Source/JavaScriptCore/ChangeLog

   1 2012-09-11  Mark Hahnenberg  <mhahnenberg@apple.com>
   2
   3         IncrementalSweeper should not sweep/free Zapped blocks
   4         https://bugs.webkit.org/show_bug.cgi?id=96464
   5
   6         Reviewed by Filip Pizlo.
   7
   8         This is not beneficial in terms of performance because there isn't any way a block can emerge
   9         in the Zapped state from a call to Heap::collect() unless we run an eager sweep on it, in which
  10         case we've already run all the destructors we possibly can. This also causes bugs since we don't
  11         take zapped-ness into account when determining whether or not a block is empty to free it. The
  12         incremental sweeper can then accidentally free blocks that it thinks are empty but are in fact
  13         zapped with still-live objects in them.
  14
  15         * heap/MarkedBlock.h:
  16         (JSC::MarkedBlock::needsSweeping): It is only valid to sweep a block if it is in the Marked state.
  17
  18 2012-09-05  Mark Hahnenberg  <mhahnenberg@apple.com>
  19
  20         Remove use of JSCell::classInfoOffset() from tryCacheGetByID
  21         https://bugs.webkit.org/show_bug.cgi?id=95860
  22
  23         Reviewed by Oliver Hunt.
  24
  25         We should just do the indirection through the Structure instead.
  26
  27         * dfg/DFGRepatch.cpp:
  28         (JSC::DFG::tryCacheGetByID):
  29
  30 2012-09-05  Mark Hahnenberg  <mhahnenberg@apple.com>
  31
  32         Remove use of JSCell::classInfoOffset() from virtualForThunkGenerator
  33         https://bugs.webkit.org/show_bug.cgi?id=95821
  34
  35         Reviewed by Oliver Hunt.
  36
  37         We can replace the load of the ClassInfo from the object with a load from the Structure.
  38
  39         * dfg/DFGThunks.cpp:
  40         (JSC::DFG::virtualForThunkGenerator):
  41
  42 2013-03-11  Oliver Hunt  <oliver@apple.com>
  43
  44         Make SegmentedVector Noncopyable
  45         https://bugs.webkit.org/show_bug.cgi?id=112059
  46
  47         Reviewed by Geoffrey Garen.
  48
  49         Copying a SegmentedVector is very expensive, and really shouldn't
  50         be necessary.  So I've taken the one place where we currently copy
  51         and replaced it with a regular Vector, and replaced the address
  52         dependent logic with a indexing ref instead.
  53
  54         * bytecompiler/BytecodeGenerator.cpp:
  55         (JSC::BytecodeGenerator::newLabelScope):
  56         (JSC::BytecodeGenerator::emitComplexJumpScopes):
  57         * bytecompiler/BytecodeGenerator.h:
  58         (BytecodeGenerator):
  59         * bytecompiler/LabelScope.h:
  60         (JSC):
  61         (JSC::LabelScopePtr::LabelScopePtr):
  62         (LabelScopePtr):
  63         (JSC::LabelScopePtr::operator=):
  64         (JSC::LabelScopePtr::~LabelScopePtr):
  65         (JSC::LabelScopePtr::operator*):
  66         (JSC::LabelScopePtr::operator->):
  67         * bytecompiler/NodesCodegen.cpp:
  68         (JSC::DoWhileNode::emitBytecode):
  69         (JSC::WhileNode::emitBytecode):
  70         (JSC::ForNode::emitBytecode):
  71         (JSC::ForInNode::emitBytecode):
  72         (JSC::SwitchNode::emitBytecode):
  73         (JSC::LabelNode::emitBytecode):
  74
  75 2012-11-20  Yong Li  <yoli@rim.com>
  76
  77         [ARMv7] Neither linkCall() nor linkPointer() should flush code.
  78         https://bugs.webkit.org/show_bug.cgi?id=99213
  79
  80         Reviewed by George Staikos.
  81
  82         LinkBuffer doesn't need to flush code during linking. It will
  83         eventually flush the whole executable. Fixing this gives >%5
  84         sunspider boost (on QNX).
  85
  86         Also make replaceWithLoad() and replaceWithAddressComputation() flush
  87         only when necessary.
  88
  89         * assembler/ARMv7Assembler.h:
  90         (JSC::ARMv7Assembler::linkCall):
  91         (JSC::ARMv7Assembler::linkPointer):
  92         (JSC::ARMv7Assembler::relinkCall):
  93         (JSC::ARMv7Assembler::repatchInt32):
  94         (JSC::ARMv7Assembler::repatchPointer):
  95         (JSC::ARMv7Assembler::replaceWithLoad): Flush only after it did write.
  96         (JSC::ARMv7Assembler::replaceWithAddressComputation): Flush only after it did write.
  97         (JSC::ARMv7Assembler::setInt32):
  98         (JSC::ARMv7Assembler::setPointer):
  99
 100 2012-08-30  Byungwoo Lee  <bw80.lee@samsung.com>
 101
 102         Build warning : -Wsign-compare on DFGByteCodeParser.cpp.
 103         https://bugs.webkit.org/show_bug.cgi?id=95418
 104
 105         Reviewed by Filip Pizlo.
 106
 107         There is a build warning '-Wsign-compare' on
 108         findArgumentPositionForLocal() in DFGByteCodeParser.cpp.
 109
 110         For removing this warning, casting statement is added explicitly.
 111
 112         * dfg/DFGByteCodeParser.cpp:
 113         (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
 114         (JSC::DFG::ByteCodeParser::findArgumentPosition):
 115
 116 2012-11-13  Cosmin Truta  <ctruta@rim.com>
 117
 118         Uninitialized fields in class JSLock
 119         https://bugs.webkit.org/show_bug.cgi?id=101695
 120
 121         Reviewed by Mark Hahnenberg.
 122
 123         Initialize JSLock::m_ownerThread and JSLock::m_lockDropDepth.
 124
 125         * runtime/JSLock.cpp:
 126         (JSC::JSLock::JSLock):
 127
 128 2012-09-17  Filip Pizlo  <fpizlo@apple.com>
 129
 130         Unreviewed, fix a broken assertion in offlineasm.
 131
 132         * offlineasm/armv7.rb:
 133         * offlineasm/backends.rb:
 134
 135 2012-09-10  Thiago Marcos P. Santos  <thiago.santos@intel.com>
 136
 137         [CMake][EFL] Enable the LLInt
 138         https://bugs.webkit.org/show_bug.cgi?id=92682
 139
 140         Reviewed by Csaba Osztrogonác.
 141
 142         Generate the headers needed by LLint when LLint is enabled.
 143
 144         * CMakeLists.txt:
 145
 146 2012-09-09  Mark Lam  <mark.lam@apple.com>
 147
 148         Fixed a few llint C++ interpreter bugs.
 149         https://bugs.webkit.org/show_bug.cgi?id=96127.
 150
 151         Reviewed by Geoffrey Garen.
 152
 153         * llint/LLIntCLoop.h:
 154             CLoop::execute()'s bootstrapOpcodeId does not need a default
 155             value. There is no case when this function is called without
 156             that parameter being specified.
 157         * llint/LowLevelInterpreter.asm:
 158             Moved the dispatchAfterCall() call to where it is needed.
 159             For the C_LOOP back-end, it generates unreachable code.
 160         * llint/LowLevelInterpreter.cpp:
 161             #include <wtf/Assertions.h> because LLIntAssembly.h needs it.
 162         (JSC):
 163             Fixed bug in SIGN_BIT32() macro.
 164             Placate a MSVC warning for t0, and t1 being uninitialized.
 165         (JSC::CLoop::execute):
 166             The bootstrapOpcodeId arg should always be specified.
 167             MSVC doesn't like UNUSED_PARAM() for labels. Switch to using
 168                 the new UNUSED_LABEL() macro.
 169         * offlineasm/cloop.rb:
 170         * offlineasm/generate_offset_extractor.rb:
 171             Resolved a compiler warning found via MSVC.
 172
 173 2012-09-07  Sheriff Bot  <webkit.review.bot@gmail.com>
 174
 175         Unreviewed, rolling out r127938.
 176         http://trac.webkit.org/changeset/127938
 177         https://bugs.webkit.org/show_bug.cgi?id=96166
 178
 179         It broke the build (Requested by smfr on #webkit).
 180
 181         * llint/LowLevelInterpreter.cpp:
 182         (JSC):
 183         (JSC::CLoop::execute):
 184         * offlineasm/cloop.rb:
 185
 186 2012-09-07  Mark Lam  <mark.lam@apple.com>
 187
 188         Fix a llint C++ interpreter bugs.
 189         https://bugs.webkit.org/show_bug.cgi?id=96127.
