs.webkit.org/show_bug.cgi?id=97037
11486
11487         Reviewed by Eric Carlson.
11488
11489         Define the ENABLE_ENCRYPTED_MEDIA_V2 setting.
11490
11491         * Configurations/FeatureDefines.xcconfig:
11492
11493 2013-02-08  Gavin Barraclough  <barraclough@apple.com>
11494
11495         Objective-C API for JavaScriptCore
11496         https://bugs.webkit.org/show_bug.cgi?id=105889
11497
11498         Reviewed by Joseph Pecoraro
11499
11500         Following up on review comments, mostly typos.
11501
11502         * API/JSBlockAdaptor.h:
11503         * API/JSBlockAdaptor.mm:
11504         (-[JSBlockAdaptor blockFromValue:inContext:withException:]):
11505         * API/JSContext.h:
11506         * API/JSExport.h:
11507         * API/JSValue.h:
11508         * API/JSValue.mm:
11509         * API/JSWrapperMap.mm:
11510         (selectorToPropertyName):
11511         (-[JSWrapperMap classInfoForClass:]):
11512         (-[JSWrapperMap wrapperForObject:]):
11513
11514 2013-02-08  Martin Robinson  <mrobinson@igalia.com>
11515
11516         [GTK] Add an experimental gyp build
11517         https://bugs.webkit.org/show_bug.cgi?id=109003
11518
11519         Reviewed by Gustavo Noronha Silva.
11520
11521         * JavaScriptCore.gypi: Update the list of source files to include those
11522         necessary for the GTK+ build.
11523
11524 2013-02-08  Andreas Kling  <akling@apple.com>
11525
11526         JSC: Lower minimum PropertyTable size.
11527         <http://webkit.org/b/109247>
11528
11529         Reviewed by Darin Adler.
11530
11531         Lower the minimum table size for PropertyTable from 16 to 8.
11532         3.32 MB progression on Membuster3 (a ~13% reduction in memory used by PropertyTables.)
11533
11534         * runtime/PropertyMapHashTable.h:
11535         (PropertyTable):
11536         (JSC::PropertyTable::sizeForCapacity):
11537
11538 2013-02-07  Roger Fong  <roger_fong@apple.com>
11539
11540         Unreviewed. More VS2010 WebKit solution touchups.
11541         Make JavaScriptCoreExports.def.in be treated as a custom build file so that changes to it cause the exports to be rebuilt.
11542
11543         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj:
11544         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.filters:
11545         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in:
11546
11547 2013-02-07  Mark Hahnenberg  <mhahnenberg@apple.com>
11548
11549         Objective-C API: testapi.mm should use ARC
11550         https://bugs.webkit.org/show_bug.cgi?id=107838
11551
11552         Reviewed by Mark Rowe.
11553
11554         Removing the changes to the Xcode project file and moving the equivalent flags into
11555         the ToolExecutable xcconfig file.
11556
11557         * Configurations/ToolExecutable.xcconfig:
11558         * JavaScriptCore.xcodeproj/project.pbxproj:
11559
11560 2013-02-07  Brent Fulgham  <bfulgham@webkit.org>
11561
11562         [Windows] Unreviewed Visual Studio 2010 build fixes after r142179.
11563
11564         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in: Correct changed symbols
11565         * JavaScriptCore.vcxproj/JavaScriptCoreExports.def: Removed autogenerated file.
11566
11567 2013-02-05  Filip Pizlo  <fpizlo@apple.com>
11568
11569         DFG::ByteCodeParser should do surgical constant folding to reduce load on the optimization fixpoint
11570         https://bugs.webkit.org/show_bug.cgi?id=109000
11571
11572         Reviewed by Oliver Hunt.
11573
11574         Previously our source parser's ASTBuilder did some surgical constant folding, but it
11575         didn't cover some cases.  It was particularly incapable of doing constant folding for
11576         cases where we do some minimal loop peeling in the bytecode generator - since it
11577         didn't "see" those constants prior to the peeling.  Example:
11578
11579         for (var i = 0; i < 4; ++i)
11580             things;
11581
11582         This will get peeled just a bit by the bytecode generator, so that the "i < 4" is
11583         duplicated both at the top of the loop and the bottom.  This means that we have a
11584         constant comparison: "0 < 4", which the bytecode generator emits without any further
11585         thought.
11586
11587         The DFG optimization fixpoint of course folds this and simplifies the CFG
11588         accordingly, but this incurs a compile-time cost.  The purpose of this change is to
11589         do some surgical constant folding in the DFG's bytecode parser, so that such
11590         constructs reduce load on the CFG simplifier and the optimization fixpoint.  The goal
11591         is not to cover all cases, since the DFG CFA and CFG simplifier have a powerful
11592         sparse conditional constant propagation that we can always fall back on. Instead the
11593         goal is to cover enough cases that for common small functions we don't have to
11594         perform such transformations, thereby reducing compile times.
11595
11596         This also refactors m_inlineStackEntry->m_inlineCallFrame to be a handy method call
11597         and also adds the notion of a TriState-based JSValue::pureToBoolean(). Both of these
11598         things are used by the folder.
11599
11600         As well, care has been taken to make sure that the bytecode parser only does folding
11601         that is statically provable, and that doesn't arise out of speculation. This means
11602         we cannot fold on data flow that crosses inlining boundaries. On the other hand, the
11603         folding that the bytecode parser uses doesn't require phantoming anything. Such is
11604         the trade-off: for anything that we do need phantoming, we defer it to the
11605         optimization fixpoint.
11606
11607         Slight SunSpider speed-up.
11608
11609         * dfg/DFGByteCodeParser.cpp:
11610         (JSC::DFG::ByteCodeParser::get):
11611         (JSC::DFG::ByteCodeParser::getLocal):
11612         (JSC::DFG::ByteCodeParser::setLocal):
11613         (JSC::DFG::ByteCodeParser::flushDirect):
11614         (JSC::DFG::ByteCodeParser::flushArgumentsAndCapturedVariables):
11615         (JSC::DFG::ByteCodeParser::toInt32):
11616         (ByteCodeParser):
11617         (JSC::DFG::ByteCodeParser::inlineCallFrame):
11618         (JSC::DFG::ByteCodeParser::currentCodeOrigin):
11619         (JSC::DFG::ByteCodeParser::canFold):
11620         (JSC::DFG::ByteCodeParser::handleInlining):
11621         (JSC::DFG::ByteCodeParser::getScope):
11622         (JSC::DFG::ByteCodeParser::parseResolveOperations):
11623         (JSC::DFG::ByteCodeParser::parseBlock):
11624         (JSC::DFG::ByteCodeParser::parseCodeBlock):
11625         * dfg/DFGNode.h:
11626         (JSC::DFG::Node::isStronglyProvedConstantIn):
11627         (Node):
11628         * runtime/JSCJSValue.h:
11629         * runtime/JSCJSValueInlines.h:
11630         (JSC::JSValue::pureToBoolean):
11631         (JSC):
11632
11633 2013-02-07  Zoltan Herczeg  <zherczeg@webkit.org>
11634
11635         Invalid code is generated for storing constants with baseindex addressing modes on ARM traditional.
11636         https://bugs.webkit.org/show_bug.cgi?id=109050
11637
11638         Reviewed by Oliver Hunt.
11639
11640         The S! scratch register is reused, but it should contain the constant value.
11641
11642         * assembler/ARMAssembler.cpp:
11643         (JSC::ARMAssembler::baseIndexTransfer32):
11644         (JSC::ARMAssembler::baseIndexTransfer16):
11645
11646 2013-02-07  Andras Becsi  <andras.becsi@digia.com>
11647
11648         [Qt] Use GNU ar's thin archive format for intermediate static libs
11649         https://bugs.webkit.org/show_bug.cgi?id=109052
11650
11651         Reviewed by Jocelyn Turcotte.
11652
11653         Adjust project files that used activeBuildConfig()
11654         to use targetSubDir().
11655
11656         * JavaScriptCore.pri:
11657         * LLIntOffsetsExtractor.pro:
11658         * Target.pri:
11659
11660 2013-02-06  Roger Fong  <roger_fong@apple.com>
11661
11662         Unreviewed. Touchups to VS2010 WebKit solution.
11663         Fix an export generator script, modify some property sheets, add resouce file.
11664
11665         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorDebug.props:
11666         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd:
11667         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorRelease.props:
11668         * JavaScriptCore.vcxproj/resource.h: Added.
11669
11670 2013-02-06  Ilya Tikhonovsky  <loislo@chromium.org>
11671
11672         Web Inspector: Native Memory Instrumentation: assign class name to the heap graph node automatically
11673         https://bugs.webkit.org/show_bug.cgi?id=107262
11674
11675         Reviewed by Yury Semikhatsky.
11676
11677         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
11678
11679 2013-02-06  Mike West  <mkwst@chromium.org>
11680
11681         Add an ENABLE_NOSNIFF feature flag.
11682         https://bugs.webkit.org/show_bug.cgi?id=109029
11683
11684         Reviewed by Jochen Eisinger.
11685
11686         This new flag will control the behavior of 'X-Content-Type-Options: nosniff'
11687         when processing script and other resource types.
11688
11689         * Configurations/FeatureDefines.xcconfig:
11690
11691 2013-02-05  Mark Hahnenberg  <mhahnenberg@apple.com>
11692
11693         put_to_base should emit a Phantom for "value" across the ForceOSRExit
11694         https://bugs.webkit.org/show_bug.cgi?id=108998
11695
11696         Reviewed by Oliver Hunt.
11697
11698         Otherwise, the OSR exit compiler could clobber it, which would lead to badness.
11699
11700         * bytecode/CodeBlock.cpp:
11701         (JSC::CodeBlock::tallyFrequentExitSites): Build fixes for when DFG debug logging is enabled.
11702         * dfg/DFGByteCodeParser.cpp:
11703         (JSC::DFG::ByteCodeParser::parseBlock): Added extra Phantoms for the "value" field where needed.
11704         * dfg/DFGSpeculativeJIT.cpp:
11705         (JSC::DFG::SpeculativeJIT::compile): Ditto.
11706
11707 2013-02-05  Michael Saboff  <msaboff@apple.com>
11708
11709         Crash at JSC::call when loading www.gap.com with JSVALUE32_64 Enabled
11710         https://bugs.webkit.org/show_bug.cgi?id=108991
11711
11712         Reviewed by Oliver Hunt.
11713
11714         Changed the restoration from calleeGPR to nonArgGPR0 because the restoration of the return location
11715         may step on calleeGPR is it happen to be nonArgGPR2.
11716
11717         * dfg/DFGRepatch.cpp:
11718         (JSC::DFG::dfgLinkClosureCall):
11719
11720 2013-02-05  Roger Fong  <roger_fong@apple.com>
11721
11722         Add a JavaScriptCore Export Generator project.
11723         https://bugs.webkit.org/show_bug.cgi?id=108971.
11724
11725         Reviewed by Brent Fulgham.
11726
11727         * JavaScriptCore.vcxproj/JavaScriptCore.sln:
11728         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
11729         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
11730         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
11731         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator: Added.
11732         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj: Added.
11733         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.filters: Added.
11734         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGenerator.vcxproj.user: Added.
11735         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorBuildCmd.cmd: Added.
11736         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorCommon.props: Added.
11737         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorDebug.props: Added.
11738         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPostBuild.cmd: Added.
11739         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorPreBuild.cmd: Added.
11740         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExportGeneratorRelease.props: Added.
11741         * JavaScriptCore.vcxproj/JavaScriptCoreExportGenerator/JavaScriptCoreExports.def.in: Added.
11742
11743 2013-02-04  Filip Pizlo  <fpizlo@apple.com>
11744
11745         DFG should have a precise view of jump targets
11746         https://bugs.webkit.org/show_bug.cgi?id=108868
11747
11748         Reviewed by Oliver Hunt.
11749
11750         Previously, the DFG relied entirely on the CodeBlock's jump targets list for
11751         determining when to break basic blocks. This worked great, except sometimes it
11752         would be too conservative since the CodeBlock just says where the bytecode
11753         generator inserted labels.
11754
11755         This change keeps the old jump target list in CodeBlock since it is still
11756         valuable to the baseline JIT, but switches the DFG to use its own jump target
11757         calculator. This ought to reduce pressure on the DFG simplifier, which would
11758         previously do a lot of work to try to merge redundantly created basic blocks.
11759         It appears to be a 1% progression on SunSpider.
11760
11761         * CMakeLists.txt:
11762         * GNUmakefile.list.am:
11763         * JavaScriptCore.xcodeproj/project.pbxproj:
11764         * Target.pri:
11765         * bytecode/PreciseJumpTargets.cpp: Added.
11766         (JSC):
11767         (JSC::addSimpleSwitchTargets):
11768         (JSC::computePreciseJumpTargets):
11769         * bytecode/PreciseJumpTargets.h: Added.
11770         (JSC):
11771         * dfg/DFGByteCodeParser.cpp:
11772         (JSC::DFG::ByteCodeParser::parseCodeBlock):
11773
11774 2013-02-01  Roger Fong  <roger_fong@apple.com>
11775
11776         Make ConfigurationBuildDir include directories precede WebKitLibraries in JSC.
11777         https://bugs.webkit.org/show_bug.cgi?id=108693.
11778
11779         Rubberstamped by Timothy Horton.
11780
11781         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
11782
11783 2013-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
11784
11785         Structure::m_outOfLineCapacity is unnecessary
11786         https://bugs.webkit.org/show_bug.cgi?id=108206
11787
11788         Reviewed by Darin Adler.
11789
11790         Simplifying the utility functions that we use since we don't need a
11791         bunch of fancy templates for this one specific call site.
11792
11793         * runtime/Structure.h:
11794         (JSC::Structure::outOfLineCapacity):
11795
11796 2013-02-05  Mark Hahnenberg  <mhahnenberg@apple.com>
11797
11798         Objective-C API: testapi.mm should use ARC
11799         https://bugs.webkit.org/show_bug.cgi?id=107838
11800
11801         Reviewed by Oliver Hunt.
11802
11803         In ToT testapi.mm uses the Obj-C garbage collector, which hides a lot of our object lifetime bugs.
11804         We should enable ARC, since that is what most of our clients will be using. We use Xcode project
11805         settings to make sure we don't try to compile ARC on 32-bit.
11806
11807         * API/tests/testapi.mm:
11808         (+[TestObject testObject]):
11809         (testObjectiveCAPI):
11810         * JavaScriptCore.xcodeproj/project.pbxproj:
11811
11812 2013-02-05  Brent Fulgham  <bfulgham@webkit.org>
11813
11814         [Windows] Unreviewed VS2010 Build Correction after r141651
11815
11816         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Add missing
11817         StructureRareData.h and StructureRareData.cpp files.
11818         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Ditto.
11819
11820 2013-02-05  Michael Saboff  <msaboff@apple.com>
11821
11822         r141788 won't build due to not having all changes needed by Node* change
11823         https://bugs.webkit.org/show_bug.cgi?id=108944
11824
11825         Reviewed by David Kilzer.
11826
11827         Fixed three instances of integerResult(..., m_compileIndex) to be integerResult(..., node).
11828
11829         * dfg/DFGSpeculativeJIT.cpp:
11830         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
11831         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForARMv7s):
11832
11833 2013-02-04  Sheriff Bot  <webkit.review.bot@gmail.com>
11834
11835         Unreviewed, rolling out r141809.
11836         http://trac.webkit.org/changeset/141809
11837         https://bugs.webkit.org/show_bug.cgi?id=108860
11838
11839         ARC isn't supported on 32-bit. (Requested by mhahnenberg on
11840         #webkit).
11841
11842         * API/tests/testapi.mm:
11843         (+[TestObject testObject]):
11844         (testObjectiveCAPI):
11845         * JavaScriptCore.xcodeproj/project.pbxproj:
11846
11847 2013-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
11848
11849         Objective-C API: testapi.mm should use ARC
11850         https://bugs.webkit.org/show_bug.cgi?id=107838
11851
11852         Reviewed by Oliver Hunt.
11853
11854         In ToT testapi.mm uses the Obj-C garbage collector, which hides a lot of our object lifetime bugs.
11855         We should enable ARC, since that is what most of our clients will be using.
11856
11857         * API/tests/testapi.mm:
11858         (-[TestObject init]):
11859         (-[TestObject dealloc]):
11860         (+[TestObject testObject]):
11861         (testObjectiveCAPI):
11862         * JavaScriptCore.xcodeproj/project.pbxproj:
11863
11864 2013-02-04  Mark Hahnenberg  <mhahnenberg@apple.com>
11865
11866         Objective-C API: ObjCCallbackFunction should retain the target of its NSInvocation
11867         https://bugs.webkit.org/show_bug.cgi?id=108843
11868
11869         Reviewed by Darin Adler.
11870
11871         Currently, ObjCCallbackFunction doesn't retain the target of its NSInvocation. It needs to do
11872         this to prevent crashes when trying to invoke a callback later on.
11873
11874         * API/ObjCCallbackFunction.mm:
11875         (ObjCCallbackFunction::ObjCCallbackFunction):
11876         (ObjCCallbackFunction::~ObjCCallbackFunction):
11877
11878 2013-02-04  Martin Robinson  <mrobinson@igalia.com>
11879
11880         Fix GTK+ 'make dist' in preparation for the 1.11.5 release.
11881
11882         * GNUmakefile.list.am: Update the source lists.
11883
11884 2013-02-04  Michael Saboff  <msaboff@apple.com>
11885
11886         For ARMv7s use integer divide instruction for divide and modulo when possible
11887         https://bugs.webkit.org/show_bug.cgi?id=108840
11888
11889         Reviewed in person by Filip Pizlo.
11890
11891         Added ARMv7s integer divide path for ArithDiv and ArithMod where operands and results are integer.
11892         This is patterned after the similar code for X86.  Also added modulo power of 2 optimization
11893         that uses logical and.  Added sdiv and udiv to the ARMv7 disassembler.  Put all the changes
11894         behind #if CPU(APPLE_ARMV7S).
11895
11896         * assembler/ARMv7Assembler.h:
11897         (ARMv7Assembler):
11898         (JSC::ARMv7Assembler::sdiv):
11899         (JSC::ARMv7Assembler::udiv):
11900         * dfg/DFGCommon.h:
11901         (JSC::DFG::isARMv7s):
11902         * dfg/DFGFixupPhase.cpp:
11903         (JSC::DFG::FixupPhase::fixupNode):
11904         * dfg/DFGSpeculativeJIT.cpp:
11905         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
11906         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForARMv7s):
11907         * dfg/DFGSpeculativeJIT.h:
11908         (SpeculativeJIT):
11909         * dfg/DFGSpeculativeJIT32_64.cpp:
11910         (JSC::DFG::SpeculativeJIT::compile):
11911
11912 2013-02-04  David Kilzer  <ddkilzer@apple.com>
11913
11914         Check PrivateHeaders/JSBasePrivate.h for inappropriate macros
11915         <http://webkit.org/b/108749>
11916
11917         Reviewed by Joseph Pecoraro.
11918
11919         * JavaScriptCore.xcodeproj/project.pbxproj: Add
11920         PrivateHeaders/JSBasePrivate.h to list of headers to check in
11921         "Check for Inappropriate Macros in External Headers" build phase
11922         script.
11923
11924 2013-02-04  David Kilzer  <ddkilzer@apple.com>
11925
11926         Remove duplicate entries from JavaScriptCore Xcode project
11927
11928             $ uniq Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj | diff -u - Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj | patch -p0 -R
11929             patching file Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
11930
11931         * JavaScriptCore.xcodeproj/project.pbxproj: Remove duplicates.
11932
11933 2013-02-04  David Kilzer  <ddkilzer@apple.com>
11934
11935         Sort JavaScriptCore Xcode project file
11936
11937         * JavaScriptCore.xcodeproj/project.pbxproj:
11938
11939 2013-02-03  David Kilzer  <ddkilzer@apple.com>
11940
11941         Upstream ENABLE_PDFKIT_PLUGIN settting
11942         <http://webkit.org/b/108792>
11943
11944         Reviewed by Tim Horton.
11945
11946         * Configurations/FeatureDefines.xcconfig: Disable PDFKIT_PLUGIN
11947         on iOS since PDFKit is a Mac-only framework.
11948
11949 2013-02-02  Andreas Kling  <akling@apple.com>
11950
11951         Vector should consult allocator about ideal size when choosing capacity.
11952         <http://webkit.org/b/108410>
11953         <rdar://problem/13124002>
11954
11955         Reviewed by Benjamin Poulain.
11956
11957         Remove assertion about Vector capacity that won't hold anymore since capacity()
11958         may not be what you passed to reserveCapacity().
11959         Also export WTF::fastMallocGoodSize() for Windows builds.
11960
11961         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
11962         * bytecode/CodeBlock.cpp:
11963         (JSC::CodeBlock::CodeBlock):
11964
11965 2013-02-02  Patrick Gansterer  <paroga@webkit.org>
11966
11967         [CMake] Adopt the WinCE port to new CMake
11968         https://bugs.webkit.org/show_bug.cgi?id=108754
11969
11970         Reviewed by Laszlo Gombos.
11971
11972         * os-win32/WinMain.cpp: Removed.
11973         * shell/PlatformWinCE.cmake: Removed.
11974
11975 2013-02-02  Mark Rowe  <mrowe@apple.com>
11976
11977         <http://webkit.org/b/108745> WTF shouldn't use a script build phase to detect the presence of headers when the compiler can do it for us
11978
11979         Reviewed by Sam Weinig.
11980
11981         * DerivedSources.make: Remove an obsolete Makefile rule. This should have been removed when the use
11982         of the generated file moved to WTF.
11983
11984 2013-02-02  David Kilzer  <ddkilzer@apple.com>
11985
11986         Upstream iOS FeatureDefines
11987         <http://webkit.org/b/108753>
11988
11989         Reviewed by Anders Carlsson.
11990
11991         * Configurations/FeatureDefines.xcconfig:
11992         - ENABLE_DEVICE_ORIENTATION: Add iOS configurations.
11993         - ENABLE_PLUGIN_PROXY_FOR_VIDEO: Ditto.
11994         - FEATURE_DEFINES: Add ENABLE_PLUGIN_PROXY_FOR_VIDEO.  Add
11995           PLATFORM_NAME variant to reduce future merge conflicts.
11996
11997 2013-02-01  Mark Hahnenberg  <mhahnenberg@apple.com>
11998
11999         Structure::m_enumerationCache should be moved to StructureRareData
12000         https://bugs.webkit.org/show_bug.cgi?id=108723
12001
12002         Reviewed by Oliver Hunt.
12003
12004         m_enumerationCache is only used by objects whose properties are iterated over, so not every Structure needs this
12005         field and it can therefore be moved safely to StructureRareData to help with memory savings.
12006
12007         * runtime/JSPropertyNameIterator.h:
12008         (JSPropertyNameIterator):
12009         (JSC::Register::propertyNameIterator):
12010         (JSC::StructureRareData::enumerationCache): Add to JSPropertyNameIterator.h so that it can see the correct type.
12011         (JSC::StructureRareData::setEnumerationCache): Ditto.
12012         * runtime/Structure.cpp:
12013         (JSC::Structure::addPropertyWithoutTransition): Use the enumerationCache() getter rather than accessing the field.
12014         (JSC::Structure::removePropertyWithoutTransition): Ditto.
12015         (JSC::Structure::visitChildren): We no longer have to worry about marking the m_enumerationCache field.
12016         * runtime/Structure.h:
12017         (JSC::Structure::setEnumerationCache): Move the old accessors back since we don't have to have any knowledge of
12018         the JSPropertyNameIterator type.
12019         (JSC::Structure::enumerationCache): Ditto.
12020         * runtime/StructureRareData.cpp:
12021         (JSC::StructureRareData::visitChildren): Mark the new m_enumerationCache field.
12022         * runtime/StructureRareData.h: Add new functions/fields.
12023         (StructureRareData):
12024
12025 2013-02-01  Roger Fong  <roger_fong@apple.com>
12026
12027         Unreviewed. JavaScriptCore VS2010 project cleanup.
12028
12029         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
12030         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
12031         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
12032         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj:
12033
12034 2013-02-01  Sheriff Bot  <webkit.review.bot@gmail.com>
12035
12036         Unreviewed, rolling out r141662.
12037         http://trac.webkit.org/changeset/141662
12038         https://bugs.webkit.org/show_bug.cgi?id=108738
12039
12040         it's an incorrect change since processPhiStack will
12041         dereference dangling BasicBlock pointers (Requested by pizlo
12042         on #webkit).
12043
12044         * dfg/DFGByteCodeParser.cpp:
12045         (JSC::DFG::ByteCodeParser::parse):
12046
12047 2013-02-01  Filip Pizlo  <fpizlo@apple.com>
12048
12049         Eliminate dead blocks sooner in the DFG::ByteCodeParser to make clear that you don't need to hold onto them during Phi construction
12050         https://bugs.webkit.org/show_bug.cgi?id=108717
12051
12052         Reviewed by Mark Hahnenberg.
12053
12054         I think this makes the code clearer. It doesn't change behavior.
12055
12056         * dfg/DFGByteCodeParser.cpp:
12057         (JSC::DFG::ByteCodeParser::parse):
12058
12059 2013-02-01  Mark Hahnenberg  <mhahnenberg@apple.com>
12060
12061         Structure should have a StructureRareData field to save space
12062         https://bugs.webkit.org/show_bug.cgi?id=108659
12063
12064         Reviewed by Oliver Hunt.
12065
12066         Many of the fields in Structure are used in a subset of all total Structures; however, all Structures must
12067         pay the memory cost of those fields, regardless of whether they use them or not. Since we can have potentially
12068         many Structures on a single page (e.g. bing.com creates ~1500 Structures), it would be profitable to
12069         refactor Structure so that not every Structure has to pay the memory costs for these infrequently used fields.
12070
12071         To accomplish this, we can create a new StructureRareData class to house these seldom used fields which we
12072         can allocate on demand whenever a Structure requires it. This StructureRareData can itself be a JSCell, and
12073         can do all the marking of the fields for the Structure. The StructureRareData field will be part of a union
12074         with m_previous to minimize overhead. We'll add a new field to JSTypeInfo to indicate that the Structure has
12075         a StructureRareData field. During transitions, a Structure will clone its previous Structure's StructureRareData
12076         if it has one. There could be some potential for optimizing this process, but the initial implementation will
12077         be dumb since we'd be paying these overhead costs for each Structure anyways.
12078
12079         Initially we'll only put two fields in the StructureRareData to avoid a memory regression. Over time we'll
12080         continue to move fields from Structure to StructureRareData. Optimistically, this could potentially reduce our
12081         Structure memory footprint by up to around 75%. It could also clear the way for removing destructors from
12082         Structures (and into StructureRareData).
12083
12084         * CMakeLists.txt:
12085         * GNUmakefile.list.am:
12086         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
12087         * JavaScriptCore.xcodeproj/project.pbxproj:
12088         * Target.pri:
12089         * dfg/DFGRepatch.cpp: Includes for linking purposes.
12090         * jit/JITStubs.cpp:
12091         * jsc.cpp:
12092         * llint/LLIntSlowPaths.cpp:
12093         * runtime/JSCellInlines.h: Added ifdef guards.
12094         * runtime/JSGlobalData.cpp: New Structure for StructureRareData class.
12095         (JSC::JSGlobalData::JSGlobalData):
12096         * runtime/JSGlobalData.h:
12097         (JSGlobalData):
12098         * runtime/JSGlobalObject.h:
12099         * runtime/JSTypeInfo.h: New flag to indicate whether or not a Structure has a StructureRareData field.
12100         (JSC::TypeInfo::flags):
12101         (JSC::TypeInfo::structureHasRareData):
12102         * runtime/ObjectPrototype.cpp:
12103         * runtime/Structure.cpp: We use a combined WriteBarrier<JSCell> field m_previousOrRareData to avoid compiler issues.
12104         (JSC::Structure::dumpStatistics):
12105         (JSC::Structure::Structure):
12106         (JSC::Structure::materializePropertyMap):
12107         (JSC::Structure::addPropertyTransition):
12108         (JSC::Structure::nonPropertyTransition):
12109         (JSC::Structure::pin):
12110         (JSC::Structure::allocateRareData): Handles allocating a brand new StructureRareData field.
12111         (JSC::Structure::cloneRareDataFrom): Handles cloning a StructureRareData field from another. Used during Structure
12112         transitions.
12113         (JSC::Structure::visitChildren): We no longer have to worry about marking m_objectToStringValue.
12114         * runtime/Structure.h:
12115         (JSC::Structure::previousID): Checks the structureHasRareData flag to see where it should get the previous Structure.
12116         (JSC::Structure::objectToStringValue): Reads the value from the StructureRareData. If it doesn't exist, returns 0.
12117         (JSC::Structure::setObjectToStringValue): Ensures that we have a StructureRareData field, then forwards the function
12118         call to it.
12119         (JSC::Structure::materializePropertyMapIfNecessary):
12120         (JSC::Structure::setPreviousID): Checks for StructureRareData and forwards if necessary.
12121         (Structure):
12122         (JSC::Structure::clearPreviousID): Ditto.
12123         (JSC::Structure::create):
12124         * runtime/StructureRareData.cpp: Added. All of the basic functionality of a JSCell with the fields that we've moved
12125         from Structure and the functions required to access/modify those fields as Structure would have done.
12126         (JSC):
12127         (JSC::StructureRareData::createStructure):
12128         (JSC::StructureRareData::create):
12129         (JSC::StructureRareData::clone):
12130         (JSC::StructureRareData::StructureRareData):
12131         (JSC::StructureRareData::visitChildren):
12132         * runtime/StructureRareData.h: Added.
12133         (JSC):
12134         (StructureRareData):
12135         * runtime/StructureRareDataInlines.h: Added.
12136         (JSC):
12137         (JSC::StructureRareData::previousID):
12138         (JSC::StructureRareData::setPreviousID):
12139         (JSC::StructureRareData::clearPreviousID):
12140         (JSC::Structure::previous): Handles the ugly casting to get the value of the right type of m_previousOrRareData.
12141         (JSC::Structure::rareData): Ditto.
12142         (JSC::StructureRareData::objectToStringValue):
12143         (JSC::StructureRareData::setObjectToStringValue):
12144
12145         * CMakeLists.txt:
12146         * GNUmakefile.list.am:
12147         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
12148         * JavaScriptCore.xcodeproj/project.pbxproj:
12149         * Target.pri:
12150         * dfg/DFGRepatch.cpp:
12151         * jit/JITStubs.cpp:
12152         * jsc.cpp:
12153         * llint/LLIntSlowPaths.cpp:
12154         * runtime/JSCellInlines.h:
12155         * runtime/JSGlobalData.cpp:
12156         (JSC::JSGlobalData::JSGlobalData):
12157         * runtime/JSGlobalData.h:
12158         (JSGlobalData):
12159         * runtime/JSGlobalObject.h:
12160         * runtime/JSTypeInfo.h:
12161         (JSC):
12162         (JSC::TypeInfo::flags):
12163         (JSC::TypeInfo::structureHasRareData):
12164         * runtime/ObjectPrototype.cpp:
12165         * runtime/Structure.cpp:
12166         (JSC::Structure::dumpStatistics):
12167         (JSC::Structure::Structure):
12168         (JSC::Structure::materializePropertyMap):
12169         (JSC::Structure::addPropertyTransition):
12170         (JSC::Structure::nonPropertyTransition):
12171         (JSC::Structure::pin):
12172         (JSC::Structure::allocateRareData):
12173         (JSC):
12174         (JSC::Structure::cloneRareDataFrom):
12175         (JSC::Structure::visitChildren):
12176         * runtime/Structure.h:
12177         (JSC::Structure::previousID):
12178         (JSC::Structure::objectToStringValue):
12179         (JSC::Structure::setObjectToStringValue):
12180         (JSC::Structure::materializePropertyMapIfNecessary):
12181         (JSC::Structure::setPreviousID):
12182         (Structure):
12183         (JSC::Structure::clearPreviousID):
12184         (JSC::Structure::previous):
12185         (JSC::Structure::rareData):
12186         (JSC::Structure::create):
12187         * runtime/StructureRareData.cpp: Added.
12188         (JSC):
12189         (JSC::StructureRareData::createStructure):
12190         (JSC::StructureRareData::create):
12191         (JSC::StructureRareData::clone):
12192         (JSC::StructureRareData::StructureRareData):
12193         (JSC::StructureRareData::visitChildren):
12194         * runtime/StructureRareData.h: Added.
12195         (JSC):
12196         (StructureRareData):
12197         * runtime/StructureRareDataInlines.h: Added.
12198         (JSC):
12199         (JSC::StructureRareData::previousID):
12200         (JSC::StructureRareData::setPreviousID):
12201         (JSC::StructureRareData::clearPreviousID):
12202         (JSC::StructureRareData::objectToStringValue):
12203         (JSC::StructureRareData::setObjectToStringValue):
12204
12205 2013-02-01  Balazs Kilvady  <kilvadyb@homejinni.com>
12206
12207         offlineasm BaseIndex handling is broken on ARM due to MIPS changes
12208         https://bugs.webkit.org/show_bug.cgi?id=108261
12209
12210         Reviewed by Filip Pizlo.
12211
12212         offlineasm BaseIndex handling fix on MIPS.
12213
12214         * offlineasm/mips.rb:
12215         * offlineasm/risc.rb:
12216
12217 2013-02-01  Geoffrey Garen  <ggaren@apple.com>
12218
12219         Removed an unused function: JSGlobalObject::createFunctionExecutableFromGlobalCode
12220         https://bugs.webkit.org/show_bug.cgi?id=108657
12221
12222         Reviewed by Anders Carlsson.
12223
12224         * runtime/JSGlobalObject.cpp:
12225         (JSC):
12226         * runtime/JSGlobalObject.h:
12227         (JSGlobalObject):
12228
12229 2013-02-01  Geoffrey Garen  <ggaren@apple.com>
12230
12231         Added TriState to WTF and started using it in one place
12232         https://bugs.webkit.org/show_bug.cgi?id=108628
12233
12234         Reviewed by Beth Dakin.
12235
12236         * runtime/PrototypeMap.h:
12237         (JSC::PrototypeMap::isPrototype): Use TriState instead of boolean. In
12238         response to review feedback, this is an attempt to clarify that our
12239         'true' condition is actually just a 'maybe'.
12240
12241         * runtime/PrototypeMap.h:
12242         (PrototypeMap):
12243         (JSC::PrototypeMap::isPrototype):
12244
12245 2013-02-01  Alexis Menard  <alexis@webkit.org>
12246
12247         Enable unprefixed CSS transitions by default.
12248         https://bugs.webkit.org/show_bug.cgi?id=108216
12249
12250         Reviewed by Dean Jackson.
12251
12252         Rename the flag CSS_TRANSFORMS_ANIMATIONS_TRANSITIONS_UNPREFIXED
12253         to CSS_TRANSFORMS_ANIMATIONS_UNPREFIXED which will be used later to
12254         guard the unprefixing work for CSS Transforms and animations.
12255
12256         * Configurations/FeatureDefines.xcconfig:
12257
12258 2013-01-31  Filip Pizlo  <fpizlo@apple.com>
12259
12260         DFG::CFGSimplificationPhase::keepOperandAlive() conflates liveness and availability
12261         https://bugs.webkit.org/show_bug.cgi?id=108580
12262
12263         Reviewed by Oliver Hunt.
12264
12265         This is a harmless bug in that it only results in us keeping a bit too many things
12266         for OSR.  But it's worth fixing so that the code is consistent.
12267
12268         keepOperandAlive() is called when block A has a branch to blocks B and C, but the
12269         A->B edge is proven to never be taken and we want to optimize the code to have A
12270         unconditionally jump to C.  In that case, for the purposes of OSR, we need to
12271         preserve the knowledge that the state that B expected to be live incoming from A
12272         ought still to be live up to the point of where the A->B,C branch used to be.  The
12273         way we keep things alive is by using the variablesAtTail of A (i.e., we use the
12274         knowledge of in what manner A made state available to B and C).  The way we choose
12275         which state should be kept alive ought to be chosen by the variablesAtHead of B
12276         (i.e. the things B says it needs from its predecessors, including A), except that
12277         keepOperandAlive() was previously just using variablesAtTail of A for this
12278         purpose.
12279
12280         The fix is to have keepOperandAlive() use both liveness and availability in its
12281         logic. It should use liveness (i.e. B->variablesAtHead) to decide what to keep
12282         alive, and it should use availability (i.e. A->variablesAtTail) to decide how to
12283         keep it alive.
12284
12285         This might be a microscopic win on some programs, but it's mainly intended to be
12286         a code clean-up so that I don't end up scratching my head in confusion the next
12287         time I look at this code.
12288
12289         * dfg/DFGCFGSimplificationPhase.cpp:
12290         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
12291         (JSC::DFG::CFGSimplificationPhase::jettisonBlock):
12292         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
12293
12294 2013-01-31  Geoffrey Garen  <ggaren@apple.com>
12295
12296         REGRESSION (r141192): Crash beneath cti_op_get_by_id_generic @ discussions.apple.com
12297         https://bugs.webkit.org/show_bug.cgi?id=108576
12298
12299         Reviewed by Filip Pizlo.
12300
12301         This was a long-standing bug. The DFG would destructively reuse a register
12302         in op_convert_this, but:
12303
12304             * The bug only presented during speculation failure for type Other
12305
12306             * The bug presented by removing the low bits of a pointer, which
12307             used to be harmless, since all objects were so aligned anyway.
12308
12309         * dfg/DFGSpeculativeJIT64.cpp:
12310         (JSC::DFG::SpeculativeJIT::compile): Don't reuse our this register as
12311         our scratch register. The whole point of our scratch register is to
12312         avoid destructively modifying our this register. I'm pretty sure this
12313         was a copy-paste error.
12314
12315 2013-01-31  Roger Fong  <roger_fong@apple.com>
12316
12317         Unreviewed. Windows build fix.
12318
12319         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
12320
12321 2013-01-31  Jessie Berlin  <jberlin@apple.com>
12322
12323         Rolling out r141407 because it is causing crashes under
12324         WTF::TCMalloc_Central_FreeList::FetchFromSpans() in Release builds.
12325
12326         * bytecode/CodeBlock.cpp:
12327         (JSC::CodeBlock::CodeBlock):
12328
12329 2013-01-31  Mark Hahnenberg  <mhahnenberg@apple.com>
12330
12331         Objective-C API: JSContext exception property causes reference cycle
12332         https://bugs.webkit.org/show_bug.cgi?id=107778
12333
12334         Reviewed by Darin Adler.
12335
12336         JSContext has a (retain) JSValue * exception property which, when non-null, creates a
12337         reference cycle (since the JSValue * holds a strong reference back to the JSContext *).
12338
12339         * API/JSContext.mm: Instead of JSValue *, we now use a plain JSValueRef, which eliminates the reference cycle.
12340         (-[JSContext initWithVirtualMachine:]):
12341         (-[JSContext setException:]):
12342         (-[JSContext exception]):
12343
12344 2013-01-31  Roger Fong  <roger_fong@apple.com>
12345
12346         Unreviewed build fix. Win7 port.
12347
12348         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
12349
12350 2013-01-31  Joseph Pecoraro  <pecoraro@apple.com>
12351
12352         Disable ENABLE_FULLSCREEN_API on iOS
12353         https://bugs.webkit.org/show_bug.cgi?id=108250
12354
12355         Reviewed by Benjamin Poulain.
12356
12357         * Configurations/FeatureDefines.xcconfig:
12358
12359 2013-01-31  Mark Hahnenberg  <mhahnenberg@apple.com>
12360
12361         Objective-C API: Fix insertion of values greater than the max index allowed by the spec
12362         https://bugs.webkit.org/show_bug.cgi?id=108264
12363
12364         Reviewed by Oliver Hunt.
12365
12366         Fixed a bug, added a test to the API tests, cleaned up some code.
12367
12368         * API/JSValue.h: Changed some of the documentation on setValue:atIndex: to indicate that
12369         setting values at indices greater than UINT_MAX - 1 wont' affect the length of JS arrays.
12370         * API/JSValue.mm:
12371         (-[JSValue valueAtIndex:]): We weren't returning when we should have been.
12372         (-[JSValue setValue:atIndex:]): Added a comment about why we do the early check for being larger than UINT_MAX.
12373         (objectToValueWithoutCopy): Removed two redundant cases that were already checked previously.
12374         * API/tests/testapi.mm:
12375
12376 2013-01-30  Andreas Kling  <akling@apple.com>
12377
12378         Vector should consult allocator about ideal size when choosing capacity.
12379         <http://webkit.org/b/108410>
12380         <rdar://problem/13124002>
12381
12382         Reviewed by Benjamin Poulain.
12383
12384         Remove assertion about Vector capacity that won't hold anymore since capacity()
12385         may not be what you passed to reserveCapacity().
12386
12387         * bytecode/CodeBlock.cpp:
12388         (JSC::CodeBlock::CodeBlock):
12389
12390 2013-01-30  Filip Pizlo  <fpizlo@apple.com>
12391
12392         DFG bytecode parser should have more assertions about the status of local accesses
12393         https://bugs.webkit.org/show_bug.cgi?id=108417
12394
12395         Reviewed by Mark Hahnenberg.
12396
12397         Assert some things that we already know to be true, just to reassure ourselves that they are true.
12398         This is meant as a prerequisite for https://bugs.webkit.org/show_bug.cgi?id=108414, which will
12399         make these rules even stricter.
12400
12401         * dfg/DFGByteCodeParser.cpp:
12402         (JSC::DFG::ByteCodeParser::getLocal):
12403         (JSC::DFG::ByteCodeParser::getArgument):
12404
12405 2013-01-30  Mark Hahnenberg  <mhahnenberg@apple.com>
12406
12407         Objective-C API: JSContext's dealloc causes ASSERT due to ordering of releases
12408         https://bugs.webkit.org/show_bug.cgi?id=107978
12409
12410         Reviewed by Filip Pizlo.
12411
12412         We need to add the Identifier table save/restore in JSContextGroupRelease so that we
12413         have the correct table if we end up destroying the JSGlobalData/Heap.
12414
12415         * API/JSContextRef.cpp:
12416         (JSContextGroupRelease):
12417
12418 2013-01-30  Mark Hahnenberg  <mhahnenberg@apple.com>
12419
12420         Objective-C API: exceptionHandler needs to be released in JSContext dealloc
12421         https://bugs.webkit.org/show_bug.cgi?id=108378
12422
12423         Reviewed by Filip Pizlo.
12424
12425         JSContext has a (copy) exceptionHandler property that it doesn't release in dealloc.
12426         That sounds like the potential for a leak. It should be released.
12427
12428         * API/JSContext.mm:
12429         (-[JSContext dealloc]):
12430
12431 2013-01-30  Filip Pizlo  <fpizlo@apple.com>
12432
12433         REGRESSION(140504): pure CSE no longer matches things, 10% regression on Kraken
12434         https://bugs.webkit.org/show_bug.cgi?id=108366
12435
12436         Reviewed by Geoffrey Garen and Mark Hahnenberg.
12437
12438         This was a longstanding bug that was revealed by http://trac.webkit.org/changeset/140504.
12439         Pure CSE requires that the Node::flags() that may affect the behavior of a node match,
12440         when comparing a possibly redundant node to its possible replacement. It was doing this
12441         by comparing Node::arithNodeFlags(), which as the name might appear to suggest, returns
12442         just those flag bits that correspond to actual node behavior and not auxiliary things.
12443         Unfortunately, Node::arithNodeFlags() wasn't actually masking off the irrelevant bits.
12444         This worked prior to r140504 because CSE itself didn't mutate the flags, so there was a
12445         very high probability that matching nodes would also have completely identical flag bits
12446         (even the ones that aren't relevant to arithmetic behavior, like NodeDoesNotExit). But
12447         r140504 moved one of CSE's side-tables (m_relevantToOSR) into a flag bit for quicker
12448         access. These bits would be mutated as the CSE ran over a basic block, in such a way that
12449         there was a very high probability that the possible replacement would already have the
12450         bit set, while the redundant node did not have the bit set. Since Node::arithNodeFlags()
12451         returned all of the bits, this would cause CSEPhase::pureCSE() to reject the match
12452         almost every time.
12453
12454         The solution is to make Node::arithNodeFlags() do as its name suggests: only return those
12455         flags that are relevant to arithmetic behavior. This patch introduces a new mask that
12456         represents those bits, and includes NodeBehaviorMask and NodeBackPropMask, which are both
12457         used for queries on Node::arithNodeFlags(), and both affect arithmetic code gen. None of
12458         the other flags are relevant to Node::arithNodeFlags() since they either correspond to
12459         information already conveyed by the opcode (like NodeResultMask, NodeMustGenerate,
12460         NodeHasVarArgs, NodeClobbersWorld, NodeMightClobber) or information that doesn't affect
12461         the result that the node will produce or any of the queries performed on the result of
12462         Node::arithNodeFlags (NodeDoesNotExit and of course NodeRelevantToOSR).
12463
12464         This is a 10% speed-up on Kraken, undoing the regression from r140504.
12465
12466         * dfg/DFGNode.h:
12467         (JSC::DFG::Node::arithNodeFlags):
12468         * dfg/DFGNodeFlags.h:
12469         (DFG):
12470
12471 2013-01-29  Mark Hahnenberg  <mhahnenberg@apple.com>
12472
12473         Structure::m_outOfLineCapacity is unnecessary
12474         https://bugs.webkit.org/show_bug.cgi?id=108206
12475
12476         Reviewed by Geoffrey Garen.
12477
12478         We can calculate our out of line capacity by using the outOfLineSize and our knowledge about our resize policy.
12479         According to GDB, this knocks Structures down from 136 bytes to 128 bytes (I'm guessing the extra bytes are from
12480         better alignment of object fields), which puts Structures in a smaller size class. Woohoo! Looks neutral on our
12481         benchmarks.
12482
12483         * runtime/Structure.cpp:
12484         (JSC::Structure::Structure):
12485         (JSC):
12486         (JSC::Structure::suggestedNewOutOfLineStorageCapacity):
12487         (JSC::Structure::addPropertyTransition):
12488         (JSC::Structure::addPropertyWithoutTransition):
12489         * runtime/Structure.h:
12490         (Structure):
12491         (JSC::Structure::outOfLineCapacity):
12492         (JSC::Structure::totalStorageCapacity):
12493
12494 2013-01-29  Geoffrey Garen  <ggaren@apple.com>
12495
12496         Be a little more conservative about emitting table-based switches
12497         https://bugs.webkit.org/show_bug.cgi?id=108292
12498
12499         Reviewed by Filip Pizlo.
12500
12501         Profiling shows we're using op_switch in cases where it's a regression.
12502
12503         * bytecompiler/NodesCodegen.cpp:
12504         (JSC):
12505         (JSC::length):
12506         (JSC::CaseBlockNode::tryTableSwitch):
12507         (JSC::CaseBlockNode::emitBytecodeForBlock):
12508         * parser/Nodes.h:
12509         (CaseBlockNode):
12510
12511 2013-01-29  Sheriff Bot  <webkit.review.bot@gmail.com>
12512
12513         Unreviewed, rolling out r140983.
12514         http://trac.webkit.org/changeset/140983
12515         https://bugs.webkit.org/show_bug.cgi?id=108277
12516
12517         Unfortunately, this API has one last client (Requested by
12518         abarth on #webkit).
12519
12520         * Configurations/FeatureDefines.xcconfig:
12521
12522 2013-01-29  Mark Hahnenberg  <mhahnenberg@apple.com>
12523
12524         Objective-C API: JSObjCClassInfo creates reference cycle with JSContext
12525         https://bugs.webkit.org/show_bug.cgi?id=107839
12526
12527         Reviewed by Geoffrey Garen.
12528
12529         Fixing several ASSERTs that were incorrect along with some of the reallocation of m_prototype and
12530         m_constructor that they were based on.
12531
12532         * API/JSWrapperMap.mm:
12533         (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]): We now only allocate those
12534         fields that are null (i.e. have been collected or have never been allocated to begin with).
12535         (-[JSObjCClassInfo reallocateConstructorAndOrPrototype]): Renamed to better indicate that we're
12536         reallocating one or both of the prototype/constructor combo.
12537         (-[JSObjCClassInfo wrapperForObject:]): Call new reallocate function.
12538         (-[JSObjCClassInfo constructor]): Ditto.
12539
12540 2013-01-29  Geoffrey Garen  <ggaren@apple.com>
12541
12542         Make precise size classes more precise
12543         https://bugs.webkit.org/show_bug.cgi?id=108270
12544
12545         Reviewed by Mark Hahnenberg.
12546
12547         Size inference makes this profitable.
12548
12549         I chose 8 byte increments because JSString is 24 bytes. Otherwise, 16
12550         byte increments might be better.
12551
12552         * heap/Heap.h:
12553         (Heap): Removed firstAllocatorWithoutDestructors because it's unused now.
12554
12555         * heap/MarkedBlock.h:
12556         (MarkedBlock): Updated constants.
12557
12558         * heap/MarkedSpace.h:
12559         (MarkedSpace):
12560         (JSC): Also reduced the maximum precise size class because my testing
12561         has shown that the smaller size classes are much more common. This
12562         offsets some of the size class explosion caused by reducing the precise
12563         increment.
12564
12565         * llint/LLIntData.cpp:
12566         (JSC::LLInt::Data::performAssertions): No need for this ASSERT anymore
12567         because we don't rely on firstAllocatorWithoutDestructors anymore, since
12568         we pick size classes dynamically now.
12569
12570 2013-01-29  Oliver Hunt  <oliver@apple.com>
12571
12572         Add some hardening to methodTable()
12573         https://bugs.webkit.org/show_bug.cgi?id=108253
12574
12575         Reviewed by Mark Hahnenberg.
12576
12577         When accessing methodTable() we now always make sure that our
12578         structure _could_ be valid.  Added a separate method to get a
12579         classes methodTable during destruction as it's not possible to
12580         validate the structure at that point.  This separation might
12581         also make it possible to improve the performance of methodTable
12582         access more generally in future.
12583
12584         * heap/MarkedBlock.cpp:
12585         (JSC::MarkedBlock::callDestructor):
12586         * runtime/JSCell.h:
12587         (JSCell):
12588         * runtime/JSCellInlines.h:
12589         (JSC::JSCell::methodTableForDestruction):
12590         (JSC):
12591         (JSC::JSCell::methodTable):
12592
12593 2013-01-29  Filip Pizlo  <fpizlo@apple.com>
12594
12595         offlineasm BaseIndex handling is broken on ARM due to MIPS changes
12596         https://bugs.webkit.org/show_bug.cgi?id=108261
12597
12598         Reviewed by Oliver Hunt.
12599
12600         Backends shouldn't override each other's methods. That's not cool.
12601
12602         * offlineasm/mips.rb:
12603
12604 2013-01-29  Filip Pizlo  <fpizlo@apple.com>
12605
12606         cloop.rb shouldn't use a method called 'dump' for code generation
12607         https://bugs.webkit.org/show_bug.cgi?id=108251
12608
12609         Reviewed by Mark Hahnenberg.
12610
12611         Revert http://trac.webkit.org/changeset/141178 and rename 'dump' to 'clDump'.
12612
12613         Also made trivial build fixes for !ENABLE(JIT).
12614
12615         * offlineasm/cloop.rb:
12616         * runtime/Executable.h:
12617         (ExecutableBase):
12618         (JSC::ExecutableBase::intrinsicFor):
12619         * runtime/JSGlobalData.h:
12620
12621 2013-01-29  Geoffrey Garen  <ggaren@apple.com>
12622
12623         Removed GGC because it has been disabled for a long time
12624         https://bugs.webkit.org/show_bug.cgi?id=108245
12625
12626         Reviewed by Filip Pizlo.
12627
12628         * GNUmakefile.list.am:
12629         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
12630         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
12631         * JavaScriptCore.xcodeproj/project.pbxproj:
12632         * dfg/DFGRepatch.cpp:
12633         (JSC::DFG::emitPutReplaceStub):
12634         (JSC::DFG::emitPutTransitionStub):
12635         * dfg/DFGSpeculativeJIT.cpp:
12636         (JSC::DFG::SpeculativeJIT::writeBarrier):
12637         * dfg/DFGSpeculativeJIT.h:
12638         (SpeculativeJIT):
12639         * dfg/DFGSpeculativeJIT32_64.cpp:
12640         (JSC::DFG::SpeculativeJIT::compile):
12641         * dfg/DFGSpeculativeJIT64.cpp:
12642         (JSC::DFG::SpeculativeJIT::compile):
12643         * heap/CardSet.h: Removed.
12644         * heap/Heap.cpp:
12645         (JSC::Heap::markRoots):
12646         (JSC::Heap::collect):
12647         * heap/Heap.h:
12648         (Heap):
12649         (JSC::Heap::shouldCollect):
12650         (JSC::Heap::isWriteBarrierEnabled):
12651         (JSC):
12652         (JSC::Heap::writeBarrier):
12653         * heap/MarkedBlock.h:
12654         (MarkedBlock):
12655         (JSC):
12656         * heap/MarkedSpace.cpp:
12657         (JSC):
12658         * jit/JITPropertyAccess.cpp:
12659         (JSC::JIT::emitWriteBarrier):
12660
12661 2013-01-29  Filip Pizlo  <fpizlo@apple.com>
12662
12663         Remove redundant AST dump method from cloop.rb, since they are already defined in ast.rb
12664         https://bugs.webkit.org/show_bug.cgi?id=108247
12665
12666         Reviewed by Oliver Hunt.
12667
12668         Makes offlineasm dumping easier to read and less likely to cause assertion failures.
12669         Also fixes the strange situation where cloop.rb and ast.rb both defined dump methods,
12670         but cloop.rb was winning.
12671
12672         * offlineasm/cloop.rb:
12673
12674 2013-01-29  Mark Hahnenberg  <mhahnenberg@apple.com>
12675
12676         Objective-C API: JSObjCClassInfo creates reference cycle with JSContext
12677         https://bugs.webkit.org/show_bug.cgi?id=107839
12678
12679         Reviewed by Oliver Hunt.
12680
12681         JSContext has a JSWrapperMap, which has an NSMutableDictionary m_classMap, which has values that
12682         are JSObjCClassInfo objects, which have strong references to two JSValue *'s, m_prototype and
12683         m_constructor, which in turn have strong references to the JSContext, creating a reference cycle.
12684         We should make m_prototype and m_constructor Weak<JSObject>. This gets rid of the strong reference
12685         to the JSContext and also prevents clients from accidentally creating reference cycles by assigning
12686         to the prototype of the constructor. If Weak<JSObject> fields are ever garbage collected, we will
12687         reallocate them.
12688
12689         * API/JSContext.mm:
12690         (-[JSContext wrapperMap]):
12691         * API/JSContextInternal.h:
12692         * API/JSWrapperMap.mm:
12693         (-[JSObjCClassInfo initWithContext:forClass:superClassInfo:]):
12694         (-[JSObjCClassInfo dealloc]):
12695         (-[JSObjCClassInfo allocateConstructorAndPrototypeWithSuperClassInfo:]):
12696         (-[JSObjCClassInfo allocateConstructorAndPrototype]):
12697         (-[JSObjCClassInfo wrapperForObject:]):
12698         (-[JSObjCClassInfo constructor]):
12699
12700 2013-01-29  Oliver Hunt  <oliver@apple.com>
12701
12702         REGRESSION (r140594): RELEASE_ASSERT_NOT_REACHED in JSC::Interpreter::execute
12703         https://bugs.webkit.org/show_bug.cgi?id=108097
12704
12705         Reviewed by Geoffrey Garen.
12706
12707         LiteralParser was accepting a bogus 'var a.b = c' statement
12708
12709         * runtime/LiteralParser.cpp:
12710         (JSC::::tryJSONPParse):
12711
12712 2013-01-29  Oliver Hunt  <oliver@apple.com>
12713
12714         Force debug builds to do bounds checks on contiguous property storage
12715         https://bugs.webkit.org/show_bug.cgi?id=108212
12716
12717         Reviewed by Mark Hahnenberg.
12718
12719         Add a ContiguousData type that we use to represent contiguous property
12720         storage.  In release builds it is simply a pointer to the correct type,
12721         but in debug builds it also carries the data length and performs bounds
12722         checks.  This means we don't have to add as many manual bounds assertions
12723         when performing operations over contiguous data.
12724
12725         * dfg/DFGOperations.cpp:
12726         * runtime/ArrayStorage.h:
12727         (ArrayStorage):
12728         (JSC::ArrayStorage::vector):
12729         * runtime/Butterfly.h:
12730         (JSC::ContiguousData::ContiguousData):
12731         (ContiguousData):
12732         (JSC::ContiguousData::operator[]):
12733         (JSC::ContiguousData::data):
12734         (JSC::ContiguousData::length):
12735         (JSC):
12736         (JSC::Butterfly::contiguousInt32):
12737         (Butterfly):
12738         (JSC::Butterfly::contiguousDouble):
12739         (JSC::Butterfly::contiguous):
12740         * runtime/JSArray.cpp:
12741         (JSC::JSArray::sortNumericVector):
12742         (ContiguousTypeAccessor):
12743         (JSC::ContiguousTypeAccessor::getAsValue):
12744         (JSC::ContiguousTypeAccessor::setWithValue):
12745         (JSC::ContiguousTypeAccessor::replaceDataReference):
12746         (JSC):
12747         (JSC::JSArray::sortCompactedVector):
12748         (JSC::JSArray::sort):
12749         (JSC::JSArray::fillArgList):
12750         (JSC::JSArray::copyToArguments):
12751         * runtime/JSArray.h:
12752         (JSArray):
12753         * runtime/JSObject.cpp:
12754         (JSC::JSObject::copyButterfly):
12755         (JSC::JSObject::visitButterfly):
12756         (JSC::JSObject::createInitialInt32):
12757         (JSC::JSObject::createInitialDouble):
12758         (JSC::JSObject::createInitialContiguous):
12759         (JSC::JSObject::convertUndecidedToInt32):
12760         (JSC::JSObject::convertUndecidedToDouble):
12761         (JSC::JSObject::convertUndecidedToContiguous):
12762         (JSC::JSObject::convertInt32ToDouble):
12763         (JSC::JSObject::convertInt32ToContiguous):
12764         (JSC::JSObject::genericConvertDoubleToContiguous):
12765         (JSC::JSObject::convertDoubleToContiguous):
12766         (JSC::JSObject::rageConvertDoubleToContiguous):
12767         (JSC::JSObject::ensureInt32Slow):
12768         (JSC::JSObject::ensureDoubleSlow):
12769         (JSC::JSObject::ensureContiguousSlow):
12770         (JSC::JSObject::rageEnsureContiguousSlow):
12771         (JSC::JSObject::ensureLengthSlow):
12772         * runtime/JSObject.h:
12773         (JSC::JSObject::ensureInt32):
12774         (JSC::JSObject::ensureDouble):
12775         (JSC::JSObject::ensureContiguous):
12776         (JSC::JSObject::rageEnsureContiguous):
12777         (JSObject):
12778         (JSC::JSObject::indexingData):
12779         (JSC::JSObject::currentIndexingData):
12780
12781 2013-01-29  Brent Fulgham  <bfulgham@webkit.org>
12782
12783         [Windows, WinCairo] Unreviewed build fix after r141050
12784
12785         * JavaScriptCore.vcxproj/JavaScriptCoreExports.def: Update symbols
12786         to match JavaScriptCore.vcproj version.
12787
12788 2013-01-29  Allan Sandfeld Jensen  <allan.jensen@digia.com>
12789
12790         [Qt] Implement GCActivityCallback
12791         https://bugs.webkit.org/show_bug.cgi?id=103998
12792
12793         Reviewed by Simon Hausmann.
12794
12795         Implements the activity triggered garbage collector.
12796
12797         * runtime/GCActivityCallback.cpp:
12798         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
12799         (JSC::DefaultGCActivityCallback::scheduleTimer):
12800         (JSC::DefaultGCActivityCallback::cancelTimer):
12801         * runtime/GCActivityCallback.h:
12802         (GCActivityCallback):
12803         (DefaultGCActivityCallback):
12804
12805 2013-01-29  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
12806
12807         Compilation warning in JSC
12808         https://bugs.webkit.org/show_bug.cgi?id=108178
12809
12810         Reviewed by Kentaro Hara.
12811
12812         Fixed 'comparison between signed and unsigned integer' warning in JSC::Structure constructor.
12813
12814         * runtime/Structure.cpp:
12815         (JSC::Structure::Structure):
12816
12817 2013-01-29  Jocelyn Turcotte  <jocelyn.turcotte@digia.com>
12818
12819         [Qt] Fix the JSC build on Mac
12820
12821         Unreviewed, build fix.
12822
12823         * heap/HeapTimer.h:
12824         Qt on Mac has USE(CF) true, and should use the CF HeapTimer in that case.
12825
12826 2013-01-29  Allan Sandfeld Jensen  <allan.jensen@digia.com>
12827
12828         [Qt] Implement IncrementalSweeper and HeapTimer
12829         https://bugs.webkit.org/show_bug.cgi?id=103996
12830
12831         Reviewed by Simon Hausmann.
12832
12833         Implements the incremental sweeping garbage collection for the Qt platform.
12834
12835         * heap/HeapTimer.cpp:
12836         (JSC::HeapTimer::HeapTimer):
12837         (JSC::HeapTimer::~HeapTimer):
12838         (JSC::HeapTimer::timerEvent):
12839         (JSC::HeapTimer::synchronize):
12840         (JSC::HeapTimer::invalidate):
12841         (JSC::HeapTimer::didStartVMShutdown):
12842         * heap/HeapTimer.h:
12843         (HeapTimer):
12844         * heap/IncrementalSweeper.cpp:
12845         (JSC::IncrementalSweeper::IncrementalSweeper):
12846         (JSC::IncrementalSweeper::scheduleTimer):
12847         * heap/IncrementalSweeper.h:
12848         (IncrementalSweeper):
12849
12850 2013-01-28  Filip Pizlo  <fpizlo@apple.com>
12851
12852         DFG should not use a graph that is a vector, Nodes shouldn't move after allocation, and we should always refer to nodes by Node*
12853         https://bugs.webkit.org/show_bug.cgi?id=106868
12854
12855         Reviewed by Oliver Hunt.
12856
12857         This adds a pool allocator for Nodes, and uses that instead of a Vector. Changes all
12858         uses of Node& and NodeIndex to be simply Node*. Nodes no longer have an index except
12859         for debugging (Node::index(), which is not guaranteed to be O(1)).
12860
12861         1% speed-up on SunSpider, presumably because this improves compile times.
12862
12863         * CMakeLists.txt:
12864         * GNUmakefile.list.am:
12865         * JavaScriptCore.xcodeproj/project.pbxproj:
12866         * Target.pri:
12867         * bytecode/DataFormat.h:
12868         (JSC::dataFormatToString):
12869         * dfg/DFGAbstractState.cpp:
12870         (JSC::DFG::AbstractState::initialize):
12871         (JSC::DFG::AbstractState::booleanResult):
12872         (JSC::DFG::AbstractState::execute):
12873         (JSC::DFG::AbstractState::mergeStateAtTail):
12874         (JSC::DFG::AbstractState::mergeToSuccessors):
12875         (JSC::DFG::AbstractState::mergeVariableBetweenBlocks):
12876         (JSC::DFG::AbstractState::dump):
12877         * dfg/DFGAbstractState.h:
12878         (DFG):
12879         (JSC::DFG::AbstractState::forNode):
12880         (AbstractState):
12881         (JSC::DFG::AbstractState::speculateInt32Unary):
12882         (JSC::DFG::AbstractState::speculateNumberUnary):
12883         (JSC::DFG::AbstractState::speculateBooleanUnary):
12884         (JSC::DFG::AbstractState::speculateInt32Binary):
12885         (JSC::DFG::AbstractState::speculateNumberBinary):
12886         (JSC::DFG::AbstractState::trySetConstant):
12887         * dfg/DFGAbstractValue.h:
12888         (AbstractValue):
12889         * dfg/DFGAdjacencyList.h:
12890         (JSC::DFG::AdjacencyList::AdjacencyList):
12891         (JSC::DFG::AdjacencyList::initialize):
12892         * dfg/DFGAllocator.h: Added.
12893         (DFG):
12894         (Allocator):
12895         (JSC::DFG::Allocator::Region::size):
12896         (JSC::DFG::Allocator::Region::headerSize):
12897         (JSC::DFG::Allocator::Region::numberOfThingsPerRegion):
12898         (JSC::DFG::Allocator::Region::data):
12899         (JSC::DFG::Allocator::Region::isInThisRegion):
12900         (JSC::DFG::Allocator::Region::regionFor):
12901         (Region):
12902         (JSC::DFG::::Allocator):
12903         (JSC::DFG::::~Allocator):
12904         (JSC::DFG::::allocate):
12905         (JSC::DFG::::free):
12906         (JSC::DFG::::freeAll):
12907         (JSC::DFG::::reset):
12908         (JSC::DFG::::indexOf):
12909         (JSC::DFG::::allocatorOf):
12910         (JSC::DFG::::bumpAllocate):
12911         (JSC::DFG::::freeListAllocate):
12912         (JSC::DFG::::allocateSlow):
12913         (JSC::DFG::::freeRegionsStartingAt):
12914         (JSC::DFG::::startBumpingIn):
12915         * dfg/DFGArgumentsSimplificationPhase.cpp:
12916         (JSC::DFG::ArgumentsSimplificationPhase::run):
12917         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
12918         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
12919         (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
12920         (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
12921         (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
12922         * dfg/DFGArrayMode.cpp:
12923         (JSC::DFG::ArrayMode::originalArrayStructure):
12924         (JSC::DFG::ArrayMode::alreadyChecked):
12925         * dfg/DFGArrayMode.h:
12926         (ArrayMode):
12927         * dfg/DFGArrayifySlowPathGenerator.h:
12928         (JSC::DFG::ArrayifySlowPathGenerator::ArrayifySlowPathGenerator):
12929         * dfg/DFGBasicBlock.h:
12930         (JSC::DFG::BasicBlock::node):
12931         (JSC::DFG::BasicBlock::isInPhis):
12932         (JSC::DFG::BasicBlock::isInBlock):
12933         (BasicBlock):
12934         * dfg/DFGBasicBlockInlines.h:
12935         (DFG):
12936         * dfg/DFGByteCodeParser.cpp:
12937         (ByteCodeParser):
12938         (JSC::DFG::ByteCodeParser::getDirect):
12939         (JSC::DFG::ByteCodeParser::get):
12940         (JSC::DFG::ByteCodeParser::setDirect):
12941         (JSC::DFG::ByteCodeParser::set):
12942         (JSC::DFG::ByteCodeParser::setPair):
12943         (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
12944         (JSC::DFG::ByteCodeParser::getLocal):
12945         (JSC::DFG::ByteCodeParser::setLocal):
12946         (JSC::DFG::ByteCodeParser::getArgument):
12947         (JSC::DFG::ByteCodeParser::setArgument):
12948         (JSC::DFG::ByteCodeParser::flushDirect):
12949         (JSC::DFG::ByteCodeParser::getToInt32):
12950         (JSC::DFG::ByteCodeParser::toInt32):
12951         (JSC::DFG::ByteCodeParser::getJSConstantForValue):
12952         (JSC::DFG::ByteCodeParser::getJSConstant):
12953         (JSC::DFG::ByteCodeParser::getCallee):
12954         (JSC::DFG::ByteCodeParser::getThis):
12955         (JSC::DFG::ByteCodeParser::setThis):
12956         (JSC::DFG::ByteCodeParser::isJSConstant):
12957         (JSC::DFG::ByteCodeParser::isInt32Constant):
12958         (JSC::DFG::ByteCodeParser::valueOfJSConstant):
12959         (JSC::DFG::ByteCodeParser::valueOfInt32Constant):
12960         (JSC::DFG::ByteCodeParser::constantUndefined):
12961         (JSC::DFG::ByteCodeParser::constantNull):
12962         (JSC::DFG::ByteCodeParser::one):
12963         (JSC::DFG::ByteCodeParser::constantNaN):
12964         (JSC::DFG::ByteCodeParser::cellConstant):
12965         (JSC::DFG::ByteCodeParser::addToGraph):
12966         (JSC::DFG::ByteCodeParser::insertPhiNode):
12967         (JSC::DFG::ByteCodeParser::addVarArgChild):
12968         (JSC::DFG::ByteCodeParser::addCall):
12969         (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
12970         (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
12971         (JSC::DFG::ByteCodeParser::getPrediction):
12972         (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
12973         (JSC::DFG::ByteCodeParser::makeSafe):
12974         (JSC::DFG::ByteCodeParser::makeDivSafe):
12975         (JSC::DFG::ByteCodeParser::ConstantRecord::ConstantRecord):
12976         (ConstantRecord):
12977         (JSC::DFG::ByteCodeParser::PhiStackEntry::PhiStackEntry):
12978         (PhiStackEntry):
12979         (JSC::DFG::ByteCodeParser::handleCall):
12980         (JSC::DFG::ByteCodeParser::emitFunctionChecks):
12981         (JSC::DFG::ByteCodeParser::handleInlining):
12982         (JSC::DFG::ByteCodeParser::setIntrinsicResult):
12983         (JSC::DFG::ByteCodeParser::handleMinMax):
12984         (JSC::DFG::ByteCodeParser::handleIntrinsic):
12985         (JSC::DFG::ByteCodeParser::handleGetByOffset):
12986         (JSC::DFG::ByteCodeParser::handleGetById):
12987         (JSC::DFG::ByteCodeParser::getScope):
12988         (JSC::DFG::ByteCodeParser::parseResolveOperations):
12989         (JSC::DFG::ByteCodeParser::parseBlock):
12990         (JSC::DFG::ByteCodeParser::processPhiStack):
12991         (JSC::DFG::ByteCodeParser::linkBlock):
12992         (JSC::DFG::ByteCodeParser::parseCodeBlock):
12993         (JSC::DFG::ByteCodeParser::parse):
12994         * dfg/DFGCFAPhase.cpp:
12995         (JSC::DFG::CFAPhase::performBlockCFA):
12996         * dfg/DFGCFGSimplificationPhase.cpp:
12997         (JSC::DFG::CFGSimplificationPhase::run):
12998         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
12999         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
13000         (JSC::DFG::CFGSimplificationPhase::fixPhis):
13001         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
13002         (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::OperandSubstitution):
13003         (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::dump):
13004         (OperandSubstitution):
13005         (JSC::DFG::CFGSimplificationPhase::skipGetLocal):
13006         (JSC::DFG::CFGSimplificationPhase::recordNewTarget):
13007         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
13008         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
13009         * dfg/DFGCSEPhase.cpp:
13010         (JSC::DFG::CSEPhase::canonicalize):
13011         (JSC::DFG::CSEPhase::endIndexForPureCSE):
13012         (JSC::DFG::CSEPhase::pureCSE):
13013         (JSC::DFG::CSEPhase::constantCSE):
13014         (JSC::DFG::CSEPhase::weakConstantCSE):
13015         (JSC::DFG::CSEPhase::getCalleeLoadElimination):
13016         (JSC::DFG::CSEPhase::getArrayLengthElimination):
13017         (JSC::DFG::CSEPhase::globalVarLoadElimination):
13018         (JSC::DFG::CSEPhase::scopedVarLoadElimination):
13019         (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
13020         (JSC::DFG::CSEPhase::globalVarStoreElimination):
13021         (JSC::DFG::CSEPhase::scopedVarStoreElimination):
13022         (JSC::DFG::CSEPhase::getByValLoadElimination):
13023         (JSC::DFG::CSEPhase::checkFunctionElimination):
13024         (JSC::DFG::CSEPhase::checkExecutableElimination):
13025         (JSC::DFG::CSEPhase::checkStructureElimination):
13026         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
13027         (JSC::DFG::CSEPhase::putStructureStoreElimination):
13028         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
13029         (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
13030         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
13031         (JSC::DFG::CSEPhase::checkArrayElimination):
13032         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
13033         (JSC::DFG::CSEPhase::getMyScopeLoadElimination):
13034         (JSC::DFG::CSEPhase::getLocalLoadElimination):
13035         (JSC::DFG::CSEPhase::setLocalStoreElimination):
13036         (JSC::DFG::CSEPhase::performSubstitution):
13037         (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
13038         (JSC::DFG::CSEPhase::setReplacement):
13039         (JSC::DFG::CSEPhase::eliminate):
13040         (JSC::DFG::CSEPhase::performNodeCSE):
13041         (JSC::DFG::CSEPhase::performBlockCSE):
13042         (CSEPhase):
13043         * dfg/DFGCommon.cpp: Added.
13044         (DFG):
13045         (JSC::DFG::NodePointerTraits::dump):
13046         * dfg/DFGCommon.h:
13047         (DFG):
13048         (JSC::DFG::NodePointerTraits::defaultValue):
13049         (NodePointerTraits):
13050         (JSC::DFG::verboseCompilationEnabled):
13051         (JSC::DFG::shouldDumpGraphAtEachPhase):
13052         (JSC::DFG::validationEnabled):
13053         * dfg/DFGConstantFoldingPhase.cpp:
13054         (JSC::DFG::ConstantFoldingPhase::foldConstants):
13055         (JSC::DFG::ConstantFoldingPhase::isCapturedAtOrAfter):
13056         (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
13057         (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
13058         * dfg/DFGDisassembler.cpp:
13059         (JSC::DFG::Disassembler::Disassembler):
13060         (JSC::DFG::Disassembler::createDumpList):
13061         (JSC::DFG::Disassembler::dumpDisassembly):
13062         * dfg/DFGDisassembler.h:
13063         (JSC::DFG::Disassembler::setForNode):
13064         (Disassembler):
13065         * dfg/DFGDriver.cpp:
13066         (JSC::DFG::compile):
13067         * dfg/DFGEdge.cpp: Added.
13068         (DFG):
13069         (JSC::DFG::Edge::dump):
13070         * dfg/DFGEdge.h:
13071         (JSC::DFG::Edge::Edge):
13072         (JSC::DFG::Edge::node):
13073         (JSC::DFG::Edge::operator*):
13074         (JSC::DFG::Edge::operator->):
13075         (Edge):
13076         (JSC::DFG::Edge::setNode):
13077         (JSC::DFG::Edge::useKind):
13078         (JSC::DFG::Edge::setUseKind):
13079         (JSC::DFG::Edge::isSet):
13080         (JSC::DFG::Edge::shift):
13081         (JSC::DFG::Edge::makeWord):
13082         (JSC::DFG::operator==):
13083         (JSC::DFG::operator!=):
13084         * dfg/DFGFixupPhase.cpp:
13085         (JSC::DFG::FixupPhase::fixupBlock):
13086         (JSC::DFG::FixupPhase::fixupNode):
13087         (JSC::DFG::FixupPhase::checkArray):
13088         (JSC::DFG::FixupPhase::blessArrayOperation):
13089         (JSC::DFG::FixupPhase::fixIntEdge):
13090         (JSC::DFG::FixupPhase::fixDoubleEdge):
13091         (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
13092         (FixupPhase):
13093         * dfg/DFGGenerationInfo.h:
13094         (JSC::DFG::GenerationInfo::GenerationInfo):
13095         (JSC::DFG::GenerationInfo::initConstant):
13096         (JSC::DFG::GenerationInfo::initInteger):
13097         (JSC::DFG::GenerationInfo::initJSValue):
13098         (JSC::DFG::GenerationInfo::initCell):
13099         (JSC::DFG::GenerationInfo::initBoolean):
13100         (JSC::DFG::GenerationInfo::initDouble):
13101         (JSC::DFG::GenerationInfo::initStorage):
13102         (GenerationInfo):
13103         (JSC::DFG::GenerationInfo::node):
13104         (JSC::DFG::GenerationInfo::noticeOSRBirth):
13105         (JSC::DFG::GenerationInfo::use):
13106         (JSC::DFG::GenerationInfo::appendFill):
13107         (JSC::DFG::GenerationInfo::appendSpill):
13108         * dfg/DFGGraph.cpp:
13109         (JSC::DFG::Graph::Graph):
13110         (JSC::DFG::Graph::~Graph):
13111         (DFG):
13112         (JSC::DFG::Graph::dumpCodeOrigin):
13113         (JSC::DFG::Graph::amountOfNodeWhiteSpace):
13114         (JSC::DFG::Graph::printNodeWhiteSpace):
13115         (JSC::DFG::Graph::dump):
13116         (JSC::DFG::Graph::dumpBlockHeader):
13117         (JSC::DFG::Graph::refChildren):
13118         (JSC::DFG::Graph::derefChildren):
13119         (JSC::DFG::Graph::predictArgumentTypes):
13120         (JSC::DFG::Graph::collectGarbage):
13121         (JSC::DFG::Graph::determineReachability):
13122         (JSC::DFG::Graph::resetExitStates):
13123         * dfg/DFGGraph.h:
13124         (Graph):
13125         (JSC::DFG::Graph::ref):
13126         (JSC::DFG::Graph::deref):
13127         (JSC::DFG::Graph::changeChild):
13128         (JSC::DFG::Graph::compareAndSwap):
13129         (JSC::DFG::Graph::clearAndDerefChild):
13130         (JSC::DFG::Graph::clearAndDerefChild1):
13131         (JSC::DFG::Graph::clearAndDerefChild2):
13132         (JSC::DFG::Graph::clearAndDerefChild3):
13133         (JSC::DFG::Graph::convertToConstant):
13134         (JSC::DFG::Graph::getJSConstantSpeculation):
13135         (JSC::DFG::Graph::addSpeculationMode):
13136         (JSC::DFG::Graph::valueAddSpeculationMode):
13137         (JSC::DFG::Graph::arithAddSpeculationMode):
13138         (JSC::DFG::Graph::addShouldSpeculateInteger):
13139         (JSC::DFG::Graph::mulShouldSpeculateInteger):
13140         (JSC::DFG::Graph::negateShouldSpeculateInteger):
13141         (JSC::DFG::Graph::isConstant):
13142         (JSC::DFG::Graph::isJSConstant):
13143         (JSC::DFG::Graph::isInt32Constant):
13144         (JSC::DFG::Graph::isDoubleConstant):
13145         (JSC::DFG::Graph::isNumberConstant):
13146         (JSC::DFG::Graph::isBooleanConstant):
13147         (JSC::DFG::Graph::isCellConstant):
13148         (JSC::DFG::Graph::isFunctionConstant):
13149         (JSC::DFG::Graph::isInternalFunctionConstant):
13150         (JSC::DFG::Graph::valueOfJSConstant):
13151         (JSC::DFG::Graph::valueOfInt32Constant):
13152         (JSC::DFG::Graph::valueOfNumberConstant):
13153         (JSC::DFG::Graph::valueOfBooleanConstant):
13154         (JSC::DFG::Graph::valueOfFunctionConstant):
13155         (JSC::DFG::Graph::valueProfileFor):
13156         (JSC::DFG::Graph::methodOfGettingAValueProfileFor):
13157         (JSC::DFG::Graph::numSuccessors):
13158         (JSC::DFG::Graph::successor):
13159         (JSC::DFG::Graph::successorForCondition):
13160         (JSC::DFG::Graph::isPredictedNumerical):
13161         (JSC::DFG::Graph::byValIsPure):
13162         (JSC::DFG::Graph::clobbersWorld):
13163         (JSC::DFG::Graph::varArgNumChildren):
13164         (JSC::DFG::Graph::numChildren):
13165         (JSC::DFG::Graph::varArgChild):
13166         (JSC::DFG::Graph::child):
13167         (JSC::DFG::Graph::voteNode):
13168         (JSC::DFG::Graph::voteChildren):
13169         (JSC::DFG::Graph::substitute):
13170         (JSC::DFG::Graph::substituteGetLocal):
13171         (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
13172         (JSC::DFG::Graph::mulImmediateShouldSpeculateInteger):
13173         * dfg/DFGInsertionSet.h:
13174         (JSC::DFG::Insertion::Insertion):
13175         (JSC::DFG::Insertion::element):
13176         (Insertion):
13177         (JSC::DFG::InsertionSet::insert):
13178         (InsertionSet):
13179         * dfg/DFGJITCompiler.cpp:
13180         * dfg/DFGJITCompiler.h:
13181         (JSC::DFG::JITCompiler::setForNode):
13182         (JSC::DFG::JITCompiler::addressOfDoubleConstant):
13183         (JSC::DFG::JITCompiler::noticeOSREntry):
13184         * dfg/DFGLongLivedState.cpp: Added.
13185         (DFG):
13186         (JSC::DFG::LongLivedState::LongLivedState):
13187         (JSC::DFG::LongLivedState::~LongLivedState):
13188         (JSC::DFG::LongLivedState::shrinkToFit):
13189         * dfg/DFGLongLivedState.h: Added.
13190         (DFG):
13191         (LongLivedState):
13192         * dfg/DFGMinifiedID.h:
13193         (JSC::DFG::MinifiedID::MinifiedID):
13194         (JSC::DFG::MinifiedID::node):
13195         * dfg/DFGMinifiedNode.cpp:
13196         (JSC::DFG::MinifiedNode::fromNode):
13197         * dfg/DFGMinifiedNode.h:
13198         (MinifiedNode):
13199         * dfg/DFGNode.cpp: Added.
13200         (DFG):
13201         (JSC::DFG::Node::index):
13202         (WTF):
13203         (WTF::printInternal):
13204         * dfg/DFGNode.h:
13205         (DFG):
13206         (JSC::DFG::Node::Node):
13207         (Node):
13208         (JSC::DFG::Node::convertToGetByOffset):
13209         (JSC::DFG::Node::convertToPutByOffset):
13210         (JSC::DFG::Node::ref):
13211         (JSC::DFG::Node::shouldSpeculateInteger):
13212         (JSC::DFG::Node::shouldSpeculateIntegerForArithmetic):
13213         (JSC::DFG::Node::shouldSpeculateIntegerExpectingDefined):
13214         (JSC::DFG::Node::shouldSpeculateDoubleForArithmetic):
13215         (JSC::DFG::Node::shouldSpeculateNumber):
13216         (JSC::DFG::Node::shouldSpeculateNumberExpectingDefined):
13217         (JSC::DFG::Node::shouldSpeculateFinalObject):
13218         (JSC::DFG::Node::shouldSpeculateArray):
13219         (JSC::DFG::Node::dumpChildren):
13220         (WTF):
13221         * dfg/DFGNodeAllocator.h: Added.
13222         (DFG):
13223         (operator new ):
13224         * dfg/DFGOSRExit.cpp:
13225         (JSC::DFG::OSRExit::OSRExit):
13226         * dfg/DFGOSRExit.h:
13227         (OSRExit):
13228         (SpeculationFailureDebugInfo):
13229         * dfg/DFGOSRExitCompiler.cpp:
13230         * dfg/DFGOSRExitCompiler32_64.cpp:
13231         (JSC::DFG::OSRExitCompiler::compileExit):
13232         * dfg/DFGOSRExitCompiler64.cpp:
13233         (JSC::DFG::OSRExitCompiler::compileExit):
13234         * dfg/DFGOperations.cpp:
13235         * dfg/DFGPhase.cpp:
13236         (DFG):
13237         (JSC::DFG::Phase::beginPhase):
13238         (JSC::DFG::Phase::endPhase):
13239         * dfg/DFGPhase.h:
13240         (Phase):
13241         (JSC::DFG::runAndLog):
13242         * dfg/DFGPredictionPropagationPhase.cpp:
13243         (JSC::DFG::PredictionPropagationPhase::setPrediction):
13244         (JSC::DFG::PredictionPropagationPhase::mergePrediction):
13245         (JSC::DFG::PredictionPropagationPhase::isNotNegZero):
13246         (JSC::DFG::PredictionPropagationPhase::isNotZero):
13247         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoForConstant):
13248         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoNonRecursive):
13249         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwo):
13250         (JSC::DFG::PredictionPropagationPhase::propagate):
13251         (JSC::DFG::PredictionPropagationPhase::mergeDefaultFlags):
13252         (JSC::DFG::PredictionPropagationPhase::propagateForward):
13253         (JSC::DFG::PredictionPropagationPhase::propagateBackward):
13254         (JSC::DFG::PredictionPropagationPhase::doDoubleVoting):
13255         (PredictionPropagationPhase):
13256         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
13257         * dfg/DFGScoreBoard.h:
13258         (JSC::DFG::ScoreBoard::ScoreBoard):
13259         (JSC::DFG::ScoreBoard::use):
13260         (JSC::DFG::ScoreBoard::useIfHasResult):
13261         (ScoreBoard):
13262         * dfg/DFGSilentRegisterSavePlan.h:
13263         (JSC::DFG::SilentRegisterSavePlan::SilentRegisterSavePlan):
13264         (JSC::DFG::SilentRegisterSavePlan::node):
13265         (SilentRegisterSavePlan):
13266         * dfg/DFGSlowPathGenerator.h:
13267         (JSC::DFG::SlowPathGenerator::SlowPathGenerator):
13268         (JSC::DFG::SlowPathGenerator::generate):
13269         (SlowPathGenerator):
13270         * dfg/DFGSpeculativeJIT.cpp:
13271         (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
13272         (JSC::DFG::SpeculativeJIT::speculationCheck):
13273         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
13274         (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
13275         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
13276         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
13277         (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
13278         (JSC::DFG::SpeculativeJIT::silentSavePlanForFPR):
13279         (JSC::DFG::SpeculativeJIT::silentSpill):
13280         (JSC::DFG::SpeculativeJIT::silentFill):
13281         (JSC::DFG::SpeculativeJIT::checkArray):
13282         (JSC::DFG::SpeculativeJIT::arrayify):
13283         (JSC::DFG::SpeculativeJIT::fillStorage):
13284         (JSC::DFG::SpeculativeJIT::useChildren):
13285         (JSC::DFG::SpeculativeJIT::isStrictInt32):
13286         (JSC::DFG::SpeculativeJIT::isKnownInteger):
13287         (JSC::DFG::SpeculativeJIT::isKnownNumeric):
13288         (JSC::DFG::SpeculativeJIT::isKnownCell):
13289         (JSC::DFG::SpeculativeJIT::isKnownNotCell):
13290         (JSC::DFG::SpeculativeJIT::isKnownNotInteger):
13291         (JSC::DFG::SpeculativeJIT::isKnownNotNumber):
13292         (JSC::DFG::SpeculativeJIT::writeBarrier):
13293         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompare):
13294         (JSC::DFG::SpeculativeJIT::nonSpeculativeStrictEq):
13295         (JSC::DFG::GPRTemporary::GPRTemporary):
13296         (JSC::DFG::FPRTemporary::FPRTemporary):
13297         (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
13298         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
13299         (JSC::DFG::SpeculativeJIT::compilePeepHoleIntegerBranch):
13300         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
13301         (JSC::DFG::SpeculativeJIT::noticeOSRBirth):
13302         (JSC::DFG::SpeculativeJIT::compileMovHint):
13303         (JSC::DFG::SpeculativeJIT::compile):
13304         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
13305         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
13306         (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
13307         (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
13308         (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
13309         (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
13310         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
13311         (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
13312         (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
13313         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
13314         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
13315         (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
13316         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
13317         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
13318         (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
13319         (JSC::DFG::SpeculativeJIT::compileInstanceOf):
13320         (JSC::DFG::SpeculativeJIT::compileSoftModulo):
13321         (JSC::DFG::SpeculativeJIT::compileAdd):
13322         (JSC::DFG::SpeculativeJIT::compileArithSub):
13323         (JSC::DFG::SpeculativeJIT::compileArithNegate):
13324         (JSC::DFG::SpeculativeJIT::compileArithMul):
13325         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86):
13326         (JSC::DFG::SpeculativeJIT::compileArithMod):
13327         (JSC::DFG::SpeculativeJIT::compare):
13328         (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
13329         (JSC::DFG::SpeculativeJIT::compileStrictEq):
13330         (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
13331         (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
13332         (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
13333         (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
13334         (JSC::DFG::SpeculativeJIT::compileNewFunctionNoCheck):
13335         (JSC::DFG::SpeculativeJIT::compileNewFunctionExpression):
13336         (JSC::DFG::SpeculativeJIT::compileRegExpExec):
13337         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
13338         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
13339         * dfg/DFGSpeculativeJIT.h:
13340         (SpeculativeJIT):
13341         (JSC::DFG::SpeculativeJIT::canReuse):
13342         (JSC::DFG::SpeculativeJIT::isFilled):
13343         (JSC::DFG::SpeculativeJIT::isFilledDouble):
13344         (JSC::DFG::SpeculativeJIT::use):
13345         (JSC::DFG::SpeculativeJIT::isConstant):
13346         (JSC::DFG::SpeculativeJIT::isJSConstant):
13347         (JSC::DFG::SpeculativeJIT::isInt32Constant):
13348         (JSC::DFG::SpeculativeJIT::isDoubleConstant):
13349         (JSC::DFG::SpeculativeJIT::isNumberConstant):
13350         (JSC::DFG::SpeculativeJIT::isBooleanConstant):
13351         (JSC::DFG::SpeculativeJIT::isFunctionConstant):
13352         (JSC::DFG::SpeculativeJIT::valueOfInt32Constant):
13353         (JSC::DFG::SpeculativeJIT::valueOfNumberConstant):
13354         (JSC::DFG::SpeculativeJIT::valueOfNumberConstantAsInt32):
13355         (JSC::DFG::SpeculativeJIT::addressOfDoubleConstant):
13356         (JSC::DFG::SpeculativeJIT::valueOfJSConstant):
13357         (JSC::DFG::SpeculativeJIT::valueOfBooleanConstant):
13358         (JSC::DFG::SpeculativeJIT::valueOfFunctionConstant):
13359         (JSC::DFG::SpeculativeJIT::isNullConstant):
13360         (JSC::DFG::SpeculativeJIT::valueOfJSConstantAsImm64):
13361         (JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):
13362         (JSC::DFG::SpeculativeJIT::integerResult):
13363         (JSC::DFG::SpeculativeJIT::noResult):
13364         (JSC::DFG::SpeculativeJIT::cellResult):
13365         (JSC::DFG::SpeculativeJIT::booleanResult):
13366         (JSC::DFG::SpeculativeJIT::jsValueResult):
13367         (JSC::DFG::SpeculativeJIT::storageResult):
13368         (JSC::DFG::SpeculativeJIT::doubleResult):
13369         (JSC::DFG::SpeculativeJIT::initConstantInfo):
13370         (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
13371         (JSC::DFG::SpeculativeJIT::isInteger):
13372         (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
13373         (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
13374         (JSC::DFG::SpeculativeJIT::setNodeForOperand):
13375         (JSC::DFG::IntegerOperand::IntegerOperand):
13376         (JSC::DFG::IntegerOperand::node):
13377         (JSC::DFG::IntegerOperand::gpr):
13378         (JSC::DFG::IntegerOperand::use):
13379         (IntegerOperand):
13380         (JSC::DFG::DoubleOperand::DoubleOperand):
13381         (JSC::DFG::DoubleOperand::node):
13382         (JSC::DFG::DoubleOperand::fpr):
13383         (JSC::DFG::DoubleOperand::use):
13384         (DoubleOperand):
13385         (JSC::DFG::JSValueOperand::JSValueOperand):
13386         (JSC::DFG::JSValueOperand::node):
13387         (JSC::DFG::JSValueOperand::gpr):
13388         (JSC::DFG::JSValueOperand::fill):
13389         (JSC::DFG::JSValueOperand::use):
13390         (JSValueOperand):
13391         (JSC::DFG::StorageOperand::StorageOperand):
13392         (JSC::DFG::StorageOperand::node):
13393         (JSC::DFG::StorageOperand::gpr):
13394         (JSC::DFG::StorageOperand::use):
13395         (StorageOperand):
13396         (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
13397         (JSC::DFG::SpeculateIntegerOperand::node):
13398         (JSC::DFG::SpeculateIntegerOperand::gpr):
13399         (JSC::DFG::SpeculateIntegerOperand::use):
13400         (SpeculateIntegerOperand):
13401         (JSC::DFG::SpeculateStrictInt32Operand::SpeculateStrictInt32Operand):
13402         (JSC::DFG::SpeculateStrictInt32Operand::node):
13403         (JSC::DFG::SpeculateStrictInt32Operand::gpr):
13404         (JSC::DFG::SpeculateStrictInt32Operand::use):
13405         (SpeculateStrictInt32Operand):
13406         (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
13407         (JSC::DFG::SpeculateDoubleOperand::node):
13408         (JSC::DFG::SpeculateDoubleOperand::fpr):
13409         (JSC::DFG::SpeculateDoubleOperand::use):
13410         (SpeculateDoubleOperand):
13411         (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
13412         (JSC::DFG::SpeculateCellOperand::node):
13413         (JSC::DFG::SpeculateCellOperand::gpr):
13414         (JSC::DFG::SpeculateCellOperand::use):
13415         (SpeculateCellOperand):
13416         (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
13417         (JSC::DFG::SpeculateBooleanOperand::node):
13418         (JSC::DFG::SpeculateBooleanOperand::gpr):
13419         (JSC::DFG::SpeculateBooleanOperand::use):
13420         (SpeculateBooleanOperand):
13421         * dfg/DFGSpeculativeJIT32_64.cpp:
13422         (JSC::DFG::SpeculativeJIT::fillInteger):
13423         (JSC::DFG::SpeculativeJIT::fillDouble):
13424         (JSC::DFG::SpeculativeJIT::fillJSValue):
13425         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
13426         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
13427         (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
13428         (JSC::DFG::SpeculativeJIT::cachedPutById):
13429         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
13430         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
13431         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
13432         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
13433         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
13434         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
13435         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
13436         (JSC::DFG::SpeculativeJIT::emitCall):
13437         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
13438         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
13439         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
13440         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
13441         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
13442         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
13443         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
13444         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
13445         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
13446         (JSC::DFG::SpeculativeJIT::compileIntegerCompare):
13447         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
13448         (JSC::DFG::SpeculativeJIT::compileValueAdd):
13449         (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
13450         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
13451         (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
13452         (JSC::DFG::SpeculativeJIT::emitBranch):
13453         (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
13454         (JSC::DFG::SpeculativeJIT::compile):
13455         * dfg/DFGSpeculativeJIT64.cpp:
13456         (JSC::DFG::SpeculativeJIT::fillInteger):
13457         (JSC::DFG::SpeculativeJIT::fillDouble):
13458         (JSC::DFG::SpeculativeJIT::fillJSValue):
13459         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
13460         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
13461         (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
13462         (JSC::DFG::SpeculativeJIT::cachedPutById):
13463         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
13464         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
13465         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
13466         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
13467         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
13468         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
13469         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
13470         (JSC::DFG::SpeculativeJIT::emitCall):
13471         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
13472         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
13473         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
13474         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
13475         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
13476         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
13477         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
13478         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
13479         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
13480         (JSC::DFG::SpeculativeJIT::compileIntegerCompare):
13481         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
13482         (JSC::DFG::SpeculativeJIT::compileValueAdd):
13483         (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
13484         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
13485         (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
13486         (JSC::DFG::SpeculativeJIT::emitBranch):
13487         (JSC::DFG::SpeculativeJIT::compile):
13488         * dfg/DFGStructureAbstractValue.h:
13489         (StructureAbstractValue):
13490         * dfg/DFGStructureCheckHoistingPhase.cpp:
13491         (JSC::DFG::StructureCheckHoistingPhase::run):
13492         * dfg/DFGValidate.cpp:
13493         (DFG):
13494         (Validate):
13495         (JSC::DFG::Validate::validate):
13496         (JSC::DFG::Validate::reportValidationContext):
13497         * dfg/DFGValidate.h:
13498         * dfg/DFGValueSource.cpp:
13499         (JSC::DFG::ValueSource::dump):
13500         * dfg/DFGValueSource.h:
13501         (JSC::DFG::ValueSource::ValueSource):
13502         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
13503         (JSC::DFG::VirtualRegisterAllocationPhase::run):
13504         * runtime/FunctionExecutableDump.cpp: Added.
13505         (JSC):
13506         (JSC::FunctionExecutableDump::dump):
13507         * runtime/FunctionExecutableDump.h: Added.
13508         (JSC):
13509         (FunctionExecutableDump):
13510         (JSC::FunctionExecutableDump::FunctionExecutableDump):
13511         * runtime/JSGlobalData.cpp:
13512         (JSC::JSGlobalData::JSGlobalData):
13513         * runtime/JSGlobalData.h:
13514         (JSC):
13515         (DFG):
13516         (JSGlobalData):
13517         * runtime/Options.h:
13518         (JSC):
13519
13520 2013-01-28  Laszlo Gombos  <l.gombos@samsung.com>
13521
13522         Collapse testing for a list of PLATFORM() into OS() and USE() tests
13523         https://bugs.webkit.org/show_bug.cgi?id=108018
13524
13525         Reviewed by Eric Seidel.
13526
13527         No functional change as "OS(DARWIN) && USE(CF)" equals to the
13528         following platforms: MAC, WX, QT and CHROMIUM. CHROMIUM
13529         is not using JavaScriptCore.
13530
13531         * runtime/DatePrototype.cpp:
13532         (JSC):
13533
13534 2013-01-28  Geoffrey Garen  <ggaren@apple.com>
13535
13536         Static size inference for JavaScript objects
13537         https://bugs.webkit.org/show_bug.cgi?id=108093
13538
13539         Reviewed by Phil Pizlo.
13540
13541         * API/JSObjectRef.cpp:
13542         * JavaScriptCore.order:
13543         * JavaScriptCore.xcodeproj/project.pbxproj: Pay the tax man.
13544
13545         * bytecode/CodeBlock.cpp:
13546         (JSC::CodeBlock::dumpBytecode): op_new_object and op_create_this now
13547         have an extra inferredInlineCapacity argument. This is the statically
13548         inferred inline capacity, just from analyzing source text. op_new_object
13549         also gets a pointer to an allocation profile. (For op_create_this, the
13550         profile is in the construtor function.)
13551
13552         (JSC::CodeBlock::CodeBlock): Link op_new_object.
13553
13554         (JSC::CodeBlock::stronglyVisitStrongReferences): Mark our profiles.
13555
13556         * bytecode/CodeBlock.h:
13557         (CodeBlock): Removed some dead code. Added object allocation profiles.
13558
13559         * bytecode/Instruction.h:
13560         (JSC): New union type, since an instruction operand may point to an
13561         object allocation profile now.
13562
13563         * bytecode/ObjectAllocationProfile.h: Added.
13564         (JSC):
13565         (ObjectAllocationProfile):
13566         (JSC::ObjectAllocationProfile::offsetOfAllocator):
13567         (JSC::ObjectAllocationProfile::offsetOfStructure):
13568         (JSC::ObjectAllocationProfile::ObjectAllocationProfile):
13569         (JSC::ObjectAllocationProfile::isNull):
13570         (JSC::ObjectAllocationProfile::initialize):
13571         (JSC::ObjectAllocationProfile::structure):
13572         (JSC::ObjectAllocationProfile::inlineCapacity):
13573         (JSC::ObjectAllocationProfile::clear):
13574         (JSC::ObjectAllocationProfile::visitAggregate):
13575         (JSC::ObjectAllocationProfile::possibleDefaultPropertyCount): New class
13576         for tracking a prediction about object allocation: structure, inline
13577         capacity, allocator to use.
13578
13579         * bytecode/Opcode.h:
13580         (JSC):
13581         (JSC::padOpcodeName): Updated instruction sizes.
13582
13583         * bytecode/UnlinkedCodeBlock.cpp:
13584         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
13585         * bytecode/UnlinkedCodeBlock.h:
13586         (JSC):
13587         (JSC::UnlinkedCodeBlock::addObjectAllocationProfile):
13588         (JSC::UnlinkedCodeBlock::numberOfObjectAllocationProfiles):
13589         (UnlinkedCodeBlock): Unlinked support for allocation profiles.
13590
13591         * bytecompiler/BytecodeGenerator.cpp:
13592         (JSC::BytecodeGenerator::generate): Kill all remaining analyses at the
13593         end of codegen, since this is our last opportunity.
13594
13595         (JSC::BytecodeGenerator::BytecodeGenerator): Added a static property
13596         analyzer to bytecode generation. It tracks initializing assignments and
13597         makes a guess about how many will happen.
13598
13599         (JSC::BytecodeGenerator::newObjectAllocationProfile):
13600         (JSC):
13601         (JSC::BytecodeGenerator::emitProfiledOpcode):
13602         (JSC::BytecodeGenerator::emitMove):
13603         (JSC::BytecodeGenerator::emitResolve):
13604         (JSC::BytecodeGenerator::emitResolveBase):
13605         (JSC::BytecodeGenerator::emitResolveBaseForPut):
13606         (JSC::BytecodeGenerator::emitResolveWithBaseForPut):
13607         (JSC::BytecodeGenerator::emitResolveWithThis):
13608         (JSC::BytecodeGenerator::emitGetById):
13609         (JSC::BytecodeGenerator::emitPutById):
13610         (JSC::BytecodeGenerator::emitDirectPutById):
13611         (JSC::BytecodeGenerator::emitPutGetterSetter):
13612         (JSC::BytecodeGenerator::emitGetArgumentByVal):
13613         (JSC::BytecodeGenerator::emitGetByVal): Added hooks to the static property
13614         analyzer, so it can observe allocations and stores.
13615
13616         (JSC::BytecodeGenerator::emitCreateThis): Factored this into a helper
13617         function because it was a significant amount of logic, and I wanted to
13618         add to it.
13619
13620         (JSC::BytecodeGenerator::emitNewObject):
13621         (JSC::BytecodeGenerator::emitExpectedFunctionSnippet):
13622         (JSC::BytecodeGenerator::emitCall):
13623         (JSC::BytecodeGenerator::emitCallVarargs):
13624         (JSC::BytecodeGenerator::emitConstruct): Added a hook to profiled opcodes
13625         to track their stores, in case a store kills a profiled allocation. Since
13626         profiled opcodes are basically the only interesting stores we do, this
13627         is a convenient place to notice any store that might kill an allocation.
13628
13629         * bytecompiler/BytecodeGenerator.h:
13630         (BytecodeGenerator): As above.
13631
13632         * bytecompiler/StaticPropertyAnalysis.h: Added.
13633         (JSC):
13634         (StaticPropertyAnalysis):
13635         (JSC::StaticPropertyAnalysis::create):
13636         (JSC::StaticPropertyAnalysis::addPropertyIndex):
13637         (JSC::StaticPropertyAnalysis::record):
13638         (JSC::StaticPropertyAnalysis::propertyIndexCount):
13639         (JSC::StaticPropertyAnalysis::StaticPropertyAnalysis): Simple helper
13640         class for tracking allocations and stores.
13641
13642         * bytecompiler/StaticPropertyAnalyzer.h: Added.
13643         (StaticPropertyAnalyzer):
13644         (JSC::StaticPropertyAnalyzer::StaticPropertyAnalyzer):
13645         (JSC::StaticPropertyAnalyzer::createThis):
13646         (JSC::StaticPropertyAnalyzer::newObject):
13647         (JSC::StaticPropertyAnalyzer::putById):
13648         (JSC::StaticPropertyAnalyzer::mov):
13649         (JSC::StaticPropertyAnalyzer::kill): Helper class for observing allocations
13650         and stores and making an inline capacity guess. The heuristics here are
13651         intentionally minimal because we don't want this one class to try to
13652         re-create something like a DFG or a runtime analysis. If we discover that
13653         we need those kinds of analyses, we should just replace this class with
13654         something else.
13655
13656         This class tracks multiple registers that alias the same object -- that
13657         happens a lot, when moving locals into temporary registers -- but it
13658         doesn't track control flow or multiple objects that alias the same register.
13659
13660         * dfg/DFGAbstractState.cpp:
13661         (JSC::DFG::AbstractState::execute): Updated for rename.
13662
13663         * dfg/DFGByteCodeParser.cpp:
13664         (JSC::DFG::ByteCodeParser::parseBlock): Updated for inline capacity and
13665         allocation profile.
13666
13667         * dfg/DFGNode.h:
13668         (JSC::DFG::Node::hasInlineCapacity):
13669         (Node):
13670         (JSC::DFG::Node::inlineCapacity):
13671         (JSC::DFG::Node::hasFunction): Give the graph a good way to represent
13672         inline capacity for an allocation.
13673
13674         * dfg/DFGNodeType.h:
13675         (DFG): Updated for rename.
13676
13677         * dfg/DFGOperations.cpp: Updated for interface change.
13678
13679         * dfg/DFGOperations.h: We pass the inline capacity to the slow case as
13680         an argument. This is the simplest way, since it's stored as a bytecode operand.
13681
13682         * dfg/DFGPredictionPropagationPhase.cpp:
13683         (JSC::DFG::PredictionPropagationPhase::propagate): Updated for rename.
13684
13685         * dfg/DFGRepatch.cpp:
13686         (JSC::DFG::tryCacheGetByID): Fixed a horrible off-by-one-half bug that only
13687         appears when doing an inline cached load for property number 64 on a 32-bit
13688         system. In JSVALUE32_64 land, "offsetRelativeToPatchedStorage" is the
13689         offset of the 64bit JSValue -- but we'll actually issue two loads, one for
13690         the payload at that offset, and one for the tag at that offset + 4. We need
13691         to ensure that both loads have a compact representation, or we'll corrupt
13692         the instruction stream.
13693
13694         * dfg/DFGSpeculativeJIT.cpp:
13695         (JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
13696         * dfg/DFGSpeculativeJIT.h:
13697         (JSC::DFG::SpeculativeJIT::callOperation):
13698         (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
13699         (SpeculativeJIT):
13700         (JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
13701         * dfg/DFGSpeculativeJIT32_64.cpp:
13702         (JSC::DFG::SpeculativeJIT::compile):
13703         * dfg/DFGSpeculativeJIT64.cpp:
13704         (JSC::DFG::SpeculativeJIT::compile): Lots of refactoring to support
13705         passing an allocator to our allocation function, and/or passing a Structure
13706         as a register instead of an immediate.
13707
13708         * heap/MarkedAllocator.h:
13709         (DFG):
13710         (MarkedAllocator):
13711         (JSC::MarkedAllocator::offsetOfFreeListHead): Added an accessor to simplify
13712         JIT code generation of allocation from an arbitrary allocator.
13713
13714         * jit/JIT.h:
13715         (JSC):
13716         * jit/JITInlines.h:
13717         (JSC):
13718         (JSC::JIT::emitAllocateJSObject):
13719         * jit/JITOpcodes.cpp:
13720         (JSC::JIT::emit_op_new_object):
13721         (JSC::JIT::emitSlow_op_new_object):
13722         (JSC::JIT::emit_op_create_this):
13723         (JSC::JIT::emitSlow_op_create_this):
13724         * jit/JITOpcodes32_64.cpp:
13725         (JSC::JIT::emit_op_new_object):
13726         (JSC::JIT::emitSlow_op_new_object):
13727         (JSC::JIT::emit_op_create_this):
13728         (JSC::JIT::emitSlow_op_create_this): Same refactoring as done for the DFG.
13729
13730         * jit/JITStubs.cpp:
13731         (JSC::tryCacheGetByID): Fixed the same bug mentioned above.
13732
13733         (JSC::DEFINE_STUB_FUNCTION): Updated for interface changes.
13734
13735         * llint/LLIntData.cpp:
13736         (JSC::LLInt::Data::performAssertions): Updated for interface changes.
13737
13738         * llint/LLIntSlowPaths.cpp:
13739         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
13740         * llint/LowLevelInterpreter.asm:
13741         * llint/LowLevelInterpreter32_64.asm:
13742         * llint/LowLevelInterpreter64.asm: Same refactoring as for the JITs.
13743
13744         * profiler/ProfilerBytecode.cpp:
13745         * profiler/ProfilerBytecodes.cpp:
13746         * profiler/ProfilerCompilation.cpp:
13747         * profiler/ProfilerCompiledBytecode.cpp:
13748         * profiler/ProfilerDatabase.cpp:
13749         * profiler/ProfilerOSRExit.cpp:
13750         * profiler/ProfilerOrigin.cpp:
13751         * profiler/ProfilerProfiledBytecodes.cpp: Include ObjectConstructor.h
13752         because that's where createEmptyObject() lives now.
13753
13754         * runtime/Executable.h:
13755         (JSC::JSFunction::JSFunction): Updated for rename.
13756
13757         * runtime/JSCellInlines.h:
13758         (JSC::allocateCell): Updated to match the allocator selection code in
13759         the JIT, so it's clearer that both are correct.
13760
13761         * runtime/JSFunction.cpp:
13762         (JSC::JSFunction::JSFunction):
13763         (JSC::JSFunction::createAllocationProfile):
13764         (JSC::JSFunction::visitChildren):
13765         (JSC::JSFunction::getOwnPropertySlot):
13766         (JSC::JSFunction::put):
13767         (JSC::JSFunction::defineOwnProperty):
13768         (JSC::JSFunction::getConstructData):
13769         * runtime/JSFunction.h:
13770         (JSC::JSFunction::offsetOfScopeChain):
13771         (JSC::JSFunction::offsetOfExecutable):
13772         (JSC::JSFunction::offsetOfAllocationProfile):
13773         (JSC::JSFunction::allocationProfile):
13774         (JSFunction):
13775         (JSC::JSFunction::tryGetAllocationProfile):
13776         (JSC::JSFunction::addAllocationProfileWatchpoint): Changed inheritorID
13777         data member to be an ObjectAllocationProfile, which includes a pointer
13778         to the desired allocator. This simplifies JIT code, since we don't have
13779         to compute the allocator on the fly. I verified by code inspection that
13780         JSFunction is still only 64 bytes.
13781
13782         * runtime/JSGlobalObject.cpp:
13783         (JSC::JSGlobalObject::reset):
13784         (JSC::JSGlobalObject::visitChildren):
13785         * runtime/JSGlobalObject.h:
13786         (JSGlobalObject):
13787         (JSC::JSGlobalObject::dateStructure): No direct pointer to the empty
13788         object structure anymore, because now clients need to specify how much
13789         inline capacity they want.
13790
13791         * runtime/JSONObject.cpp:
13792         * runtime/JSObject.h:
13793         (JSC):
13794         (JSFinalObject):
13795         (JSC::JSFinalObject::defaultInlineCapacity):
13796         (JSC::JSFinalObject::maxInlineCapacity):
13797         (JSC::JSFinalObject::createStructure): A little refactoring to try to
13798         clarify where some of these constants derive from.
13799
13800         (JSC::maxOffsetRelativeToPatchedStorage): Used for bug fix, above.
13801
13802         * runtime/JSProxy.cpp:
13803         (JSC::JSProxy::setTarget): Ugly, but effective.
13804
13805         * runtime/LiteralParser.cpp:
13806         * runtime/ObjectConstructor.cpp:
13807         (JSC::constructObject):
13808         (JSC::constructWithObjectConstructor):
13809         (JSC::callObjectConstructor):
13810         (JSC::objectConstructorCreate): Updated for interface changes.
13811
13812         * runtime/ObjectConstructor.h:
13813         (JSC::constructEmptyObject): Clarified your options for how to allocate
13814         an empty object, to emphasize what things can actually vary.
13815
13816         * runtime/PropertyOffset.h: These constants have moved because they're
13817         really higher level concepts to do with the layout of objects and the
13818         collector. PropertyOffset is just an abstract number line, independent
13819         of those things.
13820
13821         * runtime/PrototypeMap.cpp:
13822         (JSC::PrototypeMap::emptyObjectStructureForPrototype):
13823         (JSC::PrototypeMap::clearEmptyObjectStructureForPrototype):
13824         * runtime/PrototypeMap.h:
13825         (PrototypeMap): The map key is now a pair of prototype and inline capacity,
13826         since Structure encodes inline capacity.
13827
13828         * runtime/Structure.cpp:
13829         (JSC::Structure::Structure):
13830         (JSC::Structure::materializePropertyMap):
13831         (JSC::Structure::addPropertyTransition):
13832         (JSC::Structure::nonPropertyTransition):
13833         (JSC::Structure::copyPropertyTableForPinning):
13834         * runtime/Structure.h:
13835         (Structure):
13836         (JSC::Structure::totalStorageSize):
13837         (JSC::Structure::transitionCount):
13838         (JSC::Structure::create): Fixed a nasty refactoring bug that only shows
13839         up after enabling variable-sized inline capacities: we were passing our
13840         type info where our inline capacity was expected. The compiler didn't
13841         notice because both have type int :(.
13842
13843 2013-01-28  Oliver Hunt  <oliver@apple.com>
13844
13845         Add more assertions to the property storage use in arrays
13846         https://bugs.webkit.org/show_bug.cgi?id=107728
13847
13848         Reviewed by Filip Pizlo.
13849
13850         Add a bunch of assertions to array and object butterfly
13851         usage.  This should make debugging somewhat easier.
13852
13853         I also converted a couple of assertions to release asserts
13854         as they were so low cost it seemed a sensible thing to do.
13855
13856         * runtime/JSArray.cpp:
13857         (JSC::JSArray::sortVector):
13858         (JSC::JSArray::compactForSorting):
13859         * runtime/JSObject.h:
13860         (JSC::JSObject::getHolyIndexQuickly):
13861
13862 2013-01-28  Adam Barth  <abarth@webkit.org>
13863
13864         Remove webkitNotifications.createHTMLNotification
13865         https://bugs.webkit.org/show_bug.cgi?id=107598
13866
13867         Reviewed by Benjamin Poulain.
13868
13869         * Configurations/FeatureDefines.xcconfig:
13870
13871 2013-01-28  Michael Saboff  <msaboff@apple.com>
13872
13873         Cleanup ARM version of debugName() in DFGFPRInfo.h
13874         https://bugs.webkit.org/show_bug.cgi?id=108090
13875
13876         Reviewed by David Kilzer.
13877
13878         Fixed debugName() so it will compile by adding static_cast<int> and missing commas.
13879
13880         * dfg/DFGFPRInfo.h:
13881         (JSC::DFG::FPRInfo::debugName):
13882
13883 2013-01-27  Andreas Kling  <akling@apple.com>
13884
13885         JSC: FunctionParameters are memory hungry.
13886         <http://webkit.org/b/108033>
13887         <rdar://problem/13094803>
13888
13889         Reviewed by Sam Weinig.
13890
13891         Instead of inheriting from Vector<Identifier>, make FunctionParameters a simple fixed-size array
13892         with a custom-allocating create() function. Removes one step of indirection and cuts memory usage
13893         roughly in half.
13894
13895         2.73 MB progression on Membuster3.
13896
13897         * bytecode/UnlinkedCodeBlock.cpp:
13898         (JSC::UnlinkedFunctionExecutable::paramString):
13899         * bytecompiler/BytecodeGenerator.cpp:
13900         (JSC::BytecodeGenerator::BytecodeGenerator):
13901         * parser/Nodes.cpp:
13902         (JSC::FunctionParameters::create):
13903         (JSC::FunctionParameters::FunctionParameters):
13904         (JSC::FunctionParameters::~FunctionParameters):
13905         * parser/Nodes.h:
13906         (FunctionParameters):
13907         (JSC::FunctionParameters::size):
13908         (JSC::FunctionParameters::at):
13909         (JSC::FunctionParameters::identifiers):
13910
13911 2013-01-27  Andreas Kling  <akling@apple.com>
13912
13913         JSC: SourceProviderCache is memory hungry.
13914         <http://webkit.org/b/108029>
13915         <rdar://problem/13094806>
13916
13917         Reviewed by Sam Weinig.
13918
13919         Use fixed-size arrays for SourceProviderCacheItem's lists of captured variables.
13920         Since the lists never change after the object is created, there's no need to keep them in Vectors
13921         and we can instead create the whole cache item in a single allocation.
13922
13923         13.37 MB progression on Membuster3.
13924
13925         * parser/Parser.cpp:
13926         (JSC::::parseFunctionInfo):
13927         * parser/Parser.h:
13928         (JSC::Scope::copyCapturedVariablesToVector):
13929         (JSC::Scope::fillParametersForSourceProviderCache):
13930         (JSC::Scope::restoreFromSourceProviderCache):
13931         * parser/SourceProviderCacheItem.h:
13932         (SourceProviderCacheItemCreationParameters):
13933         (SourceProviderCacheItem):
13934         (JSC::SourceProviderCacheItem::approximateByteSize):
13935         (JSC::SourceProviderCacheItem::usedVariables):
13936         (JSC::SourceProviderCacheItem::writtenVariables):
13937         (JSC::SourceProviderCacheItem::~SourceProviderCacheItem):
13938         (JSC::SourceProviderCacheItem::create):
13939         (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
13940
13941 2013-01-27  Zoltan Arvai  <zarvai@inf.u-szeged.hu>
13942
13943         Fixing atomicIncrement implementation for Windows by dropping support before XP SP2.
13944         https://bugs.webkit.org/show_bug.cgi?id=106740
13945
13946         Reviewed by Benjamin Poulain.
13947
13948         * config.h:
13949
13950 2013-01-25  Filip Pizlo  <fpizlo@apple.com>
13951
13952         DFG variable event stream shouldn't use NodeIndex
13953         https://bugs.webkit.org/show_bug.cgi?id=107996
13954
13955         Reviewed by Oliver Hunt.
13956
13957         Introduce the notion of a DFG::MinifiedID, which is just a unique ID of a DFG Node.
13958         Internally it currently uses a NodeIndex, but we could change this without having
13959         to recode all of the users of MinifiedID. This effectively decouples the OSR exit
13960         compiler's way of identifying nodes from the speculative JIT's way of identifying
13961         nodes, and should make it easier to make changes to the speculative JIT's internals
13962         in the future.
13963
13964         Also changed variable event stream logging to exclude information about births and
13965         deaths of constants, since the OSR exit compiler never cares about which register
13966         holds a constant; if a value is constant then the OSR exit compiler can reify it.
13967
13968         Also changed the variable event stream's value recovery computation to use a
13969         HashMap keyed by MinifiedID rather than a Vector indexed by NodeIndex.
13970
13971         This appears to be performance-neutral. It's primarily meant as a small step
13972         towards https://bugs.webkit.org/show_bug.cgi?id=106868.
13973
13974         * GNUmakefile.list.am:
13975         * JavaScriptCore.xcodeproj/project.pbxproj:
13976         * dfg/DFGGenerationInfo.h:
13977         (JSC::DFG::GenerationInfo::GenerationInfo):
13978         (JSC::DFG::GenerationInfo::initConstant):
13979         (JSC::DFG::GenerationInfo::initInteger):
13980         (JSC::DFG::GenerationInfo::initJSValue):
13981         (JSC::DFG::GenerationInfo::initCell):
13982         (JSC::DFG::GenerationInfo::initBoolean):
13983         (JSC::DFG::GenerationInfo::initDouble):
13984         (JSC::DFG::GenerationInfo::initStorage):
13985         (JSC::DFG::GenerationInfo::noticeOSRBirth):
13986         (JSC::DFG::GenerationInfo::use):
13987         (JSC::DFG::GenerationInfo::appendFill):
13988         (JSC::DFG::GenerationInfo::appendSpill):
13989         (GenerationInfo):
13990         * dfg/DFGJITCompiler.cpp:
13991         (JSC::DFG::JITCompiler::link):
13992         * dfg/DFGMinifiedGraph.h:
13993         (JSC::DFG::MinifiedGraph::at):
13994         (MinifiedGraph):
13995         * dfg/DFGMinifiedID.h: Added.
13996         (DFG):
13997         (MinifiedID):
13998         (JSC::DFG::MinifiedID::MinifiedID):
13999         (JSC::DFG::MinifiedID::operator!):
14000         (JSC::DFG::MinifiedID::nodeIndex):
14001         (JSC::DFG::MinifiedID::operator==):
14002         (JSC::DFG::MinifiedID::operator!=):
14003         (JSC::DFG::MinifiedID::operator<):
14004         (JSC::DFG::MinifiedID::operator>):
14005         (JSC::DFG::MinifiedID::operator<=):
14006         (JSC::DFG::MinifiedID::operator>=):
14007         (JSC::DFG::MinifiedID::hash):
14008         (JSC::DFG::MinifiedID::dump):
14009         (JSC::DFG::MinifiedID::isHashTableDeletedValue):
14010         (JSC::DFG::MinifiedID::invalidID):
14011         (JSC::DFG::MinifiedID::otherInvalidID):
14012         (JSC::DFG::MinifiedID::fromBits):
14013         (JSC::DFG::MinifiedIDHash::hash):
14014         (JSC::DFG::MinifiedIDHash::equal):
14015         (MinifiedIDHash):
14016         (WTF):
14017         * dfg/DFGMinifiedNode.cpp:
14018         (JSC::DFG::MinifiedNode::fromNode):
14019         * dfg/DFGMinifiedNode.h:
14020         (JSC::DFG::MinifiedNode::id):
14021         (JSC::DFG::MinifiedNode::child1):
14022         (JSC::DFG::MinifiedNode::getID):
14023         (JSC::DFG::MinifiedNode::compareByNodeIndex):
14024         (MinifiedNode):
14025         * dfg/DFGSpeculativeJIT.cpp:
14026         (JSC::DFG::SpeculativeJIT::compileMovHint):
14027         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
14028         * dfg/DFGSpeculativeJIT.h:
14029         (JSC::DFG::SpeculativeJIT::setNodeIndexForOperand):
14030         * dfg/DFGValueSource.cpp:
14031         (JSC::DFG::ValueSource::dump):
14032         * dfg/DFGValueSource.h:
14033         (JSC::DFG::ValueSource::ValueSource):
14034         (JSC::DFG::ValueSource::isSet):
14035         (JSC::DFG::ValueSource::kind):
14036         (JSC::DFG::ValueSource::id):
14037         (ValueSource):
14038         (JSC::DFG::ValueSource::idFromKind):
14039         (JSC::DFG::ValueSource::kindFromID):
14040         * dfg/DFGVariableEvent.cpp:
14041         (JSC::DFG::VariableEvent::dump):
14042         (JSC::DFG::VariableEvent::dumpFillInfo):
14043         (JSC::DFG::VariableEvent::dumpSpillInfo):
14044         * dfg/DFGVariableEvent.h:
14045         (JSC::DFG::VariableEvent::fillGPR):
14046         (JSC::DFG::VariableEvent::fillPair):
14047         (JSC::DFG::VariableEvent::fillFPR):
14048         (JSC::DFG::VariableEvent::spill):
14049         (JSC::DFG::VariableEvent::death):
14050         (JSC::DFG::VariableEvent::movHint):
14051         (JSC::DFG::VariableEvent::id):
14052         (VariableEvent):
14053         * dfg/DFGVariableEventStream.cpp:
14054         (DFG):
14055         (JSC::DFG::VariableEventStream::tryToSetConstantRecovery):
14056         (JSC::DFG::VariableEventStream::reconstruct):
14057         * dfg/DFGVariableEventStream.h:
14058         (VariableEventStream):
14059
14060 2013-01-25  Roger Fong  <roger_fong@apple.com>
14061
14062         Unreviewed. Rename LLInt projects folder and make appropriate changes to solutions.
14063
14064         * JavaScriptCore.vcxproj/JavaScriptCore.sln:
14065         * JavaScriptCore.vcxproj/LLInt: Copied from JavaScriptCore.vcxproj/LLInt.vcproj.
14066         * JavaScriptCore.vcxproj/LLInt.vcproj: Removed.
14067         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly: Removed.
14068         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.make: Removed.
14069         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.vcxproj: Removed.
14070         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.vcxproj.user: Removed.
14071         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/build-LLIntAssembly.sh: Removed.
14072         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets: Removed.
14073         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.make: Removed.
14074         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj: Removed.
14075         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj.user: Removed.
14076         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh: Removed.
14077         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor: Removed.
14078         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj: Removed.
14079         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj.user: Removed.
14080         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props: Removed.
14081         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props: Removed.
14082         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.props: Removed.
14083
14084 2013-01-24  Roger Fong  <roger_fong@apple.com>
14085
14086         VS2010 JavascriptCore: Clean up property sheets, add a JSC solution, add testRegExp and testAPI projects.
14087         https://bugs.webkit.org/show_bug.cgi?id=106987
14088
14089         Reviewed by Brent Fulgham.
14090
14091         * JavaScriptCore.vcxproj/JavaScriptCore.sln: Added.
14092         * JavaScriptCore.vcxproj/JavaScriptCoreCF.props:
14093         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props:
14094         * JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd:
14095         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props:
14096         * JavaScriptCore.vcxproj/jsc/jscCommon.props:
14097         * JavaScriptCore.vcxproj/jsc/jscDebug.props:
14098         * JavaScriptCore.vcxproj/jsc/jscPostBuild.cmd:
14099         * JavaScriptCore.vcxproj/jsc/jscPreLink.cmd:
14100         * JavaScriptCore.vcxproj/testRegExp: Added.
14101         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj: Added.
14102         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.filters: Added.
14103         * JavaScriptCore.vcxproj/testRegExp/testRegExp.vcxproj.user: Added.
14104         * JavaScriptCore.vcxproj/testRegExp/testRegExpCommon.props: Added.
14105         * JavaScriptCore.vcxproj/testRegExp/testRegExpDebug.props: Added.
14106         * JavaScriptCore.vcxproj/testRegExp/testRegExpPostBuild.cmd: Added.
14107         * JavaScriptCore.vcxproj/testRegExp/testRegExpPreBuild.cmd: Added.
14108         * JavaScriptCore.vcxproj/testRegExp/testRegExpPreLink.cmd: Added.
14109         * JavaScriptCore.vcxproj/testRegExp/testRegExpRelease.props: Added.
14110         * JavaScriptCore.vcxproj/testapi: Added.
14111         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj: Added.
14112         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.filters: Added.
14113         * JavaScriptCore.vcxproj/testapi/testapi.vcxproj.user: Added.
14114         * JavaScriptCore.vcxproj/testapi/testapiCommon.props: Added.
14115         * JavaScriptCore.vcxproj/testapi/testapiDebug.props: Added.
14116         * JavaScriptCore.vcxproj/testapi/testapiPostBuild.cmd: Added.
14117         * JavaScriptCore.vcxproj/testapi/testapiPreBuild.cmd: Added.
14118         * JavaScriptCore.vcxproj/testapi/testapiPreLink.cmd: Added.
14119         * JavaScriptCore.vcxproj/testapi/testapiRelease.props: Added.
14120
14121 2013-01-24  Roger Fong  <roger_fong@apple.com>
14122
14123         Unreviewed. Windows build fix.
14124
14125         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
14126
14127 2013-01-24  Filip Pizlo  <fpizlo@apple.com>
14128
14129         DFG::JITCompiler::getSpeculation() methods are badly named and superfluous
14130         https://bugs.webkit.org/show_bug.cgi?id=107860
14131
14132         Reviewed by Mark Hahnenberg.
14133
14134         * dfg/DFGJITCompiler.h:
14135         (JITCompiler):
14136         * dfg/DFGSpeculativeJIT64.cpp:
14137         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
14138         (JSC::DFG::SpeculativeJIT::emitBranch):
14139
14140 2013-01-24  Mark Hahnenberg  <mhahnenberg@apple.com>
14141
14142         Objective-C API: Rename JSValue.h/APIJSValue.h to JSCJSValue.h/JSValue.h
14143         https://bugs.webkit.org/show_bug.cgi?id=107327
14144
14145         Reviewed by Filip Pizlo.
14146
14147         We're renaming these two files, so we have to replace the names everywhere.
14148
14149         * API/APICast.h:
14150         * API/APIJSValue.h: Removed.
14151         * API/JSBlockAdaptor.mm:
14152         * API/JSStringRefCF.cpp:
14153         * API/JSValue.h: Copied from Source/JavaScriptCore/API/APIJSValue.h.
14154         * API/JSValue.mm:
14155         * API/JSValueInternal.h:
14156         * API/JSValueRef.cpp:
14157         * API/JSWeakObjectMapRefPrivate.cpp:
14158         * API/JavaScriptCore.h:
14159         * CMakeLists.txt:
14160         * GNUmakefile.list.am:
14161         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
14162         * JavaScriptCore.xcodeproj/project.pbxproj:
14163         * Target.pri:
14164         * bytecode/CallLinkStatus.h:
14165         * bytecode/CodeBlock.cpp:
14166         * bytecode/MethodOfGettingAValueProfile.h:
14167         * bytecode/ResolveGlobalStatus.cpp:
14168         * bytecode/ResolveGlobalStatus.h:
14169         * bytecode/SpeculatedType.h:
14170         * bytecode/ValueRecovery.h:
14171         * dfg/DFGByteCodeParser.cpp:
14172         * dfg/DFGJITCompiler.cpp:
14173         * dfg/DFGNode.h:
14174         * dfg/DFGSpeculativeJIT.cpp:
14175         * dfg/DFGSpeculativeJIT64.cpp:
14176         * heap/CopiedBlock.h:
14177         * heap/HandleStack.cpp:
14178         * heap/HandleTypes.h:
14179         * heap/WeakImpl.h:
14180         * interpreter/Interpreter.h:
14181         * interpreter/Register.h:
14182         * interpreter/VMInspector.h:
14183         * jit/HostCallReturnValue.cpp:
14184         * jit/HostCallReturnValue.h:
14185         * jit/JITCode.h:
14186         * jit/JITExceptions.cpp:
14187         * jit/JITExceptions.h:
14188         * jit/JSInterfaceJIT.h:
14189         * llint/LLIntCLoop.h:
14190         * llint/LLIntData.h:
14191         * llint/LLIntSlowPaths.cpp:
14192         * profiler/ProfilerBytecode.h:
14193         * profiler/ProfilerBytecodeSequence.h:
14194         * profiler/ProfilerBytecodes.h:
14195         * profiler/ProfilerCompilation.h:
14196         * profiler/ProfilerCompiledBytecode.h:
14197         * profiler/ProfilerDatabase.h:
14198         * profiler/ProfilerOSRExit.h:
14199         * profiler/ProfilerOSRExitSite.h:
14200         * profiler/ProfilerOrigin.h:
14201         * profiler/ProfilerOriginStack.h:
14202         * runtime/ArgList.cpp:
14203         * runtime/CachedTranscendentalFunction.h:
14204         * runtime/CallData.h:
14205         * runtime/Completion.h:
14206         * runtime/ConstructData.h:
14207         * runtime/DateConstructor.cpp:
14208         * runtime/DateInstance.cpp:
14209         * runtime/DatePrototype.cpp:
14210         * runtime/JSAPIValueWrapper.h:
14211         * runtime/JSCJSValue.cpp: Copied from Source/JavaScriptCore/runtime/JSValue.cpp.
14212         * runtime/JSCJSValue.h: Copied from Source/JavaScriptCore/runtime/JSValue.h.
14213         (JSValue):
14214         * runtime/JSCJSValueInlines.h: Copied from Source/JavaScriptCore/runtime/JSValueInlines.h.
14215         * runtime/JSGlobalData.h:
14216         * runtime/JSGlobalObject.cpp:
14217         * runtime/JSGlobalObjectFunctions.h:
14218         * runtime/JSStringJoiner.h:
14219         * runtime/JSValue.cpp: Removed.
14220         * runtime/JSValue.h: Removed.
14221         * runtime/JSValueInlines.h: Removed.
14222         * runtime/LiteralParser.h:
14223         * runtime/Operations.h:
14224         * runtime/PropertyDescriptor.h:
14225         * runtime/PropertySlot.h:
14226         * runtime/Protect.h:
14227         * runtime/RegExpPrototype.cpp:
14228         * runtime/Structure.h:
14229
14230 2013-01-23  Oliver Hunt  <oliver@apple.com>
14231
14232         Harden JSC a bit with RELEASE_ASSERT
14233         https://bugs.webkit.org/show_bug.cgi?id=107766
14234
14235         Reviewed by Mark Hahnenberg.
14236
14237         Went through and replaced a pile of ASSERTs that were covering
14238         significantly important details (bounds checks, etc) where
14239         having the checks did not impact release performance in any
14240         measurable way.
14241
14242         * API/JSContextRef.cpp:
14243         (JSContextCreateBacktrace):
14244         * assembler/MacroAssembler.h:
14245         (JSC::MacroAssembler::branchAdd32):
14246         (JSC::MacroAssembler::branchMul32):
14247         * bytecode/CodeBlock.cpp:
14248         (JSC::CodeBlock::dumpBytecode):
14249         (JSC::CodeBlock::handlerForBytecodeOffset):
14250         (JSC::CodeBlock::lineNumberForBytecodeOffset):
14251         (JSC::CodeBlock::bytecodeOffset):
14252         * bytecode/CodeBlock.h:
14253         (JSC::CodeBlock::bytecodeOffsetForCallAtIndex):
14254         (JSC::CodeBlock::bytecodeOffset):
14255         (JSC::CodeBlock::exceptionHandler):
14256         (JSC::CodeBlock::codeOrigin):
14257         (JSC::CodeBlock::immediateSwitchJumpTable):
14258         (JSC::CodeBlock::characterSwitchJumpTable):
14259         (JSC::CodeBlock::stringSwitchJumpTable):
14260         (JSC::CodeBlock::setIdentifiers):
14261         (JSC::baselineCodeBlockForInlineCallFrame):
14262         (JSC::ExecState::uncheckedR):
14263         * bytecode/CodeOrigin.cpp:
14264         (JSC::CodeOrigin::inlineStack):
14265         * bytecode/CodeOrigin.h:
14266         (JSC::CodeOrigin::CodeOrigin):
14267         * dfg/DFGCSEPhase.cpp:
14268         * dfg/DFGOSRExit.cpp:
14269         * dfg/DFGScratchRegisterAllocator.h:
14270         (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
14271         (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
14272         * dfg/DFGSpeculativeJIT.h:
14273         (JSC::DFG::SpeculativeJIT::allocate):
14274         (JSC::DFG::SpeculativeJIT::spill):
14275         (JSC::DFG::SpeculativeJIT::integerResult):
14276         * dfg/DFGSpeculativeJIT64.cpp:
14277         (JSC::DFG::SpeculativeJIT::fillInteger):
14278         (JSC::DFG::SpeculativeJIT::fillDouble):
14279         (JSC::DFG::SpeculativeJIT::fillJSValue):
14280         (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
14281         (JSC::DFG::SpeculativeJIT::emitCall):
14282         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
14283         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
14284         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
14285         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
14286         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
14287         (JSC::DFG::SpeculativeJIT::compile):
14288         * dfg/DFGValueSource.h:
14289         (JSC::DFG::dataFormatToValueSourceKind):
14290         (JSC::DFG::ValueSource::ValueSource):
14291         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
14292         * heap/BlockAllocator.cpp:
14293         (JSC::BlockAllocator::BlockAllocator):
14294         (JSC::BlockAllocator::releaseFreeRegions):
14295         (JSC::BlockAllocator::blockFreeingThreadMain):
14296         * heap/Heap.cpp:
14297         (JSC::Heap::lastChanceToFinalize):
14298         (JSC::Heap::collect):
14299         * interpreter/Interpreter.cpp:
14300         (JSC::Interpreter::throwException):
14301         (JSC::Interpreter::execute):
14302         * jit/GCAwareJITStubRoutine.cpp:
14303         (JSC::GCAwareJITStubRoutine::observeZeroRefCount):
14304         * jit/JIT.cpp:
14305         (JSC::JIT::privateCompileMainPass):
14306         (JSC::JIT::privateCompileSlowCases):
14307         * jit/JITExceptions.cpp:
14308         (JSC::genericThrow):
14309         * jit/JITInlines.h:
14310         (JSC::JIT::emitLoad):
14311         * jit/JITOpcodes.cpp:
14312         (JSC::JIT::emit_op_end):
14313         (JSC::JIT::emit_resolve_operations):
14314         * jit/JITStubRoutine.cpp:
14315         (JSC::JITStubRoutine::observeZeroRefCount):
14316         * jit/JITStubs.cpp:
14317         (JSC::returnToThrowTrampoline):
14318         * runtime/Arguments.cpp:
14319         (JSC::Arguments::getOwnPropertySlot):
14320         (JSC::Arguments::getOwnPropertyDescriptor):
14321         (JSC::Arguments::deleteProperty):
14322         (JSC::Arguments::defineOwnProperty):
14323         (JSC::Arguments::didTearOffActivation):
14324         * runtime/ArrayPrototype.cpp:
14325         (JSC::shift):
14326         (JSC::unshift):
14327         (JSC::arrayProtoFuncLastIndexOf):
14328         * runtime/ButterflyInlines.h:
14329         (JSC::Butterfly::growPropertyStorage):
14330         * runtime/CodeCache.cpp:
14331         (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
14332         * runtime/CodeCache.h:
14333         (JSC::CacheMap::add):
14334         * runtime/Completion.cpp:
14335         (JSC::checkSyntax):
14336         (JSC::evaluate):
14337         * runtime/Executable.cpp:
14338         (JSC::FunctionExecutable::FunctionExecutable):
14339         (JSC::EvalExecutable::unlinkCalls):
14340         (JSC::ProgramExecutable::compileOptimized):
14341         (JSC::ProgramExecutable::unlinkCalls):
14342         (JSC::ProgramExecutable::initializeGlobalProperties):
14343         (JSC::FunctionExecutable::baselineCodeBlockFor):
14344         (JSC::FunctionExecutable::compileOptimizedForCall):
14345         (JSC::FunctionExecutable::compileOptimizedForConstruct):
14346         (JSC::FunctionExecutable::compileForCallInternal):
14347         (JSC::FunctionExecutable::compileForConstructInternal):
14348         (JSC::FunctionExecutable::unlinkCalls):
14349         (JSC::NativeExecutable::hashFor):
14350         * runtime/Executable.h:
14351         (JSC::EvalExecutable::compile):
14352         (JSC::ProgramExecutable::compile):
14353         (JSC::FunctionExecutable::compileForCall):
14354         (JSC::FunctionExecutable::compileForConstruct):
14355         * runtime/IndexingHeader.h:
14356         (JSC::IndexingHeader::setVectorLength):
14357         * runtime/JSArray.cpp:
14358         (JSC::JSArray::pop):
14359         (JSC::JSArray::shiftCountWithArrayStorage):
14360         (JSC::JSArray::shiftCountWithAnyIndexingType):
14361         (JSC::JSArray::unshiftCountWithArrayStorage):
14362         * runtime/JSGlobalObjectFunctions.cpp:
14363         (JSC::jsStrDecimalLiteral):
14364         * runtime/JSObject.cpp:
14365         (JSC::JSObject::copyButterfly):
14366         (JSC::JSObject::defineOwnIndexedProperty):
14367         (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
14368         * runtime/JSString.cpp:
14369         (JSC::JSRopeString::getIndexSlowCase):
14370         * yarr/YarrInterpreter.cpp:
14371         (JSC::Yarr::Interpreter::popParenthesesDisjunctionContext):
14372
14373 2013-01-23  Filip Pizlo  <fpizlo@apple.com>
14374
14375         Constant folding an access to an uncaptured variable that is captured later in the same basic block shouldn't lead to assertion failures
14376         https://bugs.webkit.org/show_bug.cgi?id=107750
14377         <rdar://problem/12387265>
14378
14379         Reviewed by Mark Hahnenberg.
14380
14381         The point of this assertion was that if there is no variable capturing going on, then there should only be one GetLocal
14382         for the variable anywhere in the basic block. But if there is some capturing, then we'll have an unbounded number of
14383         GetLocals. The assertion was too imprecise for the latter case. I want to keep this assertion, so I introduced a
14384         checker that verifies this precisely: if there are any captured accesses to the variable anywhere at or after the
14385         GetLocal we are eliminating, then we allow redundant GetLocals.
14386
14387         * dfg/DFGConstantFoldingPhase.cpp:
14388         (JSC::DFG::ConstantFoldingPhase::foldConstants):
14389         (ConstantFoldingPhase):
14390         (JSC::DFG::ConstantFoldingPhase::isCapturedAtOrAfter):
14391
14392 2013-01-23  Oliver Hunt  <oliver@apple.com>
14393
14394         Replace ASSERT_NOT_REACHED with RELEASE_ASSERT_NOT_REACHED in JSC
14395         https://bugs.webkit.org/show_bug.cgi?id=107736
14396
14397         Reviewed by Mark Hahnenberg.
14398
14399         Mechanical change with no performance impact.
14400
14401         * API/JSBlockAdaptor.mm:
14402         (BlockArgumentTypeDelegate::typeVoid):
14403         * API/JSCallbackObjectFunctions.h:
14404         (JSC::::construct):
14405         (JSC::::call):
14406         * API/JSScriptRef.cpp:
14407         * API/ObjCCallbackFunction.mm:
14408         (ArgumentTypeDelegate::typeVoid):
14409         * assembler/ARMv7Assembler.h:
14410         (JSC::ARMv7Assembler::link):
14411         (JSC::ARMv7Assembler::replaceWithLoad):
14412         (JSC::ARMv7Assembler::replaceWithAddressComputation):
14413         * assembler/MacroAssembler.h:
14414         (JSC::MacroAssembler::invert):
14415         * assembler/MacroAssemblerARM.h:
14416         (JSC::MacroAssemblerARM::countLeadingZeros32):
14417         (JSC::MacroAssemblerARM::divDouble):
14418         * assembler/MacroAssemblerMIPS.h:
14419         (JSC::MacroAssemblerMIPS::absDouble):
14420         (JSC::MacroAssemblerMIPS::replaceWithJump):
14421         (JSC::MacroAssemblerMIPS::maxJumpReplacementSize):
14422         * assembler/MacroAssemblerSH4.h:
14423         (JSC::MacroAssemblerSH4::absDouble):
14424         (JSC::MacroAssemblerSH4::replaceWithJump):
14425         (JSC::MacroAssemblerSH4::maxJumpReplacementSize):
14426         * assembler/SH4Assembler.h:
14427         (JSC::SH4Assembler::shllImm8r):
14428         (JSC::SH4Assembler::shlrImm8r):
14429         (JSC::SH4Assembler::cmplRegReg):
14430         (JSC::SH4Assembler::branch):
14431         * assembler/X86Assembler.h:
14432         (JSC::X86Assembler::replaceWithLoad):
14433         (JSC::X86Assembler::replaceWithAddressComputation):
14434         * bytecode/CallLinkInfo.cpp:
14435         (JSC::CallLinkInfo::unlink):
14436         * bytecode/CodeBlock.cpp:
14437         (JSC::debugHookName):
14438         (JSC::CodeBlock::printGetByIdOp):
14439         (JSC::CodeBlock::printGetByIdCacheStatus):
14440         (JSC::CodeBlock::visitAggregate):
14441         (JSC::CodeBlock::finalizeUnconditionally):
14442         (JSC::CodeBlock::usesOpcode):
14443         * bytecode/DataFormat.h:
14444         (JSC::needDataFormatConversion):
14445         * bytecode/ExitKind.cpp:
14446         (JSC::exitKindToString):
14447         (JSC::exitKindIsCountable):
14448         * bytecode/MethodOfGettingAValueProfile.cpp:
14449         (JSC::MethodOfGettingAValueProfile::getSpecFailBucket):
14450         * bytecode/Opcode.h:
14451         (JSC::opcodeLength):
14452         * bytecode/PolymorphicPutByIdList.cpp:
14453         (JSC::PutByIdAccess::fromStructureStubInfo):
14454         (JSC::PutByIdAccess::visitWeak):
14455         * bytecode/StructureStubInfo.cpp:
14456         (JSC::StructureStubInfo::deref):
14457         * bytecompiler/BytecodeGenerator.cpp:
14458         (JSC::ResolveResult::checkValidity):
14459         (JSC::BytecodeGenerator::emitGetLocalVar):
14460         (JSC::BytecodeGenerator::beginSwitch):
14461         * bytecompiler/NodesCodegen.cpp:
14462         (JSC::BinaryOpNode::emitBytecode):
14463         (JSC::emitReadModifyAssignment):
14464         * dfg/DFGAbstractState.cpp:
14465         (JSC::DFG::AbstractState::execute):
14466         (JSC::DFG::AbstractState::mergeStateAtTail):
14467         (JSC::DFG::AbstractState::mergeToSuccessors):
14468         * dfg/DFGByteCodeParser.cpp:
14469         (JSC::DFG::ByteCodeParser::makeSafe):
14470         (JSC::DFG::ByteCodeParser::parseBlock):
14471         * dfg/DFGCFGSimplificationPhase.cpp:
14472         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
14473         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
14474         * dfg/DFGCSEPhase.cpp:
14475         (JSC::DFG::CSEPhase::setLocalStoreElimination):
14476         * dfg/DFGCapabilities.cpp:
14477         (JSC::DFG::canHandleOpcodes):
14478         * dfg/DFGCommon.h:
14479         (JSC::DFG::useKindToString):
14480         * dfg/DFGDoubleFormatState.h:
14481         (JSC::DFG::mergeDoubleFormatStates):
14482         (JSC::DFG::doubleFormatStateToString):
14483         * dfg/DFGFixupPhase.cpp:
14484         (JSC::DFG::FixupPhase::blessArrayOperation):
14485         * dfg/DFGGraph.h:
14486         (JSC::DFG::Graph::clobbersWorld):
14487         * dfg/DFGNode.h:
14488         (JSC::DFG::Node::valueOfJSConstant):
14489         (JSC::DFG::Node::successor):
14490         * dfg/DFGNodeFlags.cpp:
14491         (JSC::DFG::nodeFlagsAsString):
14492         * dfg/DFGNodeType.h:
14493         (JSC::DFG::defaultFlags):
14494         * dfg/DFGRepatch.h:
14495         (JSC::DFG::dfgResetGetByID):
14496         (JSC::DFG::dfgResetPutByID):
14497         * dfg/DFGSlowPathGenerator.h:
14498         (JSC::DFG::SlowPathGenerator::call):
14499         * dfg/DFGSpeculativeJIT.cpp:
14500         (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
14501         (JSC::DFG::SpeculativeJIT::silentSpill):
14502         (JSC::DFG::SpeculativeJIT::silentFill):
14503         (JSC::DFG::SpeculativeJIT::checkArray):
14504         (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
14505         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
14506         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
14507         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
14508         * dfg/DFGSpeculativeJIT.h:
14509         (JSC::DFG::SpeculativeJIT::bitOp):
14510         (JSC::DFG::SpeculativeJIT::shiftOp):
14511         (JSC::DFG::SpeculativeJIT::integerResult):
14512         * dfg/DFGSpeculativeJIT32_64.cpp:
14513         (JSC::DFG::SpeculativeJIT::fillInteger):
14514         (JSC::DFG::SpeculativeJIT::fillDouble):
14515         (JSC::DFG::SpeculativeJIT::fillJSValue):
14516         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
14517         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
14518         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
14519         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
14520         (JSC::DFG::SpeculativeJIT::compile):
14521         * dfg/DFGSpeculativeJIT64.cpp:
14522         (JSC::DFG::SpeculativeJIT::fillInteger):
14523         (JSC::DFG::SpeculativeJIT::fillDouble):
14524         (JSC::DFG::SpeculativeJIT::fillJSValue):
14525         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
14526         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
14527         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
14528         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
14529         (JSC::DFG::SpeculativeJIT::compile):
14530         * dfg/DFGStructureCheckHoistingPhase.cpp:
14531         (JSC::DFG::StructureCheckHoistingPhase::run):
14532         * dfg/DFGValueSource.h:
14533         (JSC::DFG::ValueSource::valueRecovery):
14534         * dfg/DFGVariableEvent.cpp:
14535         (JSC::DFG::VariableEvent::dump):
14536         * dfg/DFGVariableEventStream.cpp:
14537         (JSC::DFG::VariableEventStream::reconstruct):
14538         * heap/BlockAllocator.h:
14539         (JSC::BlockAllocator::regionSetFor):
14540         * heap/GCThread.cpp:
14541         (JSC::GCThread::gcThreadMain):
14542         * heap/MarkedBlock.cpp:
14543         (JSC::MarkedBlock::sweepHelper):
14544         * heap/MarkedBlock.h:
14545         (JSC::MarkedBlock::isLive):
14546         * interpreter/CallFrame.h:
14547         (JSC::ExecState::inlineCallFrame):
14548         * interpreter/Interpreter.cpp:
14549         (JSC::getCallerInfo):
14550         (JSC::getStackFrameCodeType):
14551         (JSC::Interpreter::execute):
14552         * jit/ExecutableAllocatorFixedVMPool.cpp:
14553         (JSC::FixedVMPoolExecutableAllocator::notifyPageIsFree):
14554         * jit/JIT.cpp:
14555         (JSC::JIT::privateCompileMainPass):
14556         (JSC::JIT::privateCompileSlowCases):
14557         (JSC::JIT::privateCompile):
14558         * jit/JITArithmetic.cpp:
14559         (JSC::JIT::emitSlow_op_mod):
14560         * jit/JITArithmetic32_64.cpp:
14561         (JSC::JIT::emitBinaryDoubleOp):
14562         (JSC::JIT::emitSlow_op_mod):
14563         * jit/JITPropertyAccess.cpp:
14564         (JSC::JIT::isDirectPutById):
14565         * jit/JITStubs.cpp:
14566         (JSC::getPolymorphicAccessStructureListSlot):
14567         (JSC::DEFINE_STUB_FUNCTION):
14568         * llint/LLIntSlowPaths.cpp:
14569         (JSC::LLInt::jitCompileAndSetHeuristics):
14570         * parser/Lexer.cpp:
14571         (JSC::::lex):
14572         * parser/Nodes.h:
14573         (JSC::ExpressionNode::emitBytecodeInConditionContext):
14574         * parser/Parser.h:
14575         (JSC::Parser::getTokenName):
14576         (JSC::Parser::updateErrorMessageSpecialCase):
14577         * parser/SyntaxChecker.h:
14578         (JSC::SyntaxChecker::operatorStackPop):
14579         * runtime/Arguments.cpp:
14580         (JSC::Arguments::tearOffForInlineCallFrame):
14581         * runtime/DatePrototype.cpp:
14582         (JSC::formatLocaleDate):
14583         * runtime/Executable.cpp:
14584         (JSC::samplingDescription):
14585         * runtime/Executable.h:
14586         (JSC::ScriptExecutable::unlinkCalls):
14587         * runtime/Identifier.cpp:
14588         (JSC):
14589         * runtime/InternalFunction.cpp:
14590         (JSC::InternalFunction::getCallData):
14591         * runtime/JSArray.cpp:
14592         (JSC::JSArray::push):
14593         (JSC::JSArray::sort):
14594         * runtime/JSCell.cpp:
14595         (JSC::JSCell::defaultValue):
14596         (JSC::JSCell::getOwnPropertyNames):
14597         (JSC::JSCell::getOwnNonIndexPropertyNames):
14598         (JSC::JSCell::className):
14599         (JSC::JSCell::getPropertyNames):
14600         (JSC::JSCell::customHasInstance):
14601         (JSC::JSCell::putDirectVirtual):
14602         (JSC::JSCell::defineOwnProperty):
14603         (JSC::JSCell::getOwnPropertyDescriptor):
14604         * runtime/JSCell.h:
14605         (JSCell):
14606         * runtime/JSNameScope.cpp:
14607         (JSC::JSNameScope::put):
14608         * runtime/JSObject.cpp:
14609         (JSC::JSObject::getOwnPropertySlotByIndex):
14610         (JSC::JSObject::putByIndex):
14611         (JSC::JSObject::ensureArrayStorageSlow):
14612         (JSC::JSObject::deletePropertyByIndex):
14613         (JSC::JSObject::getOwnPropertyNames):
14614         (JSC::JSObject::putByIndexBeyondVectorLength):
14615         (JSC::JSObject::putDirectIndexBeyondVectorLength):
14616         (JSC::JSObject::getOwnPropertyDescriptor):
14617         * runtime/JSObject.h:
14618         (JSC::JSObject::canGetIndexQuickly):
14619         (JSC::JSObject::getIndexQuickly):
14620         (JSC::JSObject::tryGetIndexQuickly):
14621         (JSC::JSObject::canSetIndexQuickly):
14622         (JSC::JSObject::canSetIndexQuicklyForPutDirect):
14623         (JSC::JSObject::setIndexQuickly):
14624         (JSC::JSObject::initializeIndex):
14625         (JSC::JSObject::hasSparseMap):
14626         (JSC::JSObject::inSparseIndexingMode):
14627         * runtime/JSScope.cpp:
14628         (JSC::JSScope::isDynamicScope):
14629         * runtime/JSSymbolTableObject.cpp:
14630         (JSC::JSSymbolTableObject::putDirectVirtual):
14631         * runtime/JSSymbolTableObject.h:
14632         (JSSymbolTableObject):
14633         * runtime/LiteralParser.cpp:
14634         (JSC::::parse):
14635         * runtime/RegExp.cpp:
14636         (JSC::RegExp::compile):
14637         (JSC::RegExp::compileMatchOnly):
14638         * runtime/StructureTransitionTable.h:
14639         (JSC::newIndexingType):
14640         * tools/CodeProfile.cpp:
14641         (JSC::CodeProfile::sample):
14642         * yarr/YarrCanonicalizeUCS2.h:
14643         (JSC::Yarr::getCanonicalPair):
14644         (JSC::Yarr::areCanonicallyEquivalent):
14645         * yarr/YarrInterpreter.cpp:
14646         (JSC::Yarr::Interpreter::matchCharacterClass):
14647         (JSC::Yarr::Interpreter::matchBackReference):
14648         (JSC::Yarr::Interpreter::backtrackParenthesesTerminalEnd):
14649         (JSC::Yarr::Interpreter::matchParentheses):
14650         (JSC::Yarr::Interpreter::backtrackParentheses):
14651         (JSC::Yarr::Interpreter::matchDisjunction):
14652         * yarr/YarrJIT.cpp:
14653         (JSC::Yarr::YarrGenerator::generateTerm):
14654         (JSC::Yarr::YarrGenerator::backtrackTerm):
14655         * yarr/YarrParser.h:
14656         (JSC::Yarr::Parser::CharacterClassParserDelegate::assertionWordBoundary):
14657         (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBackReference):
14658         * yarr/YarrPattern.cpp:
14659         (JSC::Yarr::YarrPatternConstructor::atomCharacterClassBuiltIn):
14660
14661 2013-01-23  Tony Chang  <tony@chromium.org>
14662
14663         Unreviewed, set svn:eol-style to CRLF on Windows .sln files.
14664
14665         * JavaScriptCore.vcproj/JavaScriptCore.sln: Modified property svn:eol-style.
14666         * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Modified property svn:eol-style.
14667
14668 2013-01-23  Oliver Hunt  <oliver@apple.com>
14669
14670         Replace numerous manual CRASH's in JSC with RELEASE_ASSERT
14671         https://bugs.webkit.org/show_bug.cgi?id=107726
14672
14673         Reviewed by Filip Pizlo.
14674
14675         Fairly manual change from if (foo) CRASH(); to RELEASE_ASSERT(!foo);
14676
14677         * assembler/MacroAssembler.h:
14678         (JSC::MacroAssembler::branchAdd32):
14679         (JSC::MacroAssembler::branchMul32):
14680         * bytecode/CodeBlockHash.cpp:
14681         (JSC::CodeBlockHash::CodeBlockHash):
14682         * heap/BlockAllocator.h:
14683         (JSC::Region::create):
14684         (JSC::Region::createCustomSize):
14685         * heap/GCAssertions.h:
14686         * heap/HandleSet.cpp:
14687         (JSC::HandleSet::visitStrongHandles):
14688         (JSC::HandleSet::writeBarrier):
14689         * heap/HandleSet.h:
14690         (JSC::HandleSet::allocate):
14691         * heap/Heap.cpp:
14692         (JSC::Heap::collect):
14693         * heap/SlotVisitor.cpp:
14694         (JSC::SlotVisitor::validate):
14695         * interpreter/Interpreter.cpp:
14696         (JSC::Interpreter::execute):
14697         * jit/ExecutableAllocator.cpp:
14698         (JSC::DemandExecutableAllocator::allocateNewSpace):
14699         (JSC::ExecutableAllocator::allocate):
14700         * jit/ExecutableAllocator.h:
14701         (JSC::roundUpAllocationSize):
14702         * jit/ExecutableAllocatorFixedVMPool.cpp:
14703         (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
14704         (JSC::ExecutableAllocator::allocate):
14705         * runtime/ButterflyInlines.h:
14706         (JSC::Butterfly::createUninitialized):
14707         * runtime/Completion.cpp:
14708         (JSC::evaluate):
14709         * runtime/JSArray.h:
14710         (JSC::constructArray):
14711         * runtime/JSGlobalObject.cpp:
14712         (JSC::slowValidateCell):
14713         * runtime/JSObject.cpp:
14714         (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
14715         (JSC::JSObject::createArrayStorage):
14716         * tools/TieredMMapArray.h:
14717         (JSC::TieredMMapArray::append):
14718         * yarr/YarrInterpreter.cpp:
14719         (JSC::Yarr::Interpreter::allocDisjunctionContext):
14720         (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
14721         (JSC::Yarr::Interpreter::InputStream::readChecked):
14722         (JSC::Yarr::Interpreter::InputStream::uncheckInput):
14723         (JSC::Yarr::Interpreter::InputStream::atEnd):
14724         (JSC::Yarr::Interpreter::interpret):
14725
14726 2013-01-22  Filip Pizlo  <fpizlo@apple.com>
14727
14728         Convert CSE phase to not rely too much on NodeIndex
14729         https://bugs.webkit.org/show_bug.cgi?id=107616
14730
14731         Reviewed by Geoffrey Garen.
14732
14733         - Instead of looping over the graph (which assumes that you can simply loop over all
14734           nodes without considering blocks first) to reset node.replacement, do that in the
14735           loop that sets up relevantToOSR, just before running CSE on the block.
14736
14737         - Instead of having a relevantToOSR bitvector indexed by NodeIndex, made
14738           NodeRelevantToOSR be a NodeFlag. We had exactly one bit left in NodeFlags, so I did
14739           some reshuffling to fit it in.
14740
14741         * dfg/DFGCSEPhase.cpp:
14742         (JSC::DFG::CSEPhase::CSEPhase):
14743         (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
14744         (JSC::DFG::CSEPhase::performNodeCSE):
14745         (JSC::DFG::CSEPhase::performBlockCSE):
14746         (CSEPhase):
14747         * dfg/DFGNodeFlags.h:
14748         (DFG):
14749         * dfg/DFGNodeType.h:
14750         (DFG):
14751
14752 2013-01-21  Kentaro Hara  <haraken@chromium.org>
14753
14754         Implement UIEvent constructor
14755         https://bugs.webkit.org/show_bug.cgi?id=107430
14756
14757         Reviewed by Adam Barth.
14758
14759         Editor's draft: https://dvcs.w3.org/hg/d4e/raw-file/tip/source_respec.htm
14760
14761         UIEvent constructor is implemented under a DOM4_EVENTS_CONSTRUCTOR flag,
14762         which is enabled on Safari and Chromium for now.
14763
14764         * Configurations/FeatureDefines.xcconfig:
14765
14766 2013-01-22  Roger Fong  <roger_fong@apple.com>
14767
14768         Unreviewed VS2010 build fix following r140259.
14769
14770         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
14771         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
14772
14773 2013-01-22  Roger Fong  <roger_fong@apple.com>
14774
14775         JavaScriptCore property sheets, project files and modified build scripts.
14776         https://bugs.webkit.org/show_bug.cgi?id=106987
14777
14778         Reviewed by Brent Fulgham.
14779
14780         * JavaScriptCore.vcxproj: Added.
14781         * JavaScriptCore.vcxproj/JavaScriptCore.resources: Added.
14782         * JavaScriptCore.vcxproj/JavaScriptCore.resources/Info.plist: Added.
14783         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: Added.
14784         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: Added.
14785         * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.user: Added.
14786         * JavaScriptCore.vcxproj/JavaScriptCoreCF.props: Added.
14787         * JavaScriptCore.vcxproj/JavaScriptCoreCommon.props: Added.
14788         * JavaScriptCore.vcxproj/JavaScriptCoreDebug.props: Added.
14789         * JavaScriptCore.vcxproj/JavaScriptCoreExports.def: Added.
14790         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.make: Added.
14791         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj: Added.
14792         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj.filters: Added.
14793         * JavaScriptCore.vcxproj/JavaScriptCoreGenerated.vcxproj.user: Added.
14794         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedCommon.props: Added.
14795         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedDebug.props: Added.
14796         * JavaScriptCore.vcxproj/JavaScriptCoreGeneratedRelease.props: Added.
14797         * JavaScriptCore.vcxproj/JavaScriptCorePostBuild.cmd: Added.
14798         * JavaScriptCore.vcxproj/JavaScriptCorePreBuild.cmd: Added.
14799         * JavaScriptCore.vcxproj/JavaScriptCorePreLink.cmd: Added.
14800         * JavaScriptCore.vcxproj/JavaScriptCoreRelease.props: Added.
14801         * JavaScriptCore.vcxproj/LLInt.vcproj: Added.
14802         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly: Added.
14803         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.make: Added.
14804         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.vcxproj: Added.
14805         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/LLIntAssembly.vcxproj.user: Added.
14806         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntAssembly/build-LLIntAssembly.sh: Added.
14807         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets: Added.
14808         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.make: Added.
14809         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj: Added.
14810         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcxproj.user: Added.
14811         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh: Added.
14812         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor: Added.
14813         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj: Added.
14814         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcxproj.user: Added.
14815         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.props: Added.
14816         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.props: Added.
14817         * JavaScriptCore.vcxproj/LLInt.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.props: Added.
14818         * JavaScriptCore.vcxproj/build-generated-files.sh: Added.
14819         * JavaScriptCore.vcxproj/copy-files.cmd: Added.
14820         * JavaScriptCore.vcxproj/jsc: Added.
14821         * JavaScriptCore.vcxproj/jsc/jsc.vcxproj: Added.
14822         * JavaScriptCore.vcxproj/jsc/jsc.vcxproj.filters: Added.
14823         * JavaScriptCore.vcxproj/jsc/jsc.vcxproj.user: Added.
14824         * JavaScriptCore.vcxproj/jsc/jscCommon.props: Added.
14825         * JavaScriptCore.vcxproj/jsc/jscDebug.props: Added.
14826         * JavaScriptCore.vcxproj/jsc/jscPostBuild.cmd: Added.
14827         * JavaScriptCore.vcxproj/jsc/jscPreBuild.cmd: Added.
14828         * JavaScriptCore.vcxproj/jsc/jscPreLink.cmd: Added.
14829         * JavaScriptCore.vcxproj/jsc/jscRelease.props: Added.
14830         * config.h:
14831
14832 2013-01-22  Joseph Pecoraro  <pecoraro@apple.com>
14833
14834         [Mac] Enable Page Visibility (PAGE_VISIBILITY_API)
14835         https://bugs.webkit.org/show_bug.cgi?id=107230
14836
14837         Reviewed by David Kilzer.
14838
14839         * Configurations/FeatureDefines.xcconfig:
14840
14841 2013-01-22  Tobias Netzel  <tobias.netzel@googlemail.com>
14842
14843         Yarr JIT isn't big endian compatible
14844         https://bugs.webkit.org/show_bug.cgi?id=102897
14845
14846         Reviewed by Oliver Hunt.
14847
14848         This patch was tested in the current mozilla codebase only and has passed the regexp tests there.
14849
14850         * yarr/YarrJIT.cpp:
14851         (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
14852
14853 2013-01-22  David Kilzer  <ddkilzer@apple.com>
14854
14855         Fix DateMath.cpp to compile with -Wshorten-64-to-32
14856         <http://webkit.org/b/107503>
14857
14858         Reviewed by Darin Adler.
14859
14860         * runtime/JSDateMath.cpp:
14861         (JSC::parseDateFromNullTerminatedCharacters): Remove unneeded
14862         static_cast<int>().
14863
14864 2013-01-22  Tim Horton  <timothy_horton@apple.com>
14865
14866         PDFPlugin: Build PDFPlugin everywhere, enable at runtime
14867         https://bugs.webkit.org/show_bug.cgi?id=107117
14868
14869         Reviewed by Alexey Proskuryakov.
14870
14871         Since PDFLayerController SPI is all forward-declared, the plugin should build
14872         on all Mac platforms, and can be enabled at runtime.
14873
14874         * Configurations/FeatureDefines.xcconfig:
14875
14876 2013-01-21  Justin Schuh  <jschuh@chromium.org>
14877
14878         [CHROMIUM] Suppress c4267 build warnings for Win64 targets
14879         https://bugs.webkit.org/show_bug.cgi?id=107499
14880
14881         Reviewed by Abhishek Arya.
14882
14883         * JavaScriptCore.gyp/JavaScriptCore.gyp:
14884
14885 2013-01-21  Dirk Schulze  <dschulze@adobe.com>
14886
14887         Add build flag for Canvas's Path object (disabled by default)
14888         https://bugs.webkit.org/show_bug.cgi?id=107473
14889
14890         Reviewed by Dean Jackson.
14891
14892         Add CANVAS_PATH build flag to build systems.
14893
14894         * Configurations/FeatureDefines.xcconfig:
14895
14896 2013-01-20  Geoffrey Garen  <ggaren@apple.com>
14897
14898         Weak GC maps should be easier to use
14899         https://bugs.webkit.org/show_bug.cgi?id=107312
14900
14901         Reviewed by Sam Weinig.
14902
14903         Follow-up fix.
14904
14905         * runtime/PrototypeMap.cpp:
14906         (JSC::PrototypeMap::emptyObjectStructureForPrototype): Restored this
14907         ASSERT, which was disabled because of a bug in WeakGCMap.
14908
14909         * runtime/WeakGCMap.h:
14910         (JSC::WeakGCMap::add): We can't pass our passed-in value to add() because
14911         a PassWeak() clears itself when passed to another function. So, we pass
14912         nullptr instead, and fix things up afterwards.
14913
14914 2013-01-20  Geoffrey Garen  <ggaren@apple.com>
14915
14916         Unreviewed.
14917
14918         Temporarily disabling this ASSERT to get the bots green
14919         while I investigate a fix.
14920
14921         * runtime/PrototypeMap.cpp:
14922         (JSC::PrototypeMap::emptyObjectStructureForPrototype):
14923
14924 2013-01-20  Filip Pizlo  <fpizlo@apple.com>
14925
14926         Inserting a node into the DFG graph should not require five lines of code
14927         https://bugs.webkit.org/show_bug.cgi?id=107381
14928
14929         Reviewed by Sam Weinig.
14930
14931         This adds fairly comprehensive support for inserting a node into a DFG graph in one
14932         method call. A common example of this is:
14933
14934         m_insertionSet.insertNode(indexInBlock, DontRefChildren, DontRefNode, SpecNone, ForceOSRExit, codeOrigin);
14935
14936         The arguments to insert() specify what reference counting you need to have happen
14937         (RefChildren => recursively refs all children, RefNode => non-recursively refs the node
14938         that was created), the prediction to set (SpecNone is a common default), followed by
14939         the arguments to the Node() constructor. InsertionSet::insertNode() and similar methods
14940         (Graph::addNode() and BasicBlock::appendNode()) all use a common variadic template
14941         function macro from DFGVariadicFunction.h. Also, all of these methods will automatically
14942         non-recursively ref() the node being created if the flags say NodeMustGenerate.
14943
14944         In all, this new mechanism retains the flexibility of the old approach (you get to
14945         manage ref counts yourself, albeit in less code) while ensuring that most code that adds
14946         nodes to the graph now needs less code to do it.
14947
14948         In the future, we should revisit the reference counting methodology in the DFG: we could
14949         do like most compilers and get rid of it entirely, or we could make it automatic. This
14950         patch doesn't attempt to make any such major changes, and only seeks to simplify the
14951         technique we were already using (manual ref counting).
14952
14953         * GNUmakefile.list.am:
14954         * JavaScriptCore.xcodeproj/project.pbxproj:
14955         * bytecode/Operands.h:
14956         (JSC::dumpOperands):
14957         * dfg/DFGAdjacencyList.h:
14958         (AdjacencyList):
14959         (JSC::DFG::AdjacencyList::kind):
14960         * dfg/DFGArgumentsSimplificationPhase.cpp:
14961         (JSC::DFG::ArgumentsSimplificationPhase::run):
14962         * dfg/DFGBasicBlock.h:
14963         (DFG):
14964         (BasicBlock):
14965         * dfg/DFGBasicBlockInlines.h: Added.
14966         (DFG):
14967         * dfg/DFGCFGSimplificationPhase.cpp:
14968         (JSC::DFG::CFGSimplificationPhase::run):
14969         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
14970         * dfg/DFGCommon.h:
14971         * dfg/DFGConstantFoldingPhase.cpp:
14972         (JSC::DFG::ConstantFoldingPhase::ConstantFoldingPhase):
14973         (JSC::DFG::ConstantFoldingPhase::foldConstants):
14974         (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
14975         (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
14976         (ConstantFoldingPhase):
14977         * dfg/DFGFixupPhase.cpp:
14978         (JSC::DFG::FixupPhase::FixupPhase):
14979         (JSC::DFG::FixupPhase::fixupBlock):
14980         (JSC::DFG::FixupPhase::fixupNode):
14981         (FixupPhase):
14982         (JSC::DFG::FixupPhase::checkArray):
14983         (JSC::DFG::FixupPhase::blessArrayOperation):
14984         (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
14985         * dfg/DFGGraph.h:
14986         (JSC::DFG::Graph::ref):
14987         (Graph):
14988         * dfg/DFGInsertionSet.h:
14989         (DFG):
14990         (JSC::DFG::Insertion::Insertion):
14991         (JSC::DFG::Insertion::element):
14992         (Insertion):
14993         (JSC::DFG::InsertionSet::InsertionSet):
14994         (JSC::DFG::InsertionSet::insert):
14995         (InsertionSet):
14996         (JSC::DFG::InsertionSet::execute):
14997         * dfg/DFGNode.h:
14998         (JSC::DFG::Node::Node):
14999         (Node):
15000         * dfg/DFGStructureCheckHoistingPhase.cpp:
15001         (JSC::DFG::StructureCheckHoistingPhase::run):
15002         * dfg/DFGVariadicFunction.h: Added.
15003
15004 2013-01-19  Geoffrey Garen  <ggaren@apple.com>
15005
15006         Track inheritance structures in a side table, instead of using a private
15007         name in each prototype
15008         https://bugs.webkit.org/show_bug.cgi?id=107378
15009
15010         Reviewed by Sam Weinig and Phil Pizlo.
15011
15012         This is a step toward object size inference.
15013
15014         Using a side table frees us to use a more complex key (a pair of
15015         prototype and expected inline capacity).
15016
15017         It also avoids ruining inline caches for prototypes. (Adding a new private
15018         name for a new inline capacity would change the prototype's structure,
15019         possibly firing watchpoints, making inline caches go polymorphic, and
15020         generally causing us to have a bad time.)
15021
15022         * CMakeLists.txt:
15023         * GNUmakefile.list.am:
15024         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
15025         * JavaScriptCore.xcodeproj/project.pbxproj:
15026         * Target.pri: Buildage.
15027
15028         * runtime/ArrayPrototype.cpp:
15029         (JSC::ArrayPrototype::finishCreation): Updated to use new side table API.
15030
15031         * runtime/JSFunction.cpp:
15032         (JSC::JSFunction::cacheInheritorID): Updated to use new side table API.
15033
15034         (JSC::JSFunction::visitChildren): Fixed a long-standing bug where JSFunction
15035         forgot to visit one of its data members (m_cachedInheritorID). This
15036         wasn't a user-visible problem before because JSFunction would always
15037         visit its .prototype property, which visited its m_cachedInheritorID.
15038         But now, function.prototype only weakly owns function.m_cachedInheritorID.
15039
15040         * runtime/JSGlobalData.h:
15041         (JSGlobalData): Added the map, taking care to make sure that its
15042         destructor would run after the heap destructor.
15043
15044         * runtime/JSGlobalObject.cpp:
15045         (JSC::JSGlobalObject::reset): Updated to use new side table API.
15046
15047         * runtime/JSObject.cpp:
15048         (JSC::JSObject::notifyPresenceOfIndexedAccessors):
15049         (JSC::JSObject::setPrototype):
15050         * runtime/JSObject.h:
15051         (JSObject): Updated to use new side table API, and removed lots of code
15052         that used to manage the per-object private name.
15053
15054         * runtime/JSProxy.cpp:
15055         (JSC::JSProxy::setTarget):
15056         * runtime/ObjectConstructor.cpp:
15057         (JSC::objectConstructorCreate):
15058         * runtime/ObjectPrototype.cpp:
15059         (JSC::ObjectPrototype::finishCreation): Updated to use new side table API.
15060
15061         * runtime/PrototypeMap.cpp: Added.
15062         (JSC):
15063         (JSC::PrototypeMap::addPrototype):
15064         (JSC::PrototypeMap::emptyObjectStructureForPrototype):
15065         * runtime/PrototypeMap.h: Added.
15066         (PrototypeMap):
15067         (JSC::PrototypeMap::isPrototype):
15068         (JSC::PrototypeMap::clearEmptyObjectStructureForPrototype): New side table.
15069         This is a simple weak map, mapping an object to the structure you should
15070         use when inheriting from that object. (In future, inline capacity will
15071         be a part of the mapping.)
15072
15073         I used two maps to preserve existing behavior that allowed us to speculate
15074         about an object becoming a prototype, even if it wasn't one at the moment.
15075         However, I suspect that behavior can be removed without harm.
15076
15077         * runtime/WeakGCMap.h:
15078         (JSC::WeakGCMap::contains):
15079         (WeakGCMap): I would rate myself a 6 / 10 in C++.
15080
15081 2013-01-18  Dan Bernstein  <mitz@apple.com>
15082
15083         Removed duplicate references to two headers in the project files.
15084
15085         Rubber-stamped by Mark Rowe.
15086
15087         * JavaScriptCore.xcodeproj/project.pbxproj:
15088
15089 2013-01-18  Michael Saboff  <msaboff@apple.com>
15090
15091         Unreviewed build fix for building JSC with DFG_ENABLE_DEBUG_PROPAGATION_VERBOSE enabled in DFGCommon.h.
15092         Fixes the case where the argument node in fixupNode is freed due to the Vector storage being reallocated.
15093
15094         * dfg/DFGFixupPhase.cpp:
15095         (JSC::DFG::FixupPhase::fixupNode):
15096
15097 2013-01-18  Michael Saboff  <msaboff@apple.com>
15098
15099         Unreviewed build fix for release builds when DFG_ENABLE_DEBUG_PROPAGATION_VERBOSE is set to 1 in DFGCommon.h.
15100
15101         * dfg/DFGCFAPhase.cpp: Added #include "Operations.h"
15102
15103 2013-01-18  Michael Saboff  <msaboff@apple.com>
15104
15105         Change set r140201 broke editing/selection/move-by-word-visually-multi-line.html
15106         https://bugs.webkit.org/show_bug.cgi?id=107340
15107
15108         Reviewed by Filip Pizlo.
15109
15110         Due to the change landed in r140201, more nodes might end up
15111         generating Int32ToDouble nodes.  Therefore, changed the JSVALUE64
15112         constant path of compileInt32ToDouble() to use the more
15113         restrictive isInt32Constant() check on the input.  This check was
15114         the same as the existing ASSERT() so the ASSERT was eliminated.
15115
15116         * dfg/DFGSpeculativeJIT.cpp:
15117         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
15118
15119 2013-01-18  Viatcheslav Ostapenko  <sl.ostapenko@samsung.com>
15120
15121         Weak GC maps should be easier to use
15122         https://bugs.webkit.org/show_bug.cgi?id=107312
15123
15124         Reviewed by Ryosuke Niwa.
15125
15126         Build fix for linux platforms after r140194.
15127
15128         * runtime/WeakGCMap.h:
15129         (WeakGCMap):
15130
15131 2013-01-18  Michael Saboff  <msaboff@apple.com>
15132
15133         Harden ArithDiv of integers fix-up by inserting Int32ToDouble node directly
15134         https://bugs.webkit.org/show_bug.cgi?id=107321
15135
15136         Reviewed by  Filip Pizlo.
15137
15138         Split out the Int32ToDouble node insertion from fixDoubleEdge() and used it directly when we're fixing up
15139         an ArithDiv node with integer inputs and output for platforms that don't have integer division.
15140         Since we are checking that our inputs should be ints, we can just insert the Int32ToDouble node
15141         without any further checks.
15142
15143         * dfg/DFGFixupPhase.cpp:
15144         (JSC::DFG::FixupPhase::fixupNode):
15145         (JSC::DFG::FixupPhase::fixDoubleEdge):
15146         (FixupPhase):
15147         (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
15148
15149 2013-01-18  Michael Saboff  <msaboff@apple.com>
15150
15151         Fix up of ArithDiv nodes for non-x86 CPUs is broken
15152         https://bugs.webkit.org/show_bug.cgi?id=107309
15153
15154         Reviewed by  Filip Pizlo.
15155
15156         Changed the logic so that we insert an Int32ToDouble node when the existing edge is not SpecDouble.
15157
15158         * dfg/DFGFixupPhase.cpp:
15159         (JSC::DFG::FixupPhase::fixDoubleEdge):
15160
15161 2013-01-18  Dan Bernstein  <mitz@apple.com>
15162
15163         Tried to fix the build after r140194.
15164
15165         * API/JSWrapperMap.mm:
15166         (-[JSWrapperMap wrapperForObject:]):
15167
15168 2013-01-18  Mark Hahnenberg  <mhahnenberg@apple.com>
15169
15170         Objective-C API: Update documentation for JSValue and JSContext
15171         https://bugs.webkit.org/show_bug.cgi?id=107313
15172
15173         Reviewed by Geoffrey Garen.
15174
15175         After changing the semantics of object lifetime we need to update the API documentation to reflect the new semantics.
15176
15177         * API/APIJSValue.h:
15178         * API/JSContext.h:
15179
15180 2013-01-18  Balazs Kilvady  <kilvadyb@homejinni.com>
15181
15182         r134080 causes heap problem on linux systems where PAGESIZE != 4096
15183         https://bugs.webkit.org/show_bug.cgi?id=102828
15184
15185         Reviewed by Mark Hahnenberg.
15186
15187         Make MarkStackSegment::blockSize as the capacity of segments of a MarkStackArray.
15188
15189         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def:
15190         * heap/MarkStack.cpp:
15191         (JSC):
15192         (JSC::MarkStackArray::MarkStackArray):
15193         (JSC::MarkStackArray::expand):
15194         (JSC::MarkStackArray::donateSomeCellsTo):
15195         (JSC::MarkStackArray::stealSomeCellsFrom):
15196         * heap/MarkStack.h:
15197         (JSC::MarkStackSegment::data):
15198         (CapacityFromSize):
15199         (MarkStackArray):
15200         * heap/MarkStackInlines.h:
15201         (JSC::MarkStackArray::setTopForFullSegment):
15202         (JSC::MarkStackArray::append):
15203         (JSC::MarkStackArray::isEmpty):
15204         (JSC::MarkStackArray::size):
15205         * runtime/Options.h:
15206         (JSC):
15207
15208 2013-01-18  Geoffrey Garen  <ggaren@apple.com>
15209
15210         Weak GC maps should be easier to use
15211         https://bugs.webkit.org/show_bug.cgi?id=107312
15212
15213         Reviewed by Sam Weinig.
15214
15215         This patch changes WeakGCMap to not use a WeakImpl finalizer to remove
15216         items from the map, and to instead have the map automatically remove
15217         stale items itself upon insertion. This has a few advantages:
15218
15219         (1) WeakGCMap is now compatible with all the specializations you would
15220         use for HashMap.
15221
15222         (2) There's no need for clients to write special finalization munging
15223         functions.
15224
15225         (3) Clients can specify custom value finalizers if they like.
15226
15227         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def: Def!
15228
15229         * API/JSWeakObjectMapRefPrivate.cpp: Setter no longer requires a global
15230         data, since we've reduced interdependency.
15231
15232         * heap/Handle.h: No more need to forward declare, since we've reduced
15233         interdependency.
15234
15235         * heap/Weak.h:
15236         (Weak): Use explicit so we can assign directly to a weak map iterator
15237         without ambiguity between Weak<T> and PassWeak<T>.
15238
15239         * runtime/Structure.cpp:
15240         (JSC::StructureTransitionTable::add): See above.
15241
15242         * runtime/Structure.h:
15243         (JSC):
15244         * runtime/StructureTransitionTable.h:
15245         (StructureTransitionTable): Bad code goes away, programmer happy.
15246
15247         * runtime/WeakGCMap.h:
15248         (JSC):
15249         (WeakGCMap):
15250         (JSC::WeakGCMap::WeakGCMap):
15251         (JSC::WeakGCMap::set):
15252         (JSC::WeakGCMap::add):
15253         (JSC::WeakGCMap::find):
15254         (JSC::WeakGCMap::contains):
15255         (JSC::WeakGCMap::gcMap):
15256         (JSC::WeakGCMap::gcMapIfNeeded): Inherit from HashMap and override any
15257         function that might observe a Weak<T> that has died, just enough to
15258         make such items appear as if they are not in the table.
15259
15260 2013-01-18  Michael Saboff  <msaboff@apple.com>
15261
15262         Refactor isPowerOf2() and add getLSBSet()
15263         https://bugs.webkit.org/show_bug.cgi?id=107306
15264
15265         Reviewed by Filip Pizlo.
15266
15267         Moved implementation of isPowerOf2() to new hasOneBitSet() in wtf/MathExtras.h.
15268
15269         * runtime/PropertyMapHashTable.h:
15270         (JSC::isPowerOf2):
15271
15272 2013-01-17  Mark Hahnenberg  <mhahnenberg@apple.com>
15273
15274         Objective-C API: Clean up JSValue.mm
15275         https://bugs.webkit.org/show_bug.cgi?id=107163
15276
15277         Reviewed by Darin Adler.
15278
15279         m_context is no longer weak, so there is now a lot of dead code in in JSValue.mm, and a wasted message send
15280         on every API call.  In the head of just about every method in JSValue.mm we're doing:
15281
15282         JSContext *context = [self context];
15283         if (!context)
15284             return nil;
15285
15286         This is getting a retained copy of the context, which is no longer necessary now m_context is no longer weak.
15287         We can just delete all these lines from all functions doing this, and where they were referring to the local
15288         variable 'context', instead we can just access m_context directly.
15289
15290         Since we're already going to be modifying most of JSValue.mm, we'll also do the following:
15291
15292         1) context @property is no longer weak – the context property is declared as:
15293
15294             @property(readonly, weak) JSContext *context;
15295
15296         This is really only informative (since we're not presently synthesizing the ivar), but it is now misleading.
15297         We should change it to:
15298
15299             @property(readonly, retain) JSContext *context;
15300
15301         2) the JSContext ivar and accessor can be automatically generated.  Since we're no longer doing anything
15302         special with m_context, we can just let the compiler handle the ivar for us.  We'll delete:
15303
15304             JSContext *m_context;
15305
15306         and:
15307
15308             - (JSContext *)context
15309             {
15310                 return m_context;
15311
15312             }
15313
15314         and find&replace "m_context" to "_context" in JSValue.mm.
15315
15316         * API/APIJSValue.h:
15317         * API/JSValue.mm:
15318         (-[JSValue toObject]):
15319         (-[JSValue toBool]):
15320         (-[JSValue toDouble]):
15321         (-[JSValue toNumber]):
15322         (-[JSValue toString]):
15323         (-[JSValue toDate]):
15324         (-[JSValue toArray]):
15325         (-[JSValue toDictionary]):
15326         (-[JSValue valueForProperty:]):
15327         (-[JSValue setValue:forProperty:]):
15328         (-[JSValue deleteProperty:]):
15329         (-[JSValue hasProperty:]):
15330         (-[JSValue defineProperty:descriptor:]):
15331         (-[JSValue valueAtIndex:]):
15332         (-[JSValue setValue:atIndex:]):
15333         (-[JSValue isUndefined]):
15334         (-[JSValue isNull]):
15335         (-[JSValue isBoolean]):
15336         (-[JSValue isNumber]):
15337         (-[JSValue isString]):
15338         (-[JSValue isObject]):
15339         (-[JSValue isEqualToObject:]):
15340         (-[JSValue isEqualWithTypeCoercionToObject:]):
15341         (-[JSValue isInstanceOf:]):
15342         (-[JSValue callWithArguments:]):
15343         (-[JSValue constructWithArguments:]):
15344         (-[JSValue invokeMethod:withArguments:]):
15345         (-[JSValue objectForKeyedSubscript:]):
15346         (-[JSValue setObject:forKeyedSubscript:]):
15347         (-[JSValue initWithValue:inContext:]):
15348         (-[JSValue dealloc]):
15349         (-[JSValue description]):
15350
15351 2013-01-17  Mark Hahnenberg  <mhahnenberg@apple.com>
15352
15353         Objective-C API: Clean up JSValue
15354         https://bugs.webkit.org/show_bug.cgi?id=107156
15355
15356         Reviewed by Oliver Hunt.
15357
15358         JSContext m_protectCounts, protect, unprotect are all now unnecessary overhead, and should all be removed.
15359         These exist to handle the context going away before the value does; the context needs to be able to unprotect
15360         values early.  Since the value is now keeping the context alive there is no longer any danger of this happening;
15361         instead we should just protect/unprotect the value in JSValue's init/dealloc methods.
15362
15363         * API/JSContext.mm:
15364         (-[JSContext dealloc]):
15365         * API/JSContextInternal.h:
15366         * API/JSValue.mm:
15367         (-[JSValue initWithValue:inContext:]):
15368         (-[JSValue dealloc]):
15369
15370 2013-01-17  Filip Pizlo  <fpizlo@apple.com>
15371
15372         DFG Node::ref() and Node::deref() should not return bool, and should have postfixRef variants
15373         https://bugs.webkit.org/show_bug.cgi?id=107147
15374
15375         Reviewed by Mark Hahnenberg.
15376
15377         This small refactoring will enable a world where ref() returns Node*, which is useful for
15378         https://bugs.webkit.org/show_bug.cgi?id=106868.  Also, while this refactoring does lead to
15379         slightly less terse code, it's also slightly more self-explanatory.  I could never quite
15380         remember what the meaning of the bool return from ref() and deref() was.
15381
15382         * dfg/DFGGraph.cpp:
15383         (JSC::DFG::Graph::collectGarbage):
15384         * dfg/DFGGraph.h:
15385         (JSC::DFG::Graph::ref):
15386         (JSC::DFG::Graph::deref):
15387         * dfg/DFGNode.h:
15388         (JSC::DFG::Node::ref):
15389         (Node):
15390         (JSC::DFG::Node::postfixRef):
15391         (JSC::DFG::Node::deref):
15392         (JSC::DFG::Node::postfixDeref):
15393
15394 2013-01-17  Alexey Proskuryakov  <ap@apple.com>
15395
15396         Added svn:ignore=*.pyc, so that ud_opcode.pyc and ud_optable.pyc don't show up
15397         in svn stat.
15398
15399         * disassembler/udis86: Added property svn:ignore.
15400
15401 2013-01-16  Filip Pizlo  <fpizlo@apple.com>
15402
15403         DFG 32_64 backend doesn't check for hasArrayStorage() in NewArrayWithSize
15404         https://bugs.webkit.org/show_bug.cgi?id=107081
15405
15406         Reviewed by Michael Saboff.
15407
15408         This bug led to the 32_64 backend emitting contiguous allocation code to allocate
15409         ArrayStorage arrays. This then led to all manner of heap corruption, since
15410         subsequent array accesses would be accessing the contiguous array "as if" it was
15411         an arraystorage array.
15412
15413         * dfg/DFGSpeculativeJIT32_64.cpp:
15414         (JSC::DFG::SpeculativeJIT::compile):
15415
15416 2013-01-16  Jonathan Liu  <net147@gmail.com>
15417
15418         Add missing sys/mman.h include on Mac
15419         https://bugs.webkit.org/show_bug.cgi?id=98089
15420
15421         Reviewed by Darin Adler.
15422
15423         The madvise function and MADV_FREE constant require sys/mman.h.
15424
15425         * jit/ExecutableAllocatorFixedVMPool.cpp:
15426
15427 2013-01-15  Michael Saboff  <msaboff@apple.com>
15428
15429         DFG X86: division in the used-as-int case doesn't correctly check for -2^31/-1
15430         https://bugs.webkit.org/show_bug.cgi?id=106978
15431
15432         Reviewed by Filip Pizlo.
15433
15434         Changed the numerator equal to -2^31 check to just return if we expect an integer
15435         result, since the check is after we have determined that the denominator is -1.
15436         The int result of -2^31 / -1 is -2^31, so just return the numerator as the result.
15437
15438         * dfg/DFGSpeculativeJIT.cpp:
15439         (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86):
15440
15441 2013-01-15  Levi Weintraub  <leviw@chromium.org>
15442
15443         Unreviewed, rolling out r139792.
15444         http://trac.webkit.org/changeset/139792
15445         https://bugs.webkit.org/show_bug.cgi?id=106970
15446
15447         Broke the windows build.
15448
15449         * bytecode/GlobalResolveInfo.h: Removed property svn:mergeinfo.
15450
15451 2013-01-15  Pratik Solanki  <psolanki@apple.com>
15452
15453         Use MADV_FREE_REUSABLE to return JIT memory to OS
15454         https://bugs.webkit.org/show_bug.cgi?id=106830
15455         <rdar://problem/11437701>
15456
15457         Reviewed by Geoffrey Garen.
15458
15459         Use MADV_FREE_REUSABLE to return JIT memory on OSes that have the underlying madvise bug
15460         fixed.
15461
15462         * jit/ExecutableAllocatorFixedVMPool.cpp:
15463         (JSC::FixedVMPoolExecutableAllocator::notifyPageIsFree):
15464
15465 2013-01-15  Levi Weintraub  <leviw@chromium.org>
15466
15467         Unreviewed, rolling out r139790.
15468         http://trac.webkit.org/changeset/139790
15469         https://bugs.webkit.org/show_bug.cgi?id=106948
15470
15471         The patch is failing its own test.
15472
15473         * bytecode/GlobalResolveInfo.h: Removed property svn:mergeinfo.
15474
15475 2013-01-15  Zan Dobersek  <zandobersek@gmail.com>
15476
15477         [Autotools] Unify JavaScriptCore sources list, regardless of target OS
15478         https://bugs.webkit.org/show_bug.cgi?id=106007
15479
15480         Reviewed by Gustavo Noronha Silva.
15481
15482         Include the Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp target
15483         in the general sources list as it is guarded by the ENABLE_EXECUTABLE_ALLOCATOR_FIXED
15484         feature define. This define is only used on 64-bit architecture and indirectly depends
15485         on enabling either JIT or YARR JIT feature. Both of these defines are disabled on
15486         Windows OS when using 64-bit architecture so there's no need to add this target to
15487         sources only when the target OS is Windows.
15488
15489         * GNUmakefile.list.am:
15490
15491 2013-01-11  Filip Pizlo  <fpizlo@apple.com>
15492
15493         DFG should not forget that it had proved something to be a constant during a merge just because it's merging against the empty value
15494         https://bugs.webkit.org/show_bug.cgi?id=106727
15495
15496         Reviewed by Oliver Hunt.
15497
15498         The problem was this statement:
15499
15500         if (m_value != other.m_value)
15501             m_value = JSValue();
15502
15503         This is well-intentioned, in the sense that if we want our abstract value (i.e. this) to become the superset of the other
15504         abstract value, and the two abstract values have proven different constants, then our abstract value should rescind its
15505         claim that it has been proven to be constant. But this misses the special case that if the other abstract value is
15506         completely clear (meaning that it wishes to contribute zero information and so the superset operation shouldn't change
15507         this), it will have a clear m_value. So, the code prior to this patch would rescind the constant proof even though it
15508         didn't have to.
15509
15510         This comes up rarely and I don't believe it will be a performance win, but it is good to have the CFA been consistently
15511         precise as often as possible.
15512
15513         * dfg/DFGAbstractValue.h:
15514         (JSC::DFG::AbstractValue::merge):
15515
15516 2013-01-11  Filip Pizlo  <fpizlo@apple.com>
15517
15518         Python implementation reports "MemoryError" instead of doing things
15519         https://bugs.webkit.org/show_bug.cgi?id=106690
15520
15521         Reviewed by Oliver Hunt.
15522
15523         The bug was that the CFA was assuming that a variable is dead at the end of a basic block and hence doesn't need to
15524         be merged to the next block if the last mention of the variable was dead. This is almost correct, except that it
15525         doesn't work if the last mention is a GetLocal - the GetLocal itself may be dead, but that doesn't mean that the
15526         variable is dead - it may still be live. The appropriate thing to do is to look at the GetLocal's Phi. If the
15527         variable is used in the next block then the next block will have a reference to the last mention in our block unless
15528         that last mention is a GetLocal, in which case it will link to the Phi. Doing it this way captures everything that
15529         the CFA wants: if the last use is a live GetLocal then the CFA needs to consider the GetLocal itself for possible
15530         refinements to the proof of the value in the variable, but if the GetLocal is dead, then this must mean that the
15531         variable is not mentioned in the block but may still be "passed through" it, which is what the Phi will tell us.
15532         Note that it is not possible for the GetLocal to refer to anything other than a Phi, and it is also not possible
15533         for the last mention of a variable to be a dead GetLocal while there are other mentions that aren't dead - if
15534         there had been SetLocals or GetLocals prior to the dead one then the dead one wouldn't have been emitted by the
15535         parser.
15536
15537         This also fixes a similar bug in the handling of captured variables. If a variable is captured, then it doesn't
15538         matter if the last mention is dead, or not. Either way, we already know that a captured variable will be live in
15539         the next block, so we must merge it no matter what.
15540
15541         Finally, this change makes the output of Operands dumping a bit more verbose: it now prints the variable name next
15542         to each variable's dump. I've often found the lack of this information confusing particularly for operand dumps
15543         that involve a lot of variables.
15544
15545         * bytecode/Operands.h:
15546         (JSC::dumpOperands):
15547         * dfg/DFGAbstractState.cpp:
15548         (JSC::DFG::AbstractState::mergeStateAtTail):
15549
15550 2013-01-14  Roger Fong  <roger_fong@apple.com>
15551
15552         Unreviewed. Fix vcproj file. Missing file tag after http://trac.webkit.org/changeset/139541.
15553
15554         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
15555
15556 2013-01-13  Filip Pizlo  <fpizlo@apple.com>
15557
15558         DFG phases that store per-node information should store it in Node itself rather than using a secondary vector
15559         https://bugs.webkit.org/show_bug.cgi?id=106753
15560
15561         Reviewed by Geoffrey Garen.
15562
15563         * dfg/DFGAbstractState.cpp:
15564         (JSC::DFG::AbstractState::AbstractState):
15565         (JSC::DFG::AbstractState::beginBasicBlock):
15566         (JSC::DFG::AbstractState::dump):
15567         * dfg/DFGAbstractState.h:
15568         (JSC::DFG::AbstractState::forNode):
15569         (AbstractState):
15570         * dfg/DFGCFGSimplificationPhase.cpp:
15571         * dfg/DFGCSEPhase.cpp:
15572         (JSC::DFG::CSEPhase::CSEPhase):
15573         (JSC::DFG::CSEPhase::performSubstitution):
15574         (JSC::DFG::CSEPhase::setReplacement):
15575         (CSEPhase):
15576         * dfg/DFGNode.h:
15577         (Node):
15578
15579 2013-01-12  Tim Horton  <timothy_horton@apple.com>
15580
15581         Unreviewed build fix.
15582
15583         * API/JSBlockAdaptor.mm:
15584         * API/JSContext.mm:
15585         * API/JSValue.mm:
15586
15587 2013-01-12  Csaba Osztrogonác  <ossy@webkit.org>
15588
15589         Unreviewed 64 bit buildfix after r139496.
15590
15591         * dfg/DFGOperations.cpp:
15592
15593 2013-01-11  Filip Pizlo  <fpizlo@apple.com>
15594
15595         Unreviewed, speculative build fix.
15596
15597         * API/JSWrapperMap.mm:
15598
15599 2013-01-10  Filip Pizlo  <fpizlo@apple.com>
15600
15601         JITThunks should not compile only because of luck
15602         https://bugs.webkit.org/show_bug.cgi?id=105696
15603
15604         Rubber stamped by Sam Weinig and Geoffrey Garen.
15605
15606         This patch was supposed to just move JITThunks into its own file. But then I
15607         realized that there is a horrible circular dependency chain between JSCell,
15608         JSGlobalData, CallFrame, and Weak, which only works because of magical include
15609         order in JITStubs.h, and the fact that JSGlobalData.h includes JITStubs.h
15610         before it includes JSCell or JSValue.
15611
15612         I first tried to just get JITThunks.h to just magically do the same pointless
15613         includes that JITStubs.h had, but then I decided to actually fix the underflying
15614         problem, which was that JSCell needed CallFrame, CallFrame needed JSGlobalData,
15615         JSGlobalData needed JITThunks, JITThunks needed Weak, and Weak needed JSCell.
15616         Now, all of JSCell's outgoing dependencies are placed in JSCellInlines.h. This
15617         also gave me an opportunity to move JSValue inline methods from JSCell.h into
15618         JSValueInlines.h. But to make this really work, I needed to remove includes of
15619         *Inlines.h from other headers (CodeBlock.h for example included JSValueInlines.h,
15620         which defeats the whole entire purpose of having an Inlines.h file), and I needed
15621         to add includes of *Inlines.h into a bunch of .cpp files. I did this mostly by
15622         having .cpp files include Operations.h. In future, if you're adding a .cpp file
15623         to JSC, you'll almost certainly have to include Operations.h unless you enjoy
15624         link errors.
15625
15626         * API/JSBase.cpp:
15627         * API/JSCallbackConstructor.cpp:
15628         * API/JSCallbackFunction.cpp:
15629         * API/JSCallbackObject.cpp:
15630         * API/JSClassRef.cpp:
15631         * API/JSContextRef.cpp:
15632         * API/JSObjectRef.cpp:
15633         * API/JSScriptRef.cpp:
15634         * API/JSWeakObjectMapRefPrivate.cpp:
15635         * JSCTypedArrayStubs.h:
15636         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
15637         * JavaScriptCore.xcodeproj/project.pbxproj:
15638         * bytecode/ArrayAllocationProfile.cpp:
15639         * bytecode/CodeBlock.cpp:
15640         * bytecode/GetByIdStatus.cpp:
15641         * bytecode/LazyOperandValueProfile.cpp:
15642         * bytecode/ResolveGlobalStatus.cpp:
15643         * bytecode/SpeculatedType.cpp:
15644         * bytecode/UnlinkedCodeBlock.cpp:
15645         * bytecompiler/BytecodeGenerator.cpp:
15646         * debugger/Debugger.cpp:
15647         * debugger/DebuggerActivation.cpp:
15648         * debugger/DebuggerCallFrame.cpp:
15649         * dfg/DFGArgumentsSimplificationPhase.cpp:
15650         * dfg/DFGArrayMode.cpp:
15651         * dfg/DFGByteCodeParser.cpp:
15652         * dfg/DFGConstantFoldingPhase.cpp:
15653         * dfg/DFGDriver.cpp:
15654         * dfg/DFGFixupPhase.cpp:
15655         * dfg/DFGGraph.cpp:
15656         * dfg/DFGJITCompiler.cpp:
15657         * dfg/DFGOSREntry.cpp:
15658         * dfg/DFGOSRExitCompiler.cpp:
15659         * dfg/DFGOSRExitCompiler32_64.cpp:
15660         * dfg/DFGOSRExitCompiler64.cpp:
15661         * dfg/DFGPredictionPropagationPhase.cpp:
15662         * dfg/DFGSpeculativeJIT.cpp:
15663         (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
15664         (DFG):
15665         (JSC::DFG::SpeculativeJIT::silentSavePlanForFPR):
15666         (JSC::DFG::SpeculativeJIT::silentSpill):
15667         (JSC::DFG::SpeculativeJIT::silentFill):
15668         * dfg/DFGSpeculativeJIT.h:
15669         (SpeculativeJIT):
15670         * dfg/DFGSpeculativeJIT32_64.cpp:
15671         * dfg/DFGSpeculativeJIT64.cpp:
15672         * dfg/DFGStructureCheckHoistingPhase.cpp:
15673         * dfg/DFGVariableEventStream.cpp:
15674         * heap/CopiedBlock.h:
15675         * heap/CopiedSpace.cpp:
15676         * heap/HandleSet.cpp:
15677         * heap/Heap.cpp:
15678         * heap/HeapStatistics.cpp:
15679         * heap/SlotVisitor.cpp:
15680         * heap/WeakBlock.cpp:
15681         * interpreter/CallFrame.cpp:
15682         * interpreter/CallFrame.h:
15683         * jit/ClosureCallStubRoutine.cpp:
15684         * jit/GCAwareJITStubRoutine.cpp:
15685         * jit/JIT.cpp:
15686         * jit/JITArithmetic.cpp:
15687         * jit/JITArithmetic32_64.cpp:
15688         * jit/JITCall.cpp:
15689         * jit/JITCall32_64.cpp:
15690         * jit/JITCode.h:
15691         * jit/JITExceptions.cpp:
15692         * jit/JITStubs.h:
15693         * jit/JITThunks.h:
15694         * jsc.cpp:
15695         * llint/LLIntExceptions.cpp:
15696         * profiler/LegacyProfiler.cpp:
15697         * profiler/ProfileGenerator.cpp:
15698         * profiler/ProfilerBytecode.cpp:
15699         * profiler/ProfilerBytecodeSequence.cpp:
15700         * profiler/ProfilerBytecodes.cpp:
15701         * profiler/ProfilerCompilation.cpp:
15702         * profiler/ProfilerCompiledBytecode.cpp:
15703         * profiler/ProfilerDatabase.cpp:
15704         * profiler/ProfilerOSRExit.cpp:
15705         * profiler/ProfilerOSRExitSite.cpp:
15706         * profiler/ProfilerOrigin.cpp:
15707         * profiler/ProfilerOriginStack.cpp:
15708         * profiler/ProfilerProfiledBytecodes.cpp:
15709         * runtime/ArgList.cpp:
15710         * runtime/Arguments.cpp:
15711         * runtime/ArrayConstructor.cpp:
15712         * runtime/BooleanConstructor.cpp:
15713         * runtime/BooleanObject.cpp:
15714         * runtime/BooleanPrototype.cpp:
15715         * runtime/CallData.cpp:
15716         * runtime/CodeCache.cpp:
15717         * runtime/Completion.cpp:
15718         * runtime/ConstructData.cpp:
15719         * runtime/DateConstructor.cpp:
15720         * runtime/DateInstance.cpp:
15721         * runtime/DatePrototype.cpp:
15722         * runtime/Error.cpp:
15723         * runtime/ErrorConstructor.cpp:
15724         * runtime/ErrorInstance.cpp:
15725         * runtime/ErrorPrototype.cpp:
15726         * runtime/ExceptionHelpers.cpp:
15727         * runtime/Executable.cpp:
15728         * runtime/FunctionConstructor.cpp:
15729         * runtime/FunctionPrototype.cpp:
15730         * runtime/GetterSetter.cpp:
15731         * runtime/Identifier.cpp:
15732         * runtime/InternalFunction.cpp:
15733         * runtime/JSActivation.cpp:
15734         * runtime/JSBoundFunction.cpp:
15735         * runtime/JSCell.cpp:
15736         * runtime/JSCell.h:
15737         (JSC):
15738         * runtime/JSCellInlines.h: Added.
15739         (JSC):
15740         (JSC::JSCell::JSCell):
15741         (JSC::JSCell::finishCreation):
15742         (JSC::JSCell::structure):
15743         (JSC::JSCell::visitChildren):
15744         (JSC::allocateCell):
15745         (JSC::isZapped):
15746         (JSC::JSCell::isObject):
15747         (JSC::JSCell::isString):
15748         (JSC::JSCell::isGetterSetter):
15749         (JSC::JSCell::isProxy):
15750         (JSC::JSCell::isAPIValueWrapper):
15751         (JSC::JSCell::setStructure):
15752         (JSC::JSCell::methodTable):
15753         (JSC::JSCell::inherits):
15754         (JSC::JSCell::fastGetOwnPropertySlot):
15755         (JSC::JSCell::fastGetOwnProperty):
15756         (JSC::JSCell::toBoolean):
15757         * runtime/JSDateMath.cpp:
15758         * runtime/JSFunction.cpp:
15759         * runtime/JSFunction.h:
15760         (JSC):
15761         * runtime/JSGlobalData.h:
15762         (JSC):
15763         (JSGlobalData):
15764         * runtime/JSGlobalObject.cpp:
15765         * runtime/JSGlobalObjectFunctions.cpp:
15766         * runtime/JSLock.cpp:
15767         * runtime/JSNameScope.cpp:
15768         * runtime/JSNotAnObject.cpp:
15769         * runtime/JSONObject.cpp:
15770         * runtime/JSObject.h:
15771         (JSC):
15772         * runtime/JSProxy.cpp:
15773         * runtime/JSScope.cpp:
15774         * runtime/JSSegmentedVariableObject.cpp:
15775         * runtime/JSString.h:
15776         (JSC):
15777         * runtime/JSStringJoiner.cpp:
15778         * runtime/JSSymbolTableObject.cpp:
15779         * runtime/JSValue.cpp:
15780         * runtime/JSValueInlines.h:
15781         (JSC::JSValue::toInt32):
15782         (JSC::JSValue::toUInt32):
15783         (JSC):
15784         (JSC::JSValue::isUInt32):
15785         (JSC::JSValue::asUInt32):
15786         (JSC::JSValue::asNumber):
15787         (JSC::jsNaN):
15788         (JSC::JSValue::JSValue):
15789         (JSC::JSValue::encode):
15790         (JSC::JSValue::decode):
15791         (JSC::JSValue::operator bool):
15792         (JSC::JSValue::operator==):
15793         (JSC::JSValue::operator!=):
15794         (JSC::JSValue::isEmpty):
15795         (JSC::JSValue::isUndefined):
15796         (JSC::JSValue::isNull):
15797         (JSC::JSValue::isUndefinedOrNull):
15798         (JSC::JSValue::isCell):
15799         (JSC::JSValue::isInt32):
15800         (JSC::JSValue::isDouble):
15801         (JSC::JSValue::isTrue):
15802         (JSC::JSValue::isFalse):
15803         (JSC::JSValue::tag):
15804         (JSC::JSValue::payload):
15805         (JSC::JSValue::asInt32):
15806         (JSC::JSValue::asDouble):
15807         (JSC::JSValue::asCell):
15808         (JSC::JSValue::isNumber):
15809         (JSC::JSValue::isBoolean):
15810         (JSC::JSValue::asBoolean):
15811         (JSC::reinterpretDoubleToInt64):
15812         (JSC::reinterpretInt64ToDouble):
15813         (JSC::JSValue::isString):
15814         (JSC::JSValue::isPrimitive):
15815         (JSC::JSValue::isGetterSetter):
15816         (JSC::JSValue::isObject):
15817         (JSC::JSValue::getString):
15818         (JSC::::getString):
15819         (JSC::JSValue::getObject):
15820         (JSC::JSValue::getUInt32):
15821         (JSC::JSValue::toPrimitive):
15822         (JSC::JSValue::getPrimitiveNumber):
15823         (JSC::JSValue::toNumber):
15824         (JSC::JSValue::toObject):
15825         (JSC::JSValue::isFunction):
15826         (JSC::JSValue::inherits):
15827         (JSC::JSValue::toThisObject):
15828         (JSC::JSValue::get):
15829         (JSC::JSValue::put):
15830         (JSC::JSValue::putByIndex):
15831         (JSC::JSValue::structureOrUndefined):
15832         (JSC::JSValue::equal):
15833         (JSC::JSValue::equalSlowCaseInline):
15834         (JSC::JSValue::strictEqualSlowCaseInline):
15835         (JSC::JSValue::strictEqual):
15836         * runtime/JSVariableObject.cpp:
15837         * runtime/JSWithScope.cpp:
15838         * runtime/JSWrapperObject.cpp:
15839         * runtime/LiteralParser.cpp:
15840         * runtime/Lookup.cpp:
15841         * runtime/NameConstructor.cpp:
15842         * runtime/NameInstance.cpp:
15843         * runtime/NamePrototype.cpp:
15844         * runtime/NativeErrorConstructor.cpp:
15845         * runtime/NativeErrorPrototype.cpp:
15846         * runtime/NumberConstructor.cpp:
15847         * runtime/NumberObject.cpp:
15848         * runtime/ObjectConstructor.cpp:
15849         * runtime/ObjectPrototype.cpp:
15850         * runtime/Operations.h:
15851         (JSC):
15852         * runtime/PropertySlot.cpp:
15853         * runtime/RegExp.cpp:
15854         * runtime/RegExpCache.cpp:
15855         * runtime/RegExpCachedResult.cpp:
15856         * runtime/RegExpConstructor.cpp:
15857         * runtime/RegExpMatchesArray.cpp:
15858         * runtime/RegExpObject.cpp:
15859         * runtime/RegExpPrototype.cpp:
15860         * runtime/SmallStrings.cpp:
15861         * runtime/SparseArrayValueMap.cpp:
15862         * runtime/StrictEvalActivation.cpp:
15863         * runtime/StringConstructor.cpp:
15864         * runtime/StringObject.cpp:
15865         * runtime/StringRecursionChecker.cpp:
15866         * runtime/Structure.h:
15867         (JSC):
15868         * runtime/StructureChain.cpp:
15869         * runtime/TimeoutChecker.cpp:
15870         * testRegExp.cpp:
15871
15872 2013-01-11  Filip Pizlo  <fpizlo@apple.com>
15873
15874         If you use Phantom to force something to be live across an OSR exit, you should put it after the OSR exit
15875         https://bugs.webkit.org/show_bug.cgi?id=106724
15876
15877         Reviewed by Oliver Hunt.
15878
15879         In cases where we were getting it wrong, I think it was benign because we would either already have an
15880         OSR exit prior to there, or the operand would be a constant.  But still, it's good to get this right.
15881
15882         * dfg/DFGByteCodeParser.cpp:
15883         (JSC::DFG::ByteCodeParser::parseBlock):
15884
15885 2013-01-11  Filip Pizlo  <fpizlo@apple.com>
15886
15887         Phantom(GetLocal) should be treated as relevant to OSR
15888         https://bugs.webkit.org/show_bug.cgi?id=106715
15889
15890         Reviewed by Mark Hahnenberg.
15891
15892         * dfg/DFGCSEPhase.cpp:
15893         (JSC::DFG::CSEPhase::performBlockCSE):
15894
15895 2013-01-11  Pratik Solanki  <psolanki@apple.com>
15896
15897         Fix function name typo ProgramExecutable::initalizeGlobalProperties()
15898         https://bugs.webkit.org/show_bug.cgi?id=106701
15899
15900         Reviewed by Geoffrey Garen.
15901
15902         * interpreter/Interpreter.cpp:
15903         (JSC::Interpreter::execute):
15904         * runtime/Executable.cpp:
15905         (JSC::ProgramExecutable::initializeGlobalProperties):
15906         * runtime/Executable.h:
15907
15908 2013-01-11  Mark Hahnenberg  <mhahnenberg@apple.com>
15909
15910         testapi is failing with a block-related error in the Objc API
15911         https://bugs.webkit.org/show_bug.cgi?id=106055
15912
15913         Reviewed by Filip Pizlo.
15914
15915         Same bug as in testapi.mm. We need to actually call the static block, rather than casting the block to a bool.