 190
 191         Reviewed by Filip Pizlo.
 192
 193         * llint/LowLevelInterpreter.cpp:
 194         (JSC):
 195         (JSC::CLoop::execute):
 196         * offlineasm/cloop.rb:
 197
 198 2012-09-01  Mark Lam  <mark.lam@apple.com>
 199
 200         LLInt C loop backend.
 201         https://bugs.webkit.org/show_bug.cgi?id=91052.
 202
 203         Reviewed by Filip Pizlo.
 204
 205         * JavaScriptCore.xcodeproj/project.pbxproj:
 206         * bytecode/CodeBlock.cpp:
 207         (JSC::CodeBlock::dump):
 208         (JSC::CodeBlock::bytecodeOffset):
 209         * interpreter/Interpreter.cpp:
 210         (JSC::Interpreter::execute):
 211         (JSC::Interpreter::executeCall):
 212         (JSC::Interpreter::executeConstruct):
 213         (JSC):
 214         * interpreter/Interpreter.h:
 215         * jit/JITStubs.h:
 216         (JITStackFrame):
 217         (JSC):
 218         * llint/LLIntCLoop.cpp: Added.
 219         (JSC):
 220         (LLInt):
 221         (JSC::LLInt::CLoop::initialize):
 222         (JSC::LLInt::CLoop::catchRoutineFor):
 223         (JSC::LLInt::CLoop::hostCodeEntryFor):
 224         (JSC::LLInt::CLoop::jsCodeEntryWithArityCheckFor):
 225         (JSC::LLInt::CLoop::jsCodeEntryFor):
 226         * llint/LLIntCLoop.h: Added.
 227         (JSC):
 228         (LLInt):
 229         (CLoop):
 230         * llint/LLIntData.cpp:
 231         (JSC::LLInt::initialize):
 232         * llint/LLIntData.h:
 233         (JSC):
 234         * llint/LLIntOfflineAsmConfig.h:
 235         * llint/LLIntOpcode.h:
 236         * llint/LLIntThunks.cpp:
 237         (LLInt):
 238         * llint/LowLevelInterpreter.asm:
 239         * llint/LowLevelInterpreter.cpp:
 240         (LLInt):
 241         (JSC::LLInt::Ints2Double):
 242         (JSC):
 243         (JSC::CLoop::execute):
 244         * llint/LowLevelInterpreter.h:
 245         (JSC):
 246         * llint/LowLevelInterpreter32_64.asm:
 247         * llint/LowLevelInterpreter64.asm:
 248         * offlineasm/asm.rb:
 249         * offlineasm/backends.rb:
 250         * offlineasm/cloop.rb: Added.
 251         * offlineasm/instructions.rb:
 252         * runtime/Executable.h:
 253         (ExecutableBase):
 254         (JSC::ExecutableBase::hostCodeEntryFor):
 255         (JSC::ExecutableBase::jsCodeEntryFor):
 256         (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor):
 257         (JSC::ExecutableBase::catchRoutineFor):
 258         (NativeExecutable):
 259         * runtime/JSValue.h:
 260         (JSC):
 261         (LLInt):
 262         (JSValue):
 263         * runtime/JSValueInlineMethods.h:
 264         (JSC):
 265         (JSC::JSValue::JSValue):
 266         * runtime/Options.cpp:
 267         (JSC::Options::initialize):
 268
 269 2012-08-31  Mark Lam  <mark.lam@apple.com>
 270
 271         Refactor LLInt and supporting code in preparation for the C Loop backend.
 272         https://bugs.webkit.org/show_bug.cgi?id=95531.
 273
 274         Reviewed by Filip Pizlo.
 275
 276         * bytecode/GetByIdStatus.cpp:
 277         (JSC::GetByIdStatus::computeFromLLInt):
 278         * bytecode/PutByIdStatus.cpp:
 279         (JSC::PutByIdStatus::computeFromLLInt):
 280         * jit/JITExceptions.cpp:
 281         (JSC::genericThrow): Use ExecutableBase::catchRoutineFor() to fetch
 282             fetch the catch routine for a thrown exception.  This will allow
 283             us to redefine that for the C loop later, and still keep this
 284             code readable.
 285         * llint/LLIntOfflineAsmConfig.h: Moved ASM macros to
 286             LowLevelInterpreter.cpp which is the only place they are used. This
 287             will make it more convenient to redefine them for the C loop later.
 288         * llint/LLIntSlowPaths.cpp:
 289         (JSC::LLInt::setUpCall): Use ExecutableBase's hostCodeEntry()
 290             jsCodeEntryFor(), and jsCodeWithArityCheckEntryFor() for computing
 291             the entry points to functions being called.
 292         * llint/LLIntSlowPaths.h:
 293         (SlowPathReturnType):
 294         (JSC::LLInt::encodeResult):
 295         (LLInt):
 296         (JSC::LLInt::decodeResult): Added.  Needed by LLInt C Loop later.
 297         * llint/LowLevelInterpreter.asm:
 298         * llint/LowLevelInterpreter.cpp:
 299         * llint/LowLevelInterpreter32_64.asm:
 300         * llint/LowLevelInterpreter64.asm:
 301         * offlineasm/asm.rb: Disambiguate between opcodes and other labels.
 302         * offlineasm/config.rb:
 303         * runtime/Executable.h:
 304         (JSC::ExecutableBase::hostCodeEntryFor): Added.
 305         (ExecutableBase):
 306         (JSC::ExecutableBase::jsCodeEntryFor): Added.
 307         (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor): Added.
 308         (JSC::ExecutableBase::catchRoutineFor): Added.
 309         * runtime/JSValueInlineMethods.h:
 310         (JSC):
 311
 312 2012-08-30  Mark Lam  <mark.lam@apple.com>
 313
 314         Render unto #ifdef's that which belong to them.
 315         https://bugs.webkit.org/show_bug.cgi?id=95482.
 316
 317         Reviewed by Filip Pizlo.
 318
 319         Refining / disambiguating between #ifdefs and adding some. For
 320         example, ENABLE(JIT) is conflated with ENABLE(LLINT) in some places.
 321         Also, we need to add ENABLE(COMPUTED_GOTO_OPCODES) to indicate that we
 322         want interpreted opcodes to use COMPUTED GOTOs apart from ENABLE(LLINT)
 323         and ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER). Also cleaned up #ifdefs
 324         in certain places which were previously incorrect.
 325
 326         * bytecode/CodeBlock.cpp:
 327         (JSC):
 328         (JSC::CodeBlock::bytecodeOffset):
 329         * bytecode/CodeBlock.h:
 330         (CodeBlock):
 331         * bytecode/Opcode.h:
 332         (JSC::padOpcodeName):
 333         * config.h:
 334         * dfg/DFGOperations.cpp:
 335         * interpreter/AbstractPC.cpp:
 336         (JSC::AbstractPC::AbstractPC):
 337         * interpreter/CallFrame.h:
 338         (ExecState):
 339         * interpreter/Interpreter.cpp:
 340         (JSC::Interpreter::~Interpreter):
 341         (JSC::Interpreter::initialize):
 342         (JSC::Interpreter::isOpcode):
 343         (JSC::Interpreter::unwindCallFrame):
 344         (JSC::getLineNumberForCallFrame):
 345         (JSC::getCallerInfo):
 346         (JSC::Interpreter::execute):
 347         (JSC::Interpreter::executeCall):
 348         (JSC::Interpreter::executeConstruct):
 349         (JSC::Interpreter::privateExecute):
 350         * interpreter/Interpreter.h:
 351         (JSC::Interpreter::getOpcode):
 352         (JSC::Interpreter::getOpcodeID):
 353         (Interpreter):
 354         * jit/HostCallReturnValue.h:
 355         * jit/JITCode.h:
 356         (JITCode):
 357         * jit/JITExceptions.cpp:
 358         * jit/JITExceptions.h:
 359         * jit/JSInterfaceJIT.h:
 360         * llint/LLIntData.h:
 361         (JSC::LLInt::getOpcode):
 362         * llint/LLIntEntrypoints.cpp:
 363         (JSC::LLInt::getFunctionEntrypoint):
 364         (JSC::LLInt::getEvalEntrypoint):
 365         (JSC::LLInt::getProgramEntrypoint):
 366         * llint/LLIntOffsetsExtractor.cpp:
 367         (JSC::LLIntOffsetsExtractor::dummy):
 368         * llint/LLIntSlowPaths.cpp:
 369         (LLInt):
 370         * runtime/JSGlobalData.cpp:
 371         (JSC):
 372
 373 2012-08-23  Christophe Dumez  <christophe.dumez@intel.com>
 374
 375         Serialization of JavaScript values does not appear to respect new HTML5 Structured Clone semantics
 376         https://bugs.webkit.org/show_bug.cgi?id=65292
 377
 378         Reviewed by Oliver Hunt.
 379
 380         Add function to construct a StringObject from a JSValue.
 381         Similar functions already exist for NumberObject and
 382         BooleanObject for example.
 383
 384         Export several symbols so address linking errors in
 385         WebCore.
 386
 387         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 388         * runtime/BooleanObject.h:
 389         (BooleanObject):
 390         * runtime/NumberObject.h:
 391         (NumberObject):
 392         (JSC):
 393         * runtime/StringObject.cpp:
 394         (JSC::constructString):
 395         (JSC):
 396         * runtime/StringObject.h:
 397         (JSC):
 398
 399 2012-08-30  Mark Lam  <mark.lam@apple.com>
 400
 401         Fix broken classic intrpreter build.
 402         https://bugs.webkit.org/show_bug.cgi?id=95484.
 403
 404         Reviewed by Filip Pizlo.
 405
 406         * interpreter/Interpreter.cpp:
 407         (JSC::Interpreter::privateExecute):
 408
 409 2012-08-29  Mark Lam  <mark.lam@apple.com>
 410
 411         Refactoring LLInt::Data.
 412         https://bugs.webkit.org/show_bug.cgi?id=95316.
 413
 414         Reviewed by Geoff Garen.
 415
 416         This change allows its opcodeMap to be easily queried from any function
 417         without needing to go through a GlobalData object.  It also introduces
 418         the LLInt::getCodePtr() methods that will be used by the LLInt C loop
 419         later to redefine how llint symbols (opcodes and trampoline glue
 420         labels) get resolved.
 421
 422         * assembler/MacroAssemblerCodeRef.h:
 423         (MacroAssemblerCodePtr):
 424         (JSC::MacroAssemblerCodePtr::createLLIntCodePtr):
 425         (MacroAssemblerCodeRef):
 426         (JSC::MacroAssemblerCodeRef::createLLIntCodeRef):
 427         * bytecode/CodeBlock.cpp:
 428         (JSC::CodeBlock::adjustPCIfAtCallSite):
 429         (JSC::CodeBlock::bytecodeOffset):
 430         * bytecode/Opcode.h:
 431             Remove the 'const' to simplify things and avoid having to do
 432             additional casts and #ifdefs in many places.
 433         * bytecode/ResolveGlobalStatus.cpp:
 434         (JSC::computeForLLInt):
 435         * bytecompiler/BytecodeGenerator.cpp:
 436         (JSC::BytecodeGenerator::generate):
 437         * interpreter/Interpreter.cpp:
 438         (JSC::Interpreter::initialize):
 439         * interpreter/Interpreter.h:
 440         (Interpreter):
 441         * jit/JITExceptions.cpp:
 442         (JSC::genericThrow):
 443         * llint/LLIntData.cpp:
 444         (LLInt):
 445         (JSC::LLInt::initialize):
 446         * llint/LLIntData.h:
 447         (JSC):
 448         (LLInt):
 449         (Data):
 450         (JSC::LLInt::exceptionInstructions):
 451         (JSC::LLInt::opcodeMap):
 452         (JSC::LLInt::getOpcode):
 453         (JSC::LLInt::getCodePtr):
 454         (JSC::LLInt::Data::performAssertions):
 455         * llint/LLIntExceptions.cpp:
 456         (JSC::LLInt::returnToThrowForThrownException):
 457         (JSC::LLInt::returnToThrow):
 458         (JSC::LLInt::callToThrow):
 459         * llint/LLIntSlowPaths.cpp:
 460         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
 461         (JSC::LLInt::handleHostCall):
 462         * runtime/InitializeThreading.cpp:
 463         (JSC::initializeThreadingOnce): Initialize the singleton LLInt data.
 464         * runtime/JSGlobalData.cpp:
 465         (JSC::JSGlobalData::JSGlobalData):
 466         * runtime/JSGlobalData.h:
 467         (JSGlobalData): Removed the now unneeded LLInt::Data instance in
 468             JSGlobalData.
 469         * runtime/JSValue.h:
 470         (JSValue):
 471
 472 2012-08-24  Filip Pizlo  <fpizlo@apple.com>
 473
 474         Finally inlining should correctly track the catch context
 475         https://bugs.webkit.org/show_bug.cgi?id=94986
 476         <rdar://problem/11753784>
 477
 478         Reviewed by Sam Weinig.
 479
 480         This fixes two behaviors:
 481
 482         1) Throwing from a finally block. Previously, we would seem to reenter the finally
 483            block - though only once.
 484
 485         2) Executing a finally block from some nested context, for example due to a
 486            'continue', 'break', or 'return' in the try. This would execute the finally
 487            block in the context of of the try block, which could lead to either scope depth
 488            mismatches or reexecutions of the finally block on throw, similarly to (1) but
 489            for different reasons.
 490
 491         * bytecompiler/BytecodeGenerator.cpp:
 492         (JSC):
 493         (JSC::BytecodeGenerator::pushFinallyContext):
 494         (JSC::BytecodeGenerator::emitComplexJumpScopes):
 495         (JSC::BytecodeGenerator::pushTry):
 496         (JSC::BytecodeGenerator::popTryAndEmitCatch):
 497         * bytecompiler/BytecodeGenerator.h:
 498         (FinallyContext):
 499         (TryData):
 500         (JSC):
 501         (TryContext):
 502         (TryRange):
 503         (BytecodeGenerator):
 504         * bytecompiler/NodesCodegen.cpp:
 505         (JSC::TryNode::emitBytecode):
 506
 507 2012-08-28  Mark Lam  <mark.lam@apple.com>
 508
 509         Adding support for adding LLInt opcode extensions.  This will be needed
 510         by the LLInt C loop interpreter later.
 511         https://bugs.webkit.org/show_bug.cgi?id=95277.
 512
 513         Reviewed by Geoffrey Garen.
 514
 515         * JavaScriptCore.xcodeproj/project.pbxproj:
 516         * bytecode/Opcode.h:
 517         * llint/LLIntOpcode.h: Added.
 518         * llint/LowLevelInterpreter.h:
 519
 520 2012-08-28  Filip Pizlo  <fpizlo@apple.com>
 521
 522         LLInt should not rely on ordering of global labels
 523         https://bugs.webkit.org/show_bug.cgi?id=95221
 524
 525         Reviewed by Oliver Hunt.
 526
 527         * llint/LowLevelInterpreter.asm:
 528         * llint/LowLevelInterpreter32_64.asm:
 529         * llint/LowLevelInterpreter64.asm:
 530
 531 2012-08-20  Mark Lam  <mark.lam@apple.com>
 532
 533         Fix broken non-JIT build.
 534         https://bugs.webkit.org/show_bug.cgi?id=94564.
 535
 536         Reviewed by Filip Pizlo.
 537
 538         Added some UNUSED_PARAM() macros to make the compiler happy.
 539
 540         * runtime/Executable.cpp:
 541         (JSC::EvalExecutable::compileInternal):
 542         (JSC::ProgramExecutable::compileInternal):
 543         (JSC::FunctionExecutable::compileForCallInternal):
 544         (JSC::FunctionExecutable::compileForConstructInternal):
 545
 546 2012-08-20  Mark Lam  <mark.lam@apple.com>
 547
 548         Fixed erroneous line number for LLint frame when throwing exceptions.
 549         https://bugs.webkit.org/show_bug.cgi?id=94051.
 550
 551         Reviewed by Filip Pizlo.
 552
 553         For LLInt frames, before throwing an exception, adjust the PC from the
 554         return PC back to the call PC if we are indeed at a call site.
 555
 556         * bytecode/CodeBlock.cpp:
 557         (JSC::CodeBlock::adjustPCIfAtCallSite):
 558         (JSC):
 559         (JSC::CodeBlock::bytecodeOffset):
 560         * bytecode/CodeBlock.h:
 561         (CodeBlock):
 562         * llint/LLIntExceptions.cpp:
 563         (JSC::LLInt::fixupPCforExceptionIfNeeded):
 564         (LLInt):
 565         (JSC::LLInt::interpreterThrowInCaller):
 566         (JSC::LLInt::returnToThrow):
 567         (JSC::LLInt::callToThrow):
 568
 569 2012-08-03  Filip Pizlo  <fpizlo@apple.com>
 570
 571         Crashes in dfgBuildPutByIdList when clicking on just about anything on Google Maps
 572         https://bugs.webkit.org/show_bug.cgi?id=92691
 573
 574         Reviewed by Mark Hahnenberg.
 575
 576         The state of the stubs was changing after we determined the type (by virtue of the slow path
 577         function that was called), since the get or put (in this case put) could cause arbitrary
 578         side effects. Perhaps a full-blown fix would be to eliminate our reliance of the slow path
 579         function to determine what to do, but an easier fix for now is to have the slow path give up
 580         if its assumptions were invalidated by a side effect.