15916
15917         * API/ObjCCallbackFunction.mm:
15918         (blockSignatureContainsClass):
15919
15920 2013-01-11  Filip Pizlo  <fpizlo@apple.com>
15921
15922         Add a run-time option to print bytecode at DFG compile time
15923         https://bugs.webkit.org/show_bug.cgi?id=106704
15924
15925         Reviewed by Mark Hahnenberg.
15926
15927         * dfg/DFGByteCodeParser.cpp:
15928         (JSC::DFG::ByteCodeParser::parseCodeBlock):
15929         * runtime/Options.h:
15930         (JSC):
15931
15932 2013-01-11  Filip Pizlo  <fpizlo@apple.com>
15933
15934         It should be possible to enable verbose printing of each OSR exit at run-time (rather than compile-time) and it should print register state
15935         https://bugs.webkit.org/show_bug.cgi?id=106700
15936
15937         Reviewed by Mark Hahnenberg.
15938
15939         * dfg/DFGAssemblyHelpers.h:
15940         (DFG):
15941         (JSC::DFG::AssemblyHelpers::debugCall):
15942         * dfg/DFGCommon.h:
15943         * dfg/DFGOSRExit.h:
15944         (DFG):
15945         * dfg/DFGOSRExitCompiler32_64.cpp:
15946         (JSC::DFG::OSRExitCompiler::compileExit):
15947         * dfg/DFGOSRExitCompiler64.cpp:
15948         (JSC::DFG::OSRExitCompiler::compileExit):
15949         * dfg/DFGOperations.cpp:
15950         * dfg/DFGOperations.h:
15951         * runtime/Options.h:
15952         (JSC):
15953
15954 2013-01-11  Geoffrey Garen  <ggaren@apple.com>
15955
15956         Removed getDirectLocation and offsetForLocation and all their uses
15957         https://bugs.webkit.org/show_bug.cgi?id=106692
15958
15959         Reviewed by Filip Pizlo.
15960
15961         getDirectLocation() and its associated offsetForLocation() relied on
15962         detailed knowledge of the rules of PropertyOffset, JSObject, and
15963         Structure, which is a hard thing to reverse-engineer reliably. Luckily,
15964         it wasn't needed, and all clients either wanted a true value or a
15965         PropertyOffset. So, I refactored accordingly.
15966
15967         * dfg/DFGOperations.cpp: Renamed putDirectOffset to putDirect, to clarify
15968         that we are not putting an offset.
15969
15970         * runtime/JSActivation.cpp:
15971         (JSC::JSActivation::getOwnPropertySlot): Get a value instead of a value
15972         pointer, since we never wanted a pointer to begin with.
15973
15974         * runtime/JSFunction.cpp:
15975         (JSC::JSFunction::getOwnPropertySlot): Use a PropertyOffset instead of a pointer,
15976         so we don't have to reverse-engineer the offset from the pointer.
15977
15978         * runtime/JSObject.cpp:
15979         (JSC::JSObject::put):
15980         (JSC::JSObject::resetInheritorID):
15981         (JSC::JSObject::inheritorID):
15982         (JSC::JSObject::removeDirect):
15983         (JSC::JSObject::fillGetterPropertySlot):
15984         (JSC::JSObject::getOwnPropertyDescriptor): Renamed getDirectOffset and
15985         putDirectOffset, as explaind above. We want to use the name "getDirectOffset"
15986         for when the thing you're getting is the offset.
15987
15988         * runtime/JSObject.h:
15989         (JSC::JSObject::getDirect):
15990         (JSC::JSObject::getDirectOffset): Changed getDirectLocation to getDirectOffset,
15991         since clients really wants PropertyOffsets and not locations.
15992
15993         (JSObject::offsetForLocation): Removed this function because it was hard
15994         to get right.
15995
15996         (JSC::JSObject::putDirect):
15997         (JSC::JSObject::putDirectUndefined):
15998         (JSC::JSObject::inlineGetOwnPropertySlot):
15999         (JSC::JSObject::putDirectInternal):
16000         (JSC::JSObject::putDirectWithoutTransition):
16001         * runtime/JSScope.cpp:
16002         (JSC::executeResolveOperations):
16003         (JSC::JSScope::resolvePut):
16004         * runtime/JSValue.cpp:
16005         (JSC::JSValue::putToPrimitive): Updated for renames.
16006
16007         * runtime/Lookup.cpp:
16008         (JSC::setUpStaticFunctionSlot): Use a PropertyOffset instead of a pointer,
16009         so we don't have to reverse-engineer the offset from the pointer.
16010
16011         * runtime/Structure.cpp:
16012         (JSC::Structure::flattenDictionaryStructure): Updated for renames.
16013
16014 2013-01-11  Geoffrey Garen  <ggaren@apple.com>
16015
16016         Removed an unused version of getDirectLocation
16017         https://bugs.webkit.org/show_bug.cgi?id=106691
16018
16019         Reviewed by Gavin Barraclough.
16020
16021         getDirectLocation is a weird operation. Removing the unused version is
16022         the easy part.
16023
16024         * runtime/JSObject.h:
16025         (JSObject):
16026
16027 2013-01-11  Mark Hahnenberg  <mhahnenberg@apple.com>
16028
16029         Objective-C objects that are passed to JavaScript leak (until the JSContext is destroyed)
16030         https://bugs.webkit.org/show_bug.cgi?id=106056
16031
16032         Reviewed by Darin Adler.
16033
16034         * API/APIJSValue.h:
16035         * API/JSValue.mm: Make the reference to the JSContext strong.
16036         (-[JSValue context]):
16037         (-[JSValue initWithValue:inContext:]):
16038         (-[JSValue dealloc]):
16039         * API/JSWrapperMap.mm: Make the reference back from wrappers to Obj-C objects weak instead of strong.
16040         Also add an explicit WeakGCMap in the JSWrapperMap rather than using Obj-C associated object API which
16041         was causing memory leaks.
16042         (wrapperClass):
16043         (-[JSObjCClassInfo wrapperForObject:]):
16044         (-[JSWrapperMap initWithContext:]):
16045         (-[JSWrapperMap dealloc]):
16046         (-[JSWrapperMap wrapperForObject:]):
16047
16048 2013-01-11  Geoffrey Garen  <ggaren@apple.com>
16049
16050         Fixed some bogus PropertyOffset ASSERTs
16051         https://bugs.webkit.org/show_bug.cgi?id=106686
16052
16053         Reviewed by Gavin Barraclough.
16054
16055         The ASSERTs were passing a JSType instead of an inlineCapacity, due to
16056         an incomplete refactoring.
16057
16058         The compiler didn't catch this because both types are int underneath.
16059
16060         * runtime/JSObject.h:
16061         (JSC::JSObject::getDirect):
16062         (JSC::JSObject::getDirectLocation):
16063         (JSC::JSObject::offsetForLocation):
16064         * runtime/Structure.cpp:
16065         (JSC::Structure::addPropertyTransitionToExistingStructure): Validate against
16066         our inline capacity, as we intended.
16067
16068 2013-01-11  Geoffrey Garen  <ggaren@apple.com>
16069
16070         Rename propertyOffsetFor => offsetForPropertyNumber
16071         https://bugs.webkit.org/show_bug.cgi?id=106685
16072
16073         Reviewed by Gavin Barraclough.
16074
16075         Since the argument is just a typedef and not an object, I wanted to clarify the meaning.
16076
16077         * runtime/PropertyMapHashTable.h:
16078         (JSC::PropertyTable::nextOffset): Updated for rename.
16079
16080         * runtime/PropertyOffset.h:
16081         (JSC::offsetForPropertyNumber): Renamed. Also changed some PropertyOffset variables
16082         to plain ints, because they're not actually on the PropertyOffsets number line.
16083
16084         * runtime/Structure.cpp:
16085         (JSC::Structure::flattenDictionaryStructure):
16086         * runtime/Structure.h:
16087         (JSC::Structure::lastValidOffset): Updated for rename.
16088
16089 2013-01-10  Zan Dobersek  <zandobersek@gmail.com>
16090
16091         Remove the ENABLE_ANIMATION_API feature define occurences
16092         https://bugs.webkit.org/show_bug.cgi?id=106544
16093
16094         Reviewed by Simon Fraser.
16095
16096         The Animation API code was removed in r137243. The ENABLE_ANIMATION_API
16097         feature define handling still lingers in various build systems and configurations
16098         but is of no use, so it should be removed.
16099
16100         * Configurations/FeatureDefines.xcconfig:
16101
16102 2013-01-09  Roger Fong  <roger_fong@apple.com>
16103
16104         Unreviewed. Just move the JavaScriptCore exports file around in the vcproj to make things clearer.
16105
16106         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
16107
16108 2013-01-09  Filip Pizlo  <fpizlo@apple.com>
16109
16110         Dont use a node reference after appending to the graph.
16111         https://bugs.webkit.org/show_bug.cgi?id=103305
16112         <rdar://problem/12753096>
16113
16114         Reviewed by Mark Hahnenberg.
16115
16116         * dfg/DFGArgumentsSimplificationPhase.cpp:
16117         (JSC::DFG::ArgumentsSimplificationPhase::run):
16118
16119 2013-01-09  Roger Fong  <roger_fong@apple.com>
16120
16121         Rename export files to make them more easily findable.
16122         https://bugs.webkit.org/show_bug.cgi?id=98695.
16123
16124         Reviewed by Timothy Horton.
16125
16126         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Removed.
16127         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
16128         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
16129         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def: Copied from Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def.
16130
16131 2013-01-09  Carlos Garcia Campos  <cgarcia@igalia.com>
16132
16133         Unreviewed. Fix make distcheck.
16134
16135         * GNUmakefile.list.am: Add mips.rb to offlineasm_nosources.
16136
16137 2013-01-08  Oliver Hunt  <oliver@apple.com>
16138
16139         Support op_typeof in the DFG
16140         https://bugs.webkit.org/show_bug.cgi?id=98898
16141
16142         Reviewed by Filip Pizlo.
16143
16144         Adds a TypeOf node to the DFG to support op_typeof.
16145
16146         To avoid adding too much GC horror, this also makes the
16147         common strings portion of the SmallString cache strongly
16148         referenced.
16149
16150         * dfg/DFGAbstractState.cpp:
16151         (JSC::DFG::AbstractState::execute):
16152           We try to determine the result early here, and substitute in a constant.
16153           Otherwise we leave the node intact, and set the result type to SpecString.
16154         * dfg/DFGByteCodeParser.cpp:
16155         (JSC::DFG::ByteCodeParser::parseBlock):
16156           Parse op_typeof
16157         * dfg/DFGCSEPhase.cpp:
16158         (JSC::DFG::CSEPhase::performNodeCSE):
16159           TypeOf nodes can be subjected to pure CSE
16160         * dfg/DFGCapabilities.h:
16161         (JSC::DFG::canCompileOpcode):
16162           We can handle typeof.
16163         * dfg/DFGNodeType.h:
16164         (DFG):
16165           Define the node.
16166         * dfg/DFGOperations.cpp:
16167         * dfg/DFGOperations.h:
16168           Add operationTypeOf to support the non-trivial cases.
16169         * dfg/DFGPredictionPropagationPhase.cpp:
16170         (JSC::DFG::PredictionPropagationPhase::propagate):
16171         * dfg/DFGSpeculativeJIT32_64.cpp:
16172         (JSC::DFG::SpeculativeJIT::compile):
16173         * dfg/DFGSpeculativeJIT64.cpp:
16174         (JSC::DFG::SpeculativeJIT::compile):
16175           Actual codegen
16176         * runtime/Operations.cpp:
16177         (JSC::jsTypeStringForValue):
16178         (JSC):
16179         * runtime/Operations.h:
16180         (JSC):
16181           Some refactoring to allow us to get the type string for an
16182           object without needing a callframe.
16183
16184
16185 2013-01-08  Filip Pizlo  <fpizlo@apple.com>
16186
16187         DFG shouldn't treat the 'this' argument as being captured if a code block uses arguments
16188         https://bugs.webkit.org/show_bug.cgi?id=106398
16189         <rdar://problem/12439776>
16190
16191         Reviewed by Mark Hahnenberg.
16192
16193         This is a possible optimization for inlined calls, and fixes crashes for inlined constructors, in the case
16194         that the inlined code used arguments. The problem was that assuming that 'this' was captured implies the
16195         assumption that it was initialized by the caller, which is wrong for constructors and this.
16196
16197         Also added a pretty essential DFG IR validation rule: we shouldn't have any live locals at the top of the
16198         root block. This helps to catch this bug: our assumption that 'this' was captured in an inlined constructor
16199         that used arguments led to liveness for the temporary that would have held 'this' in the caller being
16200         propagated all the way up to the entrypoint of the function.
16201
16202         * bytecode/CodeBlock.h:
16203         (JSC::CodeBlock::isCaptured):
16204         * dfg/DFGValidate.cpp:
16205         (JSC::DFG::Validate::validate):
16206         (JSC::DFG::Validate::reportValidationContext):
16207         (Validate):
16208         (JSC::DFG::Validate::dumpGraphIfAppropriate):
16209
16210 2013-01-08  Filip Pizlo  <fpizlo@apple.com>
16211
16212         REGRESSION (r138921): Crash in JSC::Arguments::create
16213         https://bugs.webkit.org/show_bug.cgi?id=106329
16214         <rdar://problem/12974196>
16215
16216         Reviewed by Mark Hahnenberg.
16217
16218         Arguments::finishCreation() that takes an InlineCallFrame* needs to understand that the callee can
16219         be unset, indicating that the callee needs to be loaded from the true call frame. This adds a
16220         method to InlineCallFrame to do just that.
16221
16222         * bytecode/CodeOrigin.cpp:
16223         (JSC::InlineCallFrame::calleeForCallFrame):
16224         * bytecode/CodeOrigin.h:
16225         (InlineCallFrame):
16226         * runtime/Arguments.h:
16227         (JSC::Arguments::finishCreation):
16228
16229 2013-01-08  Filip Pizlo  <fpizlo@apple.com>
16230
16231         DFG initrinsic handling should ensure that we backwards propagate the fact that all operands may escape
16232         https://bugs.webkit.org/show_bug.cgi?id=106365
16233
16234         Reviewed by Mark Hahnenberg.
16235
16236         Use the fact that Phantom means that things escaped, and just insert Phantoms for all
16237         of the operands.
16238
16239         * dfg/DFGByteCodeParser.cpp:
16240         (JSC::DFG::ByteCodeParser::handleCall):
16241
16242 2013-01-08  Filip Pizlo  <fpizlo@apple.com>
16243
16244         If array allocation profiling causes a new_array to allocate double arrays, then the holes should end up being correctly initialized
16245         https://bugs.webkit.org/show_bug.cgi?id=106363
16246
16247         Reviewed by Mark Hahnenberg.
16248
16249         * runtime/JSArray.h:
16250         (JSC::JSArray::tryCreateUninitialized):
16251
16252 2013-01-07  Filip Pizlo  <fpizlo@apple.com>
16253
16254         DFG should backwards-propagate NodeUsedAsValue for Phantom
16255         https://bugs.webkit.org/show_bug.cgi?id=106299
16256
16257         Reviewed by Mark Hahnenberg.
16258
16259         This is currently benign because Phantom is only inserted by the bytecode parser for
16260         things that already happen to be used in contexts that backwards propagate
16261         NodeUsedAsValue. But that doesn't change the fact that the semantics of Phantom are
16262         that the value can be arbitrarily used by the baseline JIT.
16263
16264         * dfg/DFGPredictionPropagationPhase.cpp:
16265         (JSC::DFG::PredictionPropagationPhase::propagate):
16266
16267 2013-01-07  Filip Pizlo  <fpizlo@apple.com>
16268
16269         Rationalize closure call heuristics and profiling
16270         https://bugs.webkit.org/show_bug.cgi?id=106270
16271
16272         Reviewed by Oliver Hunt.
16273
16274         Did a number of things:
16275
16276         - CallLinkInfo now remembers if it was ever a closure call, and CallLinkStatus uses
16277           this. Reduces the likelihood that we will inline a closure call as if it was a
16278           normal call.
16279
16280         - Made InlineCallFrame print inferred function names, and refactored
16281           CodeBlock::inferredName() to better use FunctionExecutable's API.
16282
16283         - Made bytecode dumping print frequent exit sites that led to recompilation.
16284
16285         - Made bytecode dumping for op_call and op_construct print what the CallLinkStatus
16286           saw.
16287
16288         * bytecode/CallLinkInfo.h:
16289         (JSC::CallLinkInfo::CallLinkInfo):
16290         (CallLinkInfo):
16291         * bytecode/CallLinkStatus.cpp:
16292         (JSC::CallLinkStatus::computeFor):
16293         * bytecode/CodeBlock.cpp:
16294         (JSC::CodeBlock::inferredName):
16295         (JSC::CodeBlock::dumpBytecodeCommentAndNewLine):
16296         (JSC::CodeBlock::printCallOp):
16297         * bytecode/CodeOrigin.cpp:
16298         (JSC::CodeOrigin::dump):
16299         (JSC::InlineCallFrame::inferredName):
16300         (JSC):
16301         (JSC::InlineCallFrame::dumpBriefFunctionInformation):
16302         (JSC::InlineCallFrame::dump):
16303         * bytecode/CodeOrigin.h:
16304         (InlineCallFrame):
16305         * bytecode/DFGExitProfile.cpp:
16306         (JSC::DFG::ExitProfile::exitSitesFor):
16307         (DFG):
16308         * bytecode/DFGExitProfile.h:
16309         (ExitProfile):
16310         * jit/JITStubs.cpp:
16311         (JSC::DEFINE_STUB_FUNCTION):
16312
16313 2013-01-07  Ryosuke Niwa  <rniwa@webkit.org>
16314
16315         Sorted the xcodeproj file.
16316
16317         * JavaScriptCore.xcodeproj/project.pbxproj:
16318
16319 2013-01-07  Filip Pizlo  <fpizlo@apple.com>
16320
16321         Unreviewed, it should be possible to build JSC on ARM.
16322
16323         * API/JSBase.h:
16324         * jit/JITStubs.cpp:
16325         (JSC::performPlatformSpecificJITAssertions):
16326         (JSC):
16327         * jit/JITStubs.h:
16328         (JSC):
16329         * jit/JITThunks.cpp:
16330         (JSC::JITThunks::JITThunks):
16331         * jit/JITThunks.h:
16332         (JITThunks):
16333         * offlineasm/armv7.rb:
16334         * runtime/JSGlobalData.cpp:
16335         (JSC::JSGlobalData::JSGlobalData):
16336
16337 2013-01-07  Balazs Kilvady  <kilvadyb@homejinni.com>
16338
16339         MIPS LLInt implementation.
16340         https://bugs.webkit.org/show_bug.cgi?id=99706
16341
16342         Reviewed by Filip Pizlo.
16343
16344         LLInt implementation for MIPS.
16345
16346         * assembler/MacroAssemblerMIPS.h:
16347         (JSC::MacroAssemblerMIPS::jump):
16348         * dfg/DFGOperations.cpp:
16349         (JSC):
16350         * jit/JITStubs.cpp:
16351         (JSC):
16352         * jit/JITStubs.h:
16353         (JITStackFrame):
16354         * llint/LLIntOfflineAsmConfig.h:
16355         * llint/LowLevelInterpreter.asm:
16356         * llint/LowLevelInterpreter32_64.asm:
16357         * offlineasm/backends.rb:
16358         * offlineasm/instructions.rb:
16359         * offlineasm/mips.rb: Added.
16360
16361 2013-01-07  Mark Hahnenberg  <mhahnenberg@apple.com>
16362
16363         testapi is failing with a block-related error in the Objc API
16364         https://bugs.webkit.org/show_bug.cgi?id=106055
16365
16366         Reviewed by Geoffrey Garen.
16367
16368         Casting a block to a bool will always return true, which isn't the behavior that is intended here.
16369         Instead we need to call the block, but C semantics don't allow this, so we need to change
16370         testapi.m to be Objective-C++ and therefore testapi.mm.
16371
16372         * API/tests/testapi.m: Removed.
16373         * API/tests/testapi.mm: Copied from Source/JavaScriptCore/API/tests/testapi.m.
16374         (blockSignatureContainsClass):
16375         * JavaScriptCore.xcodeproj/project.pbxproj:
16376
16377 2013-01-06  Filip Pizlo  <fpizlo@apple.com>
16378
16379         Simplify slow case profiling
16380         https://bugs.webkit.org/show_bug.cgi?id=106208
16381
16382         Reviewed by Mark Rowe.
16383
16384         Removing the minimum execution ratio portion of slow case profiling, which allows
16385         the removal of a field from CodeBlock. This appears to be performance neutral,
16386         implying that the complexity incurred by the previous heuristic was purely
16387         harmful: it made the code more complicated, and it made CodeBlock larger, without
16388         resulting in any measurable benefits.
16389
16390         * bytecode/CodeBlock.cpp:
16391         (JSC::CodeBlock::CodeBlock):
16392         * bytecode/CodeBlock.h:
16393         (JSC::CodeBlock::likelyToTakeSlowCase):
16394         (JSC::CodeBlock::couldTakeSlowCase):
16395         (JSC::CodeBlock::likelyToTakeSpecialFastCase):
16396         (JSC::CodeBlock::couldTakeSpecialFastCase):
16397         (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
16398         (JSC::CodeBlock::likelyToTakeAnySlowCase):
16399         * jit/JIT.cpp:
16400         (JSC::JIT::privateCompile):
16401         * runtime/Options.h:
16402
16403 2013-01-05  Filip Pizlo  <fpizlo@apple.com>
16404
16405         DFG should inline closure calls
16406         https://bugs.webkit.org/show_bug.cgi?id=106067
16407
16408         Reviewed by Gavin Barraclough.
16409
16410         This adds initial support for inlining closure calls to the DFG. A call is considered
16411         to be a closure call when the JSFunction* varies, but always has the same executable.
16412         We already have closure call inline caching in both JITs, which works by checking that
16413         the callee has an expected structure (as a cheap way of detecting that it is in fact
16414         a JSFunction) and an expected executable. Closure call inlining uses profiling data
16415         aggregated by CallLinkStatus to decide when to specialize the call to the particular
16416         structure/executable, and inline the call rather than emitting a call sequence. When
16417         we choose to do a closure inline rather than an ordinary inline, a number of things
16418         change about how inlining is performed:
16419
16420         - The inline is guarded by a CheckStructure/CheckExecutable rather than a
16421           CheckFunction.
16422
16423         - Instead of propagating a constant value for the scope, we emit GetMyScope every time
16424           that the scope is needed, which loads the scope from a local variable. We do similar
16425           things for the callee.
16426
16427         - The prologue of the inlined code includes SetMyScope and SetCallee nodes to eagerly
16428           plant the scope and callee into the "true call frame", i.e. the place on the stack
16429           where the call frame would have been if the call had been actually performed. This
16430           allows GetMyScope/GetCallee to work as they would if the code wasn't inlined. It
16431           also allows for trivial handling of scope and callee for call frame reconstruction
16432           upon stack introspection and during OSR.
16433
16434         - A new node called GetScope is introduced, which just gets the scope of a function.
16435           This node has the expected CSE support. This allows for the
16436           SetMyScope(GetScope(@function)) sequence to set up the scope in the true call frame.
16437
16438         - GetMyScope/GetCallee CSE can match against SetMyScope/SetCallee, which means that
16439           the GetMyScope/GetCallee nodes emitted during parsing are often removed during CSE,
16440           if we can prove that it is safe to do so.
16441
16442         - Inlining heuristics are adjusted to grok the cost of inlining a closure. We are
16443           less likely to inline a closure call than we are to inline a normal call, since we
16444           end up emitting more code for closures due to CheckStructure, CheckExecutable,
16445           GetScope, SetMyScope, and SetCallee.
16446
16447         Additionally, I've fixed the VariableEventStream to ensure that we don't attempt to
16448         plant Undefined into the true call frames. This was previously a harmless oversight,
16449         but it becomes quite bad if OSR is relying on the scope/callee already having been
16450         set and not subsequently clobbered by the OSR itself.
16451
16452         This is a ~60% speed-up on programs that frequently make calls to closures. It's
16453         neutral on V8v7 and other major benchmark suites.
16454
16455         The lack of a definite speed-up is likely due the fact that closure inlining currently
16456         does not do any cardinality [1] optimizations. We don't observe when a closure was
16457         constructed within its caller, and so used the scope from its caller; and furthermore
16458         we have no facility to detect when the scope is single. All scoped variable accesses
16459         are assumed to be multiple instead. A subsequent step will be to ensure that closure
16460         call inlining will be single and loving it.
16461
16462         [1] Single and loving it: Must-alias analysis for higher-order languages. Suresh
16463             Jagannathan, Peter Thiemann, Stephen Weeks, and Andrew Wright. In POPL '98.
16464
16465         * bytecode/CallLinkStatus.cpp:
16466         (JSC::CallLinkStatus::dump):
16467         * bytecode/CallLinkStatus.h:
16468         (JSC::CallLinkStatus::isClosureCall):
16469         (CallLinkStatus):
16470         * bytecode/CodeBlock.cpp:
16471         (JSC::CodeBlock::globalObjectFor):
16472         (JSC):
16473         * bytecode/CodeBlock.h:
16474         (CodeBlock):
16475         * bytecode/CodeOrigin.cpp:
16476         (JSC::InlineCallFrame::dump):
16477         * dfg/DFGAbstractState.cpp:
16478         (JSC::DFG::AbstractState::execute):
16479         * dfg/DFGByteCodeParser.cpp:
16480         (ByteCodeParser):
16481         (JSC::DFG::ByteCodeParser::handleCall):
16482         (JSC::DFG::ByteCodeParser::emitFunctionChecks):
16483         (JSC::DFG::ByteCodeParser::handleInlining):
16484         * dfg/DFGCSEPhase.cpp:
16485         (JSC::DFG::CSEPhase::pureCSE):
16486         (CSEPhase):
16487         (JSC::DFG::CSEPhase::getCalleeLoadElimination):
16488         (JSC::DFG::CSEPhase::checkExecutableElimination):
16489         (JSC::DFG::CSEPhase::getMyScopeLoadElimination):
16490         (JSC::DFG::CSEPhase::performNodeCSE):
16491         * dfg/DFGCapabilities.cpp:
16492         (JSC::DFG::mightInlineFunctionForClosureCall):
16493         * dfg/DFGCapabilities.h:
16494         (DFG):
16495         (JSC::DFG::mightInlineFunctionForClosureCall):
16496         (JSC::DFG::canInlineFunctionForClosureCall):
16497         (JSC::DFG::canInlineFunctionFor):
16498         * dfg/DFGNode.h:
16499         (Node):
16500         (JSC::DFG::Node::hasExecutable):
16501         (JSC::DFG::Node::executable):
16502         * dfg/DFGNodeType.h:
16503         (DFG):
16504         * dfg/DFGPredictionPropagationPhase.cpp:
16505         (JSC::DFG::PredictionPropagationPhase::propagate):
16506         * dfg/DFGSpeculativeJIT32_64.cpp:
16507         (JSC::DFG::SpeculativeJIT::compile):
16508         * dfg/DFGSpeculativeJIT64.cpp:
16509         (JSC::DFG::SpeculativeJIT::compile):
16510         * dfg/DFGVariableEventStream.cpp:
16511         (JSC::DFG::VariableEventStream::reconstruct):
16512         * runtime/Options.h:
16513         (JSC):
16514
16515 2013-01-05  Filip Pizlo  <fpizlo@apple.com>
16516
16517         Data flow paths that carry non-numbers, non-undefined, non-null values should not cause subtractions and arithmetic additions (i.e. ++) to speculate double
16518         https://bugs.webkit.org/show_bug.cgi?id=106190
16519
16520         Reviewed by Sam Weinig.
16521
16522         The problem is that the DFG logic for deciding when to speculate integer was
16523         confusing the special case of ValueAdd (where non-numeric values should cause us
16524         to not speculate integer, because we want to fall off into the generic case) with
16525         the more normal case of ArithAdd and ArithSub (where we want to speculate integer
16526         unless we have evidence that the operands are doubles, since the DFG doesn't have
16527         generic handling of non-numeric arithmetic). Prior to this change doing a - b where
16528         either a or b were possibly non-numeric would always force the subtraction to be
16529         done using doubles.
16530
16531         * dfg/DFGGraph.h:
16532         (JSC::DFG::Graph::addSpeculationMode):
16533         (Graph):
16534         (JSC::DFG::Graph::valueAddSpeculationMode):
16535         (JSC::DFG::Graph::arithAddSpeculationMode):
16536         (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
16537
16538 2013-01-04  Filip Pizlo  <fpizlo@apple.com>
16539
16540         DFG should trust array profiling over value profiling
16541         https://bugs.webkit.org/show_bug.cgi?id=106155
16542
16543         Reviewed by Gavin Barraclough.
16544
16545         The real problem is that prediction propagation is not flow-sensitive. We had code
16546         like:
16547
16548         var a = (some load from memory); // returns either an array or false
16549         if (a)
16550             a[i] = v;
16551
16552         Because 'a' could be 'false', we were emitting a fully generic unoptimized PutByVal.
16553         This patch changes ArrayMode to ignore the type of the base of an array access, if
16554         array profiling tells us that the array access can be optimized.
16555
16556         In the future, we could probably make this work even better with some flow
16557         sensitivity in the prediction propagator, but I also tend to think that this is a
16558         more robust overall solution. If we ever did want to support array accesses on
16559         array-or-false then we should change the array profiler to be able to tell us that
16560         this is what is going on.
16561
16562         3.7% speed-up on V8/earley.
16563
16564         * dfg/DFGArrayMode.cpp:
16565         (JSC::DFG::ArrayMode::refine):
16566
16567 2013-01-04  Filip Pizlo  <fpizlo@apple.com>
16568
16569         Rationalize exit site profiling for calls
16570         https://bugs.webkit.org/show_bug.cgi?id=106150
16571
16572         Reviewed by Sam Weinig.
16573
16574         This adds two new exit kinds for calls: BadFunction and BadExecutable. The latter is not used
16575         yet, but is already integrated with profiling. CheckFunction uses a BadFunction speculation
16576         instead of BadCache, now. This allows CallLinkStatus to turn itself into a closure call status
16577         if we had a BadFunction exit site but the CallLinkInfo told us to use a non-closure call. This
16578         might happen if we had call unlinking that led to information loss along the way.
16579
16580         No performance impact. This is meant as another step towards inlining closure calls.
16581
16582         * bytecode/CallLinkStatus.cpp:
16583         * bytecode/CallLinkStatus.h:
16584         (JSC::CallLinkStatus::setIsProved):
16585         (JSC::CallLinkStatus::setHasBadFunctionExitSite):
16586         (CallLinkStatus):
16587         (JSC::CallLinkStatus::setHasBadCacheExitSite):
16588         (JSC::CallLinkStatus::setHasBadExecutableExitSite):
16589         * bytecode/ExitKind.cpp:
16590         (JSC::exitKindToString):
16591         * bytecode/ExitKind.h:
16592         * dfg/DFGByteCodeParser.cpp:
16593         (JSC::DFG::ByteCodeParser::handleCall):
16594         * dfg/DFGSpeculativeJIT32_64.cpp:
16595         (JSC::DFG::SpeculativeJIT::compile):
16596         * dfg/DFGSpeculativeJIT64.cpp:
16597         (JSC::DFG::SpeculativeJIT::compile):
16598
16599 2013-01-03  Filip Pizlo  <fpizlo@apple.com>
16600
16601         DFG should not elide CheckStructure if it's needed to perform a cell check
16602         https://bugs.webkit.org/show_bug.cgi?id=106074
16603
16604         Reviewed by Ryosuke Niwa.
16605
16606         The problem here was that the constant folding phase was misinterpreting the meaning of the sets
16607         in DFG::AbstractValue.  AbstractValue describes a constraint on the values that a variable (i.e.
16608         a DFG Node, or a virtual register, i.e. local or argument) may have. It does so by containing
16609         four sets: the set of JSValues (either empty, the singleton set containing one JSValue, or the
16610         set of all JSValues); the set of "current known" structures, i.e. the set of structures that you
16611         already know that this value may have right now (also either empty, the singleton set, or the set
16612         of all structures); the set of "future possible" structures, i.e. the set of structures that this
16613         value could have in the future if none of the structure transition watchpoints for those
16614         structures had fired (also empty, singleton, or all); and the set of types, which is a
16615         SpeculatedType bitmask. The correct way to interpret the sets is to think of the AbstractValue as
16616         the intersection of these three sets of values:
16617
16618         - The set of JSValues that have a type that belongs to the m_type set.
16619         - If m_value is not the empty value then: the set of all JSValues that are == m_value;
16620                                             else: the set of all JSValues.
16621           where '==' is as defined by JSValue::operator==.
16622         - Union of { the set of all cells that have a structure that belongs to m_currentKnownStructure }
16623                and { the set of all JSValues that are not cells }.
16624
16625         You can then further intersect this set with the following set, if you guard the code with
16626         watchpoints on all structures in the m_futurePossibleStructure:
16627
16628         - Union of { the set of all cells that have a structure that belongs to m_futurePossibleStructure }
16629                and { the set of all JSValues that are not cells }.
16630
16631         One way to think of this is that m_currentKnownStructure is filtered by m_futurePossibleStructure
16632         (i.e. is set to the intersection of m_currentKnownStructure and m_futurePossibleStructure), if the
16633         code for which you're doing this is always preceded by watchpoints on all structures in
16634         m_futurePossibleStructure, and is always before any side-effects that could change the structures
16635         of objects.
16636
16637         The incorrect optimization related to CheckStructure. CheckStructure checks that the value is a
16638         cell, and that it has a particular structure. It was incorrectly assuming that you could eliminate
16639         the CheckStructure, if m_currentKnownStructure contained the structure that CheckStructure was
16640         checking. But this is not the case, since m_currentKnownStructure does not prove that the value is
16641         a cell with a particular structure; it only proves that if the value was a cell then it would have
16642         a particular structure. Hence, to eliminate CheckStructure, it is also necessary to check that
16643         AbstractValue::m_type contains only cells (i.e. isCellSpeculation(m_type) == true).
16644
16645         It wasn't doing that, and this changes makes sure that it does do that.
16646
16647         * dfg/DFGConstantFoldingPhase.cpp:
16648         (JSC::DFG::ConstantFoldingPhase::foldConstants):
16649
16650 2013-01-04  Adam Klein  <adamk@chromium.org>
16651
16652         Remove ENABLE_MUTATION_OBSERVERS #define
16653         https://bugs.webkit.org/show_bug.cgi?id=105459
16654
16655         Reviewed by Ryosuke Niwa.
16656
16657         * Configurations/FeatureDefines.xcconfig:
16658
16659 2013-01-03  Filip Pizlo  <fpizlo@apple.com>
16660
16661         DFG::ByteCodeCache serves little or no purpose ever since we decided to keep bytecode around permanently
16662         https://bugs.webkit.org/show_bug.cgi?id=106058
16663
16664         Reviewed by Michael Saboff.
16665
16666         All baseline code blocks now always have bytecode, so the bytecode cache's ability to minimize the
16667         number of times that the DFG produces bytecode sequences for code blocks is superfluous.
16668
16669         * GNUmakefile.list.am:
16670         * JavaScriptCore.xcodeproj/project.pbxproj:
16671         * dfg/DFGByteCodeCache.h: Removed.
16672         * dfg/DFGByteCodeParser.cpp:
16673         (ByteCodeParser):
16674         (JSC::DFG::ByteCodeParser::handleInlining):
16675         * runtime/Executable.cpp:
16676         (JSC):
16677         * runtime/Executable.h:
16678         (FunctionExecutable):
16679
16680 2013-01-03  Filip Pizlo  <fpizlo@apple.com>
16681
16682         Unreviewed, fix build for DFG JIT disabled.
16683
16684         * bytecode/CodeBlock.cpp:
16685         (JSC::CodeBlock::dumpValueProfiling):
16686         (JSC::CodeBlock::dumpArrayProfiling):
16687         * runtime/Executable.cpp:
16688         (JSC):
16689         (JSC::ExecutableBase::intrinsic):
16690
16691 2013-01-03  Filip Pizlo  <fpizlo@apple.com>
16692
16693         CallLinkStatus should be aware of closure calls, and the DFG bytecode parser should use that as its sole internal notion of how to optimize calls
16694         https://bugs.webkit.org/show_bug.cgi?id=106027
16695
16696         Reviewed by Mark Hahnenberg.
16697
16698         Previously, the DFG bytecode parser had its own internal notion of exactly what CallLinkStatus was
16699         meant to do, in the form of a CallType, expectedFunction, intrinsic, etc. This change makes CallLinkStatus
16700         smart enough to do all of that, and also gives it the ability to understand closure calls.
16701
16702         * bytecode/CallLinkStatus.cpp:
16703         (JSC::CallLinkStatus::CallLinkStatus):
16704         (JSC):
16705         (JSC::CallLinkStatus::function):
16706         (JSC::CallLinkStatus::internalFunction):
16707         (JSC::CallLinkStatus::intrinsicFor):
16708         (JSC::CallLinkStatus::setIsProved):
16709         (JSC::CallLinkStatus::computeFromLLInt):
16710         (JSC::CallLinkStatus::computeFor):
16711         (JSC::CallLinkStatus::dump):
16712         * bytecode/CallLinkStatus.h:
16713         (JSC):
16714         (JSC::CallLinkStatus::CallLinkStatus):
16715         (CallLinkStatus):
16716         (JSC::CallLinkStatus::takesSlowPath):
16717         (JSC::CallLinkStatus::isSet):
16718         (JSC::CallLinkStatus::isClosureCall):
16719         (JSC::CallLinkStatus::callTarget):
16720         (JSC::CallLinkStatus::executable):
16721         (JSC::CallLinkStatus::structure):
16722         (JSC::CallLinkStatus::isProved):
16723         (JSC::CallLinkStatus::canOptimize):
16724         * dfg/DFGByteCodeParser.cpp:
16725         (JSC::DFG::ByteCodeParser::handleCall):
16726         * dfg/DFGGraph.h:
16727         (JSC::DFG::Graph::valueOfFunctionConstant):
16728
16729 2013-01-02  Simon Hausmann  <simon.hausmann@digia.com>
16730
16731         [MinGW-w64] Centralize workaround for pow() implementation
16732         https://bugs.webkit.org/show_bug.cgi?id=105925
16733
16734         Reviewed by Sam Weinig.
16735
16736         As suggested by Sam, move the MinGW-w64 workaround into MathExtras.h
16737         away from the JSC usage.
16738
16739         * runtime/MathObject.cpp:
16740         (JSC::mathPow):
16741
16742 2013-01-02  Gavin Barraclough  <barraclough@apple.com>
16743
16744         Objective-C API for JavaScriptCore
16745         https://bugs.webkit.org/show_bug.cgi?id=105889
16746
16747         Reviewed by Geoff Garen.
16748
16749         Fixes for more issues raised by Darin.
16750
16751         * API/JSBlockAdaptor.mm:
16752         (BlockArgument):
16753         (BlockArgumentStruct::BlockArgumentStruct):
16754         (BlockArgumentTypeDelegate::typeStruct):
16755         (BlockResult):
16756         (BlockResultStruct::BlockResultStruct):
16757         (buildBlockSignature):
16758         (-[JSBlockAdaptor initWithBlockSignatureFromProtocol:]):
16759         (-[JSBlockAdaptor blockFromValue:inContext:withException:]):
16760             - fix * position for Objective-C types
16761         * API/JSContext.h:
16762             - fix * position for Objective-C types
16763         * API/JSContext.mm:
16764         (-[JSContext initWithVirtualMachine:]):
16765         (-[JSContext virtualMachine]):
16766         (contextInternalContext):
16767             - fix * position for Objective-C types
16768         (-[JSContext dealloc]):
16769         (-[JSContext protect:]):
16770         (-[JSContext unprotect:]):
16771             - HashMap<JSValueRef, size_t> -> HashCountedSet<JSValueRef>
16772         * API/JSContextInternal.h:
16773         (WeakContextRef):
16774             - fix * position for Objective-C types
16775         * API/JSValue.mm:
16776         (valueToString):
16777             - fix * position for Objective-C types
16778         (isNSBoolean):
16779             - Added helper to check for booleans.
16780         (objectToValueWithoutCopy):
16781             - Added contextRef
16782             - fix * position for Objective-C types
16783             - Remove @YES, @NO literal usage, use isNSBoolean instead
16784         (objectToValue):
16785             - Added contextRef
16786         (+[JSValue valueWithValue:inContext:]):
16787         (-[JSValue initWithValue:inContext:]):
16788             - fix * position for Objective-C types
16789         (createStructHandlerMap):
16790         (handerForStructTag):
16791             - getStructTagHandler -> handerForStructTag
16792             - Split out createStructHandlerMap
16793             - strncmp -> memcmp
16794             - String(type).impl() -> StringImpl::create(type)
16795         (+[JSValue selectorForStructToValue:]):
16796         (+[JSValue selectorForValueToStruct:]):
16797             - getStructTagHandler -> handerForStructTag
16798         (typeToValueInvocationFor):
16799         (valueToTypeInvocationFor):
16800             - fix * position for Objective-C types
16801         * API/JSValueInternal.h:
16802             - fix * position for Objective-C types
16803         * API/JSVirtualMachineInternal.h:
16804             - fix * position for Objective-C types
16805         * API/JSWrapperMap.h:
16806             - fix * position for Objective-C types
16807         * API/JSWrapperMap.mm:
16808         (selectorToPropertyName):
16809         (createObjectWithCustomBrand):
16810         (createRenameMap):
16811         (putNonEnumerable):
16812         (copyMethodsToObject):
16813         (copyPrototypeProperties):
16814         (-[JSObjCClassInfo initWithContext:forClass:superClassInfo:]):
16815         (-[JSWrapperMap initWithContext:]):
16816         (-[JSWrapperMap wrapperForObject:]):
16817         (getJSExportProtocol):
16818             - fix * position for Objective-C types
16819         * API/ObjCCallbackFunction.h:
16820             - fix * position for Objective-C types
16821         * API/ObjCCallbackFunction.mm:
16822         (CallbackArgument):
16823         (CallbackArgumentStruct::CallbackArgumentStruct):
16824             - fix * position for Objective-C types
16825         (CallbackArgumentBlockCallback::createAdoptingJSBlockAdaptor):
16826             - Added to make adopt explicit
16827         (CallbackArgumentBlockCallback):
16828         (CallbackArgumentBlockCallback::CallbackArgumentBlockCallback):
16829         (ArgumentTypeDelegate::typeBlock):
16830             - Call createAdoptingJSBlockAdaptor
16831         (ArgumentTypeDelegate::typeStruct):
16832         (CallbackResult):
16833         (CallbackResultStruct::CallbackResultStruct):
16834         (ResultTypeDelegate::typeStruct):
16835         (ObjCCallbackFunction::ObjCCallbackFunction):
16836         (ObjCCallbackFunction::context):
16837         (objCCallbackFunctionForInvocation):
16838         (objCCallbackFunctionForMethod):
16839         (objCCallbackFunctionForBlock):
16840             - fix * position for Objective-C types
16841         * API/ObjcRuntimeExtras.h:
16842         (protocolImplementsProtocol):
16843         (forEachProtocolImplementingProtocol):
16844         (forEachMethodInProtocol):
16845         (forEachPropertyInProtocol):
16846             - fix * position for Objective-C types
16847         * API/tests/testapi.m:
16848         (-[TestObject testArgumentTypesWithInt:double:boolean:string:number:array:dictionary:]):
16849         (testObjectiveCAPI):
16850             - fix * position for Objective-C types
16851
16852 2013-01-02  Geoffrey Garen  <ggaren@apple.com>
16853
16854         Some renaming in the CodeCache
16855         https://bugs.webkit.org/show_bug.cgi?id=105966
16856
16857         Reviewed by Gavin Barraclough.
16858
16859         CodeBlockKey => SourceCodeKey because the key is not a CodeBlock.
16860
16861         m_recentlyUsedFunctionCode => m_recentlyUsedFunctions to match other names.
16862
16863         GlobalFunctionKey => FunctionKey because the key is not unique to globalness.
16864
16865         m_cachedGlobalFunctions => m_globalFunctions because "cached" is redundant
16866         for data members in an object called "CodeCache".
16867
16868         kMaxRootCodeBlockEntries => kMaxRootEntries because there are no non-CodeBlock
16869         entries in a CodeBlock cache.
16870
16871         kMaxFunctionCodeBlocks => kMaxChildFunctionEntries to clarify that this
16872         number models a parent-child relationship.
16873
16874         Also removed the initial "k" from enum constants. That's an interesting
16875         style for calling out constants, but it's not the WebKit style.
16876
16877         Finally, a behavior change: Use MaxRootEntries for the limit on global
16878         functions, and not MaxChildFunctionEntries. Previously, there was an
16879         unused constant that seemed to have been intended for this purpose.
16880
16881         * runtime/CodeCache.cpp:
16882         (JSC::CodeCache::makeSourceCodeKey):
16883         (JSC::CodeCache::getCodeBlock):
16884         (JSC::CodeCache::generateFunctionCodeBlock):
16885         (JSC::CodeCache::makeFunctionKey):
16886         (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
16887         (JSC::CodeCache::usedFunctionCode):
16888         * runtime/CodeCache.h:
16889         (JSC::CodeCache::clear):
16890
16891 2013-01-02  Filip Pizlo  <fpizlo@apple.com>
16892
16893         DFG inlining machinery should be robust against the inline callee varying while the executable stays the same
16894         https://bugs.webkit.org/show_bug.cgi?id=105953
16895
16896         Reviewed by Mark Hahnenberg.
16897
16898         This institutes the policy that if InlineCallFrame::callee is null, then the callee and scope have already
16899         been stored into the true call frame (i.e. the place where the call frame of the inlined call would have
16900         been) and so any attempt to access the callee or scope should do a load instead of assuming that the value
16901         is constant. This wires the changes through the bytecode parser, the stack scanning logic, and the compiler
16902         optimization phases and backends.
16903
16904         * bytecode/CodeOrigin.cpp:
16905         (JSC::InlineCallFrame::dump):
16906         * bytecode/CodeOrigin.h:
16907         (CodeOrigin):
16908         (InlineCallFrame):
16909         (JSC::InlineCallFrame::isClosureCall):
16910         (JSC::CodeOrigin::stackOffset):
16911         (JSC):
16912         * dfg/DFGAssemblyHelpers.h:
16913         * dfg/DFGByteCodeParser.cpp:
16914         (JSC::DFG::ByteCodeParser::get):
16915         (InlineStackEntry):
16916         (JSC::DFG::ByteCodeParser::getScope):
16917         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
16918         * dfg/DFGCSEPhase.cpp:
16919         (CSEPhase):
16920         (JSC::DFG::CSEPhase::genericPureCSE):
16921         (JSC::DFG::CSEPhase::pureCSE):
16922         (JSC::DFG::CSEPhase::pureCSERequiringSameInlineCallFrame):
16923         (JSC::DFG::CSEPhase::getMyScopeLoadElimination):
16924         (JSC::DFG::CSEPhase::performNodeCSE):
16925         * dfg/DFGOSRExitCompiler32_64.cpp:
16926         (JSC::DFG::OSRExitCompiler::compileExit):
16927         * dfg/DFGOSRExitCompiler64.cpp:
16928         (JSC::DFG::OSRExitCompiler::compileExit):
16929         * dfg/DFGSpeculativeJIT32_64.cpp:
16930         (JSC::DFG::SpeculativeJIT::compile):
16931         * dfg/DFGSpeculativeJIT64.cpp:
16932         (JSC::DFG::SpeculativeJIT::compile):
16933         * interpreter/CallFrame.cpp:
16934         (JSC::CallFrame::trueCallFrame):
16935
16936 2013-01-02  Gavin Barraclough  <barraclough@apple.com>
16937
16938         Objective-C API for JavaScriptCore
16939         https://bugs.webkit.org/show_bug.cgi?id=105889
16940
16941         Reviewed by Geoff Garen.
16942
16943         Fixes for a number of issues raised by Darin.
16944
16945         * API/APIJSValue.h:
16946             - Fix typos in comment
16947             - Add newline before NS_CLASS_AVAILABLE(10_9, NA)
16948             - cls -> expectedClass
16949             - key type for -setObject:forKeyedSubscript: is now NSObject <NSCopying> *
16950         * API/JSBase.h:
16951             - JS_OBJC_API_ENABLED no longer implies __OBJC__
16952         * API/JSBlockAdaptor.mm:
16953         (BlockArgumentStruct::BlockArgumentStruct):
16954         (BlockArgumentStruct):
16955             - mark virtual functions as virtual, override, and private
16956             - refactor out buffer allocation for struct types
16957         (BlockArgumentTypeDelegate::typeVoid):
16958         (BlockArgumentTypeDelegate::typeBlock):
16959         (BlockArgumentTypeDelegate::typeStruct):
16960             - return nil -> return 0
16961         (BlockResultStruct::BlockResultStruct):
16962         (BlockResultStruct):
16963             - mark virtual functions as virtual, override, and private
16964             - refactor out buffer allocation for struct types
16965         (buildBlockSignature):
16966             - %lu is not an appropriate format specifier for NSInteger
16967         (-[JSBlockAdaptor initWithBlockSignatureFromProtocol:]):
16968             - nil check [super init]
16969         (-[JSBlockAdaptor blockMatchesSignature:]):
16970         (-[JSBlockAdaptor blockFromValue:inContext:withException:]):
16971             - ctx -> contextRef
16972         * API/JSContext.h:
16973             - Fix typos in comment
16974             - Add newline before NS_CLASS_AVAILABLE(10_9, NA)
16975             - key type for -setObject:forKeyedSubscript: is now NSObject <NSCopying> *
16976         * API/JSContext.mm:
16977         (-[JSContext initWithVirtualMachine:]):
16978             - nil check [super init]
16979         (+[JSContext currentArguments]):
16980             - args -> argumentArray
16981         (-[JSContext setObject:forKeyedSubscript:]):
16982             - key type for -setObject:forKeyedSubscript: is now NSObject <NSCopying> *
16983         (-[JSContext dealloc]):
16984         (-[JSContext protect:]):
16985         (-[JSContext unprotect:]):
16986             - m_protected -> m_protectCounts
16987         * API/JSValue.mm:
16988         (-[JSValue toObjectOfClass:]):
16989             - cls -> expectedClass
16990         (-[JSValue toBool]):
16991         (-[JSValue deleteProperty:]):
16992         (-[JSValue hasProperty:]):
16993         (-[JSValue isUndefined]):
16994         (-[JSValue isNull]):
16995         (-[JSValue isBoolean]):
16996         (-[JSValue isNumber]):
16997         (-[JSValue isString]):
16998         (-[JSValue isObject]):
16999         (-[JSValue isEqualToObject:]):
17000         (-[JSValue isEqualWithTypeCoercionToObject:]):
17001         (-[JSValue isInstanceOf:]):
17002             - removed ? YES : NO
17003         (-[JSValue callWithArguments:]):
17004         (-[JSValue constructWithArguments:]):
17005         (-[JSValue invokeMethod:withArguments:]):
17006             - args -> argumentArray
17007         (+[JSValue valueWithPoint:inContext:]):
17008         (+[JSValue valueWithRange:inContext:]):
17009         (+[JSValue valueWithRect:inContext:]):
17010         (+[JSValue valueWithSize:inContext:]):
17011             - [NSNumber numberWithFloat:] -> @()
17012         (-[JSValue objectForKeyedSubscript:]):
17013         (-[JSValue setObject:forKeyedSubscript:]):
17014             - key type for -setObject:forKeyedSubscript: is now NSObject <NSCopying> *
17015         (JSContainerConvertor):
17016         (JSContainerConvertor::isWorkListEmpty):
17017         (JSContainerConvertor::convert):
17018         (ObjcContainerConvertor):
17019         (ObjcContainerConvertor::isWorkListEmpty):
17020             - remove WTF::
17021             - isWorkListEmpty is const
17022         (objectToValue):
17023             -  use fast enumeration
17024         (-[JSValue initWithValue:inContext:]):
17025             - nil check [super init]
17026         (getStructTagHandler):
17027             - m_structHandlers -> structHandlers
17028         * API/JSVirtualMachine.h:
17029             - Add newline before NS_CLASS_AVAILABLE(10_9, NA)
17030         * API/JSVirtualMachine.mm:
17031         (-[JSVirtualMachine init]):
17032             - nil check [super init]
17033         * API/JSWrapperMap.mm:
17034         (selectorToPropertyName):
17035         (copyPrototypeProperties):
17036             - remove WTF::
17037             - use static_cast
17038         (-[JSObjCClassInfo initWithContext:forClass:superClassInfo:]):
17039         (-[JSWrapperMap initWithContext:]):
17040             - nil check [super init]
17041         (-[JSWrapperMap wrapperForObject:]):
17042         (tryUnwrapObjcObject):
17043             - enable ASSERT
17044         (getJSExportProtocol):
17045         (getNSBlockClass):
17046             - remove if check on initializing static
17047         * API/JavaScriptCore.h:
17048             - JS_OBJC_API_ENABLED no longer implies __OBJC__
17049         * API/ObjCCallbackFunction.mm:
17050         (CallbackArgumentOfClass):
17051         (CallbackArgumentOfClass::~CallbackArgumentOfClass):
17052         (CallbackArgumentStruct::CallbackArgumentStruct):
17053         (CallbackArgumentStruct):
17054         (CallbackArgumentBlockCallback):
17055             - mark virtual functions as virtual, override, and private
17056             - refactor out buffer allocation for struct types
17057         (ArgumentTypeDelegate::typeVoid):
17058         (ArgumentTypeDelegate::typeOfClass):
17059         (ArgumentTypeDelegate::typeStruct):
17060             - return nil -> return 0
17061         (CallbackResultStruct::CallbackResultStruct):
17062         (CallbackResultStruct):
17063             - mark virtual functions as virtual, override, and private
17064             - refactor out buffer allocation for struct types
17065         (ResultTypeDelegate::typeStruct):
17066             - return nil -> return 0
17067         (ObjCCallbackFunction):
17068             - remove WTF::
17069         (objCCallbackFunctionFinalize):
17070             - use static_cast
17071         (objCCallbackFunctionCallAsFunction):
17072             - Fix typos in comment
17073         (createObjCCallbackFunctionClass):
17074         (objCCallbackFunctionClass):
17075             - Split out createObjCCallbackFunctionClass from objCCallbackFunctionClass
17076         (ObjCCallbackFunction::call):
17077             - ctx -> contextRef
17078         (blockSignatureContainsClass):
17079             - Remove tri-state enum.
17080         (skipNumber):
17081             - isdigit -> isASCIIDigit
17082         (objCCallbackFunctionForInvocation):
17083             - clean up & comment blockSignatureContainsClass() usage
17084         (tryUnwrapBlock):
17085             - use static_cast
17086         * API/ObjcRuntimeExtras.h:
17087         (forEachProtocolImplementingProtocol):
17088         (forEachMethodInClass):
17089         (forEachMethodInProtocol):
17090         (forEachPropertyInProtocol):
17091             - Remove WTF::
17092             - Remove if (count) checks
17093         (skipPair):
17094             - NSUInteger -> size_t
17095         (StringRange):
17096         (StringRange::operator const char*):
17097         (StringRange::get):
17098         (StructBuffer):
17099         (StructBuffer::StructBuffer):
17100         (StructBuffer::~StructBuffer):
17101         (StructBuffer::operator void*):
17102             - Added helper for creating an aligned buffer, used by struct conversion invocations.
17103         (parseObjCType):
17104             - *(position++) -> *position++
17105         * API/tests/testapi.c:
17106             - PLATFORM(MAC) -> JS_OBJC_API_ENABLED
17107         * API/tests/testapi.m:
17108         (blockSignatureContainsClass):
17109             - Remove tri-state enum.
17110         (testObjectiveCAPI):
17111             - Added more result type checks.
17112
17113 2013-01-02  Filip Pizlo  <fpizlo@apple.com>
17114
17115         DFG should not use the InlineCallFrame's callee when it could have used the executable istead
17116         https://bugs.webkit.org/show_bug.cgi?id=105947
17117
17118         Reviewed by Mark Hahnenberg.
17119
17120         We shouldn't use the callee to get the executable when we have the executable already. Not only
17121         does this make the logic more clear, but it also allows for a world where the executable is known
17122         but the callee isn't.
17123
17124         * dfg/DFGAssemblyHelpers.h:
17125         (JSC::DFG::AssemblyHelpers::strictModeFor):
17126
17127 2013-01-02  Filip Pizlo  <fpizlo@apple.com>
17128
17129         DFG inliner should not use the callee's bytecode variable for resolving references to the callee in inlined code
17130         https://bugs.webkit.org/show_bug.cgi?id=105938
17131
17132         Reviewed by Mark Hahnenberg.
17133
17134         This simplifies a bunch of code for referring to the callee. It also ought to simplify how we do
17135         closure call inlining: for inlined closure call frames we will simply require that the callee is
17136         already stashed on the stack in the Callee slot in the inline call frame header.
17137
17138         * dfg/DFGByteCodeParser.cpp:
17139         (ByteCodeParser):
17140         (JSC::DFG::ByteCodeParser::getDirect):
17141         (JSC::DFG::ByteCodeParser::get):
17142         (InlineStackEntry):
17143         (JSC::DFG::ByteCodeParser::InlineStackEntry::remapOperand):
17144         (JSC::DFG::ByteCodeParser::handleCall):
17145         (JSC::DFG::ByteCodeParser::handleInlining):
17146         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
17147         (JSC::DFG::ByteCodeParser::parse):
17148
17149 2013-01-02  Ryosuke Niwa  <rniwa@webkit.org>
17150
17151         Another Windows port build fix attempt. Try not exporting this symbol from JSC
17152         since it's also compiled in WebCore.
17153
17154         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
17155
17156 2013-01-02  Csaba Osztrogonác  <ossy@webkit.org>
17157
17158         One more unreviewed buildfix after r138609.
17159
17160         * jit/JITCall.cpp: Add a missing include.
17161
17162 2013-01-02  Csaba Osztrogonác  <ossy@webkit.org>
17163
17164         Unreviewed buildfix after r138609.
17165
17166         * jit/JITCall32_64.cpp: Add a missing include.
17167
17168 2013-01-01  Filip Pizlo  <fpizlo@apple.com>
17169
17170         Baseline JIT should have closure call caching
17171         https://bugs.webkit.org/show_bug.cgi?id=105900
17172
17173         Reviewed by Gavin Barraclough.
17174
17175         This is not a speed-up by itself, but is meant to allow the DFG inliner to
17176         accurately discern between closure calls and non-closure calls, so that it can
17177         do closure call inlining in the future.
17178
17179         * bytecode/CallLinkStatus.cpp:
17180         (JSC::CallLinkStatus::computeFromLLInt):
17181         (JSC::CallLinkStatus::computeFor):
17182         * bytecode/CallLinkStatus.h:
17183         (JSC::CallLinkStatus::CallLinkStatus):
17184         (JSC::CallLinkStatus::isClosureCall):
17185         (CallLinkStatus):
17186         * dfg/DFGByteCodeParser.cpp:
17187         (JSC::DFG::ByteCodeParser::handleCall):
17188         * jit/JIT.cpp:
17189         (JSC::JIT::linkFor):
17190         (JSC::JIT::linkSlowCall):
17191         * jit/JIT.h:
17192         (JSC::JIT::compileClosureCall):
17193         * jit/JITCall.cpp:
17194         (JSC::JIT::privateCompileClosureCall):
17195         * jit/JITCall32_64.cpp:
17196         (JSC::JIT::privateCompileClosureCall):
17197         * jit/JITStubs.cpp:
17198         (JSC::DEFINE_STUB_FUNCTION):
17199         * jit/JITStubs.h:
17200         * jit/ThunkGenerators.cpp:
17201         (JSC::linkClosureCallGenerator):
17202         * jit/ThunkGenerators.h:
17203
17204 2013-01-01  Dan Bernstein  <mitz@apple.com>
17205
17206         <rdar://problem/12942239> Update copyright strings
17207
17208         Reviewed by Sam Weinig.
17209
17210         * Info.plist:
17211
17212 2012-12-31  Gavin Barraclough  <barraclough@apple.com>
17213
17214         Objective-C API for JavaScriptCore
17215         https://bugs.webkit.org/show_bug.cgi?id=105889
17216
17217         Reviewed by Filip Pizlo.
17218
17219         For a detailed description of the API implemented here, see:
17220             JSContext.h
17221             APIJSValue.h
17222             JSVirtualMachine.h
17223             JSExport.h
17224         Still to do -
17225             (1) Shoud rename APIJSValue.h -> JSValue.h (but we'll have to rename JSValue.h first).
17226             (2) Numerous FIXMEs, all with separate bugs filed.
17227
17228         * API/APIJSValue.h: Added.
17229             - this Objective-C class is used to reference a JavaScript object.
17230         * API/JSBase.h:
17231             - added JS_OBJC_API_ENABLED macro to control ObjC API support.
17232         * API/JSBlockAdaptor.h: Added.
17233             - this Objective-C class is used in creating a special NSBlock proxying a JavaScript function.
17234         * API/JSBlockAdaptor.mm: Added.
17235         (BlockArgument):
17236         (BlockArgument::~BlockArgument):
17237         (BlockArgumentBoolean):
17238         (BlockArgumentBoolean::get):
17239         (BlockArgumentNumeric):
17240         (BlockArgumentNumeric::get):
17241         (BlockArgumentId):
17242         (BlockArgumentId::get):
17243         (BlockArgumentStruct):
17244         (BlockArgumentStruct::BlockArgumentStruct):
17245         (BlockArgumentStruct::~BlockArgumentStruct):
17246         (BlockArgumentStruct::get):
17247             - decoded arguent type information of a JSBlockAdaptor.
17248         (BlockArgumentTypeDelegate):
17249         (BlockArgumentTypeDelegate::typeInteger):
17250         (BlockArgumentTypeDelegate::typeDouble):
17251         (BlockArgumentTypeDelegate::typeBool):
17252         (BlockArgumentTypeDelegate::typeVoid):
17253         (BlockArgumentTypeDelegate::typeId):
17254         (BlockArgumentTypeDelegate::typeOfClass):
17255         (BlockArgumentTypeDelegate::typeBlock):
17256         (BlockArgumentTypeDelegate::typeStruct):
17257             - delegate for use in conjunction with parseObjCType.
17258         (BlockResult):
17259         (BlockResult::~BlockResult):
17260         (BlockResultVoid):
17261         (BlockResultVoid::set):
17262         (BlockResultInteger):
17263         (BlockResultInteger::set):
17264         (BlockResultDouble):
17265         (BlockResultDouble::set):
17266         (BlockResultBoolean):
17267         (BlockResultBoolean::set):
17268         (BlockResultStruct):
17269         (BlockResultStruct::BlockResultStruct):
17270         (BlockResultStruct::~BlockResultStruct):
17271         (BlockResultStruct::set):
17272             - decoded result type information of a JSBlockAdaptor.
17273         (buildBlockSignature):
17274             - partial step in constructing a signature with stack offset information from one without.
17275         (-[JSBlockAdaptor initWithBlockSignatureFromProtocol:]):
17276             - constructor.
17277         (-[JSBlockAdaptor blockMatchesSignature:]):
17278             - check whether signature strings match, where only one contains stack frame offsets.
17279         (-[JSBlockAdaptor blockFromValue:inContext:withException:]):
17280             - use the adaptor to create a special forwarding block.
17281         * API/JSCallbackObjectFunctions.h:
17282         (JSC::::inherits):
17283             - add missing braces to multiline for statement.
17284         * API/JSContext.h: Added.
17285             - this Objective-C class is used to reference a JavaScript context.
17286         * API/JSContext.mm: Added.
17287         (-[JSContext init]):
17288             - constructor.
17289         (-[JSContext initWithVirtualMachine:]):
17290             - construct in a given VM (JSGlobalData).
17291         (-[JSContext evaluateScript:]):
17292         (-[JSContext globalObject]):
17293             - evaluate a script, global object accessor.
17294         (+[JSContext currentContext]):
17295         (+[JSContext currentThis]):
17296         (+[JSContext currentArguments]):
17297             - These methods obtain context, this, arguments from within a callback.
17298         (-[JSContext virtualMachine]):
17299             - implementation for .virtualMachine property.
17300         (-[JSContext objectForKeyedSubscript:]):
17301         (-[JSContext setObject:forKeyedSubscript:]):
17302             - support for subscript property access.
17303         (contextInternalContext):
17304             - internal accessor to m_context.
17305         (-[JSContext dealloc]):
17306             - desctructor.
17307         (-[JSContext notifyException:]):
17308         (-[JSContext valueFromNotifyException:]):
17309         (-[JSContext boolFromNotifyException:]):
17310             - internal method to record an exception was thrown.
17311         (-[JSContext beginCallbackWithData:thisValue:argumentCount:arguments:]):
17312         (-[JSContext endCallbackWithData:]):
17313             - internal methods to push/pop a callback record.
17314         (-[JSContext protect:]):
17315         (-[JSContext unprotect:]):
17316             - internal methods to add a value to a protect set (used to protect the internal property of JSValue).
17317         (-[JSContext wrapperForObject:]):
17318             - internal method to create a wrapper object.
17319         (WeakContextRef::WeakContextRef):
17320         (WeakContextRef::~WeakContextRef):
17321         (WeakContextRef::get):
17322         (WeakContextRef::set):
17323             - Helper class to implement a weak reference to a JSContext.
17324         * API/JSContextInternal.h: Added.
17325         (CallbackData):
17326         (WeakContextRef):
17327             - see API/JSContext.mm for description of internal methods.
17328         * API/JSExport.h: Added.
17329             - Provides JSExport protocol & JSExportAs macro.
17330         * API/JSValue.mm: Added.
17331         (+[JSValue valueWithObject:inContext:]):
17332         (+[JSValue valueWithBool:inContext:]):
17333         (+[JSValue valueWithDouble:inContext:]):
17334         (+[JSValue valueWithInt32:inContext:]):
17335         (+[JSValue valueWithUInt32:inContext:]):
17336         (+[JSValue valueWithNewObjectInContext:]):
17337         (+[JSValue valueWithNewArrayInContext:]):
17338         (+[JSValue valueWithNewRegularExpressionFromPattern:flags:inContext:]):
17339         (+[JSValue valueWithNewErrorFromMessage:inContext:]):
17340         (+[JSValue valueWithNullInContext:]):
17341         (+[JSValue valueWithUndefinedInContext:]):
17342             - Constructors.
17343         (-[JSValue toObject]):
17344         (-[JSValue toObjectOfClass:]):
17345         (-[JSValue toBool]):
17346         (-[JSValue toDouble]):
17347         (-[JSValue toInt32]):
17348         (-[JSValue toUInt32]):
17349         (-[JSValue toNumber]):
17350         (-[JSValue toString]):
17351         (-[JSValue toDate]):
17352         (-[JSValue toArray]):
17353         (-[JSValue toDictionary]):
17354             - Conversion to Objective-C types.
17355         (-[JSValue valueForProperty:]):
17356         (-[JSValue setValue:forProperty:]):
17357         (-[JSValue deleteProperty:]):
17358         (-[JSValue hasProperty:]):
17359         (-[JSValue defineProperty:descriptor:]):
17360             - Property access by property name.
17361         (-[JSValue valueAtIndex:]):
17362         (-[JSValue setValue:atIndex:]):
17363             - Property access by index.
17364         (-[JSValue isUndefined]):
17365         (-[JSValue isNull]):
17366         (-[JSValue isBoolean]):
17367         (-[JSValue isNumber]):
17368         (-[JSValue isString]):
17369         (-[JSValue isObject]):
17370             - Test JavaScript type.
17371         (-[JSValue isEqualToObject:]):
17372         (-[JSValue isEqualWithTypeCoercionToObject:]):
17373         (-[JSValue isInstanceOf:]):
17374             - ===, ==, instanceof operators.
17375         (-[JSValue callWithArguments:]):
17376         (-[JSValue constructWithArguments:]):
17377         (-[JSValue invokeMethod:withArguments:]):
17378             - Call & construct.
17379         (-[JSValue context]):
17380             - implementation for .context property.
17381         (-[JSValue toPoint]):
17382         (-[JSValue toRange]):
17383         (-[JSValue toRect]):
17384         (-[JSValue toSize]):
17385         (+[JSValue valueWithPoint:inContext:]):
17386         (+[JSValue valueWithRange:inContext:]):
17387         (+[JSValue valueWithRect:inContext:]):
17388         (+[JSValue valueWithSize:inContext:]):
17389             - Support for NS struct types.
17390         (-[JSValue objectForKeyedSubscript:]):
17391         (-[JSValue objectAtIndexedSubscript:]):
17392         (-[JSValue setObject:forKeyedSubscript:]):
17393         (-[JSValue setObject:atIndexedSubscript:]):
17394             - support for subscript property access.
17395         (isDate):
17396         (isArray):
17397             - internal helper functions to check for instances of JS Date, Array types.
17398         (JSContainerConvertor):
17399         (Task):
17400         (JSContainerConvertor::JSContainerConvertor):
17401         (JSContainerConvertor::isWorkListEmpty):
17402         (JSContainerConvertor::convert):
17403         (JSContainerConvertor::add):
17404         (JSContainerConvertor::take):
17405             - helper class for tracking state while converting to Array/Dictionary objects.
17406         (valueToObjectWithoutCopy):
17407         (containerValueToObject):
17408         (valueToObject):
17409         (valueToNumber):
17410         (valueToString):
17411         (valueToDate):
17412         (valueToArray):
17413         (valueToDictionary):
17414             - function for converting JavaScript values to Objective-C objects.
17415         (ObjcContainerConvertor):
17416         (ObjcContainerConvertor::ObjcContainerConvertor):
17417         (ObjcContainerConvertor::isWorkListEmpty):
17418         (ObjcContainerConvertor::convert):
17419         (ObjcContainerConvertor::add):
17420         (ObjcContainerConvertor::take):
17421             - helper class for tracking state while converting to Array/Dictionary values.
17422         (objectToValueWithoutCopy):
17423         (objectToValue):
17424         (valueInternalValue):
17425             - function for converting Objective-C objects to JavaScript values.
17426         (+[JSValue valueWithValue:inContext:]):
17427         (-[JSValue initWithValue:inContext:]):
17428             - internal constructors.
17429         (StructTagHandler):
17430         (getStructTagHandler):
17431         (+[JSValue selectorForStructToValue:]):
17432         (+[JSValue selectorForValueToStruct:]):
17433             - methods to tracking struct types that support conversion to/from JSValue.
17434         (-[JSValue dealloc]):
17435             - destructor.
17436         (-[JSValue description]):
17437             - Objective-C to-NSString conversion.
17438         (typeToValueInvocationFor):
17439         (valueToTypeInvocationFor):
17440             - create invocation objects for conversion to/from JSValue.
17441         * API/JSValueInternal.h: Added.
17442             - see API/JSValue.mm for description of internal methods.
17443         * API/JSVirtualMachine.h: Added.
17444             - this Objective-C class is used to reference a JavaScript virtual machine (JSGlobalData).
17445         * API/JSVirtualMachine.mm: Added.
17446         (-[JSVirtualMachine init]):
17447         (-[JSVirtualMachine dealloc]):
17448             - constructor & destructor.
17449         (getGroupFromVirtualMachine):
17450             - internal accessor for m_group property.
17451         * API/JSVirtualMachineInternal.h: Added.
17452             - see API/JSVirtualMachine.mm for description of internal methods.
17453         * API/JSWrapperMap.h: Added.
17454         * API/JSWrapperMap.mm: Added.
17455         (wrapperClass):
17456             - singleton root for detction (& unwrapping) of wrapper objects.
17457         (selectorToPropertyName):
17458             - default selector to property name conversion.
17459         (createObjectWithCustomBrand):
17460             - creates a JSObject with a custom NativeBrand (class name).
17461         (createRenameMap):
17462             - parse @optional properties of a JSExport protocol.
17463         (putNonEnumerable):
17464             - property put with enumerable=false.
17465         (copyMethodsToObject):
17466             - iterate methods in a protocol; add functions to a JSObject.
17467         (parsePropertyAttributes):
17468             - examine protocol property metadata.
17469         (makeSetterName):
17470             - "foo" -> "setFoo"
17471         (copyPrototypeProperties):
17472             - create properties on a Protocol object reflecting the instance methods & properties of a protocol.
17473         (-[JSObjCClassInfo initWithContext:forClass:superClassInfo:]):
17474         (-[JSObjCClassInfo dealloc]):
17475         (-[JSObjCClassInfo wrapperForObject:]):
17476         (-[JSObjCClassInfo constructor]):
17477             - cache the Protocol/Constructor objects for an Objective-C type.
17478         (-[JSWrapperMap initWithContext:]):
17479         (-[JSWrapperMap dealloc]):
17480             - constructor & desctructor.
17481         (-[JSWrapperMap classInfoForClass:]):
17482             - maps Class -> JSObjCClassInfo.
17483         (-[JSWrapperMap wrapperForObject:]):
17484             - cretae or retrieve a cached wrapper value for an object.
17485         (tryUnwrapObjcObject):
17486             - check whether a value is a wrapper object; unwrap if so.
17487         * API/JavaScriptCore.h:
17488             - Added includes for new API headers.
17489         * API/ObjCCallbackFunction.h: Added.
17490             - this class is used to wrap Objective-C instance methods, class methods & blocks as JSFunction objects.
17491         * API/ObjCCallbackFunction.mm: Added.
17492         (CallbackArgument):
17493         (CallbackArgument::~CallbackArgument):
17494         (CallbackArgumentBoolean):
17495         (CallbackArgumentBoolean::set):
17496         (CallbackArgumentInteger):
17497         (CallbackArgumentInteger::set):
17498         (CallbackArgumentDouble):
17499         (CallbackArgumentDouble::set):
17500         (CallbackArgumentJSValue):
17501         (CallbackArgumentJSValue::set):
17502         (CallbackArgumentId):
17503         (CallbackArgumentId::set):
17504         (CallbackArgumentOfClass):
17505         (CallbackArgumentOfClass::CallbackArgumentOfClass):
17506         (CallbackArgumentOfClass::~CallbackArgumentOfClass):
17507         (CallbackArgumentOfClass::set):
17508         (CallbackArgumentNSNumber):
17509         (CallbackArgumentNSNumber::set):
17510         (CallbackArgumentNSString):
17511         (CallbackArgumentNSString::set):
17512         (CallbackArgumentNSDate):
17513         (CallbackArgumentNSDate::set):
17514         (CallbackArgumentNSArray):
17515         (CallbackArgumentNSArray::set):
17516         (CallbackArgumentNSDictionary):
17517         (CallbackArgumentNSDictionary::set):
17518         (CallbackArgumentStruct):
17519         (CallbackArgumentStruct::CallbackArgumentStruct):
17520         (CallbackArgumentStruct::~CallbackArgumentStruct):
17521         (CallbackArgumentStruct::set):
17522         (CallbackArgumentBlockCallback):
17523         (CallbackArgumentBlockCallback::CallbackArgumentBlockCallback):
17524         (CallbackArgumentBlockCallback::~CallbackArgumentBlockCallback):
17525         (CallbackArgumentBlockCallback::set):
17526             - decoded arguent type information of a ObjCCallbackFunction.
17527         (ArgumentTypeDelegate):
17528         (ArgumentTypeDelegate::typeInteger):
17529         (ArgumentTypeDelegate::typeDouble):
17530         (ArgumentTypeDelegate::typeBool):
17531         (ArgumentTypeDelegate::typeVoid):
17532         (ArgumentTypeDelegate::typeId):
17533         (ArgumentTypeDelegate::typeOfClass):
17534         (ArgumentTypeDelegate::typeBlock):
17535         (ArgumentTypeDelegate::typeStruct):
17536             - delegate for use in conjunction with parseObjCType.
17537         (CallbackResult):
17538         (CallbackResult::~CallbackResult):
17539         (CallbackResultVoid):
17540         (CallbackResultVoid::get):
17541         (CallbackResultId):
17542         (CallbackResultId::get):
17543         (CallbackResultNumeric):
17544         (CallbackResultNumeric::get):
17545         (CallbackResultBoolean):
17546         (CallbackResultBoolean::get):
17547         (CallbackResultStruct):
17548         (CallbackResultStruct::CallbackResultStruct):
17549         (CallbackResultStruct::~CallbackResultStruct):
17550         (CallbackResultStruct::get):
17551             - decoded result type information of a ObjCCallbackFunction.
17552         (ResultTypeDelegate):
17553         (ResultTypeDelegate::typeInteger):
17554         (ResultTypeDelegate::typeDouble):
17555         (ResultTypeDelegate::typeBool):
17556         (ResultTypeDelegate::typeVoid):
17557         (ResultTypeDelegate::typeId):
17558         (ResultTypeDelegate::typeOfClass):
17559         (ResultTypeDelegate::typeBlock):
17560         (ResultTypeDelegate::typeStruct):
17561             - delegate for use in conjunction with parseObjCType.
17562         (ObjCCallbackFunction):
17563         (ObjCCallbackFunction::ObjCCallbackFunction):
17564         (ObjCCallbackFunction::~ObjCCallbackFunction):
17565             - constructor & destructor.
17566         (ObjCCallbackFunction::context):
17567             - accessor.
17568         (ObjCCallbackFunction::wrappedBlock):
17569             - attemmpt to unwrap a block object.
17570         (objCCallbackFunctionFinalize):
17571         (objCCallbackFunctionCallAsFunction):
17572         (objCCallbackFunctionClass):
17573             - JSClassRef used to represent ObjCCallbackFunction objects.
17574         (ObjCCallbackFunction::call):
17575         (blockSignatureContainsClass):
17576             - helper function to determine if we're running on a recent Clang.
17577         (skipNumber):
17578             - helper used in parsing signature strings.
17579         (objCCallbackFunctionForInvocation):
17580         (objCCallbackFunctionForMethod):
17581         (objCCallbackFunctionForBlock):
17582             - functions to try to create ObjCCallbackFunction instances for methods/blocks.
17583         (tryUnwrapBlock):
17584             - attemmpt to unwrap a block object.
17585         * API/ObjcRuntimeExtras.h: Added.
17586         (protocolImplementsProtocol):
17587         (forEachProtocolImplementingProtocol):
17588         (forEachMethodInClass):
17589         (forEachMethodInProtocol):
17590         (forEachPropertyInProtocol):
17591             - functions used in reflecting on Objective-C types.
17592         (skipPair):
17593             - parsing helper used by parseObjCType, scans for matching parentheses.
17594         (StringRange):
17595         (StringRange::StringRange):
17596         (StringRange::~StringRange):
17597         (StringRange::operator const char*):
17598         (StringRange::get):
17599             - Helper class - create a c string copy of a range of an existing string.
17600         (parseObjCType):
17601             - function to parse Objective-C type strings, makes callbacks to a deleagte.
17602         * API/tests/testapi.c:
17603         (main):
17604             - added call to testObjectiveCAPI (in testapi.m).
17605         * API/tests/testapi.m: Added.
17606         (+[ParentObject parentTest]):
17607         (+[TestObject testObject]):
17608         (+[TestObject classTest]):
17609         (-[TestObject getString]):
17610         (-[TestObject testArgumentTypesWithInt:double:boolean:string:number:array:dictionary:]):
17611         (-[TestObject callback:]):
17612         (-[TextXYZ test:]):
17613             - test object, used in various test vases.
17614         (checkResult):
17615             - helper function.
17616         (blockSignatureContainsClass):
17617             - helper function to determine if we're running on a recent Clang.
17618         (testObjectiveCAPI):
17619             - new test cases.
17620         * JavaScriptCore.xcodeproj/project.pbxproj:
17621             - added new files.
17622         * runtime/JSGlobalData.cpp:
17623         (JSC::JSGlobalData::JSGlobalData):
17624         * runtime/JSGlobalData.h:
17625         (JSGlobalData):
17626             - added m_apiData - provide convenient storage for use by the API.
17627         * runtime/JSGlobalObject.cpp:
17628         (JSC::JSGlobalObject::JSGlobalObject):
17629         * runtime/JSGlobalObject.h:
17630         (JSGlobalObject):
17631             - added m_apiData - provide convenient storage for use by the API.
17632
17633 2012-12-27  Csaba Osztrogonác  <ossy@webkit.org>
17634
17635         One more unreviwed holiday MIPS and SH4 buildfixes after r138516.
17636
17637         * jit/ThunkGenerators.cpp:
17638
17639 2012-12-27  Csaba Osztrogonác  <ossy@webkit.org>
17640
17641         Unreviwed holiday ARM and SH4 buildfixes after r138516.
17642
17643         * jit/ThunkGenerators.cpp:
17644         (JSC::nativeForGenerator):
17645
17646 2012-12-26  Filip Pizlo  <fpizlo@apple.com>
17647
17648         All JIT stubs should go through the getCTIStub API
17649         https://bugs.webkit.org/show_bug.cgi?id=105750
17650
17651         Reviewed by Sam Weinig.
17652
17653         Previously JITThunks had two sets of thunks: one static set stored in a struct,
17654         which was filled by JIT::privateCompileCTITrampolines, and another set stored in
17655         a HashMap. Moreover, the code to generate the code for the CTI trampoline struct
17656         had loads of copy-paste between JSVALUE32_64 and JSVALUE64, and was total
17657         unmodular with respect to calls versus constructors, among other things.
17658
17659         This changeset removes this struct and rationalizes the code that generates those
17660         thunks. All of thunks are now generated through the getCTIStub HashMap API. All
17661         thunks for the baseline JIT now use the JSInterfaceJIT and have their codegen
17662         located in ThunkGenerators.cpp. All thunks now share as much code as possible -
17663         it turns out that they are almost 100% identical between 32_64 and 64, so that
17664         works out great. A bunch of call vs. construct duplication was eliminated. And,
17665         most of the call link versus virtual call duplication was also eliminated.
17666
17667         This does not change behavior but it does make it easier to add more thunks in
17668         the future.
17669
17670         * bytecode/CallLinkInfo.cpp:
17671         (JSC::CallLinkInfo::unlink):
17672         * jit/JIT.cpp:
17673         (JSC::JIT::linkFor):
17674         * jit/JIT.h:
17675         (JIT):
17676         * jit/JITCall.cpp:
17677         (JSC::JIT::compileCallEvalSlowCase):
17678         (JSC::JIT::compileOpCallSlowCase):
17679         * jit/JITCall32_64.cpp:
17680         (JSC::JIT::compileCallEvalSlowCase):
17681         (JSC::JIT::compileOpCallSlowCase):
17682         * jit/JITInlines.h:
17683         (JSC):
17684         * jit/JITOpcodes.cpp:
17685         (JSC):
17686         (JSC::JIT::privateCompileCTINativeCall):
17687         * jit/JITOpcodes32_64.cpp:
17688         (JSC):
17689         * jit/JITStubs.cpp:
17690         (JSC::tryCacheGetByID):
17691         * jit/JITThunks.cpp:
17692         (JSC::JITThunks::JITThunks):
17693         (JSC::JITThunks::ctiNativeCall):
17694         (JSC::JITThunks::ctiNativeConstruct):
17695         (JSC):
17696         (JSC::JITThunks::hostFunctionStub):
17697         * jit/JITThunks.h:
17698         (JSC):
17699         (JITThunks):
17700         * jit/JSInterfaceJIT.h:
17701         (JSInterfaceJIT):
17702         (JSC::JSInterfaceJIT::emitJumpIfNotJSCell):
17703         (JSC):
17704         (JSC::JSInterfaceJIT::emitFastArithIntToImmNoCheck):
17705         (JSC::JSInterfaceJIT::emitJumpIfNotType):
17706         (JSC::JSInterfaceJIT::emitGetFromCallFrameHeaderPtr):
17707         (JSC::JSInterfaceJIT::emitPutToCallFrameHeader):
17708         (JSC::JSInterfaceJIT::emitPutImmediateToCallFrameHeader):
17709         (JSC::JSInterfaceJIT::emitPutCellToCallFrameHeader):
17710         (JSC::JSInterfaceJIT::preserveReturnAddressAfterCall):
17711         (JSC::JSInterfaceJIT::restoreReturnAddressBeforeReturn):
17712         (JSC::JSInterfaceJIT::restoreArgumentReference):
17713         * jit/ThunkGenerators.cpp:
17714         (JSC::generateSlowCaseFor):
17715         (JSC):
17716         (JSC::linkForGenerator):
17717         (JSC::linkCallGenerator):
17718         (JSC::linkConstructGenerator):
17719         (JSC::virtualForGenerator):
17720         (JSC::virtualCallGenerator):
17721         (JSC::virtualConstructGenerator):
17722         (JSC::stringLengthTrampolineGenerator):
17723         (JSC::nativeForGenerator):
17724         (JSC::nativeCallGenerator):
17725         (JSC::nativeConstructGenerator):
17726         (JSC::charCodeAtThunkGenerator):
17727         (JSC::charAtThunkGenerator):
17728         (JSC::fromCharCodeThunkGenerator):
17729         (JSC::sqrtThunkGenerator):
17730         (JSC::floorThunkGenerator):
17731         (JSC::ceilThunkGenerator):
17732         (JSC::roundThunkGenerator):
17733         (JSC::expThunkGenerator):
17734         (JSC::logThunkGenerator):
17735         (JSC::absThunkGenerator):
17736         (JSC::powThunkGenerator):
17737         * jit/ThunkGenerators.h:
17738         (JSC):
17739         * runtime/Executable.h:
17740         (NativeExecutable):
17741         (JSC::NativeExecutable::nativeFunctionFor):
17742         (JSC::NativeExecutable::offsetOfNativeFunctionFor):
17743
17744 2012-12-25  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
17745
17746         [CMAKE] Remove header files in JavaScriptCore/CMakeLists.txt
17747         https://bugs.webkit.org/show_bug.cgi?id=105753
17748
17749         Reviewed by Laszlo Gombos.
17750
17751         * CMakeLists.txt: Remove header files in source list.
17752
17753 2012-12-25  Filip Pizlo  <fpizlo@apple.com>
17754
17755         JITThunks should be in its own file
17756         https://bugs.webkit.org/show_bug.cgi?id=105744
17757
17758         Rubber stamped by Sam Weinig.
17759
17760         Moved JITThunks into its own file and removed some static methods from it
17761         that were not related to what JITThunks currently does. Performed various
17762         pagan rituals to get it to build - apparently there is a circular dependency
17763         between JSCell, Weak, and JITThunks, which magically resolves itself if you
17764         make sure to first include Register.h. Making it so that fewer pagan rituals
17765         need to be performed if this code changes in the future is covered by
17766         https://bugs.webkit.org/show_bug.cgi?id=105696.
17767
17768         * CMakeLists.txt:
17769         * GNUmakefile.list.am:
17770         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
17771         * JavaScriptCore.xcodeproj/project.pbxproj:
17772         * Target.pri:
17773         * jit/JITStubs.cpp:
17774         (JSC::tryCachePutByID):
17775         (JSC::tryCacheGetByID):
17776         * jit/JITStubs.h:
17777         (JSC::JITStackFrame::returnAddressSlot):
17778         (JSC::returnAddressIsInCtiTrampoline):
17779         * jit/JITThunks.cpp: Added.
17780         (JSC::JITThunks::JITThunks):
17781         (JSC::JITThunks::~JITThunks):
17782         (JSC::JITThunks::ctiStub):
17783         (JSC::JITThunks::hostFunctionStub):
17784         (JSC::JITThunks::clearHostFunctionStubs):
17785         * jit/JITThunks.h: Added.
17786         (JSC::JITThunks::ctiStringLengthTrampoline):
17787         (JSC::JITThunks::ctiVirtualCallLink):
17788         (JSC::JITThunks::ctiVirtualConstructLink):
17789         (JSC::JITThunks::ctiVirtualCall):
17790         (JSC::JITThunks::ctiVirtualConstruct):
17791         (JSC::JITThunks::ctiNativeCall):
17792         (JSC::JITThunks::ctiNativeConstruct):
17793         * jit/ThunkGenerator.h: Added.
17794         * jit/ThunkGenerators.cpp:
17795         * jit/ThunkGenerators.h:
17796         * runtime/JSGlobalData.h:
17797
17798 2012-12-25  Ilya Tikhonovsky  <loislo@chromium.org>
17799
17800         Unreviewed follow-up for r138455.
17801
17802         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
17803
17804 2012-12-24  Ilya Tikhonovsky  <loislo@chromium.org>
17805
17806         Unreviewed compilation fix for r138452.
17807
17808         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
17809
17810 2012-12-24  Laszlo Gombos  <l.gombos@samsung.com>
17811
17812         Remove wtf/Platform.h includes from {c|cpp} files
17813         https://bugs.webkit.org/show_bug.cgi?id=105678
17814
17815         Reviewed by Kentaro Hara.
17816
17817         Remove wtf/Platform.h from the include list as it is already
17818         included in config.h.
17819
17820         * disassembler/udis86/udis86.c:
17821         * disassembler/udis86/udis86_decode.c:
17822         * disassembler/udis86/udis86_input.c:
17823         * disassembler/udis86/udis86_itab_holder.c:
17824         * disassembler/udis86/udis86_syn-att.c:
17825         * disassembler/udis86/udis86_syn-intel.c:
17826         * disassembler/udis86/udis86_syn.c:
17827         * heap/VTableSpectrum.cpp:
17828
17829 2012-12-21  Filip Pizlo  <fpizlo@apple.com>
17830
17831         DFG Arrayify slow path should be out-of-line
17832         https://bugs.webkit.org/show_bug.cgi?id=105400
17833
17834         Reviewed by Gavin Barraclough.
17835
17836         The interesting bit of this change is allowing out-of-line slow path generators
17837         to emit speculation checks. This is accomplished by having a version of
17838         speculationCheck() that returns a jump placeholder instead of taking a jump (or
17839         jump list) as an argument. You can then fill in that jump placeholder at a
17840         later time, so long as you do it before OSR exit linking. Slow path generators
17841         run before linking, so that just naturally ends up working.
17842
17843         This isn't really a big win, but we know that out-of-lining slow paths is
17844         generally a good thing to do, so it's fair to assume that this is a move in the
17845         right direction.
17846
17847         * CMakeLists.txt:
17848         * GNUmakefile.list.am:
17849         * JavaScriptCore.xcodeproj/project.pbxproj:
17850         * Target.pri:
17851         * dfg/DFGArrayifySlowPathGenerator.h: Added.
17852         (DFG):
17853         (ArrayifySlowPathGenerator):
17854         (JSC::DFG::ArrayifySlowPathGenerator::ArrayifySlowPathGenerator):
17855         (JSC::DFG::ArrayifySlowPathGenerator::generateInternal):
17856         * dfg/DFGOSRExitJumpPlaceholder.cpp: Added.
17857         (DFG):
17858         (JSC::DFG::OSRExitJumpPlaceholder::fill):
17859         * dfg/DFGOSRExitJumpPlaceholder.h: Added.
17860         (DFG):
17861         (OSRExitJumpPlaceholder):
17862         (JSC::DFG::OSRExitJumpPlaceholder::OSRExitJumpPlaceholder):
17863         (JSC::DFG::OSRExitJumpPlaceholder::operator!):
17864         * dfg/DFGSpeculativeJIT.cpp:
17865         (JSC::DFG::SpeculativeJIT::speculationCheck):
17866         (DFG):
17867         (JSC::DFG::SpeculativeJIT::arrayify):
17868         * dfg/DFGSpeculativeJIT.h:
17869         (SpeculativeJIT):
17870
17871 2012-12-20  Oliver Hunt  <oliver@apple.com>
17872
17873         Finally found the problem.  Using the wrong JSContextGroup.
17874
17875         * API/tests/testapi.c:
17876         (main):
17877
17878 2012-12-20  Oliver Hunt  <oliver@apple.com>
17879
17880         Try to convince bots to be happy with testapi.
17881
17882         * API/JSScriptRefPrivate.h:
17883
17884 2012-12-20  Michael Saboff  <msaboff@apple.com>
17885
17886         JIT: Change uninitialized pointer value -1 to constant
17887         https://bugs.webkit.org/show_bug.cgi?id=105576
17888
17889         Rubber stamped by Gavin Barraclough.
17890
17891         Changed the use of -1 as a pointer value in the JITs to be the constant unusedPointer defined in the
17892         new file jit/UnusedPointer.h.  Made it's value 0xd1e7beef, which is a bad pointer on most architectures
17893         because it is odd, and to distinguish it from other common values.
17894
17895         * GNUmakefile.list.am:
17896         * JavaScriptCore.xcodeproj/project.pbxproj:
17897         * dfg/DFGRepatch.cpp:
17898         (JSC::DFG::dfgResetGetByID):
17899         (JSC::DFG::dfgResetPutByID):
17900         * dfg/DFGSpeculativeJIT32_64.cpp:
17901         (JSC::DFG::SpeculativeJIT::cachedGetById):
17902         (JSC::DFG::SpeculativeJIT::cachedPutById):
17903         * dfg/DFGSpeculativeJIT64.cpp:
17904         (JSC::DFG::SpeculativeJIT::cachedGetById):
17905         (JSC::DFG::SpeculativeJIT::cachedPutById):
17906         * jit/JIT.h:
17907         * jit/JITPropertyAccess.cpp:
17908         (JSC::JIT::resetPatchGetById):
17909         (JSC::JIT::resetPatchPutById):
17910         * jit/JITPropertyAccess32_64.cpp:
17911         (JSC::JIT::resetPatchGetById):
17912         (JSC::JIT::resetPatchPutById):
17913         * jit/JITWriteBarrier.h:
17914         (JSC::JITWriteBarrierBase::clearToUnusedPointer):
17915         (JSC::JITWriteBarrierBase::get):
17916         * jit/UnusedPointer.h: Added.
17917
17918 2012-12-20  Filip Pizlo  <fpizlo@apple.com>
17919
17920         DFG shouldn't emit CheckStructure on array accesses if exit profiling tells it not to
17921         https://bugs.webkit.org/show_bug.cgi?id=105577
17922
17923         Reviewed by Mark Hahnenberg.
17924
17925         I don't know why this wasn't there from the beginning.
17926
17927         * dfg/DFGByteCodeParser.cpp:
17928         (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
17929
17930 2012-12-19  Filip Pizlo  <fpizlo@apple.com>
17931
17932         DFG speculation checks that take JumpList should consolidate OSRExits
17933         https://bugs.webkit.org/show_bug.cgi?id=105401
17934
17935         Reviewed by Oliver Hunt.
17936
17937         Change OSRExitCompilationInfo to always contain a JumpList, and change JumpList
17938         to be more compact. This way, a speculationCheck that takes a JumpList only has
17939         to emit one OSRExit structure, and one OSRExit landing pad.
17940
17941         The downside is that we get less precise information about *where* we exited
17942         from. So, this also includes changes to the profiler to be more relaxed about
17943         what an ExitSite is.
17944
17945         * assembler/AbstractMacroAssembler.h:
17946         (JumpList):
17947         * dfg/DFGJITCompiler.cpp:
17948         (JSC::DFG::JITCompiler::linkOSRExits):
17949         (JSC::DFG::JITCompiler::link):
17950         * dfg/DFGJITCompiler.h:
17951         (DFG):
17952         (JSC::DFG::JITCompiler::appendExitInfo):
17953         (JITCompiler):
17954         * dfg/DFGOSRExitCompilationInfo.h:
17955         (OSRExitCompilationInfo):
17956         * dfg/DFGSpeculativeJIT.cpp:
17957         (JSC::DFG::SpeculativeJIT::speculationCheck):
17958         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
17959         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
17960         * profiler/ProfilerCompilation.cpp:
17961         (JSC::Profiler::Compilation::addOSRExitSite):
17962         * profiler/ProfilerCompilation.h:
17963         (Compilation):
17964         * profiler/ProfilerOSRExitSite.cpp:
17965         (JSC::Profiler::OSRExitSite::toJS):
17966         * profiler/ProfilerOSRExitSite.h:
17967         (JSC::Profiler::OSRExitSite::OSRExitSite):
17968         (JSC::Profiler::OSRExitSite::codeAddress):
17969         (OSRExitSite):
17970
17971 2012-12-19  Oliver Hunt  <oliver@apple.com>
17972
17973         Fix some incorrect tests in testapi.c
17974
17975         Reviewed by Simon Fraser.
17976
17977         * API/tests/testapi.c:
17978         (main):
17979
17980 2012-12-19  Filip Pizlo  <fpizlo@apple.com>
17981
17982         JSObject::ensure<IndexingType> should gracefully handle InterceptsGetOwn..., and should never be called when the 'this' is not an object
17983         https://bugs.webkit.org/show_bug.cgi?id=105468
17984
17985         Reviewed by Mark Hahnenberg, Oliver Hunt, and Gavin Barraclough.
17986
17987         Changed JSObject::ensure<IndexingType> methods to gracefully handle
17988         InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero. Most of them handle it by returning
17989         null as a result of indexingShouldBeSparse() returning true, while ensureArrayStorage handles it
17990         by entering dictionary indexing mode, which forces the object to behave correctly even if there
17991         is proxying or weird prototype stuff going on.
17992
17993         Changed DFGOperations entrypoints to reject non-objects, so that JSObject doesn't have to deal
17994         with pretending to be JSString. In particular, this would go wrong in the ArrayStorage case
17995         since we'd try to resize a butterfly on a JSString, but JSString has something other than
17996         m_butterfly at that offset.
17997
17998         Finally, removed all InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero from JIT code
17999         since those are now redundant.
18000
18001         * dfg/DFGOperations.cpp:
18002         * dfg/DFGOperations.h:
18003         * dfg/DFGSpeculativeJIT.cpp:
18004         (JSC::DFG::SpeculativeJIT::arrayify):
18005         * dfg/DFGSpeculativeJIT.h:
18006         (JSC::DFG::SpeculativeJIT::callOperation):
18007         * runtime/JSObject.cpp:
18008         (JSC::JSObject::enterDictionaryIndexingMode):
18009         (JSC::JSObject::ensureInt32Slow):
18010         (JSC::JSObject::ensureDoubleSlow):
18011         (JSC::JSObject::ensureContiguousSlow):
18012         (JSC::JSObject::ensureArrayStorageSlow):
18013         (JSC):
18014         (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
18015         * runtime/JSObject.h:
18016         (JSObject):
18017
18018 2012-12-19  Oliver Hunt  <oliver@apple.com>
18019
18020         Tidy up JSScriptRef API
18021         https://bugs.webkit.org/show_bug.cgi?id=105470
18022
18023         Reviewed by Anders Carlsson.
18024
18025         People found the API's use of a context confusing, so we'll switch to a JSContextGroup based
18026         API, and drop a number of the unnecessary uses of contexts.
18027
18028         * API/JSScriptRef.cpp:
18029         (OpaqueJSScript::globalData):
18030         (parseScript):
18031         * API/JSScriptRefPrivate.h:
18032         * API/tests/testapi.c:
18033         (main):
18034
18035 2012-12-19  Alexis Menard  <alexis@webkit.org>
18036
18037         Implement CSS parsing for CSS transitions unprefixed.
18038         https://bugs.webkit.org/show_bug.cgi?id=104804
18039
18040         Reviewed by Dean Jackson.
18041
18042         Add a new flag ENABLE_CSS_TRANSFORMS_ANIMATIONS_TRANSITIONS_UNPREFIXED
18043         to cover the work of unprefixing Transforms, Animations and
18044         Transitions. It will let the possibility of each ports to turn it off
18045         in their release branches until we're confident that these CSS
18046         properties are ready to be unprefixed.
18047
18048         * Configurations/FeatureDefines.xcconfig:
18049
18050 2012-12-18  Filip Pizlo  <fpizlo@apple.com>
18051
18052         Proxies should set InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero
18053         https://bugs.webkit.org/show_bug.cgi?id=105379
18054
18055         Reviewed by Gavin Barraclough.
18056
18057         Forgetting to set this flag led to the DFG trying to ensure array storage on a proxy. I've
18058         now hardened the code with a release assertion as well as fixing the bug. A release assertion
18059         is appropriate here since this is slow-path code.
18060
18061         * runtime/JSObject.cpp:
18062         (JSC::JSObject::enterDictionaryIndexingMode):
18063         (JSC::JSObject::ensureInt32Slow):
18064         (JSC::JSObject::ensureDoubleSlow):
18065         (JSC::JSObject::ensureContiguousSlow):
18066         (JSC::JSObject::ensureArrayStorageSlowNoCheck):
18067         (JSC::JSObject::ensureArrayStorageSlow):
18068         (JSC):
18069         (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
18070         * runtime/JSObject.h:
18071         (JSObject):
18072         * runtime/JSProxy.h:
18073         (JSProxy):
18074
18075 2012-12-18  Oliver Hunt  <oliver@apple.com>
18076
18077         Add a JSScriptRef API to JSC so that we can allow API users to avoid the full cost of reparsing everytime the execute a script.
18078         https://bugs.webkit.org/show_bug.cgi?id=105340
18079
18080         Reviewed by Gavin Barraclough.
18081
18082         This patch adds a (currently private) API to allow users of the JSC API to create a JSScript object
18083         that references a reusable version of the script that they wish to evaluate.  This can help us avoid
18084         numeorus copies that are otherwise induced by our existing API and gives us an opaque object that we
18085         can hang various caches off.  Currently this is simply a simple SourceProvider, but in future we may
18086         be able to add more caching without requiring new/replacement APIs.
18087
18088         * API/JSScriptRef.cpp: Added.
18089         * API/JSScriptRefPrivate.h: Added.
18090         * API/tests/testapi.c:
18091           Add tests for new APIs.
18092         * JavaScriptCore.xcodeproj/project.pbxproj:
18093
18094 2012-12-18  Filip Pizlo  <fpizlo@apple.com>
18095
18096         DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode incorrectly checks for non-array array storage when it should be checking for array array storage
18097         https://bugs.webkit.org/show_bug.cgi?id=105365
18098
18099         Reviewed by Mark Hahnenberg.
18100
18101         * dfg/DFGSpeculativeJIT.cpp:
18102         (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
18103
18104 2012-12-18  Filip Pizlo  <fpizlo@apple.com>
18105
18106         SunSpider/date-format-tofte shouldn't compile each of the tiny worthless eval's only to OSR exit in the prologue every time
18107         https://bugs.webkit.org/show_bug.cgi?id=105335
18108
18109         Reviewed by Geoffrey Garen.
18110
18111         The first thing I did was restructure the logic of canInlineResolveOperations(),
18112         because I didn't understand it. This was relevant because the OSR exits are
18113         caused by a resolve that the DFG cannot handle.
18114
18115         I was then going to make it so that we didn't compile the resolve at all, but
18116         realized that this would not be the best fix: it didn't seem sensible to me to
18117         be optimizing these evals after only 60 invocations. Evals should have a higher
18118         threshold, since they often contain code for which the baseline JIT does a
18119         pretty good job already (if all you've got is a single heap access or a single
18120         hard-to-inline call, then the baseline JIT has got you covered), and typically
18121         if we see one eval code block we expect to see more (from the same eval site):
18122         so our typical low threshold could lead to a *lot* of compilation. As such, the
18123         main effect of this patch is to introduce an evalThresholdMultiplier, which is
18124         now set to 10.
18125
18126         This is a ~5% speed-up on data-format-tofte. No regressions anywhere as far as
18127         I can see.
18128
18129         * bytecode/CodeBlock.cpp:
18130         (JSC::CodeBlock::codeTypeThresholdMultiplier):
18131         (JSC):
18132         (JSC::CodeBlock::optimizationThresholdScalingFactor):
18133         (JSC::CodeBlock::exitCountThresholdForReoptimization):
18134         (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
18135         * bytecode/CodeBlock.h:
18136         (CodeBlock):
18137         * dfg/DFGCapabilities.h:
18138         (JSC::DFG::canInlineResolveOperations):
18139         * dfg/DFGOSRExitCompiler.cpp:
18140         * runtime/Options.h:
18141         (JSC):
18142
18143 2012-12-18  Filip Pizlo  <fpizlo@apple.com>
18144
18145         Convert indexingTypeToString to IndexingTypeDump
18146         https://bugs.webkit.org/show_bug.cgi?id=105351
18147
18148         Reviewed by Mark Hahnenberg.
18149
18150         This gets rid of another case of static char buffer[thingy].
18151
18152         * dfg/DFGGraph.cpp:
18153         (JSC::DFG::Graph::dump):
18154         * runtime/IndexingType.cpp:
18155         (JSC::dumpIndexingType):
18156         * runtime/IndexingType.h:
18157         (JSC):
18158         * runtime/JSValue.cpp:
18159         (JSC::JSValue::dump):
18160
18161 2012-12-18  Beth Dakin  <bdakin@apple.com>
18162
18163         https://bugs.webkit.org/show_bug.cgi?id=102579
18164         [mac] Enable scaled cursors
18165
18166         Reviewed by Dean Jackson.
18167
18168         * Configurations/FeatureDefines.xcconfig:
18169
18170 2012-12-18  Mark Hahnenberg  <mhahnenberg@apple.com>
18171
18172         Restrictions on oversize CopiedBlock allocations should be relaxed
18173         https://bugs.webkit.org/show_bug.cgi?id=105339
18174
18175         Reviewed by Filip Pizlo.
18176
18177         Currently the DFG has a single branch in the inline allocation path for property/array storage where
18178         it checks to see if the number of bytes requested will fit in the current block. This does not match
18179         what the C++ allocation path does; it checks if the requested number of bytes is oversize, and then
18180         if it's not, it tries to fit it in the current block. The garbage collector assumes that ALL allocations
18181         that are greater than 16KB are in oversize blocks. Therefore, this mismatch can lead to crashes when
18182         the collector tries to perform some operation on a CopiedBlock.
18183
18184         To avoid adding an extra branch to the inline allocation path in the JIT, we should make it so that
18185         oversize blocks are allocated on the same alignment boundaries so that there is a single mask to find
18186         the block header of any CopiedBlock (rather than two, one for normal and one for oversize blocks), and
18187         we should figure out if a block is oversize by some other method than just whatever the JSObject says
18188         it is. One way we could record this info Region of the block, since we allocate a one-off Region for
18189         oversize blocks.
18190
18191         * heap/BlockAllocator.h:
18192         (JSC::Region::isCustomSize):
18193         (Region):
18194         (JSC::Region::createCustomSize):
18195         (JSC::Region::Region):
18196         (JSC::BlockAllocator::deallocateCustomSize):
18197         * heap/CopiedBlock.h:
18198         (CopiedBlock):
18199         (JSC::CopiedBlock::isOversize):
18200         (JSC):
18201         * heap/CopiedSpace.cpp:
18202         (JSC::CopiedSpace::tryAllocateOversize):
18203         (JSC::CopiedSpace::tryReallocate):
18204         (JSC::CopiedSpace::tryReallocateOversize):
18205         * heap/CopiedSpace.h:
18206         (CopiedSpace):
18207         * heap/CopiedSpaceInlines.h:
18208         (JSC::CopiedSpace::contains):
18209         (JSC::CopiedSpace::tryAllocate):
18210         (JSC):
18211         * heap/CopyVisitor.h:
18212         (CopyVisitor):
18213         * heap/CopyVisitorInlines.h:
18214         (JSC::CopyVisitor::checkIfShouldCopy):
18215         (JSC::CopyVisitor::didCopy):
18216         * heap/SlotVisitorInlines.h:
18217         (JSC::SlotVisitor::copyLater):
18218         * runtime/JSObject.cpp:
18219         (JSC::JSObject::copyButterfly):
18220
18221 2012-12-18  Joseph Pecoraro  <pecoraro@apple.com>
18222
18223         [Mac] Add Build Phase to Check Headers for Inappropriate Macros (Platform.h macros)
18224         https://bugs.webkit.org/show_bug.cgi?id=104279
18225
18226         Reviewed by David Kilzer.
18227
18228         Add a build phase to check the public JavaScriptCore headers for
18229         inappropriate macros.
18230
18231         * JavaScriptCore.xcodeproj/project.pbxproj:
18232
18233 2012-12-18  Michael Saboff  <msaboff@apple.com>
18234
18235         [Qt] Fix the ARMv7 build after r137976
18236         https://bugs.webkit.org/show_bug.cgi?id=105270
18237
18238         Reviewed by Csaba Osztrogonác.
18239
18240         Add default value for Jump parameter to fix build.
18241
18242         * assembler/AbstractMacroAssembler.h:
18243         (JSC::AbstractMacroAssembler::Jump::Jump):
18244
18245 2012-12-17  Geoffrey Garen  <ggaren@apple.com>
18246
18247         Constant fold !{number} in the parser
18248         https://bugs.webkit.org/show_bug.cgi?id=105232
18249
18250         Reviewed by Filip Pizlo.
18251
18252         Typically, we wait for hot execution and constant fold in the DFG.
18253         However, !0 and !1 are common enough in minifiers that it can be good
18254         to get them out of the way early, for faster/smaller parsing and startup.
18255
18256         * parser/ASTBuilder.h:
18257         (JSC::ASTBuilder::createLogicalNot): !{literal} is super simple, especially
18258         since there's no literal form of NaN or Inf.
18259
18260 2012-12-17  Filip Pizlo  <fpizlo@apple.com>
18261
18262         DFG is too aggressive eliding overflow checks for additions involving large constants
18263         https://bugs.webkit.org/show_bug.cgi?id=105239
18264
18265         Reviewed by Gavin Barraclough.
18266
18267         If we elide overflow checks on an addition (or subtraction) involving a larger-than-2^32 immediate,
18268         then make sure that the non-constant child of the addition knows that he's got to do an overflow
18269         check, by flowing the UsedAsNumber property at him.
18270
18271         * dfg/DFGGraph.h:
18272         (JSC::DFG::Graph::addSpeculationMode):
18273         (Graph):
18274         (JSC::DFG::Graph::addShouldSpeculateInteger):
18275         (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
18276         * dfg/DFGPredictionPropagationPhase.cpp:
18277         (JSC::DFG::PredictionPropagationPhase::propagate):
18278
18279 2012-12-17  Michael Saboff  <msaboff@apple.com>
18280
18281         DFG: Refactor DFGCorrectableJumpPoint to reduce size of OSRExit data
18282         https://bugs.webkit.org/show_bug.cgi?id=105237
18283
18284         Reviewed by Filip Pizlo.
18285
18286         Replaced DFGCorrectableJumpPoint with OSRExitCompilationInfo which is used and kept alive only while we are
18287         compiling in the DFG.  Moved the patchable branch offset directly into OSRExit.
18288
18289         * CMakeLists.txt:
18290         * GNUmakefile.list.am:
18291         * JavaScriptCore.xcodeproj/project.pbxproj:
18292         * Target.pri:
18293         * assembler/AbstractMacroAssembler.h:
18294         * dfg/DFGCorrectableJumpPoint.cpp: Removed.
18295         * dfg/DFGCorrectableJumpPoint.h: Removed.
18296         * dfg/DFGJITCompiler.cpp:
18297         (JSC::DFG::JITCompiler::linkOSRExits):
18298         (JSC::DFG::JITCompiler::link):
18299         * dfg/DFGJITCompiler.h:
18300         (JSC::DFG::JITCompiler::appendExitJump):
18301         (JITCompiler):
18302         * dfg/DFGOSRExit.cpp:
18303         (JSC::DFG::OSRExit::OSRExit):
18304         (JSC::DFG::OSRExit::setPatchableCodeOffset):
18305         (JSC::DFG::OSRExit::getPatchableCodeOffsetAsJump):
18306         (JSC::DFG::OSRExit::codeLocationForRepatch):
18307         (JSC::DFG::OSRExit::correctJump):
18308         * dfg/DFGOSRExit.h:
18309         (OSRExit):
18310         * dfg/DFGOSRExitCompilationInfo.h: Added.
18311         (OSRExitCompilationInfo):
18312         (JSC::DFG::OSRExitCompilationInfo::OSRExitCompilationInfo):
18313         (JSC::DFG::OSRExitCompilationInfo::failureJump):
18314         * dfg/DFGOSRExitCompiler.cpp:
18315         * dfg/DFGSpeculativeJIT.cpp:
18316         (JSC::DFG::SpeculativeJIT::speculationCheck):
18317         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
18318
18319 2012-12-17  Filip Pizlo  <fpizlo@apple.com>
18320
18321         DFG is too aggressive with eliding overflow checks in loops
18322         https://bugs.webkit.org/show_bug.cgi?id=105226
18323
18324         Reviewed by Mark Hahnenberg and Oliver Hunt.
18325
18326         If we see a variable's live range cross basic block boundaries, conservatively assume that it may
18327         be part of a data-flow back-edge, and as a result, we may have entirely integer operations that
18328         could lead to the creation of an integer that is out of range of 2^52 (the significand of a double
18329         float). This does not seem to regress any of the benchmarks we care about, and it fixes the bug.
18330
18331         In future we may want to actually look at whether or not there was a data-flow back-edge instead
18332         of being super conservative about it. But we have no evidence, yet, that this would help us on
18333         real code.
18334
18335         * dfg/DFGNodeFlags.h:
18336         (DFG):
18337         * dfg/DFGPredictionPropagationPhase.cpp:
18338         (JSC::DFG::PredictionPropagationPhase::propagate):
18339
18340 2012-12-17  Mark Hahnenberg  <mhahnenberg@apple.com>
18341
18342         Butterfly::growArrayRight shouldn't be called on null Butterfly objects
18343         https://bugs.webkit.org/show_bug.cgi?id=105221
18344
18345         Reviewed by Filip Pizlo.
18346
18347         Currently we depend upon the fact that Butterfly::growArrayRight works with null Butterfly
18348         objects purely by coincidence. We should add a new static function that null checks the old
18349         Butterfly object and creates a new one if it's null, or calls growArrayRight if it isn't for
18350         use in the couple of places in JSObject that expect such behavior to work.
18351
18352         * runtime/Butterfly.h:
18353         (Butterfly):
18354         * runtime/ButterflyInlines.h:
18355         (JSC::Butterfly::createOrGrowArrayRight):
18356         (JSC):
18357         * runtime/JSObject.cpp:
18358         (JSC::JSObject::createInitialIndexedStorage):
18359         (JSC::JSObject::createArrayStorage):
18360
18361 2012-12-17  Filip Pizlo  <fpizlo@apple.com>
18362
18363         javascript integer overflow
18364         https://bugs.webkit.org/show_bug.cgi?id=104967
18365
18366         Reviewed by Mark Hahnenberg.
18367
18368         Fix PutScopedVar backward flow.
18369
18370         * dfg/DFGPredictionPropagationPhase.cpp:
18371         (JSC::DFG::PredictionPropagationPhase::propagate):
18372
18373 2012-12-16  Filip Pizlo  <fpizlo@apple.com>
18374
18375         Rationalize array profiling for out-of-bounds and hole cases
18376         https://bugs.webkit.org/show_bug.cgi?id=105139
18377
18378         Reviewed by Geoffrey Garen.
18379
18380         This makes ArrayProfile track whether or not we had out-of-bounds, which allows
18381         for more precise decision-making in the DFG.
18382
18383         Also cleaned up ExitKinds for out-of-bounds and hole cases to make it easier to
18384         look at them in the profiler.
18385
18386         Slight speed-up (5-8%) on SunSpider/crypto-md5.
18387
18388         * bytecode/ArrayProfile.cpp:
18389         (JSC::ArrayProfile::computeUpdatedPrediction):
18390         (JSC::ArrayProfile::briefDescription):
18391         * bytecode/ArrayProfile.h:
18392         (JSC::ArrayProfile::ArrayProfile):
18393         (JSC::ArrayProfile::addressOfOutOfBounds):
18394         (JSC::ArrayProfile::expectedStructure):
18395         (JSC::ArrayProfile::structureIsPolymorphic):
18396         (JSC::ArrayProfile::outOfBounds):
18397         (JSC::ArrayProfile::polymorphicStructure):
18398         * bytecode/CodeBlock.cpp:
18399         (JSC::dumpChain):
18400         * bytecode/ExitKind.cpp:
18401         (JSC::exitKindToString):
18402         (JSC::exitKindIsCountable):
18403         * bytecode/ExitKind.h:
18404         * dfg/DFGByteCodeParser.cpp:
18405         (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
18406         * dfg/DFGSpeculativeJIT.cpp:
18407         (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
18408         * dfg/DFGSpeculativeJIT32_64.cpp:
18409         (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
18410         (JSC::DFG::SpeculativeJIT::compile):
18411         * dfg/DFGSpeculativeJIT64.cpp:
18412         (JSC::DFG::SpeculativeJIT::compile):
18413         * jit/JIT.h:
18414         * jit/JITInlines.h:
18415         (JSC::JIT::emitArrayProfileOutOfBoundsSpecialCase):
18416         * jit/JITPropertyAccess.cpp:
18417         (JSC::JIT::emitSlow_op_get_by_val):
18418         (JSC::JIT::emitSlow_op_put_by_val):
18419         * jit/JITPropertyAccess32_64.cpp:
18420         (JSC::JIT::emitSlow_op_get_by_val):
18421         (JSC::JIT::emitSlow_op_put_by_val):
18422         * llint/LowLevelInterpreter32_64.asm:
18423         * llint/LowLevelInterpreter64.asm:
18424
18425 2012-12-17  Balazs Kilvady  <kilvadyb@homejinni.com>
18426
18427         Implement add64 for MIPS assembler after r136601
18428         https://bugs.webkit.org/show_bug.cgi?id=104106
18429
18430         Reviewed by Zoltan Herczeg.
18431
18432         Added add64 function to MacroAssebler of MIPS.
18433
18434         * assembler/MacroAssemblerMIPS.h:
18435         (JSC::MacroAssemblerMIPS::add32):
18436         (JSC::MacroAssemblerMIPS::add64):
18437         (MacroAssemblerMIPS):
18438
18439 2012-12-17  Jonathan Liu  <net147@gmail.com>
18440
18441         Fix Math.pow implementation with MinGW-w64
18442         https://bugs.webkit.org/show_bug.cgi?id=105087
18443
18444         Reviewed by Simon Hausmann.
18445
18446         The MinGW-w64 runtime has different behaviour for pow()
18447         compared to other C runtimes. This results in the following
18448         test262 tests failing with the latest MinGW-w64 runtime:
18449         - S15.8.2.13_A14
18450         - S15.8.2.13_A16
18451         - S15.8.2.13_A20
18452         - S15.8.2.13_A22
18453
18454         Handle the special cases that are different with MinGW-w64.
18455
18456         * runtime/MathObject.cpp:
18457         (JSC::mathPow):
18458
18459 2012-12-16  Filip Pizlo  <fpizlo@apple.com>
18460
18461         Bytecode dumping should show rare case profiles
18462         https://bugs.webkit.org/show_bug.cgi?id=105133
18463
18464         Reviewed by Geoffrey Garen.
18465
18466         Refactored the dumper to call dumpBytecodeCommandAndNewLine in just one place,
18467         rather than in all of the places. Changed the rare case profile getters to use
18468         tryBinarySearch rather than binarySearch, so that they can be used speculatively
18469         even if you don't know that the bytecode has rare case profiles. This actually
18470         increases our assertion level, since it means that in release builds we will get
18471         null and crash rather than getting some random adjacent profile. And then this
18472         adds some printing of the rare case profiles.
18473
18474         * bytecode/CodeBlock.cpp:
18475         (JSC::CodeBlock::printUnaryOp):
18476         (JSC::CodeBlock::printBinaryOp):
18477         (JSC::CodeBlock::printConditionalJump):
18478         (JSC::CodeBlock::printCallOp):
18479         (JSC::CodeBlock::printPutByIdOp):
18480         (JSC::CodeBlock::beginDumpProfiling):
18481         (JSC):
18482         (JSC::CodeBlock::dumpValueProfiling):
18483         (JSC::CodeBlock::dumpArrayProfiling):
18484         (JSC::CodeBlock::dumpRareCaseProfile):
18485         (JSC::CodeBlock::dumpBytecode):
18486         * bytecode/CodeBlock.h:
18487         (JSC::CodeBlock::rareCaseProfileForBytecodeOffset):
18488         (JSC::CodeBlock::specialFastCaseProfileForBytecodeOffset):
18489
18490 2012-12-13  Filip Pizlo  <fpizlo@apple.com>
18491
18492         Attempt to rationalize and simplify WTF::binarySearch
18493         https://bugs.webkit.org/show_bug.cgi?id=104890
18494
18495         Reviewed by Maciej Stachowiak.
18496
18497         Switch to using the new binarySearch() API. No change in behavior.
18498
18499         * bytecode/CodeBlock.cpp:
18500         (JSC::CodeBlock::bytecodeOffset):
18501         (JSC::CodeBlock::codeOriginForReturn):
18502         * bytecode/CodeBlock.h:
18503         (JSC::CodeBlock::getStubInfo):
18504         (JSC::CodeBlock::getByValInfo):
18505         (JSC::CodeBlock::getCallLinkInfo):
18506         (JSC::CodeBlock::dfgOSREntryDataForBytecodeIndex):
18507         (JSC::CodeBlock::valueProfileForBytecodeOffset):
18508         (JSC::CodeBlock::rareCaseProfileForBytecodeOffset):
18509         (JSC::CodeBlock::specialFastCaseProfileForBytecodeOffset):
18510         * dfg/DFGGraph.h:
18511         (JSC::DFG::Graph::blockIndexForBytecodeOffset):
18512         * dfg/DFGMinifiedGraph.h:
18513         (JSC::DFG::MinifiedGraph::at):
18514         * dfg/DFGOSRExitCompiler32_64.cpp:
18515         (JSC::DFG::OSRExitCompiler::compileExit):
18516         * dfg/DFGOSRExitCompiler64.cpp:
18517         (JSC::DFG::OSRExitCompiler::compileExit):
18518         * llint/LLIntSlowPaths.cpp:
18519         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
18520         * profiler/ProfilerBytecodeSequence.cpp:
18521         (JSC::Profiler::BytecodeSequence::indexForBytecodeIndex):
18522
18523 2012-12-13  Filip Pizlo  <fpizlo@apple.com>
18524
18525         Don't assert that flags <= 0x3ff in JSTypeInfo
18526         https://bugs.webkit.org/show_bug.cgi?id=104988
18527
18528         Reviewed by Sam Weinig.
18529
18530         This assertion doesn't accomplish anything other than crashes.
18531
18532         * runtime/JSTypeInfo.h:
18533         (JSC::TypeInfo::TypeInfo):
18534
18535 2012-12-13  Filip Pizlo  <fpizlo@apple.com>
18536
18537         Named lookups on HTML documents produce inconsistent results in JavaScriptCore bindings
18538         https://bugs.webkit.org/show_bug.cgi?id=104623
18539
18540         Reviewed by Geoffrey Garen.
18541
18542         Add the notion of objects that HasImpureGetOwnPropertySlot, and use that to inhibit prototype chain caching
18543         in some cases. This appears to be perf-neutral on benchmarks that we track.
18544
18545         * dfg/DFGRepatch.cpp:
18546         (JSC::DFG::tryCacheGetByID):
18547         (JSC::DFG::tryBuildGetByIDProtoList):
18548         * jit/JITStubs.cpp:
18549         (JSC::JITThunks::tryCacheGetByID):
18550         (JSC::DEFINE_STUB_FUNCTION):
18551         * runtime/JSTypeInfo.h:
18552         (JSC):
18553         (JSC::TypeInfo::hasImpureGetOwnPropertySlot):
18554         * runtime/Operations.h:
18555         (JSC::normalizePrototypeChainForChainAccess):
18556
18557 2012-12-13  Filip Pizlo  <fpizlo@apple.com>
18558
18559         Unreviewed, roll out http://trac.webkit.org/changeset/137683.
18560         It broke gmail.
18561
18562         * dfg/DFGAbstractState.cpp:
18563         (JSC::DFG::AbstractState::execute):
18564         * dfg/DFGByteCodeParser.cpp:
18565         (JSC::DFG::ByteCodeParser::parseBlock):
18566         * dfg/DFGCSEPhase.cpp:
18567         (JSC::DFG::CSEPhase::putStructureStoreElimination):
18568         (JSC::DFG::CSEPhase::performNodeCSE):
18569         * dfg/DFGCapabilities.h:
18570         (JSC::DFG::canCompileOpcode):
18571         * dfg/DFGNodeType.h:
18572         (DFG):
18573         * dfg/DFGOperations.cpp:
18574         * dfg/DFGOperations.h:
18575         * dfg/DFGPredictionPropagationPhase.cpp:
18576         (JSC::DFG::PredictionPropagationPhase::propagate):
18577         * dfg/DFGSpeculativeJIT32_64.cpp:
18578         (JSC::DFG::SpeculativeJIT::compile):
18579         * dfg/DFGSpeculativeJIT64.cpp:
18580         (JSC::DFG::SpeculativeJIT::compile):
18581         * runtime/Operations.cpp:
18582         (JSC::jsTypeStringForValue):
18583         (JSC):
18584         * runtime/Operations.h:
18585         (JSC):
18586
18587 2012-13-11  Oliver Hunt  <oliver@apple.com>
18588
18589         Support op_typeof in the DFG
18590         https://bugs.webkit.org/show_bug.cgi?id=98898
18591
18592         Reviewed by Filip Pizlo.
18593
18594         Adds a TypeOf node to the DFG to support op_typeof.
18595
18596         * dfg/DFGAbstractState.cpp:
18597         (JSC::DFG::AbstractState::execute):
18598           We try to determine the result early here, and substitute in a constant.
18599           Otherwise we leave the node intact, and set the result type to SpecString.
18600         * dfg/DFGByteCodeParser.cpp:
18601         (JSC::DFG::ByteCodeParser::parseBlock):
18602           Parse op_typeof
18603         * dfg/DFGCSEPhase.cpp:
18604         (JSC::DFG::CSEPhase::performNodeCSE):
18605           TypeOf nodes can be subjected to pure CSE
18606         * dfg/DFGCapabilities.h:
18607         (JSC::DFG::canCompileOpcode):
18608           We can handle typeof.
18609         * dfg/DFGNodeType.h:
18610         (DFG):
18611           Define the node.
18612         * dfg/DFGOperations.cpp:
18613         * dfg/DFGOperations.h:
18614           Add operationTypeOf to support the non-trivial cases.
18615         * dfg/DFGPredictionPropagationPhase.cpp:
18616         (JSC::DFG::PredictionPropagationPhase::propagate):
18617         * dfg/DFGSpeculativeJIT32_64.cpp:
18618         (JSC::DFG::SpeculativeJIT::compile):
18619         * dfg/DFGSpeculativeJIT64.cpp:
18620         (JSC::DFG::SpeculativeJIT::compile):
18621           Actual codegen
18622         * runtime/Operations.cpp:
18623         (JSC::jsTypeStringForValue):
18624         (JSC):
18625         * runtime/Operations.h:
18626         (JSC):
18627           Some refactoring to allow us to get the type string for an
18628           object without needing a callframe.
18629
18630 2012-12-12  Filip Pizlo  <fpizlo@apple.com>
18631
18632         OSR exit compiler should emit code for resetting the execution counter that matches the logic of ExecutionCounter.cpp
18633         https://bugs.webkit.org/show_bug.cgi?id=104791
18634
18635         Reviewed by Oliver Hunt.
18636
18637         The OSR exit compiler wants to make it so that every OSR exit does the equivalent
18638         of:
18639
18640         codeBlock->m_jitExecuteCounter.setNewThreshold(
18641             codeBlock->counterValueForOptimizeAfterLongWarmUp());
18642
18643         This logically involves:
18644
18645         - Resetting the counter to zero.
18646         - Setting m_activeThreshold to counterValueForOptimizeAfterLongWarmUp().
18647         - Figuring out the scaled threshold, subtracting the count so far (which is zero,
18648           so this part is a no-op), and clipping (ExecuteCounter::clippedThreshold()).
18649         - Setting m_counter to the negated clipped threshold.
18650         - Setting m_totalCount to the previous count so far (which is zero) plus the
18651           clipped threshold.
18652
18653         Because of the reset, which sets the count-so-far to zero, this amounts to:
18654
18655         - Setting m_activeThreshold to counterValueForOptimizeAfterLongWarmUp().
18656         - Figuring out the clipped scaled threshold.
18657         - Setting m_counter to the negated clipped scaled threshold.
18658         - Setting m_totalCount to the (positive) clipped scaled threshold.
18659
18660         The code was previously not doing this, but now is. This is performance neutral.
18661         The only change in behavior over what the code was previously doing (setting the
18662         m_counter to the negated scaled threshold, without clipping, and then setting
18663         the m_totalCount to the clipped scaled threshold) is that this will respond more
18664         gracefully under memory pressure and will ensure that we get more value profile
18665         LUBing before triggering recompilation. More LUBing is almost always a good
18666         thing.
18667
18668         * dfg/DFGOSRExitCompiler.cpp:
18669         (JSC::DFG::OSRExitCompiler::handleExitCounts):
18670
18671 2012-12-12  Ilya Tikhonovsky  <loislo@chromium.org>
18672
18673         Web Inspector: Native Memory Instrumentation: remove fake root MemoryObjectInfo.
18674         https://bugs.webkit.org/show_bug.cgi?id=104796
18675
18676         Reviewed by Yury Semikhatsky.
18677
18678         It was not a good idea to introduce a fake root MemoryObjectInfo.
18679         It makes a problem when we visit an object without its own MemoryObjectType.
18680
18681         Example: RenderBox has a global pointer to a hash map.
18682         HashMap doesn't have its own object type because it is a generic container.
18683         It will inherit object type from the fake root memory object info.
18684         The same could happen for another container in another class with other MemoryObjectType.
18685
18686         This fact forces me to create custom process method for root objects
18687         because they need to have their own MemoryObjectInfo with customisable memory object type.
18688
18689         Drive by fix: InstrumentedPointer* was replaced with Wrapper* because actually it is using
18690         for instrumented and not instrumented object classes.
18691
18692         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
18693
18694 2012-12-11  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
18695
18696         Implement add64 for ARM traditional assembler after r136601
18697         https://bugs.webkit.org/show_bug.cgi?id=104103
18698
18699         Reviewed by Zoltan Herczeg.
18700
18701         Implement add64 function for ARM traditional macroassembler.
18702
18703         * assembler/MacroAssemblerARM.h:
18704         (JSC::MacroAssemblerARM::add64):
18705         (MacroAssemblerARM):
18706
18707 2012-12-11  Filip Pizlo  <fpizlo@apple.com>
18708
18709         Unreviewed. Fix build with DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE).
18710
18711         * bytecode/CodeBlock.cpp:
18712         (JSC::CodeBlock::tallyFrequentExitSites):
18713
18714 2012-12-11  Filip Pizlo  <fpizlo@apple.com>
18715
18716         Profiler should show bytecode dumps as they would have been visible to the JITs, including the profiling data that the JITs would see
18717         https://bugs.webkit.org/show_bug.cgi?id=104647
18718
18719         Reviewed by Oliver Hunt.
18720
18721         Adds more profiling data to bytecode dumps, and adds the ability to do a secondary
18722         bytecode dump for each JIT compilation of a code block. This is relevant because both
18723         the bytecodes, and the profiling data, may change after some number of executions.
18724
18725         Also fixes some random dumping code to use PrintStream& rather than
18726         static const char[thingy].
18727
18728         * CMakeLists.txt:
18729         * GNUmakefile.list.am:
18730         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
18731         * JavaScriptCore.xcodeproj/project.pbxproj:
18732         * Target.pri:
18733         * bytecode/ArrayProfile.cpp:
18734         (JSC::dumpArrayModes):
18735         (JSC::ArrayProfile::briefDescription):
18736         * bytecode/ArrayProfile.h:
18737         * bytecode/CodeBlock.cpp:
18738         (JSC::CodeBlock::printGetByIdOp):
18739         (JSC::CodeBlock::printGetByIdCacheStatus):
18740         (JSC::CodeBlock::printCallOp):
18741         (JSC::CodeBlock::dumpValueProfiling):
18742         (JSC::CodeBlock::dumpArrayProfiling):
18743         (JSC::CodeBlock::dumpBytecode):
18744         * bytecode/CodeBlock.h:
18745         * bytecode/ValueProfile.h:
18746         (JSC::ValueProfileBase::briefDescription):
18747         * dfg/DFGAbstractValue.h:
18748         (JSC::DFG::AbstractValue::dump):
18749         * dfg/DFGByteCodeParser.cpp:
18750         (JSC::DFG::ByteCodeParser::parseCodeBlock):
18751         * jit/JIT.cpp:
18752         (JSC::JIT::privateCompile):
18753         * profiler/ProfilerBytecodeSequence.cpp: Added.
18754         (JSC::Profiler::BytecodeSequence::BytecodeSequence):
18755         (JSC::Profiler::BytecodeSequence::~BytecodeSequence):
18756         (JSC::Profiler::BytecodeSequence::indexForBytecodeIndex):
18757         (JSC::Profiler::BytecodeSequence::forBytecodeIndex):
18758         (JSC::Profiler::BytecodeSequence::addSequenceProperties):
18759         * profiler/ProfilerBytecodeSequence.h: Added.
18760         (JSC::Profiler::BytecodeSequence::size):
18761         (JSC::Profiler::BytecodeSequence::at):
18762         * profiler/ProfilerBytecodes.cpp:
18763         (JSC::Profiler::Bytecodes::Bytecodes):
18764         (JSC::Profiler::Bytecodes::toJS):
18765         * profiler/ProfilerBytecodes.h:
18766         (JSC::Profiler::Bytecodes::instructionCount):
18767         * profiler/ProfilerCompilation.cpp:
18768         (JSC::Profiler::Compilation::addProfiledBytecodes):
18769         (JSC::Profiler::Compilation::toJS):
18770         * profiler/ProfilerCompilation.h:
18771         (JSC::Profiler::Compilation::profiledBytecodesSize):
18772         (JSC::Profiler::Compilation::profiledBytecodesAt):
18773         * profiler/ProfilerDatabase.cpp:
18774         (JSC::Profiler::Database::ensureBytecodesFor):
18775         * profiler/ProfilerDatabase.h:
18776         * profiler/ProfilerProfiledBytecodes.cpp: Added.
18777         (JSC::Profiler::ProfiledBytecodes::ProfiledBytecodes):
18778         (JSC::Profiler::ProfiledBytecodes::~ProfiledBytecodes):
18779         (JSC::Profiler::ProfiledBytecodes::toJS):
18780         * profiler/ProfilerProfiledBytecodes.h: Added.
18781         (JSC::Profiler::ProfiledBytecodes::bytecodes):
18782         * runtime/CommonIdentifiers.h:
18783
18784 2012-12-11  Oswald Buddenhagen  <oswald.buddenhagen@digia.com>
18785
18786         [Qt] delete dead include paths
18787
18788         Reviewed by Simon Hausmann.
18789
18790         followup to https://bugs.webkit.org/show_bug.cgi?id=93446
18791
18792         * JavaScriptCore.pri:
18793
18794 2012-12-11  Julien BRIANCEAU   <jbrianceau@nds.com>
18795
18796         Implement add64 for SH4 assembler to fix build after r136601
18797         https://bugs.webkit.org/show_bug.cgi?id=104377
18798
18799         Reviewed by Zoltan Herczeg.
18800
18801         * assembler/MacroAssemblerSH4.h:
18802         (JSC::MacroAssemblerSH4::add64):
18803         (MacroAssemblerSH4):
18804
18805 2012-12-10  Yury Semikhatsky  <yurys@chromium.org>
18806
18807         Memory instrumentation: make sure each edge is reported only once
18808         https://bugs.webkit.org/show_bug.cgi?id=104630
18809
18810         Reviewed by Pavel Feldman.
18811
18812         Changed exported symbols for MemoryInstrumentation.
18813
18814         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
18815
18816 2012-12-10  Filip Pizlo  <fpizlo@apple.com>
18817
18818         Don't OSR exit just because a string is a rope
18819         https://bugs.webkit.org/show_bug.cgi?id=104621
18820
18821         Reviewed by Michael Saboff.
18822
18823         Slight SunSpider speed-up at around the 0.7% level. This patch does the obvious
18824         thing of calling a slow path to resolve ropes rather than OSR exiting if the
18825         string is a rope.
18826
18827         * dfg/DFGAbstractState.cpp:
18828         (JSC::DFG::AbstractState::execute):
18829         * dfg/DFGArrayMode.h:
18830         (JSC::DFG::ArrayMode::getIndexedPropertyStorageMayTriggerGC):
18831         (ArrayMode):
18832         * dfg/DFGCSEPhase.cpp:
18833         (JSC::DFG::CSEPhase::putStructureStoreElimination):
18834         * dfg/DFGOperations.cpp:
18835         * dfg/DFGOperations.h:
18836         * dfg/DFGSpeculativeJIT.cpp:
18837         (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
18838         * dfg/DFGSpeculativeJIT.h:
18839         (JSC::DFG::SpeculativeJIT::callOperation):
18840
18841 2012-12-10  Gustavo Noronha Silva  <gns@gnome.org>
18842
18843         Unreviewed distcheck fix.
18844
18845         * GNUmakefile.list.am:
18846
18847 2012-12-10  Filip Pizlo  <fpizlo@apple.com>
18848
18849         JSC profiling and debug dump code should use inferred names when possible
18850         https://bugs.webkit.org/show_bug.cgi?id=104519
18851
18852         Reviewed by Oliver Hunt.
18853
18854         This does as advertised: the profiler now knows the inferred name of all code blocks,
18855         and all uses of CodeBlock::dump() dump it along with the hash.
18856
18857         * bytecode/CodeBlock.cpp:
18858         (JSC::CodeBlock::inferredName):
18859         (JSC::CodeBlock::dumpAssumingJITType):
18860         * bytecode/CodeBlock.h:
18861         * profiler/ProfilerBytecodes.cpp:
18862         (JSC::Profiler::Bytecodes::Bytecodes):
18863         (JSC::Profiler::Bytecodes::toJS):
18864         * profiler/ProfilerBytecodes.h:
18865         (JSC::Profiler::Bytecodes::inferredName):
18866         * profiler/ProfilerDatabase.cpp:
18867         (JSC::Profiler::Database::addBytecodes):
18868         (JSC::Profiler::Database::ensureBytecodesFor):
18869         * profiler/ProfilerDatabase.h:
18870         * runtime/CommonIdentifiers.h:
18871
18872 2012-12-09  Filip Pizlo  <fpizlo@apple.com>
18873
18874         Profiler should say things about OSR exits
18875         https://bugs.webkit.org/show_bug.cgi?id=104497
18876
18877         Reviewed by Oliver Hunt.
18878
18879         This adds support for profiling OSR exits. For each exit that is taken, the profiler
18880         records the machine code address that the exit occurred on, the exit kind, the origin
18881         stack, and the number of times that it happened.
18882
18883         * CMakeLists.txt:
18884         * GNUmakefile.list.am:
18885         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
18886         * JavaScriptCore.xcodeproj/project.pbxproj:
18887         * Target.pri:
18888         * assembler/AbstractMacroAssembler.h:
18889         (Jump):
18890         (JSC::AbstractMacroAssembler::Jump::label):
18891         * bytecode/CodeBlock.h:
18892         (JSC::CodeBlock::saveCompilation):
18893         (CodeBlock):
18894         (JSC::CodeBlock::compilation):
18895         (DFGData):
18896         * bytecode/DFGExitProfile.h:
18897         (DFG):
18898         * bytecode/ExitKind.cpp: Added.
18899         (JSC):
18900         (JSC::exitKindToString):
18901         (JSC::exitKindIsCountable):
18902         (WTF):
18903         (WTF::printInternal):
18904         * bytecode/ExitKind.h: Added.
18905         (JSC):
18906         (WTF):
18907         * dfg/DFGGraph.h:
18908         (Graph):
18909         * dfg/DFGJITCompiler.cpp:
18910         (JSC::DFG::JITCompiler::linkOSRExits):
18911         (JSC::DFG::JITCompiler::link):
18912         (JSC::DFG::JITCompiler::compile):
18913         (JSC::DFG::JITCompiler::compileFunction):
18914         * dfg/DFGJITCompiler.h:
18915         (JITCompiler):
18916         * dfg/DFGOSRExitCompiler.cpp:
18917         * jit/JIT.cpp:
18918         (JSC::JIT::JIT):
18919         (JSC::JIT::privateCompile):
18920         * jit/JIT.h:
18921         (JIT):
18922         * jit/JumpReplacementWatchpoint.h:
18923         (JSC::JumpReplacementWatchpoint::sourceLabel):
18924         (JumpReplacementWatchpoint):
18925         * profiler/ProfilerCompilation.cpp:
18926         (JSC::Profiler::Compilation::addOSRExitSite):
18927         (Profiler):
18928         (JSC::Profiler::Compilation::addOSRExit):
18929         (JSC::Profiler::Compilation::toJS):
18930         * profiler/ProfilerCompilation.h:
18931         (Compilation):
18932         * profiler/ProfilerDatabase.cpp:
18933         (JSC::Profiler::Database::newCompilation):
18934         * profiler/ProfilerDatabase.h:
18935         (Database):
18936         * profiler/ProfilerOSRExit.cpp: Added.
18937         (Profiler):
18938         (JSC::Profiler::OSRExit::OSRExit):
18939         (JSC::Profiler::OSRExit::~OSRExit):
18940         (JSC::Profiler::OSRExit::toJS):
18941         * profiler/ProfilerOSRExit.h: Added.
18942         (Profiler):
18943         (OSRExit):
18944         (JSC::Profiler::OSRExit::id):
18945         (JSC::Profiler::OSRExit::origin):
18946         (JSC::Profiler::OSRExit::exitKind):
18947         (JSC::Profiler::OSRExit::isWatchpoint):
18948         (JSC::Profiler::OSRExit::counterAddress):
18949         (JSC::Profiler::OSRExit::count):
18950         * profiler/ProfilerOSRExitSite.cpp: Added.
18951         (Profiler):
18952         (JSC::Profiler::OSRExitSite::toJS):
18953         * profiler/ProfilerOSRExitSite.h: Added.
18954         (Profiler):
18955         (OSRExitSite):
18956         (JSC::Profiler::OSRExitSite::OSRExitSite):
18957         (JSC::Profiler::OSRExitSite::codeAddress):
18958         * runtime/CommonIdentifiers.h:
18959
18960 2012-12-10  Alexis Menard  <alexis@webkit.org>
18961
18962         [CSS3 Backgrounds and Borders] Remove CSS3_BACKGROUND feature flag.
18963         https://bugs.webkit.org/show_bug.cgi?id=104539
18964
18965         Reviewed by Antonio Gomes.
18966
18967         As discussed on webkit-dev it is not needed to keep this feature flag
18968         as support for <position> type is a small feature that is already
18969         implemented by three other UAs. It was useful while landing this
18970         feature as partial bits were landed one after one.
18971
18972         * Configurations/FeatureDefines.xcconfig:
18973
18974 2012-12-09  Filip Pizlo  <fpizlo@apple.com>
18975
18976         DFG ArrayPush/Pop should not pass their second child as the index for blessArrayOperation()
18977         https://bugs.webkit.org/show_bug.cgi?id=104500
18978
18979         Reviewed by Oliver Hunt.
18980
18981         Slight across-the-board speed-up.
18982
18983         * dfg/DFGAbstractState.cpp:
18984         (JSC::DFG::AbstractState::execute):
18985         * dfg/DFGFixupPhase.cpp:
18986         (JSC::DFG::FixupPhase::fixupNode):
18987
18988 2012-12-08  Filip Pizlo  <fpizlo@apple.com>
18989
18990         JSC should scale the optimization threshold for a code block according to the cost of compiling it
18991         https://bugs.webkit.org/show_bug.cgi?id=104406
18992
18993         Reviewed by Oliver Hunt.
18994
18995         We've long known that we want to scale the execution count threshold needed for the DFG
18996         to kick in to scale according to some estimate of the cost of compiling that code block.
18997         This institutes a relationship like this:
18998
18999         threshold = thresholdSetting * (a * sqrt(instructionCount + b) + abs(c * instructionCount) + d
19000
19001         Where a, b, c, d are coefficients derived from fitting the above expression to various
19002         data points, which I chose based on looking at one benchmark (3d-cube) and from my
19003         own intuitions.
19004
19005         Making this work well also required changing the thresholdForOptimizeAfterLongWarmUp
19006         from 5000 to 1000.
19007
19008         This is a >1% speed-up on SunSpider, a >3% speed-up on V8Spider, ~1% speed-up on V8v7,
19009         neutral on Octane, and neutral on Kraken.
19010
19011         I also out-of-lined a bunch of methods related to these heuristics, because I couldn't
19012         stand having them defined in the header anymore. I also made improvements to debugging
19013         code because I needed it for tuning this change.
19014
19015         * CMakeLists.txt:
19016         * GNUmakefile.list.am:
19017         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
19018         * JavaScriptCore.xcodeproj/project.pbxproj:
19019         * Target.pri:
19020         * bytecode/CodeBlock.cpp:
19021         (JSC::CodeBlock::sourceCodeForTools):
19022         (JSC::CodeBlock::sourceCodeOnOneLine):
19023         (JSC::CodeBlock::dumpBytecode):
19024         (JSC::CodeBlock::CodeBlock):
19025         (JSC::CodeBlock::reoptimizationRetryCounter):
19026         (JSC::CodeBlock::countReoptimization):
19027         (JSC::CodeBlock::optimizationThresholdScalingFactor):
19028         (JSC::clipThreshold):
19029         (JSC::CodeBlock::counterValueForOptimizeAfterWarmUp):
19030         (JSC::CodeBlock::counterValueForOptimizeAfterLongWarmUp):
19031         (JSC::CodeBlock::counterValueForOptimizeSoon):
19032         (JSC::CodeBlock::checkIfOptimizationThresholdReached):
19033         (JSC::CodeBlock::optimizeNextInvocation):
19034         (JSC::CodeBlock::dontOptimizeAnytimeSoon):
19035         (JSC::CodeBlock::optimizeAfterWarmUp):
19036         (JSC::CodeBlock::optimizeAfterLongWarmUp):
19037         (JSC::CodeBlock::optimizeSoon):
19038         (JSC::CodeBlock::adjustedExitCountThreshold):
19039         (JSC::CodeBlock::exitCountThresholdForReoptimization):
19040         (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
19041         (JSC::CodeBlock::shouldReoptimizeNow):
19042         (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
19043         * bytecode/CodeBlock.h:
19044         * bytecode/ExecutionCounter.cpp:
19045         (JSC::ExecutionCounter::hasCrossedThreshold):
19046         * bytecode/ReduceWhitespace.cpp: Added.
19047         (JSC::reduceWhitespace):
19048         * bytecode/ReduceWhitespace.h: Added.
19049         * dfg/DFGCapabilities.cpp:
19050         (JSC::DFG::mightCompileEval):
19051         (JSC::DFG::mightCompileProgram):
19052         (JSC::DFG::mightCompileFunctionForCall):
19053         (JSC::DFG::mightCompileFunctionForConstruct):
19054         (JSC::DFG::mightInlineFunctionForCall):
19055         (JSC::DFG::mightInlineFunctionForConstruct):
19056         * dfg/DFGCapabilities.h:
19057         * dfg/DFGDisassembler.cpp:
19058         (JSC::DFG::Disassembler::dumpHeader):
19059         * dfg/DFGOSREntry.cpp:
19060         (JSC::DFG::prepareOSREntry):
19061         * jit/JITDisassembler.cpp:
19062         (JSC::JITDisassembler::dumpHeader):
19063         * jit/JITStubs.cpp:
19064         (JSC::DEFINE_STUB_FUNCTION):
19065         * llint/LLIntSlowPaths.cpp:
19066         (JSC::LLInt::entryOSR):
19067         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
19068         * profiler/ProfilerDatabase.cpp:
19069         (JSC::Profiler::Database::ensureBytecodesFor):
19070         * runtime/Options.h:
19071
19072 2012-12-07  Jonathan Liu  <net147@gmail.com>
19073
19074         Add missing forward declaration for JSC::ArrayAllocationProfile
19075         https://bugs.webkit.org/show_bug.cgi?id=104425
19076
19077         Reviewed by Kentaro Hara.
19078
19079         The header for the JSC::ArrayConstructor class is missing a forward
19080         declaration for the JSC::ArrayAllocationProfile class which causes
19081         compilation to fail when compiling with MinGW-w64.
19082
19083         * runtime/ArrayConstructor.h:
19084         (JSC):
19085
19086 2012-12-07  Jonathan Liu  <net147@gmail.com>
19087
19088         Add missing const qualifier to JSC::CodeBlock::getJITType()
19089         https://bugs.webkit.org/show_bug.cgi?id=104424
19090
19091         Reviewed by Laszlo Gombos.
19092
19093         JSC::CodeBlock::getJITType() has the const qualifier when JIT is
19094         enabled but is missing the const qualifier when JIT is disabled.
19095
19096         * bytecode/CodeBlock.h:
19097         (JSC::CodeBlock::getJITType):
19098
19099 2012-12-07  Oliver Hunt  <oliver@apple.com>
19100
19101         Make function code cache proportional to main codeblock cache
19102         https://bugs.webkit.org/show_bug.cgi?id=104420
19103
19104         Reviewed by Geoffrey Garen.
19105
19106         Makes the constants determining the recently used function cache proportional
19107         to the number of root codeblocks in the cache.  Also renames the constants to
19108         make them more clear.
19109
19110         * runtime/CodeCache.h:
19111
19112 2012-12-06  Filip Pizlo  <fpizlo@apple.com>
19113
19114         Strange results calculating a square root in a loop
19115         https://bugs.webkit.org/show_bug.cgi?id=104247
19116         <rdar://problem/12826880>
19117
19118         Reviewed by Oliver Hunt.
19119
19120         Fixed the CFG simplification phase to ignore dead GetLocals in the first of the blocks
19121         under the merge. This fixes the assertion, and is also cleaner: our general rule is
19122         to not "revive" things that we've already proved to be dead.
19123
19124         Also fixed some rotted debug code.
19125
19126         * dfg/DFGCFGSimplificationPhase.cpp:
19127         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
19128         * dfg/DFGStructureCheckHoistingPhase.cpp:
19129         (JSC::DFG::StructureCheckHoistingPhase::run):
19130
19131 2012-12-07  Geoffrey Garen  <ggaren@apple.com>
19132
19133         Crash in JSC::Bindings::RootObject::globalObject() sync'ing notes in Evernote
19134         https://bugs.webkit.org/show_bug.cgi?id=104321
19135         <rdar://problem/12770497>
19136
19137         Reviewed by Sam Weinig.
19138
19139         Work around a JSValueUnprotect(NULL) in Evernote.
19140
19141         * API/JSValueRef.cpp:
19142         (evernoteHackNeeded):
19143         (JSValueUnprotect):
19144
19145 2012-12-06  Filip Pizlo  <fpizlo@apple.com>
19146
19147         Incorrect inequality for checking whether a statement is within bounds of a handler
19148         https://bugs.webkit.org/show_bug.cgi?id=104313
19149         <rdar://problem/12808934>
19150
19151         Reviewed by Geoffrey Garen.
19152
19153         The most relevant change is in handlerForBytecodeOffset(), which fixes the inequality
19154         used for checking whether a handler is pertinent to the current instruction. '<' is
19155         correct, but '<=' isn't, since the 'end' is not inclusive.
19156
19157         Also found, and addressed, a benign goof in how the finally inliner works: sometimes
19158         we will have end > start. This falls out naturally from how the inliner works and how
19159         we pop scopes in the bytecompiler, but it's sufficiently surprising that, to avoid any
19160         future confusion, I added a comment and some code to prune those handlers out. Because
19161         of how the handler resolution works, these handlers would have been skipped anyway.
19162
19163         Also made various fixes to debugging code, which was necessary for tracking this down.
19164
19165         * bytecode/CodeBlock.cpp:
19166         (JSC::CodeBlock::dumpBytecode):
19167         (JSC::CodeBlock::handlerForBytecodeOffset):
19168         * bytecompiler/BytecodeGenerator.cpp:
19169         (JSC::BytecodeGenerator::generate):
19170         * bytecompiler/Label.h:
19171         (JSC::Label::bind):
19172         * interpreter/Interpreter.cpp:
19173         (JSC::Interpreter::throwException):
19174         * llint/LLIntExceptions.cpp:
19175         (JSC::LLInt::interpreterThrowInCaller):
19176         (JSC::LLInt::returnToThrow):
19177         (JSC::LLInt::callToThrow):
19178         * llint/LLIntSlowPaths.cpp:
19179         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
19180         (JSC::LLInt::handleHostCall):
19181
19182 2012-12-06  Rick Byers  <rbyers@chromium.org>
19183
19184         CSS cursor property should support webkit-image-set
19185         https://bugs.webkit.org/show_bug.cgi?id=99493
19186
19187         Reviewed by Beth Dakin.
19188
19189         Add ENABLE_MOUSE_CURSOR_SCALE (disabled by default)
19190
19191         * Configurations/FeatureDefines.xcconfig:
19192
19193 2012-12-06  Laszlo Gombos  <l.gombos@samsung.com>
19194
19195         [CMake] Consolidate list of files to build for JavaScriptCore
19196         https://bugs.webkit.org/show_bug.cgi?id=104287
19197
19198         Reviewed by Gyuyoung Kim.
19199
19200         Add MemoryStatistics.cpp and ExecutableAllocator.cpp to the common
19201         list of files and remove them from the port specific lists.
19202
19203         * CMakeLists.txt:
19204         * PlatformBlackBerry.cmake:
19205         * PlatformEfl.cmake:
19206         * PlatformWinCE.cmake:
19207
19208 2012-12-06  Oliver Hunt  <oliver@apple.com>
19209
19210         Tell heap that we've released all the compiled code.
19211
19212         Reviewed by Geoff Garen.
19213
19214         When we discard compiled code, inform the heap that we've
19215         released an entire object graph.  This informs the heap that
19216         it might want to perform a GC soon.
19217
19218         * runtime/JSGlobalData.cpp:
19219         (JSC::JSGlobalData::discardAllCode):
19220
19221 2012-12-06  Laszlo Gombos  <l.gombos@samsung.com>
19222
19223         [EFL] Remove ENABLE_GLIB_SUPPORT CMake variable
19224         https://bugs.webkit.org/show_bug.cgi?id=104278
19225
19226         Reviewed by Brent Fulgham.
19227
19228         The conditional is not required as it is always set for EFL.
19229
19230         * PlatformEfl.cmake:
19231
19232 2012-12-06  Oliver Hunt  <oliver@apple.com>
19233
19234         Build fix, last patch rolled out logic that is now needed on ToT.
19235
19236         * parser/ASTBuilder.h:
19237         (ASTBuilder):
19238         (JSC::ASTBuilder::setFunctionStart):
19239         * parser/Nodes.h:
19240         (JSC::FunctionBodyNode::setFunctionStart):
19241         (JSC::FunctionBodyNode::functionStart):
19242         (FunctionBodyNode):
19243         * parser/Parser.cpp:
19244         (JSC::::parseFunctionInfo):
19245         * parser/SyntaxChecker.h:
19246         (JSC::SyntaxChecker::setFunctionStart):
19247
19248 2012-12-05  Oliver Hunt  <oliver@apple.com>
19249
19250         Remove harmful string->function cache
19251         https://bugs.webkit.org/show_bug.cgi?id=104193
19252
19253         Reviewed by Alexey Proskuryakov.
19254
19255         Remove the string->function code cache that turned out to actually
19256         be quite harmful.
19257
19258         * runtime/CodeCache.cpp:
19259         (JSC::CodeCache::getFunctionCodeBlock):
19260         * runtime/CodeCache.h:
19261         (JSC::CodeCache::clear):
19262
19263 2012-12-05  Halton Huo  <halton.huo@intel.com>
19264
19265         [CMake] Unify coding style for CMake files
19266         https://bugs.webkit.org/show_bug.cgi?id=103605
19267
19268         Reviewed by Laszlo Gombos.
19269
19270         Update cmake files(.cmake, CMakeLists.txt) with following style rules:
19271         1. Indentation
19272         1.1 Use spaces, not tabs.
19273         1.2 Four spaces as indent.
19274         2. Spacing
19275         2.1 Place one space between control statements and their parentheses.
19276             For eg, if (), else (), elseif (), endif (), foreach (),
19277             endforeach (), while (), endwhile (), break ().
19278         2.2 Do not place spaces between function and macro statements and
19279             their parentheses. For eg, macro(), endmacro(), function(),
19280             endfunction().
19281         2.3 Do not place spaces between a command or function or macro and its
19282             parentheses, or between a parenthesis and its content. For eg,
19283             message("testing") not message( "testing") or message ("testing" )
19284         2.4 No space at line ending.
19285         3. Lowercase when call commands macros and functions. For eg,
19286            add_executable() not ADD_EXECUTABLE(), set() not SET().
19287
19288         * CMakeLists.txt:
19289         * PlatformBlackBerry.cmake:
19290         * PlatformEfl.cmake:
19291         * PlatformWinCE.cmake:
19292         * shell/CMakeLists.txt:
19293         * shell/PlatformBlackBerry.cmake:
19294         * shell/PlatformEfl.cmake:
19295         * shell/PlatformWinCE.cmake:
19296
19297 2012-12-05  Oliver Hunt  <oliver@apple.com>
19298
19299         Empty parse cache when receiving a low memory warning
19300         https://bugs.webkit.org/show_bug.cgi?id=104161
19301
19302         Reviewed by Filip Pizlo.
19303
19304         This adds a function to the globaldata to empty all code related data
19305         structures (code in the heap and the code cache).
19306         It also adds a function to allow the CodeCache to actually be cleared
19307         at all.
19308
19309         * runtime/CodeCache.h:
19310         (CacheMap):
19311         (JSC::CacheMap::clear):
19312         (JSC::CodeCache::clear):
19313         (CodeCache):
19314         * runtime/JSGlobalData.cpp:
19315         (JSC::JSGlobalData::discardAllCode):
19316         (JSC):
19317         * runtime/JSGlobalData.h:
19318         (JSGlobalData):
19319
19320 2012-12-05  Filip Pizlo  <fpizlo@apple.com>
19321
19322         JSC profiler should not count executions of op_call_put_result because doing so changes DFG codegen
19323         https://bugs.webkit.org/show_bug.cgi?id=104102
19324
19325         Reviewed by Oliver Hunt.
19326
19327         This removes op_call_put_result from profiling, since profiling it has an effect on
19328         codegen. This fix enables all of SunSpider, V8, and Kraken to be profiled with the
19329         new profiler.
19330
19331         To make this all fit together, the profiler now also reports in its output the exact
19332         bytecode opcode name for each instruction (in addition to the stringified dump of that
19333         bytecode), so that tools that grok the output can take note of op_call_put_result and
19334         work around the fact that it has no counts.
19335
19336         * dfg/DFGByteCodeParser.cpp:
19337         (JSC::DFG::ByteCodeParser::parseBlock):
19338         (JSC::DFG::ByteCodeParser::parseCodeBlock):
19339         * dfg/DFGDriver.cpp:
19340         (JSC::DFG::compile):
19341         * jit/JIT.cpp:
19342         (JSC::JIT::privateCompileMainPass):
19343         * profiler/ProfilerBytecode.cpp:
19344         (JSC::Profiler::Bytecode::toJS):
19345         * profiler/ProfilerBytecode.h:
19346         (JSC::Profiler::Bytecode::Bytecode):
19347         (JSC::Profiler::Bytecode::opcodeID):
19348         (Bytecode):
19349         * profiler/ProfilerDatabase.cpp:
19350         (JSC::Profiler::Database::ensureBytecodesFor):
19351         * runtime/CommonIdentifiers.h:
19352
19353 2012-12-04  Filip Pizlo  <fpizlo@apple.com>
19354
19355         display-profiler-output should be able to show source code
19356         https://bugs.webkit.org/show_bug.cgi?id=104073
19357
19358         Reviewed by Oliver Hunt.
19359
19360         Modify the profiler database to store source code. For functions, we store the
19361         function including the function signature.
19362
19363         * bytecode/CodeBlock.h:
19364         (JSC::CodeBlock::unlinkedCodeBlock):
19365         (CodeBlock):
19366         * profiler/ProfilerBytecodes.cpp:
19367         (JSC::Profiler::Bytecodes::Bytecodes):
19368         (JSC::Profiler::Bytecodes::toJS):
19369         * profiler/ProfilerBytecodes.h:
19370         (Bytecodes):
19371         (JSC::Profiler::Bytecodes::sourceCode):
19372         * profiler/ProfilerDatabase.cpp:
19373         (JSC::Profiler::Database::addBytecodes):
19374         (JSC::Profiler::Database::ensureBytecodesFor):
19375         * profiler/ProfilerDatabase.h:
19376         (Database):
19377         * runtime/CommonIdentifiers.h:
19378         * runtime/Executable.h:
19379         (FunctionExecutable):
19380         (JSC::FunctionExecutable::unlinkedExecutable):
19381
19382 2012-12-02  Filip Pizlo  <fpizlo@apple.com>
19383
19384         JSC should be able to report profiling data associated with the IR dumps and disassembly
19385         https://bugs.webkit.org/show_bug.cgi?id=102999
19386
19387         Reviewed by Gavin Barraclough.
19388
19389         Added a new profiler to JSC. It's simply called "Profiler" in anticipation of it
19390         ultimately replacing the previous profiling infrastructure. This profiler counts the
19391         number of times that a bytecode executes in various engines, and will record both the
19392         counts and all disassembly and bytecode dumps, into a database that can be at any
19393         time turned into either a JS object using any global object or global data of your
19394         choice, or can be turned into a JSON string, or saved to a file.
19395
19396         Currently the only use of this is the new '-p <file>' flag to the jsc command-line.
19397
19398         The profiler is always compiled in and normally incurs no execution time cost, but is
19399         only activated when you create a Profiler::Database and install it in
19400         JSGlobalData::m_perBytecodeProfiler. From that point on, all code blocks will be
19401         compiled along with disassembly and bytecode dumps stored into the Profiler::Database,
19402         and all code blocks will have execution counts, which are also stored in the database.
19403         The database will continue to keep information about code blocks alive even after they
19404         are otherwise GC'd.
19405
19406         This currently still has some glitches, like the fact that it only counts executions
19407         in the JITs. Doing execution counting in the LLInt might require a bit of a rethink
19408         about how the counting is expressed - currently it is implicit in bytecode, so there
19409         is no easy way to "turn it on" in the LLInt. Also, right now there is no information
19410         recorded about OSR exits or out-of-line stubs. But, even so, it's quite cool, and
19411         gives you a peek into what JSC is doing that would otherwise not be possible.
19412
19413         * CMakeLists.txt:
19414         * GNUmakefile.list.am:
19415         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
19416         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
19417         * JavaScriptCore.xcodeproj/project.pbxproj:
19418         * Target.pri:
19419         * bytecode/CodeBlock.cpp:
19420         (JSC::CodeBlock::~CodeBlock):
19421         * bytecode/CodeBlock.h:
19422         (CodeBlock):
19423         (JSC::CodeBlock::baselineVersion):
19424         * bytecode/CodeOrigin.cpp:
19425         (JSC::InlineCallFrame::baselineCodeBlock):
19426         (JSC):
19427         * bytecode/CodeOrigin.h:
19428         (InlineCallFrame):
19429         * dfg/DFGAbstractState.cpp:
19430         (JSC::DFG::AbstractState::execute):
19431         * dfg/DFGByteCodeParser.cpp:
19432         (JSC::DFG::ByteCodeParser::parseBlock):
19433         * dfg/DFGDisassembler.cpp:
19434         (JSC::DFG::Disassembler::dump):
19435         (DFG):
19436         (JSC::DFG::Disassembler::reportToProfiler):
19437         (JSC::DFG::Disassembler::dumpHeader):
19438         (JSC::DFG::Disassembler::append):
19439         (JSC::DFG::Disassembler::createDumpList):
19440         * dfg/DFGDisassembler.h:
19441         (Disassembler):
19442         (JSC::DFG::Disassembler::DumpedOp::DumpedOp):
19443         (DumpedOp):
19444         * dfg/DFGGraph.cpp:
19445         (JSC::DFG::Graph::Graph):
19446         (JSC::DFG::Graph::dumpCodeOrigin):
19447         (JSC::DFG::Graph::dump):
19448         * dfg/DFGGraph.h:
19449         (Graph):
19450         * dfg/DFGJITCompiler.cpp:
19451         (JSC::DFG::JITCompiler::JITCompiler):
19452         (JSC::DFG::JITCompiler::compile):
19453         (JSC::DFG::JITCompiler::compileFunction):
19454         * dfg/DFGNode.h:
19455         (Node):
19456         (JSC::DFG::Node::hasExecutionCounter):
19457         (JSC::DFG::Node::executionCounter):
19458         * dfg/DFGNodeType.h:
19459         (DFG):
19460         * dfg/DFGPredictionPropagationPhase.cpp:
19461         (JSC::DFG::PredictionPropagationPhase::propagate):
19462         * dfg/DFGSpeculativeJIT32_64.cpp:
19463         (JSC::DFG::SpeculativeJIT::compile):
19464         * dfg/DFGSpeculativeJIT64.cpp:
19465         (JSC::DFG::SpeculativeJIT::compile):
19466         * jit/JIT.cpp:
19467         (JSC::JIT::JIT):
19468         (JSC::JIT::privateCompileMainPass):
19469         (JSC::JIT::privateCompile):
19470         * jit/JIT.h:
19471         (JIT):
19472         * jit/JITDisassembler.cpp:
19473         (JSC::JITDisassembler::dump):
19474         (JSC::JITDisassembler::reportToProfiler):
19475         (JSC):
19476         (JSC::JITDisassembler::dumpHeader):
19477         (JSC::JITDisassembler::firstSlowLabel):
19478         (JSC::JITDisassembler::dumpVectorForInstructions):
19479         (JSC::JITDisassembler::dumpForInstructions):
19480         (JSC::JITDisassembler::reportInstructions):
19481         * jit/JITDisassembler.h:
19482         (JITDisassembler):
19483         (DumpedOp):
19484         * jsc.cpp:
19485         (CommandLine::CommandLine):
19486         (CommandLine):
19487         (printUsageStatement):
19488         (CommandLine::parseArguments):
19489         (jscmain):
19490         * profiler/ProfilerBytecode.cpp: Added.
19491         (Profiler):
19492         (JSC::Profiler::Bytecode::toJS):
19493         * profiler/ProfilerBytecode.h: Added.
19494         (Profiler):
19495         (Bytecode):
19496         (JSC::Profiler::Bytecode::Bytecode):
19497         (JSC::Profiler::Bytecode::bytecodeIndex):
19498         (JSC::Profiler::Bytecode::description):
19499         (JSC::Profiler::getBytecodeIndexForBytecode):
19500         * profiler/ProfilerBytecodes.cpp: Added.
19501         (Profiler):
19502         (JSC::Profiler::Bytecodes::Bytecodes):
19503         (JSC::Profiler::Bytecodes::~Bytecodes):
19504         (JSC::Profiler::Bytecodes::indexForBytecodeIndex):
19505         (JSC::Profiler::Bytecodes::forBytecodeIndex):
19506         (JSC::Profiler::Bytecodes::dump):
19507         (JSC::Profiler::Bytecodes::toJS):
19508         * profiler/ProfilerBytecodes.h: Added.
19509         (Profiler):
19510         (Bytecodes):
19511         (JSC::Profiler::Bytecodes::append):
19512         (JSC::Profiler::Bytecodes::id):
19513         (JSC::Profiler::Bytecodes::hash):
19514         (JSC::Profiler::Bytecodes::size):
19515         (JSC::Profiler::Bytecodes::at):
19516         * profiler/ProfilerCompilation.cpp: Added.
19517         (Profiler):
19518         (JSC::Profiler::Compilation::Compilation):
19519         (JSC::Profiler::Compilation::~Compilation):
19520         (JSC::Profiler::Compilation::addDescription):
19521         (JSC::Profiler::Compilation::executionCounterFor):
19522         (JSC::Profiler::Compilation::toJS):
19523         * profiler/ProfilerCompilation.h: Added.
19524         (Profiler):
19525         (Compilation):
19526         (JSC::Profiler::Compilation::bytecodes):
19527         (JSC::Profiler::Compilation::kind):
19528         * profiler/ProfilerCompilationKind.cpp: Added.
19529         (WTF):
19530         (WTF::printInternal):
19531         * profiler/ProfilerCompilationKind.h: Added.
19532         (Profiler):
19533         (WTF):
19534         * profiler/ProfilerCompiledBytecode.cpp: Added.
19535         (Profiler):
19536         (JSC::Profiler::CompiledBytecode::CompiledBytecode):
19537         (JSC::Profiler::CompiledBytecode::~CompiledBytecode):
19538         (JSC::Profiler::CompiledBytecode::toJS):
19539         * profiler/ProfilerCompiledBytecode.h: Added.
19540         (Profiler):
19541         (CompiledBytecode):
19542         (JSC::Profiler::CompiledBytecode::originStack):
19543         (JSC::Profiler::CompiledBytecode::description):
19544         * profiler/ProfilerDatabase.cpp: Added.
19545         (Profiler):
19546         (JSC::Profiler::Database::Database):
19547         (JSC::Profiler::Database::~Database):
19548         (JSC::Profiler::Database::addBytecodes):
19549         (JSC::Profiler::Database::ensureBytecodesFor):
19550         (JSC::Profiler::Database::notifyDestruction):
19551         (JSC::Profiler::Database::newCompilation):
19552         (JSC::Profiler::Database::toJS):
19553         (JSC::Profiler::Database::toJSON):
19554         (JSC::Profiler::Database::save):
19555         * profiler/ProfilerDatabase.h: Added.
19556         (Profiler):
19557         (Database):
19558         * profiler/ProfilerExecutionCounter.h: Added.
19559         (Profiler):
19560         (ExecutionCounter):
19561         (JSC::Profiler::ExecutionCounter::ExecutionCounter):
19562         (JSC::Profiler::ExecutionCounter::address):
19563         (JSC::Profiler::ExecutionCounter::count):
19564         * profiler/ProfilerOrigin.cpp: Added.
19565         (Profiler):
19566         (JSC::Profiler::Origin::Origin):
19567         (JSC::Profiler::Origin::dump):
19568         (JSC::Profiler::Origin::toJS):
19569         * profiler/ProfilerOrigin.h: Added.
19570         (JSC):
19571         (Profiler):
19572         (Origin):
19573         (JSC::Profiler::Origin::Origin):
19574         (JSC::Profiler::Origin::operator!):
19575         (JSC::Profiler::Origin::bytecodes):
19576         (JSC::Profiler::Origin::bytecodeIndex):
19577         (JSC::Profiler::Origin::operator!=):
19578         (JSC::Profiler::Origin::operator==):
19579         (JSC::Profiler::Origin::hash):
19580         (JSC::Profiler::Origin::isHashTableDeletedValue):
19581         (JSC::Profiler::OriginHash::hash):
19582         (JSC::Profiler::OriginHash::equal):
19583         (OriginHash):
19584         (WTF):
19585         * profiler/ProfilerOriginStack.cpp: Added.
19586         (Profiler):
19587         (JSC::Profiler::OriginStack::OriginStack):
19588         (JSC::Profiler::OriginStack::~OriginStack):
19589         (JSC::Profiler::OriginStack::append):
19590         (JSC::Profiler::OriginStack::operator==):
19591         (JSC::Profiler::OriginStack::hash):
19592         (JSC::Profiler::OriginStack::dump):
19593         (JSC::Profiler::OriginStack::toJS):
19594         * profiler/ProfilerOriginStack.h: Added.
19595         (JSC):
19596         (Profiler):
19597         (OriginStack):
19598         (JSC::Profiler::OriginStack::OriginStack):
19599         (JSC::Profiler::OriginStack::operator!):
19600         (JSC::Profiler::OriginStack::size):
19601         (JSC::Profiler::OriginStack::fromBottom):
19602         (JSC::Profiler::OriginStack::fromTop):
19603         (JSC::Profiler::OriginStack::isHashTableDeletedValue):
19604         (JSC::Profiler::OriginStackHash::hash):
19605         (JSC::Profiler::OriginStackHash::equal):
19606         (OriginStackHash):
19607         (WTF):
19608         * runtime/CommonIdentifiers.h:
19609         * runtime/ExecutionHarness.h:
19610         (JSC::prepareForExecution):
19611         (JSC::prepareFunctionForExecution):
19612         * runtime/JSGlobalData.cpp:
19613         (JSC::JSGlobalData::JSGlobalData):
19614         (JSC::JSGlobalData::~JSGlobalData):
19615         * runtime/JSGlobalData.h:
19616         (JSGlobalData):
19617         * runtime/Options.h:
19618         (JSC):
19619
19620 2012-12-04  Filip Pizlo  <fpizlo@apple.com>
19621
19622         Rename Profiler to LegacyProfiler
19623         https://bugs.webkit.org/show_bug.cgi?id=104031
19624
19625         Rubber stamped by Mark Hahnenberg
19626
19627         Make room in the namespace for https://bugs.webkit.org/show_bug.cgi?id=102999.
19628
19629         * API/JSProfilerPrivate.cpp:
19630         (JSStartProfiling):
19631         (JSEndProfiling):
19632         * CMakeLists.txt:
19633         * GNUmakefile.list.am:
19634         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
19635         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
19636         * JavaScriptCore.xcodeproj/project.pbxproj:
19637         * Target.pri:
19638         * interpreter/Interpreter.cpp:
19639         (JSC::Interpreter::throwException):
19640         (JSC::Interpreter::execute):
19641         (JSC::Interpreter::executeCall):
19642         (JSC::Interpreter::executeConstruct):
19643         * jit/JIT.h:
19644         * jit/JITCode.h:
19645         * jit/JITStubs.cpp:
19646         (JSC::DEFINE_STUB_FUNCTION):
19647         * jit/JITStubs.h:
19648         (JSC):
19649         * llint/LLIntSlowPaths.cpp:
19650         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
19651         * profiler/LegacyProfiler.cpp: Added.
19652         (JSC):
19653         (JSC::LegacyProfiler::profiler):
19654         (JSC::LegacyProfiler::startProfiling):
19655         (JSC::LegacyProfiler::stopProfiling):
19656         (JSC::dispatchFunctionToProfiles):
19657         (JSC::LegacyProfiler::willExecute):
19658         (JSC::LegacyProfiler::didExecute):
19659         (JSC::LegacyProfiler::exceptionUnwind):
19660         (JSC::LegacyProfiler::createCallIdentifier):
19661         (JSC::createCallIdentifierFromFunctionImp):
19662         * profiler/LegacyProfiler.h: Added.
19663         (JSC):
19664         (LegacyProfiler):
19665         (JSC::LegacyProfiler::currentProfiles):
19666         * profiler/ProfileGenerator.cpp:
19667         (JSC::ProfileGenerator::addParentForConsoleStart):
19668         * profiler/ProfileNode.cpp:
19669         * profiler/Profiler.cpp: Removed.
19670         * profiler/Profiler.h: Removed.
19671         * runtime/JSGlobalData.h:
19672         (JSC):
19673         (JSC::JSGlobalData::enabledProfiler):
19674         (JSGlobalData):
19675         * runtime/JSGlobalObject.cpp:
19676         (JSC::JSGlobalObject::~JSGlobalObject):
19677
19678 2012-12-03  Filip Pizlo  <fpizlo@apple.com>
19679
19680         DFG should inline code blocks that use scoped variable access
19681         https://bugs.webkit.org/show_bug.cgi?id=103974
19682
19683         Reviewed by Oliver Hunt.
19684
19685         This mostly just turns on something we could have done all along, but also adds a few key
19686         necessities to make this right:
19687
19688         1) Constant folding of SkipScope, since if we inline with a known JSFunction* then the
19689            scope is constant.
19690
19691         2) Interference analysis for GetLocal<->PutScopedVar and SetLocal<->GetScopedVar.
19692
19693         This is not meant to be a speed-up on major benchmarks since we don't yet inline most
19694         closure calls for entirely unrelated reasons. But on toy programs it can be >2x faster.
19695
19696         * dfg/DFGAbstractState.cpp:
19697         (JSC::DFG::AbstractState::execute):
19698         * dfg/DFGByteCodeParser.cpp:
19699         (JSC::DFG::ByteCodeParser::getScope):
19700         (JSC::DFG::ByteCodeParser::parseResolveOperations):
19701         * dfg/DFGCSEPhase.cpp:
19702         (JSC::DFG::CSEPhase::scopedVarLoadElimination):
19703         (JSC::DFG::CSEPhase::scopedVarStoreElimination):
19704         (JSC::DFG::CSEPhase::getLocalLoadElimination):
19705         (JSC::DFG::CSEPhase::setLocalStoreElimination):
19706         * dfg/DFGCapabilities.h:
19707         (JSC::DFG::canInlineResolveOperations):
19708
19709 2012-12-03  Filip Pizlo  <fpizlo@apple.com>
19710
19711         Replace JSValue::description() with JSValue::dump(PrintStream&)
19712         https://bugs.webkit.org/show_bug.cgi?id=103866
19713
19714         Reviewed by Darin Adler.
19715
19716         JSValue now has a dump() method. Anywhere that you would have wanted to use
19717         description(), you can either do toCString(value).data(), or if the callee
19718         is a print()/dataLog() method then you just pass the value directly.
19719
19720         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
19721         * bytecode/CodeBlock.cpp:
19722         (JSC::valueToSourceString):
19723         (JSC::CodeBlock::finalizeUnconditionally):
19724         * bytecode/ValueProfile.h:
19725         (JSC::ValueProfileBase::dump):
19726         * bytecode/ValueRecovery.h:
19727         (JSC::ValueRecovery::dump):
19728         * dfg/DFGAbstractValue.h:
19729         (JSC::DFG::AbstractValue::dump):
19730         * dfg/DFGGraph.cpp:
19731         (JSC::DFG::Graph::dump):
19732         * interpreter/Interpreter.cpp:
19733         (JSC::Interpreter::dumpRegisters):
19734         * jsc.cpp:
19735         (functionDescribe):
19736         * llint/LLIntSlowPaths.cpp:
19737         (JSC::LLInt::llint_trace_value):
19738         * runtime/JSValue.cpp:
19739         (JSC::JSValue::dump):
19740         * runtime/JSValue.h:
19741
19742 2012-12-04  Filip Pizlo  <fpizlo@apple.com>
19743
19744         jsc command line tool's support for typed arrays should be robust against array buffer allocation errors
19745         https://bugs.webkit.org/show_bug.cgi?id=104020
19746         <rdar://problem/12802478>
19747
19748         Reviewed by Mark Hahnenberg.
19749
19750         Check for null buffers, since that's what typed array allocators are supposed to do. WebCore does it,
19751         and that is indeed the contract of ArrayBuffer and TypedArrayBase.
19752
19753         * JSCTypedArrayStubs.h:
19754         (JSC):
19755
19756 2012-12-03  Peter Rybin  <prybin@chromium.org>
19757
19758         Web Inspector: make ASSERTION FAILED: foundPropertiesCount == object->size() more useful
19759         https://bugs.webkit.org/show_bug.cgi?id=103254
19760
19761         Reviewed by Pavel Feldman.
19762
19763         Missing symbol WTFReportFatalError is added to the linker list.
19764
19765         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
19766
19767 2012-12-03  Alexis Menard  <alexis@webkit.org>
19768
19769         [Mac] Enable CSS3 background-position offset by default.
19770         https://bugs.webkit.org/show_bug.cgi?id=103905
19771
19772         Reviewed by Simon Fraser.
19773
19774         Turn the flag on by default.
19775
19776         * Configurations/FeatureDefines.xcconfig:
19777
19778 2012-12-02  Filip Pizlo  <fpizlo@apple.com>
19779
19780         DFG should trigger rage conversion from double to contiguous if it sees a GetByVal on Double being used in an integer context
19781         https://bugs.webkit.org/show_bug.cgi?id=103858
19782
19783         Reviewed by Gavin Barraclough.
19784
19785         A rage conversion from double to contiguous is one where you try to convert each
19786         double to an int32.
19787
19788         This is probably not the last we'll hear of rage conversion from double to contiguous.
19789         It may be better to do this right during parsing, which will result in fewer cases of
19790         Arrayification. But even so, this looks like a straight win already - 1% speed-up on
19791         Kraken, no major regression anywhere else.
19792
19793         * dfg/DFGAbstractState.cpp:
19794         (JSC::DFG::AbstractState::execute):
19795         * dfg/DFGArrayMode.cpp:
19796         (JSC::DFG::ArrayMode::refine):
19797         (JSC::DFG::arrayConversionToString):
19798         (JSC::DFG::ArrayMode::dump):
19799         (WTF):
19800         (WTF::printInternal):
19801         * dfg/DFGArrayMode.h:
19802         (JSC::DFG::ArrayMode::withConversion):
19803         (ArrayMode):
19804         (JSC::DFG::ArrayMode::doesConversion):
19805         (WTF):
19806         * dfg/DFGFixupPhase.cpp:
19807         (JSC::DFG::FixupPhase::fixupBlock):
19808         (JSC::DFG::FixupPhase::fixupNode):
19809         (JSC::DFG::FixupPhase::checkArray):
19810         (FixupPhase):
19811         * dfg/DFGGraph.cpp:
19812         (JSC::DFG::Graph::dump):
19813         * dfg/DFGNodeFlags.h:
19814         (DFG):
19815         * dfg/DFGOperations.cpp:
19816         * dfg/DFGOperations.h:
19817         * dfg/DFGPredictionPropagationPhase.cpp:
19818         (JSC::DFG::PredictionPropagationPhase::propagate):
19819         * dfg/DFGSpeculativeJIT.cpp:
19820         (JSC::DFG::SpeculativeJIT::arrayify):
19821         * dfg/DFGStructureCheckHoistingPhase.cpp:
19822         (JSC::DFG::StructureCheckHoistingPhase::run):
19823         * runtime/JSObject.cpp:
19824         (JSC):
19825         (JSC::JSObject::genericConvertDoubleToContiguous):
19826         (JSC::JSObject::convertDoubleToContiguous):
19827         (JSC::JSObject::rageConvertDoubleToContiguous):
19828         (JSC::JSObject::ensureContiguousSlow):
19829         (JSC::JSObject::rageEnsureContiguousSlow):
19830         * runtime/JSObject.h:
19831         (JSObject):
19832         (JSC::JSObject::rageEnsureContiguous):
19833
19834 2012-12-02  Filip Pizlo  <fpizlo@apple.com>
19835
19836         DFG CSE should not keep alive things that aren't relevant to OSR
19837         https://bugs.webkit.org/show_bug.cgi?id=103849
19838
19839         Reviewed by Oliver Hunt.
19840
19841         Most Phantom nodes are inserted by CSE, and by default have the same children as the
19842         node that CSE had eliminated. This change makes CSE inspect all Phantom nodes (both
19843         those it creates and those that were created by other phases) to see if they have
19844         children that are redundant - i.e. children that are not interesting to OSR, which
19845         is the only reason why Phantoms exist in the first place. Being relevant to OSR is
19846         defined as one of: (1) you're a Phi, (2) you're a SetLocal, (3) somewhere between
19847         your definition and the Phantom there was a SetLocal that referred to you.
19848
19849         This is a slight speed-up in a few places.
19850
19851         * dfg/DFGCSEPhase.cpp:
19852         (JSC::DFG::CSEPhase::CSEPhase):
19853         (JSC::DFG::CSEPhase::run):
19854         (JSC::DFG::CSEPhase::performSubstitution):
19855         (CSEPhase):
19856         (JSC::DFG::CSEPhase::eliminateIrrelevantPhantomChildren):
19857         (JSC::DFG::CSEPhase::setReplacement):
19858         (JSC::DFG::CSEPhase::eliminate):
19859         (JSC::DFG::CSEPhase::performNodeCSE):
19860         (JSC::DFG::CSEPhase::performBlockCSE):
19861
19862 2012-12-02  Filip Pizlo  <fpizlo@apple.com>
19863
19864         It should be possible to build and run with DFG_ENABLE(PROPAGATION_VERBOSE)
19865         https://bugs.webkit.org/show_bug.cgi?id=103848
19866
19867         Reviewed by Sam Weinig.
19868
19869         Fix random dataLog() and print() statements.
19870
19871         * dfg/DFGArgumentsSimplificationPhase.cpp:
19872         (JSC::DFG::ArgumentsSimplificationPhase::run):
19873         * dfg/DFGByteCodeParser.cpp:
19874         (JSC::DFG::ByteCodeParser::parseCodeBlock):
19875         * dfg/DFGGraph.cpp:
19876         (JSC::DFG::Graph::dumpBlockHeader):
19877         * dfg/DFGPredictionPropagationPhase.cpp:
19878         (JSC::DFG::PredictionPropagationPhase::propagate):
19879         * dfg/DFGStructureCheckHoistingPhase.cpp:
19880         (JSC::DFG::StructureCheckHoistingPhase::run):
19881
19882 2012-12-01  Filip Pizlo  <fpizlo@apple.com>
19883
19884         CodeBlock should be able to dump bytecode to something other than WTF::dataFile()
19885         https://bugs.webkit.org/show_bug.cgi?id=103832
19886
19887         Reviewed by Oliver Hunt.
19888
19889         Add a PrintStream& argument to all of the CodeBlock bytecode dumping methods.
19890
19891         * bytecode/CodeBlock.cpp:
19892         (JSC::CodeBlock::dumpBytecodeCommentAndNewLine):
19893         (JSC::CodeBlock::printUnaryOp):
19894         (JSC::CodeBlock::printBinaryOp):
19895         (JSC::CodeBlock::printConditionalJump):
19896         (JSC::CodeBlock::printGetByIdOp):
19897         (JSC::dumpStructure):
19898         (JSC::dumpChain):
19899         (JSC::CodeBlock::printGetByIdCacheStatus):
19900         (JSC::CodeBlock::printCallOp):
19901         (JSC::CodeBlock::printPutByIdOp):
19902         (JSC::CodeBlock::printStructure):
19903         (JSC::CodeBlock::printStructures):
19904         (JSC::CodeBlock::dumpBytecode):
19905         * bytecode/CodeBlock.h:
19906         (CodeBlock):
19907         * jit/JITDisassembler.cpp:
19908         (JSC::JITDisassembler::dumpForInstructions):
19909
19910 2012-11-30  Pierre Rossi  <pierre.rossi@gmail.com>
19911
19912         [Qt] Unreviewed speculative Mac build fix after r136232
19913
19914         Update the include path so that LLIntAssembly.h is picked up.
19915         The bot didn't break until later when a clean build was triggered.
19916
19917         * JavaScriptCore.pri:
19918
19919 2012-11-30  Oliver Hunt  <oliver@apple.com>
19920
19921         Optimise more cases of op_typeof
19922         https://bugs.webkit.org/show_bug.cgi?id=103783
19923
19924         Reviewed by Mark Hahnenberg.
19925
19926         Increase our coverage of typeof based typechecks by
19927         making sure that the codegenerators always uses
19928         consistent operand ordering when feeding typeof operations
19929         into equality operations.
19930
19931         * bytecompiler/NodesCodegen.cpp:
19932         (JSC::BinaryOpNode::emitBytecode):
19933         (JSC::EqualNode::emitBytecode):
19934         (JSC::StrictEqualNode::emitBytecode):
19935
19936 2012-11-30  Filip Pizlo  <fpizlo@apple.com>
19937
19938         Rationalize and clean up DFG handling of scoped accesses
19939         https://bugs.webkit.org/show_bug.cgi?id=103715
19940
19941         Reviewed by Oliver Hunt.
19942
19943         Previously, we had a GetScope node that specified the depth to which you wanted
19944         to travel to get a JSScope, and the backend implementation of the node would
19945         perform all of the necessary footwork, including potentially skipping the top
19946         scope if necessary, and doing however many loads were needed. But there were
19947         strange things. First, if you had accesses at different scope depths, then the
19948         loads to get to the common depth could not be CSE'd - CSE would match only
19949         GetScope's that had identical depth. Second, GetScope would be emitted even if
19950         we already had the scope, for example in put_to_base. And finally, even though
19951         the ResolveOperations could tell us whether or not we had to skip the top scope,
19952         the backend would recompute this information itself, often pessimistically.
19953
19954         This eliminates GetScope and replaces it with the following:
19955
19956         GetMyScope: just get the JSScope from the call frame header. This will forever
19957         mean getting the JSScope associated with the machine call frame; it will not
19958         mean getting the scope of an inlined function. Or at least that's the intent.
19959
19960         SkipTopScope: check if there is an activation, and if so, skip a scope. This
19961         takes a scope as a child and returns a scope.
19962
19963         SkipScope: skip one scope level.
19964
19965         The bytecode parser now emits the right combination of the above, and
19966         potentially emits multiple SkipScope's, based on the ResolveOperations.
19967
19968         This change also includes some fixups to debug logging. We now always print
19969         the ExecutableBase* in addition to the CodeBlock* in the CodeBlock's dump,
19970         and we are now more verbose when dumping CodeOrigins and InlineCallFrames.
19971
19972         This is performance-neutral. It's just meant to be a clean-up.
19973
19974         * bytecode/CodeBlock.cpp:
19975         (JSC::CodeBlock::dumpAssumingJITType):
19976         * bytecode/CodeOrigin.cpp:
19977         (JSC::CodeOrigin::inlineStack):
19978         (JSC::CodeOrigin::dump):
19979         (JSC):
19980         (JSC::InlineCallFrame::dump):
19981         * bytecode/CodeOrigin.h:
19982         (CodeOrigin):
19983         (InlineCallFrame):
19984         * dfg/DFGAbstractState.cpp:
19985         (JSC::DFG::AbstractState::execute):
19986         * dfg/DFGByteCodeParser.cpp:
19987         (ByteCodeParser):
19988         (JSC::DFG::ByteCodeParser::getScope):
19989         (DFG):
19990         (JSC::DFG::ByteCodeParser::parseResolveOperations):
19991         (JSC::DFG::ByteCodeParser::parseBlock):
19992         * dfg/DFGCSEPhase.cpp:
19993         (JSC::DFG::CSEPhase::scopedVarLoadElimination):
19994         (JSC::DFG::CSEPhase::scopedVarStoreElimination):
19995         (JSC::DFG::CSEPhase::getMyScopeLoadElimination):
19996         (JSC::DFG::CSEPhase::setLocalStoreElimination):
19997         (JSC::DFG::CSEPhase::performNodeCSE):
19998         * dfg/DFGDisassembler.cpp:
19999         (JSC::DFG::Disassembler::dump):
20000         * dfg/DFGGraph.cpp:
20001         (JSC::DFG::Graph::dumpCodeOrigin):
20002         (JSC::DFG::Graph::dumpBlockHeader):
20003         * dfg/DFGNode.h:
20004         (Node):
20005         * dfg/DFGNodeType.h:
20006         (DFG):
20007         * dfg/DFGPredictionPropagationPhase.cpp:
20008         (JSC::DFG::PredictionPropagationPhase::propagate):
20009         * dfg/DFGSpeculativeJIT32_64.cpp:
20010         (JSC::DFG::SpeculativeJIT::compile):
20011         * dfg/DFGSpeculativeJIT64.cpp:
20012         (JSC::DFG::SpeculativeJIT::compile):
20013         * jit/JITDisassembler.cpp:
20014         (JSC::JITDisassembler::dump):
20015
20016 2012-11-30  Oliver Hunt  <oliver@apple.com>
20017
20018         Add direct string->function code cache
20019         https://bugs.webkit.org/show_bug.cgi?id=103764
20020
20021         Reviewed by Michael Saboff.
20022
20023         A fairly logically simple patch.  We now track the start of the
20024         unique portion of a functions body, and use that as our key for
20025         unlinked function code.  This allows us to cache identical code
20026         in different contexts, leading to a small but consistent improvement
20027         on the benchmarks we track.
20028
20029         * bytecode/UnlinkedCodeBlock.cpp:
20030         (JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
20031         * bytecode/UnlinkedCodeBlock.h:
20032         (JSC::UnlinkedFunctionExecutable::functionStartOffset):
20033         (UnlinkedFunctionExecutable):
20034         * parser/ASTBuilder.h:
20035         (ASTBuilder):
20036         (JSC::ASTBuilder::setFunctionStart):
20037         * parser/Nodes.cpp:
20038         * parser/Nodes.h:
20039         (JSC::FunctionBodyNode::setFunctionStart):
20040         (JSC::FunctionBodyNode::functionStart):
20041         (FunctionBodyNode):
20042         * parser/Parser.cpp:
20043         (JSC::::parseFunctionInfo):
20044         * parser/Parser.h:
20045         (JSC::Parser::findCachedFunctionInfo):
20046         * parser/SyntaxChecker.h:
20047         (JSC::SyntaxChecker::setFunctionStart):
20048         * runtime/CodeCache.cpp:
20049         (JSC::CodeCache::generateFunctionCodeBlock):
20050         (JSC::CodeCache::getFunctionCodeBlock):
20051         (JSC::CodeCache::usedFunctionCode):
20052         * runtime/CodeCache.h:
20053
20054 2012-11-30  Allan Sandfeld Jensen  <allan.jensen@digia.com>
20055
20056         Crash in conversion of empty OpaqueJSString to Identifier
20057         https://bugs.webkit.org/show_bug.cgi?id=101867
20058
20059         Reviewed by Michael Saboff.
20060
20061         The constructor call used for both null and empty OpaqueJSStrings results
20062         in an assertion voilation and crash. This patch instead uses the Identifier
20063         constructors which are specifically for null and empty Identifier.
20064
20065         * API/OpaqueJSString.cpp:
20066         (OpaqueJSString::identifier):
20067
20068 2012-11-30  Tor Arne Vestbø  <tor.arne.vestbo@digia.com>
20069
20070         [Qt] Place the LLIntOffsetsExtractor binaries in debug/release subdirs on Mac
20071
20072         Otherwise we'll end up using the same LLIntAssembly.h for both build
20073         configs of JavaScriptCore -- one of them which will be for the wrong
20074         config.
20075
20076         Reviewed by Simon Hausmann.
20077
20078         * LLIntOffsetsExtractor.pro:
20079
20080 2012-11-30  Julien BRIANCEAU   <jbrianceau@nds.com>
20081
20082         [sh4] Fix compilation warnings in JavaScriptCore JIT for sh4 arch
20083         https://bugs.webkit.org/show_bug.cgi?id=103378
20084
20085         Reviewed by Filip Pizlo.
20086
20087         * assembler/MacroAssemblerSH4.h:
20088         (JSC::MacroAssemblerSH4::branchTest32):
20089         (JSC::MacroAssemblerSH4::branchAdd32):
20090         (JSC::MacroAssemblerSH4::branchMul32):
20091         (JSC::MacroAssemblerSH4::branchSub32):
20092         (JSC::MacroAssemblerSH4::branchOr32):
20093
20094 2012-11-29  Rafael Weinstein  <rafaelw@chromium.org>
20095
20096         [HTMLTemplateElement] Add feature flag
20097         https://bugs.webkit.org/show_bug.cgi?id=103694
20098
20099         Reviewed by Adam Barth.
20100
20101         This flag will guard the implementation of the HTMLTemplateElement.
20102         http://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/templates/index.html
20103
20104         * Configurations/FeatureDefines.xcconfig:
20105
20106 2012-11-29  Filip Pizlo  <fpizlo@apple.com>
20107
20108         It should be easy to find code blocks in debug dumps
20109         https://bugs.webkit.org/show_bug.cgi?id=103623
20110
20111         Reviewed by Goeffrey Garen.
20112
20113         This gives CodeBlock a relatively strong, but also relatively compact, hash. We compute
20114         it lazily so that it only impacts run-time when debug support is enabled. We stringify
20115         it smartly so that it's short and easy to type. We base it on the source code so that
20116         the optimization level is irrelevant. And, we use SHA1 since it's already in our code
20117         base. Now, when a piece of code wants to print some debugging to say that it's operating
20118         on some code block, it can use this CodeBlockHash instead of memory addresses.
20119
20120         This also takes CodeBlock debugging into the new world of print() and dataLog(). In
20121         particular, CodeBlock::dump() corresponds to the thing you want printed if you do:
20122
20123         dataLog("I heart ", *myCodeBlock);
20124
20125         Probably, you want to just print some identifying information at this point rather than
20126         the full bytecode dump. So, the existing CodeBlock::dump() has been renamed to
20127         CodeBlock::dumpBytecode(), and CodeBlock::dump() now prints the CodeBlockHash plus just
20128         a few little tidbits.
20129
20130         Here's an example of CodeBlock::dump() output:
20131
20132         EkILzr:[0x103883a00, BaselineFunctionCall]
20133
20134         EkILzr is the CodeBlockHash. 0x103883a00 is the CodeBlock's address in memory. The other
20135         part is self-explanatory.
20136
20137         Finally, this new notion of CodeBlockHash is available for other purposes like bisecting
20138         breakage. As such CodeBlockHash has all of the comparison operator overloads. When
20139         bisecting in DFGDriver.cpp, you can now say things like:
20140
20141         if (codeBlock->hash() < CodeBlockHash("CAAAAA"))
20142             return false;
20143
20144         And yes, CAAAAA is near the median hash, and the largest one is smaller than E99999. Such
20145         is life when you use base 62 to encode a 32-bit number.
20146
20147         * CMakeLists.txt:
20148         * GNUmakefile.list.am:
20149         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
20150         * JavaScriptCore.xcodeproj/project.pbxproj:
20151         * Target.pri:
20152         * bytecode/CallLinkInfo.h:
20153         (CallLinkInfo):
20154         (JSC::CallLinkInfo::specializationKind):
20155         * bytecode/CodeBlock.cpp:
20156         (JSC::CodeBlock::hash):
20157         (JSC):
20158         (JSC::CodeBlock::dumpAssumingJITType):
20159         (JSC::CodeBlock::dump):
20160         (JSC::CodeBlock::dumpBytecode):
20161         (JSC::CodeBlock::CodeBlock):
20162         (JSC::CodeBlock::finalizeUnconditionally):
20163         (JSC::CodeBlock::resetStubInternal):
20164         (JSC::CodeBlock::reoptimize):
20165         (JSC::ProgramCodeBlock::jettison):
20166         (JSC::EvalCodeBlock::jettison):
20167         (JSC::FunctionCodeBlock::jettison):
20168         (JSC::CodeBlock::shouldOptimizeNow):
20169         (JSC::CodeBlock::tallyFrequentExitSites):
20170         (JSC::CodeBlock::dumpValueProfiles):
20171         * bytecode/CodeBlock.h:
20172         (JSC::CodeBlock::specializationKind):
20173         (CodeBlock):
20174         (JSC::CodeBlock::getJITType):
20175         * bytecode/CodeBlockHash.cpp: Added.
20176         (JSC):
20177         (JSC::CodeBlockHash::CodeBlockHash):
20178         (JSC::CodeBlockHash::dump):
20179         * bytecode/CodeBlockHash.h: Added.
20180         (JSC):
20181         (CodeBlockHash):
20182         (JSC::CodeBlockHash::CodeBlockHash):
20183         (JSC::CodeBlockHash::hash):
20184         (JSC::CodeBlockHash::operator==):
20185         (JSC::CodeBlockHash::operator!=):
20186         (JSC::CodeBlockHash::operator<):
20187         (JSC::CodeBlockHash::operator>):
20188         (JSC::CodeBlockHash::operator<=):
20189         (JSC::CodeBlockHash::operator>=):
20190         * bytecode/CodeBlockWithJITType.h: Added.
20191         (JSC):
20192         (CodeBlockWithJITType):
20193         (JSC::CodeBlockWithJITType::CodeBlockWithJITType):
20194         (JSC::CodeBlockWithJITType::dump):
20195         * bytecode/CodeOrigin.cpp: Added.
20196         (JSC):
20197         (JSC::CodeOrigin::inlineDepthForCallFrame):
20198         (JSC::CodeOrigin::inlineDepth):
20199         (JSC::CodeOrigin::inlineStack):
20200         (JSC::InlineCallFrame::hash):
20201         * bytecode/CodeOrigin.h:
20202         (InlineCallFrame):
20203         (JSC::InlineCallFrame::specializationKind):
20204         (JSC):
20205         * bytecode/CodeType.cpp: Added.
20206         (WTF):
20207         (WTF::printInternal):
20208         * bytecode/CodeType.h:
20209         (WTF):
20210         * bytecode/ExecutionCounter.cpp:
20211         (JSC::ExecutionCounter::dump):
20212         * bytecode/ExecutionCounter.h:
20213         (ExecutionCounter):
20214         * dfg/DFGByteCodeParser.cpp:
20215         (JSC::DFG::ByteCodeParser::parseCodeBlock):
20216         * dfg/DFGDisassembler.cpp:
20217         (JSC::DFG::Disassembler::dump):
20218         * dfg/DFGGraph.cpp:
20219         (JSC::DFG::Graph::dumpCodeOrigin):
20220         * dfg/DFGOSRExitCompiler.cpp:
20221         * dfg/DFGOperations.cpp:
20222         * dfg/DFGRepatch.cpp:
20223         (JSC::DFG::generateProtoChainAccessStub):
20224         (JSC::DFG::tryCacheGetByID):
20225         (JSC::DFG::tryBuildGetByIDList):
20226         (JSC::DFG::emitPutReplaceStub):
20227         (JSC::DFG::emitPutTransitionStub):
20228         (JSC::DFG::dfgLinkClosureCall):
20229         * interpreter/Interpreter.cpp:
20230         (JSC::Interpreter::dumpCallFrame):
20231         * jit/JITCode.cpp: Added.
20232         (WTF):
20233         (WTF::printInternal):
20234         * jit/JITCode.h:
20235         (JSC::JITCode::jitType):
20236         (WTF):
20237         * jit/JITDisassembler.cpp:
20238         (JSC::JITDisassembler::dump):
20239         (JSC::JITDisassembler::dumpForInstructions):
20240         * jit/JITPropertyAccess.cpp:
20241         (JSC::JIT::privateCompilePutByIdTransition):
20242         (JSC::JIT::privateCompilePatchGetArrayLength):
20243         (JSC::JIT::privateCompileGetByIdProto):
20244         (JSC::JIT::privateCompileGetByIdSelfList):
20245         (JSC::JIT::privateCompileGetByIdProtoList):
20246         (JSC::JIT::privateCompileGetByIdChainList):
20247         (JSC::JIT::privateCompileGetByIdChain):
20248         (JSC::JIT::privateCompileGetByVal):
20249         (JSC::JIT::privateCompilePutByVal):
20250         * jit/JITPropertyAccess32_64.cpp:
20251         (JSC::JIT::privateCompilePutByIdTransition):
20252         (JSC::JIT::privateCompilePatchGetArrayLength):
20253         (JSC::JIT::privateCompileGetByIdProto):
20254         (JSC::JIT::privateCompileGetByIdSelfList):
20255         (JSC::JIT::privateCompileGetByIdProtoList):
20256         (JSC::JIT::privateCompileGetByIdChainList):
20257         (JSC::JIT::privateCompileGetByIdChain):
20258         * jit/JITStubs.cpp:
20259         (JSC::DEFINE_STUB_FUNCTION):
20260         * runtime/CodeSpecializationKind.cpp: Added.
20261         (WTF):
20262         (WTF::printInternal):
20263         * runtime/CodeSpecializationKind.h:
20264         (JSC::specializationFromIsCall):
20265         (JSC):
20266         (JSC::specializationFromIsConstruct):
20267         (WTF):
20268         * runtime/Executable.cpp:
20269         (JSC::ExecutableBase::hashFor):
20270         (JSC):
20271         (JSC::NativeExecutable::hashFor):
20272         (JSC::ScriptExecutable::hashFor):
20273         * runtime/Executable.h:
20274         (ExecutableBase):
20275         (NativeExecutable):
20276         (ScriptExecutable):
20277         (JSC::ScriptExecutable::source):
20278
20279 2012-11-29  Michael Saboff  <msaboff@apple.com>
20280
20281         Speculative Windows build fix after r136086.
20282
20283         Unreviewed build fix.
20284
20285         Suspect that ?setDumpsGeneratedCode@BytecodeGenerator@JSC@@SAX_N@Z needs to be removed from Windows
20286         export list since the symbol was removed in r136086.
20287
20288         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
20289
20290 2012-11-28  Filip Pizlo  <fpizlo@apple.com>
20291
20292         SpeculatedType dumping should not use the static char buffer[thingy] idiom
20293         https://bugs.webkit.org/show_bug.cgi?id=103584
20294
20295         Reviewed by Michael Saboff.
20296
20297         Changed SpeculatedType to be "dumpable" by saying things like:
20298
20299         dataLog("thingy = ", SpeculationDump(thingy))
20300
20301         Removed the old stringification functions, and changed all code that referred to them
20302         to use the new dataLog()/print() style.
20303
20304         * CMakeLists.txt:
20305         * GNUmakefile.list.am:
20306         * JavaScriptCore.xcodeproj/project.pbxproj:
20307         * Target.pri:
20308         * bytecode/SpeculatedType.cpp:
20309         (JSC::dumpSpeculation):
20310         (JSC::speculationToAbbreviatedString):
20311         (JSC::dumpSpeculationAbbreviated):
20312         * bytecode/SpeculatedType.h:
20313         * bytecode/ValueProfile.h:
20314         (JSC::ValueProfileBase::dump):
20315         * bytecode/VirtualRegister.h:
20316         (WTF::printInternal):
20317         * dfg/DFGAbstractValue.h:
20318         (JSC::DFG::AbstractValue::dump):
20319         * dfg/DFGByteCodeParser.cpp:
20320         (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
20321         (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
20322         * dfg/DFGGraph.cpp:
20323         (JSC::DFG::Graph::dump):
20324         (JSC::DFG::Graph::predictArgumentTypes):
20325         * dfg/DFGGraph.h:
20326         (Graph):
20327         * dfg/DFGStructureAbstractValue.h:
20328         * dfg/DFGVariableAccessDataDump.cpp: Added.
20329         (JSC::DFG::VariableAccessDataDump::VariableAccessDataDump):
20330         (JSC::DFG::VariableAccessDataDump::dump):
20331         * dfg/DFGVariableAccessDataDump.h: Added.
20332         (VariableAccessDataDump):
20333
20334 2012-11-28  Michael Saboff  <msaboff@apple.com>
20335
20336         Change Bytecompiler s_dumpsGeneratedCode to an Options value
20337         https://bugs.webkit.org/show_bug.cgi?id=103588
20338
20339         Reviewed by Filip Pizlo.
20340
20341         Moved the control of dumping bytecodes to Options::dumpGeneratedBytecodes.
20342
20343         * bytecode/CodeBlock.cpp:
20344         (JSC::CodeBlock::CodeBlock):
20345         * bytecompiler/BytecodeGenerator.cpp:
20346         * bytecompiler/BytecodeGenerator.h:
20347         * jsc.cpp:
20348         (runWithScripts):
20349         * runtime/Options.h:
20350
20351 2012-11-28  Mark Hahnenberg  <mhahnenberg@apple.com>
20352
20353         Copying phase should use work lists
20354         https://bugs.webkit.org/show_bug.cgi?id=101390
20355
20356         Reviewed by Filip Pizlo.
20357
20358         * JavaScriptCore.xcodeproj/project.pbxproj:
20359         * heap/BlockAllocator.cpp:
20360         (JSC::BlockAllocator::BlockAllocator):
20361         * heap/BlockAllocator.h: New RegionSet for CopyWorkListSegments.
20362         (BlockAllocator):
20363         (JSC::CopyWorkListSegment):
20364         * heap/CopiedBlock.h: Added a per-block CopyWorkList to keep track of the JSCells that need to be revisited during the copying
20365         phase to copy their backing stores.
20366         (CopiedBlock):
20367         (JSC::CopiedBlock::CopiedBlock):
20368         (JSC::CopiedBlock::didSurviveGC):
20369         (JSC::CopiedBlock::didEvacuateBytes): There is now a one-to-one relationship between GCThreads and the CopiedBlocks they're
20370         responsible for evacuating, we no longer need any of that fancy compare and swap stuff.
20371         (JSC::CopiedBlock::pin):
20372         (JSC::CopiedBlock::hasWorkList):
20373         (JSC::CopiedBlock::workList):
20374         * heap/CopiedBlockInlines.h: Added.
20375         (JSC::CopiedBlock::reportLiveBytes): Since we now have to grab a SpinLock to perform operations on the CopyWorkList during marking,
20376         we don't need to do any of that fancy compare and swap stuff we were doing for tracking live bytes.
20377         * heap/CopiedSpace.h:
20378         (CopiedSpace):
20379         * heap/CopiedSpaceInlines.h:
20380         (JSC::CopiedSpace::pin):
20381         * heap/CopyVisitor.cpp:
20382         (JSC::CopyVisitor::copyFromShared): We now iterate over a range of CopiedBlocks rather than MarkedBlocks and revisit the cells in those
20383         blocks' CopyWorkLists.
20384         * heap/CopyVisitor.h:
20385         (CopyVisitor):
20386         * heap/CopyVisitorInlines.h:
20387         (JSC::CopyVisitor::visitCell): The function responsible for calling the correct copyBackingStore() function for each JSCell from
20388         a CopiedBlock's CopyWorkList.
20389         (JSC::CopyVisitor::didCopy): We no longer need to check if the block is empty here because we know exactly when we're done
20390         evacuating a CopiedBlock, which is when we've gone through all of the CopiedBlock's CopyWorkList.
20391         * heap/CopyWorkList.h: Added.
20392         (CopyWorkListSegment): Individual chunk of a CopyWorkList that is allocated from the BlockAllocator.
20393         (JSC::CopyWorkListSegment::create):
20394         (JSC::CopyWorkListSegment::size):
20395         (JSC::CopyWorkListSegment::isFull):
20396         (JSC::CopyWorkListSegment::get):
20397         (JSC::CopyWorkListSegment::append):
20398         (JSC::CopyWorkListSegment::CopyWorkListSegment):
20399         (JSC::CopyWorkListSegment::data):
20400         (JSC::CopyWorkListSegment::endOfBlock):
20401         (CopyWorkListIterator): Responsible for giving CopyVisitors a contiguous notion of access across the separate CopyWorkListSegments
20402         that make up each CopyWorkList.