 581
 582         * dfg/DFGOperations.cpp:
 583         * jit/JITStubs.cpp:
 584         (JSC::DEFINE_STUB_FUNCTION):
 585
 586 2012-08-03  Filip Pizlo  <fpizlo@apple.com>
 587
 588         DFG handling of get_by_id should always inject a ForceOSRExit node if there is no prediction
 589         https://bugs.webkit.org/show_bug.cgi?id=93162
 590
 591         Reviewed by Mark Hahnenberg.
 592
 593         This simplifies the DFG IR by ensuring that all nodes that use value profiles will be preceded
 594         by a ForceOSRExit if the value profile had no data.
 595
 596         * dfg/DFGByteCodeParser.cpp:
 597         (JSC::DFG::ByteCodeParser::parseBlock):
 598
 599 2012-08-03  Filip Pizlo  <fpizlo@apple.com>
 600
 601         DFG::StructureCheckHoistingPhase keeps a Node& around for too long
 602         https://bugs.webkit.org/show_bug.cgi?id=93157
 603
 604         Reviewed by Mark Hahnenberg.
 605
 606         * dfg/DFGStructureCheckHoistingPhase.cpp:
 607         (JSC::DFG::StructureCheckHoistingPhase::run):
 608
 609 2012-08-02  Filip Pizlo  <fpizlo@apple.com>
 610
 611         ASSERTION FAILED: at(m_compileIndex).canExit() || m_isCheckingArgumentTypes
 612         https://bugs.webkit.org/show_bug.cgi?id=91074
 613
 614         Reviewed by Mark Hahnenberg.
 615
 616         Fixes a bug where the speculative JIT was performing an unnecessary speculation that the
 617         CFA had proven shouldn't be performed, leading to asserts that a node should not have
 618         exit sites. This is a debug-only assert with no release symptom - we were just emitting
 619         a check that was not reachable.
 620
 621         Also found, and fixed, a bug where structure check hoisting was slightly confusing the
 622         CFA by inserting GetLocal's into the graph. CSE would clean the GetLocal's up, which
 623         would make the backend happy - but the CFA would produce subtly wrong results.
 624
 625         * bytecode/SpeculatedType.h:
 626         (JSC::isOtherOrEmptySpeculation):
 627         (JSC):
 628         * dfg/DFGDriver.cpp:
 629         (JSC::DFG::compile):
 630         * dfg/DFGGraph.cpp:
 631         (JSC::DFG::Graph::dump):
 632         * dfg/DFGSpeculativeJIT64.cpp:
 633         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
 634         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
 635
 636 2012-08-02  Filip Pizlo  <fpizlo@apple.com>
 637
 638         Unreviewed, build fix for DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE).
 639
 640         * dfg/DFGStructureCheckHoistingPhase.cpp:
 641         (JSC::DFG::StructureCheckHoistingPhase::run):
 642
 643 2012-08-01  Mark Hahnenberg  <mhahnenberg@apple.com>
 644
 645         Remove all uses of ClassInfo for JSStrings in JIT code
 646         https://bugs.webkit.org/show_bug.cgi?id=92935
 647
 648         Reviewed by Geoffrey Garen.
 649
 650         This is the first step in removing our dependence on in-object ClassInfo pointers
 651         in JIT code. Most of the changes are to check the Structure, which is unique for
 652         JSString primitives.
 653
 654         * bytecode/SpeculatedType.cpp:
 655         (JSC::speculationFromClassInfo):
 656         (JSC::speculationFromStructure): Changed to check the TypeInfo in the Structure
 657         since there wasn't a JSGlobalData immediately available to grab the JSString
 658         Structure out of.
 659         * dfg/DFGSpeculativeJIT.cpp:
 660         (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
 661         * dfg/DFGSpeculativeJIT32_64.cpp:
 662         (JSC::DFG::SpeculativeJIT::compile):
 663         * dfg/DFGSpeculativeJIT64.cpp:
 664         (JSC::DFG::SpeculativeJIT::compile):
 665         * jit/JITInlineMethods.h:
 666         (JSC::JIT::emitLoadCharacterString):
 667         * jit/JITOpcodes.cpp:
 668         (JSC::JIT::privateCompileCTIMachineTrampolines):
 669         (JSC::JIT::emit_op_to_primitive):
 670         (JSC::JIT::emit_op_convert_this):
 671         * jit/JITOpcodes32_64.cpp:
 672         (JSC::JIT::privateCompileCTIMachineTrampolines):
 673         (JSC::JIT::emit_op_to_primitive):
 674         (JSC::JIT::emitSlow_op_eq):
 675         (JSC::JIT::emitSlow_op_neq):
 676         (JSC::JIT::compileOpStrictEq):
 677         (JSC::JIT::emit_op_convert_this):
 678         * jit/JITPropertyAccess.cpp:
 679         (JSC::JIT::stringGetByValStubGenerator):
 680         (JSC::JIT::emitSlow_op_get_by_val):
 681         * jit/JITPropertyAccess32_64.cpp:
 682         (JSC::JIT::stringGetByValStubGenerator):
 683         (JSC::JIT::emitSlow_op_get_by_val):
 684         * jit/SpecializedThunkJIT.h:
 685         (JSC::SpecializedThunkJIT::loadJSStringArgument):
 686         * jit/ThunkGenerators.cpp:
 687         (JSC::stringCharLoad):
 688         (JSC::charCodeAtThunkGenerator):
 689         (JSC::charAtThunkGenerator):
 690
 691 2012-08-02  Filip Pizlo  <fpizlo@apple.com>
 692
 693         Unreviewed, missed a style goof in the previous patch: "NodeIndex nodeIndex"
 694         in a method signature is painfully redundant.
 695
 696         * dfg/DFGSpeculativeJIT.h:
 697         (SpeculativeJIT):
 698
 699 2012-08-02  Filip Pizlo  <fpizlo@apple.com>
 700
 701         DFGSpeculativeJIT.h has too many inline method bodies
 702         https://bugs.webkit.org/show_bug.cgi?id=92957
 703
 704         Reviewed by Antti Koivisto.
 705
 706         * dfg/DFGSpeculativeJIT.cpp:
 707         (JSC::DFG::SpeculativeJIT::speculationCheck):
 708         (DFG):
 709         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
 710         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
 711         (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection):
 712         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
 713         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
 714         * dfg/DFGSpeculativeJIT.h:
 715         (SpeculativeJIT):
 716
 717 2012-08-01  Filip Pizlo  <fpizlo@apple.com>
 718
 719         DFG should hoist structure checks
 720         https://bugs.webkit.org/show_bug.cgi?id=92696
 721
 722         Reviewed by Gavin Barraclough.
 723
 724         This hoists structure checks in the same way that we would hoist array checks, but with added
 725         complexity to cope with the fact that the structure of an object may change. This is handled
 726         by performing a side effects analysis over the region in which the respective variable is
 727         live. If a structure clobbering side effect may happen then we either hoist the structure
 728         checks and fall back on structure transition watchpoints (if the watchpoint set is still
 729         valid), or we avoid hoisting altogether.
 730
 731         Doing this required teaching the CFA that we may have an expectation that an object has a
 732         particular structure even after structure clobbering happens, in the sense that structure
 733         proofs that were cobbered can be revived using watchpoints. CFA must know about this so that
 734         OSR entry may know about it, since we cannot allow entry to happen if the variable has a
 735         clobbered structure proof, will have a watchpoint to revive the proof, and the variable in
 736         the baseline JIT has a completely unrelated structure.