20403         (JSC::CopyWorkListIterator::get):
20404         (JSC::CopyWorkListIterator::operator*):
20405         (JSC::CopyWorkListIterator::operator->):
20406         (JSC::CopyWorkListIterator::operator++):
20407         (JSC::CopyWorkListIterator::operator==):
20408         (JSC::CopyWorkListIterator::operator!=):
20409         (JSC::CopyWorkListIterator::CopyWorkListIterator):
20410         (CopyWorkList): Data structure that keeps track of the JSCells that need copying in a particular CopiedBlock.
20411         (JSC::CopyWorkList::CopyWorkList):
20412         (JSC::CopyWorkList::~CopyWorkList):
20413         (JSC::CopyWorkList::append):
20414         (JSC::CopyWorkList::begin):
20415         (JSC::CopyWorkList::end):
20416         * heap/GCThreadSharedData.cpp:
20417         (JSC::GCThreadSharedData::GCThreadSharedData): We no longer use the m_blockSnapshot from the Heap during the copying phase.
20418         (JSC::GCThreadSharedData::didStartCopying): We now copy the set of all blocks in the CopiedSpace to a separate vector for
20419         iterating over during the copying phase since the set stored in the CopiedSpace will change as blocks are evacuated and
20420         recycled throughout the copying phase.
20421         * heap/GCThreadSharedData.h:
20422         (GCThreadSharedData):
20423         * heap/Heap.h:
20424         (Heap):
20425         * heap/SlotVisitor.h: We now need to know the object who is being marked that has a backing store so that we can store it
20426         in a CopyWorkList to revisit later during the copying phase.
20427         * heap/SlotVisitorInlines.h:
20428         (JSC::SlotVisitor::copyLater):
20429         * runtime/JSObject.cpp:
20430         (JSC::JSObject::visitButterfly):
20431
20432 2012-11-28  Filip Pizlo  <fpizlo@apple.com>
20433
20434         Disassembly methods should be able to disassemble to any PrintStream& rather than always using WTF::dataFile()
20435         https://bugs.webkit.org/show_bug.cgi?id=103492
20436
20437         Reviewed by Mark Hahnenberg.
20438
20439         Switched disassembly code to use PrintStream&, and to use print() rather than printf().
20440
20441         * dfg/DFGDisassembler.cpp:
20442         (JSC::DFG::Disassembler::dump):
20443         (DFG):
20444         (JSC::DFG::Disassembler::dumpDisassembly):
20445         * dfg/DFGDisassembler.h:
20446         (Disassembler):
20447         * dfg/DFGGraph.cpp:
20448         (JSC::DFG::printWhiteSpace):
20449         (JSC::DFG::Graph::dumpCodeOrigin):
20450         (JSC::DFG::Graph::printNodeWhiteSpace):
20451         (JSC::DFG::Graph::dump):
20452         (DFG):
20453         (JSC::DFG::Graph::dumpBlockHeader):
20454         * dfg/DFGGraph.h:
20455         (Graph):
20456         * jit/JITDisassembler.cpp:
20457         (JSC::JITDisassembler::dump):
20458         (JSC::JITDisassembler::dumpForInstructions):
20459         (JSC::JITDisassembler::dumpDisassembly):
20460         * jit/JITDisassembler.h:
20461         (JITDisassembler):
20462
20463 2012-11-28  Filip Pizlo  <fpizlo@apple.com>
20464
20465         It should be possible to say dataLog("count = ", count, "\n") instead of dataLogF("count = %d\n", count)
20466         https://bugs.webkit.org/show_bug.cgi?id=103009
20467
20468         Reviewed by Michael Saboff.
20469
20470         Instead of converting all of JSC to use the new dataLog()/print() methods, I just changed
20471         one place: dumping of abstract values. This is mainly just to ensure that the code I
20472         added to WTF is actually doing things.
20473
20474         * bytecode/CodeBlock.cpp:
20475         (JSC::CodeBlock::dump):
20476         * dfg/DFGAbstractValue.h:
20477         (JSC::DFG::AbstractValue::dump):
20478         (WTF):
20479         (WTF::printInternal):
20480         * dfg/DFGStructureAbstractValue.h:
20481         (JSC::DFG::StructureAbstractValue::dump):
20482         (WTF):
20483         (WTF::printInternal):
20484
20485 2012-11-28  Oliver Hunt  <oliver@apple.com>
20486
20487         Make source cache include more information about the function extent.
20488         https://bugs.webkit.org/show_bug.cgi?id=103552
20489
20490         Reviewed by Gavin Barraclough.
20491
20492         Add a bit more information to the source cache.
20493
20494         * parser/Parser.cpp:
20495         (JSC::::parseFunctionInfo):
20496            Store the function start offset
20497         * parser/SourceProviderCacheItem.h:
20498         (JSC::SourceProviderCacheItem::SourceProviderCacheItem):
20499         (SourceProviderCacheItem):
20500            Add additional field for the start of the real function string, and re-arrange
20501            fields to avoid growing the struct.
20502
20503 2012-11-27  Filip Pizlo  <fpizlo@apple.com>
20504
20505         Convert some remaining uses of FILE* to PrintStream&.
20506
20507         Rubber stamped by Mark Hahnenberg.
20508
20509         * bytecode/ValueProfile.h:
20510         (JSC::ValueProfileBase::dump):
20511         * bytecode/ValueRecovery.h:
20512         (JSC::ValueRecovery::dump):
20513         * dfg/DFGByteCodeParser.cpp:
20514         (JSC::DFG::ByteCodeParser::parseCodeBlock):
20515         * dfg/DFGNode.h:
20516         (JSC::DFG::Node::dumpChildren):
20517
20518 2012-11-27  Filip Pizlo  <fpizlo@apple.com>
20519
20520         Fix indentation in JSValue.h
20521
20522         Rubber stamped by Mark Hahnenberg.
20523
20524         * runtime/JSValue.h:
20525
20526 2012-11-26  Filip Pizlo  <fpizlo@apple.com>
20527
20528         DFG SetLocal should use forwardSpeculationCheck instead of its own half-baked version of same
20529         https://bugs.webkit.org/show_bug.cgi?id=103353
20530
20531         Reviewed by Oliver Hunt and Gavin Barraclough.
20532
20533         Made it possible to use forward speculations for most of the operand classes. Changed the conditional
20534         direction parameter from being 'bool isForward' to an enum (SpeculationDirection). Changed SetLocal
20535         to use forward speculations and got rid of its half-baked version of same.
20536
20537         Also added the ability to force the DFG's disassembler to dump all nodes, even ones that are dead.
20538
20539         * dfg/DFGByteCodeParser.cpp:
20540         (JSC::DFG::ByteCodeParser::parseBlock):
20541         * dfg/DFGDisassembler.cpp:
20542         (JSC::DFG::Disassembler::dump):
20543         * dfg/DFGDriver.cpp:
20544         (JSC::DFG::compile):
20545         * dfg/DFGSpeculativeJIT.cpp:
20546         (JSC::DFG::SpeculativeJIT::speculationCheck):
20547         (DFG):
20548         (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
20549         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
20550         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
20551         (JSC::DFG::SpeculativeJIT::fillStorage):
20552         * dfg/DFGSpeculativeJIT.h:
20553         (SpeculativeJIT):
20554         (JSC::DFG::SpeculateIntegerOperand::SpeculateIntegerOperand):
20555         (JSC::DFG::SpeculateIntegerOperand::gpr):
20556         (SpeculateIntegerOperand):
20557         (JSC::DFG::SpeculateDoubleOperand::SpeculateDoubleOperand):
20558         (JSC::DFG::SpeculateDoubleOperand::fpr):
20559         (SpeculateDoubleOperand):
20560         (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
20561         (JSC::DFG::SpeculateCellOperand::gpr):
20562         (SpeculateCellOperand):
20563         (JSC::DFG::SpeculateBooleanOperand::SpeculateBooleanOperand):
20564         (JSC::DFG::SpeculateBooleanOperand::gpr):
20565         (SpeculateBooleanOperand):
20566         * dfg/DFGSpeculativeJIT32_64.cpp:
20567         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
20568         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
20569         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
20570         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
20571         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
20572         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
20573         (JSC::DFG::SpeculativeJIT::compile):
20574         * dfg/DFGSpeculativeJIT64.cpp:
20575         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
20576         (JSC::DFG::SpeculativeJIT::fillSpeculateInt):
20577         (JSC::DFG::SpeculativeJIT::fillSpeculateIntStrict):
20578         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
20579         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
20580         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
20581         (JSC::DFG::SpeculativeJIT::compile):
20582         * runtime/Options.h:
20583         (JSC):
20584
20585 2012-11-26  Daniel Bates  <dbates@webkit.org>
20586
20587         Substitute "allSeparators8Bit" for "allSeperators8Bit" in JSC::jsSpliceSubstringsWithSeparators()
20588         <https://bugs.webkit.org/show_bug.cgi?id=103303>
20589
20590         Reviewed by Simon Fraser.
20591
20592         Fix misspelled word, "Seperators" [sic], in a local variable name in JSC::jsSpliceSubstringsWithSeparators().
20593
20594         * runtime/StringPrototype.cpp:
20595         (JSC::jsSpliceSubstringsWithSeparators):
20596
20597 2012-11-26  Daniel Bates  <dbates@webkit.org>
20598
20599         JavaScript fails to handle String.replace() with large replacement string
20600         https://bugs.webkit.org/show_bug.cgi?id=102956
20601         <rdar://problem/12738012>
20602
20603         Reviewed by Oliver Hunt.
20604
20605         Fix an issue where we didn't check for overflow when computing the length
20606         of the result of String.replace() with a large replacement string.
20607
20608         * runtime/StringPrototype.cpp:
20609         (JSC::jsSpliceSubstringsWithSeparators):
20610
20611 2012-11-26  Zeno Albisser  <zeno@webkit.org>
20612
20613         [Qt] Fix the LLInt build on Mac
20614         https://bugs.webkit.org/show_bug.cgi?id=97587
20615
20616         Reviewed by Simon Hausmann.
20617
20618         * DerivedSources.pri:
20619         * JavaScriptCore.pro:
20620
20621 2012-11-26  Oliver Hunt  <oliver@apple.com>
20622
20623         32-bit build fix.  Move the method decalration outside of the X86_64 only section.
20624
20625         * assembler/MacroAssembler.h:
20626         (MacroAssembler):
20627         (JSC::MacroAssembler::shouldConsiderBlinding):
20628
20629 2012-11-26  Oliver Hunt  <oliver@apple.com>
20630
20631         Don't blind all the things.
20632         https://bugs.webkit.org/show_bug.cgi?id=102572
20633
20634         Reviewed by Gavin Barraclough.
20635
20636         No longer blind all the constants in the instruction stream.  We use a
20637         simple non-deterministic filter to avoid blinding everything.  Also modified
20638         the basic integer blinding logic to avoid blinding small negative values.
20639
20640         * assembler/MacroAssembler.h:
20641         (MacroAssembler):
20642         (JSC::MacroAssembler::shouldConsiderBlinding):
20643         (JSC::MacroAssembler::shouldBlind):
20644
20645 2012-11-26  Mark Hahnenberg  <mhahnenberg@apple.com>
20646
20647         JSObject::copyButterfly doesn't handle undecided indexing types correctly
20648         https://bugs.webkit.org/show_bug.cgi?id=102573
20649
20650         Reviewed by Filip Pizlo.
20651
20652         We don't do any copying into the newly allocated vector and we don't zero-initialize CopiedBlocks
20653         during the copying phase, so we end up with uninitialized memory in arrays which have undecided indexing
20654         types. We should just do the actual memcpy from the old block to the new one.
20655
20656         * runtime/JSObject.cpp:
20657         (JSC::JSObject::copyButterfly): Just do the same thing that we do for other contiguous indexing types.
20658
20659 2012-11-26  Julien BRIANCEAU   <jbrianceau@nds.com>
20660
20661         [sh4] JavaScriptCore JIT build is broken since r135330
20662         Add missing implementation for sh4 arch.
20663         https://bugs.webkit.org/show_bug.cgi?id=103145
20664
20665         Reviewed by Oliver Hunt.
20666
20667         * assembler/MacroAssemblerSH4.h:
20668         (JSC::MacroAssemblerSH4::canJumpReplacePatchableBranchPtrWithPatch):
20669         (MacroAssemblerSH4):
20670         (JSC::MacroAssemblerSH4::startOfBranchPtrWithPatchOnRegister):
20671         (JSC::MacroAssemblerSH4::revertJumpReplacementToBranchPtrWithPatch):
20672         (JSC::MacroAssemblerSH4::startOfPatchableBranchPtrWithPatchOnAddress):
20673         (JSC::MacroAssemblerSH4::revertJumpReplacementToPatchableBranchPtrWithPatch):
20674         * assembler/SH4Assembler.h:
20675         (JSC::SH4Assembler::revertJump):
20676         (SH4Assembler):
20677         (JSC::SH4Assembler::printInstr):
20678
20679 2012-11-26  Yuqiang Xian  <yuqiang.xian@intel.com>
20680
20681         Use load64 instead of loadPtr to load a JSValue on JSVALUE64 platforms
20682         https://bugs.webkit.org/show_bug.cgi?id=100909
20683
20684         Reviewed by Brent Fulgham.
20685
20686         This is a (trivial) fix after r132701.
20687
20688         * dfg/DFGOSRExitCompiler64.cpp:
20689         (JSC::DFG::OSRExitCompiler::compileExit):
20690
20691 2012-11-26  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
20692
20693         [Qt][ARM] REGRESSION(r130826): It made 33 JSC test and 466 layout tests crash
20694         https://bugs.webkit.org/show_bug.cgi?id=98857
20695
20696         Reviewed by Zoltan Herczeg.
20697
20698         Implement a new version of patchableBranch32 to fix crashing JSC
20699         tests.
20700
20701         * assembler/MacroAssembler.h:
20702         (MacroAssembler):
20703         * assembler/MacroAssemblerARM.h:
20704         (JSC::MacroAssemblerARM::patchableBranch32):
20705         (MacroAssemblerARM):
20706
20707 2012-11-21  Filip Pizlo  <fpizlo@apple.com>
20708
20709         Any function that can log things should be able to easily log them to a memory buffer as well
20710         https://bugs.webkit.org/show_bug.cgi?id=103000
20711
20712         Reviewed by Sam Weinig.
20713
20714         Change all users of WTF::dataFile() to expect a PrintStream& rather than a FILE*.
20715
20716         * bytecode/Operands.h:
20717         (JSC::OperandValueTraits::dump):
20718         (JSC::dumpOperands):
20719         (JSC):
20720         * dfg/DFGAbstractState.cpp:
20721         (JSC::DFG::AbstractState::dump):
20722         * dfg/DFGAbstractState.h:
20723         (AbstractState):
20724         * dfg/DFGAbstractValue.h:
20725         (JSC::DFG::AbstractValue::dump):
20726         * dfg/DFGCommon.h:
20727         (JSC::DFG::NodeIndexTraits::dump):
20728         * dfg/DFGStructureAbstractValue.h:
20729         (JSC::DFG::StructureAbstractValue::dump):
20730         * dfg/DFGVariableEvent.cpp:
20731         (JSC::DFG::VariableEvent::dump):
20732         (JSC::DFG::VariableEvent::dumpFillInfo):
20733         (JSC::DFG::VariableEvent::dumpSpillInfo):
20734         * dfg/DFGVariableEvent.h:
20735         (VariableEvent):
20736         * disassembler/Disassembler.h:
20737         (JSC):
20738         (JSC::tryToDisassemble):
20739         * disassembler/UDis86Disassembler.cpp:
20740         (JSC::tryToDisassemble):
20741
20742 2012-11-23  Alexis Menard  <alexis@webkit.org>
20743
20744         [CSS3 Backgrounds and Borders] Implement new CSS3 background-position parsing.
20745         https://bugs.webkit.org/show_bug.cgi?id=102104
20746
20747         Reviewed by Julien Chaffraix.
20748
20749         Protect the new feature behind a feature flag.
20750
20751         * Configurations/FeatureDefines.xcconfig:
20752
20753 2012-11-23  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
20754
20755         Fix the ARM traditional build after r135330
20756         https://bugs.webkit.org/show_bug.cgi?id=102871
20757
20758         Reviewed by Zoltan Herczeg.
20759
20760         Added missing functionality to traditional ARM architecture.
20761
20762         * assembler/ARMAssembler.h:
20763         (JSC::ARMAssembler::revertJump):
20764         (ARMAssembler):
20765         * assembler/MacroAssemblerARM.h:
20766         (JSC::MacroAssemblerARM::startOfPatchableBranchPtrWithPatchOnAddress):
20767         (JSC::MacroAssemblerARM::startOfBranchPtrWithPatchOnRegister):
20768         (MacroAssemblerARM):
20769         (JSC::MacroAssemblerARM::revertJumpReplacementToBranchPtrWithPatch):
20770
20771 2012-11-16  Yury Semikhatsky  <yurys@chromium.org>
20772
20773         Memory instrumentation: extract MemoryObjectInfo declaration into a separate file
20774         https://bugs.webkit.org/show_bug.cgi?id=102510
20775
20776         Reviewed by Pavel Feldman.
20777
20778         Added new symbols for the methods that have moved into .../wtf/MemoryInstrumentation.cpp
20779
20780         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
20781
20782 2012-11-23  Julien BRIANCEAU   <jbrianceau@nds.com>
20783
20784         [sh4] JavaScriptCore JIT build is broken since r130839
20785         Add missing implementation for sh4 arch.
20786         https://bugs.webkit.org/show_bug.cgi?id=101479
20787
20788         Reviewed by Filip Pizlo.
20789
20790         * assembler/MacroAssemblerSH4.h:
20791         (JSC::MacroAssemblerSH4::load8Signed):
20792         (MacroAssemblerSH4):
20793         (JSC::MacroAssemblerSH4::load16Signed):
20794         (JSC::MacroAssemblerSH4::store8):
20795         (JSC::MacroAssemblerSH4::store16):
20796         (JSC::MacroAssemblerSH4::moveDoubleToInts):
20797         (JSC::MacroAssemblerSH4::moveIntsToDouble):
20798         (JSC::MacroAssemblerSH4::loadFloat):
20799         (JSC::MacroAssemblerSH4::loadDouble):
20800         (JSC::MacroAssemblerSH4::storeFloat):
20801         (JSC::MacroAssemblerSH4::storeDouble):
20802         (JSC::MacroAssemblerSH4::addDouble):
20803         (JSC::MacroAssemblerSH4::convertFloatToDouble):
20804         (JSC::MacroAssemblerSH4::convertDoubleToFloat):
20805         (JSC::MacroAssemblerSH4::urshift32):
20806         * assembler/SH4Assembler.h:
20807         (JSC::SH4Assembler::sublRegReg):
20808         (JSC::SH4Assembler::subvlRegReg):
20809         (JSC::SH4Assembler::floatfpulfrn):
20810         (JSC::SH4Assembler::fldsfpul):
20811         (JSC::SH4Assembler::fstsfpul):
20812         (JSC::SH4Assembler::dcnvsd):
20813         (SH4Assembler):
20814         (JSC::SH4Assembler::movbRegMem):
20815         (JSC::SH4Assembler::sizeOfConstantPool):
20816         (JSC::SH4Assembler::linkJump):
20817         (JSC::SH4Assembler::printInstr):
20818         (JSC::SH4Assembler::printBlockInstr):
20819
20820 2012-11-22  Balazs Kilvady  <kilvadyb@homejinni.com>
20821
20822         Fix the MIPS build after r135330
20823         https://bugs.webkit.org/show_bug.cgi?id=102872
20824
20825         Reviewed by Gavin Barraclough.
20826
20827         Revert/replace functions added to MIPS port.
20828
20829         * assembler/MIPSAssembler.h:
20830         (JSC::MIPSAssembler::revertJumpToMove):
20831         (MIPSAssembler):
20832         (JSC::MIPSAssembler::replaceWithJump):
20833         * assembler/MacroAssemblerMIPS.h:
20834         (MacroAssemblerMIPS):
20835         (JSC::MacroAssemblerMIPS::startOfBranchPtrWithPatchOnRegister):
20836         (JSC::MacroAssemblerMIPS::revertJumpReplacementToBranchPtrWithPatch):
20837         (JSC::MacroAssemblerMIPS::startOfPatchableBranchPtrWithPatchOnAddress):
20838
20839 2012-11-21  Filip Pizlo  <fpizlo@apple.com>
20840
20841         Rename dataLog() and dataLogV() to dataLogF() and dataLogFV()
20842         https://bugs.webkit.org/show_bug.cgi?id=103001
20843
20844         Rubber stamped by Dan Bernstein.
20845
20846         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
20847         * assembler/LinkBuffer.cpp:
20848         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
20849         (JSC::LinkBuffer::dumpLinkStatistics):
20850         (JSC::LinkBuffer::dumpCode):
20851         * assembler/LinkBuffer.h:
20852         (JSC):
20853         * assembler/SH4Assembler.h:
20854         (JSC::SH4Assembler::vprintfStdoutInstr):
20855         * bytecode/CodeBlock.cpp:
20856         (JSC::CodeBlock::dumpBytecodeCommentAndNewLine):
20857         (JSC::CodeBlock::printUnaryOp):
20858         (JSC::CodeBlock::printBinaryOp):
20859         (JSC::CodeBlock::printConditionalJump):
20860         (JSC::CodeBlock::printGetByIdOp):
20861         (JSC::dumpStructure):
20862         (JSC::dumpChain):
20863         (JSC::CodeBlock::printGetByIdCacheStatus):
20864         (JSC::CodeBlock::printCallOp):
20865         (JSC::CodeBlock::printPutByIdOp):
20866         (JSC::CodeBlock::printStructure):
20867         (JSC::CodeBlock::printStructures):
20868         (JSC::CodeBlock::dump):
20869         (JSC::CodeBlock::dumpStatistics):
20870         (JSC::CodeBlock::finalizeUnconditionally):
20871         (JSC::CodeBlock::resetStubInternal):
20872         (JSC::CodeBlock::reoptimize):
20873         (JSC::ProgramCodeBlock::jettison):
20874         (JSC::EvalCodeBlock::jettison):
20875         (JSC::FunctionCodeBlock::jettison):
20876         (JSC::CodeBlock::shouldOptimizeNow):
20877         (JSC::CodeBlock::tallyFrequentExitSites):
20878         (JSC::CodeBlock::dumpValueProfiles):
20879         * bytecode/Opcode.cpp:
20880         (JSC::OpcodeStats::~OpcodeStats):
20881         * bytecode/SamplingTool.cpp:
20882         (JSC::SamplingFlags::stop):
20883         (JSC::SamplingRegion::dumpInternal):
20884         (JSC::SamplingTool::dump):
20885         * dfg/DFGAbstractState.cpp:
20886         (JSC::DFG::AbstractState::initialize):
20887         (JSC::DFG::AbstractState::endBasicBlock):
20888         (JSC::DFG::AbstractState::mergeStateAtTail):
20889         (JSC::DFG::AbstractState::mergeToSuccessors):
20890         * dfg/DFGAbstractValue.h:
20891         (JSC::DFG::AbstractValue::dump):
20892         * dfg/DFGArgumentsSimplificationPhase.cpp:
20893         (JSC::DFG::ArgumentsSimplificationPhase::run):
20894         * dfg/DFGByteCodeParser.cpp:
20895         (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
20896         (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
20897         (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
20898         (JSC::DFG::ByteCodeParser::makeSafe):
20899         (JSC::DFG::ByteCodeParser::makeDivSafe):
20900         (JSC::DFG::ByteCodeParser::handleCall):
20901         (JSC::DFG::ByteCodeParser::handleInlining):
20902         (JSC::DFG::ByteCodeParser::parseBlock):
20903         (JSC::DFG::ByteCodeParser::processPhiStack):
20904         (JSC::DFG::ByteCodeParser::linkBlock):
20905         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
20906         (JSC::DFG::ByteCodeParser::parseCodeBlock):
20907         (JSC::DFG::ByteCodeParser::parse):
20908         * dfg/DFGCFAPhase.cpp:
20909         (JSC::DFG::CFAPhase::performBlockCFA):
20910         (JSC::DFG::CFAPhase::performForwardCFA):
20911         * dfg/DFGCFGSimplificationPhase.cpp:
20912         (JSC::DFG::CFGSimplificationPhase::run):
20913         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
20914         (JSC::DFG::CFGSimplificationPhase::fixPhis):
20915         (JSC::DFG::CFGSimplificationPhase::fixJettisonedPredecessors):
20916         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
20917         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
20918         * dfg/DFGCSEPhase.cpp:
20919         (JSC::DFG::CSEPhase::endIndexForPureCSE):
20920         (JSC::DFG::CSEPhase::setReplacement):
20921         (JSC::DFG::CSEPhase::eliminate):
20922         (JSC::DFG::CSEPhase::performNodeCSE):
20923         * dfg/DFGCapabilities.cpp:
20924         (JSC::DFG::debugFail):
20925         * dfg/DFGConstantFoldingPhase.cpp:
20926         (JSC::DFG::ConstantFoldingPhase::foldConstants):
20927         (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
20928         * dfg/DFGDisassembler.cpp:
20929         (JSC::DFG::Disassembler::dump):
20930         * dfg/DFGDriver.cpp:
20931         (JSC::DFG::compile):
20932         * dfg/DFGFixupPhase.cpp:
20933         (JSC::DFG::FixupPhase::fixupNode):
20934         (JSC::DFG::FixupPhase::fixDoubleEdge):
20935         * dfg/DFGGraph.cpp:
20936         (JSC::DFG::printWhiteSpace):
20937         (JSC::DFG::Graph::dumpCodeOrigin):
20938         (JSC::DFG::Graph::dump):
20939         (JSC::DFG::Graph::dumpBlockHeader):
20940         (JSC::DFG::Graph::predictArgumentTypes):
20941         * dfg/DFGJITCompiler.cpp:
20942         (JSC::DFG::JITCompiler::link):
20943         * dfg/DFGOSREntry.cpp:
20944         (JSC::DFG::prepareOSREntry):
20945         * dfg/DFGOSRExitCompiler.cpp:
20946         * dfg/DFGOSRExitCompiler32_64.cpp:
20947         (JSC::DFG::OSRExitCompiler::compileExit):
20948         * dfg/DFGOSRExitCompiler64.cpp:
20949         (JSC::DFG::OSRExitCompiler::compileExit):
20950         * dfg/DFGOperations.cpp:
20951         * dfg/DFGPhase.cpp:
20952         (JSC::DFG::Phase::beginPhase):
20953         * dfg/DFGPhase.h:
20954         (JSC::DFG::runAndLog):
20955         * dfg/DFGPredictionPropagationPhase.cpp:
20956         (JSC::DFG::PredictionPropagationPhase::propagate):
20957         (JSC::DFG::PredictionPropagationPhase::propagateForward):
20958         (JSC::DFG::PredictionPropagationPhase::propagateBackward):
20959         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
20960         * dfg/DFGRegisterBank.h:
20961         (JSC::DFG::RegisterBank::dump):
20962         * dfg/DFGScoreBoard.h:
20963         (JSC::DFG::ScoreBoard::use):
20964         (JSC::DFG::ScoreBoard::dump):
20965         * dfg/DFGSlowPathGenerator.h:
20966         (JSC::DFG::SlowPathGenerator::generate):
20967         * dfg/DFGSpeculativeJIT.cpp:
20968         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
20969         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
20970         (JSC::DFG::SpeculativeJIT::runSlowPathGenerators):
20971         (JSC::DFG::SpeculativeJIT::dump):
20972         (JSC::DFG::SpeculativeJIT::checkConsistency):
20973         (JSC::DFG::SpeculativeJIT::compile):
20974         (JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):
20975         * dfg/DFGSpeculativeJIT32_64.cpp:
20976         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
20977         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
20978         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
20979         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
20980         * dfg/DFGSpeculativeJIT64.cpp:
20981         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
20982         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
20983         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
20984         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
20985         * dfg/DFGStructureCheckHoistingPhase.cpp:
20986         (JSC::DFG::StructureCheckHoistingPhase::run):
20987         * dfg/DFGValidate.cpp:
20988         (Validate):
20989         (JSC::DFG::Validate::reportValidationContext):
20990         (JSC::DFG::Validate::dumpData):
20991         (JSC::DFG::Validate::dumpGraphIfAppropriate):
20992         * dfg/DFGVariableEventStream.cpp:
20993         (JSC::DFG::VariableEventStream::logEvent):
20994         (JSC::DFG::VariableEventStream::reconstruct):
20995         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
20996         (JSC::DFG::VirtualRegisterAllocationPhase::run):
20997         * heap/Heap.cpp:
20998         * heap/HeapStatistics.cpp:
20999         (JSC::HeapStatistics::logStatistics):
21000         (JSC::HeapStatistics::showObjectStatistics):
21001         * heap/MarkStack.h:
21002         * heap/MarkedBlock.h:
21003         * heap/SlotVisitor.cpp:
21004         (JSC::SlotVisitor::validate):
21005         * interpreter/CallFrame.cpp:
21006         (JSC::CallFrame::dumpCaller):
21007         * interpreter/Interpreter.cpp:
21008         (JSC::Interpreter::dumpRegisters):
21009         * jit/JIT.cpp:
21010         (JSC::JIT::privateCompileMainPass):
21011         (JSC::JIT::privateCompileSlowCases):
21012         (JSC::JIT::privateCompile):
21013         * jit/JITDisassembler.cpp:
21014         (JSC::JITDisassembler::dump):
21015         (JSC::JITDisassembler::dumpForInstructions):
21016         * jit/JITStubRoutine.h:
21017         (JSC):
21018         * jit/JITStubs.cpp:
21019         (JSC::DEFINE_STUB_FUNCTION):
21020         * jit/JumpReplacementWatchpoint.cpp:
21021         (JSC::JumpReplacementWatchpoint::fireInternal):
21022         * llint/LLIntExceptions.cpp:
21023         (JSC::LLInt::interpreterThrowInCaller):
21024         (JSC::LLInt::returnToThrow):
21025         (JSC::LLInt::callToThrow):
21026         * llint/LLIntSlowPaths.cpp:
21027         (JSC::LLInt::llint_trace_operand):
21028         (JSC::LLInt::llint_trace_value):
21029         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
21030         (JSC::LLInt::traceFunctionPrologue):
21031         (JSC::LLInt::jitCompileAndSetHeuristics):
21032         (JSC::LLInt::entryOSR):
21033         (JSC::LLInt::handleHostCall):
21034         (JSC::LLInt::setUpCall):
21035         * profiler/Profile.cpp:
21036         (JSC::Profile::debugPrintData):
21037         (JSC::Profile::debugPrintDataSampleStyle):
21038         * profiler/ProfileNode.cpp:
21039         (JSC::ProfileNode::debugPrintData):
21040         (JSC::ProfileNode::debugPrintDataSampleStyle):
21041         * runtime/JSGlobalData.cpp:
21042         (JSC::JSGlobalData::dumpRegExpTrace):
21043         * runtime/RegExp.cpp:
21044         (JSC::RegExp::matchCompareWithInterpreter):
21045         * runtime/SamplingCounter.cpp:
21046         (JSC::AbstractSamplingCounter::dump):
21047         * runtime/Structure.cpp:
21048         (JSC::Structure::dumpStatistics):
21049         (JSC::PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger):
21050         * tools/CodeProfile.cpp:
21051         (JSC::CodeProfile::report):
21052         * tools/ProfileTreeNode.h:
21053         (JSC::ProfileTreeNode::dumpInternal):
21054         * yarr/YarrInterpreter.cpp:
21055         (JSC::Yarr::ByteCompiler::dumpDisjunction):
21056
21057 2012-11-21  Filip Pizlo  <fpizlo@apple.com>
21058
21059         It should be possible to say disassemble(stuff) instead of having to say if (!tryToDisassemble(stuff)) dataLog("I failed")
21060         https://bugs.webkit.org/show_bug.cgi?id=103010
21061
21062         Reviewed by Anders Carlsson.
21063
21064         You can still say tryToDisassemble(), which will tell you if it failed; you can then
21065         decide what to do instead. But it's better to say disassemble(), which will just print
21066         the instruction ranges if tryToDisassemble() failed. This is particularly appropriate
21067         since that's what all previous users of tryToDisassemble() would have done in some
21068         form or another.
21069
21070         * CMakeLists.txt:
21071         * GNUmakefile.list.am:
21072         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
21073         * JavaScriptCore.xcodeproj/project.pbxproj:
21074         * Target.pri:
21075         * assembler/LinkBuffer.cpp:
21076         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
21077         * dfg/DFGDisassembler.cpp:
21078         (JSC::DFG::Disassembler::dumpDisassembly):
21079         * disassembler/Disassembler.cpp: Added.
21080         (JSC):
21081         (JSC::disassemble):
21082         * disassembler/Disassembler.h:
21083         (JSC):
21084         * jit/JITDisassembler.cpp:
21085         (JSC::JITDisassembler::dumpDisassembly):
21086
21087 2012-11-21  Filip Pizlo  <fpizlo@apple.com>
21088
21089         dumpOperands() claims that it needs a non-const Operands& when that is completely false
21090         https://bugs.webkit.org/show_bug.cgi?id=103005
21091
21092         Reviewed by Eric Carlson.
21093
21094         * bytecode/Operands.h:
21095         (JSC::dumpOperands):
21096         (JSC):
21097
21098 2012-11-20  Filip Pizlo  <fpizlo@apple.com>
21099
21100         Baseline JIT's disassembly should be just as pretty as the DFG's
21101         https://bugs.webkit.org/show_bug.cgi?id=102873
21102
21103         Reviewed by Sam Weinig.
21104
21105         Integrated the CodeBlock's bytecode dumper with the JIT's disassembler. Also fixed
21106         some type goof-ups (instructions are not in a Vector<Instruction> so using a Vector
21107         iterator makes no sense) and stream-lined some things (you don't actually need a
21108         full-fledged ExecState* to dump bytecode).
21109
21110         * CMakeLists.txt:
21111         * GNUmakefile.list.am:
21112         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
21113         * JavaScriptCore.xcodeproj/project.pbxproj:
21114         * Target.pri:
21115         * bytecode/CodeBlock.cpp:
21116         (JSC::CodeBlock::printUnaryOp):
21117         (JSC::CodeBlock::printBinaryOp):
21118         (JSC::CodeBlock::printConditionalJump):
21119         (JSC::CodeBlock::printGetByIdOp):
21120         (JSC::CodeBlock::printCallOp):
21121         (JSC::CodeBlock::printPutByIdOp):
21122         (JSC::CodeBlock::dump):
21123         (JSC):
21124         (JSC::CodeBlock::CodeBlock):
21125         * bytecode/CodeBlock.h:
21126         (CodeBlock):
21127         * interpreter/Interpreter.cpp:
21128         (JSC::Interpreter::dumpCallFrame):
21129         * jit/JIT.cpp:
21130         (JSC::JIT::privateCompileMainPass):
21131         (JSC::JIT::privateCompileSlowCases):
21132         (JSC::JIT::privateCompile):
21133         * jit/JIT.h:
21134         (JIT):
21135         * jit/JITDisassembler.cpp: Added.
21136         (JSC):
21137         (JSC::JITDisassembler::JITDisassembler):
21138         (JSC::JITDisassembler::~JITDisassembler):
21139         (JSC::JITDisassembler::dump):
21140         (JSC::JITDisassembler::dumpForInstructions):
21141         (JSC::JITDisassembler::dumpDisassembly):
21142         * jit/JITDisassembler.h: Added.
21143         (JSC):
21144         (JITDisassembler):
21145         (JSC::JITDisassembler::setStartOfCode):
21146         (JSC::JITDisassembler::setForBytecodeMainPath):
21147         (JSC::JITDisassembler::setForBytecodeSlowPath):
21148         (JSC::JITDisassembler::setEndOfSlowPath):
21149         (JSC::JITDisassembler::setEndOfCode):
21150
21151 2012-11-21  Daniel Bates  <dbates@webkit.org>
21152
21153         JavaScript fails to concatenate large strings
21154         <https://bugs.webkit.org/show_bug.cgi?id=102963>
21155
21156         Reviewed by Michael Saboff.
21157
21158         Fixes an issue where we inadvertently didn't check the length of
21159         a JavaScript string for overflow.
21160
21161         * runtime/Operations.h:
21162         (JSC::jsString):
21163         (JSC::jsStringFromArguments):
21164
21165 2012-11-20  Filip Pizlo  <fpizlo@apple.com>
21166
21167         DFG should be able to cache closure calls (part 2/2)
21168         https://bugs.webkit.org/show_bug.cgi?id=102662
21169
21170         Reviewed by Gavin Barraclough.
21171
21172         Added caching of calls where the JSFunction* varies, but the Structure* and ExecutableBase*
21173         stay the same. This is accomplished by replacing the branch that compares against a constant
21174         JSFunction* with a jump to a closure call stub. The closure call stub contains a fast path,
21175         and jumps slow directly to the virtual call thunk.
21176
21177         Looks like a 1% win on V8v7.
21178
21179         * CMakeLists.txt:
21180         * GNUmakefile.list.am:
21181         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
21182         * JavaScriptCore.xcodeproj/project.pbxproj:
21183         * Target.pri:
21184         * bytecode/CallLinkInfo.cpp:
21185         (JSC::CallLinkInfo::unlink):
21186         * bytecode/CallLinkInfo.h:
21187         (CallLinkInfo):
21188         (JSC::CallLinkInfo::isLinked):
21189         (JSC::getCallLinkInfoBytecodeIndex):
21190         * bytecode/CodeBlock.cpp:
21191         (JSC::CodeBlock::finalizeUnconditionally):
21192         (JSC):
21193         (JSC::CodeBlock::findClosureCallForReturnPC):
21194         (JSC::CodeBlock::bytecodeOffset):
21195         (JSC::CodeBlock::codeOriginForReturn):
21196         * bytecode/CodeBlock.h:
21197         (JSC::CodeBlock::getCallLinkInfo):
21198         (CodeBlock):
21199         (JSC::CodeBlock::isIncomingCallAlreadyLinked):
21200         * dfg/DFGJITCompiler.cpp:
21201         (JSC::DFG::JITCompiler::link):
21202         * dfg/DFGJITCompiler.h:
21203         (JSC::DFG::JITCompiler::addJSCall):
21204         (JSC::DFG::JITCompiler::JSCallRecord::JSCallRecord):
21205         (JSCallRecord):
21206         * dfg/DFGOperations.cpp:
21207         * dfg/DFGOperations.h:
21208         * dfg/DFGRepatch.cpp:
21209         (JSC::DFG::linkSlowFor):
21210         (DFG):
21211         (JSC::DFG::dfgLinkFor):
21212         (JSC::DFG::dfgLinkSlowFor):
21213         (JSC::DFG::dfgLinkClosureCall):
21214         * dfg/DFGRepatch.h:
21215         (DFG):
21216         * dfg/DFGSpeculativeJIT32_64.cpp:
21217         (JSC::DFG::SpeculativeJIT::emitCall):
21218         * dfg/DFGSpeculativeJIT64.cpp:
21219         (JSC::DFG::SpeculativeJIT::emitCall):
21220         * dfg/DFGThunks.cpp:
21221         (DFG):
21222         (JSC::DFG::linkClosureCallThunkGenerator):
21223         * dfg/DFGThunks.h:
21224         (DFG):
21225         * heap/Heap.h:
21226         (Heap):
21227         (JSC::Heap::jitStubRoutines):
21228         * heap/JITStubRoutineSet.h:
21229         (JSC::JITStubRoutineSet::size):
21230         (JSC::JITStubRoutineSet::at):
21231         (JITStubRoutineSet):
21232         * jit/ClosureCallStubRoutine.cpp: Added.
21233         (JSC):
21234         (JSC::ClosureCallStubRoutine::ClosureCallStubRoutine):
21235         (JSC::ClosureCallStubRoutine::~ClosureCallStubRoutine):
21236         (JSC::ClosureCallStubRoutine::markRequiredObjectsInternal):
21237         * jit/ClosureCallStubRoutine.h: Added.
21238         (JSC):
21239         (ClosureCallStubRoutine):
21240         (JSC::ClosureCallStubRoutine::structure):
21241         (JSC::ClosureCallStubRoutine::executable):
21242         (JSC::ClosureCallStubRoutine::codeOrigin):
21243         * jit/GCAwareJITStubRoutine.cpp:
21244         (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
21245         * jit/GCAwareJITStubRoutine.h:
21246         (GCAwareJITStubRoutine):
21247         (JSC::GCAwareJITStubRoutine::isClosureCall):
21248         * jit/JIT.cpp:
21249         (JSC::JIT::privateCompile):
21250
21251 2012-11-20  Filip Pizlo  <fpizlo@apple.com>
21252
21253         DFG should be able to cache closure calls (part 1/2)
21254         https://bugs.webkit.org/show_bug.cgi?id=102662
21255
21256         Reviewed by Gavin Barraclough.
21257
21258         Add ability to revert a jump replacement back to
21259         branchPtrWithPatch(Condition, RegisterID, TrustedImmPtr). This is meant to be
21260         a mandatory piece of functionality for all assemblers. I also renamed some of
21261         the functions for reverting jump replacements back to
21262         patchableBranchPtrWithPatch(Condition, Address, TrustedImmPtr), so as to avoid
21263         confusion.
21264
21265         * assembler/ARMv7Assembler.h:
21266         (JSC::ARMv7Assembler::BadReg):
21267         (ARMv7Assembler):
21268         (JSC::ARMv7Assembler::revertJumpTo_movT3):
21269         * assembler/LinkBuffer.h:
21270         (JSC):
21271         * assembler/MacroAssemblerARMv7.h:
21272         (JSC::MacroAssemblerARMv7::startOfBranchPtrWithPatchOnRegister):
21273         (MacroAssemblerARMv7):
21274         (JSC::MacroAssemblerARMv7::revertJumpReplacementToBranchPtrWithPatch):
21275         (JSC::MacroAssemblerARMv7::startOfPatchableBranchPtrWithPatchOnAddress):
21276         * assembler/MacroAssemblerX86.h:
21277         (JSC::MacroAssemblerX86::startOfBranchPtrWithPatchOnRegister):
21278         (MacroAssemblerX86):
21279         (JSC::MacroAssemblerX86::startOfPatchableBranchPtrWithPatchOnAddress):
21280         (JSC::MacroAssemblerX86::revertJumpReplacementToBranchPtrWithPatch):
21281         * assembler/MacroAssemblerX86_64.h:
21282         (JSC::MacroAssemblerX86_64::startOfBranchPtrWithPatchOnRegister):
21283         (JSC::MacroAssemblerX86_64::startOfPatchableBranchPtrWithPatchOnAddress):
21284         (MacroAssemblerX86_64):
21285         (JSC::MacroAssemblerX86_64::revertJumpReplacementToBranchPtrWithPatch):
21286         * assembler/RepatchBuffer.h:
21287         (JSC::RepatchBuffer::startOfBranchPtrWithPatchOnRegister):
21288         (RepatchBuffer):
21289         (JSC::RepatchBuffer::startOfPatchableBranchPtrWithPatchOnAddress):
21290         (JSC::RepatchBuffer::revertJumpReplacementToBranchPtrWithPatch):
21291         * assembler/X86Assembler.h:
21292         (JSC::X86Assembler::revertJumpTo_cmpl_ir_force32):
21293         (X86Assembler):
21294         * dfg/DFGRepatch.cpp:
21295         (JSC::DFG::replaceWithJump):
21296         (JSC::DFG::dfgResetGetByID):
21297         (JSC::DFG::dfgResetPutByID):
21298
21299 2012-11-20  Yong Li  <yoli@rim.com>
21300
21301         [ARMv7] Neither linkCall() nor linkPointer() should flush code.
21302         https://bugs.webkit.org/show_bug.cgi?id=99213
21303
21304         Reviewed by George Staikos.
21305
21306         LinkBuffer doesn't need to flush code during linking. It will
21307         eventually flush the whole executable. Fixing this gives >%5
21308         sunspider boost (on QNX).
21309
21310         Also make replaceWithLoad() and replaceWithAddressComputation() flush
21311         only when necessary.
21312
21313         * assembler/ARMv7Assembler.h:
21314         (JSC::ARMv7Assembler::linkCall):
21315         (JSC::ARMv7Assembler::linkPointer):
21316         (JSC::ARMv7Assembler::relinkCall):
21317         (JSC::ARMv7Assembler::repatchInt32):
21318         (JSC::ARMv7Assembler::repatchPointer):
21319         (JSC::ARMv7Assembler::replaceWithLoad): Flush only after it did write.
21320         (JSC::ARMv7Assembler::replaceWithAddressComputation): Flush only after it did write.
21321         (JSC::ARMv7Assembler::setInt32):
21322         (JSC::ARMv7Assembler::setPointer):
21323
21324 2012-11-19  Filip Pizlo  <fpizlo@apple.com>
21325
21326         Remove support for ARMv7 errata from the jump code
21327         https://bugs.webkit.org/show_bug.cgi?id=102759
21328
21329         Reviewed by Oliver Hunt.
21330
21331         The jump replacement code was wrong to begin with since it wasn't doing
21332         a cache flush on the inserted padding. And, to my knowledge, we don't need
21333         this anymore, so this patch removes all errata code from the ARMv7 port.
21334
21335         * assembler/ARMv7Assembler.h:
21336         (JSC::ARMv7Assembler::computeJumpType):
21337         (JSC::ARMv7Assembler::replaceWithJump):
21338         (JSC::ARMv7Assembler::maxJumpReplacementSize):
21339         (JSC::ARMv7Assembler::canBeJumpT3):
21340         (JSC::ARMv7Assembler::canBeJumpT4):
21341
21342 2012-11-19  Patrick Gansterer  <paroga@webkit.org>
21343
21344         [CMake] Create JavaScriptCore ForwardingHeaders
21345         https://bugs.webkit.org/show_bug.cgi?id=92665
21346
21347         Reviewed by Brent Fulgham.
21348
21349         When using CMake to build the Windows port, we need
21350         to generate the forwarding headers with it too.
21351
21352         * CMakeLists.txt:
21353
21354 2012-11-19  Kihong Kwon  <kihong.kwon@samsung.com>
21355
21356         Add PROXIMITY_EVENTS feature
21357         https://bugs.webkit.org/show_bug.cgi?id=102658
21358
21359         Reviewed by Kentaro Hara.
21360
21361         Add PROXIMITY_EVENTS feature to xcode project for JavaScriptCore.
21362
21363         * Configurations/FeatureDefines.xcconfig:
21364
21365 2012-11-18  Dan Bernstein  <mitz@apple.com>
21366
21367         Try to fix the DFG build after r135099.
21368
21369         * dfg/DFGCommon.h:
21370         (JSC::DFG::shouldShowDisassembly):
21371
21372 2012-11-18  Filip Pizlo  <fpizlo@apple.com>
21373
21374         Unreviewed, build fix for !ENABLE(DFG_JIT).
21375
21376         * dfg/DFGCommon.h:
21377         (JSC::DFG::shouldShowDisassembly):
21378         (DFG):
21379
21380 2012-11-18  Filip Pizlo  <fpizlo@apple.com>
21381
21382         JSC should have more logging in structure-related code
21383         https://bugs.webkit.org/show_bug.cgi?id=102630
21384
21385         Reviewed by Simon Fraser.
21386
21387         - JSValue::description() now tells you if something is a structure, and if so,
21388           what kind of structure it is.
21389
21390         - Jettisoning logic now tells you why things are being jettisoned.
21391
21392         - It's now possible to turn off GC-triggered jettisoning entirely.
21393
21394         * bytecode/CodeBlock.cpp:
21395         (JSC::CodeBlock::finalizeUnconditionally):
21396         (JSC::CodeBlock::reoptimize):
21397         (JSC::ProgramCodeBlock::jettison):
21398         (JSC::EvalCodeBlock::jettison):
21399         (JSC::FunctionCodeBlock::jettison):
21400         * bytecode/CodeBlock.h:
21401         (JSC::CodeBlock::shouldImmediatelyAssumeLivenessDuringScan):
21402         * runtime/JSValue.cpp:
21403         (JSC::JSValue::description):
21404         * runtime/Options.h:
21405         (JSC):
21406
21407 2012-11-18  Filip Pizlo  <fpizlo@apple.com>
21408
21409         DFG constant folding phase should say 'changed = true' whenever it changes the graph
21410         https://bugs.webkit.org/show_bug.cgi?id=102550
21411
21412         Rubber stamped by Mark Hahnenberg.
21413
21414         * dfg/DFGConstantFoldingPhase.cpp:
21415         (JSC::DFG::ConstantFoldingPhase::foldConstants):
21416
21417 2012-11-17  Elliott Sprehn  <esprehn@chromium.org>
21418
21419         Expose JSObject removeDirect and PrivateName to WebCore
21420         https://bugs.webkit.org/show_bug.cgi?id=102546
21421
21422         Reviewed by Geoffrey Garen.
21423
21424         Export removeDirect for use in WebCore so JSDependentRetained works.
21425
21426         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
21427
21428 2012-11-16  Filip Pizlo  <fpizlo@apple.com>
21429
21430         Given a PutById or GetById with a proven structure, the DFG should be able to emit a PutByOffset or GetByOffset instead
21431         https://bugs.webkit.org/show_bug.cgi?id=102327
21432
21433         Reviewed by Mark Hahnenberg.
21434
21435         If the profiler tells us that a GetById or PutById may be polymorphic but our
21436         control flow analysis proves that it isn't, we should trust the control flow
21437         analysis over the profiler. This arises in cases where GetById or PutById were
21438         inlined: the inlined function may have been called from other places that led
21439         to polymorphism, but in the current inlined context, there is no polymorphism.
21440
21441         * bytecode/CodeBlock.cpp:
21442         (JSC::CodeBlock::dump):
21443         * bytecode/GetByIdStatus.cpp:
21444         (JSC::GetByIdStatus::computeFor):
21445         (JSC):
21446         * bytecode/GetByIdStatus.h:
21447         (JSC::GetByIdStatus::GetByIdStatus):
21448         (GetByIdStatus):
21449         * bytecode/PutByIdStatus.cpp:
21450         (JSC::PutByIdStatus::computeFor):
21451         (JSC):
21452         * bytecode/PutByIdStatus.h:
21453         (JSC):
21454         (JSC::PutByIdStatus::PutByIdStatus):
21455         (PutByIdStatus):
21456         * dfg/DFGAbstractState.cpp:
21457         (JSC::DFG::AbstractState::execute):
21458         * dfg/DFGAbstractValue.h:
21459         (JSC::DFG::AbstractValue::bestProvenStructure):
21460         (AbstractValue):
21461         * dfg/DFGConstantFoldingPhase.cpp:
21462         (JSC::DFG::ConstantFoldingPhase::foldConstants):
21463         (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
21464         (ConstantFoldingPhase):
21465         * dfg/DFGNode.h:
21466         (JSC::DFG::Node::convertToGetByOffset):
21467         (Node):
21468         (JSC::DFG::Node::convertToPutByOffset):
21469         (JSC::DFG::Node::hasStorageResult):
21470         * runtime/JSGlobalObject.h:
21471         (JSC::Structure::prototypeChain):
21472         (JSC):
21473         (JSC::Structure::isValid):
21474         * runtime/Operations.h:
21475         (JSC::isPrototypeChainNormalized):
21476         (JSC):
21477         * runtime/Structure.h:
21478         (Structure):
21479         (JSC::Structure::transitionDidInvolveSpecificValue):
21480
21481 2012-11-16  Tony Chang  <tony@chromium.org>
21482
21483         Remove ENABLE_CSS_HIERARCHIES since it's no longer in use
21484         https://bugs.webkit.org/show_bug.cgi?id=102554
21485
21486         Reviewed by Andreas Kling.
21487
21488         As mentioned in https://bugs.webkit.org/show_bug.cgi?id=79939#c41 ,
21489         we're going to revist this feature once additional vendor support is
21490         achieved.
21491
21492         * Configurations/FeatureDefines.xcconfig:
21493
21494 2012-11-16  Patrick Gansterer  <paroga@webkit.org>
21495
21496         Build fix for WinCE after r133688.
21497
21498         Use numeric_limits<uint32_t>::max() instead of UINT32_MAX.
21499
21500         * runtime/CodeCache.h:
21501         (JSC::CacheMap::CacheMap):
21502
21503 2012-11-15  Filip Pizlo  <fpizlo@apple.com>
21504
21505         ClassInfo.h should have correct indentation.
21506
21507         Rubber stamped by Mark Hahnenberg.
21508
21509         ClassInfo.h had some true creativity in its use of whitespace. Some things within
21510         the namespace were indented four spaces and others where not. One #define had its
21511         contents indented four spaces, while another didn't. I applied the following rule:
21512
21513         - Non-macro things in the namespace should not be indented (that's our current
21514           accepted practice).
21515
21516         - Macros should never be indented but if they are multi-line then their subsequent
21517           bodies should be indented four spaces. I believe that is consistent with what we
21518           do elsewhere.
21519
21520         * runtime/ClassInfo.h:
21521         (JSC):
21522         (MethodTable):
21523         (ClassInfo):
21524         (JSC::ClassInfo::propHashTable):
21525         (JSC::ClassInfo::isSubClassOf):
21526         (JSC::ClassInfo::hasStaticProperties):
21527
21528 2012-11-15  Filip Pizlo  <fpizlo@apple.com>
21529
21530         DFG should copy propagate trivially no-op ConvertThis
21531         https://bugs.webkit.org/show_bug.cgi?id=102445
21532
21533         Reviewed by Oliver Hunt.
21534
21535         Copy propagation is always a good thing, since it reveals must-alias relationships
21536         to the CFA and CSE. This accomplishes copy propagation for ConvertThis by first
21537         converting it to an Identity node (which is done by the constant folder since it
21538         has access to CFA results) and then performing substitution of references to
21539         Identity with references to Identity's child in the CSE.
21540
21541         I'm not aiming for a big speed-up here; I just think that this will be useful for
21542         the work on https://bugs.webkit.org/show_bug.cgi?id=102327.
21543
21544         * dfg/DFGAbstractState.cpp:
21545         (JSC::DFG::AbstractState::execute):
21546         * dfg/DFGCSEPhase.cpp:
21547         (JSC::DFG::CSEPhase::performNodeCSE):
21548         * dfg/DFGConstantFoldingPhase.cpp:
21549         (JSC::DFG::ConstantFoldingPhase::foldConstants):
21550         * dfg/DFGNodeType.h:
21551         (DFG):
21552         * dfg/DFGPredictionPropagationPhase.cpp:
21553         (JSC::DFG::PredictionPropagationPhase::propagate):
21554         * dfg/DFGSpeculativeJIT32_64.cpp:
21555         (JSC::DFG::SpeculativeJIT::compile):
21556         * dfg/DFGSpeculativeJIT64.cpp:
21557         (JSC::DFG::SpeculativeJIT::compile):
21558
21559 2012-11-15  Filip Pizlo  <fpizlo@apple.com>
21560
21561         CallData.h should have correct indentation.
21562
21563         Rubber stamped by Mark Hahneberg.
21564
21565         * runtime/CallData.h:
21566         (JSC):
21567
21568 2012-11-15  Filip Pizlo  <fpizlo@apple.com>
21569
21570         Remove methodCallDummy since it is not used anymore.
21571
21572         Rubber stamped by Mark Hahnenberg.
21573
21574         * runtime/JSGlobalObject.cpp:
21575         (JSC::JSGlobalObject::reset):
21576         (JSC):
21577         (JSC::JSGlobalObject::visitChildren):
21578         * runtime/JSGlobalObject.h:
21579         (JSGlobalObject):
21580
21581 2012-11-14  Filip Pizlo  <fpizlo@apple.com>
21582
21583         Structure should be able to easily tell if the prototype chain might intercept a store
21584         https://bugs.webkit.org/show_bug.cgi?id=102326
21585
21586         Reviewed by Geoffrey Garen.
21587
21588         This improves our ability to reason about the correctness of the more optimized
21589         prototype chain walk in JSObject::put(), while also making it straight forward to
21590         check if the prototype chain will do strange things to a property store by just
21591         looking at the structure.
21592
21593         * runtime/JSObject.cpp:
21594         (JSC::JSObject::put):
21595         * runtime/Structure.cpp:
21596         (JSC::Structure::prototypeChainMayInterceptStoreTo):
21597         (JSC):
21598         * runtime/Structure.h:
21599         (Structure):
21600
21601 2012-11-15  Thiago Marcos P. Santos  <thiago.santos@intel.com>
21602
21603         [CMake] Do not regenerate LLIntAssembly.h on every incremental build
21604         https://bugs.webkit.org/show_bug.cgi?id=102248
21605
21606         Reviewed by Kenneth Rohde Christiansen.
21607
21608         Update LLIntAssembly.h's mtime after running asm.rb to make the build
21609         system dependency tracking consistent.
21610
21611         * CMakeLists.txt:
21612
21613 2012-11-15  Thiago Marcos P. Santos  <thiago.santos@intel.com>
21614
21615         Fix compiler warnings about signed/unsigned comparison on i386
21616         https://bugs.webkit.org/show_bug.cgi?id=102249
21617
21618         Reviewed by Kenneth Rohde Christiansen.
21619
21620         Add casting to unsigned to shut up gcc warnings. Build was broken on
21621         JSVALUE32_64 ports compiling with -Werror.
21622
21623         * llint/LLIntData.cpp:
21624         (JSC::LLInt::Data::performAssertions):
21625
21626 2012-11-14  Brent Fulgham  <bfulgham@webkit.org>
21627
21628         [Windows, WinCairo] Unreviewed build fix.
21629
21630         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
21631         Missed one of the exports that was part of the WebKit2.def.
21632
21633 2012-11-14  Brent Fulgham  <bfulgham@webkit.org>
21634
21635         [Windows, WinCairo] Correct build failure.
21636         https://bugs.webkit.org/show_bug.cgi?id=102302
21637
21638         WebCore symbols were mistakenly added to the JavaScriptCore
21639         library definition file.
21640
21641         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Remove
21642         WebCore symbols that were incorrectly added to the export file.
21643
21644 2012-11-14  Mark Lam  <mark.lam@apple.com>
21645
21646         Change JSEventListener::m_jsFunction to be a weak ref.
21647         https://bugs.webkit.org/show_bug.cgi?id=101989.
21648
21649         Reviewed by Geoffrey Garen.
21650
21651         Added infrastructure for scanning weak ref slots.
21652
21653         * heap/SlotVisitor.cpp: Added #include "SlotVisitorInlines.h".
21654         * heap/SlotVisitor.h:
21655         (SlotVisitor): Added SlotVisitor::appendUnbarrieredWeak().
21656         * heap/SlotVisitorInlines.h: Added #include "Weak.h".
21657         (JSC::SlotVisitor::appendUnbarrieredWeak): Added.
21658         * heap/Weak.h:
21659         (JSC::operator==): Added operator==() for Weak.
21660         * runtime/JSCell.h: Removed #include "SlotVisitorInlines.h".
21661         * runtime/JSObject.h: Added #include "SlotVisitorInlines.h".
21662
21663 2012-11-14  Filip Pizlo  <fpizlo@apple.com>
21664
21665         Read-only properties created with putDirect() should tell the structure that there are read-only properties
21666         https://bugs.webkit.org/show_bug.cgi?id=102292
21667
21668         Reviewed by Gavin Barraclough.
21669
21670         This mostly affects things like function.length.
21671
21672         * runtime/JSObject.h:
21673         (JSC::JSObject::putDirectInternal):
21674
21675 2012-11-13  Filip Pizlo  <fpizlo@apple.com>
21676
21677         Don't access Node& after adding nodes to the graph.
21678         https://bugs.webkit.org/show_bug.cgi?id=102005
21679
21680         Reviewed by Oliver Hunt.
21681
21682         * dfg/DFGFixupPhase.cpp:
21683         (JSC::DFG::FixupPhase::fixupNode):
21684
21685 2012-11-14  Valery Ignatyev  <valery.ignatyev@ispras.ru>
21686
21687         Replace (typeof(x) != <"object", "undefined", ...>) with
21688         !(typeof(x) == <"object",..>). Later is_object, is_<...>  bytecode operation
21689         will be used.
21690
21691         https://bugs.webkit.org/show_bug.cgi?id=98893
21692
21693         Reviewed by Filip Pizlo.
21694
21695         This eliminates expensive  typeof implementation and
21696         allows to use DFG optimizations, which doesn't support 'typeof'.
21697
21698         * bytecompiler/NodesCodegen.cpp:
21699         (JSC::BinaryOpNode::emitBytecode):
21700
21701 2012-11-14  Peter Gal  <galpeter@inf.u-szeged.hu>
21702
21703         [Qt][ARM]REGRESSION(r133985): It broke the build
21704         https://bugs.webkit.org/show_bug.cgi?id=101740
21705
21706         Reviewed by Csaba Osztrogonác.
21707
21708         Changed the emitGenericContiguousPutByVal to accept the additional IndexingType argument.
21709         This information was passed as a template parameter.
21710
21711         * jit/JIT.h:
21712         (JSC::JIT::emitInt32PutByVal):
21713         (JSC::JIT::emitDoublePutByVal):
21714         (JSC::JIT::emitContiguousPutByVal):
21715         (JIT):
21716         * jit/JITPropertyAccess.cpp:
21717         (JSC::JIT::emitGenericContiguousPutByVal):
21718         * jit/JITPropertyAccess32_64.cpp:
21719         (JSC::JIT::emitGenericContiguousPutByVal):
21720
21721 2012-11-14  Peter Gal  <galpeter@inf.u-szeged.hu>
21722
21723         Fix the MIPS build after r134332
21724         https://bugs.webkit.org/show_bug.cgi?id=102227
21725
21726         Reviewed by Csaba Osztrogonác.
21727
21728         Added missing methods for the MacroAssemblerMIPS, based on the MacroAssemblerARMv7.
21729
21730         * assembler/MacroAssemblerMIPS.h:
21731         (JSC::MacroAssemblerMIPS::canJumpReplacePatchableBranchPtrWithPatch):
21732         (MacroAssemblerMIPS):
21733         (JSC::MacroAssemblerMIPS::startOfPatchableBranchPtrWithPatch):
21734         (JSC::MacroAssemblerMIPS::revertJumpReplacementToPatchableBranchPtrWithPatch):
21735
21736 2012-11-14  Peter Gal  <galpeter@inf.u-szeged.hu>
21737
21738         Fix the [-Wreturn-type] warning in JavaScriptCore/assembler/MacroAssemblerARM.h
21739         https://bugs.webkit.org/show_bug.cgi?id=102206
21740
21741         Reviewed by Csaba Osztrogonác.
21742
21743         Add a return value for the function to suppress the warning.
21744
21745         * assembler/MacroAssemblerARM.h:
21746         (JSC::MacroAssemblerARM::startOfPatchableBranchPtrWithPatch):
21747
21748 2012-11-14  Sheriff Bot  <webkit.review.bot@gmail.com>
21749
21750         Unreviewed, rolling out r134599.
21751         http://trac.webkit.org/changeset/134599
21752         https://bugs.webkit.org/show_bug.cgi?id=102225
21753
21754         It broke the 32 bit EFL build (Requested by Ossy on #webkit).
21755
21756         * jit/JITPropertyAccess.cpp:
21757         * jit/JITPropertyAccess32_64.cpp:
21758         (JSC):
21759         (JSC::JIT::emitGenericContiguousPutByVal):
21760
21761 2012-11-14  Balazs Kilvady  <kilvadyb@homejinni.com>
21762
21763         [Qt][ARM]REGRESSION(r133985): It broke the build
21764         https://bugs.webkit.org/show_bug.cgi?id=101740
21765
21766         Reviewed by Csaba Osztrogonác.
21767
21768         Template function body moved to fix VALUE_PROFILER disabled case.
21769
21770         * jit/JITPropertyAccess.cpp:
21771         (JSC):
21772         (JSC::JIT::emitGenericContiguousPutByVal):
21773         * jit/JITPropertyAccess32_64.cpp:
21774
21775 2012-11-13  Filip Pizlo  <fpizlo@apple.com>
21776
21777         DFG CreateThis should be able to statically account for the structure of the object it creates, if profiling indicates that this structure is always the same
21778         https://bugs.webkit.org/show_bug.cgi?id=102017
21779
21780         Reviewed by Geoffrey Garen.
21781
21782         This adds a watchpoint in JSFunction on the cached inheritor ID. It also changes
21783         NewObject to take a structure as an operand (previously it implicitly used the owning
21784         global object's empty object structure). Any GetCallee where the callee is predictable
21785         is turned into a CheckFunction + WeakJSConstant, and any CreateThis on a WeakJSConstant
21786         where the inheritor ID watchpoint is still valid is turned into an InheritorIDWatchpoint
21787         followed by a NewObject. NewObject already accounts for the structure it uses for object
21788         creation in the CFA.
21789
21790         * dfg/DFGAbstractState.cpp:
21791         (JSC::DFG::AbstractState::execute):
21792         * dfg/DFGByteCodeParser.cpp:
21793         (JSC::DFG::ByteCodeParser::parseBlock):
21794         * dfg/DFGCSEPhase.cpp:
21795         (JSC::DFG::CSEPhase::checkFunctionElimination):
21796         * dfg/DFGGraph.cpp:
21797         (JSC::DFG::Graph::dump):
21798         * dfg/DFGNode.h:
21799         (JSC::DFG::Node::hasFunction):
21800         (JSC::DFG::Node::function):
21801         (JSC::DFG::Node::hasStructure):
21802         * dfg/DFGNodeType.h:
21803         (DFG):
21804         * dfg/DFGOperations.cpp:
21805         * dfg/DFGOperations.h:
21806         * dfg/DFGPredictionPropagationPhase.cpp:
21807         (JSC::DFG::PredictionPropagationPhase::propagate):
21808         * dfg/DFGSpeculativeJIT.h:
21809         (JSC::DFG::SpeculativeJIT::callOperation):
21810         * dfg/DFGSpeculativeJIT32_64.cpp:
21811         (JSC::DFG::SpeculativeJIT::compile):
21812         * dfg/DFGSpeculativeJIT64.cpp:
21813         (JSC::DFG::SpeculativeJIT::compile):
21814         * runtime/Executable.h:
21815         (JSC::JSFunction::JSFunction):
21816         * runtime/JSBoundFunction.cpp:
21817         (JSC):
21818         * runtime/JSFunction.cpp:
21819         (JSC::JSFunction::JSFunction):
21820         (JSC::JSFunction::put):
21821         (JSC::JSFunction::defineOwnProperty):
21822         * runtime/JSFunction.h:
21823         (JSC::JSFunction::tryGetKnownInheritorID):
21824         (JSFunction):
21825         (JSC::JSFunction::addInheritorIDWatchpoint):
21826
21827 2012-11-13  Filip Pizlo  <fpizlo@apple.com>
21828
21829         JSFunction and its descendants should be destructible
21830         https://bugs.webkit.org/show_bug.cgi?id=102062
21831
21832         Reviewed by Mark Hahnenberg.
21833
21834         This will make it easy to place an InlineWatchpointSet inside JSFunction. In the
21835         future, we could make JSFunction non-destructible again by making a version of
21836         WatchpointSet that is entirely GC'd, but this seems like overkill for now.
21837
21838         This is performance-neutral.
21839
21840         * runtime/JSBoundFunction.cpp:
21841         (JSC::JSBoundFunction::destroy):
21842         (JSC):
21843         * runtime/JSBoundFunction.h:
21844         (JSBoundFunction):
21845         * runtime/JSFunction.cpp:
21846         (JSC):
21847         (JSC::JSFunction::destroy):
21848         * runtime/JSFunction.h:
21849         (JSFunction):
21850
21851 2012-11-13  Cosmin Truta  <ctruta@rim.com>
21852
21853         Uninitialized fields in class JSLock
21854         https://bugs.webkit.org/show_bug.cgi?id=101695
21855
21856         Reviewed by Mark Hahnenberg.
21857
21858         Initialize JSLock::m_ownerThread and JSLock::m_lockDropDepth.
21859
21860         * runtime/JSLock.cpp:
21861         (JSC::JSLock::JSLock):
21862
21863 2012-11-13  Peter Gal  <galpeter@inf.u-szeged.hu>
21864
21865         Fix the ARM traditional build after r134332
21866         https://bugs.webkit.org/show_bug.cgi?id=102044
21867
21868         Reviewed by Zoltan Herczeg.
21869
21870         Added missing methods for the MacroAssemblerARM, based on the MacroAssemblerARMv7.
21871
21872         * assembler/MacroAssemblerARM.h:
21873         (JSC::MacroAssemblerARM::canJumpReplacePatchableBranchPtrWithPatch):
21874         (MacroAssemblerARM):
21875         (JSC::MacroAssemblerARM::startOfPatchableBranchPtrWithPatch):
21876         (JSC::MacroAssemblerARM::revertJumpReplacementToPatchableBranchPtrWithPatch):
21877
21878 2012-11-12  Filip Pizlo  <fpizlo@apple.com>
21879
21880         op_get_callee should have value profiling
21881         https://bugs.webkit.org/show_bug.cgi?id=102047
21882
21883         Reviewed by Sam Weinig.
21884
21885         This will allow us to detect if the callee is always the same, which is probably
21886         the common case for a lot of constructors.
21887
21888         * bytecode/CodeBlock.cpp:
21889         (JSC::CodeBlock::CodeBlock):
21890         * bytecode/Opcode.h:
21891         (JSC):
21892         (JSC::padOpcodeName):
21893         * bytecompiler/BytecodeGenerator.cpp:
21894         (JSC::BytecodeGenerator::BytecodeGenerator):
21895         * jit/JITOpcodes.cpp:
21896         (JSC::JIT::emit_op_get_callee):
21897         * jit/JITOpcodes32_64.cpp:
21898         (JSC::JIT::emit_op_get_callee):
21899         * llint/LowLevelInterpreter32_64.asm:
21900         * llint/LowLevelInterpreter64.asm:
21901
21902 2012-11-12  Filip Pizlo  <fpizlo@apple.com>
21903
21904         The act of getting the callee during 'this' construction should be explicit in bytecode
21905         https://bugs.webkit.org/show_bug.cgi?id=102016
21906
21907         Reviewed by Michael Saboff.
21908
21909         This is mostly a rollout of http://trac.webkit.org/changeset/116673, but also includes
21910         changes to have create_this use the result of get_callee.
21911
21912         No performance or behavioral impact. This is just meant to allow us to profile
21913         get_callee in the future.
21914
21915         * bytecode/CodeBlock.cpp:
21916         (JSC::CodeBlock::dump):
21917         * bytecode/Opcode.h:
21918         (JSC):
21919         (JSC::padOpcodeName):
21920         * bytecompiler/BytecodeGenerator.cpp:
21921         (JSC::BytecodeGenerator::BytecodeGenerator):
21922         * dfg/DFGByteCodeParser.cpp:
21923         (JSC::DFG::ByteCodeParser::parseBlock):
21924         * dfg/DFGCapabilities.h:
21925         (JSC::DFG::canCompileOpcode):
21926         * jit/JIT.cpp:
21927         (JSC::JIT::privateCompileMainPass):
21928         * jit/JIT.h:
21929         (JIT):
21930         * jit/JITOpcodes.cpp:
21931         (JSC::JIT::emit_op_get_callee):
21932         (JSC):
21933         (JSC::JIT::emit_op_create_this):
21934         * jit/JITOpcodes32_64.cpp:
21935         (JSC::JIT::emit_op_get_callee):
21936         (JSC):
21937         (JSC::JIT::emit_op_create_this):
21938         * llint/LLIntSlowPaths.cpp:
21939         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
21940         * llint/LowLevelInterpreter32_64.asm:
21941         * llint/LowLevelInterpreter64.asm:
21942
21943 2012-11-12  Filip Pizlo  <fpizlo@apple.com>
21944
21945         Unreviewed, fix ARMv7 build.
21946
21947         * assembler/MacroAssemblerARMv7.h:
21948         (JSC::MacroAssemblerARMv7::startOfPatchableBranchPtrWithPatch):
21949         (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranchPtrWithPatch):
21950
21951 2012-11-12  Filip Pizlo  <fpizlo@apple.com>
21952
21953         Patching of jumps to stubs should use jump replacement rather than branch destination overwrite
21954         https://bugs.webkit.org/show_bug.cgi?id=101909
21955
21956         Reviewed by Geoffrey Garen.
21957
21958         This saves a few instructions in inline cases, on those architectures where it is
21959         easy to figure out where to put the jump replacement. Sub-1% speed-up across the
21960         board.
21961
21962         * assembler/MacroAssemblerARMv7.h:
21963         (MacroAssemblerARMv7):
21964         (JSC::MacroAssemblerARMv7::canJumpReplacePatchableBranchPtrWithPatch):
21965         (JSC::MacroAssemblerARMv7::startOfPatchableBranchPtrWithPatch):
21966         (JSC::MacroAssemblerARMv7::revertJumpReplacementToPatchableBranchPtrWithPatch):
21967         * assembler/MacroAssemblerX86.h:
21968         (JSC::MacroAssemblerX86::canJumpReplacePatchableBranchPtrWithPatch):
21969         (MacroAssemblerX86):
21970         (JSC::MacroAssemblerX86::startOfPatchableBranchPtrWithPatch):
21971         (JSC::MacroAssemblerX86::revertJumpReplacementToPatchableBranchPtrWithPatch):
21972         * assembler/MacroAssemblerX86_64.h:
21973         (JSC::MacroAssemblerX86_64::canJumpReplacePatchableBranchPtrWithPatch):
21974         (MacroAssemblerX86_64):
21975         (JSC::MacroAssemblerX86_64::startOfPatchableBranchPtrWithPatch):
21976         (JSC::MacroAssemblerX86_64::revertJumpReplacementToPatchableBranchPtrWithPatch):
21977         * assembler/RepatchBuffer.h:
21978         (JSC::RepatchBuffer::startOfPatchableBranchPtrWithPatch):
21979         (RepatchBuffer):
21980         (JSC::RepatchBuffer::replaceWithJump):
21981         (JSC::RepatchBuffer::revertJumpReplacementToPatchableBranchPtrWithPatch):
21982         * assembler/X86Assembler.h:
21983         (X86Assembler):
21984         (JSC::X86Assembler::revertJumpTo_movq_i64r):
21985         (JSC::X86Assembler::revertJumpTo_cmpl_im_force32):
21986         (X86InstructionFormatter):
21987         * bytecode/StructureStubInfo.h:
21988         * dfg/DFGRepatch.cpp:
21989         (JSC::DFG::replaceWithJump):
21990         (DFG):
21991         (JSC::DFG::tryCacheGetByID):
21992         (JSC::DFG::tryBuildGetByIDList):
21993         (JSC::DFG::tryBuildGetByIDProtoList):
21994         (JSC::DFG::tryCachePutByID):
21995         (JSC::DFG::dfgResetGetByID):
21996         (JSC::DFG::dfgResetPutByID):
21997
21998 2012-11-11  Filip Pizlo  <fpizlo@apple.com>
21999
22000         DFG ArithMul overflow check elimination is too aggressive
22001         https://bugs.webkit.org/show_bug.cgi?id=101871
22002
22003         Reviewed by Oliver Hunt.
22004
22005         The code was ignoring the fact that ((a * b) | 0) == (((a | 0) * (b | 0)) | 0)
22006         only holds if a * b < 2^53. So, I changed it to only enable the optimization
22007         when a < 2^22 and b is an int32 (and vice versa), using a super trivial peephole
22008         analysis to prove the inequality. I considered writing an epic forward flow
22009         formulation that tracks the ranges of integer values but then I thought better
22010         of it.
22011
22012         This also rewires the ArithMul integer speculation logic. Previously, we would
22013         assume that an ArithMul was only UsedAsNumber if it escaped, and separately we
22014         would decide whether to speculate integer based on a proof of the <2^22
22015         inequality. Now, we treat the double rounding behavior of ArithMul as if the
22016         result was UsedAsNumber even if it did not escape. Then we try to prove that
22017         double rounding cannot happen by attemping to prove that a < 2^22. This then
22018         feeds back into the decision of whether or not to speculate integer (if we fail
22019         to prove a < 2^22 then we're UsedAsNumber, and if we're also MayOverflow then
22020         that forces double speculation).
22021
22022         No performance impact. It just fixes a bug.
22023
22024         * dfg/DFGGraph.h:
22025         (JSC::DFG::Graph::mulShouldSpeculateInteger):
22026         * dfg/DFGPredictionPropagationPhase.cpp:
22027         (PredictionPropagationPhase):
22028         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoForConstant):
22029         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwoNonRecursive):
22030         (JSC::DFG::PredictionPropagationPhase::isWithinPowerOfTwo):
22031         (JSC::DFG::PredictionPropagationPhase::propagate):
22032
22033 2012-11-11  Filip Pizlo  <fpizlo@apple.com>
22034
22035         DFG should not emit function checks if we've already proved that the operand is that exact function
22036         https://bugs.webkit.org/show_bug.cgi?id=101885
22037
22038         Reviewed by Oliver Hunt.
22039
22040         * dfg/DFGAbstractState.cpp:
22041         (JSC::DFG::AbstractState::execute):
22042         * dfg/DFGAbstractValue.h:
22043         (JSC::DFG::AbstractValue::filterByValue):
22044         (AbstractValue):
22045         * dfg/DFGConstantFoldingPhase.cpp:
22046         (JSC::DFG::ConstantFoldingPhase::foldConstants):
22047
22048 2012-11-12  Kentaro Hara  <haraken@chromium.org>
22049
22050         [V8][JSC] ScriptProfileNode::callUID needs not to be [Custom]
22051         https://bugs.webkit.org/show_bug.cgi?id=101892
22052
22053         Reviewed by Adam Barth.
22054
22055         Added callUID(), which enables us to kill custom bindings for ScriptProfileNode::callUID.
22056
22057         * profiler/ProfileNode.h:
22058         (JSC::ProfileNode::callUID):
22059
22060 2012-11-12  Carlos Garcia Campos  <cgarcia@igalia.com>
22061
22062         Unreviewed. Fix make distcheck.
22063
22064         * GNUmakefile.list.am: Add missing header.
22065
22066 2012-11-11  Michael Pruett  <michael@68k.org>
22067
22068         Fix assertion failure in JSObject::tryGetIndexQuickly()
22069         https://bugs.webkit.org/show_bug.cgi?id=101869
22070
22071         Reviewed by Filip Pizlo.
22072
22073         Currently JSObject::tryGetIndexQuickly() triggers an assertion
22074         failure when the object has an undecided indexing type. This
22075         case should be treated the same as a blank indexing type.
22076
22077         * runtime/JSObject.h:
22078         (JSC::JSObject::tryGetIndexQuickly):
22079
22080 2012-11-11  Filip Pizlo  <fpizlo@apple.com>
22081
22082         DFG register allocation should be greedy rather than round-robin
22083         https://bugs.webkit.org/show_bug.cgi?id=101870
22084
22085         Reviewed by Geoffrey Garen.
22086
22087         This simplifies the code, reduces some code duplication, and shows some slight
22088         performance improvements in a few places, likely due to the fact that lower-numered
22089         registers also typically have smaller encodings.
22090
22091         * dfg/DFGRegisterBank.h:
22092         (JSC::DFG::RegisterBank::RegisterBank):
22093         (JSC::DFG::RegisterBank::tryAllocate):
22094         (JSC::DFG::RegisterBank::allocate):
22095         (JSC::DFG::RegisterBank::allocateInternal):
22096         (RegisterBank):
22097
22098 2012-11-11  Kenichi Ishibashi  <bashi@chromium.org>
22099
22100         WTFString::utf8() should have a mode of conversion to use replacement character
22101         https://bugs.webkit.org/show_bug.cgi?id=101678
22102
22103         Reviewed by Alexey Proskuryakov.
22104
22105         Follow the change on String::utf8()
22106
22107         * runtime/JSGlobalObjectFunctions.cpp:
22108         (JSC::encode): Pass String::StrictConversion instead of true to String::utf8().
22109
22110 2012-11-10  Filip Pizlo  <fpizlo@apple.com>
22111
22112         DFG should optimize out the NaN check on loads from double arrays if the array prototype chain is having a great time
22113         https://bugs.webkit.org/show_bug.cgi?id=101718
22114
22115         Reviewed by Geoffrey Garen.
22116
22117         If we're reading from a JSArray in double mode, where the array's structure is
22118         primordial (all aspects of the structure are unchanged except for indexing type),
22119         and the result of the load is used in arithmetic that is known to not distinguish
22120         between NaN and undefined, then we should not emit a NaN check. Looks like a 5%
22121         win on navier-stokes.
22122
22123         Also fixed an OpInfo initialization goof for String ops that was revealed by this
22124         change.
22125
22126         * dfg/DFGAbstractState.cpp:
22127         (JSC::DFG::AbstractState::execute):
22128         * dfg/DFGArrayMode.cpp:
22129         (JSC::DFG::arraySpeculationToString):
22130         * dfg/DFGArrayMode.h:
22131         (JSC::DFG::ArrayMode::isSaneChain):
22132         (ArrayMode):
22133         (JSC::DFG::ArrayMode::isInBounds):
22134         * dfg/DFGByteCodeParser.cpp:
22135         (JSC::DFG::ByteCodeParser::handleIntrinsic):
22136         * dfg/DFGFixupPhase.cpp:
22137         (JSC::DFG::FixupPhase::fixupNode):
22138         * dfg/DFGNodeFlags.cpp:
22139         (JSC::DFG::nodeFlagsAsString):
22140         * dfg/DFGNodeFlags.h:
22141         (DFG):
22142         * dfg/DFGPredictionPropagationPhase.cpp:
22143         (JSC::DFG::PredictionPropagationPhase::propagate):
22144         * dfg/DFGSpeculativeJIT32_64.cpp:
22145         (JSC::DFG::SpeculativeJIT::compile):
22146         * dfg/DFGSpeculativeJIT64.cpp:
22147         (JSC::DFG::SpeculativeJIT::compile):
22148         * runtime/JSGlobalObject.cpp:
22149         (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
22150         (JSC):
22151         * runtime/JSGlobalObject.h:
22152         (JSGlobalObject):
22153
22154 2012-11-10  Filip Pizlo  <fpizlo@apple.com>
22155
22156         DFG constant folding and CFG simplification should be smart enough to know that if a logical op's operand is proven to have a non-masquerading structure then it always evaluates to true
22157         https://bugs.webkit.org/show_bug.cgi?id=101511
22158
22159         Reviewed by Geoffrey Garen.
22160
22161         This is the second attempt at this patch, which fixes the !"" case.
22162
22163         To make life easier, this moves BranchDirection into BasicBlock so that after
22164         running the CFA, we always know, for each block, what direction the CFA
22165         proved. CFG simplification now both uses and preserves cfaBranchDirection in
22166         its transformations.
22167
22168         Also made both LogicalNot and Branch check whether the operand is a known cell
22169         with a known structure, and if so, made them do the appropriate folding.
22170
22171         5% speed-up on V8/raytrace because it makes raytrace's own null checks
22172         evaporate (i.e. idioms like 'if (!x) throw "unhappiness"') thanks to the fact
22173         that we were already doing structure check hoisting.
22174
22175         * JavaScriptCore.xcodeproj/project.pbxproj:
22176         * dfg/DFGAbstractState.cpp:
22177         (JSC::DFG::AbstractState::endBasicBlock):
22178         (JSC::DFG::AbstractState::execute):
22179         (JSC::DFG::AbstractState::mergeToSuccessors):
22180         * dfg/DFGAbstractState.h:
22181         (AbstractState):
22182         * dfg/DFGBasicBlock.h:
22183         (JSC::DFG::BasicBlock::BasicBlock):
22184         (BasicBlock):
22185         * dfg/DFGBranchDirection.h: Added.
22186         (DFG):
22187         (JSC::DFG::branchDirectionToString):
22188         (JSC::DFG::isKnownDirection):
22189         (JSC::DFG::branchCondition):
22190         * dfg/DFGCFGSimplificationPhase.cpp:
22191         (JSC::DFG::CFGSimplificationPhase::run):
22192         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
22193
22194 2012-11-10  Sheriff Bot  <webkit.review.bot@gmail.com>
22195
22196         Unreviewed, rolling out r133971.
22197         http://trac.webkit.org/changeset/133971
22198         https://bugs.webkit.org/show_bug.cgi?id=101839
22199
22200         Causes WebProcess to hang at 100% on www.apple.com (Requested
22201         by kling on #webkit).
22202
22203         * JavaScriptCore.xcodeproj/project.pbxproj:
22204         * dfg/DFGAbstractState.cpp:
22205         (JSC::DFG::AbstractState::endBasicBlock):
22206         (JSC::DFG::AbstractState::execute):
22207         (JSC::DFG::AbstractState::mergeToSuccessors):
22208         * dfg/DFGAbstractState.h:
22209         (JSC::DFG::AbstractState::branchDirectionToString):
22210         (AbstractState):
22211         * dfg/DFGBasicBlock.h:
22212         (JSC::DFG::BasicBlock::BasicBlock):
22213         (BasicBlock):
22214         * dfg/DFGBranchDirection.h: Removed.
22215         * dfg/DFGCFGSimplificationPhase.cpp:
22216         (JSC::DFG::CFGSimplificationPhase::run):
22217         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
22218
22219 2012-11-09  Filip Pizlo  <fpizlo@apple.com>
22220
22221         If the DFG ArrayMode says that an access is on an OriginalArray, then the checks should always enforce this
22222         https://bugs.webkit.org/show_bug.cgi?id=101720
22223
22224         Reviewed by Mark Hahnenberg.
22225
22226         Previously, "original" arrays was just a hint that we could find the structure
22227         of the array if we needed to even if the array profile didn't have it due to
22228         polymorphism. Now, "original" arrays are a property that is actually checked:
22229         if an array access has ArrayMode::arrayClass() == Array::OriginalArray, then we
22230         can be sure that the code performing the access is dealing with not just a
22231         JSArray, but a JSArray that has no named properties, no indexed accessors, and
22232         the ArrayPrototype as its prototype. This will be useful for optimizations that
22233         are being done as part of https://bugs.webkit.org/show_bug.cgi?id=101720.
22234
22235         * dfg/DFGAbstractState.cpp:
22236         (JSC::DFG::AbstractState::execute):
22237         * dfg/DFGArrayMode.cpp:
22238         (JSC::DFG::ArrayMode::originalArrayStructure):
22239         (DFG):
22240         (JSC::DFG::ArrayMode::alreadyChecked):
22241         * dfg/DFGArrayMode.h:
22242         (JSC):
22243         (DFG):
22244         (JSC::DFG::ArrayMode::withProfile):
22245         (ArrayMode):
22246         (JSC::DFG::ArrayMode::benefitsFromOriginalArray):
22247         * dfg/DFGConstantFoldingPhase.cpp:
22248         (JSC::DFG::ConstantFoldingPhase::foldConstants):
22249         * dfg/DFGFixupPhase.cpp:
22250         (JSC::DFG::FixupPhase::checkArray):
22251         * dfg/DFGSpeculativeJIT.cpp:
22252         (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
22253         (JSC::DFG::SpeculativeJIT::checkArray):
22254         (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
22255         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
22256         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
22257         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
22258         (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
22259         (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
22260
22261 2012-11-09  Filip Pizlo  <fpizlo@apple.com>
22262
22263         Fix indentation of BooleanPrototype.h
22264
22265         Rubber stamped by Mark Hahnenberg.
22266
22267         * runtime/BooleanPrototype.h:
22268
22269 2012-11-09  Filip Pizlo  <fpizlo@apple.com>
22270
22271         Fix indentation of BooleanObject.h
22272
22273         Rubber stamped by Mark Hahnenberg.
22274
22275         * runtime/BooleanObject.h:
22276
22277 2012-11-09  Filip Pizlo  <fpizlo@apple.com>
22278
22279         Fix indentation of BooleanConstructor.h
22280
22281         Rubber stamped by Mark Hahnenberg.
22282
22283         * runtime/BooleanConstructor.h:
22284
22285 2012-11-09  Filip Pizlo  <fpizlo@apple.com>
22286
22287         Fix indentation of BatchedTransitionOptimizer.h
22288
22289         Rubber stamped by Mark Hahnenberg.
22290
22291         * runtime/BatchedTransitionOptimizer.h:
22292
22293 2012-11-09  Oliver Hunt  <oliver@apple.com>
22294
22295         So Thingy probably isn't the best name for a class, so
22296         renamed to CacheMap.
22297
22298         RS=Geoff
22299
22300         * runtime/CodeCache.h:
22301         (JSC::CacheMap::CacheMap):
22302
22303 2012-11-09  Filip Pizlo  <fpizlo@apple.com>
22304
22305         ArrayPrototype should start out with a blank indexing type
22306         https://bugs.webkit.org/show_bug.cgi?id=101719
22307
22308         Reviewed by Mark Hahnenberg.
22309
22310         This allows us to track if the array prototype ever ends up with indexed
22311         properties.
22312
22313         * runtime/ArrayPrototype.cpp:
22314         (JSC::ArrayPrototype::create):
22315         (JSC::ArrayPrototype::ArrayPrototype):
22316         * runtime/ArrayPrototype.h:
22317         (ArrayPrototype):
22318         (JSC::ArrayPrototype::createStructure):
22319
22320 2012-11-08  Mark Hahnenberg  <mhahnenberg@apple.com>
22321
22322         MarkStackArray should use the BlockAllocator instead of the MarkStackSegmentAllocator
22323         https://bugs.webkit.org/show_bug.cgi?id=101642
22324
22325         Reviewed by Filip Pizlo.
22326
22327         MarkStackSegmentAllocator is like a miniature version of the BlockAllocator. Now that the BlockAllocator has support
22328         for a variety of block sizes, we should get rid of the MarkStackSegmentAllocator in favor of the BlockAllocator.
22329
22330         * heap/BlockAllocator.h: Add new specializations of regionSetFor for the new MarkStackSegments.
22331         (JSC):
22332         (JSC::MarkStackSegment):
22333         * heap/GCThreadSharedData.cpp:
22334         (JSC::GCThreadSharedData::GCThreadSharedData):
22335         (JSC::GCThreadSharedData::reset):
22336         * heap/GCThreadSharedData.h:
22337         (GCThreadSharedData):
22338         * heap/MarkStack.cpp:
22339         (JSC::MarkStackArray::MarkStackArray): We now have a doubly linked list of MarkStackSegments, so we need to refactor
22340         all the places that used the old custom tail/previous logic.
22341         (JSC::MarkStackArray::~MarkStackArray):
22342         (JSC::MarkStackArray::expand):
22343         (JSC::MarkStackArray::refill):
22344         (JSC::MarkStackArray::donateSomeCellsTo): Refactor to use the new linked list.
22345         (JSC::MarkStackArray::stealSomeCellsFrom): Ditto.
22346         * heap/MarkStack.h:
22347         (JSC):
22348         (MarkStackSegment):
22349         (JSC::MarkStackSegment::MarkStackSegment):
22350         (JSC::MarkStackSegment::sizeFromCapacity):
22351         (MarkStackArray):
22352         * heap/MarkStackInlines.h:
22353         (JSC::MarkStackSegment::create):
22354         (JSC):
22355         (JSC::MarkStackArray::postIncTop):
22356         (JSC::MarkStackArray::preDecTop):
22357         (JSC::MarkStackArray::setTopForFullSegment):
22358         (JSC::MarkStackArray::setTopForEmptySegment):
22359         (JSC::MarkStackArray::top):
22360         (JSC::MarkStackArray::validatePrevious):
22361         (JSC::MarkStackArray::append):
22362         (JSC::MarkStackArray::removeLast):
22363         (JSC::MarkStackArray::isEmpty):
22364         (JSC::MarkStackArray::size):
22365         * heap/SlotVisitor.cpp:
22366         (JSC::SlotVisitor::SlotVisitor):
22367
22368 2012-11-09  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
22369
22370         [Qt] r133953 broke the ARM_TRADITIONAL build
22371         https://bugs.webkit.org/show_bug.cgi?id=101706
22372
22373         Reviewed by Csaba Osztrogonác.
22374
22375         Fix for both hardfp and softfp.
22376
22377         * dfg/DFGCCallHelpers.h:
22378         (CCallHelpers):
22379         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
22380
22381 2012-11-09  Sheriff Bot  <webkit.review.bot@gmail.com>
22382
22383         Unreviewed, rolling out r134051.
22384         http://trac.webkit.org/changeset/134051
22385         https://bugs.webkit.org/show_bug.cgi?id=101757
22386
22387         It didn't fix the build (Requested by Ossy on #webkit).
22388
22389         * dfg/DFGCCallHelpers.h:
22390         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
22391
22392 2012-11-09  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
22393
22394         [Qt] r133953 broke the ARM_TRADITIONAL build
22395         https://bugs.webkit.org/show_bug.cgi?id=101706
22396
22397         Reviewed by Csaba Osztrogonác.
22398
22399         Fix the ARM_TRADITIONAL build after r133953
22400
22401         * dfg/DFGCCallHelpers.h:
22402         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
22403         (CCallHelpers):
22404
22405 2012-11-09  Csaba Osztrogonác  <ossy@webkit.org>
22406
22407         [Qt] Fix the LLINT build from ARMv7 platform
22408         https://bugs.webkit.org/show_bug.cgi?id=101712
22409
22410         Reviewed by Simon Hausmann.
22411
22412         Enable generating of LLIntAssembly.h on ARM platforms.
22413
22414         * DerivedSources.pri:
22415         * JavaScriptCore.pro:
22416
22417 2012-11-08  Filip Pizlo  <fpizlo@apple.com>
22418
22419         ArrayPrototype.h should have correct indentation
22420
22421         Rubber stamped by Sam Weinig.
22422
22423         * runtime/ArrayPrototype.h:
22424
22425 2012-11-08  Mark Lam  <mark.lam@apple.com>
22426
22427         Renamed ...InlineMethods.h files to ...Inlines.h.
22428         https://bugs.webkit.org/show_bug.cgi?id=101145.
22429
22430         Reviewed by Geoffrey Garen.
22431
22432         This is only a refactoring effort to rename the files. There are no
22433         functionality changes.
22434
22435         * API/JSObjectRef.cpp:
22436         * GNUmakefile.list.am:
22437         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
22438         * JavaScriptCore.xcodeproj/project.pbxproj:
22439         * bytecode/CodeBlock.cpp:
22440         * dfg/DFGOperations.cpp:
22441         * heap/ConservativeRoots.cpp:
22442         * heap/CopiedBlock.h:
22443         * heap/CopiedSpace.cpp:
22444         * heap/CopiedSpaceInlineMethods.h: Removed.
22445         * heap/CopiedSpaceInlines.h: Copied from Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h.
22446         * heap/CopyVisitor.cpp:
22447         * heap/CopyVisitorInlineMethods.h: Removed.
22448         * heap/CopyVisitorInlines.h: Copied from Source/JavaScriptCore/heap/CopyVisitorInlineMethods.h.
22449         * heap/GCThread.cpp:
22450         * heap/GCThreadSharedData.cpp:
22451         * heap/HandleStack.cpp:
22452         * heap/Heap.cpp:
22453         * heap/HeapRootVisitor.h:
22454         * heap/MarkStack.cpp:
22455         * heap/MarkStackInlineMethods.h: Removed.
22456         * heap/MarkStackInlines.h: Copied from Source/JavaScriptCore/heap/MarkStackInlineMethods.h.
22457         * heap/SlotVisitor.cpp:
22458         * heap/SlotVisitor.h:
22459         * heap/SlotVisitorInlineMethods.h: Removed.
22460         * heap/SlotVisitorInlines.h: Copied from Source/JavaScriptCore/heap/SlotVisitorInlineMethods.h.
22461         * jit/HostCallReturnValue.cpp:
22462         * jit/JIT.cpp:
22463         * jit/JITArithmetic.cpp:
22464         * jit/JITArithmetic32_64.cpp:
22465         * jit/JITCall.cpp:
22466         * jit/JITCall32_64.cpp:
22467         * jit/JITInlineMethods.h: Removed.
22468         * jit/JITInlines.h: Copied from Source/JavaScriptCore/jit/JITInlineMethods.h.
22469         * jit/JITOpcodes.cpp:
22470         * jit/JITOpcodes32_64.cpp:
22471         * jit/JITPropertyAccess.cpp:
22472         * jit/JITPropertyAccess32_64.cpp:
22473         * jsc.cpp:
22474         * runtime/ArrayConstructor.cpp:
22475         * runtime/ArrayPrototype.cpp:
22476         * runtime/ButterflyInlineMethods.h: Removed.
22477         * runtime/ButterflyInlines.h: Copied from Source/JavaScriptCore/runtime/ButterflyInlineMethods.h.
22478         * runtime/IndexingHeaderInlineMethods.h: Removed.
22479         * runtime/IndexingHeaderInlines.h: Copied from Source/JavaScriptCore/runtime/IndexingHeaderInlineMethods.h.
22480         * runtime/JSActivation.h:
22481         * runtime/JSArray.cpp:
22482         * runtime/JSArray.h:
22483         * runtime/JSCell.h:
22484         * runtime/JSObject.cpp:
22485         * runtime/JSValueInlineMethods.h: Removed.
22486         * runtime/JSValueInlines.h: Copied from Source/JavaScriptCore/runtime/JSValueInlineMethods.h.
22487         * runtime/LiteralParser.cpp:
22488         * runtime/ObjectConstructor.cpp:
22489         * runtime/Operations.h:
22490         * runtime/RegExpMatchesArray.cpp:
22491         * runtime/RegExpObject.cpp:
22492         * runtime/StringPrototype.cpp:
22493
22494 2012-11-08  Filip Pizlo  <fpizlo@apple.com>
22495
22496         ArrayConstructor.h should have correct indentation
22497
22498         Rubber stamped by Sam Weinig.
22499
22500         * runtime/ArrayConstructor.h:
22501
22502 2012-11-08  Filip Pizlo  <fpizlo@apple.com>
22503
22504         DFG should know that int == null is always false
22505         https://bugs.webkit.org/show_bug.cgi?id=101665
22506
22507         Reviewed by Oliver Hunt.
22508
22509         * dfg/DFGAbstractState.cpp:
22510         (JSC::DFG::AbstractState::execute):
22511
22512 2012-11-08  Filip Pizlo  <fpizlo@apple.com>
22513
22514         Arguments.h should have correct indentation
22515
22516         Rubber stamped by Sam Weinig.
22517
22518         * runtime/Arguments.h:
22519
22520 2012-11-08  Filip Pizlo  <fpizlo@apple.com>
22521
22522         It should be possible to JIT compile get_by_vals and put_by_vals even if the DFG is disabled.
22523
22524         Reviewed by Oliver Hunt.
22525
22526         * jit/JITInlineMethods.h:
22527         (JSC::JIT::chooseArrayMode):
22528
22529 2012-11-08  Filip Pizlo  <fpizlo@apple.com>
22530
22531         op_call should have LLInt call link info even if the DFG is disabled
22532         https://bugs.webkit.org/show_bug.cgi?id=101672
22533
22534         Reviewed by Oliver Hunt.
22535
22536         Get rid of the evil uses of fall-through.
22537
22538         * bytecode/CodeBlock.cpp:
22539         (JSC::CodeBlock::CodeBlock):
22540
22541 2012-11-08  Oliver Hunt  <oliver@apple.com>
22542
22543         Improve effectiveness of function-level caching
22544         https://bugs.webkit.org/show_bug.cgi?id=101667
22545
22546         Reviewed by Filip Pizlo.
22547
22548         Added a random-eviction based cache for unlinked functions, and switch
22549         UnlinkedFunctionExecutable's code references to Weak<>, thereby letting
22550         us remove the explicit UnlinkedFunctionExecutable::clearCode() calls that
22551         were being triggered by GC.
22552
22553         Refactored the random eviction part of the CodeCache into a separate data
22554         structure so that I didn't have to duplicate the code again, and then used
22555         that for the new function cache.
22556
22557         * bytecode/UnlinkedCodeBlock.cpp:
22558         (JSC::UnlinkedFunctionExecutable::visitChildren):
22559         (JSC::UnlinkedFunctionExecutable::codeBlockFor):
22560         * bytecode/UnlinkedCodeBlock.h:
22561         (JSC::UnlinkedFunctionExecutable::clearCodeForRecompilation):
22562         (UnlinkedFunctionExecutable):
22563         * debugger/Debugger.cpp:
22564         * runtime/CodeCache.cpp:
22565         (JSC::CodeCache::getCodeBlock):
22566         (JSC::CodeCache::generateFunctionCodeBlock):
22567         (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
22568         (JSC::CodeCache::usedFunctionCode):
22569         (JSC):
22570         * runtime/Executable.cpp:
22571         (JSC::FunctionExecutable::clearUnlinkedCodeForRecompilationIfNotCompiling):
22572         (JSC::FunctionExecutable::clearCode):
22573         * runtime/Executable.h:
22574         (FunctionExecutable):
22575
22576 2012-11-07  Filip Pizlo  <fpizlo@apple.com>
22577
22578         DFG constant folding and CFG simplification should be smart enough to know that if a logical op's operand is proven to have a non-masquerading structure then it always evaluates to true
22579         https://bugs.webkit.org/show_bug.cgi?id=101511
22580
22581         Reviewed by Oliver Hunt.
22582
22583         To make life easier, this moves BranchDirection into BasicBlock so that after
22584         running the CFA, we always know, for each block, what direction the CFA
22585         proved. CFG simplification now both uses and preserves cfaBranchDirection in
22586         its transformations.
22587
22588         Also made both LogicalNot and Branch check whether the operand is a known cell
22589         with a known structure, and if so, made them do the appropriate folding.
22590
22591         5% speed-up on V8/raytrace because it makes raytrace's own null checks
22592         evaporate (i.e. idioms like 'if (!x) throw "unhappiness"') thanks to the fact
22593         that we were already doing structure check hoisting.
22594
22595         * JavaScriptCore.xcodeproj/project.pbxproj:
22596         * dfg/DFGAbstractState.cpp:
22597         (JSC::DFG::AbstractState::endBasicBlock):
22598         (JSC::DFG::AbstractState::execute):
22599         (JSC::DFG::AbstractState::mergeToSuccessors):
22600         * dfg/DFGAbstractState.h:
22601         (AbstractState):
22602         * dfg/DFGBasicBlock.h:
22603         (JSC::DFG::BasicBlock::BasicBlock):
22604         (BasicBlock):
22605         * dfg/DFGBranchDirection.h: Added.
22606         (DFG):
22607         (JSC::DFG::branchDirectionToString):
22608         (JSC::DFG::isKnownDirection):
22609         (JSC::DFG::branchCondition):
22610         * dfg/DFGCFGSimplificationPhase.cpp:
22611         (JSC::DFG::CFGSimplificationPhase::run):
22612         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
22613
22614 2012-11-08  Christophe Dumez  <christophe.dumez@intel.com>
22615
22616         [JSC] HTML extensions to String.prototype should escape " as &quot; in argument values
22617         https://bugs.webkit.org/show_bug.cgi?id=90667
22618
22619         Reviewed by Benjamin Poulain.
22620
22621         Escape quotation mark as &quot; in argument values to:
22622         - String.prototype.anchor(name)
22623         - String.prototype.fontcolor(color)
22624         - String.prototype.fontsize(size)
22625         - String.prototype.link(href)
22626
22627         This behavior matches Chromium/V8 and Firefox/Spidermonkey
22628         implementations and is requited by:
22629         http://mathias.html5.org/specs/javascript/#escapeattributevalue
22630
22631         This also fixes a potential security risk (XSS vector).
22632
22633         * runtime/StringPrototype.cpp:
22634         (JSC::stringProtoFuncFontcolor):
22635         (JSC::stringProtoFuncFontsize):
22636         (JSC::stringProtoFuncAnchor):
22637         (JSC::stringProtoFuncLink):
22638
22639 2012-11-08  Anders Carlsson  <andersca@apple.com>
22640
22641         HeapStatistics::s_pauseTimeStarts and s_pauseTimeEnds should be Vectors
22642         https://bugs.webkit.org/show_bug.cgi?id=101651
22643
22644         Reviewed by Andreas Kling.
22645
22646         HeapStatistics uses Deques when Vectors would work just as good.
22647
22648         * heap/HeapStatistics.cpp:
22649         * heap/HeapStatistics.h:
22650         (HeapStatistics):
22651
22652 2012-11-07  Filip Pizlo  <fpizlo@apple.com>
22653
22654         DFG should not assume that something is a double just because it might be undefined
22655         https://bugs.webkit.org/show_bug.cgi?id=101438
22656
22657         Reviewed by Oliver Hunt.
22658
22659         This changes all non-bitop arithmetic to (a) statically expect that variables are
22660         defined prior to use in arithmetic and (b) not fall off into double paths just
22661         because a value may not be a number. This is accomplished with two new notions of
22662         speculation:
22663
22664         shouldSpeculateIntegerExpectingDefined: Should we speculate that the value is an
22665         integer if we ignore undefined (i.e. SpecOther) predictions?
22666
22667         shouldSpeculateIntegerForArithmetic: Should we speculate that the value is an
22668         integer if we ignore non-numeric predictions?
22669
22670         This is a ~2x speed-up on programs that seem to our prediction propagator to have
22671         paths in which otherwise numeric variables are undefined.
22672
22673         * bytecode/SpeculatedType.h:
22674         (JSC::isInt32SpeculationForArithmetic):
22675         (JSC):
22676         (JSC::isInt32SpeculationExpectingDefined):
22677         (JSC::isDoubleSpeculationForArithmetic):
22678         (JSC::isNumberSpeculationExpectingDefined):
22679         * dfg/DFGAbstractState.cpp:
22680         (JSC::DFG::AbstractState::execute):
22681         * dfg/DFGFixupPhase.cpp:
22682         (JSC::DFG::FixupPhase::fixupNode):
22683         * dfg/DFGGraph.h:
22684         (JSC::DFG::Graph::addShouldSpeculateInteger):
22685         (JSC::DFG::Graph::mulShouldSpeculateInteger):
22686         (JSC::DFG::Graph::negateShouldSpeculateInteger):
22687         (JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
22688         (JSC::DFG::Graph::mulImmediateShouldSpeculateInteger):
22689         * dfg/DFGNode.h:
22690         (JSC::DFG::Node::shouldSpeculateIntegerForArithmetic):
22691         (Node):
22692         (JSC::DFG::Node::shouldSpeculateIntegerExpectingDefined):
22693         (JSC::DFG::Node::shouldSpeculateDoubleForArithmetic):
22694         (JSC::DFG::Node::shouldSpeculateNumberExpectingDefined):
22695         * dfg/DFGPredictionPropagationPhase.cpp:
22696         (JSC::DFG::PredictionPropagationPhase::propagate):
22697         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
22698         * dfg/DFGSpeculativeJIT.cpp:
22699         (JSC::DFG::SpeculativeJIT::compileAdd):
22700         (JSC::DFG::SpeculativeJIT::compileArithMod):
22701         * dfg/DFGSpeculativeJIT32_64.cpp:
22702         (JSC::DFG::SpeculativeJIT::compile):
22703         * dfg/DFGSpeculativeJIT64.cpp:
22704         (JSC::DFG::SpeculativeJIT::compile):
22705         * jit/JITArithmetic.cpp:
22706         (JSC::JIT::emit_op_div):
22707
22708 2012-11-06  Filip Pizlo  <fpizlo@apple.com>
22709
22710         JSC should infer when indexed storage contains only integers or doubles
22711         https://bugs.webkit.org/show_bug.cgi?id=98606
22712
22713         Reviewed by Oliver Hunt.
22714
22715         This adds two new indexing types: int32 and double. It also adds array allocation profiling,
22716         which allows array allocations to converge to allocating arrays using those types to which
22717         those arrays would have been converted.
22718
22719         20% speed-up on navier-stokes. 40% speed-up on various Kraken DSP tests. Some slow-downs too,
22720         but a performance win overall on all benchmarks we track.
22721
22722         * API/JSObjectRef.cpp:
22723         (JSObjectMakeArray):
22724         * CMakeLists.txt:
22725         * GNUmakefile.list.am:
22726         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
22727         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
22728         * JavaScriptCore.xcodeproj/project.pbxproj:
22729         * Target.pri:
22730         * assembler/AbstractMacroAssembler.h:
22731         (JumpList):
22732         (JSC::AbstractMacroAssembler::JumpList::JumpList):
22733         * assembler/MacroAssemblerX86Common.h:
22734         (JSC::MacroAssemblerX86Common::branchDouble):
22735         * assembler/X86Assembler.h:
22736         (JSC::X86Assembler::jnp):
22737         (X86Assembler):
22738         (JSC::X86Assembler::X86InstructionFormatter::emitRex):
22739         * bytecode/ArrayAllocationProfile.cpp: Added.
22740         (JSC):
22741         (JSC::ArrayAllocationProfile::updateIndexingType):
22742         * bytecode/ArrayAllocationProfile.h: Added.
22743         (JSC):
22744         (ArrayAllocationProfile):
22745         (JSC::ArrayAllocationProfile::ArrayAllocationProfile):
22746         (JSC::ArrayAllocationProfile::selectIndexingType):
22747         (JSC::ArrayAllocationProfile::updateLastAllocation):
22748         (JSC::ArrayAllocationProfile::selectIndexingTypeFor):
22749         (JSC::ArrayAllocationProfile::updateLastAllocationFor):
22750         * bytecode/ArrayProfile.cpp:
22751         (JSC::ArrayProfile::updatedObservedArrayModes):
22752         (JSC):
22753         * bytecode/ArrayProfile.h:
22754         (JSC):
22755         (JSC::arrayModesInclude):
22756         (JSC::shouldUseSlowPutArrayStorage):
22757         (JSC::shouldUseFastArrayStorage):
22758         (JSC::shouldUseContiguous):
22759         (JSC::shouldUseDouble):
22760         (JSC::shouldUseInt32):
22761         (ArrayProfile):
22762         * bytecode/ByValInfo.h:
22763         (JSC::isOptimizableIndexingType):
22764         (JSC::jitArrayModeForIndexingType):
22765         * bytecode/CodeBlock.cpp:
22766         (JSC::CodeBlock::dump):
22767         (JSC::CodeBlock::CodeBlock):
22768         (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
22769         (JSC):
22770         (JSC::CodeBlock::updateAllValueProfilePredictions):
22771         (JSC::CodeBlock::updateAllArrayPredictions):
22772         (JSC::CodeBlock::updateAllPredictions):
22773         (JSC::CodeBlock::shouldOptimizeNow):
22774         * bytecode/CodeBlock.h:
22775         (CodeBlock):
22776         (JSC::CodeBlock::numberOfArrayAllocationProfiles):
22777         (JSC::CodeBlock::addArrayAllocationProfile):
22778         (JSC::CodeBlock::updateAllValueProfilePredictions):
22779         (JSC::CodeBlock::updateAllArrayPredictions):
22780         * bytecode/DFGExitProfile.h:
22781         (JSC::DFG::exitKindToString):
22782         * bytecode/Instruction.h:
22783         (JSC):
22784         (JSC::Instruction::Instruction):
22785         * bytecode/Opcode.h:
22786         (JSC):
22787         (JSC::padOpcodeName):
22788         * bytecode/SpeculatedType.h:
22789         (JSC):
22790         (JSC::isRealNumberSpeculation):
22791         * bytecode/UnlinkedCodeBlock.cpp:
22792         (JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
22793         * bytecode/UnlinkedCodeBlock.h:
22794         (JSC):
22795         (JSC::UnlinkedCodeBlock::addArrayAllocationProfile):
22796         (JSC::UnlinkedCodeBlock::numberOfArrayAllocationProfiles):
22797         (UnlinkedCodeBlock):
22798         * bytecompiler/BytecodeGenerator.cpp:
22799         (JSC::BytecodeGenerator::newArrayAllocationProfile):
22800         (JSC):
22801         (JSC::BytecodeGenerator::emitNewArray):
22802         (JSC::BytecodeGenerator::emitExpectedFunctionSnippet):
22803         * bytecompiler/BytecodeGenerator.h:
22804         (BytecodeGenerator):
22805         * dfg/DFGAbstractState.cpp:
22806         (JSC::DFG::AbstractState::execute):
22807         * dfg/DFGArrayMode.cpp:
22808         (JSC::DFG::ArrayMode::fromObserved):
22809         (JSC::DFG::ArrayMode::refine):
22810         (DFG):
22811         (JSC::DFG::ArrayMode::alreadyChecked):
22812         (JSC::DFG::arrayTypeToString):
22813         * dfg/DFGArrayMode.h:
22814         (JSC::DFG::ArrayMode::withType):
22815         (ArrayMode):
22816         (JSC::DFG::ArrayMode::withTypeAndConversion):
22817         (JSC::DFG::ArrayMode::usesButterfly):
22818         (JSC::DFG::ArrayMode::isSpecific):
22819         (JSC::DFG::ArrayMode::supportsLength):
22820         (JSC::DFG::ArrayMode::arrayModesThatPassFiltering):
22821         * dfg/DFGByteCodeParser.cpp:
22822         (JSC::DFG::ByteCodeParser::getArrayMode):
22823         (ByteCodeParser):
22824         (JSC::DFG::ByteCodeParser::handleIntrinsic):
22825         (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
22826         (JSC::DFG::ByteCodeParser::parseBlock):
22827         * dfg/DFGCCallHelpers.h:
22828         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
22829         (CCallHelpers):
22830         * dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
22831         (JSC::DFG::CallArrayAllocatorSlowPathGenerator::generateInternal):
22832         (JSC::DFG::CallArrayAllocatorWithVariableSizeSlowPathGenerator::generateInternal):
22833         * dfg/DFGFixupPhase.cpp:
22834         (JSC::DFG::FixupPhase::fixupNode):
22835         (JSC::DFG::FixupPhase::checkArray):
22836         * dfg/DFGGraph.cpp:
22837         (JSC::DFG::Graph::dump):
22838         * dfg/DFGGraph.h:
22839         (JSC::DFG::Graph::byValIsPure):
22840         * dfg/DFGNode.h:
22841         (NewArrayBufferData):
22842         (JSC::DFG::Node::hasIndexingType):
22843         (Node):
22844         (JSC::DFG::Node::indexingType):
22845         (JSC::DFG::Node::setIndexingType):
22846         * dfg/DFGOperations.cpp:
22847         * dfg/DFGOperations.h:
22848         * dfg/DFGPredictionPropagationPhase.cpp:
22849         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
22850         * dfg/DFGSpeculativeJIT.cpp:
22851         (JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
22852         (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
22853         (DFG):
22854         (JSC::DFG::SpeculativeJIT::checkArray):
22855         (JSC::DFG::SpeculativeJIT::arrayify):
22856         (JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
22857         (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
22858         * dfg/DFGSpeculativeJIT.h:
22859         (JSC::DFG::SpeculativeJIT::callOperation):
22860         (SpeculativeJIT):
22861         (SpeculateIntegerOperand):
22862         (JSC::DFG::SpeculateIntegerOperand::use):
22863         (SpeculateDoubleOperand):
22864         (JSC::DFG::SpeculateDoubleOperand::use):
22865         * dfg/DFGSpeculativeJIT32_64.cpp:
22866         (DFG):
22867         (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
22868         (JSC::DFG::SpeculativeJIT::compile):
22869         * dfg/DFGSpeculativeJIT64.cpp:
22870         (JSC::DFG::SpeculativeJIT::compile):
22871         * jit/JIT.h:
22872         (JSC::JIT::emitInt32GetByVal):
22873         (JIT):
22874         (JSC::JIT::emitInt32PutByVal):
22875         (JSC::JIT::emitDoublePutByVal):
22876         (JSC::JIT::emitContiguousPutByVal):
22877         * jit/JITExceptions.cpp:
22878         (JSC::genericThrow):
22879         * jit/JITInlineMethods.h:
22880         (JSC::arrayProfileSaw):
22881         (JSC::JIT::chooseArrayMode):
22882         * jit/JITOpcodes.cpp:
22883         (JSC::JIT::emit_op_new_array):
22884         (JSC::JIT::emit_op_new_array_with_size):
22885         (JSC::JIT::emit_op_new_array_buffer):
22886         * jit/JITPropertyAccess.cpp:
22887         (JSC::JIT::emit_op_get_by_val):
22888         (JSC::JIT::emitDoubleGetByVal):
22889         (JSC):
22890         (JSC::JIT::emitContiguousGetByVal):
22891         (JSC::JIT::emit_op_put_by_val):
22892         (JSC::JIT::emitGenericContiguousPutByVal):
22893         (JSC::JIT::emitSlow_op_put_by_val):
22894         (JSC::JIT::privateCompileGetByVal):
22895         (JSC::JIT::privateCompilePutByVal):
22896         * jit/JITPropertyAccess32_64.cpp:
22897         (JSC::JIT::emit_op_get_by_val):
22898         (JSC::JIT::emitContiguousGetByVal):
22899         (JSC::JIT::emitDoubleGetByVal):
22900         (JSC):
22901         (JSC::JIT::emit_op_put_by_val):
22902         (JSC::JIT::emitGenericContiguousPutByVal):
22903         (JSC::JIT::emitSlow_op_put_by_val):
22904         * jit/JITStubs.cpp:
22905         (JSC::DEFINE_STUB_FUNCTION):
22906         * jit/JITStubs.h:
22907         (JSC):
22908         * jsc.cpp:
22909         (GlobalObject::finishCreation):
22910         * llint/LLIntSlowPaths.cpp:
22911         (JSC::LLInt::jitCompileAndSetHeuristics):
22912         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
22913         * llint/LowLevelInterpreter.asm:
22914         * llint/LowLevelInterpreter32_64.asm:
22915         * llint/LowLevelInterpreter64.asm:
22916         * offlineasm/x86.rb:
22917         * runtime/ArrayConstructor.cpp:
22918         (JSC::constructArrayWithSizeQuirk):
22919         * runtime/ArrayConstructor.h:
22920         (JSC):
22921         * runtime/ArrayPrototype.cpp:
22922         (JSC::arrayProtoFuncConcat):
22923         (JSC::arrayProtoFuncSlice):
22924         (JSC::arrayProtoFuncSplice):
22925         (JSC::arrayProtoFuncFilter):
22926         (JSC::arrayProtoFuncMap):
22927         * runtime/Butterfly.h:
22928         (JSC::Butterfly::contiguousInt32):
22929         (JSC::Butterfly::contiguousDouble):
22930         (JSC::Butterfly::fromContiguous):
22931         * runtime/ButterflyInlineMethods.h:
22932         (JSC::Butterfly::createUninitializedDuringCollection):
22933         * runtime/FunctionPrototype.cpp:
22934         (JSC::functionProtoFuncBind):
22935         * runtime/IndexingHeaderInlineMethods.h:
22936         (JSC::IndexingHeader::indexingPayloadSizeInBytes):
22937         * runtime/IndexingType.cpp:
22938         (JSC::leastUpperBoundOfIndexingTypes):
22939         (JSC):
22940         (JSC::leastUpperBoundOfIndexingTypeAndType):
22941         (JSC::leastUpperBoundOfIndexingTypeAndValue):
22942         (JSC::indexingTypeToString):
22943         * runtime/IndexingType.h:
22944         (JSC):
22945         (JSC::hasUndecided):
22946         (JSC::hasInt32):
22947         (JSC::hasDouble):
22948         * runtime/JSArray.cpp:
22949         (JSC::JSArray::setLength):
22950         (JSC::JSArray::pop):
22951         (JSC::JSArray::push):
22952         (JSC::JSArray::shiftCountWithAnyIndexingType):
22953         (JSC::JSArray::unshiftCountWithAnyIndexingType):
22954         (JSC::compareNumbersForQSortWithInt32):
22955         (JSC):
22956         (JSC::compareNumbersForQSortWithDouble):
22957         (JSC::JSArray::sortNumericVector):
22958         (JSC::JSArray::sortNumeric):
22959         (JSC::JSArray::sortCompactedVector):
22960         (JSC::JSArray::sort):
22961         (JSC::JSArray::sortVector):
22962         (JSC::JSArray::fillArgList):
22963         (JSC::JSArray::copyToArguments):
22964         (JSC::JSArray::compactForSorting):
22965         * runtime/JSArray.h:
22966         (JSArray):
22967         (JSC::createContiguousArrayButterfly):
22968         (JSC::JSArray::create):
22969         (JSC::JSArray::tryCreateUninitialized):
22970         * runtime/JSGlobalObject.cpp:
22971         (JSC::JSGlobalObject::reset):
22972         (JSC):
22973         (JSC::JSGlobalObject::haveABadTime):
22974         (JSC::JSGlobalObject::visitChildren):
22975         * runtime/JSGlobalObject.h:
22976         (JSGlobalObject):
22977         (JSC::JSGlobalObject::originalArrayStructureForIndexingType):
22978         (JSC::JSGlobalObject::arrayStructureForIndexingTypeDuringAllocation):
22979         (JSC::JSGlobalObject::arrayStructureForProfileDuringAllocation):
22980         (JSC::JSGlobalObject::isOriginalArrayStructure):
22981         (JSC::constructEmptyArray):
22982         (JSC::constructArray):
22983         * runtime/JSObject.cpp:
22984         (JSC::JSObject::copyButterfly):
22985         (JSC::JSObject::getOwnPropertySlotByIndex):
22986         (JSC::JSObject::putByIndex):
22987         (JSC::JSObject::enterDictionaryIndexingMode):
22988         (JSC::JSObject::createInitialIndexedStorage):
22989         (JSC):
22990         (JSC::JSObject::createInitialUndecided):
22991         (JSC::JSObject::createInitialInt32):
22992         (JSC::JSObject::createInitialDouble):
22993         (JSC::JSObject::createInitialContiguous):
22994         (JSC::JSObject::convertUndecidedToInt32):
22995         (JSC::JSObject::convertUndecidedToDouble):
22996         (JSC::JSObject::convertUndecidedToContiguous):
22997         (JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
22998         (JSC::JSObject::convertUndecidedToArrayStorage):
22999         (JSC::JSObject::convertInt32ToDouble):
23000         (JSC::JSObject::convertInt32ToContiguous):
23001         (JSC::JSObject::convertInt32ToArrayStorage):
23002         (JSC::JSObject::convertDoubleToContiguous):
23003         (JSC::JSObject::convertDoubleToArrayStorage):
23004         (JSC::JSObject::convertContiguousToArrayStorage):
23005         (JSC::JSObject::convertUndecidedForValue):
23006         (JSC::JSObject::convertInt32ForValue):
23007         (JSC::JSObject::setIndexQuicklyToUndecided):
23008         (JSC::JSObject::convertInt32ToDoubleOrContiguousWhilePerformingSetIndex):
23009         (JSC::JSObject::convertDoubleToContiguousWhilePerformingSetIndex):
23010         (JSC::JSObject::ensureInt32Slow):
23011         (JSC::JSObject::ensureDoubleSlow):
23012         (JSC::JSObject::ensureContiguousSlow):
23013         (JSC::JSObject::ensureArrayStorageSlow):
23014         (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
23015         (JSC::JSObject::switchToSlowPutArrayStorage):
23016         (JSC::JSObject::deletePropertyByIndex):
23017         (JSC::JSObject::getOwnPropertyNames):
23018         (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
23019         (JSC::JSObject::putByIndexBeyondVectorLength):
23020         (JSC::JSObject::putDirectIndexBeyondVectorLength):
23021         (JSC::JSObject::getNewVectorLength):
23022         (JSC::JSObject::countElements):
23023         (JSC::JSObject::ensureLengthSlow):
23024         (JSC::JSObject::getOwnPropertyDescriptor):
23025         * runtime/JSObject.h:
23026         (JSC::JSObject::getArrayLength):
23027         (JSC::JSObject::getVectorLength):
23028         (JSC::JSObject::canGetIndexQuickly):
23029         (JSC::JSObject::getIndexQuickly):
23030         (JSC::JSObject::tryGetIndexQuickly):
23031         (JSC::JSObject::canSetIndexQuickly):
23032         (JSC::JSObject::canSetIndexQuicklyForPutDirect):
23033         (JSC::JSObject::setIndexQuickly):
23034         (JSC::JSObject::initializeIndex):
23035         (JSC::JSObject::hasSparseMap):
23036         (JSC::JSObject::inSparseIndexingMode):
23037         (JSObject):
23038         (JSC::JSObject::ensureInt32):
23039         (JSC::JSObject::ensureDouble):
23040         (JSC::JSObject::ensureLength):
23041         (JSC::JSObject::indexingData):
23042         (JSC::JSObject::currentIndexingData):
23043         (JSC::JSObject::getHolyIndexQuickly):
23044         (JSC::JSObject::relevantLength):
23045         (JSC::JSObject::currentRelevantLength):
23046         * runtime/JSValue.cpp:
23047         (JSC::JSValue::description):
23048         * runtime/LiteralParser.cpp:
23049         (JSC::::parse):
23050         * runtime/ObjectConstructor.cpp:
23051         (JSC::objectConstructorGetOwnPropertyNames):
23052         (JSC::objectConstructorKeys):
23053         * runtime/StringPrototype.cpp:
23054         (JSC::stringProtoFuncMatch):
23055         (JSC::stringProtoFuncSplit):
23056         * runtime/Structure.cpp:
23057         (JSC::Structure::nonPropertyTransition):
23058         * runtime/StructureTransitionTable.h:
23059         (JSC::newIndexingType):
23060
23061 2012-11-08  Balazs Kilvady  <kilvadyb@homejinni.com>
23062
23063         ASSERT problem on MIPS
23064         https://bugs.webkit.org/show_bug.cgi?id=100589
23065
23066         Reviewed by Oliver Hunt.
23067
23068         ASSERT fix for MIPS arch.
23069
23070         * jit/JITOpcodes.cpp:
23071         (JSC::JIT::emit_resolve_operations):
23072
23073 2012-11-08  Michael Saboff  <msaboff@apple.com>
23074
23075         OpaqueJSClassContextData() should use StringImpl::isolatedCopy() to make string copies
23076         https://bugs.webkit.org/show_bug.cgi?id=101507
23077
23078         Reviewed by Andreas Kling.
23079
23080         Changed to use isolatedCopy() for key Strings.
23081
23082         * API/JSClassRef.cpp:
23083         (OpaqueJSClassContextData::OpaqueJSClassContextData):
23084
23085 2012-11-07  Mark Hahnenberg  <mhahnenberg@apple.com>
23086
23087         WeakBlocks should be HeapBlocks
23088         https://bugs.webkit.org/show_bug.cgi?id=101411
23089
23090         Reviewed by Oliver Hunt.
23091
23092         Currently WeakBlocks use fastMalloc memory. They are very similar to the other HeapBlocks, however,
23093         so we should change them to being allocated with the BlockAllocator.
23094
23095         * heap/BlockAllocator.cpp:
23096         (JSC::BlockAllocator::BlockAllocator):
23097         * heap/BlockAllocator.h: Added a new RegionSet for WeakBlocks.
23098         (JSC):
23099         (BlockAllocator):
23100         (JSC::WeakBlock):
23101         * heap/Heap.h: Friended WeakSet to allow access to the BlockAllocator.
23102         (Heap):
23103         * heap/WeakBlock.cpp:
23104         (JSC::WeakBlock::create): Refactored to use HeapBlocks rather than fastMalloc.
23105         (JSC::WeakBlock::WeakBlock):
23106         * heap/WeakBlock.h: Changed the WeakBlock size to 4 KB so that it divides evenly into the Region size.
23107         (JSC):
23108         (WeakBlock):
23109         * heap/WeakSet.cpp:
23110         (JSC::WeakSet::~WeakSet):
23111         (JSC::WeakSet::addAllocator):
23112
23113 2012-11-07  Filip Pizlo  <fpizlo@apple.com>
23114
23115         Indentation of ArgList.h is wrong
23116         https://bugs.webkit.org/show_bug.cgi?id=101441
23117
23118         Reviewed by Andreas Kling.
23119
23120         Just unindented by 4 spaces.
23121
23122         * runtime/ArgList.h:
23123
23124 2012-11-07  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
23125
23126         [Qt][ARM] REGRESSION(r133688): It made all JSC and layout tests crash on ARM traditional platform
23127         https://bugs.webkit.org/show_bug.cgi?id=101465
23128
23129         Reviewed by Oliver Hunt.
23130
23131         Fix failing javascriptcore tests on ARM after r133688
23132
23133         * bytecode/CodeBlock.cpp:
23134         (JSC::CodeBlock::CodeBlock):
23135
23136 2012-11-06  Oliver Hunt  <oliver@apple.com>
23137
23138         Reduce parser overhead in JSC
23139         https://bugs.webkit.org/show_bug.cgi?id=101127
23140
23141         Reviewed by Filip Pizlo.
23142
23143         An exciting journey into the world of architecture in which our hero
23144         adds yet another layer to JSC codegeneration.
23145
23146         This patch adds a marginally more compact form of bytecode that is
23147         free from any data specific to a given execution context, and that
23148         does store any data structures necessary for execution.  To actually
23149         execute this UnlinkedBytecode we still need to instantiate a real
23150         CodeBlock, but this is a much faster linear time operation than any
23151         of the earlier parsing or code generation passes.
23152
23153         As the unlinked code is context free we can then simply use a cache
23154         from source to unlinked code mapping to completely avoid all of the
23155         old parser overhead.  The cache is currently very simple and memory
23156         heavy, using the complete source text as a key (rather than SourceCode
23157         or equivalent), and a random eviction policy.
23158
23159         This seems to produce a substantial win when loading identical content
23160         in different contexts.
23161
23162         * API/tests/testapi.c:
23163         (main):
23164         * CMakeLists.txt:
23165         * GNUmakefile.list.am:
23166         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
23167         * JavaScriptCore.xcodeproj/project.pbxproj:
23168         * bytecode/CodeBlock.cpp:
23169         * bytecode/CodeBlock.h:
23170             Moved a number of fields, and a bunch of logic to UnlinkedCodeBlock.h/cpp
23171         * bytecode/Opcode.h:
23172             Added a global const init no op instruction needed to get correct
23173             behaviour without any associated semantics.
23174         * bytecode/UnlinkedCodeBlock.cpp: Added.
23175         * bytecode/UnlinkedCodeBlock.h: Added.
23176             A fairly shallow, GC allocated version of the old CodeBlock
23177             classes with a 32bit instruction size, and just metadata
23178             size tracking.
23179         * bytecompiler/BytecodeGenerator.cpp:
23180         * bytecompiler/BytecodeGenerator.h:
23181             Replace direct access to m_symbolTable with access through
23182             symbolTable().  ProgramCode no longer has a symbol table at
23183             all so some previously unconditional (and pointless) uses
23184             of symbolTable get null checks.
23185             A few other changes to deal with type changes due to us generating
23186             unlinked code (eg. pointer free, so profile indices rather than
23187             pointers).
23188         * dfg/DFGByteCodeParser.cpp:
23189         * dfg/DFGCapabilities.h:
23190             Support global_init_nop
23191         * interpreter/Interpreter.cpp:
23192             Now get the ProgramExecutable to initialise new global properties
23193             before starting execution.
23194         * jit/JIT.cpp:
23195         * jit/JITDriver.h:
23196         * jit/JITStubs.cpp:
23197         * llint/LLIntData.cpp:
23198         * llint/LLIntSlowPaths.cpp:
23199         * llint/LowLevelInterpreter.asm:
23200         * llint/LowLevelInterpreter32_64.asm:
23201         * llint/LowLevelInterpreter64.asm:
23202             Adding init_global_const_nop everywhere else
23203         * parser/Parser.h:
23204         * parser/ParserModes.h: Added.
23205         * parser/ParserTokens.h:
23206             Parser no longer needs a global object or callframe to function
23207         * runtime/CodeCache.cpp: Added.
23208         * runtime/CodeCache.h: Added.
23209             A simple, random eviction, Source->UnlinkedCode cache
23210         * runtime/Executable.cpp:
23211         * runtime/Executable.h:
23212             Executables now reference their unlinked counterparts, and
23213             request code specifically for the target global object.
23214         * runtime/JSGlobalData.cpp:
23215         * runtime/JSGlobalData.h:
23216             GlobalData now owns a CodeCache and a set of new structures
23217             for the unlinked code types.
23218         * runtime/JSGlobalObject.cpp:
23219         * runtime/JSGlobalObject.h:
23220             Utility functions used by executables to perform compilation
23221
23222         * runtime/JSType.h:
23223           Add new JSTypes for unlinked code
23224
23225 2012-11-06  Michael Saboff  <msaboff@apple.com>
23226
23227         JSStringCreateWithCFString() Should create an 8 bit String if possible
23228         https://bugs.webkit.org/show_bug.cgi?id=101104
23229
23230         Reviewed by Darin Adler.
23231
23232         Try converting the CFString to an 8 bit string using CFStringGetBytes(...,
23233         kCFStringEncodingISOLatin1, ...) and return the 8 bit string if successful.
23234         If not proceed with 16 bit conversion.
23235
23236         * API/JSStringRefCF.cpp:
23237         (JSStringCreateWithCFString):
23238
23239 2012-11-06  Oliver Hunt  <oliver@apple.com>
23240
23241         Reduce direct m_symbolTable usage in CodeBlock
23242         https://bugs.webkit.org/show_bug.cgi?id=101391
23243
23244         Reviewed by Sam Weinig.
23245
23246         Simple refactoring.
23247
23248         * bytecode/CodeBlock.cpp:
23249         (JSC::CodeBlock::dump):
23250         (JSC::CodeBlock::dumpStatistics):
23251         (JSC::CodeBlock::nameForRegister):
23252         * bytecode/CodeBlock.h:
23253         (JSC::CodeBlock::isCaptured):
23254
23255 2012-11-06  Michael Saboff  <msaboff@apple.com>
23256
23257         Lexer::scanRegExp, create 8 bit pattern and flag Identifiers from 16 bit source when possible
23258         https://bugs.webkit.org/show_bug.cgi?id=101013
23259
23260         Reviewed by Darin Adler.
23261
23262         Changed scanRegExp so that it will create 8 bit identifiers from 8 bit sources and from 16 bit sources
23263         whan all the characters are 8 bit.  Using two templated helpers, the "is all 8 bit" check is only performed
23264         on 16 bit sources.  The first helper is orCharacter() that will accumulate the or value of all characters
23265         only for 16 bit sources.  Replaced the helper Lexer::makeIdentifierSameType() with Lexer::makeRightSizedIdentifier().
23266
23267         * parser/Lexer.cpp:
23268         (JSC::orCharacter<LChar>): Explicit template that serves as a placeholder.
23269         (JSC::orCharacter<UChar>): Explicit template that actually or accumulates characters.
23270         (JSC::Lexer::scanRegExp):
23271         * parser/Lexer.h:
23272         (Lexer):
23273         (JSC::Lexer::makeRightSizedIdentifier<LChar>): New template that always creates an 8 bit Identifier.
23274         (JSC::Lexer::makeRightSizedIdentifier<UChar>): New template that creates an 8 bit Identifier for 8 bit
23275         data in a 16 bit source.
23276
23277 2012-11-06  Filip Pizlo  <fpizlo@apple.com>
23278
23279         Indentation of JSCell.h is wrong
23280         https://bugs.webkit.org/show_bug.cgi?id=101379
23281
23282         Rubber stamped by Alexey Proskuryakov.
23283
23284         Just removed four spaces on a bunch of lines.
23285
23286         * runtime/JSCell.h:
23287
23288 2012-11-05  Filip Pizlo  <fpizlo@apple.com>
23289
23290         Indentation of JSObject.h is wrong
23291         https://bugs.webkit.org/show_bug.cgi?id=101313
23292
23293         Rubber stamped by Alexey Proskuryakov.
23294
23295         Just unindented code, since namespace bodies shouldn't be indented.
23296
23297         * runtime/JSObject.h:
23298
23299 2012-11-05  Filip Pizlo  <fpizlo@apple.com>
23300
23301         Indentation of JSArray.h is wrong
23302         https://bugs.webkit.org/show_bug.cgi?id=101314
23303
23304         Rubber stamped by Alexey Proskuryakov.
23305
23306         Just removing the indentation inside the namespace body.
23307
23308         * runtime/JSArray.h:
23309
23310 2012-11-05  Filip Pizlo  <fpizlo@apple.com>
23311
23312         DFG should not fall down to patchable GetById just because a prototype had things added to it
23313         https://bugs.webkit.org/show_bug.cgi?id=101299
23314
23315         Reviewed by Geoffrey Garen.
23316
23317         This looks like a slight win on V8v7 and SunSpider.
23318
23319         * bytecode/DFGExitProfile.h:
23320         (JSC::DFG::exitKindToString):
23321         * dfg/DFGSpeculativeJIT64.cpp:
23322         (JSC::DFG::SpeculativeJIT::compile):
23323
23324 2012-11-05  Filip Pizlo  <fpizlo@apple.com>
23325
23326         Get rid of method_check
23327         https://bugs.webkit.org/show_bug.cgi?id=101147
23328
23329         Reviewed by Geoffrey Garen.
23330
23331         op_method_check no longer buys us anything, since get_by_id proto caching
23332         gives just as much profiling information and the DFG inlines monomorphic
23333         proto accesses anyway.
23334
23335         This also has the potential for a speed-up since it makes parsing of
23336         profiling data easier. No longer do we have to deal with the confusion of
23337         the get_by_id portion of a method_check appearing monomorphic even though
23338         we're really dealing with a bimorphic access (method_check specializes for
23339         one case and get_by_id for another).
23340
23341         This looks like a 1% speed-up on both SunSpider and V8v7.
23342
23343         * CMakeLists.txt:
23344         * GNUmakefile.list.am:
23345         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
23346         * JavaScriptCore.xcodeproj/project.pbxproj:
23347         * Target.pri:
23348         * bytecode/CodeBlock.cpp:
23349         (JSC::CodeBlock::printGetByIdCacheStatus):
23350         (JSC::CodeBlock::dump):
23351         (JSC::CodeBlock::finalizeUnconditionally):
23352         (JSC::CodeBlock::shrinkToFit):
23353         (JSC::CodeBlock::unlinkCalls):
23354         * bytecode/CodeBlock.h:
23355         (JSC::CodeBlock::getCallLinkInfo):
23356         (JSC::CodeBlock::callLinkInfo):
23357         (CodeBlock):
23358         * bytecode/GetByIdStatus.cpp:
23359         (JSC::GetByIdStatus::computeFromLLInt):
23360         * bytecode/MethodCallLinkInfo.cpp: Removed.
23361         * bytecode/MethodCallLinkInfo.h: Removed.
23362         * bytecode/MethodCallLinkStatus.cpp: Removed.
23363         * bytecode/MethodCallLinkStatus.h: Removed.
23364         * bytecode/Opcode.h:
23365         (JSC):
23366         (JSC::padOpcodeName):
23367         * bytecompiler/BytecodeGenerator.cpp:
23368         (JSC):
23369         * bytecompiler/BytecodeGenerator.h:
23370         (BytecodeGenerator):
23371         * bytecompiler/NodesCodegen.cpp:
23372         (JSC::FunctionCallDotNode::emitBytecode):
23373         * dfg/DFGByteCodeParser.cpp:
23374         (JSC::DFG::ByteCodeParser::parseBlock):
23375         * dfg/DFGCapabilities.h:
23376         (JSC::DFG::canCompileOpcode):
23377         * jit/JIT.cpp:
23378         (JSC::JIT::privateCompileMainPass):
23379         (JSC::JIT::privateCompileSlowCases):
23380         (JSC::PropertyStubCompilationInfo::copyToStubInfo):
23381         (JSC::JIT::privateCompile):
23382         * jit/JIT.h:
23383         (JSC::PropertyStubCompilationInfo::slowCaseInfo):
23384         (PropertyStubCompilationInfo):
23385         (JSC):
23386         (JIT):
23387         * jit/JITPropertyAccess.cpp:
23388         (JSC):
23389         (JSC::JIT::emitSlow_op_get_by_id):
23390         (JSC::JIT::compileGetByIdSlowCase):
23391         * jit/JITPropertyAccess32_64.cpp:
23392         (JSC):
23393         (JSC::JIT::compileGetByIdSlowCase):
23394         * jit/JITStubs.cpp:
23395         (JSC):
23396         * jit/JITStubs.h:
23397         * llint/LowLevelInterpreter.asm:
23398
23399 2012-11-05  Yuqiang Xian  <yuqiang.xian@intel.com>
23400
23401         Refactor LLInt64 to distinguish the pointer operations from the 64-bit integer operations
23402         https://bugs.webkit.org/show_bug.cgi?id=100321
23403
23404         Reviewed by Filip Pizlo.
23405
23406         We have refactored the MacroAssembler and JIT compilers to distinguish
23407         the pointer operations from the 64-bit integer operations (see bug #99154).
23408         Now we want to do the similar work for LLInt, and the goal is same as
23409         the one mentioned in 99154.
23410
23411         This is the second part of the modification: in the low level interpreter,
23412         changing the operations on 64-bit integers to use the "<foo>q" instructions.
23413         This also removes some unused/meaningless "<foo>p" instructions.
23414
23415         * llint/LowLevelInterpreter.asm:
23416         * llint/LowLevelInterpreter.cpp:
23417         (JSC::CLoop::execute):
23418         * llint/LowLevelInterpreter64.asm:
23419         * offlineasm/armv7.rb:
23420         * offlineasm/cloop.rb:
23421         * offlineasm/instructions.rb:
23422         * offlineasm/x86.rb:
23423
23424 2012-11-05  Filip Pizlo  <fpizlo@apple.com>
23425
23426         Prototype chain caching should check that the path from the base object to the slot base involves prototype hops only
23427         https://bugs.webkit.org/show_bug.cgi?id=101276
23428
23429         Reviewed by Gavin Barraclough.
23430
23431         Changed normalizePrototypeChain() to report an invalid prototype chain if any object is a proxy.
23432         This catches cases where our prototype chain checks would have been insufficient to guard against
23433         newly introduced properties, despecialized properties, or deleted properties in the chain of
23434         objects involved in the access.
23435
23436         * dfg/DFGRepatch.cpp:
23437         (JSC::DFG::tryCacheGetByID):
23438         (JSC::DFG::tryBuildGetByIDProtoList):
23439         (JSC::DFG::tryCachePutByID):
23440         (JSC::DFG::tryBuildPutByIdList):
23441         * jit/JITStubs.cpp:
23442         (JSC::JITThunks::tryCachePutByID):
23443         (JSC::JITThunks::tryCacheGetByID):
23444         (JSC::DEFINE_STUB_FUNCTION):
23445         * llint/LLIntSlowPaths.cpp:
23446         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
23447         * runtime/Operations.h:
23448         (JSC):
23449         (JSC::normalizePrototypeChain):
23450
23451 2012-11-05  Dima Gorbik  <dgorbik@apple.com>
23452
23453         Back out controversial changes from Bug 98665.
23454         https://bugs.webkit.org/show_bug.cgi?id=101244
23455
23456         Reviewed by David Kilzer.
23457
23458         Backing out changes from Bug 98665 until further discussions take place on rules for including Platform.h in Assertions.h.
23459
23460         * API/tests/minidom.c:
23461         * API/tests/testapi.c:
23462
23463 2012-11-04  Filip Pizlo  <fpizlo@apple.com>
23464
23465         Reduce the verbosity of referring to QNaN in JavaScriptCore
23466         https://bugs.webkit.org/show_bug.cgi?id=101174
23467
23468         Reviewed by Geoffrey Garen.
23469
23470         Introduces a #define QNaN in JSValue.h, and replaces all previous uses of
23471         std::numeric_limits<double>::quiet_NaN() with QNaN.
23472
23473         * API/JSValueRef.cpp:
23474         (JSValueMakeNumber):
23475         (JSValueToNumber):
23476         * dfg/DFGSpeculativeJIT.cpp:
23477         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
23478         * jit/JITPropertyAccess.cpp:
23479         (JSC::JIT::emitFloatTypedArrayGetByVal):
23480         * runtime/CachedTranscendentalFunction.h:
23481         (JSC::CachedTranscendentalFunction::initialize):
23482         * runtime/DateConstructor.cpp:
23483         (JSC::constructDate):
23484         * runtime/DateInstanceCache.h:
23485         (JSC::DateInstanceData::DateInstanceData):
23486         (JSC::DateInstanceCache::reset):
23487         * runtime/ExceptionHelpers.cpp:
23488         (JSC::InterruptedExecutionError::defaultValue):
23489         (JSC::TerminatedExecutionError::defaultValue):
23490         * runtime/JSCell.h:
23491         (JSC::JSValue::getPrimitiveNumber):
23492         * runtime/JSDateMath.cpp:
23493         (JSC::parseDateFromNullTerminatedCharacters):
23494         * runtime/JSGlobalData.cpp:
23495         (JSC::JSGlobalData::JSGlobalData):
23496         (JSC::JSGlobalData::resetDateCache):
23497         * runtime/JSGlobalObjectFunctions.cpp:
23498         (JSC::parseInt):
23499         (JSC::jsStrDecimalLiteral):
23500         (JSC::toDouble):
23501         (JSC::jsToNumber):
23502         (JSC::parseFloat):
23503         * runtime/JSValue.cpp:
23504         (JSC::JSValue::toNumberSlowCase):
23505         * runtime/JSValue.h:
23506         (JSC):
23507         * runtime/JSValueInlineMethods.h:
23508         (JSC::jsNaN):
23509         * runtime/MathObject.cpp:
23510         (JSC::mathProtoFuncMax):
23511         (JSC::mathProtoFuncMin):
23512
23513 2012-11-03  Filip Pizlo  <fpizlo@apple.com>
23514
23515         Baseline JIT should use structure watchpoints whenever possible
23516         https://bugs.webkit.org/show_bug.cgi?id=101146
23517
23518         Reviewed by Sam Weinig.
23519
23520         No speed-up yet except on toy programs. I think that it will start to show
23521         speed-ups with https://bugs.webkit.org/show_bug.cgi?id=101147, which this is
23522         a step towards.
23523
23524         * jit/JIT.h:
23525         (JIT):
23526         * jit/JITPropertyAccess.cpp:
23527         (JSC::JIT::privateCompilePutByIdTransition):
23528         (JSC::JIT::privateCompileGetByIdProto):
23529         (JSC::JIT::privateCompileGetByIdProtoList):
23530         (JSC::JIT::privateCompileGetByIdChainList):
23531         (JSC::JIT::privateCompileGetByIdChain):
23532         (JSC::JIT::addStructureTransitionCheck):
23533         (JSC):
23534         (JSC::JIT::testPrototype):
23535         * jit/JITPropertyAccess32_64.cpp:
23536         (JSC::JIT::privateCompilePutByIdTransition):
23537         (JSC::JIT::privateCompileGetByIdProto):
23538         (JSC::JIT::privateCompileGetByIdProtoList):
23539         (JSC::JIT::privateCompileGetByIdChainList):
23540         (JSC::JIT::privateCompileGetByIdChain):
23541
23542 2012-11-04  Csaba Osztrogonác  <ossy@webkit.org>
23543
23544         [Qt] udis86_itab.c is always regenerated
23545         https://bugs.webkit.org/show_bug.cgi?id=100756
23546
23547         Reviewed by Simon Hausmann.
23548
23549         * DerivedSources.pri: Generate sources to the generated directory.
23550         * disassembler/udis86/differences.txt:
23551         * disassembler/udis86/itab.py: Add --outputDir option.
23552         (UdItabGenerator.__init__):
23553         (genItabH):
23554         (genItabC):
23555         (main):
23556
23557 2012-11-02  Filip Pizlo  <fpizlo@apple.com>
23558
23559         LLInt 32-bit put_by_val ArrayStorage case should use the right register (t3, not t2) for the index in the publicLength updating path
23560         https://bugs.webkit.org/show_bug.cgi?id=101118
23561
23562         Reviewed by Gavin Barraclough.
23563
23564         * llint/LowLevelInterpreter32_64.asm:
23565
23566 2012-11-02  Filip Pizlo  <fpizlo@apple.com>
23567
23568         DFG::Node::converToStructureTransitionWatchpoint should take kindly to ArrayifyToStructure
23569         https://bugs.webkit.org/show_bug.cgi?id=101117
23570
23571         Reviewed by Gavin Barraclough.
23572
23573         We have logic to convert ArrayifyToStructure to StructureTransitionWatchpoint, which is awesome, except
23574         that previously convertToStructureTransitionWatchpoint was (a) asserting that it never saw an
23575         ArrayifyToStructure and (b) would incorrectly create a ForwardStructureTransitionWatchpoint if it did.
23576
23577         * dfg/DFGNode.h:
23578         (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
23579
23580 2012-11-02  Filip Pizlo  <fpizlo@apple.com>
23581
23582         DFG::SpeculativeJIT::typedArrayDescriptor should use the Float64Array descriptor for Float64Arrays
23583         https://bugs.webkit.org/show_bug.cgi?id=101114
23584
23585         Reviewed by Gavin Barraclough.
23586
23587         As in https://bugs.webkit.org/show_bug.cgi?id=101112, this was only wrong when Float64Array descriptors
23588         hadn't been initialized yet. That happens rarely, but when it does happen, we would crash.
23589
23590         This would also become much more wrong if we ever put type size info (num bytes, etc) in the descriptor
23591         and used that directly. So it's good to fix it.
23592
23593         * dfg/DFGSpeculativeJIT.cpp:
23594         (JSC::DFG::SpeculativeJIT::typedArrayDescriptor):
23595
23596 2012-11-02  Filip Pizlo  <fpizlo@apple.com>
23597
23598         JIT::privateCompileGetByVal should use the uint8ClampedArrayDescriptor for compiling accesses to Uint8ClampedArrays
23599         https://bugs.webkit.org/show_bug.cgi?id=101112
23600
23601         Reviewed by Gavin Barraclough.
23602
23603         The only reason why the code was wrong to use uint8ArrayDescriptor instead is that if we're just using
23604         Uint8ClampedArrays then the descriptor for Uint8Array may not have been initialized.
23605
23606         * jit/JITPropertyAccess.cpp:
23607         (JSC::JIT::privateCompileGetByVal):
23608
23609 2012-11-02  Mark Hahnenberg  <mhahnenberg@apple.com>
23610
23611         MarkedBlocks should use something other than the mark bits to indicate liveness for newly allocated objects
23612         https://bugs.webkit.org/show_bug.cgi?id=100877
23613
23614         Reviewed by Filip Pizlo.
23615
23616         Currently when we canonicalize cell liveness data in MarkedBlocks, we set the mark bit for every cell in the
23617         block except for those in the free list. This allows us to consider objects that were allocated since the
23618         previous collection to be considered live until they have a chance to be properly marked by the collector.
23619
23620         If we want to use the mark bits to signify other types of information, e.g. using sticky mark bits for generational
23621         collection, we will have to keep track of newly allocated objects in a different fashion when we canonicalize cell liveness.
23622
23623         One method would be to allocate a separate set of bits while canonicalizing liveness data. These bits would
23624         track the newly allocated objects in the block separately from those objects who had already been marked. We would
23625         then check these bits, along with the mark bits, when determining liveness.
23626
23627         * heap/Heap.h:
23628         (Heap):
23629         (JSC::Heap::isLive): We now check for the presence of the newlyAllocated Bitmap.
23630         (JSC):
23631         * heap/MarkedBlock.cpp:
23632         (JSC::MarkedBlock::specializedSweep): We clear the newlyAllocated Bitmap if we're creating a free list. This
23633         will happen if we canonicalize liveness data for some other reason than collection (e.g. forEachCell) and
23634         then start allocating again.
23635         (JSC::SetNewlyAllocatedFunctor::SetNewlyAllocatedFunctor):
23636         (SetNewlyAllocatedFunctor):
23637         (JSC::SetNewlyAllocatedFunctor::operator()): We set the newlyAllocated bits for all the objects
23638         that aren't already marked. We undo the bits for the objects in the free list later in canonicalizeCellLivenessData.
23639         (JSC::MarkedBlock::canonicalizeCellLivenessData): We should never have a FreeListed block with a newlyAllocated Bitmap.
23640         We allocate the new Bitmap, set the bits for all the objects that aren't already marked, and then unset all of the
23641         bits for the items currently in the FreeList.
23642         * heap/MarkedBlock.h:
23643         (JSC::MarkedBlock::clearMarks): We clear the newlyAllocated bitmap if it exists because at this point we don't need it
23644         any more.
23645         (JSC::MarkedBlock::isEmpty): If we have some objects that are newlyAllocated, we are not empty.
23646         (JSC::MarkedBlock::isNewlyAllocated):
23647         (JSC):
23648         (JSC::MarkedBlock::setNewlyAllocated):
23649         (JSC::MarkedBlock::clearNewlyAllocated):
23650         (JSC::MarkedBlock::isLive): We now check the newlyAllocated Bitmap, if it exists, when determining liveness of a cell in
23651         a block that is Marked.
23652         * heap/WeakBlock.cpp:
23653         (JSC::WeakBlock::visit): We need to make sure we don't finalize objects that are in the newlyAllocated Bitmap.
23654         (JSC::WeakBlock::reap): Ditto.
23655
23656 2012-11-02  Filip Pizlo  <fpizlo@apple.com>
23657
23658         JIT::privateCompileGetByVal should use MacroAssemblerCodePtr::createFromExecutableAddress like JIT::privateCompilePutByVal
23659         https://bugs.webkit.org/show_bug.cgi?id=101109
23660
23661         Reviewed by Gavin Barraclough.
23662
23663         This fixes crashes on ARMv7 resulting from the return address already being tagged with the THUMB2 bit.
23664
23665         * jit/JITPropertyAccess.cpp:
23666         (JSC::JIT::privateCompileGetByVal):
23667
23668 2012-11-02  Simon Fraser  <simon.fraser@apple.com>
23669
23670         Enable SUBPIXEL_LAYOUT on Mac
23671         https://bugs.webkit.org/show_bug.cgi?id=101076
23672
23673         Reviewed by Dave Hyatt.
23674
23675         Define ENABLE_SUBPIXEL_LAYOUT and include it in FEATURE_DEFINES.
23676
23677         * Configurations/FeatureDefines.xcconfig:
23678
23679 2012-11-02  Michael Saboff  <msaboff@apple.com>
23680
23681         RegExp.prototype.toString Should Produce an 8 bit JSString if possible.
23682         https://bugs.webkit.org/show_bug.cgi?id=101003
23683
23684         Reviewed by Geoffrey Garen.
23685
23686         Took the logic of regExpObjectSource() and created two templated helpers that uses the
23687         source character type when appending to the StringBuilder.
23688
23689         * runtime/RegExpObject.cpp:
23690         (JSC::appendLineTerminatorEscape): Checks line terminate type to come up with escaped version.
23691         (JSC::regExpObjectSourceInternal): Templated version of original.
23692         (JSC::regExpObjectSource): Wrapper function.
23693
23694 2012-11-02  Adam Barth  <abarth@webkit.org>
23695
23696         ENABLE(UNDO_MANAGER) is disabled everywhere and is not under active development
23697         https://bugs.webkit.org/show_bug.cgi?id=100711
23698
23699         Reviewed by Eric Seidel.
23700
23701         * Configurations/FeatureDefines.xcconfig:
23702
23703 2012-11-02  Simon Hausmann  <simon.hausmann@digia.com>
23704
23705         [Qt] Fix build on Windows when Qt is configured with -release
23706         https://bugs.webkit.org/show_bug.cgi?id=101041
23707
23708         Reviewed by Jocelyn Turcotte.
23709
23710         When Qt is configured with -debug or -release, the release/debug build of for example
23711         QtCore is not available by default. For LLIntExtractor we always need to build debug
23712         _and_ release versions, but we do not actually need any Qt libraries nor qtmain(d).lib.
23713         Therefore we can disable all these features but need to keep $$QT.core.includes in the
23714         INCLUDEPATH for some defines from qglobal.h.
23715
23716         * LLIntOffsetsExtractor.pro:
23717
23718 2012-11-01  Mark Lam  <mark.lam@apple.com>
23719
23720         A llint workaround for a toolchain issue.
23721         https://bugs.webkit.org/show_bug.cgi?id=101012.
23722
23723         Reviewed by Michael Saboff.
23724
23725         * llint/LowLevelInterpreter.asm:
23726           - use a local label to workaround the toolchain issue with undeclared
23727             global labels.
23728
23729 2012-11-01  Oliver Hunt  <oliver@apple.com>
23730
23731         Remove GlobalObject constant register that is typically unused
23732         https://bugs.webkit.org/show_bug.cgi?id=101005
23733
23734         Reviewed by Geoffrey Garen.
23735
23736         The GlobalObject constant register is frequently allocated even when it
23737         is not used, it is also getting in the way of some other optimisations.
23738
23739         * bytecode/CodeBlock.cpp:
23740         (JSC::CodeBlock::CodeBlock):
23741         * bytecode/CodeBlock.h:
23742         (CodeBlock):
23743         * bytecompiler/BytecodeGenerator.cpp:
23744         (JSC::BytecodeGenerator::BytecodeGenerator):
23745         * dfg/DFGByteCodeParser.cpp:
23746         (JSC::DFG::ByteCodeParser::parseResolveOperations):
23747
23748 2012-10-31  Filip Pizlo  <fpizlo@apple.com>
23749
23750         DFG optimized string access code should be enabled
23751         https://bugs.webkit.org/show_bug.cgi?id=100825
23752
23753         Reviewed by Oliver Hunt.
23754
23755         - Removes prediction checks from the parser.
23756
23757         - Fixes the handling of array mode refinement for strings. I.e. we don't do
23758           any refinement - we already know it's going to be a string. We could
23759           revisit this in the future, but for now the DFG lacks the ability to
23760           handle any array modes other than Array::String for string intrinsics, so
23761           this is as good as it gets.
23762
23763         - Removes uses of isBlahSpeculation for checking if a mode is already
23764           checked. isBlahSpeculation implicitly checks if the SpeculatedType is not
23765           BOTTOM ("empty"), which breaks for checking if a mode is already checked
23766           since a mode may already be "checked" in the sense that we've proven that
23767           the code is unreachable.
23768
23769         ~1% speed-up on V8v7, mostly from a speed-up on crypto, which uses string
23770         intrinsics in one of the hot functions.
23771
23772         * bytecode/SpeculatedType.h:
23773         (JSC::speculationChecked):
23774         (JSC):
23775         * dfg/DFGArrayMode.cpp:
23776         (JSC::DFG::ArrayMode::alreadyChecked):
23777         * dfg/DFGByteCodeParser.cpp:
23778         (JSC::DFG::ByteCodeParser::handleIntrinsic):
23779         * dfg/DFGFixupPhase.cpp:
23780         (JSC::DFG::FixupPhase::fixupNode):
23781         * dfg/DFGSpeculativeJIT.cpp:
23782         (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
23783
23784 2012-10-31  Filip Pizlo  <fpizlo@apple.com>
23785
23786         Sparse array size threshold should be increased to 100000
23787         https://bugs.webkit.org/show_bug.cgi?id=100827
23788
23789         Reviewed by Oliver Hunt.
23790
23791         This enables the use of contiguous arrays in programs that previously
23792         couldn't use them. And I so far can't see any examples of this being
23793         a downside. To the extent that there is a downside, it ought to be
23794         addressed by GC: https://bugs.webkit.org/show_bug.cgi?id=100828
23795
23796         * runtime/ArrayConventions.h:
23797         (JSC):
23798
23799 2012-10-31  Mark Lam  <mark.lam@apple.com>
23800
23801         C++ llint 64-bit backend needs to zero extend results of int32 operations.
23802         https://bugs.webkit.org/show_bug.cgi?id=100899.
23803
23804         Reviewed by Filip Pizlo.
23805
23806         llint asm instructions ending in "i" for a 64-bit machine expects the
23807         high 32-bit of registers to be zero'ed out when a 32-bit instruction
23808         writes into a register. Fixed the C++ llint to honor this.
23809
23810         Fixed the index register used in BaseIndex addressing to be of size
23811         intptr_t as expected.
23812
23813         Updated CLoopRegister to handle different endiannesss configurations.
23814
23815         * llint/LowLevelInterpreter.cpp:
23816         (JSC::CLoopRegister::clearHighWord):
23817           - new method to clear the high 32-bit of a 64-bit register.
23818             It's a no-op for the 32-bit build.
23819         (CLoopRegister):
23820           - CLoopRegister now takes care of packing and byte endianness order.
23821         (JSC::CLoop::execute): - Added an assert.
23822         * offlineasm/cloop.rb:
23823           - Add calls to clearHighWord() wherever needed.
23824
23825 2012-10-31  Mark Lam  <mark.lam@apple.com>
23826
23827         A JSC printf (support for %J+s and %b).
23828         https://bugs.webkit.org/show_bug.cgi?id=100566.
23829
23830         Reviewed by Michael Saboff.
23831
23832         Added VMInspector::printf(), fprintf(), sprintf(), and snprintf().
23833         - %b prints ints as boolean TRUE (non-zero) or FALSE (zero).
23834         - %Js prints a WTF::String* like a %s prints a char*.
23835           Also works for 16bit WTF::Strings (prints wchar_t* using %S).
23836         - '+' is a modifier meaning 'use verbose mode', and %J+s is an example
23837           of its use.
23838
23839         * JavaScriptCore.xcodeproj/project.pbxproj:
23840         * interpreter/VMInspector.cpp:
23841         (FormatPrinter):
23842         (JSC::FormatPrinter::~FormatPrinter):
23843         (JSC::FormatPrinter::print):
23844         (JSC::FormatPrinter::printArg):
23845         (JSC::FormatPrinter::printWTFString):
23846         (JSC::FileFormatPrinter::FileFormatPrinter):
23847         (JSC::FileFormatPrinter::printArg):
23848         (JSC::StringFormatPrinter::StringFormatPrinter):
23849         (JSC::StringFormatPrinter::printArg):
23850         (JSC::StringNFormatPrinter::StringNFormatPrinter):
23851         (JSC::StringNFormatPrinter::printArg):
23852         (JSC::VMInspector::fprintf):
23853         (JSC::VMInspector::printf):
23854         (JSC::VMInspector::sprintf):
23855         (JSC::VMInspector::snprintf):
23856         * interpreter/VMInspector.h:
23857         (VMInspector):
23858
23859 2012-10-31  Mark Lam  <mark.lam@apple.com>
23860
23861         64-bit llint PC offset can be negative: using an unsigned shift is a bug.
23862         https://bugs.webkit.org/show_bug.cgi?id=100896.
23863
23864         Reviewed by Filip Pizlo.
23865
23866         Fixed the PC offset divisions in the 64-bit llint asm to use rshift instead of urshift.
23867
23868         * llint/LowLevelInterpreter64.asm:
23869
23870 2012-10-30  Yuqiang Xian  <yuqiang.xian@intel.com>
23871
23872         glsl-function-atan.html WebGL conformance test fails after https://bugs.webkit.org/show_bug.cgi?id=99154
23873         https://bugs.webkit.org/show_bug.cgi?id=100789
23874
23875         Reviewed by Filip Pizlo.
23876
23877         We accidently missed a bitwise double to int64 conversion.
23878
23879         * dfg/DFGSpeculativeJIT.h:
23880         (JSC::DFG::SpeculativeJIT::silentFill):
23881
23882 2012-10-30  Joseph Pecoraro  <pecoraro@apple.com>
23883
23884         [Mac] Sync up FeatureDefine Configuration Files
23885         https://bugs.webkit.org/show_bug.cgi?id=100171
23886
23887         Reviewed by David Kilzer.
23888
23889         Follow up to better coordinate with iOS feature defines. Make:
23890
23891           - ENABLE_FILTERS always on
23892           - ENABLE_INPUT_* iphonesimulator values point to the iphoneos values
23893
23894         * Configurations/FeatureDefines.xcconfig:
23895
23896 2012-10-30  Joseph Pecoraro  <pecoraro@apple.com>
23897
23898         [Mac] Sync up FeatureDefine Configuration Files
23899         https://bugs.webkit.org/show_bug.cgi?id=100171
23900
23901         Reviewed by David Kilzer.
23902
23903         Ensure an identical FeatureDefine files across all projects. Changes:
23904
23905           - ENABLE_CSS_BOX_DECORATION_BREAK should be in all
23906           - ENABLE_PDFKIT_PLUGIN should be in all
23907           - ENABLE_RESOLUTION_MEDIA_QUERY should be in all
23908           - ENABLE_ENCRYPTED_MEDIA should be in all
23909           - ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING with corrected value
23910           - Some alphabetical ordering cleanup
23911
23912         * Configurations/FeatureDefines.xcconfig:
23913
23914 2012-10-30  Mark Hahnenberg  <mhahnenberg@apple.com>
23915
23916         Arrays can change IndexingType in the middle of sorting
23917         https://bugs.webkit.org/show_bug.cgi?id=100773
23918
23919         Reviewed by Filip Pizlo.
23920
23921         Instead of giving up, we just fetch the appropriate vector based on the current
23922         IndexingType of the array.
23923
23924         * runtime/JSArray.cpp:
23925         (JSC::JSArray::sortVector):
23926         * runtime/JSObject.h:
23927         (JSObject):
23928         (JSC::JSObject::currentIndexingData):
23929         (JSC::JSObject::currentRelevantLength):
23930
23931 2012-10-29  Anders Carlsson  <andersca@apple.com>
23932
23933         Build WebKit as C++11 on Mac
23934         https://bugs.webkit.org/show_bug.cgi?id=100720
23935
23936         Reviewed by Daniel Bates.
23937
23938         * Configurations/Base.xcconfig:
23939         Add CLANG_CXX_LANGUAGE_STANDARD=gnu++0x.
23940
23941         * bytecompiler/BytecodeGenerator.cpp:
23942         (JSC::BytecodeGenerator::generate):
23943         (JSC::BytecodeGenerator::pushFinallyContext):
23944         (JSC::BytecodeGenerator::beginSwitch):
23945         * llint/LLIntOffsetsExtractor.cpp:
23946         * runtime/Identifier.cpp:
23947         (JSC::Identifier::add8):
23948         * runtime/Identifier.h:
23949         (JSC::Identifier::add):
23950         * runtime/JSONObject.cpp:
23951         (JSC::appendStringToStringBuilder):
23952         * runtime/StringPrototype.cpp:
23953         (JSC::replaceUsingStringSearch):
23954         Add static_casts to prevent implicit type conversions in non-constant initializer lists.
23955
23956 2012-10-28  Mark Rowe  <mrowe@apple.com>
23957
23958         Simplify Xcode configuration settings that used to vary between OS versions.
23959
23960         Reviewed by Dan Bernstein.
23961
23962         * Configurations/Base.xcconfig:
23963         * Configurations/DebugRelease.xcconfig:
23964         * Configurations/JavaScriptCore.xcconfig:
23965
23966 2012-10-28  Mark Rowe  <mrowe@apple.com>
23967
23968         Remove references to unsupported OS and Xcode versions.
23969
23970         Reviewed by Anders Carlsson.
23971
23972         * Configurations/Base.xcconfig:
23973         * Configurations/CompilerVersion.xcconfig: Removed.
23974         * Configurations/DebugRelease.xcconfig:
23975         * Configurations/Version.xcconfig:
23976         * JavaScriptCore.xcodeproj/project.pbxproj:
23977
23978 2012-10-29  Michael Saboff  <msaboff@apple.com>
23979
23980         Non-special escape character sequences cause JSC::Lexer::parseString to create 16 bit strings
23981         https://bugs.webkit.org/show_bug.cgi?id=100576
23982
23983         Reviewed by Darin Adler.
23984
23985         Changed singleEscape() processing to be based on a lookup of a static table.  The table
23986         covers ASCII characters SPACE through DEL.  If a character can be a single character escape,
23987         then the table provides the non-zero result of that escape.  Updated the result of
23988         singleEscape to be an LChar to make the table as small as possible.
23989         Added a new test fast/js/normal-character-escapes-in-string-literals.html to validated
23990         the behavior.
23991
23992         * parser/Lexer.cpp:
23993         (JSC::singleEscape):
23994         (JSC::Lexer::parseString):
23995         (JSC::Lexer::parseStringSlowCase):
23996
23997 2012-10-29  Enrica Casucci  <enrica@apple.com>
23998
23999         Add ENABLE_USERSELECT_ALL feature flag.
24000         https://bugs.webkit.org/show_bug.cgi?id=100559
24001
24002         Reviewed by Eric Seidel.
24003
24004         * Configurations/FeatureDefines.xcconfig:
24005
24006 2012-10-28  Filip Pizlo  <fpizlo@apple.com>
24007
24008         DFG should be able to emit effectful structure checks
24009         https://bugs.webkit.org/show_bug.cgi?id=99260
24010
24011         Reviewed by Oliver Hunt.
24012
24013         This change allows us to find out if an array access that has gone polymorphic
24014         is operating over known structures - i.e. the primordial array structures of the
24015         global object that the code block containing the array access belongs to. We
24016         term this state "OriginalArray" for short. The fact that the access has gone
24017         polymorphic means that the array profile will not be able to report the set of
24018         structures it had seen - but if it can tell us that all of the structures were
24019         primordial then it just so happens that we can deduce what the structure set
24020         would have been by just querying the code block's global object. This allows us
24021         to emit an ArrayifyToStructure instead of an Arrayify if we find that we need to
24022         do conversions. The fast path of an ArrayifyToStructure is exactly like the fast
24023         path of a CheckStructure and is mostly subject to the same optimizations. It
24024         also burns one fewer registers.
24025
24026         Essentially the notion of OriginalArray is a super cheap way of getting the
24027         array profile to tell us a structure set instead of a singleton structure.
24028         Currently, the array profile can only tell us the structure seen at an array
24029         access if there was exactly one structure. If there were multiple structures, it
24030         won't tell us anything other than the array modes and other auxiliary profiling
24031         data (whether there were stores to holes, for example). With OriginalArray, we
24032         cheaply get a structure set if all of the structures were primordial for the
24033         code block's global object, since in that case the array mode set (ArrayModes)
24034         can directly tell us the structure set. In the future, we might consider adding
24035         complete structure sets to the array profiles, but I suspect that we would hit
24036         diminishing returns if we did so - it would only help if we have array accesses
24037         that are both polymorphic and are cross-global-object accesses (rare) or if the
24038         arrays had named properties or other structure transitions that are unrelated to
24039         indexing type (also rare).
24040
24041         This also does away with Arrayify (and the new ArrayifyToStructure) returning
24042         the butterfly pointer. This turns out to be faster and easier to CSE.
24043
24044         And, this also changes constant folding to be able to eliminate CheckStructure,
24045         ForwardCheckStructure, and ArrayifyToStructure in addition to being able to
24046         transform them into structure transition watchpoints. This is great for
24047         ArrayifyToStructure because then CSE and CFA know that there is no side effect.
24048         Converting CheckStructure and ForwardCheckStructure to also behave this way is
24049         just a matter of elegance.
24050
24051         This has no performance impact right now. It's intended to alleviate some of the
24052         regressions seen in the early implementation of
24053         https://bugs.webkit.org/show_bug.cgi?id=98606.
24054
24055         * bytecode/ArrayProfile.cpp:
24056         (JSC::ArrayProfile::computeUpdatedPrediction):
24057         * bytecode/ArrayProfile.h:
24058         (JSC):
24059         (JSC::ArrayProfile::ArrayProfile):
24060         (ArrayProfile):
24061         (JSC::ArrayProfile::usesOriginalArrayStructures):
24062         * bytecode/CodeBlock.cpp:
24063         (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
24064         * dfg/DFGAbstractState.cpp:
24065         (JSC::DFG::AbstractState::execute):
24066         * dfg/DFGArrayMode.cpp:
24067         (JSC::DFG::ArrayMode::fromObserved):
24068         (JSC::DFG::ArrayMode::alreadyChecked):
24069         (JSC::DFG::arrayClassToString):
24070         * dfg/DFGArrayMode.h:
24071         (JSC::DFG::ArrayMode::withProfile):
24072         (JSC::DFG::ArrayMode::isJSArray):
24073         (ArrayMode):
24074         (JSC::DFG::ArrayMode::isJSArrayWithOriginalStructure):
24075         (JSC::DFG::ArrayMode::supportsLength):
24076         (JSC::DFG::ArrayMode::arrayModesWithIndexingShape):
24077         * dfg/DFGByteCodeParser.cpp:
24078         (JSC::DFG::ByteCodeParser::getArrayMode):
24079         (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
24080         (JSC::DFG::ByteCodeParser::handleGetByOffset):
24081         * dfg/DFGCSEPhase.cpp:
24082         (JSC::DFG::CSEPhase::checkStructureElimination):
24083         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
24084         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
24085         (JSC::DFG::CSEPhase::checkArrayElimination):
24086         (JSC::DFG::CSEPhase::getScopeRegistersLoadElimination):
24087         * dfg/DFGConstantFoldingPhase.cpp:
24088         (JSC::DFG::ConstantFoldingPhase::foldConstants):
24089         * dfg/DFGFixupPhase.cpp:
24090         (JSC::DFG::FixupPhase::fixupNode):
24091         (JSC::DFG::FixupPhase::checkArray):
24092         * dfg/DFGNode.h:
24093         (JSC::DFG::Node::hasStructure):
24094         (JSC::DFG::Node::hasArrayMode):
24095         (JSC::DFG::Node::arrayMode):
24096         * dfg/DFGNodeType.h:
24097         (DFG):
24098         * dfg/DFGPredictionPropagationPhase.cpp:
24099         (JSC::DFG::PredictionPropagationPhase::propagate):
24100         * dfg/DFGSpeculativeJIT.cpp:
24101         (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
24102         (JSC::DFG::SpeculativeJIT::arrayify):
24103         * dfg/DFGSpeculativeJIT.h:
24104         (SpeculativeJIT):
24105         * dfg/DFGSpeculativeJIT32_64.cpp:
24106         (JSC::DFG::SpeculativeJIT::compile):
24107         * dfg/DFGSpeculativeJIT64.cpp:
24108         (JSC::DFG::SpeculativeJIT::compile):
24109         * runtime/JSGlobalObject.h:
24110         (JSC::JSGlobalObject::isOriginalArrayStructure):
24111         * runtime/Structure.cpp:
24112         (JSC::Structure::nonPropertyTransition):
24113
24114 2012-10-28  Filip Pizlo  <fpizlo@apple.com>
24115
24116         There should not be blind spots in array length array profiling
24117         https://bugs.webkit.org/show_bug.cgi?id=100620
24118
24119         Reviewed by Oliver Hunt.
24120
24121         I don't think this has any performance impact. But it's good to not have random
24122         programs occasionally emit a GetById for array length accesses.
24123
24124         * jit/JITPropertyAccess.cpp:
24125         (JSC::JIT::compileGetByIdHotPath):
24126         (JSC::JIT::privateCompilePatchGetArrayLength):
24127         * jit/JITPropertyAccess32_64.cpp:
24128         (JSC::JIT::compileGetByIdHotPath):
24129         (JSC::JIT::privateCompilePatchGetArrayLength):
24130
24131 2012-10-28  Filip Pizlo  <fpizlo@apple.com>
24132
24133         Unreviewed, make always-true enum-to-int comparisons use casts.
24134
24135         * dfg/DFGFPRInfo.h:
24136         (JSC::DFG::FPRInfo::debugName):
24137         * dfg/DFGGPRInfo.h:
24138         (JSC::DFG::JSValueSource::tagGPR):
24139         (JSC::DFG::GPRInfo::toIndex):
24140         (JSC::DFG::GPRInfo::debugName):
24141         * runtime/JSTypeInfo.h:
24142         (JSC::TypeInfo::TypeInfo):
24143
24144 2012-10-27  Filip Pizlo  <fpizlo@apple.com>
24145
24146         OSR exit compilation should defend against argument recoveries from code blocks that are no longer on the inline stack
24147         https://bugs.webkit.org/show_bug.cgi?id=100601
24148
24149         Reviewed by Oliver Hunt.
24150
24151         This happened to me while I was fixing bugs for https://bugs.webkit.org/show_bug.cgi?id=100599.
24152         I'm not sure how to reproduce this.
24153
24154         * dfg/DFGAssemblyHelpers.h:
24155         (JSC::DFG::AssemblyHelpers::baselineCodeBlockFor):
24156         (AssemblyHelpers):
24157         * dfg/DFGOSRExitCompiler32_64.cpp:
24158         (JSC::DFG::OSRExitCompiler::compileExit):
24159         * dfg/DFGOSRExitCompiler64.cpp:
24160         (JSC::DFG::OSRExitCompiler::compileExit):
24161
24162 2012-10-27  Filip Pizlo  <fpizlo@apple.com>
24163
24164         DFG::Array::Mode needs to be cleaned up
24165         https://bugs.webkit.org/show_bug.cgi?id=100599
24166
24167         Reviewed by Oliver Hunt.
24168
24169         Turn the previous massive Array::Mode enum into a class that contains four
24170         fields, the type, whether it's a JSArray, the level of speculation, and the
24171         kind of conversion to perform.
24172
24173         No performance or behavioral change.
24174
24175         * dfg/DFGAbstractState.cpp:
24176         (JSC::DFG::AbstractState::execute):
24177         * dfg/DFGArgumentsSimplificationPhase.cpp:
24178         (JSC::DFG::ArgumentsSimplificationPhase::run):
24179         * dfg/DFGArrayMode.cpp:
24180         (JSC::DFG::ArrayMode::fromObserved):
24181         (JSC::DFG::ArrayMode::refine):
24182         (JSC::DFG::ArrayMode::alreadyChecked):
24183         (JSC::DFG::arrayTypeToString):
24184         (JSC::DFG::arrayClassToString):
24185         (DFG):
24186         (JSC::DFG::arraySpeculationToString):
24187         (JSC::DFG::arrayConversionToString):
24188         (JSC::DFG::ArrayMode::toString):
24189         * dfg/DFGArrayMode.h:
24190         (DFG):
24191         (ArrayMode):
24192         (JSC::DFG::ArrayMode::ArrayMode):
24193         (JSC::DFG::ArrayMode::type):
24194         (JSC::DFG::ArrayMode::arrayClass):
24195         (JSC::DFG::ArrayMode::speculation):
24196         (JSC::DFG::ArrayMode::conversion):
24197         (JSC::DFG::ArrayMode::asWord):
24198         (JSC::DFG::ArrayMode::fromWord):
24199         (JSC::DFG::ArrayMode::withSpeculation):
24200         (JSC::DFG::ArrayMode::usesButterfly):
24201         (JSC::DFG::ArrayMode::isJSArray):
24202         (JSC::DFG::ArrayMode::isInBounds):
24203         (JSC::DFG::ArrayMode::mayStoreToHole):
24204         (JSC::DFG::ArrayMode::isOutOfBounds):
24205         (JSC::DFG::ArrayMode::isSlowPut):
24206         (JSC::DFG::ArrayMode::canCSEStorage):
24207         (JSC::DFG::ArrayMode::lengthNeedsStorage):
24208         (JSC::DFG::ArrayMode::modeForPut):
24209         (JSC::DFG::ArrayMode::isSpecific):
24210         (JSC::DFG::ArrayMode::supportsLength):
24211         (JSC::DFG::ArrayMode::benefitsFromStructureCheck):
24212         (JSC::DFG::ArrayMode::doesConversion):
24213         (JSC::DFG::ArrayMode::arrayModesThatPassFiltering):
24214         (JSC::DFG::ArrayMode::operator==):
24215         (JSC::DFG::ArrayMode::operator!=):
24216         (JSC::DFG::ArrayMode::arrayModesWithIndexingShape):
24217         (JSC::DFG::canCSEStorage):
24218         (JSC::DFG::lengthNeedsStorage):
24219         * dfg/DFGByteCodeParser.cpp:
24220         (JSC::DFG::ByteCodeParser::getArrayMode):
24221         (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks):
24222         (JSC::DFG::ByteCodeParser::handleIntrinsic):
24223         (JSC::DFG::ByteCodeParser::parseBlock):
24224         * dfg/DFGCSEPhase.cpp:
24225         (JSC::DFG::CSEPhase::getArrayLengthElimination):
24226         (JSC::DFG::CSEPhase::checkArrayElimination):
24227         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
24228         (JSC::DFG::CSEPhase::performNodeCSE):
24229         * dfg/DFGConstantFoldingPhase.cpp:
24230         (JSC::DFG::ConstantFoldingPhase::foldConstants):
24231         * dfg/DFGFixupPhase.cpp:
24232         (JSC::DFG::FixupPhase::fixupNode):
24233         (JSC::DFG::FixupPhase::checkArray):
24234         (JSC::DFG::FixupPhase::blessArrayOperation):
24235         * dfg/DFGGraph.cpp:
24236         (JSC::DFG::Graph::dump):
24237         * dfg/DFGGraph.h:
24238         (JSC::DFG::Graph::byValIsPure):
24239         * dfg/DFGNode.h:
24240         (JSC::DFG::Node::arrayMode):
24241         (JSC::DFG::Node::setArrayMode):
24242         * dfg/DFGSpeculativeJIT.cpp:
24243         (JSC::DFG::SpeculativeJIT::typedArrayDescriptor):
24244         (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
24245         (JSC::DFG::SpeculativeJIT::checkArray):
24246         (JSC::DFG::SpeculativeJIT::arrayify):
24247         (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
24248         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
24249         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
24250         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
24251         (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
24252         (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
24253         (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
24254         (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
24255         (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
24256         * dfg/DFGSpeculativeJIT.h:
24257         (JSC::DFG::SpeculativeJIT::putByValWillNeedExtraRegister):
24258         (SpeculativeJIT):
24259         * dfg/DFGSpeculativeJIT32_64.cpp:
24260         (JSC::DFG::SpeculativeJIT::compile):
24261         * dfg/DFGSpeculativeJIT64.cpp:
24262         (JSC::DFG::SpeculativeJIT::compile):
24263
24264 2012-10-27  Dan Bernstein  <mitz@apple.com>
24265
24266         REAL_PLATFORM_NAME build setting is no longer needed
24267         https://bugs.webkit.org/show_bug.cgi?id=100587
24268
24269         Reviewed by Mark Rowe.
24270
24271         Removed the definition of REAL_PLATFORM_NAME and replaced references to it with references
24272         to PLATFORM_NAME.
24273
24274         * Configurations/Base.xcconfig:
24275         * Configurations/CompilerVersion.xcconfig:
24276         * Configurations/DebugRelease.xcconfig:
24277         * Configurations/FeatureDefines.xcconfig:
24278         * Configurations/JSC.xcconfig:
24279         * Configurations/JavaScriptCore.xcconfig:
24280         * Configurations/ToolExecutable.xcconfig:
24281
24282 2012-10-25  Filip Pizlo  <fpizlo@apple.com>
24283
24284         Forward OSR calculation is wrong in the presence of multiple SetLocals, or a mix of SetLocals and Phantoms
24285         https://bugs.webkit.org/show_bug.cgi?id=100461
24286
24287         Reviewed by Oliver Hunt and Gavin Barraclough.
24288
24289         This does a couple of things. First, it removes the part of the change in r131822 that made the forward
24290         OSR exit calculator capable of handling multiple SetLocals. That change was wrong, because it would
24291         blindly assume that all SetLocals had the same ValueRecovery, and would ignore the possibility that if
24292         there is no value recovery then a ForwardCheckStructure on the first SetLocal would not know how to
24293         recover the state associated with the second SetLocal. Then, it introduces the invariant that any bytecode
24294         op that decomposes into multiple SetLocals must first emit dead SetLocals as hints and then emit a second
24295         set of SetLocals to actually do the setting of the locals. This means that if a ForwardCheckStructure (or
24296         any other hoisted forward speculation) is inserted, it will always be inserted on the second set of
24297         SetLocals (since hoisting only touches the live ones), at which point OSR will already know about the
24298         mov hints implied by the first set of (dead) SetLocals. This gives us the behavior we wanted, namely, that
24299         a ForwardCheckStructure applied to a variant set by a resolve_with_base-like operation can correctly do a
24300         forward exit while also ensuring that prior to exiting we set the appropriate locals.
24301
24302         * dfg/DFGByteCodeParser.cpp:
24303         (JSC::DFG::ByteCodeParser::parseBlock):
24304         * dfg/DFGOSRExit.cpp:
24305         (JSC::DFG::OSRExit::OSRExit):
24306         * dfg/DFGOSRExit.h:
24307         (OSRExit):
24308         * dfg/DFGOSRExitCompiler.cpp:
24309         * dfg/DFGOSRExitCompiler32_64.cpp:
24310         (JSC::DFG::OSRExitCompiler::compileExit):
24311         * dfg/DFGOSRExitCompiler64.cpp:
24312         (JSC::DFG::OSRExitCompiler::compileExit):
24313         * dfg/DFGSpeculativeJIT.cpp:
24314         (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
24315
24316 2012-10-26  Simon Hausmann  <simon.hausmann@digia.com>
24317
24318         [Qt] Fix the LLInt build on Windows
24319         https://bugs.webkit.org/show_bug.cgi?id=97648
24320
24321         Reviewed by Tor Arne Vestbø.
24322
24323         The main change for the port on Windows is changing the way offsets are extracted
24324         and the LLIntAssembly.h is generated to accomodate release and debug configurations.
24325
24326         Firstly the LLIntOffsetsExtractor binary is now built as-is (no DESTDIR set) and
24327         placed into debug\LLIntOffsetsExtractor.exe and release\LLIntOffsetsExtractor.exe
24328         on Windows debug_and_release builds. On other patforms it remainds in the regular
24329         out directory.
24330
24331         Secondly the LLIntAssembly.h files must be different for different build types,
24332         so the LLIntAssembly.h generator in DerivedSources.pri operates no on the extractor
24333         binary files as input. Using a simple exists() check we verify the presence of either
24334         a regular, a debug\LLIntOffsetsExtractor and a release\LLIntOffsetsExtractor binary
24335         and process all of them. The resulting assembly files consequently end up in
24336         generated\debug\LLIntAssembly.h and generated\release\LLIntAssembly.h.
24337
24338         In Target.pri we have to also make sure that those directories are in the include
24339         path according to the release or debug configuration.
24340
24341         Lastly a small tweak - swapping WTF.pri and JSC.pri inclusions - in the
24342         LLIntOffsetsExtractor build was needed to make sure that we include
24343         JavaScriptCore/config.h instead of WTF/config.h, required to fix the
24344         build issues originally pasted in bug #97648.
24345
24346         * DerivedSources.pri:
24347         * JavaScriptCore.pro:
24348         * LLIntOffsetsExtractor.pro:
24349         * Target.pri:
24350
24351 2012-10-26  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
24352
24353         [Qt] Enable JSC's disassembler on x86, x86_64 Linux
24354         https://bugs.webkit.org/show_bug.cgi?id=100386
24355
24356         Reviewed by Simon Hausmann.
24357
24358         It works fine on Linux x86, x86_64 just needs to be enabled in the
24359         QtWebKit build system.
24360
24361         * DerivedSources.pri:
24362         * JavaScriptCore.pri:
24363         * Target.pri:
24364
24365 2012-10-26  Thiago Marcos P. Santos  <thiago.santos@intel.com>
24366
24367         Add feature flags for CSS Device Adaptation
24368         https://bugs.webkit.org/show_bug.cgi?id=95960
24369
24370         Reviewed by Kenneth Rohde Christiansen.
24371
24372         * Configurations/FeatureDefines.xcconfig:
24373
24374 2012-10-26  Simon Hausmann  <simon.hausmann@digia.com>
24375
24376         [WIN] Make LLInt offsets extractor work on Windows
24377         https://bugs.webkit.org/show_bug.cgi?id=100369
24378
24379         Reviewed by Kenneth Rohde Christiansen.
24380
24381         Open the input file explicitly in binary mode to prevent ruby/Windows from thinking that
24382         it's a text mode file that needs even new line conversions. The binary mode parameter is
24383         ignored on other platforms.
24384
24385         * offlineasm/offsets.rb:
24386
24387 2012-10-25  Michael Saboff  <msaboff@apple.com>
24388
24389         SymbolTableIndexHashTraits::needsDestruction should be set to true
24390         https://bugs.webkit.org/show_bug.cgi?id=100437
24391
24392         Reviewed by Mark Hahnenberg.
24393
24394         For correctness, set SymbolTableIndexHashTraits::needsDestruction to true since SymbolTableEntry's do
24395         need to have their destructor called due to the possibility of rare data.
24396
24397         * runtime/SymbolTable.h:
24398         (SymbolTableIndexHashTraits):
24399
24400 2012-10-25  Filip Pizlo  <fpizlo@apple.com>
24401
24402         DFG Arrayify elimination should replace it with GetButterfly rather than Phantom
24403         https://bugs.webkit.org/show_bug.cgi?id=100441
24404
24405         Reviewed by Oliver Hunt and Gavin Barraclough.
24406
24407         Made array profiler's to-string helper behave correctly.
24408
24409         Made Arrayify elimination do the right thing (convert to GetButterfly).
24410
24411         Made CFA's interference analysis track clobbered array modes correctly, mostly by
24412         simplifying the machinery.
24413
24414         * bytecode/ArrayProfile.cpp:
24415         (JSC::arrayModesToString):
24416         * dfg/DFGAbstractState.cpp:
24417         (JSC::DFG::AbstractState::execute):
24418         * dfg/DFGAbstractValue.h:
24419         (JSC::DFG::AbstractValue::clobberArrayModes):
24420         (AbstractValue):
24421         * dfg/DFGConstantFoldingPhase.cpp:
24422         (JSC::DFG::ConstantFoldingPhase::foldConstants):
24423
24424 2012-10-25  Filip Pizlo  <fpizlo@apple.com>
24425
24426         REGRESSION (r131793-r131826): Crash going to wikifonia.org
24427         https://bugs.webkit.org/show_bug.cgi?id=100281
24428
24429         Reviewed by Oliver Hunt.
24430
24431         Restore something that got lost in the resolve refactoring: the ability to give up on life if
24432         we see a resolve of 'arguments'.
24433
24434         * runtime/JSScope.cpp:
24435         (JSC::JSScope::resolveContainingScopeInternal):
24436
24437 2012-10-25  Dominik Röttsches  <dominik.rottsches@intel.com>
24438
24439         Conditionalize XHR timeout support
24440         https://bugs.webkit.org/show_bug.cgi?id=100356
24441
24442         Reviewed by Adam Barth.
24443
24444         Adding XHR_TIMEOUT feature to conditionalize this on ports without network backend support.
24445
24446         * Configurations/FeatureDefines.xcconfig:
24447
24448 2012-10-25  Michael Saboff  <msaboff@apple.com>
24449
24450         REGRESSION (r131836): failures in list styles tests on EFL, GTK
24451         https://bugs.webkit.org/show_bug.cgi?id=99824
24452
24453         Reviewed by Oliver Hunt.
24454
24455         Saved start of string since it is modified by call convertUTF8ToUTF16().
24456
24457         * API/JSStringRef.cpp:
24458         (JSStringCreateWithUTF8CString):
24459
24460 2012-10-24  Filip Pizlo  <fpizlo@apple.com>
24461
24462         DFG NewArrayBuffer node should keep its data in a structure on the side to free up one of the opInfos
24463         https://bugs.webkit.org/show_bug.cgi?id=100328
24464
24465         Reviewed by Oliver Hunt.
24466
24467         * dfg/DFGByteCodeParser.cpp:
24468         (JSC::DFG::ByteCodeParser::parseBlock):
24469         * dfg/DFGGraph.h:
24470         (Graph):
24471         * dfg/DFGNode.h:
24472         (NewArrayBufferData):
24473         (DFG):
24474         (JSC::DFG::Node::newArrayBufferData):
24475         (Node):
24476         (JSC::DFG::Node::startConstant):
24477         (JSC::DFG::Node::numConstants):
24478
24479 2012-10-25  Mark Lam  <mark.lam@apple.com>
24480
24481         Update the C++ llint to work with the latest op_resolve... changes.
24482         https://bugs.webkit.org/show_bug.cgi?id=100345.
24483
24484         Reviewed by Oliver Hunt.
24485
24486         * llint/LowLevelInterpreter.cpp:
24487         (JSC::CLoop::execute):
24488         - emit opcode name as label when not using COMPUTED_GOTOs. The new op_resolve
24489           opcodes have jumps to these labels.
24490         - declare all opcode labels as UNUSED_LABEL()s to keep the compiler happy
24491           for opcodes that are not referenced by anyone.
24492         * offlineasm/asm.rb:
24493         - strip llint_ prefix from opcode names used as labels.
24494
24495 2012-10-24  Yuqiang Xian  <yuqiang.xian@intel.com>
24496
24497         Refactor LLInt64 to distinguish the pointer operations from the 64-bit integer operations
24498         https://bugs.webkit.org/show_bug.cgi?id=100321
24499
24500         Reviewed by Filip Pizlo.
24501
24502         We have refactored the MacroAssembler and JIT compilers to distinguish
24503         the pointer operations from the 64-bit integer operations (see bug #99154).
24504         Now we want to do the similar work for LLInt, and the goal is same as
24505         the one mentioned in 99154.
24506
24507         This is the first part of the modification: in the offline assembler,
24508         adding the support of the "<foo>q" instructions which will be used for
24509         64-bit integer operations.
24510
24511         * llint/LowLevelInterpreter.cpp:
24512         (JSC::CLoop::execute):
24513         * offlineasm/cloop.rb:
24514         * offlineasm/instructions.rb:
24515         * offlineasm/x86.rb:
24516
24517 2012-10-24  Filip Pizlo  <fpizlo@apple.com>
24518
24519         DFG compileBlahBlahByVal methods for Contiguous and ArrayStorage have only one caller and should be removed
24520         https://bugs.webkit.org/show_bug.cgi?id=100311
24521
24522         Reviewed by Mark Hahnenberg.
24523
24524         Just trying to simplify things before I make them more complicated again.
24525
24526         * dfg/DFGSpeculativeJIT.h:
24527         (SpeculativeJIT):
24528         (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
24529         * dfg/DFGSpeculativeJIT32_64.cpp:
24530         (DFG):
24531         (JSC::DFG::SpeculativeJIT::compile):
24532         * dfg/DFGSpeculativeJIT64.cpp:
24533         (DFG):
24534         (JSC::DFG::SpeculativeJIT::compile):
24535
24536 2012-10-23  Andreas Kling  <kling@webkit.org>
24537
24538         CodeBlock: Give m_putToBaseOperations an inline capacity.
24539         <http://webkit.org/b/100190>
24540         <rdar://problem/12562466>
24541
24542         Reviewed by Oliver Hunt.
24543
24544         Since the CodeBlock constructor always inserts a single PutToBaseOperation, but there's no
24545         guarantee that more will follow, give the m_putToBaseOperations vector an inline capacity of 1.
24546         There are 4009 of these Vectors on Membuster3, and only 126 of them have more than a single entry.
24547
24548         This change yields a 1.90MB reduction in memory usage.
24549
24550         * bytecode/CodeBlock.h:
24551         (CodeBlock):
24552
24553 2012-10-23  Christophe Dumez  <christophe.dumez@intel.com>
24554
24555         Regression(r132143): Assertion hit in JSC::Interpreter::StackPolicy::StackPolicy(JSC::Interpreter&, const WTF::StackBounds&)
24556         https://bugs.webkit.org/show_bug.cgi?id=100109
24557
24558         Reviewed by Oliver Hunt.
24559
24560         Fix possible integer overflow in StackPolicy constructor by
24561         using size_t type instead of int for stack sizes. The value
24562         returned by StackBounds::size() is of type size_t but was
24563         assigned to an int, which may overflow.
24564
24565         * interpreter/Interpreter.cpp:
24566         (JSC):
24567         (JSC::Interpreter::StackPolicy::StackPolicy):
24568
24569 2012-10-23  Carlos Garcia Campos  <cgarcia@igalia.com>
24570
24571         Unreviewed. Fix make distcheck.
24572
24573         * GNUmakefile.list.am: Add missing header file.
24574
24575 2012-10-23  Mark Lam  <mark.lam@apple.com>
24576
24577         Make topCallFrame reliable.
24578         https://bugs.webkit.org/show_bug.cgi?id=98928.
24579
24580         Reviewed by Geoffrey Garen.
24581
24582         - VM entry points and the GC now uses topCallFrame.
24583         - The callerFrame value in CallFrames are now always the previous
24584           frame on the stack, except for the first frame which has a
24585           callerFrame of 0 (not counting the HostCallFrameFlag).
24586           Hence, we can now traverse every frame on the stack all the way
24587           back to the first frame.
24588         - GlobalExec's will no longer be used as the callerFrame values in
24589           call frames.
24590         - Added fences and traps for debugging the JSStack in debug builds.
24591
24592         * bytecode/SamplingTool.h:
24593         (SamplingTool):
24594         (JSC::SamplingTool::CallRecord::CallRecord):
24595         * dfg/DFGOperations.cpp:
24596         - Fixed 2 DFG helper functions to flush topCallFrame as expected.
24597         * dfg/DFGSpeculativeJIT.h:
24598         (JSC::DFG::SpeculativeJIT::prepareForExternalCall):
24599         * interpreter/CallFrame.h:
24600         (JSC::ExecState::callerFrameNoFlags):
24601         (ExecState):
24602         (JSC::ExecState::argIndexForRegister):
24603         (JSC::ExecState::getArgumentUnsafe):
24604         * interpreter/CallFrameClosure.h:
24605         (CallFrameClosure):
24606         * interpreter/Interpreter.cpp:
24607         (JSC):
24608         (JSC::eval):
24609         (JSC::Interpreter::Interpreter):
24610         (JSC::Interpreter::throwException):
24611         (JSC::Interpreter::execute):
24612         (JSC::Interpreter::executeCall):
24613         (JSC::Interpreter::executeConstruct):
24614         (JSC::Interpreter::prepareForRepeatCall):
24615         (JSC::Interpreter::endRepeatCall):
24616         * interpreter/Interpreter.h:
24617         (JSC):
24618         (Interpreter):
24619         * interpreter/JSStack.cpp:
24620         (JSC::JSStack::JSStack):
24621         (JSC::JSStack::gatherConservativeRoots):
24622         (JSC::JSStack::disableErrorStackReserve):
24623         * interpreter/JSStack.h:
24624         (JSC):
24625         (JSStack):
24626         (JSC::JSStack::installFence):
24627         (JSC::JSStack::validateFence):
24628         (JSC::JSStack::installTrapsAfterFrame):
24629         * interpreter/JSStackInlines.h: Added.
24630         (JSC):
24631         (JSC::JSStack::getTopOfFrame):
24632         (JSC::JSStack::getTopOfStack):
24633         (JSC::JSStack::getStartOfFrame):
24634         (JSC::JSStack::pushFrame):
24635         (JSC::JSStack::popFrame):
24636         (JSC::JSStack::generateFenceValue):
24637         (JSC::JSStack::installFence):
24638         (JSC::JSStack::validateFence):
24639         (JSC::JSStack::installTrapsAfterFrame):
24640         * jit/JITStubs.cpp:
24641         (JSC::jitCompileFor):
24642         (JSC::lazyLinkFor):
24643         - Set frame->codeBlock to 0 for both the above because they are called
24644           with partially intitialized frames (cb uninitialized), but may
24645           trigger a GC.
24646         (JSC::DEFINE_STUB_FUNCTION):
24647         * runtime/JSGlobalData.cpp:
24648         (JSC::JSGlobalData::JSGlobalData):
24649
24650 2012-10-22  Filip Pizlo  <fpizlo@apple.com>
24651
24652         DFG::Array::Undecided should be called DFG::Array::SelectUsingPredictions
24653         https://bugs.webkit.org/show_bug.cgi?id=100052
24654
24655         Reviewed by Oliver Hunt.
24656
24657         No functional change, just renaming. It's a clearer name that more accurately
24658         reflects the meaning, and it eliminates the namespace confusion that will happen
24659         with the Undecided indexing type in https://bugs.webkit.org/show_bug.cgi?id=98606
24660
24661         * dfg/DFGAbstractState.cpp:
24662         (JSC::DFG::AbstractState::execute):
24663         * dfg/DFGArrayMode.cpp:
24664         (JSC::DFG::fromObserved):
24665         (JSC::DFG::refineArrayMode):
24666         (JSC::DFG::modeAlreadyChecked):
24667         (JSC::DFG::modeToString):
24668         * dfg/DFGArrayMode.h:
24669         (JSC::DFG::canCSEStorage):
24670         (JSC::DFG::modeIsSpecific):
24671         (JSC::DFG::modeSupportsLength):
24672         (JSC::DFG::benefitsFromStructureCheck):
24673         * dfg/DFGFixupPhase.cpp:
24674         (JSC::DFG::FixupPhase::fixupNode):
24675         (JSC::DFG::FixupPhase::blessArrayOperation):
24676         * dfg/DFGSpeculativeJIT.cpp:
24677         (JSC::DFG::SpeculativeJIT::arrayify):
24678         * dfg/DFGSpeculativeJIT32_64.cpp:
24679         (JSC::DFG::SpeculativeJIT::compile):
24680         * dfg/DFGSpeculativeJIT64.cpp:
24681         (JSC::DFG::SpeculativeJIT::compile):
24682
24683 2012-10-22  Mark Lam  <mark.lam@apple.com>
24684
24685         Change stack recursion checks to be based on stack availability.
24686         https://bugs.webkit.org/show_bug.cgi?id=99872.
24687
24688         Reviewed by Filip Pizlo and Geoffrey Garen.
24689
24690         - Remove m_reentryDepth, ThreadStackType which are now obsolete.
24691         - Replaced the reentryDepth checks with a StackBounds check.
24692         - Added the Interpreter::StackPolicy class to compute a reasonable
24693           stack capacity requirement given the native stack that the
24694           interpreter is executing on at that time.
24695         - Reserved an amount of JSStack space for the use of error handling
24696           and enable its use (using Interpreter::ErrorHandlingMode) when
24697           we're about to throw or report an exception.
24698         - Interpreter::StackPolicy also allows more native stack space
24699           to be used when in ErrorHandlingMode. This is needed in the case
24700           of native stack overflows.
24701         - Fixed the parser so that it throws a StackOverflowError instead of
24702           a SyntaxError when it encounters a stack overflow.
24703
24704         * API/JSContextRef.cpp:
24705         (JSContextGroupCreate):
24706         (JSGlobalContextCreateInGroup):
24707         * JavaScriptCore.order:
24708         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
24709         * interpreter/Interpreter.cpp:
24710         (JSC::Interpreter::ErrorHandlingMode::ErrorHandlingMode):
24711         (JSC):
24712         (JSC::Interpreter::ErrorHandlingMode::~ErrorHandlingMode):
24713         (JSC::Interpreter::StackPolicy::StackPolicy):
24714         (JSC::Interpreter::Interpreter):
24715         (JSC::Interpreter::execute):
24716         (JSC::Interpreter::executeCall):
24717         (JSC::Interpreter::executeConstruct):
24718         (JSC::Interpreter::prepareForRepeatCall):
24719         * interpreter/Interpreter.h:
24720         (JSC):
24721         (Interpreter):
24722         (ErrorHandlingMode):
24723         (StackPolicy):
24724         (JSC::Interpreter::StackPolicy::requiredCapacity):
24725         * interpreter/JSStack.cpp:
24726         (JSC):
24727         (JSC::JSStack::JSStack):
24728         (JSC::JSStack::growSlowCase):
24729         (JSC::JSStack::enableErrorStackReserve):
24730         (JSC::JSStack::disableErrorStackReserve):
24731         * interpreter/JSStack.h:
24732         (JSStack):
24733         (JSC::JSStack::reservationEnd):
24734         (JSC):
24735         * jsc.cpp:
24736         (jscmain):
24737         * parser/Parser.cpp:
24738         (JSC::::Parser):
24739         * parser/Parser.h:
24740         (Parser):
24741         (JSC::::parse):
24742         * runtime/ExceptionHelpers.cpp:
24743         (JSC::throwStackOverflowError):
24744         * runtime/JSGlobalData.cpp:
24745         (JSC::JSGlobalData::JSGlobalData):
24746         (JSC::JSGlobalData::createContextGroup):
24747         (JSC::JSGlobalData::create):
24748         (JSC::JSGlobalData::createLeaked):
24749         (JSC::JSGlobalData::sharedInstance):
24750         * runtime/JSGlobalData.h:
24751         (JSC):
24752         (JSGlobalData):
24753         * runtime/StringRecursionChecker.h:
24754         (JSC::StringRecursionChecker::performCheck):
24755         * testRegExp.cpp:
24756         (realMain):
24757
24758 2012-10-20  Martin Robinson  <mrobinson@igalia.com>
24759
24760         Fix 'make dist' for the GTK+ port
24761
24762         * GNUmakefile.list.am: Add missing files to the source list.
24763
24764 2012-10-21  Raphael Kubo da Costa  <raphael.kubo.da.costa@intel.com>
24765
24766         [CMake][JSC] Depend on risc.rb to decide when to run the LLInt scripts.
24767         https://bugs.webkit.org/show_bug.cgi?id=99917
24768
24769         Reviewed by Geoffrey Garen.
24770
24771         Depend on the newly-added risc.rb to make sure we always run the
24772         LLInt scripts when one of them changes.
24773
24774         * CMakeLists.txt:
24775
24776 2012-10-20  Filip Pizlo  <fpizlo@apple.com>
24777
24778         LLInt backends of non-ARM RISC platforms should be able to share code with the existing ARMv7 backend
24779         https://bugs.webkit.org/show_bug.cgi?id=99745
24780
24781         Reviewed by Geoffrey Garen.
24782
24783         This moves all of the things in armv7.rb that I thought are generally useful out
24784         into risc.rb. It also separates some phases (branch ops is separated into one
24785         phase that does sensible things, and another that does things that are painfully
24786         ARM-specific), and removes ARM assumptions from others by using a callback to
24787         drive exactly what lowering must happen. The goal here is to minimize the future
24788         maintenance burden of LLInt by ensuring that the various platforms share as much
24789         lowering code as possible.
24790
24791         * offlineasm/armv7.rb:
24792         * offlineasm/risc.rb: Added.
24793
24794 2012-10-19  Filip Pizlo  <fpizlo@apple.com>
24795
24796         DFG should have some facility for recognizing redundant CheckArrays and Arrayifies
24797         https://bugs.webkit.org/show_bug.cgi?id=99287
24798
24799         Reviewed by Mark Hahnenberg.
24800
24801         Adds reasoning about indexing type sets (i.e. ArrayModes) to AbstractValue, which
24802         then enables us to fold away CheckArray's and Arrayify's that are redundant.
24803
24804         * bytecode/ArrayProfile.cpp:
24805         (JSC::arrayModesToString):
24806         (JSC):
24807         * bytecode/ArrayProfile.h:
24808         (JSC):
24809         (JSC::mergeArrayModes):
24810         (JSC::arrayModesAlreadyChecked):
24811         * bytecode/StructureSet.h:
24812         (JSC::StructureSet::arrayModesFromStructures):
24813         (StructureSet):
24814         * dfg/DFGAbstractState.cpp:
24815         (JSC::DFG::AbstractState::execute):
24816         * dfg/DFGAbstractValue.h:
24817         (JSC::DFG::AbstractValue::AbstractValue):
24818         (JSC::DFG::AbstractValue::clear):
24819         (JSC::DFG::AbstractValue::isClear):
24820         (JSC::DFG::AbstractValue::makeTop):
24821         (JSC::DFG::AbstractValue::clobberStructures):
24822         (AbstractValue):
24823         (JSC::DFG::AbstractValue::setMostSpecific):
24824         (JSC::DFG::AbstractValue::set):
24825         (JSC::DFG::AbstractValue::operator==):
24826         (JSC::DFG::AbstractValue::merge):
24827         (JSC::DFG::AbstractValue::filter):
24828         (JSC::DFG::AbstractValue::filterArrayModes):
24829         (JSC::DFG::AbstractValue::validate):
24830         (JSC::DFG::AbstractValue::checkConsistency):
24831         (JSC::DFG::AbstractValue::dump):
24832         (JSC::DFG::AbstractValue::clobberArrayModes):
24833         (JSC::DFG::AbstractValue::clobberArrayModesSlow):
24834         (JSC::DFG::AbstractValue::setFuturePossibleStructure):
24835         (JSC::DFG::AbstractValue::filterFuturePossibleStructure):
24836         * dfg/DFGArrayMode.cpp:
24837         (JSC::DFG::modeAlreadyChecked):
24838         * dfg/DFGArrayMode.h:
24839         (JSC::DFG::arrayModesFor):
24840         (DFG):
24841         * dfg/DFGConstantFoldingPhase.cpp:
24842         (JSC::DFG::ConstantFoldingPhase::foldConstants):
24843         * dfg/DFGSpeculativeJIT.cpp:
24844         (JSC::DFG::SpeculativeJIT::arrayify):
24845
24846 2012-10-19  Filip Pizlo  <fpizlo@apple.com>
24847
24848         Baseline JIT should not inline array allocations, to make them easier to instrument
24849         https://bugs.webkit.org/show_bug.cgi?id=99905
24850
24851         Reviewed by Mark Hahnenberg.
24852
24853         This will make it easier to instrument array allocations for the purposes of profiling.
24854         It also allows us to kill off a bunch of code. And, this doesn't appear to hurt
24855         performance at all. That's expected because these days any hot allocation will end up
24856         in the DFG JIT, which does inline these allocations.
24857
24858         * jit/JIT.cpp:
24859         (JSC::JIT::privateCompileSlowCases):
24860         * jit/JIT.h:
24861         (JIT):
24862         * jit/JITInlineMethods.h:
24863         (JSC):
24864         * jit/JITOpcodes.cpp:
24865         (JSC::JIT::emit_op_new_array):
24866
24867 2012-10-19  Oliver Hunt  <oliver@apple.com>
24868
24869         Fix some of the regression cause by the non-local variable reworking
24870         https://bugs.webkit.org/show_bug.cgi?id=99896
24871
24872         Reviewed by Filip Pizlo.
24873
24874         The non0local variable reworking led to some of the optimisations performed by
24875         the bytecode generator being dropped.  This in turn put more pressure on the DFG
24876         optimisations.  This exposed a short coming in our double speculation propogation.
24877         Now we try to distinguish between places where we should SpecDoubleReal vs generic
24878         SpecDouble.
24879
24880         * dfg/DFGPredictionPropagationPhase.cpp:
24881         (PredictionPropagationPhase):
24882         (JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPrediction):
24883         (JSC::DFG::PredictionPropagationPhase::speculatedDoubleTypeForPredictions):
24884         (JSC::DFG::PredictionPropagationPhase::propagate):
24885
24886 2012-10-19  Michael Saboff  <msaboff@apple.com>
24887
24888         Lexer should create 8 bit Identifiers for RegularExpressions and ASCII identifiers
24889         https://bugs.webkit.org/show_bug.cgi?id=99855
24890
24891         Reviewed by Filip Pizlo.
24892
24893         Added makeIdentifier helpers that will always make an 8 bit Identifier or make an
24894         Identifier that is the same size as the template parameter.  Used the first in the fast
24895         path when looking for a JS identifier and the second when scanning regular expressions.