 737
 738         This is mostly performance neutral.
 739
 740         * CMakeLists.txt:
 741         * GNUmakefile.list.am:
 742         * JavaScriptCore.xcodeproj/project.pbxproj:
 743         * Target.pri:
 744         * bytecode/ValueRecovery.h:
 745         (JSC::ValueRecovery::isSet):
 746         (JSC::ValueRecovery::operator!):
 747         (ValueRecovery):
 748         * dfg/DFGAbstractState.cpp:
 749         (JSC::DFG::AbstractState::execute):
 750         (JSC::DFG::AbstractState::clobberWorld):
 751         (DFG):
 752         (JSC::DFG::AbstractState::clobberCapturedVars):
 753         * dfg/DFGAbstractState.h:
 754         (AbstractState):
 755         * dfg/DFGAbstractValue.h:
 756         (JSC::DFG::AbstractValue::clear):
 757         (JSC::DFG::AbstractValue::isClear):
 758         (JSC::DFG::AbstractValue::makeTop):
 759         (JSC::DFG::AbstractValue::isTop):
 760         (JSC::DFG::AbstractValue::set):
 761         (JSC::DFG::AbstractValue::operator==):
 762         (JSC::DFG::AbstractValue::merge):
 763         (JSC::DFG::AbstractValue::filter):
 764         (JSC::DFG::AbstractValue::validate):
 765         (JSC::DFG::AbstractValue::validateForEntry):
 766         (AbstractValue):
 767         (JSC::DFG::AbstractValue::checkConsistency):
 768         (JSC::DFG::AbstractValue::dump):
 769         * dfg/DFGByteCodeParser.cpp:
 770         (JSC::DFG::ByteCodeParser::setLocal):
 771         (JSC::DFG::ByteCodeParser::getArgument):
 772         (JSC::DFG::ByteCodeParser::setArgument):
 773         (JSC::DFG::ByteCodeParser::parseBlock):
 774         (JSC::DFG::ByteCodeParser::fixVariableAccessSpeculations):
 775         * dfg/DFGCSEPhase.cpp:
 776         (JSC::DFG::CSEPhase::checkStructureLoadElimination):
 777         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
 778         (JSC::DFG::CSEPhase::putStructureStoreElimination):
 779         (JSC::DFG::CSEPhase::getLocalLoadElimination):
 780         (JSC::DFG::CSEPhase::performNodeCSE):
 781         * dfg/DFGDriver.cpp:
 782         (JSC::DFG::compile):
 783         * dfg/DFGGraph.cpp:
 784         (JSC::DFG::Graph::dump):
 785         * dfg/DFGGraph.h:
 786         (JSC::DFG::Graph::vote):
 787         (Graph):
 788         * dfg/DFGNode.h:
 789         (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
 790         (Node):
 791         (JSC::DFG::Node::hasStructureSet):
 792         * dfg/DFGNodeType.h:
 793         (DFG):
 794         * dfg/DFGOSREntry.cpp:
 795         (JSC::DFG::prepareOSREntry):
 796         * dfg/DFGPredictionPropagationPhase.cpp:
 797         (JSC::DFG::PredictionPropagationPhase::propagate):
 798         (PredictionPropagationPhase):
 799         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
 800         * dfg/DFGSpeculativeJIT.h:
 801         (SpeculativeJIT):
 802         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
 803         (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection):
 804         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
 805         (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
 806         (JSC::DFG::SpeculateCellOperand::gpr):
 807         (SpeculateCellOperand):
 808         * dfg/DFGSpeculativeJIT32_64.cpp:
 809         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
 810         (JSC::DFG::SpeculativeJIT::compile):
 811         * dfg/DFGSpeculativeJIT64.cpp:
 812         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
 813         (JSC::DFG::SpeculativeJIT::compile):
 814         * dfg/DFGStructureCheckHoistingPhase.cpp: Added.
 815         (DFG):
 816         (StructureCheckHoistingPhase):
 817         (JSC::DFG::StructureCheckHoistingPhase::StructureCheckHoistingPhase):
 818         (JSC::DFG::StructureCheckHoistingPhase::run):
 819         (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
 820         (JSC::DFG::StructureCheckHoistingPhase::noticeClobber):
 821         (JSC::DFG::StructureCheckHoistingPhase::clobber):
 822         (CheckData):
 823         (JSC::DFG::StructureCheckHoistingPhase::CheckData::CheckData):
 824         (JSC::DFG::performStructureCheckHoisting):
 825         * dfg/DFGStructureCheckHoistingPhase.h: Added.
 826         (DFG):
 827         * dfg/DFGVariableAccessData.h:
 828         (VariableAccessData):
 829         (JSC::DFG::VariableAccessData::VariableAccessData):
 830         (JSC::DFG::VariableAccessData::mergeStructureCheckHoistingFailed):
 831         (JSC::DFG::VariableAccessData::structureCheckHoistingFailed):
 832         (JSC::DFG::VariableAccessData::clearVotes):
 833         (JSC::DFG::VariableAccessData::vote):
 834         (JSC::DFG::VariableAccessData::voteRatio):
 835         (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
 836         * runtime/Options.h:
 837         (JSC):
 838
 839 2012-08-01  Filip Pizlo  <fpizlo@apple.com>
 840
 841         DFG should distinguish between PutByVal's that clobber the world and ones that don't
 842         https://bugs.webkit.org/show_bug.cgi?id=92923
 843
 844         Reviewed by Mark Hahnenberg.
 845
 846         This is performance-neutral. I also confirmed that it's neutral if we make the
 847         clobbering variant (PutByValSafe) clobber all knowledge of what is an array,
 848         which should feed nicely into work on removing uses of ClassInfo.
 849
 850         * bytecode/DFGExitProfile.h:
 851         * dfg/DFGAbstractState.cpp:
 852         (JSC::DFG::AbstractState::execute):
 853         * dfg/DFGByteCodeParser.cpp:
 854         (JSC::DFG::ByteCodeParser::parseBlock):
 855         * dfg/DFGCSEPhase.cpp:
 856         (JSC::DFG::CSEPhase::getByValLoadElimination):
 857         (JSC::DFG::CSEPhase::checkStructureLoadElimination):
 858         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
 859         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
 860         (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
 861         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
 862         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
 863         (JSC::DFG::CSEPhase::performNodeCSE):
 864         * dfg/DFGFixupPhase.cpp:
 865         (JSC::DFG::FixupPhase::fixupNode):
 866         * dfg/DFGGraph.h:
 867         (JSC::DFG::Graph::byValIsPure):
 868         (JSC::DFG::Graph::clobbersWorld):
 869         * dfg/DFGNodeType.h:
 870         (DFG):
 871         * dfg/DFGPredictionPropagationPhase.cpp:
 872         (JSC::DFG::PredictionPropagationPhase::propagate):
 873         * dfg/DFGSpeculativeJIT32_64.cpp:
 874         (JSC::DFG::SpeculativeJIT::compile):
 875         * dfg/DFGSpeculativeJIT64.cpp:
 876         (JSC::DFG::SpeculativeJIT::compile):
 877
 878 2012-08-01  Mark Hahnenberg  <mhahnenberg@apple.com>
 879
 880         C++ code should get ClassInfo from the Structure
 881         https://bugs.webkit.org/show_bug.cgi?id=92892
 882
 883         Reviewed by Geoffrey Garen.
 884
 885         In our march to remove ClassInfo from our JSCell object headers, we can switch
 886         C++ code over to grabbing the ClassInfo from the Structure since it is finally
 887         safe to do so now that Structure access is safe during finalization/destruction.
 888         The remaining JIT code changes can be done in a separate patch.
 889
 890         * heap/MarkedBlock.cpp:
 891         (JSC::MarkedBlock::callDestructor): We don't want to clear the Structure any more
 892         since the Structure should still be valid at this point.
 893         * heap/WeakSetInlines.h:
 894         (JSC::WeakBlock::finalize): Ditto.
 895         * runtime/JSCell.h:
 896         (JSC):
 897         * runtime/Structure.h:
 898         (JSC::JSCell::classInfo): Move JSCell's classInfo() to Structure.h so it can be
 899         inline. Use a different method of getting the JSCell's Structure based on
 900         whether we're in GC_VALIDATION mode or not, since always using get() will cause
 901         infinite recursion in GC_VALIDATION mode.
 902         (JSC):
 903
 904 2012-07-31  Mark Hahnenberg  <mhahnenberg@apple.com>
 905
 906         MarkedBlock::sweep() should sweep another block if it can't sweep a Structure block
 907         https://bugs.webkit.org/show_bug.cgi?id=92819
 908
 909         Reviewed by Geoffrey Garen.
 910
 911         If we are forced to allocate a new block for Structures because we are unable to safely
 912         sweep our pre-existing Structure blocks, we should sweep another random block so that we
 913         can start sweeping Structure blocks sooner.
 914
 915         * heap/IncrementalSweeper.cpp:
 916         (JSC::IncrementalSweeper::doSweep): Change to use sweepNextBlock.
 917         (JSC):
 918         (JSC::IncrementalSweeper::sweepNextBlock):
 919         * heap/IncrementalSweeper.h:
 920         (IncrementalSweeper):
 921         * heap/MarkedAllocator.cpp:
 922         (JSC::MarkedAllocator::tryAllocateHelper): When we can't safely sweep
 923         our Structure blocks, call sweepNextBlock instead.
 924
 925 2012-07-31  Sam Weinig  <sam@webkit.org>
 926
 927         Fix the Windows build.
 928
 929         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 930
 931 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 932
 933         Maybe fix the GCC build.
 934
 935         * heap/HeapBlock.h:
 936         (HeapBlock): Accommodate incorrect parsing in GCC.
 937
 938 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 939
 940         Maybe break the Windows build.
 941
 942         Reviewed by Anders Carlsson.
 943
 944         Formally objected to by Sam Weinig.
 945
 946         * heap/HeapBlock.h:
 947         (HeapBlock): Try to slightly improve this because we don't want Windows to control our lives.
 948
 949 2012-07-30  Mark Hahnenberg  <mhahnenberg@apple.com>
 950
 951         Structures should be swept after all other objects
 952         https://bugs.webkit.org/show_bug.cgi?id=92679
 953
 954         Reviewed by Filip Pizlo.
 955
 956         In order to get rid of ClassInfo from our objects, we need to be able to safely get the
 957         ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the
 958         Structure, but currently it is not safe to do so because the order of destruction of objects
 959         is not guaranteed to sweep objects before their corresponding Structure. We can fix this by
 960         sweeping Structures after everything else.