24896
24897         * parser/Lexer.cpp:
24898         (JSC::::scanRegExp):
24899         * parser/Lexer.h:
24900         (Lexer):
24901         (JSC::::makeIdentifierSameType):
24902         (JSC::::makeLCharIdentifier):
24903         (JSC::::lexExpectIdentifier):
24904
24905 2012-10-19  Mark Lam  <mark.lam@apple.com>
24906
24907         Added WTF::StackStats mechanism.
24908         https://bugs.webkit.org/show_bug.cgi?id=99805.
24909
24910         Reviewed by Geoffrey Garen.
24911
24912         Added StackStats checkpoints and probes.
24913
24914         * bytecompiler/BytecodeGenerator.h:
24915         (JSC::BytecodeGenerator::emitNode):
24916         (JSC::BytecodeGenerator::emitNodeInConditionContext):
24917         * heap/SlotVisitor.cpp:
24918         (JSC::SlotVisitor::append):
24919         (JSC::visitChildren):
24920         (JSC::SlotVisitor::donateKnownParallel):
24921         (JSC::SlotVisitor::drain):
24922         (JSC::SlotVisitor::drainFromShared):
24923         (JSC::SlotVisitor::mergeOpaqueRoots):
24924         (JSC::SlotVisitor::internalAppend):
24925         (JSC::SlotVisitor::harvestWeakReferences):
24926         (JSC::SlotVisitor::finalizeUnconditionalFinalizers):
24927         * interpreter/Interpreter.cpp:
24928         (JSC::Interpreter::execute):
24929         (JSC::Interpreter::executeCall):
24930         (JSC::Interpreter::executeConstruct):
24931         (JSC::Interpreter::prepareForRepeatCall):
24932         * parser/Parser.h:
24933         (JSC::Parser::canRecurse):
24934         * runtime/StringRecursionChecker.h:
24935         (StringRecursionChecker):
24936
24937 2012-10-19  Oliver Hunt  <oliver@apple.com>
24938
24939         REGRESSION(r131822): It made 500+ tests crash on 32 bit platforms
24940         https://bugs.webkit.org/show_bug.cgi?id=99814
24941
24942         Reviewed by Filip Pizlo.
24943
24944         Call the correct macro in 32bit.
24945
24946         * llint/LowLevelInterpreter.asm:
24947
24948 2012-10-19  Dongwoo Joshua Im  <dw.im@samsung.com>
24949
24950         Rename ENABLE_CSS3_TEXT_DECORATION to ENABLE_CSS3_TEXT
24951         https://bugs.webkit.org/show_bug.cgi?id=99804
24952
24953         Reviewed by Julien Chaffraix.
24954
24955         CSS3 text related properties will be implemented under this flag,
24956         including text decoration, text-align-last, and text-justify.
24957
24958         * Configurations/FeatureDefines.xcconfig:
24959
24960 2012-10-18  Anders Carlsson  <andersca@apple.com>
24961
24962         Clean up RegExpKey
24963         https://bugs.webkit.org/show_bug.cgi?id=99798
24964
24965         Reviewed by Darin Adler.
24966
24967         RegExpHash doesn't need to be a class template specialization when the class template is specialized
24968         for JSC::RegExpKey only. Make it a nested class of RegExp instead. Also, make operator== a friend function
24969         so Hash::equal can see it.
24970
24971         * runtime/RegExpKey.h:
24972         (JSC::RegExpKey::RegExpKey):
24973         (JSC::RegExpKey::operator==):
24974         (RegExpKey):
24975         (JSC::RegExpKey::Hash::hash):
24976         (JSC::RegExpKey::Hash::equal):
24977         (Hash):
24978
24979 2012-10-19  Mark Lam  <mark.lam@apple.com>
24980
24981         Bot greening: Follow up to r131877 to fix the Windows build.
24982         https://bugs.webkit.org/show_bug.cgi?id=99739.
24983
24984         Not reviewed.
24985
24986         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
24987
24988 2012-10-19  Mark Lam  <mark.lam@apple.com>
24989
24990         Bot greening: Attempt to fix broken Window build after r131836.
24991         https://bugs.webkit.org/show_bug.cgi?id=99739.
24992
24993         Not reviewed.
24994
24995         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
24996
24997 2012-10-19  Yuqiang Xian  <yuqiang.xian@intel.com>
24998
24999         Unreviewed fix after r131868.
25000
25001         On JSVALUE64 platforms, JSValue constants can be Imm64 instead of ImmPtr for JIT compilers.
25002
25003         * dfg/DFGOSRExitCompiler64.cpp:
25004         (JSC::DFG::OSRExitCompiler::compileExit):
25005
25006 2012-10-18  Filip Pizlo  <fpizlo@apple.com>
25007
25008         Baseline array profiling should be less accurate, and DFG OSR exit should update array profiles on CheckArray and CheckStructure failure
25009         https://bugs.webkit.org/show_bug.cgi?id=99261
25010
25011         Reviewed by Oliver Hunt.
25012
25013         This makes array profiling stochastic, like value profiling. The point is to avoid
25014         noticing one-off indexing types that we'll never see again, but instead to:
25015
25016         Notice the big ones: We want the DFG to compile based on the things that happen with
25017         high probability. So, this change makes array profiling do like value profiling and
25018         only notice a random subsampling of indexing types that flowed through an array
25019         access. Prior to this patch array profiles noticed all indexing types and weighted
25020         them identically.
25021
25022         Bias the recent: Often an array access will see awkward indexing types during the
25023         first handful of executions because of artifacts of program startup. So, we want to
25024         bias towards the indexing types that we saw most recently. With this change, array
25025         profiling does like value profiling and usually tells use a random sampling that
25026         is biased to what happened recently.
25027
25028         Have a backup plan: The above two things don't work by themselves because our
25029         randomness is not that random (nor do we care enough to make it more random), and
25030         because some procedures will have a <1/10 probability event that we must handle
25031         without bailing because it dominates a hot loop. So, like value profiling, this
25032         patch makes array profiling use OSR exits to tell us why we are bailing out, so
25033         that we don't make the same mistake again in the future.
25034
25035         This change also makes the way that the 32-bit OSR exit compiler snatches scratch
25036         registers more uniform. We don't need a scratch buffer when we can push and pop.
25037
25038         * bytecode/DFGExitProfile.h:
25039         * dfg/DFGOSRExitCompiler32_64.cpp:
25040         (JSC::DFG::OSRExitCompiler::compileExit):
25041         * dfg/DFGOSRExitCompiler64.cpp:
25042         (JSC::DFG::OSRExitCompiler::compileExit):
25043         * dfg/DFGSpeculativeJIT.cpp:
25044         (JSC::DFG::SpeculativeJIT::checkArray):
25045         (JSC::DFG::SpeculativeJIT::arrayify):
25046         * dfg/DFGSpeculativeJIT32_64.cpp:
25047         (JSC::DFG::SpeculativeJIT::compile):
25048         * dfg/DFGSpeculativeJIT64.cpp:
25049         (JSC::DFG::SpeculativeJIT::compile):
25050         * jit/JITInlineMethods.h:
25051         (JSC::JIT::emitArrayProfilingSite):
25052         * llint/LowLevelInterpreter.asm:
25053
25054 2012-10-18  Yuqiang Xian  <yuqiang.xian@intel.com>
25055
25056         [Qt] REGRESSION(r131858): It broke the ARM build
25057         https://bugs.webkit.org/show_bug.cgi?id=99809
25058
25059         Reviewed by Csaba Osztrogonác.
25060
25061         * dfg/DFGCCallHelpers.h:
25062         (CCallHelpers):
25063         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
25064
25065 2012-10-18  Yuqiang Xian  <yuqiang.xian@intel.com>
25066
25067         Refactor MacroAssembler interfaces to differentiate the pointer operands from the 64-bit integer operands
25068         https://bugs.webkit.org/show_bug.cgi?id=99154
25069
25070         Reviewed by Gavin Barraclough.
25071
25072         In current JavaScriptCore implementation for JSVALUE64 platform (i.e.,
25073         the X64 platform), we assume that the JSValue size is same to the
25074         pointer size, and thus EncodedJSValue is simply type defined as a
25075         "void*". In the JIT compiler, we also take this assumption and invoke
25076         the same macro assembler interfaces for both JSValue and pointer
25077         operands. We need to differentiate the operations on pointers from the
25078         operations on JSValues, and let them invoking different macro
25079         assembler interfaces. For example, we now use the interface of
25080         "loadPtr" to load either a pointer or a JSValue, and we need to switch
25081         to using "loadPtr" to load a pointer and some new "load64" interface
25082         to load a JSValue. This would help us supporting other JSVALUE64
25083         platforms where pointer size is not necessarily 64-bits, for example
25084         x32 (bug #99153).
25085
25086         The major modification I made is to introduce the "*64" interfaces in
25087         the MacroAssembler for those operations on JSValues, keep the "*Ptr"
25088         interfaces for those operations on real pointers, and go through all
25089         the JIT compiler code to correct the usage.
25090
25091         This is the second part of the work, i.e, to correct the usage of the
25092         new MacroAssembler interfaces in the JIT compilers, which also means
25093         that now EncodedJSValue is defined as a 64-bit integer, and the "*64"
25094         interfaces are used for it.
25095
25096         * assembler/MacroAssembler.h: JSValue immediates should be in Imm64 instead of ImmPtr.
25097         (MacroAssembler):
25098         (JSC::MacroAssembler::shouldBlind):
25099         * dfg/DFGAssemblyHelpers.cpp: Correct the JIT compilers usage of the new interfaces.
25100         (JSC::DFG::AssemblyHelpers::jitAssertIsInt32):
25101         (JSC::DFG::AssemblyHelpers::jitAssertIsJSInt32):
25102         (JSC::DFG::AssemblyHelpers::jitAssertIsJSNumber):
25103         (JSC::DFG::AssemblyHelpers::jitAssertIsJSDouble):
25104         (JSC::DFG::AssemblyHelpers::jitAssertIsCell):
25105         * dfg/DFGAssemblyHelpers.h:
25106         (JSC::DFG::AssemblyHelpers::emitPutToCallFrameHeader):
25107         (JSC::DFG::AssemblyHelpers::branchIfNotCell):
25108         (JSC::DFG::AssemblyHelpers::debugCall):
25109         (JSC::DFG::AssemblyHelpers::boxDouble):
25110         (JSC::DFG::AssemblyHelpers::unboxDouble):
25111         (JSC::DFG::AssemblyHelpers::emitExceptionCheck):
25112         * dfg/DFGCCallHelpers.h:
25113         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
25114         (CCallHelpers):
25115         * dfg/DFGOSRExitCompiler64.cpp:
25116         (JSC::DFG::OSRExitCompiler::compileExit):
25117         * dfg/DFGRepatch.cpp:
25118         (JSC::DFG::generateProtoChainAccessStub):
25119         (JSC::DFG::tryCacheGetByID):
25120         (JSC::DFG::tryBuildGetByIDList):
25121         (JSC::DFG::emitPutReplaceStub):
25122         (JSC::DFG::emitPutTransitionStub):
25123         * dfg/DFGScratchRegisterAllocator.h:
25124         (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
25125         (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
25126         * dfg/DFGSilentRegisterSavePlan.h:
25127         * dfg/DFGSpeculativeJIT.cpp:
25128         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
25129         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
25130         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
25131         (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
25132         (JSC::DFG::SpeculativeJIT::compileInstanceOf):
25133         (JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):
25134         (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
25135         * dfg/DFGSpeculativeJIT.h:
25136         (SpeculativeJIT):
25137         (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
25138         (JSC::DFG::SpeculativeJIT::silentSpill):
25139         (JSC::DFG::SpeculativeJIT::silentFill):
25140         (JSC::DFG::SpeculativeJIT::spill):
25141         (JSC::DFG::SpeculativeJIT::valueOfJSConstantAsImm64):
25142         (JSC::DFG::SpeculativeJIT::callOperation):
25143         (JSC::DFG::SpeculativeJIT::branch64):
25144         * dfg/DFGSpeculativeJIT64.cpp:
25145         (JSC::DFG::SpeculativeJIT::fillInteger):
25146         (JSC::DFG::SpeculativeJIT::fillDouble):
25147         (JSC::DFG::SpeculativeJIT::fillJSValue):
25148         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToNumber):
25149         (JSC::DFG::SpeculativeJIT::nonSpeculativeValueToInt32):
25150         (JSC::DFG::SpeculativeJIT::nonSpeculativeUInt32ToNumber):
25151         (JSC::DFG::SpeculativeJIT::cachedGetById):
25152         (JSC::DFG::SpeculativeJIT::cachedPutById):
25153         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull):
25154         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):
25155         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
25156         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompare):
25157         (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):
25158         (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeStrictEq):
25159         (JSC::DFG::SpeculativeJIT::emitCall):
25160         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
25161         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
25162         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
25163         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
25164         (JSC::DFG::SpeculativeJIT::convertToDouble):
25165         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
25166         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
25167         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
25168         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
25169         (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot):
25170         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
25171         (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch):
25172         (JSC::DFG::SpeculativeJIT::emitBranch):
25173         (JSC::DFG::SpeculativeJIT::compileContiguousGetByVal):
25174         (JSC::DFG::SpeculativeJIT::compileArrayStorageGetByVal):
25175         (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
25176         (JSC::DFG::SpeculativeJIT::compileArrayStoragePutByVal):
25177         (JSC::DFG::SpeculativeJIT::compile):
25178         * dfg/DFGThunks.cpp:
25179         (JSC::DFG::osrExitGenerationThunkGenerator):
25180         (JSC::DFG::throwExceptionFromCallSlowPathGenerator):
25181         (JSC::DFG::slowPathFor):
25182         (JSC::DFG::virtualForThunkGenerator):
25183         * interpreter/Interpreter.cpp:
25184         (JSC::Interpreter::dumpRegisters):
25185         * jit/JIT.cpp:
25186         (JSC::JIT::privateCompile):
25187         * jit/JIT.h:
25188         (JIT):
25189         * jit/JITArithmetic.cpp:
25190         (JSC::JIT::emit_op_negate):
25191         (JSC::JIT::emitSlow_op_negate):
25192         (JSC::JIT::emit_op_rshift):
25193         (JSC::JIT::emitSlow_op_urshift):
25194         (JSC::JIT::emit_compareAndJumpSlow):
25195         (JSC::JIT::emit_op_bitand):
25196         (JSC::JIT::compileBinaryArithOpSlowCase):
25197         (JSC::JIT::emit_op_div):
25198         * jit/JITCall.cpp:
25199         (JSC::JIT::compileLoadVarargs):
25200         (JSC::JIT::compileCallEval):
25201         (JSC::JIT::compileCallEvalSlowCase):
25202         (JSC::JIT::compileOpCall):
25203         * jit/JITInlineMethods.h: Have some clean-up work as well.
25204         (JSC):
25205         (JSC::JIT::emitPutCellToCallFrameHeader):
25206         (JSC::JIT::emitPutIntToCallFrameHeader):
25207         (JSC::JIT::emitPutToCallFrameHeader):
25208         (JSC::JIT::emitGetFromCallFrameHeader32):
25209         (JSC::JIT::emitGetFromCallFrameHeader64):
25210         (JSC::JIT::emitAllocateJSArray):
25211         (JSC::JIT::emitValueProfilingSite):
25212         (JSC::JIT::emitGetJITStubArg):
25213         (JSC::JIT::emitGetVirtualRegister):
25214         (JSC::JIT::emitPutVirtualRegister):
25215         (JSC::JIT::emitInitRegister):
25216         (JSC::JIT::emitJumpIfJSCell):
25217         (JSC::JIT::emitJumpIfBothJSCells):
25218         (JSC::JIT::emitJumpIfNotJSCell):
25219         (JSC::JIT::emitLoadInt32ToDouble):
25220         (JSC::JIT::emitJumpIfImmediateInteger):
25221         (JSC::JIT::emitJumpIfNotImmediateInteger):
25222         (JSC::JIT::emitJumpIfNotImmediateIntegers):
25223         (JSC::JIT::emitFastArithReTagImmediate):
25224         (JSC::JIT::emitFastArithIntToImmNoCheck):
25225         * jit/JITOpcodes.cpp:
25226         (JSC::JIT::privateCompileCTINativeCall):
25227         (JSC::JIT::emit_op_mov):
25228         (JSC::JIT::emit_op_instanceof):
25229         (JSC::JIT::emit_op_is_undefined):
25230         (JSC::JIT::emit_op_is_boolean):
25231         (JSC::JIT::emit_op_is_number):
25232         (JSC::JIT::emit_op_tear_off_activation):
25233         (JSC::JIT::emit_op_not):
25234         (JSC::JIT::emit_op_jfalse):
25235         (JSC::JIT::emit_op_jeq_null):
25236         (JSC::JIT::emit_op_jneq_null):
25237         (JSC::JIT::emit_op_jtrue):
25238         (JSC::JIT::emit_op_bitxor):
25239         (JSC::JIT::emit_op_bitor):
25240         (JSC::JIT::emit_op_get_pnames):
25241         (JSC::JIT::emit_op_next_pname):
25242         (JSC::JIT::compileOpStrictEq):
25243         (JSC::JIT::emit_op_catch):
25244         (JSC::JIT::emit_op_throw_static_error):
25245         (JSC::JIT::emit_op_eq_null):
25246         (JSC::JIT::emit_op_neq_null):
25247         (JSC::JIT::emit_op_create_activation):
25248         (JSC::JIT::emit_op_create_arguments):
25249         (JSC::JIT::emit_op_init_lazy_reg):
25250         (JSC::JIT::emitSlow_op_convert_this):
25251         (JSC::JIT::emitSlow_op_not):
25252         (JSC::JIT::emit_op_get_argument_by_val):
25253         (JSC::JIT::emit_op_put_to_base):
25254         (JSC::JIT::emit_resolve_operations):
25255         * jit/JITPropertyAccess.cpp:
25256         (JSC::JIT::emit_op_get_by_val):
25257         (JSC::JIT::emitContiguousGetByVal):
25258         (JSC::JIT::emitArrayStorageGetByVal):
25259         (JSC::JIT::emitSlow_op_get_by_val):
25260         (JSC::JIT::compileGetDirectOffset):
25261         (JSC::JIT::emit_op_get_by_pname):
25262         (JSC::JIT::emitContiguousPutByVal):
25263         (JSC::JIT::emitArrayStoragePutByVal):
25264         (JSC::JIT::compileGetByIdHotPath):
25265         (JSC::JIT::emit_op_put_by_id):
25266         (JSC::JIT::compilePutDirectOffset):
25267         (JSC::JIT::emit_op_init_global_const):
25268         (JSC::JIT::emit_op_init_global_const_check):
25269         (JSC::JIT::emitIntTypedArrayGetByVal):
25270         (JSC::JIT::emitFloatTypedArrayGetByVal):
25271         (JSC::JIT::emitFloatTypedArrayPutByVal):
25272         * jit/JITStubCall.h:
25273         (JITStubCall):
25274         (JSC::JITStubCall::JITStubCall):
25275         (JSC::JITStubCall::addArgument):
25276         (JSC::JITStubCall::call):
25277         (JSC::JITStubCall::callWithValueProfiling):
25278         * jit/JSInterfaceJIT.h:
25279         (JSC::JSInterfaceJIT::emitJumpIfImmediateNumber):
25280         (JSC::JSInterfaceJIT::emitJumpIfNotImmediateNumber):
25281         (JSC::JSInterfaceJIT::emitLoadJSCell):
25282         (JSC::JSInterfaceJIT::emitLoadInt32):
25283         (JSC::JSInterfaceJIT::emitLoadDouble):
25284         * jit/SpecializedThunkJIT.h:
25285         (JSC::SpecializedThunkJIT::returnDouble):
25286         (JSC::SpecializedThunkJIT::tagReturnAsInt32):
25287         * runtime/JSValue.cpp:
25288         (JSC::JSValue::description):
25289         * runtime/JSValue.h: Define JSVALUE64 EncodedJSValue as int64_t, which is also unified with JSVALUE32_64.
25290         (JSC):
25291         * runtime/JSValueInlineMethods.h: New implementation of some JSValue methods to make them more conformant
25292         with the new rule that "JSValue is a 64-bit integer rather than a pointer" for JSVALUE64 platforms.
25293         (JSC):
25294         (JSC::JSValue::JSValue):
25295         (JSC::JSValue::operator bool):
25296         (JSC::JSValue::operator==):
25297         (JSC::JSValue::operator!=):
25298         (JSC::reinterpretDoubleToInt64):
25299         (JSC::reinterpretInt64ToDouble):
25300         (JSC::JSValue::asDouble):
25301
25302 2012-10-18  Michael Saboff  <msaboff@apple.com>
25303
25304         convertUTF8ToUTF16() Should Check for ASCII Input
25305         ihttps://bugs.webkit.org/show_bug.cgi?id=99739
25306
25307         Reviewed by Geoffrey Garen.
25308
25309         Using the updated convertUTF8ToUTF16() , we can determine if is makes more sense to
25310         create a string using the 8 bit source.  Added a new OpaqueJSString::create(LChar*, unsigned).
25311         Had to add a cast n JSStringCreateWithCFString to differentiate which create() to call.
25312
25313         * API/JSStringRef.cpp:
25314         (JSStringCreateWithUTF8CString):
25315         * API/JSStringRefCF.cpp:
25316         (JSStringCreateWithCFString):
25317         * API/OpaqueJSString.h:
25318         (OpaqueJSString::create):
25319         (OpaqueJSString):
25320         (OpaqueJSString::OpaqueJSString):
25321
25322 2012-10-18  Oliver Hunt  <oliver@apple.com>
25323
25324         Unbreak jsc tests.  Last minute "clever"-ness is clearly just not
25325         a good plan.
25326
25327         * dfg/DFGByteCodeParser.cpp:
25328         (JSC::DFG::ByteCodeParser::parseBlock):
25329
25330 2012-10-18  Oliver Hunt  <oliver@apple.com>
25331
25332         Bytecode should not have responsibility for determining how to perform non-local resolves
25333         https://bugs.webkit.org/show_bug.cgi?id=99349
25334
25335         Reviewed by Gavin Barraclough.
25336
25337         This patch removes lexical analysis from the bytecode generation.  This allows
25338         us to delay lookup of a non-local variables until the lookup is actually necessary,
25339         and simplifies a lot of the resolve logic in BytecodeGenerator.
25340
25341         Once a lookup is performed we cache the lookup information in a set of out-of-line
25342         buffers in CodeBlock.  This allows subsequent lookups to avoid unnecessary hashing,
25343         etc, and allows the respective JITs to recreated optimal lookup code.
25344
25345         This is currently still a performance regression in LLInt, but most of the remaining
25346         regression is caused by a lot of indirection that I'll remove in future work, as well
25347         as some work necessary to allow LLInt to perform in line instruction repatching.
25348         We will also want to improve the behaviour of the baseline JIT for some of the lookup
25349         operations, however this patch was getting quite large already so I'm landing it now
25350         that we've reached the bar of "performance-neutral".
25351
25352         Basic browsing seems to work.
25353
25354         * GNUmakefile.list.am:
25355         * JavaScriptCore.xcodeproj/project.pbxproj:
25356         * bytecode/CodeBlock.cpp:
25357         (JSC::CodeBlock::printStructures):
25358         (JSC::CodeBlock::dump):
25359         (JSC::CodeBlock::CodeBlock):
25360         (JSC::CodeBlock::visitStructures):
25361         (JSC):
25362         (JSC::CodeBlock::finalizeUnconditionally):
25363         (JSC::CodeBlock::shrinkToFit):
25364         * bytecode/CodeBlock.h:
25365         (JSC::CodeBlock::addResolve):
25366         (JSC::CodeBlock::addPutToBase):
25367         (CodeBlock):
25368         (JSC::CodeBlock::resolveOperations):
25369         (JSC::CodeBlock::putToBaseOperation):
25370         (JSC::CodeBlock::numberOfResolveOperations):
25371         (JSC::CodeBlock::numberOfPutToBaseOperations):
25372         (JSC::CodeBlock::addPropertyAccessInstruction):
25373         (JSC::CodeBlock::globalObjectConstant):
25374         (JSC::CodeBlock::setGlobalObjectConstant):
25375         * bytecode/Opcode.h:
25376         (JSC):
25377         (JSC::padOpcodeName):
25378         * bytecode/ResolveGlobalStatus.cpp:
25379         (JSC::computeForStructure):
25380         (JSC::ResolveGlobalStatus::computeFor):
25381         * bytecode/ResolveGlobalStatus.h:
25382         (JSC):
25383         (ResolveGlobalStatus):
25384         * bytecompiler/BytecodeGenerator.cpp:
25385         (JSC::ResolveResult::checkValidity):
25386         (JSC):
25387         (JSC::BytecodeGenerator::BytecodeGenerator):
25388         (JSC::BytecodeGenerator::resolve):
25389         (JSC::BytecodeGenerator::resolveConstDecl):
25390         (JSC::BytecodeGenerator::shouldAvoidResolveGlobal):
25391         (JSC::BytecodeGenerator::emitResolve):
25392         (JSC::BytecodeGenerator::emitResolveBase):
25393         (JSC::BytecodeGenerator::emitResolveBaseForPut):
25394         (JSC::BytecodeGenerator::emitResolveWithBaseForPut):
25395         (JSC::BytecodeGenerator::emitResolveWithThis):
25396         (JSC::BytecodeGenerator::emitGetLocalVar):
25397         (JSC::BytecodeGenerator::emitInitGlobalConst):
25398         (JSC::BytecodeGenerator::emitPutToBase):
25399         * bytecompiler/BytecodeGenerator.h:
25400         (JSC::ResolveResult::registerResolve):
25401         (JSC::ResolveResult::dynamicResolve):
25402         (ResolveResult):
25403         (JSC::ResolveResult::ResolveResult):
25404         (JSC):
25405         (NonlocalResolveInfo):
25406         (JSC::NonlocalResolveInfo::NonlocalResolveInfo):
25407         (JSC::NonlocalResolveInfo::~NonlocalResolveInfo):
25408         (JSC::NonlocalResolveInfo::resolved):
25409         (JSC::NonlocalResolveInfo::put):
25410         (BytecodeGenerator):
25411         (JSC::BytecodeGenerator::getResolveOperations):
25412         (JSC::BytecodeGenerator::getResolveWithThisOperations):
25413         (JSC::BytecodeGenerator::getResolveBaseOperations):
25414         (JSC::BytecodeGenerator::getResolveBaseForPutOperations):
25415         (JSC::BytecodeGenerator::getResolveWithBaseForPutOperations):
25416         (JSC::BytecodeGenerator::getPutToBaseOperation):
25417         * bytecompiler/NodesCodegen.cpp:
25418         (JSC::ResolveNode::isPure):
25419         (JSC::FunctionCallResolveNode::emitBytecode):
25420         (JSC::PostfixNode::emitResolve):
25421         (JSC::PrefixNode::emitResolve):
25422         (JSC::ReadModifyResolveNode::emitBytecode):
25423         (JSC::AssignResolveNode::emitBytecode):
25424         (JSC::ConstDeclNode::emitCodeSingle):
25425         (JSC::ForInNode::emitBytecode):
25426         * dfg/DFGAbstractState.cpp:
25427         (JSC::DFG::AbstractState::execute):
25428         * dfg/DFGByteCodeParser.cpp:
25429         (ByteCodeParser):
25430         (InlineStackEntry):
25431         (JSC::DFG::ByteCodeParser::handleGetByOffset):
25432         (DFG):
25433         (JSC::DFG::ByteCodeParser::parseResolveOperations):
25434         (JSC::DFG::ByteCodeParser::parseBlock):
25435         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
25436         * dfg/DFGCapabilities.h:
25437         (JSC::DFG::canInlineResolveOperations):
25438         (DFG):
25439         (JSC::DFG::canCompileOpcode):
25440         (JSC::DFG::canInlineOpcode):
25441         * dfg/DFGGraph.h:
25442         (ResolveGlobalData):
25443         (ResolveOperationData):
25444         (DFG):
25445         (PutToBaseOperationData):
25446         (Graph):
25447         * dfg/DFGNode.h:
25448         (JSC::DFG::Node::hasIdentifier):
25449         (JSC::DFG::Node::resolveOperationsDataIndex):
25450         (Node):
25451         * dfg/DFGNodeType.h:
25452         (DFG):
25453         * dfg/DFGOSRExit.cpp:
25454         (JSC::DFG::OSRExit::OSRExit):
25455         * dfg/DFGOSRExit.h:
25456         (OSRExit):
25457         * dfg/DFGOSRExitCompiler.cpp:
25458         * dfg/DFGOSRExitCompiler32_64.cpp:
25459         (JSC::DFG::OSRExitCompiler::compileExit):
25460         * dfg/DFGOSRExitCompiler64.cpp:
25461         (JSC::DFG::OSRExitCompiler::compileExit):
25462         * dfg/DFGOperations.cpp:
25463         * dfg/DFGOperations.h:
25464         * dfg/DFGPredictionPropagationPhase.cpp:
25465         (JSC::DFG::PredictionPropagationPhase::propagate):
25466         * dfg/DFGRepatch.cpp:
25467         (JSC::DFG::tryCacheGetByID):
25468         * dfg/DFGSpeculativeJIT.cpp:
25469         (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
25470         * dfg/DFGSpeculativeJIT.h:
25471         (JSC::DFG::SpeculativeJIT::resolveOperations):
25472         (SpeculativeJIT):
25473         (JSC::DFG::SpeculativeJIT::putToBaseOperation):
25474         (JSC::DFG::SpeculativeJIT::callOperation):
25475         * dfg/DFGSpeculativeJIT32_64.cpp:
25476         (JSC::DFG::SpeculativeJIT::compile):
25477         * dfg/DFGSpeculativeJIT64.cpp:
25478         (JSC::DFG::SpeculativeJIT::compile):
25479         * dfg/DFGStructureCheckHoistingPhase.cpp:
25480         (JSC::DFG::StructureCheckHoistingPhase::run):
25481         * jit/JIT.cpp:
25482         (JSC::JIT::privateCompileMainPass):
25483         (JSC::JIT::privateCompileSlowCases):
25484         * jit/JIT.h:
25485         (JIT):
25486         * jit/JITOpcodes.cpp:
25487         (JSC::JIT::emit_op_put_to_base):
25488         (JSC):
25489         (JSC::JIT::emit_resolve_operations):
25490         (JSC::JIT::emitSlow_link_resolve_operations):
25491         (JSC::JIT::emit_op_resolve):
25492         (JSC::JIT::emitSlow_op_resolve):
25493         (JSC::JIT::emit_op_resolve_base):
25494         (JSC::JIT::emitSlow_op_resolve_base):
25495         (JSC::JIT::emit_op_resolve_with_base):
25496         (JSC::JIT::emitSlow_op_resolve_with_base):
25497         (JSC::JIT::emit_op_resolve_with_this):
25498         (JSC::JIT::emitSlow_op_resolve_with_this):
25499         (JSC::JIT::emitSlow_op_put_to_base):
25500         * jit/JITOpcodes32_64.cpp:
25501         (JSC::JIT::emit_op_put_to_base):
25502         (JSC):
25503         * jit/JITPropertyAccess.cpp:
25504         (JSC::JIT::emit_op_init_global_const):
25505         (JSC::JIT::emit_op_init_global_const_check):
25506         (JSC::JIT::emitSlow_op_init_global_const_check):
25507         * jit/JITPropertyAccess32_64.cpp:
25508         (JSC::JIT::emit_op_init_global_const):
25509         (JSC::JIT::emit_op_init_global_const_check):
25510         (JSC::JIT::emitSlow_op_init_global_const_check):
25511         * jit/JITStubs.cpp:
25512         (JSC::DEFINE_STUB_FUNCTION):
25513         (JSC):
25514         * jit/JITStubs.h:
25515         * llint/LLIntSlowPaths.cpp:
25516         (LLInt):
25517         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
25518         * llint/LLIntSlowPaths.h:
25519         (LLInt):
25520         * llint/LowLevelInterpreter.asm:
25521         * llint/LowLevelInterpreter32_64.asm:
25522         * llint/LowLevelInterpreter64.asm:
25523         * runtime/JSScope.cpp:
25524         (JSC::LookupResult::base):
25525         (JSC::LookupResult::value):
25526         (JSC::LookupResult::setBase):
25527         (JSC::LookupResult::setValue):
25528         (LookupResult):
25529         (JSC):
25530         (JSC::setPutPropertyAccessOffset):
25531         (JSC::executeResolveOperations):
25532         (JSC::JSScope::resolveContainingScopeInternal):
25533         (JSC::JSScope::resolveContainingScope):
25534         (JSC::JSScope::resolve):
25535         (JSC::JSScope::resolveBase):
25536         (JSC::JSScope::resolveWithBase):
25537         (JSC::JSScope::resolveWithThis):
25538         (JSC::JSScope::resolvePut):
25539         (JSC::JSScope::resolveGlobal):
25540         * runtime/JSScope.h:
25541         (JSScope):
25542         * runtime/JSVariableObject.cpp:
25543         (JSC):
25544         * runtime/JSVariableObject.h:
25545         (JSVariableObject):
25546         * runtime/Structure.h:
25547         (JSC::Structure::propertyAccessesAreCacheable):
25548         (Structure):
25549
25550 2012-10-18  Mark Hahnenberg  <mhahnenberg@apple.com>
25551
25552         Live oversize copied blocks should count toward overall heap fragmentation
25553         https://bugs.webkit.org/show_bug.cgi?id=99548
25554
25555         Reviewed by Filip Pizlo.
25556
25557         The CopiedSpace uses overall heap fragmentation to determine whether or not it should do any copying.
25558         Currently it doesn't include live oversize CopiedBlocks in the calculation, but it should. We should
25559         treat them as 100% utilized, since running a copying phase won't be able to free/compact any of their
25560         memory. We can also free any dead oversize CopiedBlocks while we're iterating over them, rather than
25561         iterating over them again at the end of the copying phase.
25562
25563         * heap/CopiedSpace.cpp:
25564         (JSC::CopiedSpace::doneFillingBlock):
25565         (JSC::CopiedSpace::startedCopying):
25566         (JSC::CopiedSpace::doneCopying): Also removed a branch when iterating over from-space at the end of
25567         copying. Since we eagerly recycle blocks as soon as they're fully evacuated, we should see no
25568         unpinned blocks in from-space at the end of copying.
25569         * heap/CopiedSpaceInlineMethods.h:
25570         (JSC::CopiedSpace::recycleBorrowedBlock):
25571         * heap/CopyVisitorInlineMethods.h:
25572         (JSC::CopyVisitor::checkIfShouldCopy):
25573
25574 2012-10-18  Roger Fong  <roger_fong@apple.com>
25575
25576         Unreviewed. Build fix after r131701 and r131777.
25577
25578         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
25579
25580 2012-10-18  Mark Hahnenberg  <mhahnenberg@apple.com>
25581
25582         Race condition between GCThread and main thread during copying phase
25583         https://bugs.webkit.org/show_bug.cgi?id=99641
25584
25585         Reviewed by Filip Pizlo.
25586
25587         When a GCThread returns from copyFromShared(), it then calls doneCopying(), which returns
25588         its borrowed CopiedBlock to the CopiedSpace. This final block allows the CopiedSpace to
25589         continue and finish the cleanup of the copying phase. However, the GCThread can loop back
25590         around, see that m_currentPhase is still "Copy", and try to go through the copying phase again.
25591         This can cause all sorts of issues. To fix this, we should add a cyclic barrier to GCThread::waitForNextPhase().
25592
25593         * heap/GCThread.cpp:
25594         (JSC::GCThread::waitForNextPhase): All GCThreads will wait when they finish one iteration until the main thread
25595         notifies them to move down to the second while loop, where they wait for the next GCPhase to start. They also
25596         decrement the m_numberOfActiveGCThreads counter as they begin to wait for the next phase and increment it as
25597         they enter the next phase. This allows the main thread to wait in endCurrentPhase() until all the threads have
25598         finished the current phase and are waiting on the next phase to begin. Without the counter, there would be
25599         no way to ensure that every thread was available for each GCPhase.
25600         (JSC::GCThread::gcThreadMain): We now use the m_phaseLock to synchronize with the main thread when we're being created.
25601         * heap/GCThreadSharedData.cpp:
25602         (JSC::GCThreadSharedData::GCThreadSharedData): As we create each GCThread, we increment the m_numberOfActiveGCThreads
25603         counter. When we are done creating the threads, we wait until they're all waiting for the next GCPhase. This prevents
25604         us from leaving some GCThreads behind during the first GCPhase, which could hurt us on our very short-running
25605         benchmarks (e.g. SunSpider).
25606         (JSC::GCThreadSharedData::~GCThreadSharedData):
25607         (JSC::GCThreadSharedData::startNextPhase): We atomically swap the two flags, m_gcThreadsShouldWait and m_currentPhase,
25608         so that if the threads finish very quickly, they will wait until the main thread is ready to end the current phase.
25609         (JSC::GCThreadSharedData::endCurrentPhase): Here atomically we swap the two flags again to allow the threads to
25610         advance to waiting on the next GCPhase. We wait until all of the GCThreads have settled into the second wait loop
25611         before allowing the main thread to continue. This prevents us from leaving one of the GCThreads stuck in the first
25612         wait loop if we were to call startNextPhase() before it had time to wake up and move on to the second wait loop.
25613         (JSC):
25614         (JSC::GCThreadSharedData::didStartMarking): We now use startNextPhase() to properly swap the flags.
25615         (JSC::GCThreadSharedData::didFinishMarking): Ditto for endCurrentPhase().
25616         (JSC::GCThreadSharedData::didStartCopying): Ditto.
25617         (JSC::GCThreadSharedData::didFinishCopying): Ditto.
25618         * heap/GCThreadSharedData.h:
25619         (GCThreadSharedData):
25620         * heap/Heap.cpp:
25621         (JSC::Heap::copyBackingStores): No reason to use the extra reference.
25622
25623 2012-10-18  Pablo Flouret  <pablof@motorola.com>
25624
25625         Implement css3-conditional's @supports rule
25626         https://bugs.webkit.org/show_bug.cgi?id=86146
25627
25628         Reviewed by Antti Koivisto.
25629
25630         * Configurations/FeatureDefines.xcconfig:
25631             Add an ENABLE_CSS3_CONDITIONAL_RULES flag.
25632
25633 2012-10-18  Michael Saboff  <msaboff@apple.com>
25634
25635         Make conversion between JSStringRef and WKStringRef work without character size conversions
25636         https://bugs.webkit.org/show_bug.cgi?id=99727
25637
25638         Reviewed by Anders Carlsson.
25639
25640         Export the string() method for use in WebKit.
25641
25642         * API/OpaqueJSString.h:
25643         (OpaqueJSString::string):
25644
25645 2012-10-18  Raphael Kubo da Costa  <raphael.kubo.da.costa@intel.com>
25646
25647         [CMake] Avoid unnecessarily running the LLInt generation commands.
25648         https://bugs.webkit.org/show_bug.cgi?id=99708
25649
25650         Reviewed by Rob Buis.
25651
25652         As described in the comments in the change itself, in some cases
25653         the Ruby generation scripts used when LLInt is on would each be
25654         run twice in every build even if nothing had changed.
25655
25656         Fix that by not setting the OBJECT_DEPENDS property of some source
25657         files to depend on the generated headers; instead, they are now
25658         just part of the final binaries/libraries which use them.
25659
25660         * CMakeLists.txt:
25661
25662 2012-10-17  Zoltan Horvath  <zoltan@webkit.org>
25663
25664         Remove the JSHeap memory measurement of the PageLoad performacetests since it creates bogus JSGlobalDatas
25665         https://bugs.webkit.org/show_bug.cgi?id=99609
25666
25667         Reviewed by Ryosuke Niwa.
25668
25669         Remove the implementation since it creates bogus JSGlobalDatas in the layout tests.
25670
25671         * heap/HeapStatistics.cpp:
25672         (JSC):
25673         * heap/HeapStatistics.h:
25674         (HeapStatistics):
25675
25676 2012-10-17  Sam Weinig  <sam@webkit.org>
25677
25678         Attempt to fix the build.
25679
25680         * bytecode/GlobalResolveInfo.h: Copied from bytecode/GlobalResolveInfo.h.
25681
25682 2012-10-17  Filip Pizlo  <fpizlo@apple.com>
25683
25684         REGRESSION (r130826 or r130828): Twitter top bar is dysfunctional
25685         https://bugs.webkit.org/show_bug.cgi?id=99577
25686         <rdar://problem/12518883>
25687
25688         Reviewed by Mark Hahnenberg.
25689
25690         It turns out that it's a good idea to maintain the invariants of your object model, such as that
25691         elements past publicLength should have the hole value.
25692
25693         * dfg/DFGGraph.cpp:
25694         (JSC::DFG::Graph::dump):
25695         * dfg/DFGSpeculativeJIT32_64.cpp:
25696         (JSC::DFG::SpeculativeJIT::compile):
25697         * dfg/DFGSpeculativeJIT64.cpp:
25698         (JSC::DFG::SpeculativeJIT::compile):
25699
25700 2012-10-17  Anders Carlsson  <andersca@apple.com>
25701
25702         Clean up Vector.h
25703         https://bugs.webkit.org/show_bug.cgi?id=99622
25704
25705         Reviewed by Benjamin Poulain.
25706
25707         Fix fallout from removing std::max and std::min using declarations.
25708
25709         * runtime/StringPrototype.cpp:
25710         (JSC::jsSpliceSubstrings):
25711         (JSC::jsSpliceSubstringsWithSeparators):
25712         (JSC::stringProtoFuncIndexOf):
25713         * yarr/YarrPattern.cpp:
25714         (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets):
25715
25716 2012-10-17  Oliver Hunt  <oliver@apple.com>
25717
25718         Committing new files is so overrated.
25719
25720         * bytecode/ResolveOperation.h: Added.
25721         (JSC):
25722         (JSC::ResolveOperation::getAndReturnScopedVar):
25723         (JSC::ResolveOperation::checkForDynamicEntriesBeforeGlobalScope):
25724         (ResolveOperation):
25725         (JSC::ResolveOperation::getAndReturnGlobalVar):
25726         (JSC::ResolveOperation::getAndReturnGlobalProperty):
25727         (JSC::ResolveOperation::resolveFail):
25728         (JSC::ResolveOperation::skipTopScopeNode):
25729         (JSC::ResolveOperation::skipScopes):
25730         (JSC::ResolveOperation::returnGlobalObjectAsBase):
25731         (JSC::ResolveOperation::setBaseToGlobal):
25732         (JSC::ResolveOperation::setBaseToUndefined):
25733         (JSC::ResolveOperation::setBaseToScope):
25734         (JSC::ResolveOperation::returnScopeAsBase):
25735         (JSC::PutToBaseOperation::PutToBaseOperation):
25736
25737 2012-10-17  Michael Saboff  <msaboff@apple.com>
25738
25739         StringPrototype::jsSpliceSubstringsWithSeparators() doesn't optimally handle 8 bit strings
25740         https://bugs.webkit.org/show_bug.cgi?id=99230
25741
25742         Reviewed by Geoffrey Garen.
25743
25744         Added code to select characters8() or characters16() on the not all 8 bit path for both the
25745         processing of the source and the separators.
25746
25747         * runtime/StringPrototype.cpp:
25748         (JSC::jsSpliceSubstringsWithSeparators):
25749
25750 2012-10-17  Filip Pizlo  <fpizlo@apple.com>
25751
25752         Array and object allocations via 'new Object' or 'new Array' should be inlined in bytecode to allow allocation site profiling
25753         https://bugs.webkit.org/show_bug.cgi?id=99557
25754
25755         Reviewed by Geoffrey Garen.
25756
25757         Removed an inaccurate and misleading comment as per Geoff's review. (I forgot
25758         to make this change as part of http://trac.webkit.org/changeset/131644).
25759
25760         * bytecompiler/NodesCodegen.cpp:
25761         (JSC::FunctionCallResolveNode::emitBytecode):
25762
25763 2012-10-17  Oliver Hunt  <oliver@apple.com>
25764
25765         Bytecode should not have responsibility for determining how to perform non-local resolves
25766         https://bugs.webkit.org/show_bug.cgi?id=99349
25767
25768         Reviewed by Gavin Barraclough.
25769
25770         This patch removes lexical analysis from the bytecode generation.  This allows
25771         us to delay lookup of a non-local variables until the lookup is actually necessary,
25772         and simplifies a lot of the resolve logic in BytecodeGenerator.
25773
25774         Once a lookup is performed we cache the lookup information in a set of out-of-line
25775         buffers in CodeBlock.  This allows subsequent lookups to avoid unnecessary hashing,
25776         etc, and allows the respective JITs to recreated optimal lookup code.
25777
25778         This is currently still a performance regression in LLInt, but most of the remaining
25779         regression is caused by a lot of indirection that I'll remove in future work, as well
25780         as some work necessary to allow LLInt to perform in line instruction repatching.
25781         We will also want to improve the behaviour of the baseline JIT for some of the lookup
25782         operations, however this patch was getting quite large already so I'm landing it now
25783         that we've reached the bar of "performance-neutral".
25784
25785         * GNUmakefile.list.am:
25786         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
25787         * JavaScriptCore.xcodeproj/project.pbxproj:
25788         * bytecode/CodeBlock.cpp:
25789         (JSC::CodeBlock::printStructures):
25790         (JSC::CodeBlock::dump):
25791         (JSC::CodeBlock::CodeBlock):
25792         (JSC::CodeBlock::visitStructures):
25793         (JSC):
25794         (JSC::CodeBlock::finalizeUnconditionally):
25795         (JSC::CodeBlock::shrinkToFit):
25796         * bytecode/CodeBlock.h:
25797         (JSC::CodeBlock::addResolve):
25798         (JSC::CodeBlock::addPutToBase):
25799         (CodeBlock):
25800         (JSC::CodeBlock::resolveOperations):
25801         (JSC::CodeBlock::putToBaseOperation):
25802         (JSC::CodeBlock::numberOfResolveOperations):
25803         (JSC::CodeBlock::numberOfPutToBaseOperations):
25804         (JSC::CodeBlock::addPropertyAccessInstruction):
25805         (JSC::CodeBlock::globalObjectConstant):
25806         (JSC::CodeBlock::setGlobalObjectConstant):
25807         * bytecode/GlobalResolveInfo.h: Removed.
25808         * bytecode/Opcode.h:
25809         (JSC):
25810         (JSC::padOpcodeName):
25811         * bytecode/ResolveGlobalStatus.cpp:
25812         (JSC::computeForStructure):
25813         (JSC::ResolveGlobalStatus::computeFor):
25814         * bytecode/ResolveGlobalStatus.h:
25815         (JSC):
25816         (ResolveGlobalStatus):
25817         * bytecode/ResolveOperation.h: Added.
25818           The new types and logic we use to perform the cached lookups.
25819         (JSC):
25820         (ResolveOperation):
25821         (JSC::ResolveOperation::getAndReturnScopedVar):
25822         (JSC::ResolveOperation::checkForDynamicEntriesBeforeGlobalScope):
25823         (JSC::ResolveOperation::getAndReturnGlobalVar):
25824         (JSC::ResolveOperation::getAndReturnGlobalProperty):
25825         (JSC::ResolveOperation::resolveFail):
25826         (JSC::ResolveOperation::skipTopScopeNode):
25827         (JSC::ResolveOperation::skipScopes):
25828         (JSC::ResolveOperation::returnGlobalObjectAsBase):
25829         (JSC::ResolveOperation::setBaseToGlobal):
25830         (JSC::ResolveOperation::setBaseToUndefined):
25831         (JSC::ResolveOperation::setBaseToScope):
25832         (JSC::ResolveOperation::returnScopeAsBase):
25833         (JSC::PutToBaseOperation::PutToBaseOperation):
25834         * bytecompiler/BytecodeGenerator.cpp:
25835         (JSC::ResolveResult::checkValidity):
25836         (JSC):
25837         (JSC::BytecodeGenerator::BytecodeGenerator):
25838         (JSC::BytecodeGenerator::resolve):
25839         (JSC::BytecodeGenerator::resolveConstDecl):
25840         (JSC::BytecodeGenerator::shouldAvoidResolveGlobal):
25841         (JSC::BytecodeGenerator::emitResolve):
25842         (JSC::BytecodeGenerator::emitResolveBase):
25843         (JSC::BytecodeGenerator::emitResolveBaseForPut):
25844         (JSC::BytecodeGenerator::emitResolveWithBaseForPut):
25845         (JSC::BytecodeGenerator::emitResolveWithThis):
25846         (JSC::BytecodeGenerator::emitGetLocalVar):
25847         (JSC::BytecodeGenerator::emitInitGlobalConst):
25848         (JSC::BytecodeGenerator::emitPutToBase):
25849         * bytecompiler/BytecodeGenerator.h:
25850         (JSC::ResolveResult::registerResolve):
25851         (JSC::ResolveResult::dynamicResolve):
25852         (ResolveResult):
25853         (JSC::ResolveResult::ResolveResult):
25854         (JSC):
25855         (NonlocalResolveInfo):
25856         (JSC::NonlocalResolveInfo::NonlocalResolveInfo):
25857         (JSC::NonlocalResolveInfo::~NonlocalResolveInfo):
25858         (JSC::NonlocalResolveInfo::resolved):
25859         (JSC::NonlocalResolveInfo::put):
25860         (BytecodeGenerator):
25861         (JSC::BytecodeGenerator::getResolveOperations):
25862         (JSC::BytecodeGenerator::getResolveWithThisOperations):
25863         (JSC::BytecodeGenerator::getResolveBaseOperations):
25864         (JSC::BytecodeGenerator::getResolveBaseForPutOperations):
25865         (JSC::BytecodeGenerator::getResolveWithBaseForPutOperations):
25866         (JSC::BytecodeGenerator::getPutToBaseOperation):
25867         * bytecompiler/NodesCodegen.cpp:
25868         (JSC::ResolveNode::isPure):
25869         (JSC::FunctionCallResolveNode::emitBytecode):
25870         (JSC::PostfixNode::emitResolve):
25871         (JSC::PrefixNode::emitResolve):
25872         (JSC::ReadModifyResolveNode::emitBytecode):
25873         (JSC::AssignResolveNode::emitBytecode):
25874         (JSC::ConstDeclNode::emitCodeSingle):
25875         (JSC::ForInNode::emitBytecode):
25876         * dfg/DFGAbstractState.cpp:
25877         (JSC::DFG::AbstractState::execute):
25878         * dfg/DFGByteCodeParser.cpp:
25879         (ByteCodeParser):
25880         (InlineStackEntry):
25881         (JSC::DFG::ByteCodeParser::handleGetByOffset):
25882         (DFG):
25883         (JSC::DFG::ByteCodeParser::parseResolveOperations):
25884         (JSC::DFG::ByteCodeParser::parseBlock):
25885         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
25886         * dfg/DFGCapabilities.h:
25887         (JSC::DFG::canCompileResolveOperations):
25888         (DFG):
25889         (JSC::DFG::canCompilePutToBaseOperation):
25890         (JSC::DFG::canCompileOpcode):
25891         (JSC::DFG::canInlineOpcode):
25892         * dfg/DFGGraph.h:
25893         (ResolveGlobalData):
25894         (ResolveOperationData):
25895         (DFG):
25896         (PutToBaseOperationData):
25897         (Graph):
25898         * dfg/DFGNode.h:
25899         (JSC::DFG::Node::hasIdentifier):
25900         (JSC::DFG::Node::resolveOperationsDataIndex):
25901         (Node):
25902         * dfg/DFGNodeType.h:
25903         (DFG):
25904         * dfg/DFGOSRExit.cpp:
25905         (JSC::DFG::OSRExit::OSRExit):
25906         * dfg/DFGOSRExit.h:
25907         (OSRExit):
25908         * dfg/DFGOSRExitCompiler.cpp:
25909         * dfg/DFGOSRExitCompiler32_64.cpp:
25910         (JSC::DFG::OSRExitCompiler::compileExit):
25911         * dfg/DFGOSRExitCompiler64.cpp:
25912         (JSC::DFG::OSRExitCompiler::compileExit):
25913         * dfg/DFGOperations.cpp:
25914         * dfg/DFGOperations.h:
25915         * dfg/DFGPredictionPropagationPhase.cpp:
25916         (JSC::DFG::PredictionPropagationPhase::propagate):
25917         * dfg/DFGRepatch.cpp:
25918         (JSC::DFG::tryCacheGetByID):
25919         * dfg/DFGSpeculativeJIT.cpp:
25920         (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
25921         * dfg/DFGSpeculativeJIT.h:
25922         (JSC::DFG::SpeculativeJIT::resolveOperations):
25923         (SpeculativeJIT):
25924         (JSC::DFG::SpeculativeJIT::putToBaseOperation):
25925         (JSC::DFG::SpeculativeJIT::callOperation):
25926         * dfg/DFGSpeculativeJIT32_64.cpp:
25927         (JSC::DFG::SpeculativeJIT::compile):
25928         * dfg/DFGSpeculativeJIT64.cpp:
25929         (JSC::DFG::SpeculativeJIT::compile):
25930         * dfg/DFGStructureCheckHoistingPhase.cpp:
25931         (JSC::DFG::StructureCheckHoistingPhase::run):
25932         * jit/JIT.cpp:
25933         (JSC::JIT::privateCompileMainPass):
25934         (JSC::JIT::privateCompileSlowCases):
25935         * jit/JIT.h:
25936         (JIT):
25937         * jit/JITOpcodes.cpp:
25938         (JSC::JIT::emit_op_put_to_base):
25939         (JSC):
25940         (JSC::JIT::emit_resolve_operations):
25941         (JSC::JIT::emitSlow_link_resolve_operations):
25942         (JSC::JIT::emit_op_resolve):
25943         (JSC::JIT::emitSlow_op_resolve):
25944         (JSC::JIT::emit_op_resolve_base):
25945         (JSC::JIT::emitSlow_op_resolve_base):
25946         (JSC::JIT::emit_op_resolve_with_base):
25947         (JSC::JIT::emitSlow_op_resolve_with_base):
25948         (JSC::JIT::emit_op_resolve_with_this):
25949         (JSC::JIT::emitSlow_op_resolve_with_this):
25950         (JSC::JIT::emitSlow_op_put_to_base):
25951         * jit/JITOpcodes32_64.cpp:
25952         (JSC::JIT::emit_op_put_to_base):
25953         (JSC):
25954         * jit/JITPropertyAccess.cpp:
25955         (JSC::JIT::emit_op_init_global_const):
25956         (JSC::JIT::emit_op_init_global_const_check):
25957         (JSC::JIT::emitSlow_op_init_global_const_check):
25958         * jit/JITPropertyAccess32_64.cpp:
25959         (JSC::JIT::emit_op_init_global_const):
25960         (JSC::JIT::emit_op_init_global_const_check):
25961         (JSC::JIT::emitSlow_op_init_global_const_check):
25962         * jit/JITStubs.cpp:
25963         (JSC::DEFINE_STUB_FUNCTION):
25964         (JSC):
25965         * jit/JITStubs.h:
25966         * llint/LLIntSlowPaths.cpp:
25967         (LLInt):
25968         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
25969         * llint/LLIntSlowPaths.h:
25970         (LLInt):
25971         * llint/LowLevelInterpreter.asm:
25972         * llint/LowLevelInterpreter32_64.asm:
25973         * llint/LowLevelInterpreter64.asm:
25974         * runtime/JSScope.cpp:
25975         (JSC::LookupResult::base):
25976         (JSC::LookupResult::value):
25977         (JSC::LookupResult::setBase):
25978         (JSC::LookupResult::setValue):
25979         (LookupResult):
25980         (JSC):
25981         (JSC::setPutPropertyAccessOffset):
25982         (JSC::executeResolveOperations):
25983         (JSC::JSScope::resolveContainingScopeInternal):
25984         (JSC::JSScope::resolveContainingScope):
25985         (JSC::JSScope::resolve):
25986         (JSC::JSScope::resolveBase):
25987         (JSC::JSScope::resolveWithBase):
25988         (JSC::JSScope::resolveWithThis):
25989         (JSC::JSScope::resolvePut):
25990         (JSC::JSScope::resolveGlobal):
25991         * runtime/JSScope.h:
25992         (JSScope):
25993         * runtime/JSVariableObject.cpp:
25994         (JSC):
25995         * runtime/JSVariableObject.h:
25996         (JSVariableObject):
25997         * runtime/Structure.h:
25998         (JSC::Structure::propertyAccessesAreCacheable):
25999         (Structure):
26000
26001 2012-10-17  Filip Pizlo  <fpizlo@apple.com>
26002
26003         Array and object allocations via 'new Object' or 'new Array' should be inlined in bytecode to allow allocation site profiling
26004         https://bugs.webkit.org/show_bug.cgi?id=99557
26005
26006         Reviewed by Geoffrey Garen.
26007
26008         This uses the old jneq_ptr trick to allow for the bytecode to "see" that the
26009         operation in question is what we almost certainly know it to be.
26010
26011         * bytecode/CodeBlock.cpp:
26012         (JSC::CodeBlock::dump):
26013         * bytecode/Opcode.h:
26014         (JSC):
26015         (JSC::padOpcodeName):
26016         * bytecode/SpecialPointer.h:
26017         * bytecompiler/BytecodeGenerator.cpp:
26018         (JSC::BytecodeGenerator::emitCall):
26019         (JSC::BytecodeGenerator::emitCallEval):
26020         (JSC::BytecodeGenerator::expectedFunctionForIdentifier):
26021         (JSC):
26022         (JSC::BytecodeGenerator::emitExpectedFunctionSnippet):
26023         (JSC::BytecodeGenerator::emitConstruct):
26024         * bytecompiler/BytecodeGenerator.h:
26025         (BytecodeGenerator):
26026         * bytecompiler/NodesCodegen.cpp:
26027         (JSC::NewExprNode::emitBytecode):
26028         (JSC::FunctionCallValueNode::emitBytecode):
26029         (JSC::FunctionCallResolveNode::emitBytecode):
26030         (JSC::FunctionCallBracketNode::emitBytecode):
26031         (JSC::FunctionCallDotNode::emitBytecode):
26032         (JSC::CallFunctionCallDotNode::emitBytecode):
26033         (JSC::ApplyFunctionCallDotNode::emitBytecode):
26034         * dfg/DFGByteCodeParser.cpp:
26035         (JSC::DFG::ByteCodeParser::parseBlock):
26036         * dfg/DFGCapabilities.h:
26037         (JSC::DFG::canCompileOpcode):
26038         * jit/JIT.cpp:
26039         (JSC::JIT::privateCompileMainPass):
26040         * jit/JIT.h:
26041         (JIT):
26042         * jit/JITOpcodes.cpp:
26043         (JSC::JIT::emit_op_new_array_with_size):
26044         (JSC):
26045         * jit/JITStubs.cpp:
26046         (JSC::DEFINE_STUB_FUNCTION):
26047         (JSC):
26048         * jit/JITStubs.h:
26049         * llint/LLIntSlowPaths.cpp:
26050         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
26051         (LLInt):
26052         * llint/LLIntSlowPaths.h:
26053         (LLInt):
26054         * llint/LowLevelInterpreter.asm:
26055         * runtime/ArrayConstructor.cpp:
26056         (JSC::constructArrayWithSizeQuirk):
26057         (JSC):
26058         * runtime/ArrayConstructor.h:
26059         (JSC):
26060         * runtime/CommonIdentifiers.h:
26061         * runtime/JSGlobalObject.cpp:
26062         (JSC::JSGlobalObject::reset):
26063         (JSC):
26064
26065 2012-10-17  Filip Pizlo  <fpizlo@apple.com>
26066
26067         JIT op_get_by_pname should call cti_get_by_val_generic and not cti_get_by_val
26068         https://bugs.webkit.org/show_bug.cgi?id=99631
26069         <rdar://problem/12483221>
26070
26071         Reviewed by Mark Hahnenberg.
26072
26073         cti_get_by_val assumes that the return address has patching metadata associated with it, which won't
26074         be true for op_get_by_pname. cti_get_by_val_generic makes no such assumptions.
26075
26076         * jit/JITPropertyAccess.cpp:
26077         (JSC::JIT::emitSlow_op_get_by_pname):
26078         * jit/JITPropertyAccess32_64.cpp:
26079         (JSC::JIT::emitSlow_op_get_by_pname):
26080
26081 2012-10-17  Mark Hahnenberg  <mhahnenberg@apple.com>
26082
26083         Block freeing thread should sleep indefinitely when there's no work to do
26084         https://bugs.webkit.org/show_bug.cgi?id=98084
26085
26086         Reviewed by Geoffrey Garen.
26087
26088         r130212 didn't fully fix the problem.
26089
26090         * heap/BlockAllocator.cpp:
26091         (JSC::BlockAllocator::blockFreeingThreadMain): We would just continue to the next iteration if
26092         we found that we had zero blocks to copy. We should move the indefinite wait up to where that
26093         check is done so that we properly detect the "no more blocks to copy, wait for more" condition.
26094
26095 2012-10-16  Csaba Osztrogonác  <ossy@webkit.org>
26096
26097         Unreviewed, rolling out r131516 and r131550.
26098         http://trac.webkit.org/changeset/131516
26099         http://trac.webkit.org/changeset/131550
26100         https://bugs.webkit.org/show_bug.cgi?id=99349
26101
26102         It caused zillion different problem on different platforms
26103
26104         * GNUmakefile.list.am:
26105         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
26106         * JavaScriptCore.xcodeproj/project.pbxproj:
26107         * bytecode/CodeBlock.cpp:
26108         (JSC):
26109         (JSC::isGlobalResolve):
26110         (JSC::instructionOffsetForNth):
26111         (JSC::printGlobalResolveInfo):
26112         (JSC::CodeBlock::printStructures):
26113         (JSC::CodeBlock::dump):
26114         (JSC::CodeBlock::CodeBlock):
26115         (JSC::CodeBlock::visitStructures):
26116         (JSC::CodeBlock::finalizeUnconditionally):
26117         (JSC::CodeBlock::hasGlobalResolveInfoAtBytecodeOffset):
26118         (JSC::CodeBlock::globalResolveInfoForBytecodeOffset):
26119         (JSC::CodeBlock::shrinkToFit):
26120         * bytecode/CodeBlock.h:
26121         (CodeBlock):
26122         (JSC::CodeBlock::addGlobalResolveInstruction):
26123         (JSC::CodeBlock::addGlobalResolveInfo):
26124         (JSC::CodeBlock::globalResolveInfo):
26125         (JSC::CodeBlock::numberOfGlobalResolveInfos):
26126         (JSC::CodeBlock::globalResolveInfoCount):
26127         * bytecode/GlobalResolveInfo.h: Copied from Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp.
26128         (JSC):
26129         (JSC::GlobalResolveInfo::GlobalResolveInfo):
26130         (GlobalResolveInfo):
26131         (JSC::getGlobalResolveInfoBytecodeOffset):
26132         * bytecode/Opcode.h:
26133         (JSC):
26134         (JSC::padOpcodeName):
26135         * bytecode/ResolveGlobalStatus.cpp:
26136         (JSC):
26137         (JSC::computeForStructure):
26138         (JSC::computeForLLInt):
26139         (JSC::ResolveGlobalStatus::computeFor):
26140         * bytecode/ResolveGlobalStatus.h:
26141         (JSC):
26142         (ResolveGlobalStatus):
26143         * bytecode/ResolveOperation.h: Removed.
26144         * bytecompiler/BytecodeGenerator.cpp:
26145         (JSC::ResolveResult::checkValidity):
26146         (JSC::ResolveResult::registerPointer):
26147         (JSC):
26148         (JSC::BytecodeGenerator::BytecodeGenerator):
26149         (JSC::BytecodeGenerator::resolve):
26150         (JSC::BytecodeGenerator::resolveConstDecl):
26151         (JSC::BytecodeGenerator::shouldAvoidResolveGlobal):
26152         (JSC::BytecodeGenerator::emitResolve):
26153         (JSC::BytecodeGenerator::emitResolveBase):
26154         (JSC::BytecodeGenerator::emitResolveBaseForPut):
26155         (JSC::BytecodeGenerator::emitResolveWithBase):
26156         (JSC::BytecodeGenerator::emitResolveWithThis):
26157         (JSC::BytecodeGenerator::emitGetStaticVar):
26158         (JSC::BytecodeGenerator::emitInitGlobalConst):
26159         (JSC::BytecodeGenerator::emitPutStaticVar):
26160         * bytecompiler/BytecodeGenerator.h:
26161         (JSC::ResolveResult::registerResolve):
26162         (JSC::ResolveResult::dynamicResolve):
26163         (JSC::ResolveResult::lexicalResolve):
26164         (JSC::ResolveResult::indexedGlobalResolve):
26165         (JSC::ResolveResult::dynamicIndexedGlobalResolve):
26166         (JSC::ResolveResult::globalResolve):
26167         (JSC::ResolveResult::dynamicGlobalResolve):
26168         (JSC::ResolveResult::type):
26169         (JSC::ResolveResult::index):
26170         (JSC::ResolveResult::depth):
26171         (JSC::ResolveResult::globalObject):
26172         (ResolveResult):
26173         (JSC::ResolveResult::isStatic):
26174         (JSC::ResolveResult::isIndexed):
26175         (JSC::ResolveResult::isScoped):
26176         (JSC::ResolveResult::isGlobal):
26177         (JSC::ResolveResult::ResolveResult):
26178         (BytecodeGenerator):
26179         * bytecompiler/NodesCodegen.cpp:
26180         (JSC::ResolveNode::isPure):
26181         (JSC::FunctionCallResolveNode::emitBytecode):
26182         (JSC::PostfixNode::emitResolve):
26183         (JSC::PrefixNode::emitResolve):
26184         (JSC::ReadModifyResolveNode::emitBytecode):
26185         (JSC::AssignResolveNode::emitBytecode):
26186         (JSC::ConstDeclNode::emitCodeSingle):
26187         (JSC::ForInNode::emitBytecode):
26188         * dfg/DFGAbstractState.cpp:
26189         (JSC::DFG::AbstractState::execute):
26190         * dfg/DFGByteCodeParser.cpp:
26191         (ByteCodeParser):
26192         (InlineStackEntry):
26193         (JSC::DFG::ByteCodeParser::handleGetByOffset):
26194         (JSC::DFG::ByteCodeParser::parseBlock):
26195         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
26196         * dfg/DFGCapabilities.h:
26197         (JSC::DFG::canCompileOpcode):
26198         (JSC::DFG::canInlineOpcode):
26199         * dfg/DFGGraph.h:
26200         (ResolveGlobalData):
26201         (DFG):
26202         (Graph):
26203         * dfg/DFGNode.h:
26204         (JSC::DFG::Node::hasIdentifier):
26205         * dfg/DFGNodeType.h:
26206         (DFG):
26207         * dfg/DFGOSRExit.cpp:
26208         (JSC::DFG::OSRExit::OSRExit):
26209         * dfg/DFGOSRExit.h:
26210         (OSRExit):
26211         * dfg/DFGOSRExitCompiler.cpp:
26212         * dfg/DFGOSRExitCompiler32_64.cpp:
26213         (JSC::DFG::OSRExitCompiler::compileExit):
26214         * dfg/DFGOSRExitCompiler64.cpp:
26215         (JSC::DFG::OSRExitCompiler::compileExit):
26216         * dfg/DFGOperations.cpp:
26217         * dfg/DFGOperations.h:
26218         (JSC):
26219         * dfg/DFGPredictionPropagationPhase.cpp:
26220         (JSC::DFG::PredictionPropagationPhase::propagate):
26221         * dfg/DFGRepatch.cpp:
26222         (JSC::DFG::tryCacheGetByID):
26223         * dfg/DFGSpeculativeJIT.cpp:
26224         (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
26225         * dfg/DFGSpeculativeJIT.h:
26226         (JSC::DFG::SpeculativeJIT::callOperation):
26227         * dfg/DFGSpeculativeJIT32_64.cpp:
26228         (JSC::DFG::SpeculativeJIT::compile):
26229         * dfg/DFGSpeculativeJIT64.cpp:
26230         (JSC::DFG::SpeculativeJIT::compile):
26231         * dfg/DFGStructureCheckHoistingPhase.cpp:
26232         (JSC::DFG::StructureCheckHoistingPhase::run):
26233         * jit/JIT.cpp:
26234         (JSC::JIT::privateCompileMainPass):
26235         (JSC::JIT::privateCompileSlowCases):
26236         * jit/JIT.h:
26237         (JIT):
26238         (JSC::JIT::emit_op_get_global_var_watchable):
26239         * jit/JITOpcodes.cpp:
26240         (JSC::JIT::emit_op_resolve):
26241         (JSC):
26242         (JSC::JIT::emit_op_resolve_base):
26243         (JSC::JIT::emit_op_resolve_skip):
26244         (JSC::JIT::emit_op_resolve_global):
26245         (JSC::JIT::emitSlow_op_resolve_global):
26246         (JSC::JIT::emit_op_resolve_with_base):
26247         (JSC::JIT::emit_op_resolve_with_this):
26248         (JSC::JIT::emit_op_resolve_global_dynamic):
26249         (JSC::JIT::emitSlow_op_resolve_global_dynamic):
26250         * jit/JITOpcodes32_64.cpp:
26251         (JSC::JIT::emit_op_resolve):
26252         (JSC):
26253         (JSC::JIT::emit_op_resolve_base):
26254         (JSC::JIT::emit_op_resolve_skip):
26255         (JSC::JIT::emit_op_resolve_global):
26256         (JSC::JIT::emitSlow_op_resolve_global):
26257         (JSC::JIT::emit_op_resolve_with_base):
26258         (JSC::JIT::emit_op_resolve_with_this):
26259         * jit/JITPropertyAccess.cpp:
26260         (JSC::JIT::emit_op_get_scoped_var):
26261         (JSC):
26262         (JSC::JIT::emit_op_put_scoped_var):
26263         (JSC::JIT::emit_op_get_global_var):
26264         (JSC::JIT::emit_op_put_global_var):
26265         (JSC::JIT::emit_op_put_global_var_check):
26266         (JSC::JIT::emitSlow_op_put_global_var_check):
26267         * jit/JITPropertyAccess32_64.cpp:
26268         (JSC::JIT::emit_op_get_scoped_var):
26269         (JSC):
26270         (JSC::JIT::emit_op_put_scoped_var):
26271         (JSC::JIT::emit_op_get_global_var):
26272         (JSC::JIT::emit_op_put_global_var):
26273         (JSC::JIT::emit_op_put_global_var_check):
26274         (JSC::JIT::emitSlow_op_put_global_var_check):
26275         * jit/JITStubs.cpp:
26276         (JSC::DEFINE_STUB_FUNCTION):
26277         (JSC):
26278         * jit/JITStubs.h:
26279         * llint/LLIntSlowPaths.cpp:
26280         (LLInt):
26281         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
26282         * llint/LLIntSlowPaths.h:
26283         (LLInt):
26284         * llint/LowLevelInterpreter.asm:
26285         * llint/LowLevelInterpreter32_64.asm:
26286         * llint/LowLevelInterpreter64.asm:
26287         * runtime/JSScope.cpp:
26288         (JSC::JSScope::resolve):
26289         (JSC::JSScope::resolveSkip):
26290         (JSC::JSScope::resolveGlobal):
26291         (JSC::JSScope::resolveGlobalDynamic):
26292         (JSC::JSScope::resolveBase):
26293         (JSC::JSScope::resolveWithBase):
26294         (JSC::JSScope::resolveWithThis):
26295         * runtime/JSScope.h:
26296         (JSScope):
26297         * runtime/JSVariableObject.cpp:
26298         * runtime/JSVariableObject.h:
26299         * runtime/Structure.h:
26300
26301 2012-10-16  Dongwoo Joshua Im  <dw.im@samsung.com>
26302
26303         [GTK] Fix build break - ResolveOperations.h is not in WebKit.
26304         https://bugs.webkit.org/show_bug.cgi?id=99538
26305
26306         Unreviewed build fix.
26307
26308         There are some files including ResolveOperations.h which is not exist at all.
26309
26310         * GNUmakefile.list.am: s/ResolveOperations.h/ResolveOperation.h/
26311         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: s/ResolveOperations.h/ResolveOperation.h/
26312
26313 2012-10-16  Jian Li  <jianli@chromium.org>
26314
26315         Rename feature define ENABLE_WIDGET_REGION to ENABLE_DRAGGBALE_REGION
26316         https://bugs.webkit.org/show_bug.cgi?id=98975
26317
26318         Reviewed by Adam Barth.
26319
26320         Renaming is needed to better match with the draggable region code.
26321
26322         * Configurations/FeatureDefines.xcconfig:
26323
26324 2012-10-15  Oliver Hunt  <oliver@apple.com>
26325
26326         Bytecode should not have responsibility for determining how to perform non-local resolves
26327         https://bugs.webkit.org/show_bug.cgi?id=99349
26328
26329         Reviewed by Gavin Barraclough.
26330
26331         This patch removes lexical analysis from the bytecode generation.  This allows
26332         us to delay lookup of a non-local variables until the lookup is actually necessary,
26333         and simplifies a lot of the resolve logic in BytecodeGenerator.
26334
26335         Once a lookup is performed we cache the lookup information in a set of out-of-line
26336         buffers in CodeBlock.  This allows subsequent lookups to avoid unnecessary hashing,
26337         etc, and allows the respective JITs to recreated optimal lookup code.
26338
26339         This is currently still a performance regression in LLInt, but most of the remaining
26340         regression is caused by a lot of indirection that I'll remove in future work, as well
26341         as some work necessary to allow LLInt to perform in line instruction repatching.
26342         We will also want to improve the behaviour of the baseline JIT for some of the lookup
26343         operations, however this patch was getting quite large already so I'm landing it now
26344         that we've reached the bar of "performance-neutral".
26345
26346         * GNUmakefile.list.am:
26347         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
26348         * JavaScriptCore.xcodeproj/project.pbxproj:
26349         * bytecode/CodeBlock.cpp:
26350         (JSC::CodeBlock::printStructures):
26351         (JSC::CodeBlock::dump):
26352         (JSC::CodeBlock::CodeBlock):
26353         (JSC::CodeBlock::visitStructures):
26354         (JSC):
26355         (JSC::CodeBlock::finalizeUnconditionally):
26356         (JSC::CodeBlock::shrinkToFit):
26357         * bytecode/CodeBlock.h:
26358         (JSC::CodeBlock::addResolve):
26359         (JSC::CodeBlock::addPutToBase):
26360         (CodeBlock):
26361         (JSC::CodeBlock::resolveOperations):
26362         (JSC::CodeBlock::putToBaseOperation):
26363         (JSC::CodeBlock::numberOfResolveOperations):
26364         (JSC::CodeBlock::numberOfPutToBaseOperations):
26365         (JSC::CodeBlock::addPropertyAccessInstruction):
26366         (JSC::CodeBlock::globalObjectConstant):
26367         (JSC::CodeBlock::setGlobalObjectConstant):
26368         * bytecode/GlobalResolveInfo.h: Removed.
26369         * bytecode/Opcode.h:
26370         (JSC):
26371         (JSC::padOpcodeName):
26372         * bytecode/ResolveGlobalStatus.cpp:
26373         (JSC::computeForStructure):
26374         (JSC::ResolveGlobalStatus::computeFor):
26375         * bytecode/ResolveGlobalStatus.h:
26376         (JSC):
26377         (ResolveGlobalStatus):
26378         * bytecode/ResolveOperation.h: Added.
26379           The new types and logic we use to perform the cached lookups.
26380         (JSC):
26381         (ResolveOperation):
26382         (JSC::ResolveOperation::getAndReturnScopedVar):
26383         (JSC::ResolveOperation::checkForDynamicEntriesBeforeGlobalScope):
26384         (JSC::ResolveOperation::getAndReturnGlobalVar):
26385         (JSC::ResolveOperation::getAndReturnGlobalProperty):
26386         (JSC::ResolveOperation::resolveFail):
26387         (JSC::ResolveOperation::skipTopScopeNode):
26388         (JSC::ResolveOperation::skipScopes):
26389         (JSC::ResolveOperation::returnGlobalObjectAsBase):
26390         (JSC::ResolveOperation::setBaseToGlobal):
26391         (JSC::ResolveOperation::setBaseToUndefined):
26392         (JSC::ResolveOperation::setBaseToScope):
26393         (JSC::ResolveOperation::returnScopeAsBase):
26394         (JSC::PutToBaseOperation::PutToBaseOperation):
26395         * bytecompiler/BytecodeGenerator.cpp:
26396         (JSC::ResolveResult::checkValidity):
26397         (JSC):
26398         (JSC::BytecodeGenerator::BytecodeGenerator):
26399         (JSC::BytecodeGenerator::resolve):
26400         (JSC::BytecodeGenerator::resolveConstDecl):
26401         (JSC::BytecodeGenerator::shouldAvoidResolveGlobal):
26402         (JSC::BytecodeGenerator::emitResolve):
26403         (JSC::BytecodeGenerator::emitResolveBase):
26404         (JSC::BytecodeGenerator::emitResolveBaseForPut):
26405         (JSC::BytecodeGenerator::emitResolveWithBaseForPut):
26406         (JSC::BytecodeGenerator::emitResolveWithThis):
26407         (JSC::BytecodeGenerator::emitGetLocalVar):
26408         (JSC::BytecodeGenerator::emitInitGlobalConst):
26409         (JSC::BytecodeGenerator::emitPutToBase):
26410         * bytecompiler/BytecodeGenerator.h:
26411         (JSC::ResolveResult::registerResolve):
26412         (JSC::ResolveResult::dynamicResolve):
26413         (ResolveResult):
26414         (JSC::ResolveResult::ResolveResult):
26415         (JSC):
26416         (NonlocalResolveInfo):
26417         (JSC::NonlocalResolveInfo::NonlocalResolveInfo):
26418         (JSC::NonlocalResolveInfo::~NonlocalResolveInfo):
26419         (JSC::NonlocalResolveInfo::resolved):
26420         (JSC::NonlocalResolveInfo::put):
26421         (BytecodeGenerator):
26422         (JSC::BytecodeGenerator::getResolveOperations):
26423         (JSC::BytecodeGenerator::getResolveWithThisOperations):
26424         (JSC::BytecodeGenerator::getResolveBaseOperations):
26425         (JSC::BytecodeGenerator::getResolveBaseForPutOperations):
26426         (JSC::BytecodeGenerator::getResolveWithBaseForPutOperations):
26427         (JSC::BytecodeGenerator::getPutToBaseOperation):
26428         * bytecompiler/NodesCodegen.cpp:
26429         (JSC::ResolveNode::isPure):
26430         (JSC::FunctionCallResolveNode::emitBytecode):
26431         (JSC::PostfixNode::emitResolve):
26432         (JSC::PrefixNode::emitResolve):
26433         (JSC::ReadModifyResolveNode::emitBytecode):
26434         (JSC::AssignResolveNode::emitBytecode):
26435         (JSC::ConstDeclNode::emitCodeSingle):
26436         (JSC::ForInNode::emitBytecode):
26437         * dfg/DFGAbstractState.cpp:
26438         (JSC::DFG::AbstractState::execute):
26439         * dfg/DFGByteCodeParser.cpp:
26440         (ByteCodeParser):
26441         (InlineStackEntry):
26442         (JSC::DFG::ByteCodeParser::handleGetByOffset):
26443         (DFG):
26444         (JSC::DFG::ByteCodeParser::parseResolveOperations):
26445         (JSC::DFG::ByteCodeParser::parseBlock):
26446         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
26447         * dfg/DFGCapabilities.h:
26448         (JSC::DFG::canCompileResolveOperations):
26449         (DFG):
26450         (JSC::DFG::canCompilePutToBaseOperation):
26451         (JSC::DFG::canCompileOpcode):
26452         (JSC::DFG::canInlineOpcode):
26453         * dfg/DFGGraph.h:
26454         (ResolveGlobalData):
26455         (ResolveOperationData):
26456         (DFG):
26457         (PutToBaseOperationData):
26458         (Graph):
26459         * dfg/DFGNode.h:
26460         (JSC::DFG::Node::hasIdentifier):
26461         (JSC::DFG::Node::resolveOperationsDataIndex):
26462         (Node):
26463         * dfg/DFGNodeType.h:
26464         (DFG):
26465         * dfg/DFGOSRExit.cpp:
26466         (JSC::DFG::OSRExit::OSRExit):
26467         * dfg/DFGOSRExit.h:
26468         (OSRExit):
26469         * dfg/DFGOSRExitCompiler.cpp:
26470         * dfg/DFGOSRExitCompiler32_64.cpp:
26471         (JSC::DFG::OSRExitCompiler::compileExit):
26472         * dfg/DFGOSRExitCompiler64.cpp:
26473         (JSC::DFG::OSRExitCompiler::compileExit):
26474         * dfg/DFGOperations.cpp:
26475         * dfg/DFGOperations.h:
26476         * dfg/DFGPredictionPropagationPhase.cpp:
26477         (JSC::DFG::PredictionPropagationPhase::propagate):
26478         * dfg/DFGRepatch.cpp:
26479         (JSC::DFG::tryCacheGetByID):
26480         * dfg/DFGSpeculativeJIT.cpp:
26481         (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward):
26482         * dfg/DFGSpeculativeJIT.h:
26483         (JSC::DFG::SpeculativeJIT::resolveOperations):
26484         (SpeculativeJIT):
26485         (JSC::DFG::SpeculativeJIT::putToBaseOperation):
26486         (JSC::DFG::SpeculativeJIT::callOperation):
26487         * dfg/DFGSpeculativeJIT32_64.cpp:
26488         (JSC::DFG::SpeculativeJIT::compile):
26489         * dfg/DFGSpeculativeJIT64.cpp:
26490         (JSC::DFG::SpeculativeJIT::compile):
26491         * dfg/DFGStructureCheckHoistingPhase.cpp:
26492         (JSC::DFG::StructureCheckHoistingPhase::run):
26493         * jit/JIT.cpp:
26494         (JSC::JIT::privateCompileMainPass):
26495         (JSC::JIT::privateCompileSlowCases):
26496         * jit/JIT.h:
26497         (JIT):
26498         * jit/JITOpcodes.cpp:
26499         (JSC::JIT::emit_op_put_to_base):
26500         (JSC):
26501         (JSC::JIT::emit_resolve_operations):
26502         (JSC::JIT::emitSlow_link_resolve_operations):
26503         (JSC::JIT::emit_op_resolve):
26504         (JSC::JIT::emitSlow_op_resolve):
26505         (JSC::JIT::emit_op_resolve_base):
26506         (JSC::JIT::emitSlow_op_resolve_base):
26507         (JSC::JIT::emit_op_resolve_with_base):
26508         (JSC::JIT::emitSlow_op_resolve_with_base):
26509         (JSC::JIT::emit_op_resolve_with_this):
26510         (JSC::JIT::emitSlow_op_resolve_with_this):
26511         (JSC::JIT::emitSlow_op_put_to_base):
26512         * jit/JITOpcodes32_64.cpp:
26513         (JSC::JIT::emit_op_put_to_base):
26514         (JSC):
26515         * jit/JITPropertyAccess.cpp:
26516         (JSC::JIT::emit_op_init_global_const):
26517         (JSC::JIT::emit_op_init_global_const_check):
26518         (JSC::JIT::emitSlow_op_init_global_const_check):
26519         * jit/JITPropertyAccess32_64.cpp:
26520         (JSC::JIT::emit_op_init_global_const):
26521         (JSC::JIT::emit_op_init_global_const_check):
26522         (JSC::JIT::emitSlow_op_init_global_const_check):
26523         * jit/JITStubs.cpp:
26524         (JSC::DEFINE_STUB_FUNCTION):
26525         (JSC):
26526         * jit/JITStubs.h:
26527         * llint/LLIntSlowPaths.cpp:
26528         (LLInt):
26529         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
26530         * llint/LLIntSlowPaths.h:
26531         (LLInt):
26532         * llint/LowLevelInterpreter.asm:
26533         * llint/LowLevelInterpreter32_64.asm:
26534         * llint/LowLevelInterpreter64.asm:
26535         * runtime/JSScope.cpp:
26536         (JSC::LookupResult::base):
26537         (JSC::LookupResult::value):
26538         (JSC::LookupResult::setBase):
26539         (JSC::LookupResult::setValue):
26540         (LookupResult):
26541         (JSC):
26542         (JSC::setPutPropertyAccessOffset):
26543         (JSC::executeResolveOperations):
26544         (JSC::JSScope::resolveContainingScopeInternal):
26545         (JSC::JSScope::resolveContainingScope):
26546         (JSC::JSScope::resolve):
26547         (JSC::JSScope::resolveBase):
26548         (JSC::JSScope::resolveWithBase):
26549         (JSC::JSScope::resolveWithThis):
26550         (JSC::JSScope::resolvePut):
26551         (JSC::JSScope::resolveGlobal):
26552         * runtime/JSScope.h:
26553         (JSScope):
26554         * runtime/JSVariableObject.cpp:
26555         (JSC):
26556         * runtime/JSVariableObject.h:
26557         (JSVariableObject):
26558         * runtime/Structure.h:
26559         (JSC::Structure::propertyAccessesAreCacheable):
26560         (Structure):
26561
26562 2012-10-16  Filip Pizlo  <fpizlo@apple.com>
26563
26564         Accidental switch fall-through in DFG::FixupPhase
26565         https://bugs.webkit.org/show_bug.cgi?id=96956
26566         <rdar://problem/12313242>
26567
26568         Reviewed by Mark Hahnenberg.
26569
26570         * dfg/DFGFixupPhase.cpp:
26571         (JSC::DFG::FixupPhase::fixupNode):
26572
26573 2012-10-16  Filip Pizlo  <fpizlo@apple.com>
26574
26575         GetScopedVar CSE matches dead GetScopedVar's leading to IR corruption
26576         https://bugs.webkit.org/show_bug.cgi?id=99470
26577         <rdar://problem/12363698>
26578
26579         Reviewed by Mark Hahnenberg.
26580
26581         All it takes is to follow the "if (!shouldGenerate) continue" idiom and everything will be OK.
26582
26583         * dfg/DFGCSEPhase.cpp:
26584         (JSC::DFG::CSEPhase::globalVarLoadElimination):
26585         (JSC::DFG::CSEPhase::scopedVarLoadElimination):
26586         (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
26587         (JSC::DFG::CSEPhase::getByValLoadElimination):
26588         (JSC::DFG::CSEPhase::checkStructureElimination):
26589         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
26590         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
26591
26592 2012-10-16  Dima Gorbik  <dgorbik@apple.com>
26593
26594         Remove Platform.h include from the header files.
26595         https://bugs.webkit.org/show_bug.cgi?id=98665
26596
26597         Reviewed by Eric Seidel.
26598
26599         We don't want other clients that include WebKit headers to know about Platform.h.
26600
26601         * API/tests/minidom.c:
26602         * API/tests/testapi.c:
26603
26604 2012-10-16  Balazs Kilvady  <kilvadyb@homejinni.com>
26605
26606         Add missing MIPS functions to assembler.
26607         https://bugs.webkit.org/show_bug.cgi?id=98856
26608
26609         Reviewed by Oliver Hunt.
26610
26611         Implement missing functions in MacroAssemblerMIPS and MIPSAssembler.
26612
26613         * assembler/MIPSAssembler.h:
26614         (JSC::MIPSAssembler::lb):
26615         (MIPSAssembler):
26616         (JSC::MIPSAssembler::lh):
26617         (JSC::MIPSAssembler::cvtds):
26618         (JSC::MIPSAssembler::cvtsd):
26619         (JSC::MIPSAssembler::vmov):
26620         * assembler/MacroAssemblerMIPS.h:
26621         (MacroAssemblerMIPS):
26622         (JSC::MacroAssemblerMIPS::load8Signed):
26623         (JSC::MacroAssemblerMIPS::load16Signed):
26624         (JSC::MacroAssemblerMIPS::moveDoubleToInts):
26625         (JSC::MacroAssemblerMIPS::moveIntsToDouble):
26626         (JSC::MacroAssemblerMIPS::loadFloat):
26627         (JSC::MacroAssemblerMIPS::loadDouble):
26628         (JSC::MacroAssemblerMIPS::storeFloat):
26629         (JSC::MacroAssemblerMIPS::storeDouble):
26630         (JSC::MacroAssemblerMIPS::addDouble):
26631         (JSC::MacroAssemblerMIPS::convertFloatToDouble):
26632         (JSC::MacroAssemblerMIPS::convertDoubleToFloat):
26633
26634 2012-10-16  Balazs Kilvady  <kilvadyb@homejinni.com>
26635
26636         MIPS assembler coding-style fix.
26637         https://bugs.webkit.org/show_bug.cgi?id=99359
26638
26639         Reviewed by Oliver Hunt.
26640
26641         Coding style fix of existing MIPS assembler header files.
26642
26643         * assembler/MIPSAssembler.h:
26644         (JSC::MIPSAssembler::addiu):
26645         (JSC::MIPSAssembler::addu):
26646         (JSC::MIPSAssembler::subu):
26647         (JSC::MIPSAssembler::mul):
26648         (JSC::MIPSAssembler::andInsn):
26649         (JSC::MIPSAssembler::andi):
26650         (JSC::MIPSAssembler::nor):
26651         (JSC::MIPSAssembler::orInsn):
26652         (JSC::MIPSAssembler::ori):
26653         (JSC::MIPSAssembler::xorInsn):
26654         (JSC::MIPSAssembler::xori):
26655         (JSC::MIPSAssembler::slt):
26656         (JSC::MIPSAssembler::sltu):
26657         (JSC::MIPSAssembler::sltiu):
26658         (JSC::MIPSAssembler::sll):
26659         (JSC::MIPSAssembler::sllv):
26660         (JSC::MIPSAssembler::sra):
26661         (JSC::MIPSAssembler::srav):
26662         (JSC::MIPSAssembler::srl):
26663         (JSC::MIPSAssembler::srlv):
26664         (JSC::MIPSAssembler::lbu):
26665         (JSC::MIPSAssembler::lw):
26666         (JSC::MIPSAssembler::lwl):
26667         (JSC::MIPSAssembler::lwr):
26668         (JSC::MIPSAssembler::lhu):
26669         (JSC::MIPSAssembler::sb):
26670         (JSC::MIPSAssembler::sh):
26671         (JSC::MIPSAssembler::sw):
26672         (JSC::MIPSAssembler::addd):
26673         (JSC::MIPSAssembler::subd):
26674         (JSC::MIPSAssembler::muld):
26675         (JSC::MIPSAssembler::divd):
26676         (JSC::MIPSAssembler::lwc1):
26677         (JSC::MIPSAssembler::ldc1):
26678         (JSC::MIPSAssembler::swc1):
26679         (JSC::MIPSAssembler::sdc1):
26680         (MIPSAssembler):
26681         (JSC::MIPSAssembler::relocateJumps):
26682         (JSC::MIPSAssembler::linkWithOffset):
26683         * assembler/MacroAssemblerMIPS.h:
26684         (JSC::MacroAssemblerMIPS::add32):
26685         (JSC::MacroAssemblerMIPS::and32):
26686         (JSC::MacroAssemblerMIPS::sub32):
26687         (MacroAssemblerMIPS):
26688         (JSC::MacroAssemblerMIPS::load8):
26689         (JSC::MacroAssemblerMIPS::load32):
26690         (JSC::MacroAssemblerMIPS::load32WithUnalignedHalfWords):
26691         (JSC::MacroAssemblerMIPS::load16):
26692         (JSC::MacroAssemblerMIPS::store8):
26693         (JSC::MacroAssemblerMIPS::store16):
26694         (JSC::MacroAssemblerMIPS::store32):
26695         (JSC::MacroAssemblerMIPS::nearCall):
26696         (JSC::MacroAssemblerMIPS::test8):
26697         (JSC::MacroAssemblerMIPS::test32):
26698
26699 2012-10-16  Yuqiang Xian  <yuqiang.xian@intel.com>
26700
26701         Refactor MacroAssembler interfaces to differentiate the pointer operands from the 64-bit integer operands
26702         https://bugs.webkit.org/show_bug.cgi?id=99154
26703
26704         Reviewed by Gavin Barraclough.
26705
26706         In current JavaScriptCore implementation for JSVALUE64 platform (i.e.,
26707         the X64 platform), we assume that the JSValue size is same to the
26708         pointer size, and thus EncodedJSValue is simply type defined as a
26709         "void*". In the JIT compiler, we also take this assumption and invoke
26710         the same macro assembler interfaces for both JSValue and pointer
26711         operands. We need to differentiate the operations on pointers from the
26712         operations on JSValues, and let them invoking different macro
26713         assembler interfaces. For example, we now use the interface of
26714         "loadPtr" to load either a pointer or a JSValue, and we need to switch
26715         to using "loadPtr" to load a pointer and some new "load64" interface
26716         to load a JSValue. This would help us supporting other JSVALUE64
26717         platforms where pointer size is not necessarily 64-bits, for example
26718         x32 (bug #99153).
26719
26720         The major modification I made is to introduce the "*64" interfaces in
26721         the MacroAssembler for those operations on JSValues, keep the "*Ptr"
26722         interfaces for those operations on real pointers, and go through all
26723         the JIT compiler code to correct the usage.
26724
26725         This is the first part of the work, i.e, to add the *64 interfaces to
26726         the MacroAssembler.
26727
26728         * assembler/AbstractMacroAssembler.h: Add the Imm64 interfaces.
26729         (AbstractMacroAssembler):
26730         (JSC::AbstractMacroAssembler::TrustedImm64::TrustedImm64):
26731         (TrustedImm64):
26732         (JSC::AbstractMacroAssembler::Imm64::Imm64):
26733         (Imm64):
26734         (JSC::AbstractMacroAssembler::Imm64::asTrustedImm64):
26735         * assembler/MacroAssembler.h: map <foo>Ptr methods to <foo>64 for X86_64.
26736         (MacroAssembler):
26737         (JSC::MacroAssembler::peek64):
26738         (JSC::MacroAssembler::poke):
26739         (JSC::MacroAssembler::poke64):
26740         (JSC::MacroAssembler::addPtr):
26741         (JSC::MacroAssembler::andPtr):
26742         (JSC::MacroAssembler::negPtr):
26743         (JSC::MacroAssembler::orPtr):
26744         (JSC::MacroAssembler::rotateRightPtr):
26745         (JSC::MacroAssembler::subPtr):
26746         (JSC::MacroAssembler::xorPtr):
26747         (JSC::MacroAssembler::loadPtr):
26748         (JSC::MacroAssembler::loadPtrWithAddressOffsetPatch):
26749         (JSC::MacroAssembler::loadPtrWithCompactAddressOffsetPatch):
26750         (JSC::MacroAssembler::storePtr):
26751         (JSC::MacroAssembler::storePtrWithAddressOffsetPatch):
26752         (JSC::MacroAssembler::movePtrToDouble):
26753         (JSC::MacroAssembler::moveDoubleToPtr):
26754         (JSC::MacroAssembler::comparePtr):
26755         (JSC::MacroAssembler::testPtr):
26756         (JSC::MacroAssembler::branchPtr):
26757         (JSC::MacroAssembler::branchTestPtr):
26758         (JSC::MacroAssembler::branchAddPtr):
26759         (JSC::MacroAssembler::branchSubPtr):
26760         (JSC::MacroAssembler::shouldBlindDouble):
26761         (JSC::MacroAssembler::shouldBlind):
26762         (JSC::MacroAssembler::RotatedImm64::RotatedImm64):
26763         (RotatedImm64):
26764         (JSC::MacroAssembler::rotationBlindConstant):
26765         (JSC::MacroAssembler::loadRotationBlindedConstant):
26766         (JSC::MacroAssembler::move):
26767         (JSC::MacroAssembler::and64):
26768         (JSC::MacroAssembler::store64):
26769         * assembler/MacroAssemblerX86Common.h:
26770         (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch):
26771         (MacroAssemblerX86Common):
26772         (JSC::MacroAssemblerX86Common::move):
26773         * assembler/MacroAssemblerX86_64.h: Add the <foo>64 methods for X86_64.
26774         (JSC::MacroAssemblerX86_64::branchAdd32):
26775         (JSC::MacroAssemblerX86_64::add64):
26776         (MacroAssemblerX86_64):
26777         (JSC::MacroAssemblerX86_64::and64):
26778         (JSC::MacroAssemblerX86_64::neg64):
26779         (JSC::MacroAssemblerX86_64::or64):
26780         (JSC::MacroAssemblerX86_64::rotateRight64):
26781         (JSC::MacroAssemblerX86_64::sub64):
26782         (JSC::MacroAssemblerX86_64::xor64):
26783         (JSC::MacroAssemblerX86_64::load64):
26784         (JSC::MacroAssemblerX86_64::load64WithAddressOffsetPatch):
26785         (JSC::MacroAssemblerX86_64::load64WithCompactAddressOffsetPatch):
26786         (JSC::MacroAssemblerX86_64::store64):
26787         (JSC::MacroAssemblerX86_64::store64WithAddressOffsetPatch):
26788         (JSC::MacroAssemblerX86_64::move64ToDouble):
26789         (JSC::MacroAssemblerX86_64::moveDoubleTo64):
26790         (JSC::MacroAssemblerX86_64::compare64):
26791         (JSC::MacroAssemblerX86_64::branch64):
26792         (JSC::MacroAssemblerX86_64::branchTest64):
26793         (JSC::MacroAssemblerX86_64::test64):
26794         (JSC::MacroAssemblerX86_64::branchAdd64):
26795         (JSC::MacroAssemblerX86_64::branchSub64):
26796         (JSC::MacroAssemblerX86_64::branchPtrWithPatch):
26797         (JSC::MacroAssemblerX86_64::storePtrWithPatch):
26798
26799 2012-10-15  Mark Hahnenberg  <mhahnenberg@apple.com>
26800
26801         Make CopiedSpace and MarkedSpace regions independent
26802         https://bugs.webkit.org/show_bug.cgi?id=99222
26803
26804         Reviewed by Filip Pizlo.
26805
26806         Right now CopiedSpace and MarkedSpace have the same block size and share the same regions,
26807         but there's no reason that they can't have different block sizes while still sharing the
26808         same underlying regions. We should factor the two "used" lists of regions apart so that
26809         MarkedBlocks and CopiedBlocks can be different sizes. Regions will still be a uniform size
26810         so that when they become empty they may be shared between the CopiedSpace and the MarkedSpace,
26811         since benchmarks indicate that sharing is a boon for performance.
26812
26813         * heap/BlockAllocator.cpp:
26814         (JSC::BlockAllocator::BlockAllocator):
26815         * heap/BlockAllocator.h:
26816         (JSC):
26817         (Region):
26818         (JSC::Region::create): We now have a fixed size for Regions so that empty regions can continue to
26819         be shared between the MarkedSpace and CopiedSpace. Once they are used for a specific type of block,
26820         however, they can only be used for that type of block until they become empty again.
26821         (JSC::Region::createCustomSize):
26822         (JSC::Region::Region):
26823         (JSC::Region::~Region):
26824         (JSC::Region::reset):
26825         (BlockAllocator):
26826         (JSC::BlockAllocator::RegionSet::RegionSet):
26827         (RegionSet):
26828         (JSC::BlockAllocator::tryAllocateFromRegion): We change this function so that it correctly
26829         moves blocks between empty, partial, and full lists.
26830         (JSC::BlockAllocator::allocate):
26831         (JSC::BlockAllocator::allocateCustomSize):
26832         (JSC::BlockAllocator::deallocate): Ditto.
26833         (JSC::CopiedBlock):
26834         (JSC::MarkedBlock):
26835         (JSC::BlockAllocator::regionSetFor): We use this so that we can use the same allocate/deallocate
26836         functions with different RegionSets. We specialize the function for each type of block that we
26837         want to allocate.
26838         * heap/CopiedBlock.h:
26839         (CopiedBlock):
26840         * heap/CopiedSpace.h:
26841         (CopiedSpace):
26842         * heap/HeapBlock.h:
26843         (HeapBlock):
26844         * heap/MarkedBlock.cpp:
26845         (JSC::MarkedBlock::MarkedBlock): For oversize MarkedBlocks, if the block size gets too big we can
26846         underflow the endAtom, which will cause us to segfault when we try to sweep a block. If we're a
26847         custom size MarkedBlock we need to calculate endAtom so it doesn't underflow.
26848
26849 2012-10-14  Filip Pizlo  <fpizlo@apple.com>
26850
26851         JIT::JIT fails to initialize all of its fields
26852         https://bugs.webkit.org/show_bug.cgi?id=99283
26853
26854         Reviewed by Andreas Kling.
26855
26856         There were two groups of such fields, all of which are eventually initialized
26857         prior to use inside of privateCompile(). But it's safer to make sure that they
26858         are initialized in the constructor as well, since we may use the JIT to do a
26859         stub compile without calling into privateCompile().
26860
26861         Unsigned index fields for dynamic repatching meta-data: this change
26862         initializes them to UINT_MAX, so we should crash if we try to use those
26863         indices without initializing them.
26864
26865         Boolean flags for value profiling: this change initializes them to false, so
26866         we at worst turn off value profiling.
26867
26868         * jit/JIT.cpp:
26869         (JSC::JIT::JIT):
26870
26871 2012-10-15  Mark Hahnenberg  <mhahnenberg@apple.com>
26872
26873         We should avoid weakCompareAndSwap when parallel GC is disabled
26874         https://bugs.webkit.org/show_bug.cgi?id=99331
26875
26876         Reviewed by Filip Pizlo.
26877
26878         CopiedBlock::reportLiveBytes and didEvacuateBytes uses weakCompareAndSwap, which some platforms
26879         don't support. For platforms that don't have parallel GC enabled, we should just use a normal store.
26880
26881         * heap/CopiedBlock.h:
26882         (JSC::CopiedBlock::reportLiveBytes):
26883         (JSC::CopiedBlock::didEvacuateBytes):
26884
26885 2012-10-15  Carlos Garcia Campos  <cgarcia@igalia.com>
26886
26887         Unreviewed. Fix make distcheck.
26888
26889         * GNUmakefile.list.am: Add missing header file.
26890
26891 2012-10-14  Filip Pizlo  <fpizlo@apple.com>
26892
26893         DFG should handle polymorphic array modes by eagerly transforming arrays into the most general applicable form
26894         https://bugs.webkit.org/show_bug.cgi?id=99269
26895
26896         Reviewed by Geoffrey Garen.
26897
26898         This kills off a bunch of code for "polymorphic" array modes in the DFG. It should
26899         also be a performance win for code that uses a lot of array storage arrays.
26900
26901         * dfg/DFGAbstractState.cpp:
26902         (JSC::DFG::AbstractState::execute):
26903         * dfg/DFGArrayMode.cpp:
26904         (JSC::DFG::fromObserved):
26905         (JSC::DFG::modeAlreadyChecked):
26906         (JSC::DFG::modeToString):
26907         * dfg/DFGArrayMode.h:
26908         (DFG):
26909         (JSC::DFG::modeUsesButterfly):
26910         (JSC::DFG::modeIsJSArray):
26911         (JSC::DFG::mayStoreToTail):
26912         (JSC::DFG::mayStoreToHole):
26913         (JSC::DFG::canCSEStorage):
26914         (JSC::DFG::modeSupportsLength):
26915         (JSC::DFG::benefitsFromStructureCheck):
26916         * dfg/DFGFixupPhase.cpp:
26917         (JSC::DFG::FixupPhase::checkArray):
26918         (JSC::DFG::FixupPhase::blessArrayOperation):
26919         * dfg/DFGGraph.h:
26920         (JSC::DFG::Graph::byValIsPure):
26921         * dfg/DFGSpeculativeJIT.cpp:
26922         (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
26923         (JSC::DFG::SpeculativeJIT::checkArray):
26924         (JSC::DFG::SpeculativeJIT::arrayify):
26925         (DFG):
26926         (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
26927         * dfg/DFGSpeculativeJIT.h:
26928         (JSC::DFG::SpeculativeJIT::putByValWillNeedExtraRegister):
26929         (SpeculativeJIT):
26930         * dfg/DFGSpeculativeJIT32_64.cpp:
26931         (JSC::DFG::SpeculativeJIT::compile):
26932         * dfg/DFGSpeculativeJIT64.cpp:
26933         (JSC::DFG::SpeculativeJIT::compile):
26934
26935 2012-10-14  Filip Pizlo  <fpizlo@apple.com>
26936
26937         REGRESSION(126886): Fat binary builds don't know how to handle architecture variants to which the LLInt is agnostic
26938         https://bugs.webkit.org/show_bug.cgi?id=99270
26939
26940         Reviewed by Geoffrey Garen.
26941
26942         The fix is to hash cons the offsets based on configuration index, not the offsets
26943         themselves.