 961
 962         * heap/Heap.cpp:
 963         (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures.
 964         If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is
 965         safe to sweep structures since we'll always do Structures last anyways due to the ordering of
 966         MarkedSpace::forEachBlock.
 967         (JSC):
 968         (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now
 969         calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out
 970         these pointers after it has invalidated them to prevent accidental use-after-free in the sweep()
 971         calls during lastChanceToFinalize().
 972         * heap/Heap.h:
 973         (Heap):
 974         * heap/HeapTimer.h:
 975         (HeapTimer):
 976         * heap/IncrementalSweeper.cpp:
 977         (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures.
 978         This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping
 979         the first time.
 980         (JSC):
 981         (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we
 982         make our first pass. We now null out the slots as we sweep them so that we can quickly find the
 983         Structures during the second pass.
 984         (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index.
 985         (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify
 986         the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can
 987         assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock
 988         iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds.
 989         (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index.
 990         * heap/IncrementalSweeper.h: Add declarations for new stuff.
 991         (IncrementalSweeper):
 992         * heap/MarkedAllocator.cpp:
 993         (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and
 994         if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing
 995         the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that
 996         will sweep some number of other blocks in place of the current block to mitigate the cost of the floating
 997         Structure garbage.
 998         (JSC::MarkedAllocator::addBlock):
 999         * heap/MarkedAllocator.h:
1000         (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no
1001         longer valid to allocate from, so we set the current block to null.
1002         * heap/MarkedBlock.cpp:
1003         (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures
1004         at an unsafe time.
1005         * heap/MarkedSpace.cpp:
1006         (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping.
1007         (JSC):
1008         * heap/MarkedSpace.h:
1009         (JSC):
1010         * runtime/JSGlobalData.cpp:
1011         (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown.
1012
1013 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
1014
1015         Fix all the other builds I just broke. Maybe fix the Windows build.
1016
1017         * heap/HeapBlock.h:
1018         (HeapBlock): WTF?
1019
1020 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
1021
1022         Maybe fix the Windows build.
1023
1024         * heap/HeapBlock.h:
1025         (HeapBlock): WTF?
1026
1027 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
1028
1029         Maybe fix the Windows build.
1030
1031         * heap/HeapBlock.h:
1032         (HeapBlock): WTF?
1033
1034 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
1035
1036         Removed some public data and casting from the Heap
1037         https://bugs.webkit.org/show_bug.cgi?id=92777
1038
1039         Reviewed by Oliver Hunt.
1040
1041         * heap/BlockAllocator.cpp:
1042         (JSC::BlockAllocator::releaseFreeBlocks):
1043         (JSC::BlockAllocator::blockFreeingThreadMain): Use the DeadBlock class
1044         since HeapBlock is a template, and not a class, now. Call destroy()
1045         instead of monkeying around with DeadBlock's internal data because
1046         encapsulation is good.
1047
1048         * heap/BlockAllocator.h:
1049         (DeadBlock): Added a class to represent a dead block, since HeapBlock is
1050         a template now, and can't be instantiated directly.
1051
1052         (JSC::DeadBlock::DeadBlock):
1053         (JSC::DeadBlock::create):
1054         (BlockAllocator):
1055         (JSC::BlockAllocator::allocate):
1056         (JSC::BlockAllocator::deallocate): Use the DeadBlock class because
1057         encapsulation is good.
1058
1059         * heap/CopiedBlock.h:
1060         (CopiedBlock::destroy): No need for a destroy() function, since we
1061         inherit one now.
1062
1063         (JSC::CopiedBlock::CopiedBlock):
1064         (JSC::CopiedBlock::payloadEnd):
1065         (JSC::CopiedBlock::capacity): Updated for some encapsulation inside
1066         HeapBlock.
1067
1068         * heap/CopiedSpace.cpp:
1069         (JSC::CopiedSpace::~CopiedSpace):
1070         (JSC::CopiedSpace::doneCopying):
1071         (JSC::CopiedSpace::size):
1072         (JSC::CopiedSpace::capacity):
1073         (JSC::isBlockListPagedOut): Removed a bunch of casting. This is no longer
1074         necessary, now that our list and its nodes have the right type.
1075
1076         * heap/CopiedSpace.h: Use the right type in our data structures because
1077         it improves clarity.
1078
1079         * heap/CopiedSpaceInlineMethods.h:
1080         (JSC::CopiedSpace::startedCopying): Use swap to avoid duplicating it.
1081
1082         * heap/HeapBlock.h:
1083         (HeapBlock): Made this a class template so we can return the right type
1084         in linked list operations. Made our data private because encapsulation
1085         is good.
1086
1087         (JSC::HeapBlock::destroy): Since we know our type, we can also eliminate
1088         duplicate destroy() functions in our subclasses.
1089
1090         (JSC::HeapBlock::allocation): Added an accessor so we can hide our data.
1091         By using const, this accessor prevents clients from accidentally deleting
1092         our allocation.
1093
1094         * heap/MarkedAllocator.cpp:
1095         (JSC::MarkedAllocator::isPagedOut):
1096         (JSC::MarkedAllocator::tryAllocateHelper):
1097         (JSC::MarkedAllocator::removeBlock): Removed a bunch of casting. This is
1098         no longer necessary, now that our list and its nodes have the right type.
1099
1100         * heap/MarkedAllocator.h:
1101         (MarkedAllocator):
1102         (JSC::MarkedAllocator::reset):
1103         (JSC::MarkedAllocator::forEachBlock): Use the right type, do less casting.
1104
1105         * heap/MarkedBlock.cpp:
1106         (JSC::MarkedBlock::destroy): Removed this function because our parent
1107         class provides it for us now.
1108
1109         (JSC::MarkedBlock::MarkedBlock):
1110         * heap/MarkedBlock.h:
1111         (MarkedBlock):
1112         (JSC::MarkedBlock::capacity): Updated for encapsulation.
1113
1114 2012-07-31  Filip Pizlo  <fpizlo@apple.com>
1115
1116         DFG OSR exit profiling has unusual oversights
1117         https://bugs.webkit.org/show_bug.cgi?id=92728
1118
1119         Reviewed by Geoffrey Garen.
1120
1121         * dfg/DFGOSRExit.cpp:
1122         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
1123         * dfg/DFGSpeculativeJIT.h:
1124         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
1125         * dfg/DFGSpeculativeJIT32_64.cpp:
1126         (JSC::DFG::SpeculativeJIT::compile):
1127         * dfg/DFGSpeculativeJIT64.cpp:
1128         (JSC::DFG::SpeculativeJIT::compile):
1129
1130 2012-07-31  Chao-ying Fu  <fu@mips.com>
1131
1132         Add MIPS add32 function
1133         https://bugs.webkit.org/show_bug.cgi?id=91522
1134
1135         Reviewed by Oliver Hunt.
1136
1137         Add isCompactPtrAlignedAddressOffset.
1138         Add a new version of add32 that accepts AbsoluteAddress as inputs.
1139
1140         * assembler/MacroAssemblerMIPS.h:
1141         (JSC::MacroAssemblerMIPS::isCompactPtrAlignedAddressOffset): New.
1142         (MacroAssemblerMIPS):
1143         (JSC::MacroAssemblerMIPS::add32): Support AbsoluteAddress as inputs.
1144
1145 2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
1146
1147         Unreviewed, rolling out r124123.
1148         http://trac.webkit.org/changeset/124123
1149         https://bugs.webkit.org/show_bug.cgi?id=92700
1150
1151         ASSERT crashes terminate webkit Layout tests (Requested by
1152         msaboff on #webkit).
1153
1154         * heap/Heap.cpp:
1155         * heap/Heap.h:
1156         (Heap):
1157         * heap/IncrementalSweeper.cpp:
1158         (JSC::IncrementalSweeper::doSweep):
1159         (JSC::IncrementalSweeper::startSweeping):
1160         (JSC::IncrementalSweeper::IncrementalSweeper):
1161         (JSC):
1162         * heap/IncrementalSweeper.h:
1163         (IncrementalSweeper):
1164         * heap/MarkedAllocator.cpp:
1165         (JSC::MarkedAllocator::tryAllocateHelper):
1166         (JSC::MarkedAllocator::addBlock):
1167         * heap/MarkedAllocator.h:
1168         (JSC::MarkedAllocator::zapFreeList):
1169         * heap/MarkedBlock.cpp:
1170         (JSC::MarkedBlock::sweepHelper):
1171         * heap/MarkedSpace.cpp:
1172         * heap/MarkedSpace.h:
1173         (JSC::MarkedSpace::sweep):
1174         (JSC):
1175         * runtime/JSGlobalData.cpp:
1176         (JSC::JSGlobalData::~JSGlobalData):
1177
1178 2012-07-30  Mark Hahnenberg  <mhahnenberg@apple.com>
1179
1180         Structures should be swept after all other objects
1181         https://bugs.webkit.org/show_bug.cgi?id=92679
1182
1183         Reviewed by Filip Pizlo.
1184
1185         In order to get rid of ClassInfo from our objects, we need to be able to safely get the
1186         ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the
1187         Structure, but currently it is not safe to do so because the order of destruction of objects
1188         is not guaranteed to sweep objects before their corresponding Structure. We can fix this by
1189         sweeping Structures after everything else.