26944
26945         * offlineasm/offsets.rb:
26946
26947 2012-10-13  Filip Pizlo  <fpizlo@apple.com>
26948
26949         IndexingType should not have a bit for each type
26950         https://bugs.webkit.org/show_bug.cgi?id=98997
26951
26952         Reviewed by Oliver Hunt.
26953
26954         Somewhat incidentally, the introduction of butterflies led to each indexing
26955         type being represented by a unique bit. This is superficially nice since it
26956         allows you to test if a structure corresponds to a particular indexing type
26957         by saying !!(structure->indexingType() & TheType). But the downside is that
26958         given the 8 bits we have for the m_indexingType field, that leaves only a
26959         small number of possible indexing types if we have one per bit.
26960
26961         This changeset changes the indexing type to be:
26962
26963         Bit #1: Tells you if you're an array.
26964
26965         Bits #2 - #5: 16 possible indexing types, including the blank type for
26966             objects that don't have indexed properties.
26967
26968         Bits #6-8: Auxiliary bits that we could use for other things. Currently we
26969             just use one of those bits, for MayHaveIndexedAccessors.
26970
26971         This is performance-neutral, and is primarily intended to give us more
26972         breathing room for introducing new inferred array modes.
26973
26974         * assembler/AbstractMacroAssembler.h:
26975         (JSC::AbstractMacroAssembler::JumpList::jumps):
26976         * assembler/MacroAssembler.h:
26977         (MacroAssembler):
26978         (JSC::MacroAssembler::patchableBranch32):
26979         * assembler/MacroAssemblerARMv7.h:
26980         (JSC::MacroAssemblerARMv7::patchableBranch32):
26981         (MacroAssemblerARMv7):
26982         * dfg/DFGArrayMode.cpp:
26983         (JSC::DFG::modeAlreadyChecked):
26984         * dfg/DFGRepatch.cpp:
26985         (JSC::DFG::tryCacheGetByID):
26986         * dfg/DFGSpeculativeJIT.cpp:
26987         (JSC::DFG::SpeculativeJIT::speculationCheck):
26988         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
26989         (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
26990         (DFG):
26991         (JSC::DFG::SpeculativeJIT::checkArray):
26992         (JSC::DFG::SpeculativeJIT::arrayify):
26993         * dfg/DFGSpeculativeJIT.h:
26994         (SpeculativeJIT):
26995         * dfg/DFGSpeculativeJIT32_64.cpp:
26996         (JSC::DFG::SpeculativeJIT::compile):
26997         * dfg/DFGSpeculativeJIT64.cpp:
26998         (JSC::DFG::SpeculativeJIT::compile):
26999         * jit/JITInlineMethods.h:
27000         (JSC::JIT::emitAllocateJSArray):
27001         (JSC::JIT::chooseArrayMode):
27002         * jit/JITPropertyAccess.cpp:
27003         (JSC::JIT::emit_op_get_by_val):
27004         (JSC::JIT::emitContiguousGetByVal):
27005         (JSC::JIT::emitArrayStorageGetByVal):
27006         (JSC::JIT::emit_op_put_by_val):
27007         (JSC::JIT::emitContiguousPutByVal):
27008         (JSC::JIT::emitArrayStoragePutByVal):
27009         (JSC::JIT::privateCompilePatchGetArrayLength):
27010         * jit/JITPropertyAccess32_64.cpp:
27011         (JSC::JIT::emit_op_get_by_val):
27012         (JSC::JIT::emitContiguousGetByVal):
27013         (JSC::JIT::emitArrayStorageGetByVal):
27014         (JSC::JIT::emit_op_put_by_val):
27015         (JSC::JIT::emitContiguousPutByVal):
27016         (JSC::JIT::emitArrayStoragePutByVal):
27017         (JSC::JIT::privateCompilePatchGetArrayLength):
27018         * llint/LowLevelInterpreter.asm:
27019         * llint/LowLevelInterpreter32_64.asm:
27020         * llint/LowLevelInterpreter64.asm:
27021         * runtime/IndexingType.h:
27022         (JSC):
27023         (JSC::hasIndexedProperties):
27024         (JSC::hasContiguous):
27025         (JSC::hasFastArrayStorage):
27026         (JSC::hasArrayStorage):
27027         (JSC::shouldUseSlowPut):
27028         * runtime/JSGlobalObject.cpp:
27029         (JSC):
27030         * runtime/StructureTransitionTable.h:
27031         (JSC::newIndexingType):
27032
27033 2012-10-14  Filip Pizlo  <fpizlo@apple.com>
27034
27035         DFG structure check hoisting should attempt to ignore side effects and make transformations that are sound even in their presence
27036         https://bugs.webkit.org/show_bug.cgi?id=99262
27037
27038         Reviewed by Oliver Hunt.
27039
27040         This hugely simplifies the structure check hoisting phase. It will no longer be necessary
27041         to modify it when the effectfulness of operations changes. This also enables the hoister
27042         to hoist effectful things in the future.
27043
27044         The downside is that the hoister may end up adding strictly more checks than were present
27045         in the original code, if the code truly has a lot of side-effects. I don't see evidence
27046         of this happening. This patch does have some speed-ups and some slow-downs, but is
27047         neutral in the average, and the slow-downs do not appear to have more structure checks
27048         than ToT.
27049
27050         * dfg/DFGStructureCheckHoistingPhase.cpp:
27051         (JSC::DFG::StructureCheckHoistingPhase::run):
27052         (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
27053         (StructureCheckHoistingPhase):
27054         (CheckData):
27055         (JSC::DFG::StructureCheckHoistingPhase::CheckData::CheckData):
27056
27057 2012-10-14  Filip Pizlo  <fpizlo@apple.com>
27058
27059         Fix the build of universal binary with ARMv7s of JavaScriptCore
27060
27061         * llint/LLIntOfflineAsmConfig.h:
27062         * llint/LowLevelInterpreter.asm:
27063
27064 2012-10-13  Filip Pizlo  <fpizlo@apple.com>
27065
27066         Array length array profiling is broken in the baseline JIT
27067         https://bugs.webkit.org/show_bug.cgi?id=99258
27068
27069         Reviewed by Oliver Hunt.
27070
27071         The code generator for array length stubs calls into
27072         emitArrayProfilingSiteForBytecodeIndex(), which emits profiling only if
27073         canBeOptimized() returns true. But m_canBeOptimized is only initialized during
27074         full method compiles, so in a stub compile it may (or may not) be false, meaning
27075         that we may, or may not, get meaningful profiling info.
27076
27077         This appeared to not affect too many programs since the LLInt has good array
27078         length array profiling.
27079
27080         * jit/JIT.h:
27081         (JSC::JIT::compilePatchGetArrayLength):
27082
27083 2012-10-14  Patrick Gansterer  <paroga@webkit.org>
27084
27085         Build fix for WinCE after r131089.
27086
27087         WinCE does not support getenv().
27088
27089         * runtime/Options.cpp:
27090         (JSC::overrideOptionWithHeuristic):
27091
27092 2012-10-12  Kangil Han  <kangil.han@samsung.com>
27093
27094         Fix build error on DFGSpeculativeJIT32_64.cpp
27095         https://bugs.webkit.org/show_bug.cgi?id=99234
27096
27097         Reviewed by Anders Carlsson.
27098
27099         Seems BUG 98608 causes build error on 32bit machine so fix it.
27100
27101         * dfg/DFGSpeculativeJIT32_64.cpp:
27102         (JSC::DFG::SpeculativeJIT::compile):
27103
27104 2012-10-12  Filip Pizlo  <fpizlo@apple.com>
27105
27106         Contiguous array allocation should always be inlined
27107         https://bugs.webkit.org/show_bug.cgi?id=98608
27108
27109         Reviewed by Oliver Hunt and Mark Hahnenberg.
27110
27111         This inlines contiguous array allocation in the most obvious way possible.
27112
27113         * JavaScriptCore.xcodeproj/project.pbxproj:
27114         * assembler/MacroAssembler.h:
27115         (JSC::MacroAssembler::branchSubPtr):
27116         (MacroAssembler):
27117         * assembler/MacroAssemblerX86_64.h:
27118         (JSC::MacroAssemblerX86_64::branchSubPtr):
27119         (MacroAssemblerX86_64):
27120         * dfg/DFGAbstractState.cpp:
27121         (JSC::DFG::AbstractState::execute):
27122         * dfg/DFGCCallHelpers.h:
27123         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
27124         (CCallHelpers):
27125         * dfg/DFGCallArrayAllocatorSlowPathGenerator.h: Added.
27126         (DFG):
27127         (CallArrayAllocatorSlowPathGenerator):
27128         (JSC::DFG::CallArrayAllocatorSlowPathGenerator::CallArrayAllocatorSlowPathGenerator):
27129         (JSC::DFG::CallArrayAllocatorSlowPathGenerator::generateInternal):
27130         (CallArrayAllocatorWithVariableSizeSlowPathGenerator):
27131         (JSC::DFG::CallArrayAllocatorWithVariableSizeSlowPathGenerator::CallArrayAllocatorWithVariableSizeSlowPathGenerator):
27132         (JSC::DFG::CallArrayAllocatorWithVariableSizeSlowPathGenerator::generateInternal):
27133         * dfg/DFGSpeculativeJIT.cpp:
27134         (JSC::DFG::SpeculativeJIT::emitAllocateJSArray):
27135         (DFG):
27136         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
27137         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
27138         * dfg/DFGSpeculativeJIT.h:
27139         (JSC::DFG::SpeculativeJIT::callOperation):
27140         (SpeculativeJIT):
27141         (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage):
27142         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
27143         (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject):
27144         * dfg/DFGSpeculativeJIT32_64.cpp:
27145         (JSC::DFG::SpeculativeJIT::compile):
27146         * dfg/DFGSpeculativeJIT64.cpp:
27147         (JSC::DFG::SpeculativeJIT::compile):
27148
27149 2012-10-12  Mark Hahnenberg  <mhahnenberg@apple.com>
27150
27151         Race condition during CopyingPhase can lead to deadlock
27152         https://bugs.webkit.org/show_bug.cgi?id=99226
27153
27154         Reviewed by Filip Pizlo.
27155
27156         The main thread calls startCopying() for each of the GCThreads at the beginning of the copy phase.
27157         It then proceeds to start copying. If copying completes before one of the GCThreads wakes up, the
27158         main thread will set m_currentPhase back to NoPhase, the GCThread will wake up, see that there's
27159         nothing to do, and then it will go back to sleep without ever calling CopyVisitor::doneCopying()
27160         to return its borrowed block to the CopiedSpace. CopiedSpace::doneCopying() will then sleep forever
27161         waiting on the block.
27162
27163         The fix for this is to make sure we call CopiedSpace::doneCopying() on the main thread before we
27164         call GCThreadSharedData::didFinishCopying(), which sets the m_currentPhase flag to NoPhase. This
27165         way we will wait until all threads have woken up and given back their borrowed blocks before
27166         clearing the flag.
27167
27168         * heap/Heap.cpp:
27169         (JSC::Heap::copyBackingStores):
27170
27171 2012-10-12  Anders Carlsson  <andersca@apple.com>
27172
27173         Move macros from Parser.h to Parser.cpp
27174         https://bugs.webkit.org/show_bug.cgi?id=99217
27175
27176         Reviewed by Andreas Kling.
27177
27178         There are a bunch of macros in Parser.h that are only used in Parser.cpp. Move them to Parser.cpp
27179         so they won't pollute the global namespace.
27180         * parser/Parser.cpp:
27181         * parser/Parser.h:
27182         (JSC):
27183
27184 2012-10-12  Mark Hahnenberg  <mhahnenberg@apple.com>
27185
27186         Another build fix after r131213
27187
27188         Added some symbol magic to placate the linker on some platforms.
27189
27190         * JavaScriptCore.order:
27191
27192 2012-10-12  Mark Hahnenberg  <mhahnenberg@apple.com>
27193
27194         Build fix after r131213
27195
27196         Removed an unused variable that was making compilers unhappy.
27197
27198         * heap/GCThread.cpp:
27199         (JSC::GCThread::GCThread):
27200         * heap/GCThread.h:
27201         (GCThread):
27202         * heap/GCThreadSharedData.cpp:
27203         (JSC::GCThreadSharedData::GCThreadSharedData):
27204
27205 2012-10-09  Mark Hahnenberg  <mhahnenberg@apple.com>
27206
27207         Copying collection shouldn't require O(live bytes) memory overhead
27208         https://bugs.webkit.org/show_bug.cgi?id=98792
27209
27210         Reviewed by Filip Pizlo.
27211
27212         Currently our copying collection occurs simultaneously with the marking phase. We'd like
27213         to be able to reuse CopiedBlocks as soon as they become fully evacuated, but this is not
27214         currently possible because we don't know the liveness statistics of each old CopiedBlock
27215         until marking/copying has already finished. Instead, we have to allocate additional memory
27216         from the OS to use as our working set of CopiedBlocks while copying. We then return the
27217         fully evacuated old CopiedBlocks back to the block allocator, thus giving our copying phase
27218         an O(live bytes) overhead.
27219
27220         To fix this, we should instead split the copying phase apart from the marking phase. This
27221         way we have full liveness data for each CopiedBlock during the copying phase so that we
27222         can reuse them the instant they become fully evacuated. With the additional liveness data
27223         that each CopiedBlock accumulates, we can add some additional heuristics to the collector.
27224         For example, we can calculate our global Heap fragmentation and only choose to do a copying
27225         phase if that fragmentation exceeds some limit. As another example, we can skip copying
27226         blocks that are already above a particular fragmentation limit, which allows older objects
27227         to coalesce into blocks that are rarely copied.
27228
27229         * JavaScriptCore.xcodeproj/project.pbxproj:
27230         * heap/CopiedBlock.h:
27231         (CopiedBlock):
27232         (JSC::CopiedBlock::CopiedBlock): Added support for tracking live bytes in a CopiedBlock in a
27233         thread-safe fashion.
27234         (JSC::CopiedBlock::reportLiveBytes): Adds a number of live bytes to the block in a thread-safe
27235         fashion using compare and swap.
27236         (JSC):
27237         (JSC::CopiedBlock::didSurviveGC): Called when a block survives a single GC without being
27238         evacuated. This could be called for a couple reasons: (a) the block was pinned or (b) we
27239         decided not to do any copying. A block can become pinned for a few reasons: (1) a pointer into
27240         the block was found during the conservative scan. (2) the block was deemed full enough to
27241         not warrant any copying. (3) The block is oversize and was found to be live.
27242         (JSC::CopiedBlock::didEvacuateBytes): Called when some number of bytes are copied from this
27243         block. If the number of live bytes ever hits zero, the block will return itself to the
27244         BlockAllocator to be recycled.
27245         (JSC::CopiedBlock::canBeRecycled): Indicates that a block has no live bytes and can be
27246         immediately recycled. This is used for blocks that are found to have zero live bytes at the
27247         beginning of the copying phase.
27248         (JSC::CopiedBlock::shouldEvacuate): This function returns true if the current fragmentation
27249         of the block is above our fragmentation threshold, and false otherwise.
27250         (JSC::CopiedBlock::isPinned): Added an accessor for the pinned flag
27251         (JSC::CopiedBlock::liveBytes):
27252         * heap/CopiedSpace.cpp:
27253         (JSC::CopiedSpace::CopiedSpace):
27254         (JSC::CopiedSpace::doneFillingBlock): Changed so that we can exchange our filled block for a
27255         fresh block. This avoids the situation where a thread returns its borrowed block, it's the last
27256         borrowed block, so CopiedSpace thinks that copying has completed, and it starts doing all of the
27257         copying phase cleanup. In actuality, the thread wanted another block after returning the current
27258         block. So we allow the thread to atomically exchange its block for another block.
27259         (JSC::CopiedSpace::startedCopying): Added the calculation of global Heap fragmentation to
27260         determine if the copying phase should commence. We include the MarkedSpace in our fragmentation
27261         calculation by assuming that the MarkedSpace is 0% fragmented since we can reuse any currently
27262         free memory in it (i.e. we ignore any internal fragmentation in the MarkedSpace). While we're
27263         calculating the fragmentation of CopiedSpace, we also return any free blocks we find along the
27264         way (meaning liveBytes() == 0).
27265         (JSC):
27266         (JSC::CopiedSpace::doneCopying): We still have to iterate over all the blocks, regardless of
27267         whether the copying phase took place or not so that we can reset all of the live bytes counters
27268         and un-pin any pinned blocks.
27269         * heap/CopiedSpace.h:
27270         (CopiedSpace):
27271         (JSC::CopiedSpace::shouldDoCopyPhase):
27272         * heap/CopiedSpaceInlineMethods.h:
27273         (JSC::CopiedSpace::recycleEvacuatedBlock): This function is distinct from recycling a borrowed block
27274         because a borrowed block hasn't been added to the CopiedSpace yet, but an evacuated block is still
27275         currently in CopiedSpace, so we have to make sure we properly remove all traces of the block from
27276         CopiedSpace before returning it to BlockAllocator.
27277         (JSC::CopiedSpace::recycleBorrowedBlock): Renamed to indicate the distinction mentioned above.
27278         * heap/CopyVisitor.cpp: Added.
27279         (JSC):
27280         (JSC::CopyVisitor::CopyVisitor):
27281         (JSC::CopyVisitor::copyFromShared): Main function for any thread participating in the copying phase.
27282         Grabs chunks of MarkedBlocks from the shared list and copies the backing store of anybody who needs
27283         it until there are no more chunks to copy.
27284         * heap/CopyVisitor.h: Added.
27285         (JSC):
27286         (CopyVisitor):
27287         * heap/CopyVisitorInlineMethods.h: Added.
27288         (JSC):
27289         (GCCopyPhaseFunctor):
27290         (JSC::GCCopyPhaseFunctor::GCCopyPhaseFunctor):
27291         (JSC::GCCopyPhaseFunctor::operator()):
27292         (JSC::CopyVisitor::checkIfShouldCopy): We don't have to check shouldEvacuate() because all of those
27293         checks are done during the marking phase.
27294         (JSC::CopyVisitor::allocateNewSpace):
27295         (JSC::CopyVisitor::allocateNewSpaceSlow):
27296         (JSC::CopyVisitor::startCopying): Initialization function for a thread that is about to start copying.
27297         (JSC::CopyVisitor::doneCopying):
27298         (JSC::CopyVisitor::didCopy): This callback is called by an object that has just successfully copied its
27299         backing store. It indicates to the CopiedBlock that somebody has just finished evacuating some number of
27300         bytes from it, and, if the CopiedBlock now has no more live bytes, can be recycled immediately.
27301         * heap/GCThread.cpp: Added.
27302         (JSC):
27303         (JSC::GCThread::GCThread): This is a new class that encapsulates a single thread responsible for participating
27304         in a specific set of GC phases. Currently, that set of phases includes Mark, Copy, and Exit. Each thread
27305         monitors a shared variable in its associated GCThreadSharedData. The main thread updates this m_currentPhase
27306         variable as collection progresses through the various phases. Parallel marking still works exactly like it
27307         has. In other words, the "run loop" for each of the GC threads sits above any individual phase, thus keeping
27308         the separate phases of the collector orthogonal.
27309         (JSC::GCThread::threadID):
27310         (JSC::GCThread::initializeThreadID):
27311         (JSC::GCThread::slotVisitor):
27312         (JSC::GCThread::copyVisitor):
27313         (JSC::GCThread::waitForNextPhase):
27314         (JSC::GCThread::gcThreadMain):
27315         (JSC::GCThread::gcThreadStartFunc):
27316         * heap/GCThread.h: Added.
27317         (JSC):
27318         (GCThread):
27319         * heap/GCThreadSharedData.cpp: The GCThreadSharedData now has a list of GCThread objects rather than raw
27320         ThreadIdentifiers.
27321         (JSC::GCThreadSharedData::resetChildren):
27322         (JSC::GCThreadSharedData::childVisitCount):
27323         (JSC::GCThreadSharedData::GCThreadSharedData):
27324         (JSC::GCThreadSharedData::~GCThreadSharedData):
27325         (JSC::GCThreadSharedData::reset):
27326         (JSC::GCThreadSharedData::didStartMarking): Callback to let the GCThreadSharedData know that marking has
27327         started and updates the m_currentPhase variable and notifies the GCThreads accordingly.
27328         (JSC::GCThreadSharedData::didFinishMarking): Ditto for finishing marking.
27329         (JSC::GCThreadSharedData::didStartCopying): Ditto for starting the copying phase.
27330         (JSC::GCThreadSharedData::didFinishCopying): Ditto for finishing copying.
27331         * heap/GCThreadSharedData.h:
27332         (JSC):
27333         (GCThreadSharedData):
27334         (JSC::GCThreadSharedData::getNextBlocksToCopy): Atomically gets the next chunk of work for a copying thread.
27335         * heap/Heap.cpp:
27336         (JSC::Heap::Heap):
27337         (JSC::Heap::markRoots):
27338         (JSC):
27339         (JSC::Heap::copyBackingStores): Responsible for setting up the copying phase, notifying the copying threads,
27340         and doing any copying work if necessary.
27341         (JSC::Heap::collect):
27342         * heap/Heap.h:
27343         (Heap):
27344         (JSC):
27345         (JSC::CopyFunctor::CopyFunctor):
27346         (CopyFunctor):
27347         (JSC::CopyFunctor::operator()):
27348         * heap/IncrementalSweeper.cpp: Changed the incremental sweeper to have a reference to the list of MarkedBlocks
27349         that need sweeping, since this now resides in the Heap so that it can be easily shared by the GCThreads.
27350         (JSC::IncrementalSweeper::IncrementalSweeper):
27351         (JSC::IncrementalSweeper::startSweeping):
27352         * heap/IncrementalSweeper.h:
27353         (JSC):
27354         (IncrementalSweeper):
27355         * heap/SlotVisitor.cpp:
27356         (JSC::SlotVisitor::setup):
27357         (JSC::SlotVisitor::drainFromShared): We no longer do any copying-related work here.
27358         (JSC):
27359         * heap/SlotVisitor.h:
27360         (SlotVisitor):
27361         * heap/SlotVisitorInlineMethods.h:
27362         (JSC):
27363         (JSC::SlotVisitor::copyLater): Notifies the CopiedBlock that there are some live bytes that may need
27364         to be copied.
27365         * runtime/Butterfly.h:
27366         (JSC):
27367         (Butterfly):
27368         * runtime/ButterflyInlineMethods.h:
27369         (JSC::Butterfly::createUninitializedDuringCollection): Uses the new CopyVisitor.
27370         * runtime/ClassInfo.h:
27371         (MethodTable): Added new "virtual" function copyBackingStore to method table.
27372         (JSC):
27373         * runtime/JSCell.cpp:
27374         (JSC::JSCell::copyBackingStore): Default implementation that does nothing.
27375         (JSC):
27376         * runtime/JSCell.h:
27377         (JSC):
27378         (JSCell):
27379         * runtime/JSObject.cpp:
27380         (JSC::JSObject::copyButterfly): Does the actual copying of the butterfly.
27381         (JSC):
27382         (JSC::JSObject::visitButterfly): Calls copyLater for the butterfly.
27383         (JSC::JSObject::copyBackingStore):
27384         * runtime/JSObject.h:
27385         (JSObject):
27386         (JSC::JSCell::methodTable):
27387         (JSC::JSCell::inherits):
27388         * runtime/Options.h: Added two new constants, minHeapUtilization and minCopiedBlockUtilization,
27389         to govern the amount of fragmentation we allow before doing copying.
27390         (JSC):
27391
27392 2012-10-12  Filip Pizlo  <fpizlo@apple.com>
27393
27394         DFG array allocation calls should not return an encoded JSValue
27395         https://bugs.webkit.org/show_bug.cgi?id=99196
27396
27397         Reviewed by Mark Hahnenberg.
27398
27399         The array allocation operations now return a pointer instead. This makes it
27400         easier to share code between 32-bit and 64-bit.
27401
27402         * dfg/DFGOperations.cpp:
27403         * dfg/DFGOperations.h:
27404         * dfg/DFGSpeculativeJIT.h:
27405         (JSC::DFG::SpeculativeJIT::callOperation):
27406         * dfg/DFGSpeculativeJIT32_64.cpp:
27407         (JSC::DFG::SpeculativeJIT::compile):
27408
27409 2012-10-01  Jer Noble  <jer.noble@apple.com>
27410
27411         Enable ENCRYPTED_MEDIA support on Mac.
27412         https://bugs.webkit.org/show_bug.cgi?id=98044
27413
27414         Reviewed by Anders Carlsson.
27415
27416         Enable the ENCRYPTED_MEDIA flag.
27417
27418         * Configurations/FeatureDefines.xcconfig:
27419
27420 2012-10-12  Filip Pizlo  <fpizlo@apple.com>
27421
27422         Unreviewed. It should be possible to build JSC on ARMv7.
27423
27424         * assembler/MacroAssemblerARMv7.h:
27425         (JSC::MacroAssemblerARMv7::patchableBranchPtr):
27426
27427 2012-10-11  Mark Hahnenberg  <mhahnenberg@apple.com>
27428
27429         BlockAllocator should use regions as its VM allocation abstraction
27430         https://bugs.webkit.org/show_bug.cgi?id=99107
27431
27432         Reviewed by Geoffrey Garen.
27433
27434         Currently the BlockAllocator allocates a single block at a time directly from the OS. Our block
27435         allocations are on the large-ish side (64 KB) to amortize across many allocations the expense of
27436         mapping new virtual memory from the OS. These large blocks are then shared between the MarkedSpace
27437         and the CopiedSpace. This design makes it difficult to vary the size of the blocks in different
27438         parts of the Heap while still allowing us to amortize the VM allocation costs.
27439
27440         We should redesign the BlockAllocator so that it has a layer of indirection between blocks that are
27441         used by the allocator/collector and our primary unit of VM allocation from the OS. In particular,
27442         the BlockAllocator should allocate Regions of virtual memory from the OS, which are then subdivided
27443         into one or more Blocks to be used in our custom allocators. This design has the following nice properties:
27444
27445         1) We can remove the knowledge of PageAllocationAligned from HeapBlocks. Each HeapBlock will now
27446            only know what Region it belongs to. The Region maintains all the metadata for how to allocate
27447            and deallocate virtual memory from the OS.
27448
27449         2) We can easily allocate in larger chunks than we need to satisfy a particular request for a Block.
27450            We can then continue to amortize our VM allocation costs while allowing for smaller block sizes,
27451            which should increase locality in the mutator when allocating, lazy sweeping, etc.
27452
27453         3) By encapsulating the logic of where our memory comes from inside of the Region class, we can more
27454            easily transition over to allocating VM from a specific range of pre-reserved address space. This
27455            will be a necessary step along the way to 32-bit pointers.
27456
27457         This particular patch will not change the size of MarkedBlocks or CopiedBlocks, nor will it change how
27458         much VM we allocate per failed Block request. It only sets up the data structures that we need to make
27459         these changes in future patches.
27460
27461         Most of the changes in this patch relate to the addition of the Region class to be used by the
27462         BlockAllocator and the threading of changes made to BlockAllocator's interface through to the call sites.
27463
27464         * heap/BlockAllocator.cpp: The BlockAllocator now has three lists that track the three disjoint sets of
27465         Regions that it cares about: empty regions, partially full regions, and completely full regions.
27466         Empty regions have no blocks currently in use and can be freed immediately if the freeing thread
27467         determines they should be. Partial regions have some blocks used, but aren't completely in use yet.
27468         These regions are preferred for recycling before empty regions to mitigate fragmentation within regions.
27469         Completely full regions are no longer able to be used for allocations. Regions move between these
27470         three lists as they are created and their constituent blocks are allocated and deallocated.
27471         (JSC::BlockAllocator::BlockAllocator):
27472         (JSC::BlockAllocator::~BlockAllocator):
27473         (JSC::BlockAllocator::releaseFreeRegions):
27474         (JSC::BlockAllocator::waitForRelativeTimeWhileHoldingLock):
27475         (JSC::BlockAllocator::waitForRelativeTime):
27476         (JSC::BlockAllocator::blockFreeingThreadMain):
27477         * heap/BlockAllocator.h:
27478         (JSC):
27479         (DeadBlock):
27480         (JSC::DeadBlock::DeadBlock):
27481         (Region):
27482         (JSC::Region::blockSize):
27483         (JSC::Region::isFull):
27484         (JSC::Region::isEmpty):
27485         (JSC::Region::create): This function is responsible for doing the actual VM allocation. This should be the
27486         only function in the entire JSC object runtime that calls out the OS for virtual memory allocation.
27487         (JSC::Region::Region):
27488         (JSC::Region::~Region):
27489         (JSC::Region::allocate):
27490         (JSC::Region::deallocate):
27491         (BlockAllocator):
27492         (JSC::BlockAllocator::tryAllocateFromRegion): Helper function that encapsulates checking a particular list
27493         of regions for a free block.
27494         (JSC::BlockAllocator::allocate):
27495         (JSC::BlockAllocator::allocateCustomSize): This function is responsible for allocating one-off custom size
27496         regions for use in oversize allocations in both the MarkedSpace and the CopiedSpace. These regions are not
27497         tracked by the BlockAllocator. The only pointer to them is in the HeapBlock that is returned. These regions
27498         contain exactly one block.
27499         (JSC::BlockAllocator::deallocate):
27500         (JSC::BlockAllocator::deallocateCustomSize): This function is responsible for deallocating one-off custom size
27501         regions. The regions are deallocated back to the OS eagerly.
27502         * heap/CopiedBlock.h: Re-worked CopiedBlocks to use Regions instead of PageAllocationAligned.
27503         (CopiedBlock):
27504         (JSC::CopiedBlock::createNoZeroFill):
27505         (JSC::CopiedBlock::create):
27506         (JSC::CopiedBlock::CopiedBlock):
27507         (JSC::CopiedBlock::payloadEnd):
27508         (JSC::CopiedBlock::capacity):
27509         * heap/CopiedSpace.cpp:
27510         (JSC::CopiedSpace::~CopiedSpace):
27511         (JSC::CopiedSpace::tryAllocateOversize):
27512         (JSC::CopiedSpace::tryReallocateOversize):
27513         (JSC::CopiedSpace::doneCopying):
27514         * heap/CopiedSpaceInlineMethods.h:
27515         (JSC::CopiedSpace::allocateBlockForCopyingPhase):
27516         (JSC::CopiedSpace::allocateBlock):
27517         * heap/HeapBlock.h:
27518         (JSC::HeapBlock::destroy):
27519         (JSC::HeapBlock::HeapBlock):
27520         (JSC::HeapBlock::region):
27521         (HeapBlock):
27522         * heap/MarkedAllocator.cpp:
27523         (JSC::MarkedAllocator::allocateBlock):
27524         * heap/MarkedBlock.cpp:
27525         (JSC::MarkedBlock::create):
27526         (JSC::MarkedBlock::MarkedBlock):
27527         * heap/MarkedBlock.h:
27528         (JSC::MarkedBlock::capacity):
27529         * heap/MarkedSpace.cpp:
27530         (JSC::MarkedSpace::freeBlock):
27531
27532 2012-10-11  Filip Pizlo  <fpizlo@apple.com>
27533
27534         UInt32ToNumber and OSR exit should be aware of copy propagation and correctly recover both versions of a variable that was subject to a UInt32ToNumber cast
27535         https://bugs.webkit.org/show_bug.cgi?id=99100
27536         <rdar://problem/12480955>
27537
27538         Reviewed by Michael Saboff and Mark Hahnenberg.
27539
27540         Fixed by forcing UInt32ToNumber to use a different register. This "undoes" the copy propagation that we
27541         would have been doing, since it has no performance effect in this case and has the benefit of making the
27542         OSR exit compiler a lot simpler.
27543
27544         * dfg/DFGSpeculativeJIT.cpp:
27545         (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
27546
27547 2012-10-11  Geoffrey Garen  <ggaren@apple.com>
27548
27549         Removed some more static assumptions about inline object capacity
27550         https://bugs.webkit.org/show_bug.cgi?id=98603
27551
27552         Reviewed by Filip Pizlo.
27553
27554         * dfg/DFGSpeculativeJIT.h:
27555         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): Use JSObject::allocationSize()
27556         for a little more flexibility. We still pass it a constant inline capacity
27557         because the JIT doesn't have a strategy for selecting a size class based
27558         on non-constant capacity yet. "INLINE_STORAGE_CAPACITY" is a marker for
27559         code that makes static assumptions about object size.
27560
27561         * jit/JITInlineMethods.h:
27562         (JSC::JIT::emitAllocateBasicJSObject):
27563         * llint/LLIntData.cpp:
27564         (JSC::LLInt::Data::performAssertions):
27565         * llint/LowLevelInterpreter32_64.asm:
27566         * llint/LowLevelInterpreter64.asm: Ditto for the rest of our many execution engines.
27567
27568         * runtime/JSObject.h:
27569         (JSC::JSObject::allocationSize):
27570         (JSC::JSFinalObject::finishCreation):
27571         (JSC::JSFinalObject::create): New helper function for computing object
27572         size dynamically, since we plan to have objects of different sizes.
27573
27574         (JSC::JSFinalObject::JSFinalObject): Note that our m_inlineStorage used
27575         to auto-generate an implicit C++ constructor with default null initialization.
27576         This memory is not observed in its uninitialized state, and our LLInt and
27577         JIT allocators do not initialize it, so I did not add any explicit code
27578         to do so, now that the implicit code is gone.
27579
27580         (JSC::JSObject::offsetOfInlineStorage): Changed the math here to match
27581         inlineStorageUnsafe(), since we can rely on an explicit data member anymore.
27582
27583 2012-10-11  Geoffrey Garen  <ggaren@apple.com>
27584
27585         Enable RUNTIME_HEURISTICS all the time, for easier testing
27586         https://bugs.webkit.org/show_bug.cgi?id=99090
27587
27588         Reviewed by Filip Pizlo.
27589
27590         I find myself using this a lot, and there doesn't seem to be an obvious
27591         reason to compile it out, since it only runs once at startup.
27592
27593         * runtime/Options.cpp:
27594         (JSC::overrideOptionWithHeuristic):
27595         (JSC::Options::initialize):
27596         * runtime/Options.h: Removed the #ifdef.
27597
27598 2012-10-11  Geoffrey Garen  <ggaren@apple.com>
27599
27600         Removed ASSERT_CLASS_FITS_IN_CELL
27601         https://bugs.webkit.org/show_bug.cgi?id=97634
27602
27603         Reviewed by Mark Hahnenberg.
27604
27605         Our collector now supports arbitrarily sized objects, so the ASSERT is not needed.
27606
27607         * API/JSCallbackFunction.cpp:
27608         * API/JSCallbackObject.cpp:
27609         * heap/MarkedSpace.h:
27610         * jsc.cpp:
27611         * runtime/Arguments.cpp:
27612         * runtime/ArrayConstructor.cpp:
27613         * runtime/ArrayPrototype.cpp:
27614         * runtime/BooleanConstructor.cpp:
27615         * runtime/BooleanObject.cpp:
27616         * runtime/BooleanPrototype.cpp:
27617         * runtime/DateConstructor.cpp:
27618         * runtime/DatePrototype.cpp:
27619         * runtime/Error.cpp:
27620         * runtime/ErrorConstructor.cpp:
27621         * runtime/ErrorPrototype.cpp:
27622         * runtime/FunctionConstructor.cpp:
27623         * runtime/FunctionPrototype.cpp:
27624         * runtime/InternalFunction.cpp:
27625         * runtime/JSActivation.cpp:
27626         * runtime/JSArray.cpp:
27627         * runtime/JSBoundFunction.cpp:
27628         * runtime/JSFunction.cpp:
27629         * runtime/JSGlobalObject.cpp:
27630         * runtime/JSGlobalThis.cpp:
27631         * runtime/JSNameScope.cpp:
27632         * runtime/JSNotAnObject.cpp:
27633         * runtime/JSONObject.cpp:
27634         * runtime/JSObject.cpp:
27635         * runtime/JSPropertyNameIterator.cpp:
27636         * runtime/JSScope.cpp:
27637         * runtime/JSWithScope.cpp:
27638         * runtime/JSWrapperObject.cpp:
27639         * runtime/MathObject.cpp:
27640         * runtime/NameConstructor.cpp:
27641         * runtime/NamePrototype.cpp:
27642         * runtime/NativeErrorConstructor.cpp:
27643         * runtime/NativeErrorPrototype.cpp:
27644         * runtime/NumberConstructor.cpp:
27645         * runtime/NumberObject.cpp:
27646         * runtime/NumberPrototype.cpp:
27647         * runtime/ObjectConstructor.cpp:
27648         * runtime/ObjectPrototype.cpp:
27649         * runtime/RegExpConstructor.cpp:
27650         * runtime/RegExpMatchesArray.cpp:
27651         * runtime/RegExpObject.cpp:
27652         * runtime/RegExpPrototype.cpp:
27653         * runtime/StringConstructor.cpp:
27654         * runtime/StringObject.cpp:
27655         * runtime/StringPrototype.cpp:
27656         * testRegExp.cpp: Removed the ASSERT.
27657
27658 2012-10-11  Filip Pizlo  <fpizlo@apple.com>
27659
27660         DFG should inline code blocks that use new_array_buffer
27661         https://bugs.webkit.org/show_bug.cgi?id=98996
27662
27663         Reviewed by Geoffrey Garen.
27664
27665         This adds plumbing to drop in constant buffers from the inlinees to the inliner.
27666         It's smart about not duplicating buffers needlessly but doesn't try to completely
27667         hash-cons them, either.
27668
27669         * bytecode/CodeBlock.h:
27670         (JSC::CodeBlock::numberOfConstantBuffers):
27671         (JSC::CodeBlock::addConstantBuffer):
27672         (JSC::CodeBlock::constantBufferAsVector):
27673         (JSC::CodeBlock::constantBuffer):
27674         * dfg/DFGAbstractState.cpp:
27675         (JSC::DFG::AbstractState::execute):
27676         * dfg/DFGByteCodeParser.cpp:
27677         (ConstantBufferKey):
27678         (JSC::DFG::ConstantBufferKey::ConstantBufferKey):
27679         (JSC::DFG::ConstantBufferKey::operator==):
27680         (JSC::DFG::ConstantBufferKey::hash):
27681         (JSC::DFG::ConstantBufferKey::isHashTableDeletedValue):
27682         (JSC::DFG::ConstantBufferKey::codeBlock):
27683         (JSC::DFG::ConstantBufferKey::index):
27684         (DFG):
27685         (JSC::DFG::ConstantBufferKeyHash::hash):
27686         (JSC::DFG::ConstantBufferKeyHash::equal):
27687         (ConstantBufferKeyHash):
27688         (WTF):
27689         (ByteCodeParser):
27690         (InlineStackEntry):
27691         (JSC::DFG::ByteCodeParser::parseBlock):
27692         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
27693         * dfg/DFGCapabilities.h:
27694         (JSC::DFG::canInlineOpcode):
27695         * dfg/DFGOperations.cpp:
27696         * dfg/DFGOperations.h:
27697         * dfg/DFGSpeculativeJIT.h:
27698         (JSC::DFG::SpeculativeJIT::callOperation):
27699         * dfg/DFGSpeculativeJIT32_64.cpp:
27700         (JSC::DFG::SpeculativeJIT::compile):
27701         * dfg/DFGSpeculativeJIT64.cpp:
27702         (JSC::DFG::SpeculativeJIT::compile):
27703
27704 2012-10-10  Zoltan Horvath  <zoltan@webkit.org>
27705
27706         Pageload tests should measure memory usage
27707         https://bugs.webkit.org/show_bug.cgi?id=93958
27708
27709         Reviewed by Ryosuke Niwa.
27710
27711         Add JS Heap and Heap memory measurement to PageLoad tests.
27712
27713         * heap/HeapStatistics.cpp:
27714         (JSC::HeapStatistics::usedJSHeap): Add new private function to expose the used JS Heap size.
27715         (JSC):
27716         * heap/HeapStatistics.h:
27717         (HeapStatistics): Add new private function to expose the used JS Heap size.
27718
27719 2012-10-10  Balazs Kilvady  <kilvadyb@homejinni.com>
27720
27721         RegisterFile to JSStack rename fix for a struct member.
27722
27723         Compilation problem in debug build on MIPS
27724         https://bugs.webkit.org/show_bug.cgi?id=98808
27725
27726         Reviewed by Alexey Proskuryakov.
27727
27728         In ASSERT conditions structure field name "registerFile" was replaced
27729         with type name "JSStack" and it should be "stack".
27730
27731         * jit/JITStubs.cpp:
27732         (JSC::JITThunks::JITThunks): structure member name fix.
27733
27734 2012-10-10  Michael Saboff  <msaboff@apple.com>
27735
27736         After r130344, OpaqueJSString::string() shouldn't directly return the wrapped String
27737         https://bugs.webkit.org/show_bug.cgi?id=98801
27738
27739         Reviewed by Geoffrey Garen.
27740
27741         Return a copy of the wrapped String so that the wrapped string cannot be turned into
27742         an Identifier.
27743
27744         * API/OpaqueJSString.cpp:
27745         (OpaqueJSString::string):
27746         * API/OpaqueJSString.h:
27747         (OpaqueJSString):
27748
27749 2012-10-10  Peter Gal  <galpeter@inf.u-szeged.hu>
27750
27751         Add moveDoubleToInts and moveIntsToDouble to MacroAssemblerARM
27752         https://bugs.webkit.org/show_bug.cgi?id=98855
27753
27754         Reviewed by Filip Pizlo.
27755
27756         Implement the missing moveDoubleToInts and moveIntsToDouble
27757         methods in the MacroAssemblerARM after r130839.
27758
27759         * assembler/MacroAssemblerARM.h:
27760         (JSC::MacroAssemblerARM::moveDoubleToInts):
27761         (MacroAssemblerARM):
27762         (JSC::MacroAssemblerARM::moveIntsToDouble):
27763
27764 2012-10-09  Filip Pizlo  <fpizlo@apple.com>
27765
27766         Typed arrays should not be 20x slower in the baseline JIT than in the DFG JIT
27767         https://bugs.webkit.org/show_bug.cgi?id=98605
27768
27769         Reviewed by Oliver Hunt and Gavin Barraclough.
27770
27771         This adds typed array get_by_val/put_by_val patching to the baseline JIT. It's
27772         a big (~40%) win on benchmarks that have trouble staying in the DFG JIT. Even
27773         if we fix those benchmarks, this functionality gives us the insurance that we
27774         typically desire with all speculative optimizations: even if we bail to
27775         baseline, we're still reasonably performant.
27776
27777         * CMakeLists.txt:
27778         * GNUmakefile.list.am:
27779         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
27780         * JavaScriptCore.xcodeproj/project.pbxproj:
27781         * Target.pri:
27782         * assembler/MacroAssembler.cpp: Added.
27783         (JSC):
27784         * assembler/MacroAssembler.h:
27785         (MacroAssembler):
27786         (JSC::MacroAssembler::patchableBranchPtr):
27787         * assembler/MacroAssemblerARMv7.h:
27788         (MacroAssemblerARMv7):
27789         (JSC::MacroAssemblerARMv7::moveDoubleToInts):
27790         (JSC::MacroAssemblerARMv7::moveIntsToDouble):
27791         (JSC::MacroAssemblerARMv7::patchableBranchPtr):
27792         * assembler/MacroAssemblerX86.h:
27793         (MacroAssemblerX86):
27794         (JSC::MacroAssemblerX86::moveDoubleToInts):
27795         (JSC::MacroAssemblerX86::moveIntsToDouble):
27796         * bytecode/ByValInfo.h:
27797         (JSC::hasOptimizableIndexingForClassInfo):
27798         (JSC):
27799         (JSC::hasOptimizableIndexing):
27800         (JSC::jitArrayModeForClassInfo):
27801         (JSC::jitArrayModeForStructure):
27802         (JSC::ByValInfo::ByValInfo):
27803         (ByValInfo):
27804         * dfg/DFGAssemblyHelpers.cpp:
27805         (DFG):
27806         * dfg/DFGAssemblyHelpers.h:
27807         (AssemblyHelpers):
27808         (JSC::DFG::AssemblyHelpers::boxDouble):
27809         (JSC::DFG::AssemblyHelpers::unboxDouble):
27810         * dfg/DFGSpeculativeJIT.cpp:
27811         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
27812         (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
27813         * dfg/DFGSpeculativeJIT.h:
27814         (SpeculativeJIT):
27815         * jit/JIT.h:
27816         (JIT):
27817         * jit/JITPropertyAccess.cpp:
27818         (JSC::JIT::emit_op_get_by_val):
27819         (JSC::JIT::emit_op_put_by_val):
27820         (JSC::JIT::privateCompileGetByVal):
27821         (JSC::JIT::privateCompilePutByVal):
27822         (JSC::JIT::emitIntTypedArrayGetByVal):
27823         (JSC):
27824         (JSC::JIT::emitFloatTypedArrayGetByVal):
27825         (JSC::JIT::emitIntTypedArrayPutByVal):
27826         (JSC::JIT::emitFloatTypedArrayPutByVal):
27827         * jit/JITPropertyAccess32_64.cpp:
27828         (JSC::JIT::emit_op_get_by_val):
27829         (JSC::JIT::emit_op_put_by_val):
27830         * jit/JITStubs.cpp:
27831         (JSC::DEFINE_STUB_FUNCTION):
27832         * runtime/JSCell.h:
27833         * runtime/JSGlobalData.h:
27834         (JSGlobalData):
27835         (JSC::JSGlobalData::typedArrayDescriptor):
27836         * runtime/TypedArrayDescriptor.h: Added.
27837         (JSC):
27838         (JSC::TypedArrayDescriptor::TypedArrayDescriptor):
27839         (TypedArrayDescriptor):
27840
27841 2012-10-09  Michael Saboff  <msaboff@apple.com>
27842
27843         Add tests to testapi for null OpaqueJSStrings
27844         https://bugs.webkit.org/show_bug.cgi?id=98805
27845
27846         Reviewed by Geoffrey Garen.
27847
27848         Added tests that check that OpaqueJSString, which is wrapped via JSStringRef, properly returns
27849         null strings and that a null string in a JSStringRef will return a NULL JSChar* and 0 length
27850         via the JSStringGetCharactersPtr() and JSStringGetLength() APIs respectively. Added a check that
27851         JSValueMakeFromJSONString() properly handles a null string as well.
27852
27853         * API/tests/testapi.c:
27854         (main):
27855
27856 2012-10-09  Jian Li  <jianli@chromium.org>
27857
27858         Update the CSS property used to support draggable regions.
27859         https://bugs.webkit.org/show_bug.cgi?id=97156
27860
27861         Reviewed by Adam Barth.
27862
27863         The CSS property to support draggable regions, guarded under
27864         WIDGET_REGION is now disabled from Mac WebKit, in order not to cause
27865         confusion with DASHBOARD_SUPPORT feature.
27866
27867         * Configurations/FeatureDefines.xcconfig: Disable WIDGET_REGION feature.
27868
27869 2012-10-09  Filip Pizlo  <fpizlo@apple.com>
27870
27871         Unreviewed, adding forgotten files.
27872
27873         * bytecode/ByValInfo.h: Added.
27874         (JSC):
27875         (JSC::isOptimizableIndexingType):
27876         (JSC::jitArrayModeForIndexingType):
27877         (JSC::ByValInfo::ByValInfo):
27878         (ByValInfo):
27879         (JSC::getByValInfoBytecodeIndex):
27880         * runtime/IndexingType.cpp: Added.
27881         (JSC):
27882         (JSC::indexingTypeToString):
27883
27884 2012-10-08  Filip Pizlo  <fpizlo@apple.com>
27885
27886         JSC should infer when indexed storage is contiguous, and optimize for it
27887         https://bugs.webkit.org/show_bug.cgi?id=97288
27888
27889         Reviewed by Mark Hahnenberg.
27890
27891         This introduces a new kind of indexed property storage called Contiguous,
27892         which has the following properties:
27893
27894         - No header bits beyond IndexedHeader. This results in a 16 byte reduction
27895           in memory usage per array versus an ArrayStorage array. It also means
27896           that the total memory usage for an empty array is now just 3 * 8 on both
27897           32-bit and 64-bit. Of that, only 8 bytes are array-specific; the rest is
27898           our standard object header overhead.
27899
27900         - No need for hole checks on store. This results in a ~4% speed-up on
27901           Kraken and a ~1% speed-up on V8v7.
27902
27903         - publicLength <= vectorLength. This means that doing new Array(blah)
27904           immediately allocates room for blah elements.
27905
27906         - No sparse map or index bias.
27907
27908         If you ever do things to an array that would require publicLength >
27909         vectorLength, a sparse map, or index bias, then we switch to ArrayStorage
27910         mode. This seems to never happen in any benchmark we track, and is unlikely
27911         to happen very frequently on any website.
27912
27913         * CMakeLists.txt:
27914         * GNUmakefile.list.am:
27915         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
27916         * JavaScriptCore.xcodeproj/project.pbxproj:
27917         * Target.pri:
27918         * assembler/AbstractMacroAssembler.h:
27919         (JSC::AbstractMacroAssembler::JumpList::append):
27920         * assembler/MacroAssembler.h:
27921         (MacroAssembler):
27922         (JSC::MacroAssembler::patchableBranchTest32):
27923         * bytecode/ByValInfo.h: Added.
27924         (JSC):
27925         (JSC::isOptimizableIndexingType):
27926         (JSC::jitArrayModeForIndexingType):
27927         (JSC::ByValInfo::ByValInfo):
27928         (ByValInfo):
27929         (JSC::getByValInfoBytecodeIndex):
27930         * bytecode/CodeBlock.h:
27931         (CodeBlock):
27932         (JSC::CodeBlock::getByValInfo):
27933         (JSC::CodeBlock::setNumberOfByValInfos):
27934         (JSC::CodeBlock::numberOfByValInfos):
27935         (JSC::CodeBlock::byValInfo):
27936         * bytecode/SamplingTool.h:
27937         * dfg/DFGAbstractState.cpp:
27938         (JSC::DFG::AbstractState::execute):
27939         * dfg/DFGArrayMode.cpp:
27940         (JSC::DFG::fromObserved):
27941         (JSC::DFG::modeAlreadyChecked):
27942         (JSC::DFG::modeToString):
27943         * dfg/DFGArrayMode.h:
27944         (DFG):
27945         (JSC::DFG::modeUsesButterfly):
27946         (JSC::DFG::modeIsJSArray):
27947         (JSC::DFG::isInBoundsAccess):
27948         (JSC::DFG::mayStoreToTail):
27949         (JSC::DFG::mayStoreToHole):
27950         (JSC::DFG::modeIsPolymorphic):
27951         (JSC::DFG::polymorphicIncludesContiguous):
27952         (JSC::DFG::polymorphicIncludesArrayStorage):
27953         (JSC::DFG::canCSEStorage):
27954         (JSC::DFG::modeSupportsLength):
27955         (JSC::DFG::benefitsFromStructureCheck):
27956         (JSC::DFG::isEffectful):
27957         * dfg/DFGByteCodeParser.cpp:
27958         (JSC::DFG::ByteCodeParser::handleIntrinsic):
27959         * dfg/DFGCSEPhase.cpp:
27960         (JSC::DFG::CSEPhase::getArrayLengthElimination):
27961         (JSC::DFG::CSEPhase::getByValLoadElimination):
27962         (JSC::DFG::CSEPhase::performNodeCSE):
27963         * dfg/DFGFixupPhase.cpp:
27964         (JSC::DFG::FixupPhase::fixupNode):
27965         (JSC::DFG::FixupPhase::checkArray):
27966         (JSC::DFG::FixupPhase::blessArrayOperation):
27967         * dfg/DFGGraph.h:
27968         (JSC::DFG::Graph::byValIsPure):
27969         * dfg/DFGOperations.cpp:
27970         * dfg/DFGOperations.h:
27971         * dfg/DFGRepatch.cpp:
27972         (JSC::DFG::tryCacheGetByID):
27973         * dfg/DFGSpeculativeJIT.cpp:
27974         (JSC::DFG::SpeculativeJIT::checkArray):
27975         (JSC::DFG::SpeculativeJIT::arrayify):
27976         (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
27977         (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
27978         (DFG):
27979         * dfg/DFGSpeculativeJIT.h:
27980         (DFG):
27981         (JSC::DFG::SpeculativeJIT::callOperation):
27982         (SpeculativeJIT):
27983         (JSC::DFG::SpeculativeJIT::putByValWillNeedExtraRegister):
27984         (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal):
27985         * dfg/DFGSpeculativeJIT32_64.cpp:
27986         (JSC::DFG::SpeculativeJIT::compileContiguousGetByVal):
27987         (DFG):
27988         (JSC::DFG::SpeculativeJIT::compileArrayStorageGetByVal):
27989         (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
27990         (JSC::DFG::SpeculativeJIT::compileArrayStoragePutByVal):
27991         (JSC::DFG::SpeculativeJIT::compile):
27992         * dfg/DFGSpeculativeJIT64.cpp:
27993         (JSC::DFG::SpeculativeJIT::compileContiguousGetByVal):
27994         (DFG):
27995         (JSC::DFG::SpeculativeJIT::compileArrayStorageGetByVal):
27996         (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
27997         (JSC::DFG::SpeculativeJIT::compileArrayStoragePutByVal):
27998         (JSC::DFG::SpeculativeJIT::compile):
27999         * interpreter/Interpreter.cpp:
28000         (SamplingScope):
28001         (JSC::SamplingScope::SamplingScope):
28002         (JSC::SamplingScope::~SamplingScope):
28003         (JSC):
28004         (JSC::Interpreter::execute):
28005         * jit/JIT.cpp:
28006         (JSC::JIT::privateCompileSlowCases):
28007         (JSC::JIT::privateCompile):
28008         * jit/JIT.h:
28009         (JSC::ByValCompilationInfo::ByValCompilationInfo):
28010         (ByValCompilationInfo):
28011         (JSC):
28012         (JIT):
28013         (JSC::JIT::compileGetByVal):
28014         (JSC::JIT::compilePutByVal):
28015         * jit/JITInlineMethods.h:
28016         (JSC::JIT::emitAllocateJSArray):
28017         (JSC::JIT::emitArrayProfileStoreToHoleSpecialCase):
28018         (JSC):
28019         (JSC::arrayProfileSaw):
28020         (JSC::JIT::chooseArrayMode):
28021         * jit/JITOpcodes.cpp:
28022         (JSC::JIT::emitSlow_op_get_argument_by_val):
28023         (JSC::JIT::emit_op_new_array):
28024         (JSC::JIT::emitSlow_op_new_array):
28025         * jit/JITOpcodes32_64.cpp:
28026         (JSC::JIT::emitSlow_op_get_argument_by_val):
28027         * jit/JITPropertyAccess.cpp:
28028         (JSC::JIT::emit_op_get_by_val):
28029         (JSC):
28030         (JSC::JIT::emitContiguousGetByVal):
28031         (JSC::JIT::emitArrayStorageGetByVal):
28032         (JSC::JIT::emitSlow_op_get_by_val):
28033         (JSC::JIT::emit_op_put_by_val):
28034         (JSC::JIT::emitContiguousPutByVal):
28035         (JSC::JIT::emitArrayStoragePutByVal):
28036         (JSC::JIT::emitSlow_op_put_by_val):
28037         (JSC::JIT::privateCompilePatchGetArrayLength):
28038         (JSC::JIT::privateCompileGetByVal):
28039         (JSC::JIT::privateCompilePutByVal):
28040         * jit/JITPropertyAccess32_64.cpp:
28041         (JSC::JIT::emit_op_get_by_val):
28042         (JSC):
28043         (JSC::JIT::emitContiguousGetByVal):
28044         (JSC::JIT::emitArrayStorageGetByVal):
28045         (JSC::JIT::emitSlow_op_get_by_val):
28046         (JSC::JIT::emit_op_put_by_val):
28047         (JSC::JIT::emitContiguousPutByVal):
28048         (JSC::JIT::emitArrayStoragePutByVal):
28049         (JSC::JIT::emitSlow_op_put_by_val):
28050         * jit/JITStubs.cpp:
28051         (JSC::getByVal):
28052         (JSC):
28053         (JSC::DEFINE_STUB_FUNCTION):
28054         (JSC::putByVal):
28055         * jit/JITStubs.h:
28056         * llint/LowLevelInterpreter.asm:
28057         * llint/LowLevelInterpreter32_64.asm:
28058         * llint/LowLevelInterpreter64.asm:
28059         * runtime/ArrayConventions.h:
28060         (JSC::isDenseEnoughForVector):
28061         * runtime/ArrayPrototype.cpp:
28062         (JSC):
28063         (JSC::shift):
28064         (JSC::unshift):
28065         (JSC::arrayProtoFuncPush):
28066         (JSC::arrayProtoFuncShift):
28067         (JSC::arrayProtoFuncSplice):
28068         (JSC::arrayProtoFuncUnShift):
28069         * runtime/Butterfly.h:
28070         (Butterfly):
28071         (JSC::Butterfly::fromPointer):
28072         (JSC::Butterfly::pointer):
28073         (JSC::Butterfly::publicLength):
28074         (JSC::Butterfly::vectorLength):
28075         (JSC::Butterfly::setPublicLength):
28076         (JSC::Butterfly::setVectorLength):
28077         (JSC::Butterfly::contiguous):
28078         (JSC::Butterfly::fromContiguous):
28079         * runtime/ButterflyInlineMethods.h:
28080         (JSC::Butterfly::unshift):
28081         (JSC::Butterfly::shift):
28082         * runtime/IndexingHeaderInlineMethods.h:
28083         (JSC::IndexingHeader::indexingPayloadSizeInBytes):
28084         * runtime/IndexingType.cpp: Added.
28085         (JSC):
28086         (JSC::indexingTypeToString):
28087         * runtime/IndexingType.h:
28088         (JSC):
28089         (JSC::hasContiguous):
28090         * runtime/JSArray.cpp:
28091         (JSC::JSArray::setLengthWithArrayStorage):
28092         (JSC::JSArray::setLength):
28093         (JSC):
28094         (JSC::JSArray::pop):
28095         (JSC::JSArray::push):
28096         (JSC::JSArray::shiftCountWithArrayStorage):
28097         (JSC::JSArray::shiftCountWithAnyIndexingType):
28098         (JSC::JSArray::unshiftCountWithArrayStorage):
28099         (JSC::JSArray::unshiftCountWithAnyIndexingType):
28100         (JSC::JSArray::sortNumericVector):
28101         (JSC::JSArray::sortNumeric):
28102         (JSC::JSArray::sortCompactedVector):
28103         (JSC::JSArray::sort):
28104         (JSC::JSArray::sortVector):
28105         (JSC::JSArray::fillArgList):
28106         (JSC::JSArray::copyToArguments):
28107         (JSC::JSArray::compactForSorting):
28108         * runtime/JSArray.h:
28109         (JSC::JSArray::shiftCountForShift):
28110         (JSC::JSArray::shiftCountForSplice):
28111         (JSArray):
28112         (JSC::JSArray::shiftCount):
28113         (JSC::JSArray::unshiftCountForShift):
28114         (JSC::JSArray::unshiftCountForSplice):
28115         (JSC::JSArray::unshiftCount):
28116         (JSC::JSArray::isLengthWritable):
28117         (JSC::createContiguousArrayButterfly):
28118         (JSC):
28119         (JSC::JSArray::create):
28120         (JSC::JSArray::tryCreateUninitialized):
28121         * runtime/JSGlobalObject.cpp:
28122         (JSC::JSGlobalObject::reset):
28123         (JSC):
28124         (JSC::JSGlobalObject::haveABadTime):
28125         (JSC::JSGlobalObject::visitChildren):
28126         * runtime/JSGlobalObject.h:
28127         (JSGlobalObject):
28128         (JSC::JSGlobalObject::arrayStructureWithArrayStorage):
28129         (JSC::JSGlobalObject::addressOfArrayStructureWithArrayStorage):
28130         (JSC::constructEmptyArray):
28131         * runtime/JSObject.cpp:
28132         (JSC::JSObject::visitButterfly):
28133         (JSC::JSObject::getOwnPropertySlotByIndex):
28134         (JSC::JSObject::putByIndex):
28135         (JSC::JSObject::enterDictionaryIndexingMode):
28136         (JSC::JSObject::createInitialContiguous):
28137         (JSC):
28138         (JSC::JSObject::createArrayStorage):
28139         (JSC::JSObject::convertContiguousToArrayStorage):
28140         (JSC::JSObject::ensureContiguousSlow):
28141         (JSC::JSObject::ensureArrayStorageSlow):
28142         (JSC::JSObject::ensureIndexedStorageSlow):
28143         (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
28144         (JSC::JSObject::switchToSlowPutArrayStorage):
28145         (JSC::JSObject::setPrototype):
28146         (JSC::JSObject::deletePropertyByIndex):
28147         (JSC::JSObject::getOwnPropertyNames):
28148         (JSC::JSObject::defineOwnIndexedProperty):
28149         (JSC::JSObject::putByIndexBeyondVectorLengthContiguousWithoutAttributes):
28150         (JSC::JSObject::putByIndexBeyondVectorLength):
28151         (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
28152         (JSC::JSObject::putDirectIndexBeyondVectorLength):
28153         (JSC::JSObject::getNewVectorLength):
28154         (JSC::JSObject::countElementsInContiguous):
28155         (JSC::JSObject::increaseVectorLength):
28156         (JSC::JSObject::ensureContiguousLengthSlow):
28157         (JSC::JSObject::getOwnPropertyDescriptor):
28158         * runtime/JSObject.h:
28159         (JSC::JSObject::getArrayLength):
28160         (JSC::JSObject::getVectorLength):
28161         (JSC::JSObject::canGetIndexQuickly):
28162         (JSC::JSObject::getIndexQuickly):
28163         (JSC::JSObject::tryGetIndexQuickly):
28164         (JSC::JSObject::canSetIndexQuickly):
28165         (JSC::JSObject::canSetIndexQuicklyForPutDirect):
28166         (JSC::JSObject::setIndexQuickly):
28167         (JSC::JSObject::initializeIndex):
28168         (JSC::JSObject::hasSparseMap):
28169         (JSC::JSObject::inSparseIndexingMode):
28170         (JSObject):
28171         (JSC::JSObject::ensureContiguous):
28172         (JSC::JSObject::ensureIndexedStorage):
28173         (JSC::JSObject::ensureContiguousLength):
28174         (JSC::JSObject::indexingData):
28175         (JSC::JSObject::relevantLength):
28176         * runtime/JSValue.cpp:
28177         (JSC::JSValue::description):
28178         * runtime/Options.cpp:
28179         (JSC::Options::initialize):
28180         * runtime/Structure.cpp:
28181         (JSC::Structure::needsSlowPutIndexing):
28182         (JSC):
28183         (JSC::Structure::suggestedArrayStorageTransition):
28184         * runtime/Structure.h:
28185         (Structure):
28186         * runtime/StructureTransitionTable.h:
28187         (JSC::newIndexingType):
28188
28189 2012-10-09  Michael Saboff  <msaboff@apple.com>
28190
28191         After r130344, OpaqueJSString::identifier() adds wrapped String to identifier table
28192         https://bugs.webkit.org/show_bug.cgi?id=98693
28193         REGRESSION (r130344): Install failed in Install Environment
28194         <rdar://problem/12450118>
28195
28196         Reviewed by Mark Rowe.
28197
28198         Use Identifier(LChar*, length) or Identifier(UChar*, length) constructors so that we don't
28199         add the String instance in the OpaqueJSString to any identifier tables.
28200
28201         * API/OpaqueJSString.cpp:
28202         (OpaqueJSString::identifier):
28203
28204 2012-10-08  Mark Lam  <mark.lam@apple.com>
28205
28206         Renamed RegisterFile to JSStack, and removed prototype of the
28207         previously deleted Interpreter::privateExecute().
28208         https://bugs.webkit.org/show_bug.cgi?id=98717.
28209
28210         Reviewed by Filip Pizlo.
28211
28212         * CMakeLists.txt:
28213         * GNUmakefile.list.am:
28214         * JavaScriptCore.order:
28215         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
28216         * JavaScriptCore.xcodeproj/project.pbxproj:
28217         * Target.pri:
28218         * bytecode/BytecodeConventions.h:
28219         * bytecode/CodeBlock.cpp:
28220         (JSC::CodeBlock::nameForRegister):
28221         * bytecode/CodeBlock.h:
28222         (CodeBlock):
28223         * bytecode/ValueRecovery.h:
28224         (JSC::ValueRecovery::alreadyInJSStack):
28225         (JSC::ValueRecovery::alreadyInJSStackAsUnboxedInt32):
28226         (JSC::ValueRecovery::alreadyInJSStackAsUnboxedCell):
28227         (JSC::ValueRecovery::alreadyInJSStackAsUnboxedBoolean):
28228         (JSC::ValueRecovery::alreadyInJSStackAsUnboxedDouble):
28229         (JSC::ValueRecovery::displacedInJSStack):
28230         (JSC::ValueRecovery::isAlreadyInJSStack):
28231         (JSC::ValueRecovery::virtualRegister):
28232         (JSC::ValueRecovery::dump):
28233         * bytecompiler/BytecodeGenerator.cpp:
28234         (JSC::BytecodeGenerator::resolveCallee):
28235         (JSC::BytecodeGenerator::emitCall):
28236         (JSC::BytecodeGenerator::emitConstruct):
28237         * bytecompiler/BytecodeGenerator.h:
28238         (JSC::BytecodeGenerator::registerFor):
28239         * dfg/DFGAbstractState.h:
28240         (AbstractState):
28241         * dfg/DFGAssemblyHelpers.h:
28242         (JSC::DFG::AssemblyHelpers::emitGetFromCallFrameHeaderPtr):
28243         (JSC::DFG::AssemblyHelpers::emitPutToCallFrameHeader):
28244         (JSC::DFG::AssemblyHelpers::emitPutImmediateToCallFrameHeader):
28245         * dfg/DFGByteCodeParser.cpp:
28246         (JSC::DFG::ByteCodeParser::getDirect):
28247         (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
28248         (JSC::DFG::ByteCodeParser::addCall):
28249         (JSC::DFG::ByteCodeParser::InlineStackEntry::remapOperand):
28250         (JSC::DFG::ByteCodeParser::handleInlining):
28251         (JSC::DFG::ByteCodeParser::parseBlock):
28252         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
28253         * dfg/DFGGenerationInfo.h:
28254         (GenerationInfo):
28255         (JSC::DFG::GenerationInfo::needsSpill):
28256         * dfg/DFGGraph.h:
28257         * dfg/DFGJITCompiler.cpp:
28258         (JSC::DFG::JITCompiler::compileEntry):
28259         (JSC::DFG::JITCompiler::compileFunction):
28260         * dfg/DFGJITCompiler.h:
28261         (JSC::DFG::JITCompiler::beginCall):
28262         * dfg/DFGOSREntry.cpp:
28263         (JSC::DFG::prepareOSREntry):
28264         * dfg/DFGOSRExitCompiler32_64.cpp:
28265         (JSC::DFG::OSRExitCompiler::compileExit):
28266         * dfg/DFGOSRExitCompiler64.cpp:
28267         (JSC::DFG::OSRExitCompiler::compileExit):
28268         * dfg/DFGRepatch.cpp:
28269         (JSC::DFG::tryBuildGetByIDList):
28270         * dfg/DFGSpeculativeJIT.cpp:
28271         (JSC::DFG::SpeculativeJIT::compile):
28272         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
28273         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
28274         * dfg/DFGSpeculativeJIT.h:
28275         (SpeculativeJIT):
28276         (JSC::DFG::SpeculativeJIT::spill):
28277         * dfg/DFGSpeculativeJIT32_64.cpp:
28278         (JSC::DFG::SpeculativeJIT::emitCall):
28279         (JSC::DFG::SpeculativeJIT::compile):
28280         * dfg/DFGSpeculativeJIT64.cpp:
28281         (JSC::DFG::SpeculativeJIT::fillInteger):
28282         (JSC::DFG::SpeculativeJIT::emitCall):
28283         (JSC::DFG::SpeculativeJIT::compile):
28284         * dfg/DFGThunks.cpp:
28285         (JSC::DFG::throwExceptionFromCallSlowPathGenerator):
28286         (JSC::DFG::slowPathFor):
28287         (JSC::DFG::virtualForThunkGenerator):
28288         * dfg/DFGValueSource.cpp:
28289         (JSC::DFG::ValueSource::dump):
28290         * dfg/DFGValueSource.h:
28291         (JSC::DFG::dataFormatToValueSourceKind):
28292         (JSC::DFG::valueSourceKindToDataFormat):
28293         (JSC::DFG::isInJSStack):
28294         (JSC::DFG::ValueSource::forSpeculation):
28295         (JSC::DFG::ValueSource::isInJSStack):
28296         (JSC::DFG::ValueSource::valueRecovery):
28297         * dfg/DFGVariableEventStream.cpp:
28298         (JSC::DFG::VariableEventStream::reconstruct):
28299         * heap/Heap.cpp:
28300         (JSC::Heap::stack):
28301         (JSC::Heap::getConservativeRegisterRoots):
28302         (JSC::Heap::markRoots):
28303         * heap/Heap.h:
28304         (JSC):
28305         (Heap):
28306         * interpreter/CallFrame.cpp:
28307         (JSC::CallFrame::stack):
28308         * interpreter/CallFrame.h:
28309         (JSC::ExecState::calleeAsValue):
28310         (JSC::ExecState::callee):
28311         (JSC::ExecState::codeBlock):
28312         (JSC::ExecState::scope):
28313         (JSC::ExecState::callerFrame):
28314         (JSC::ExecState::returnPC):
28315         (JSC::ExecState::hasReturnPC):
28316         (JSC::ExecState::clearReturnPC):
28317         (JSC::ExecState::bytecodeOffsetForNonDFGCode):
28318         (JSC::ExecState::setBytecodeOffsetForNonDFGCode):
28319         (JSC::ExecState::inlineCallFrame):
28320         (JSC::ExecState::codeOriginIndexForDFG):
28321         (JSC::ExecState::currentVPC):
28322         (JSC::ExecState::setCurrentVPC):
28323         (JSC::ExecState::setCallerFrame):
28324         (JSC::ExecState::setScope):
28325         (JSC::ExecState::init):
28326         (JSC::ExecState::argumentCountIncludingThis):
28327         (JSC::ExecState::offsetFor):
28328         (JSC::ExecState::setArgumentCountIncludingThis):
28329         (JSC::ExecState::setCallee):
28330         (JSC::ExecState::setCodeBlock):
28331         (JSC::ExecState::setReturnPC):
28332         (JSC::ExecState::setInlineCallFrame):
28333         (ExecState):
28334         * interpreter/Interpreter.cpp:
28335         (JSC::Interpreter::slideRegisterWindowForCall):
28336         (JSC::eval):
28337         (JSC::loadVarargs):
28338         (JSC::Interpreter::dumpRegisters):
28339         (JSC::Interpreter::throwException):
28340         (JSC::Interpreter::execute):
28341         (JSC::Interpreter::executeCall):
28342         (JSC::Interpreter::executeConstruct):
28343         (JSC::Interpreter::prepareForRepeatCall):
28344         (JSC::Interpreter::endRepeatCall):
28345         * interpreter/Interpreter.h:
28346         (JSC::Interpreter::stack):
28347         (Interpreter):
28348         (JSC::Interpreter::execute):
28349         (JSC):
28350         * interpreter/JSStack.cpp: Copied from Source/JavaScriptCore/interpreter/RegisterFile.cpp.
28351         (JSC::stackStatisticsMutex):
28352         (JSC::JSStack::~JSStack):
28353         (JSC::JSStack::growSlowCase):
28354         (JSC::JSStack::gatherConservativeRoots):
28355         (JSC::JSStack::releaseExcessCapacity):
28356         (JSC::JSStack::initializeThreading):
28357         (JSC::JSStack::committedByteCount):
28358         (JSC::JSStack::addToCommittedByteCount):
28359         * interpreter/JSStack.h: Copied from Source/JavaScriptCore/interpreter/RegisterFile.h.
28360         (JSStack):
28361         (JSC::JSStack::JSStack):
28362         (JSC::JSStack::shrink):
28363         (JSC::JSStack::grow):
28364         * interpreter/RegisterFile.cpp: Removed.
28365         * interpreter/RegisterFile.h: Removed.
28366         * interpreter/VMInspector.cpp:
28367         (JSC::VMInspector::dumpFrame):
28368         * jit/JIT.cpp:
28369         (JSC::JIT::JIT):
28370         (JSC::JIT::privateCompile):
28371         * jit/JIT.h:
28372         (JSC):
28373         (JIT):
28374         * jit/JITCall.cpp:
28375         (JSC::JIT::compileLoadVarargs):
28376         (JSC::JIT::compileCallEval):
28377         (JSC::JIT::compileCallEvalSlowCase):
28378         (JSC::JIT::compileOpCall):
28379         * jit/JITCall32_64.cpp:
28380         (JSC::JIT::emit_op_ret):
28381         (JSC::JIT::emit_op_ret_object_or_this):
28382         (JSC::JIT::compileLoadVarargs):
28383         (JSC::JIT::compileCallEval):
28384         (JSC::JIT::compileCallEvalSlowCase):
28385         (JSC::JIT::compileOpCall):
28386         * jit/JITCode.h:
28387         (JSC):
28388         (JSC::JITCode::execute):
28389         * jit/JITInlineMethods.h:
28390         (JSC::JIT::emitPutToCallFrameHeader):
28391         (JSC::JIT::emitPutCellToCallFrameHeader):
28392         (JSC::JIT::emitPutIntToCallFrameHeader):
28393         (JSC::JIT::emitPutImmediateToCallFrameHeader):
28394         (JSC::JIT::emitGetFromCallFrameHeaderPtr):
28395         (JSC::JIT::emitGetFromCallFrameHeader32):
28396         (JSC::JIT::updateTopCallFrame):
28397         (JSC::JIT::unmap):
28398         * jit/JITOpcodes.cpp:
28399         (JSC::JIT::privateCompileCTIMachineTrampolines):
28400         (JSC::JIT::privateCompileCTINativeCall):
28401         (JSC::JIT::emit_op_end):
28402         (JSC::JIT::emit_op_ret):
28403         (JSC::JIT::emit_op_ret_object_or_this):
28404         (JSC::JIT::emit_op_create_this):
28405         (JSC::JIT::emit_op_get_arguments_length):
28406         (JSC::JIT::emit_op_get_argument_by_val):
28407         (JSC::JIT::emit_op_resolve_global_dynamic):
28408         * jit/JITOpcodes32_64.cpp:
28409         (JSC::JIT::privateCompileCTIMachineTrampolines):
28410         (JSC::JIT::privateCompileCTINativeCall):
28411         (JSC::JIT::emit_op_end):
28412         (JSC::JIT::emit_op_create_this):
28413         (JSC::JIT::emit_op_get_arguments_length):
28414         (JSC::JIT::emit_op_get_argument_by_val):
28415         * jit/JITPropertyAccess.cpp:
28416         (JSC::JIT::emit_op_get_scoped_var):
28417         (JSC::JIT::emit_op_put_scoped_var):
28418         * jit/JITPropertyAccess32_64.cpp:
28419         (JSC::JIT::emit_op_get_scoped_var):
28420         (JSC::JIT::emit_op_put_scoped_var):
28421         * jit/JITStubs.cpp:
28422         (JSC::ctiTrampoline):
28423         (JSC::JITThunks::JITThunks):
28424         (JSC):
28425         (JSC::DEFINE_STUB_FUNCTION):
28426         * jit/JITStubs.h:
28427         (JSC):
28428         (JITStackFrame):
28429         * jit/JSInterfaceJIT.h:
28430         * jit/SpecializedThunkJIT.h:
28431         (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
28432         (JSC::SpecializedThunkJIT::returnJSValue):
28433         (JSC::SpecializedThunkJIT::returnDouble):
28434         (JSC::SpecializedThunkJIT::returnInt32):
28435         (JSC::SpecializedThunkJIT::returnJSCell):
28436         * llint/LLIntData.cpp:
28437         (JSC::LLInt::Data::performAssertions):
28438         * llint/LLIntOffsetsExtractor.cpp:
28439         * llint/LLIntSlowPaths.cpp:
28440         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
28441         (JSC::LLInt::genericCall):
28442         * llint/LLIntSlowPaths.h:
28443         (LLInt):
28444         * llint/LowLevelInterpreter.asm:
28445         * runtime/Arguments.cpp:
28446         (JSC::Arguments::tearOffForInlineCallFrame):
28447         * runtime/CommonSlowPaths.h:
28448         (JSC::CommonSlowPaths::arityCheckFor):
28449         * runtime/InitializeThreading.cpp:
28450         (JSC::initializeThreadingOnce):
28451         * runtime/JSActivation.cpp:
28452         (JSC::JSActivation::visitChildren):
28453         * runtime/JSGlobalObject.cpp:
28454         (JSC::JSGlobalObject::globalExec):
28455         * runtime/JSGlobalObject.h:
28456         (JSC):
28457         (JSGlobalObject):
28458         * runtime/JSLock.cpp:
28459         (JSC):
28460         * runtime/JSVariableObject.h:
28461         (JSVariableObject):
28462         * runtime/MemoryStatistics.cpp:
28463         (JSC::globalMemoryStatistics):
28464
28465 2012-10-08  Kiran Muppala  <cmuppala@apple.com>
28466
28467         Throttle DOM timers on hidden pages.
28468         https://bugs.webkit.org/show_bug.cgi?id=98474
28469
28470         Reviewed by Maciej Stachowiak.
28471
28472         Add HIDDEN_PAGE_DOM_TIMER_THROTTLING feature define.
28473
28474         * Configurations/FeatureDefines.xcconfig:
28475
28476 2012-10-08  Michael Saboff  <msaboff@apple.com>
28477
28478         After r130344, OpaqueJSString() creates an empty string which should be a null string
28479         https://bugs.webkit.org/show_bug.cgi?id=98417
28480
28481         Reviewed by Sam Weinig.
28482
28483         Changed create() of a null string to return 0. This is the same behavior as before r130344.
28484
28485         * API/OpaqueJSString.cpp:
28486         (OpaqueJSString::create):
28487
28488 2012-10-07  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
28489
28490         Rename first/second to key/value in HashMap iterators
28491         https://bugs.webkit.org/show_bug.cgi?id=82784
28492
28493         Reviewed by Eric Seidel.
28494
28495         * API/JSCallbackObject.h:
28496         (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty):
28497         (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty):
28498         (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren):
28499         * API/JSCallbackObjectFunctions.h:
28500         (JSC::::getOwnNonIndexPropertyNames):
28501         * API/JSClassRef.cpp:
28502         (OpaqueJSClass::~OpaqueJSClass):
28503         (OpaqueJSClassContextData::OpaqueJSClassContextData):
28504         (OpaqueJSClass::contextData):
28505         * bytecode/CodeBlock.cpp:
28506         (JSC::CodeBlock::dump):
28507         (JSC::EvalCodeCache::visitAggregate):
28508         (JSC::CodeBlock::nameForRegister):
28509         * bytecode/JumpTable.h:
28510         (JSC::StringJumpTable::offsetForValue):
28511         (JSC::StringJumpTable::ctiForValue):
28512         * bytecode/LazyOperandValueProfile.cpp:
28513         (JSC::LazyOperandValueProfileParser::getIfPresent):
28514         * bytecode/SamplingTool.cpp:
28515         (JSC::SamplingTool::dump):
28516         * bytecompiler/BytecodeGenerator.cpp:
28517         (JSC::BytecodeGenerator::addVar):
28518         (JSC::BytecodeGenerator::addGlobalVar):
28519         (JSC::BytecodeGenerator::addConstant):
28520         (JSC::BytecodeGenerator::addConstantValue):
28521         (JSC::BytecodeGenerator::emitLoad):
28522         (JSC::BytecodeGenerator::addStringConstant):
28523         (JSC::BytecodeGenerator::emitLazyNewFunction):
28524         * bytecompiler/NodesCodegen.cpp:
28525         (JSC::PropertyListNode::emitBytecode):
28526         * debugger/Debugger.cpp:
28527         * dfg/DFGArgumentsSimplificationPhase.cpp:
28528         (JSC::DFG::ArgumentsSimplificationPhase::run):
28529         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
28530         (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
28531         (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
28532         (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
28533         * dfg/DFGAssemblyHelpers.cpp:
28534         (JSC::DFG::AssemblyHelpers::decodedCodeMapFor):
28535         * dfg/DFGByteCodeCache.h:
28536         (JSC::DFG::ByteCodeCache::~ByteCodeCache):
28537         (JSC::DFG::ByteCodeCache::get):
28538         * dfg/DFGByteCodeParser.cpp:
28539         (JSC::DFG::ByteCodeParser::cellConstant):
28540         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
28541         * dfg/DFGStructureCheckHoistingPhase.cpp:
28542         (JSC::DFG::StructureCheckHoistingPhase::run):
28543         (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
28544         (JSC::DFG::StructureCheckHoistingPhase::noticeClobber):
28545         * heap/Heap.cpp:
28546         (JSC::Heap::markProtectedObjects):
28547         * heap/Heap.h:
28548         (JSC::Heap::forEachProtectedCell):
28549         * heap/JITStubRoutineSet.cpp:
28550         (JSC::JITStubRoutineSet::markSlow):
28551         (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
28552         * heap/SlotVisitor.cpp:
28553         (JSC::SlotVisitor::internalAppend):
28554         * heap/Weak.h:
28555         (JSC::weakRemove):
28556         * jit/JIT.cpp:
28557         (JSC::JIT::privateCompile):
28558         * jit/JITStubs.cpp:
28559         (JSC::JITThunks::ctiStub):
28560         * parser/Parser.cpp:
28561         (JSC::::parseStrictObjectLiteral):
28562         * profiler/Profile.cpp:
28563         (JSC::functionNameCountPairComparator):
28564         (JSC::Profile::debugPrintDataSampleStyle):
28565         * runtime/Identifier.cpp:
28566         (JSC::Identifier::add):
28567         * runtime/JSActivation.cpp:
28568         (JSC::JSActivation::getOwnNonIndexPropertyNames):
28569         (JSC::JSActivation::symbolTablePutWithAttributes):
28570         * runtime/JSArray.cpp:
28571         (JSC::JSArray::setLength):
28572         * runtime/JSObject.cpp:
28573         (JSC::JSObject::getOwnPropertySlotByIndex):
28574         (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):
28575         (JSC::JSObject::deletePropertyByIndex):
28576         (JSC::JSObject::getOwnPropertyNames):
28577         (JSC::JSObject::defineOwnIndexedProperty):
28578         (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
28579         (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
28580         (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):
28581         (JSC::JSObject::getOwnPropertyDescriptor):
28582         * runtime/JSSymbolTableObject.cpp:
28583         (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames):
28584         * runtime/JSSymbolTableObject.h:
28585         (JSC::symbolTableGet):
28586         (JSC::symbolTablePut):
28587         (JSC::symbolTablePutWithAttributes):
28588         * runtime/RegExpCache.cpp:
28589         (JSC::RegExpCache::invalidateCode):
28590         * runtime/SparseArrayValueMap.cpp:
28591         (JSC::SparseArrayValueMap::putEntry):
28592         (JSC::SparseArrayValueMap::putDirect):
28593         (JSC::SparseArrayValueMap::visitChildren):
28594         * runtime/WeakGCMap.h:
28595         (JSC::WeakGCMap::clear):
28596         (JSC::WeakGCMap::set):
28597         * tools/ProfileTreeNode.h:
28598         (JSC::ProfileTreeNode::sampleChild):
28599         (JSC::ProfileTreeNode::childCount):
28600         (JSC::ProfileTreeNode::dumpInternal):
28601         (JSC::ProfileTreeNode::compareEntries):
28602
28603 2012-10-05  Mark Hahnenberg  <mhahnenberg@apple.com>
28604
28605         JSC should have a way to gather and log Heap memory use and pause times
28606         https://bugs.webkit.org/show_bug.cgi?id=98431
28607
28608         Reviewed by Geoffrey Garen.
28609
28610         In order to improve our infrastructure for benchmark-driven development, we should
28611         have a centralized method of gathering and logging various statistics about the state
28612         of the JS heap. This would allow us to create and to use other tools to analyze the
28613         output of the VM after running various workloads.
28614
28615         The first two statistics that might be interesting is memory use by JSC and GC pause
28616         times. We can control whether this recording happens through the use of the Options
28617         class, allowing us to either use environment variables or command line flags.
28618
28619         * JavaScriptCore.xcodeproj/project.pbxproj:
28620         * heap/Heap.cpp:
28621         (JSC::Heap::collect): If we finish a collection and are still over our set GC heap size,
28622         we end the program immediately and report an error. Also added recording of pause times.
28623         * heap/Heap.h:
28624         (Heap):
28625         (JSC::Heap::shouldCollect): When we set a specific GC heap size through Options, we
28626         ignore all other heuristics on when we should collect and instead only ask if we're
28627         greater than the amount specified in the Option value. This allows us to view time/memory
28628         tradeoffs more clearly.
28629         * heap/HeapStatistics.cpp: Added.
28630         (JSC):
28631         (JSC::HeapStatistics::initialize):
28632         (JSC::HeapStatistics::recordGCPauseTime):
28633         (JSC::HeapStatistics::logStatistics):
28634         (JSC::HeapStatistics::exitWithFailure):
28635         (JSC::HeapStatistics::reportSuccess):
28636         (JSC::HeapStatistics::parseMemoryAmount):
28637         (StorageStatistics):
28638         (JSC::StorageStatistics::StorageStatistics):
28639         (JSC::StorageStatistics::operator()):
28640         (JSC::StorageStatistics::objectWithOutOfLineStorageCount):
28641         (JSC::StorageStatistics::objectCount):
28642         (JSC::StorageStatistics::storageSize):
28643         (JSC::StorageStatistics::storageCapacity):
28644         (JSC::HeapStatistics::showObjectStatistics): Moved the old showHeapStatistics (renamed to showObjectStatistics)
28645         to try to start collecting our various memory statistics gathering/reporting mechanisms scattered throughout the
28646         codebase into one place.
28647         * heap/HeapStatistics.h: Added.
28648         (JSC):
28649         (HeapStatistics):
28650         * jsc.cpp:
28651         (main):
28652         * runtime/InitializeThreading.cpp:
28653         (JSC::initializeThreadingOnce): We need to initialize our data structures for recording
28654         statistics if necessary.
28655         * runtime/Options.cpp: Add new Options for the various types of statistics we'll be gathering.
28656         (JSC::parse):
28657         (JSC):
28658         (JSC::Options::initialize): Initialize the various new options using environment variables.
28659         (JSC::Options::dumpOption):
28660         * runtime/Options.h:
28661         (JSC):
28662
28663 2012-10-04  Rik Cabanier  <cabanier@adobe.com>
28664
28665         Turn Compositing on by default in WebKit build
28666         https://bugs.webkit.org/show_bug.cgi?id=98315
28667
28668         Reviewed by Simon Fraser.
28669
28670         enable -webkit-blend-mode on trunk.
28671
28672         * Configurations/FeatureDefines.xcconfig:
28673
28674 2012-10-04  Michael Saboff  <msaboff@apple.com>
28675
28676         Crash in Safari at com.apple.JavaScriptCore: WTF::StringImpl::is8Bit const + 12
28677         https://bugs.webkit.org/show_bug.cgi?id=98433
28678
28679         Reviewed by Jessie Berlin.
28680
28681         The problem is due to a String with a null StringImpl (i.e. a null string).
28682         Added a length check before the is8Bit() check since length() checks for a null StringImpl.  Changed the
28683         characters16() call to characters() since it can handle a null StringImpl as well.
28684
28685         * API/JSValueRef.cpp:
28686         (JSValueMakeFromJSONString):
28687
28688 2012-10-04  Benjamin Poulain  <bpoulain@apple.com>
28689
28690         Use copyLCharsFromUCharSource() for IdentifierLCharFromUCharTranslator translation
28691         https://bugs.webkit.org/show_bug.cgi?id=98335
28692
28693         Reviewed by Michael Saboff.
28694
28695         Michael Saboff added an optimized version of UChar->LChar conversion in r125846.
28696         Use this function in JSC::Identifier.
28697
28698         * runtime/Identifier.cpp:
28699         (JSC::IdentifierLCharFromUCharTranslator::translate):
28700
28701 2012-10-04  Michael Saboff  <msaboff@apple.com>
28702
28703         After r130344, OpaqueJSString() creates a empty string which should be a null string
28704         https://bugs.webkit.org/show_bug.cgi?id=98417
28705
28706         Reviewed by Alexey Proskuryakov.
28707
28708         Removed the setting of enclosed string to an empty string from default constructor.
28709         Before changeset r130344, the semantic was the default constructor produced a null
28710         string.
28711
28712         * API/OpaqueJSString.h:
28713         (OpaqueJSString::OpaqueJSString):
28714
28715 2012-10-04  Csaba Osztrogonác  <ossy@webkit.org>
28716
28717         [Qt] Add missing LLInt dependencies to the build system
28718         https://bugs.webkit.org/show_bug.cgi?id=98394
28719
28720         Reviewed by Geoffrey Garen.
28721
28722         * DerivedSources.pri:
28723         * LLIntOffsetsExtractor.pro:
28724
28725 2012-10-03  Geoffrey Garen  <ggaren@apple.com>
28726
28727         Next step toward fixing Windows: add new symbol.
28728
28729         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
28730
28731 2012-10-03  Geoffrey Garen  <ggaren@apple.com>
28732
28733         First step toward fixing Windows: remove old symbol.
28734
28735         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
28736
28737 2012-10-03  Geoffrey Garen  <ggaren@apple.com>
28738
28739         Removed the assumption that "final" objects have a fixed number of inline slots
28740         https://bugs.webkit.org/show_bug.cgi?id=98332
28741
28742         Reviewed by Filip Pizlo.
28743
28744         This is a step toward object size inference.
28745
28746         I replaced the inline storage capacity constant with a data member per
28747         structure, set the the maximum supported value for the constant to 100,
28748         then fixed what broke. (Note that even though this patch increases the
28749         theoretical maximum inline capacity, it doesn't change any actual inline
28750         capacity.)
28751
28752         * dfg/DFGSpeculativeJIT32_64.cpp:
28753         (JSC::DFG::SpeculativeJIT::compile):
28754         * dfg/DFGSpeculativeJIT64.cpp:
28755         (JSC::DFG::SpeculativeJIT::compile):
28756         * jit/JITPropertyAccess.cpp:
28757         (JSC::JIT::compileGetDirectOffset): These functions just get a rename:
28758         the constant they need is the first out of line offset along the offset
28759         number line, which is not necessarily the same thing (and is, in this
28760         patch, never the same thing) as the inline capacity of any given object.
28761
28762         (JSC::JIT::emit_op_get_by_pname):
28763         * jit/JITPropertyAccess32_64.cpp: This function changes functionality,
28764         since it needs to convert from the abstract offset number line to an
28765         actual offset in memory, and it can't assume that inline and out-of-line
28766         offsets are contiguous on the number line.
28767
28768         (JSC::JIT::compileGetDirectOffset): Updated for rename.
28769
28770         (JSC::JIT::emit_op_get_by_pname): Same as emit_op_get_by_pname above.
28771
28772         * llint/LowLevelInterpreter.asm: Updated to mirror changes in PropertyOffset.h,
28773         since we duplicate values from there.
28774
28775         * llint/LowLevelInterpreter32_64.asm:
28776         * llint/LowLevelInterpreter64.asm: Just like the JIT, most things are just
28777         renames, and get_by_pname changes to do more math. I also standardized
28778         offset calculations to use a hard-coded "-2", to match the JIT. This
28779         isn't really better, but it makes global search and replace easier,
28780         should we choose to refactor this code not to hard-code constants.
28781
28782         I also renamed loadPropertyAtVariableOffsetKnownNotFinal to
28783         loadPropertyAtVariableOffsetKnownNotInline in order to sever the assumption
28784         that inline capacity is tied to object type, and I changed the 64bit LLInt
28785         to use this -- not using this previously seems to have been an oversight.
28786
28787         * runtime/JSObject.cpp:
28788         (JSC::JSObject::visitChildren):
28789         (JSC::JSFinalObject::visitChildren):
28790         * runtime/JSObject.h:
28791         (JSC::JSObject::offsetForLocation):
28792         (JSNonFinalObject):
28793         (JSC::JSFinalObject::createStructure):
28794         (JSFinalObject):
28795         (JSC::JSFinalObject::finishCreation): Updated for above changes.
28796
28797         * runtime/JSPropertyNameIterator.h:
28798         (JSPropertyNameIterator):
28799         (JSC::JSPropertyNameIterator::finishCreation): Store the inline capacity
28800         of our object, since it's not a constant.
28801
28802         (JSC::JSPropertyNameIterator::getOffset): Removed. This function was
28803         wrong. Luckily, it was also unused, since the C++ interpreter is gone.
28804
28805         * runtime/PropertyMapHashTable.h:
28806         (PropertyTable): Use a helper function instead of hard-coding assumptions
28807         about object types.
28808
28809         (JSC::PropertyTable::nextOffset):
28810         * runtime/PropertyOffset.h:
28811         (JSC):
28812         (JSC::checkOffset):
28813         (JSC::validateOffset):
28814         (JSC::isInlineOffset):
28815         (JSC::numberOfSlotsForLastOffset):
28816         (JSC::propertyOffsetFor): Refactored these functions to take inline capacity
28817         as an argument, since it's not fixed at compile time anymore.
28818
28819         * runtime/Structure.cpp:
28820         (JSC::Structure::Structure):
28821         (JSC::Structure::flattenDictionaryStructure):
28822         (JSC::Structure::putSpecificValue):
28823         * runtime/Structure.h:
28824         (Structure):
28825         (JSC::Structure::outOfLineCapacity):
28826         (JSC::Structure::hasInlineStorage):
28827         (JSC::Structure::inlineCapacity):
28828         (JSC::Structure::inlineSize):
28829         (JSC::Structure::firstValidOffset):
28830         (JSC::Structure::lastValidOffset):
28831         (JSC::Structure::create): Removed some hard-coded assumptions about inline
28832         capacity and object type, and replaced with more liberal use of helper functions.
28833
28834 2012-10-03  Michael Saboff  <msaboff@apple.com>
28835
28836         OpaqueJSString doesn't optimally handle 8 bit strings
28837         https://bugs.webkit.org/show_bug.cgi?id=98300
28838
28839         Reviewed by Geoffrey Garen.
28840
28841         Change OpaqueJSString to store and manage a String instead of a UChar buffer.
28842         The member string is a copy of any string used during creation.
28843
28844         * API/OpaqueJSString.cpp:
28845         (OpaqueJSString::create):
28846         (OpaqueJSString::identifier):
28847         * API/OpaqueJSString.h:
28848         (OpaqueJSString::characters):
28849         (OpaqueJSString::length):
28850         (OpaqueJSString::string):
28851         (OpaqueJSString::OpaqueJSString):
28852         (OpaqueJSString):
28853
28854 2012-10-03  Filip Pizlo  <fpizlo@apple.com>
28855
28856         Array.splice should be fast when it is used to remove elements other than the very first
28857         https://bugs.webkit.org/show_bug.cgi?id=98236
28858
28859         Reviewed by Michael Saboff.
28860
28861         Applied the same technique that was used to optimize the unshift case of splice in
28862         http://trac.webkit.org/changeset/129676.  This is a >20x speed-up on programs that
28863         use splice for element removal.
28864
28865         * runtime/ArrayPrototype.cpp:
28866         (JSC::shift):
28867         * runtime/JSArray.cpp:
28868         (JSC::JSArray::shiftCount):
28869         * runtime/JSArray.h:
28870         (JSArray):
28871
28872 2012-09-16  Mark Hahnenberg  <mhahnenberg@apple.com>
28873
28874         Delayed structure sweep can leak structures without bound
28875         https://bugs.webkit.org/show_bug.cgi?id=96546
28876
28877         Reviewed by Geoffrey Garen.
28878
28879         This patch gets rid of the separate Structure allocator in the MarkedSpace and adds two new destructor-only
28880         allocators. We now have separate allocators for our three types of objects: those objects with no destructors,
28881         those objects with destructors and with immortal structures, and those objects with destructors that don't have
28882         immortal structures. All of the objects of the third type (destructors without immortal structures) now
28883         inherit from a new class named JSDestructibleObject (which in turn is a subclass of JSNonFinalObject), which stores
28884         the ClassInfo for these classes at a fixed offset for safe retrieval during sweeping/destruction.
28885
28886         * API/JSCallbackConstructor.cpp: Use JSDestructibleObject for JSCallbackConstructor.
28887         (JSC):
28888         (JSC::JSCallbackConstructor::JSCallbackConstructor):
28889         * API/JSCallbackConstructor.h:
28890         (JSCallbackConstructor):
28891         * API/JSCallbackObject.cpp: Inherit from JSDestructibleObject for normal JSCallbackObjects and use a finalizer for
28892         JSCallbackObject<JSGlobalObject>, since JSGlobalObject also uses a finalizer.
28893         (JSC):
28894         (JSC::::create): We need to move the create function for JSCallbackObject<JSGlobalObject> out of line so we can add
28895         the finalizer for it. We don't want to add the finalizer is something like finishCreation in case somebody decides
28896         to subclass this. We use this same technique for many other subclasses of JSGlobalObject.
28897         (JSC::::createStructure):
28898         * API/JSCallbackObject.h:
28899         (JSCallbackObject):
28900         (JSC):
28901         * API/JSClassRef.cpp: Change all the JSCallbackObject<JSNonFinalObject> to use JSDestructibleObject instead.
28902         (OpaqueJSClass::prototype):
28903         * API/JSObjectRef.cpp: Ditto.
28904         (JSObjectMake):
28905         (JSObjectGetPrivate):
28906         (JSObjectSetPrivate):
28907         (JSObjectGetPrivateProperty):
28908         (JSObjectSetPrivateProperty):
28909         (JSObjectDeletePrivateProperty):
28910         * API/JSValueRef.cpp: Ditto.
28911         (JSValueIsObjectOfClass):
28912         * API/JSWeakObjectMapRefPrivate.cpp: Ditto.
28913         * JSCTypedArrayStubs.h:
28914         (JSC):
28915         * JavaScriptCore.xcodeproj/project.pbxproj:
28916         * dfg/DFGSpeculativeJIT.h: Use the proper allocator type when doing inline allocation in the DFG.
28917         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
28918         (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject):
28919         * heap/Heap.cpp:
28920         (JSC):
28921         * heap/Heap.h: Add accessors for the various types of allocators now. Also remove the isSafeToSweepStructures function
28922         since it's always safe to sweep Structures now.
28923         (JSC::Heap::allocatorForObjectWithNormalDestructor):
28924         (JSC::Heap::allocatorForObjectWithImmortalStructureDestructor):
28925         (Heap):
28926         (JSC::Heap::allocateWithNormalDestructor):
28927         (JSC):
28928         (JSC::Heap::allocateWithImmortalStructureDestructor):
28929         * heap/IncrementalSweeper.cpp: Remove all the logic to detect when it's safe to sweep Structures from the
28930         IncrementalSweeper since it's always safe to sweep Structures now.
28931         (JSC::IncrementalSweeper::IncrementalSweeper):
28932         (JSC::IncrementalSweeper::sweepNextBlock):
28933         (JSC::IncrementalSweeper::startSweeping):
28934         (JSC::IncrementalSweeper::willFinishSweeping):
28935         (JSC):
28936         * heap/IncrementalSweeper.h:
28937         (IncrementalSweeper):
28938         * heap/MarkedAllocator.cpp: Remove the logic that was preventing us from sweeping Structures if it wasn't safe. Add
28939         tracking of the specific destructor type of allocator.
28940         (JSC::MarkedAllocator::tryAllocateHelper):
28941         (JSC::MarkedAllocator::allocateBlock):
28942         * heap/MarkedAllocator.h:
28943         (JSC::MarkedAllocator::destructorType):
28944         (MarkedAllocator):
28945         (JSC::MarkedAllocator::MarkedAllocator):
28946         (JSC::MarkedAllocator::init):
28947         * heap/MarkedBlock.cpp: Add all the destructor type stuff to MarkedBlocks so that we do the right thing when sweeping.
28948         We also use the stored destructor type to determine the right thing to do in all JSCell::classInfo() calls.
28949         (JSC::MarkedBlock::create):
28950         (JSC::MarkedBlock::MarkedBlock):
28951         (JSC):
28952         (JSC::MarkedBlock::specializedSweep):
28953         (JSC::MarkedBlock::sweep):
28954         (JSC::MarkedBlock::sweepHelper):
28955         * heap/MarkedBlock.h:
28956         (JSC):
28957         (JSC::MarkedBlock::allocator):
28958         (JSC::MarkedBlock::destructorType):
28959         * heap/MarkedSpace.cpp: Add the new destructor allocators to MarkedSpace.
28960         (JSC::MarkedSpace::MarkedSpace):
28961         (JSC::MarkedSpace::resetAllocators):
28962         (JSC::MarkedSpace::canonicalizeCellLivenessData):
28963         (JSC::MarkedSpace::isPagedOut):
28964         (JSC::MarkedSpace::freeBlock):
28965         * heap/MarkedSpace.h:
28966         (MarkedSpace):
28967         (JSC::MarkedSpace::immortalStructureDestructorAllocatorFor):
28968         (JSC::MarkedSpace::normalDestructorAllocatorFor):
28969         (JSC::MarkedSpace::allocateWithImmortalStructureDestructor):
28970         (JSC::MarkedSpace::allocateWithNormalDestructor):
28971         (JSC::MarkedSpace::forEachBlock):
28972         * heap/SlotVisitor.cpp: Add include because the symbol was needed in an inlined function.
28973         * jit/JIT.h: Make sure we use the correct allocator when doing inline allocations in the baseline JIT.
28974         * jit/JITInlineMethods.h:
28975         (JSC::JIT::emitAllocateBasicJSObject):
28976         (JSC::JIT::emitAllocateJSFinalObject):
28977         (JSC::JIT::emitAllocateJSArray):
28978         * jsc.cpp:
28979         (GlobalObject::create): Add finalizer here since JSGlobalObject needs to use a finalizer instead of inheriting from
28980         JSDestructibleObject.
28981         * runtime/Arguments.cpp: Inherit from JSDestructibleObject.
28982         (JSC):
28983         * runtime/Arguments.h:
28984         (Arguments):
28985         (JSC::Arguments::Arguments):
28986         * runtime/ErrorPrototype.cpp: Added an assert to make sure we have a trivial destructor.
28987         (JSC):
28988         * runtime/Executable.h: Indicate that all of the Executable* classes have immortal Structures.
28989         (JSC):
28990         * runtime/InternalFunction.cpp: Inherit from JSDestructibleObject.
28991         (JSC):
28992         (JSC::InternalFunction::InternalFunction):
28993         * runtime/InternalFunction.h:
28994         (InternalFunction):
28995         * runtime/JSCell.h: Added two static bools, needsDestruction and hasImmortalStructure, that classes can override
28996         to indicate at compile time which part of the heap they should be allocated in.
28997         (JSC::allocateCell): Use the appropriate allocator depending on the destructor type.
28998         * runtime/JSDestructibleObject.h: Added. New class that stores the ClassInfo of any subclass so that it can be
28999         accessed safely when the object is being destroyed.
29000         (JSC):
29001         (JSDestructibleObject):
29002         (JSC::JSDestructibleObject::classInfo):
29003         (JSC::JSDestructibleObject::JSDestructibleObject):
29004         (JSC::JSCell::classInfo): Checks the current MarkedBlock to see where it should get the ClassInfo from so that it's always safe.
29005         * runtime/JSGlobalObject.cpp: JSGlobalObject now uses a finalizer instead of a destructor so that it can avoid forcing all
29006         of its relatives in the inheritance hierarchy (e.g. JSScope) to use destructors as well.
29007         (JSC::JSGlobalObject::reset):
29008         * runtime/JSGlobalObject.h:
29009         (JSGlobalObject):
29010         (JSC::JSGlobalObject::createRareDataIfNeeded): Since we always create a finalizer now, we don't have to worry about adding one
29011         for the m_rareData field when it's created.
29012         (JSC::JSGlobalObject::create):
29013         (JSC):
29014         * runtime/JSGlobalThis.h: Inherit from JSDestructibleObject.
29015         (JSGlobalThis):
29016         (JSC::JSGlobalThis::JSGlobalThis):
29017         * runtime/JSPropertyNameIterator.h: Has an immortal Structure.
29018         (JSC):
29019         * runtime/JSScope.cpp:
29020         (JSC):
29021         * runtime/JSString.h: Has an immortal Structure.
29022         (JSC):
29023         * runtime/JSWrapperObject.h: Inherit from JSDestructibleObject.
29024         (JSWrapperObject):
29025         (JSC::JSWrapperObject::JSWrapperObject):
29026         * runtime/MathObject.cpp: Cleaning up some of the inheritance stuff.
29027         (JSC):
29028         * runtime/NameInstance.h: Inherit from JSDestructibleObject.
29029         (NameInstance):
29030         * runtime/RegExp.h: Has immortal Structure.
29031         (JSC):
29032         * runtime/RegExpObject.cpp: Inheritance cleanup.
29033         (JSC):
29034         * runtime/SparseArrayValueMap.h: Has immortal Structure.
29035         (JSC):
29036         * runtime/Structure.h: Has immortal Structure.
29037         (JSC):
29038         * runtime/StructureChain.h: Ditto.
29039         (JSC):
29040         * runtime/SymbolTable.h: Ditto.
29041         (SharedSymbolTable):
29042         (JSC):
29043
29044 == Rolled over to ChangeLog-2012-10-02 ==