1190
1191         * heap/Heap.cpp:
1192         (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures.
1193         If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is
1194         safe to sweep structures since we'll always do Structures last anyways due to the ordering of
1195         MarkedSpace::forEachBlock.
1196         (JSC):
1197         (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now
1198         calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out
1199         these pointers after it has invalidated them to prevent accidental use-after-free in the sweep()
1200         calls during lastChanceToFinalize().
1201         * heap/Heap.h:
1202         (Heap):
1203         * heap/HeapTimer.h:
1204         (HeapTimer):
1205         * heap/IncrementalSweeper.cpp:
1206         (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures.
1207         This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping
1208         the first time.
1209         (JSC):
1210         (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we
1211         make our first pass. We now null out the slots as we sweep them so that we can quickly find the
1212         Structures during the second pass.
1213         (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index.
1214         (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify
1215         the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can
1216         assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock
1217         iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds.
1218         (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index.
1219         * heap/IncrementalSweeper.h: Add declarations for new stuff.
1220         (IncrementalSweeper):
1221         * heap/MarkedAllocator.cpp:
1222         (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and
1223         if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing
1224         the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that
1225         will sweep some number of other blocks in place of the current block to mitigate the cost of the floating
1226         Structure garbage.
1227         (JSC::MarkedAllocator::addBlock):
1228         * heap/MarkedAllocator.h:
1229         (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no
1230         longer valid to allocate from, so we set the current block to null.
1231         * heap/MarkedBlock.cpp:
1232         (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures
1233         at an unsafe time.
1234         * heap/MarkedSpace.cpp:
1235         (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping.
1236         (JSC):
1237         * heap/MarkedSpace.h:
1238         (JSC):
1239         * runtime/JSGlobalData.cpp:
1240         (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown.
1241
1242 2012-07-29  Filip Pizlo  <fpizlo@apple.com>
1243
1244         PropertyNameArray::m_shouldCache is only assigned and never used
1245         https://bugs.webkit.org/show_bug.cgi?id=92598
1246
1247         Reviewed by Dan Bernstein.
1248
1249         * runtime/PropertyNameArray.h:
1250         (JSC::PropertyNameArray::PropertyNameArray):
1251         (PropertyNameArray):
1252
1253 2012-07-29  Rik Cabanier  <cabanier@adobe.com>
1254
1255         Add ENABLE_CSS_COMPOSITING flag
1256         https://bugs.webkit.org/show_bug.cgi?id=92553
1257
1258         Reviewed by Dirk Schulze.
1259
1260         Adds compiler flag CSS_COMPOSITING to build systems to enable CSS blending and compositing. See spec https://dvcs.w3.org/hg/FXTF/rawfile/tip/compositing/index.html
1261
1262         * Configurations/FeatureDefines.xcconfig:
1263
1264 2012-07-27  Mark Hahnenberg  <mhahnenberg@apple.com>
1265
1266         Split functionality of MarkedAllocator::m_currentBlock
1267         https://bugs.webkit.org/show_bug.cgi?id=92550
1268
1269         Reviewed by Filip Pizlo.
1270
1271         MarkedAllocator::m_currentBlock serves two purposes right now; it indicates the block that is currently
1272         being used for allocation and the beginning of the list of blocks that need to be swept. We should split
1273         these two functionalities into two separate fields.
1274
1275         * heap/MarkedAllocator.cpp:
1276         (JSC::MarkedAllocator::tryAllocateHelper): Use m_blocksToSweep instead of m_currentBlock as the
1277         initializer/reference of the loop. Only change m_currentBlock when we know what the result will be.
1278         (JSC::MarkedAllocator::addBlock): When we add a new block we know that both m_blocksToSweep and
1279         m_currentBlock are null. In order to preserve the invariant that m_currentBlock <= m_blocksToSweep,
1280         we assign both of them to point to the new block.
1281         (JSC::MarkedAllocator::removeBlock): We need a separate check to see if the block we're removing is
1282         m_blocksToSweep and if so, advance it to the next block in the list.
1283         * heap/MarkedAllocator.h:
1284         (MarkedAllocator): Initialize m_blocksToSweep.
1285         (JSC::MarkedAllocator::MarkedAllocator):
1286         (JSC::MarkedAllocator::reset): We set m_blocksToSweep to be the head of our list. This function is called
1287         at the end of a collection, so all of the blocks in our allocator need to be swept. We need to sweep a
1288         block before we can start allocating, so m_currentBlock is set to null. We also set the freeList to
1289         the empty FreeList to emphasize the fact that we can't start allocating until we do some sweeping.
1290
1291 2012-07-27  Mark Hahnenberg  <mhahnenberg@apple.com>
1292
1293         Increase inline storage for JSFinalObjects by one
1294         https://bugs.webkit.org/show_bug.cgi?id=92526
1295
1296         Reviewed by Geoffrey Garen.
1297
1298         Now that we've removed the inheritorID from objects, we can increase our inline storage for JSFinalObjects on
1299         64-bit platforms by 1.
1300
1301         * llint/LowLevelInterpreter.asm: Change the constant.
1302         * runtime/PropertyOffset.h: Change the constant.
1303         (JSC):
1304
1305 2012-07-27  Jer Noble  <jer.noble@apple.com>
1306
1307         Support a rational time class for use by media elements.
1308         https://bugs.webkit.org/show_bug.cgi?id=88787
1309
1310         Re-export WTF::MediaTime from JavaScriptCore.
1311
1312         Reviewed by Eric Carlson.
1313
1314         * JavaScriptCore.order:
1315         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1316
1317 2012-07-26  Filip Pizlo  <fpizlo@apple.com>
1318
1319         JSObject::reallocateStorageIfNecessary is neither used nor defined
1320         https://bugs.webkit.org/show_bug.cgi?id=92417
1321
1322         Reviewed by Mark Rowe.
1323
1324         * runtime/JSObject.h:
1325         (JSObject):
1326
1327 2012-07-26  Mark Hahnenberg  <mhahnenberg@apple.com>
1328
1329         Allocate Structures in a separate part of the Heap
1330         https://bugs.webkit.org/show_bug.cgi?id=92420
1331
1332         Reviewed by Filip Pizlo.
1333
1334         To fix our issue with destruction/finalization of Structures before their objects, we can move Structures to a separate
1335         part of the Heap that will be swept after all other objects. This first patch will just be separating Structures
1336         out into their own separate MarkedAllocator. Everything else will behave identically.
1337
1338         * heap/Heap.h: New function to allocate Structures in the Heap.
1339         (Heap):
1340         (JSC):
1341         (JSC::Heap::allocateStructure):
1342         * heap/MarkedAllocator.cpp: Pass whether or not we're allocated Structures to the MarkedBlock.
1343         (JSC::MarkedAllocator::allocateBlock):
1344         * heap/MarkedAllocator.h: Add tracking for whether or not we're allocating only Structures.
1345         (JSC::MarkedAllocator::onlyContainsStructures):
1346         (MarkedAllocator):
1347         (JSC::MarkedAllocator::MarkedAllocator):
1348         (JSC::MarkedAllocator::init):
1349         * heap/MarkedBlock.cpp: Add tracking for whether or not we're allocating only Structures. We need this to be able to
1350         distinguish the various MarkedBlock types in MarkedSpace::allocatorFor(MarkedBlock*).
1351         (JSC::MarkedBlock::create):
1352         (JSC::MarkedBlock::MarkedBlock):
1353         * heap/MarkedBlock.h:
1354         (MarkedBlock):
1355         (JSC::MarkedBlock::onlyContainsStructures):
1356         (JSC):
1357         * heap/MarkedSpace.cpp: Include the new Structure allocator in all the places that all the other allocators are used/modified.
1358         (JSC::MarkedSpace::MarkedSpace):
1359         (JSC::MarkedSpace::resetAllocators):
1360         (JSC::MarkedSpace::canonicalizeCellLivenessData):
1361         (JSC::MarkedSpace::isPagedOut):
1362         * heap/MarkedSpace.h: Add new MarkedAllocator just for Structures.
1363         (MarkedSpace):
1364         (JSC::MarkedSpace::allocatorFor):
1365         (JSC::MarkedSpace::allocateStructure):
1366         (JSC):
1367         (JSC::MarkedSpace::forEachBlock):
1368         * runtime/Structure.h: Move all of the functions that call allocateCell<Structure> down below the explicit template specialization
1369         for allocateCell<Structure>. The new inline specialization for allocateCell directly calls the allocateStructure() function in the
1370         Heap.
1371         (Structure):
1372         (JSC::Structure):
1373         (JSC):
1374         (JSC::Structure::create):
1375         (JSC::Structure::createStructure):
1376
1377 2012-07-26  Filip Pizlo  <fpizlo@apple.com>
1378
1379         JSArray has methods that are neither used nor defined
1380         https://bugs.webkit.org/show_bug.cgi?id=92416
1381
1382         Reviewed by Simon Fraser.
1383
1384         * runtime/JSArray.h:
1385         (JSArray):
1386
1387 2012-07-26  Zoltan Herczeg  <zherczeg@webkit.org>
1388
1389         [Qt][ARM]ARMAssembler needs buildfix afert r123417
1390         https://bugs.webkit.org/show_bug.cgi?id=92086
1391
1392         Reviewed by Csaba Osztrogonác.
1393
1394         The ARM implementation of this should be optimized code path
1395         is covered by a non-optimized code path. This patch fixes this,
1396         and adds a new function which returns with the offset range.
1397
1398         * assembler/ARMAssembler.h:
1399         (JSC::ARMAssembler::readPointer):
1400         (ARMAssembler):
1401         (JSC::ARMAssembler::repatchInt32):
1402         (JSC::ARMAssembler::repatchCompact):
1403         * assembler/MacroAssemblerARM.h:
1404         (MacroAssemblerARM):
1405         (JSC::MacroAssemblerARM::isCompactPtrAlignedAddressOffset):
1406         (JSC::MacroAssemblerARM::load32WithCompactAddressOffsetPatch):
1407
1408 2012-07-25  Mark Hahnenberg  <mhahnenberg@apple.com>
1409
1410         Build fix for 32-bit after r123682
1411
1412         * runtime/JSObject.h: Need to pad out JSObjects on 32-bit so that they're the correct size since
1413         we only removed one 4-byte word and we need to be 8-byte aligned.
1414         (JSObject):
1415
1416 2012-07-25  Filip Pizlo  <fpizlo@apple.com>
1417
1418         JSC GC object copying APIs should allow for greater flexibility
1419         https://bugs.webkit.org/show_bug.cgi?id=92316
1420
1421         Reviewed by Mark Hahnenberg.
1422
1423         It's now the case that visitChildren() methods can directly pin and allocate in new space during copying.
1424         They can also do the copying and marking themselves. This new API is only used for JSObjects for now.
1425
1426         * JavaScriptCore.xcodeproj/project.pbxproj:
1427         * heap/MarkStack.cpp:
1428         (JSC::SlotVisitor::allocateNewSpaceSlow):
1429         (JSC::SlotVisitor::allocateNewSpaceOrPin):
1430         (JSC):
1431         (JSC::SlotVisitor::copyAndAppend):
1432         * heap/MarkStack.h:
1433         (MarkStack):
1434         (JSC::MarkStack::appendUnbarrieredValue):
1435         (JSC):
1436         * heap/SlotVisitor.h:
1437         * heap/SlotVisitorInlineMethods.h: Added.
1438         (JSC):
1439         (JSC::SlotVisitor::checkIfShouldCopyAndPinOtherwise):
1440         (JSC::SlotVisitor::allocateNewSpace):
1441         * runtime/JSObject.cpp:
1442         (JSC::JSObject::visitOutOfLineStorage):
1443         (JSC):
1444         (JSC::JSObject::visitChildren):
1445         (JSC::JSFinalObject::visitChildren):
1446         * runtime/JSObject.h:
1447         (JSObject):
1448
1449 2012-07-25  Mark Hahnenberg  <mhahnenberg@apple.com>
1450
1451         Remove JSObject::m_inheritorID
1452         https://bugs.webkit.org/show_bug.cgi?id=88378
1453
1454         Reviewed by Filip Pizlo.
1455
1456         This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
1457         and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
1458         Instead use a private named value in the object's property storage.
1459
1460         * dfg/DFGSpeculativeJIT.h:
1461         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): No need m_inheritorID to initialize!
1462         * jit/JITInlineMethods.h:
1463         (JSC::JIT::emitAllocateBasicJSObject): No need m_inheritorID to initialize!
1464         * llint/LowLevelInterpreter.asm: No need m_inheritorID to initialize!
1465         * runtime/JSGlobalData.h:
1466         (JSGlobalData): Added private name 'm_inheritorIDKey'.
1467         * runtime/JSGlobalThis.cpp:
1468         (JSC::JSGlobalThis::setUnwrappedObject): resetInheritorID is now passed a JSGlobalData&.
1469         * runtime/JSObject.cpp:
1470         (JSC::JSObject::visitChildren): No m_inheritorID to be marked.
1471         (JSC::JSFinalObject::visitChildren): No m_inheritorID to be marked.
1472         (JSC::JSObject::createInheritorID): Store the newly created inheritorID in the property map. Make sure
1473         it's got the DontEnum attribute!!
1474         * runtime/JSObject.h:
1475         (JSObject):
1476         (JSC::JSObject::resetInheritorID): Remove the inheritorID from property storage.
1477         (JSC):
1478         (JSC::JSObject::inheritorID): Read the inheritorID from property storage.
1479
1480 2012-07-25  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
1481
1482         Create a specialized pair for use in HashMap iterators
1483         https://bugs.webkit.org/show_bug.cgi?id=92137
1484
1485         Reviewed by Ryosuke Niwa.
1486
1487         Update a couple of sites that relied on the fact that "contents" of iterators were
1488         std::pairs.
1489
1490         * profiler/Profile.cpp:
1491         (JSC): This code kept a vector of the pairs that were the "contents" of the iterators. This
1492         is changed to use a KeyValuePair. We make use HashCount's ValueType (which represents only
1493         the key) to get the proper key parameter for KeyValuePair.
1494         * tools/ProfileTreeNode.h:
1495         (ProfileTreeNode): Use HashMap::ValueType to declare the type of the contents of the hash
1496         instead of declaring it manually. This will make use of the new KeyValuePair.
1497
1498 2012-07-25  Patrick Gansterer  <paroga@webkit.org>
1499
1500         REGRESSION(r123505): Date.getYear() returns the same as Date.getFullYear()
1501         https://bugs.webkit.org/show_bug.cgi?id=92218
1502
1503         Reviewed by Csaba Osztrogonác.
1504
1505         * runtime/DatePrototype.cpp:
1506         (JSC::dateProtoFuncGetYear): Added the missing offset of 1900 to the return value.
1507
1508 2012-07-24  Filip Pizlo  <fpizlo@apple.com>
1509
1510         REGRESSION(r123417): It made tests assert/crash on 32 bit
1511         https://bugs.webkit.org/show_bug.cgi?id=92088
1512
1513         Reviewed by Mark Hahnenberg.
1514
1515         The pointer arithmetic was wrong, because negative numbers are hard to think about.
1516
1517         * dfg/DFGRepatch.cpp:
1518         (JSC::DFG::emitPutTransitionStub):
1519         * dfg/DFGSpeculativeJIT.cpp:
1520         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
1521
1522 2012-07-24  Patrick Gansterer  <paroga@webkit.org>
1523
1524         Store the full year in GregorianDateTime
1525         https://bugs.webkit.org/show_bug.cgi?id=92067
1526
1527         Reviewed by Geoffrey Garen.
1528
1529         Use the full year instead of the offset from year 1900
1530         for the year member variable of GregorianDateTime.
1531
1532         * runtime/DateConstructor.cpp:
1533         (JSC::constructDate):
1534         (JSC::dateUTC):
1535         * runtime/DateConversion.cpp:
1536         (JSC::formatDate):
1537         (JSC::formatDateUTCVariant):
1538         * runtime/DatePrototype.cpp:
1539         (JSC::formatLocaleDate):
1540         (JSC::fillStructuresUsingDateArgs):
1541         (JSC::dateProtoFuncToISOString):
1542         (JSC::dateProtoFuncGetFullYear):
1543         (JSC::dateProtoFuncGetUTCFullYear):
1544         (JSC::dateProtoFuncSetYear):
1545         * runtime/JSDateMath.cpp:
1546         (JSC::gregorianDateTimeToMS):
1547         (JSC::msToGregorianDateTime):
1548
1549 2012-07-24  Patrick Gansterer  <paroga@webkit.org>
1550
1551         [WIN] Build fix after r123417.
1552
1553         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1554
1555 2012-07-23  Patrick Gansterer  <paroga@webkit.org>
1556
1557         Move GregorianDateTime from JSC to WTF namespace
1558         https://bugs.webkit.org/show_bug.cgi?id=91948
1559
1560         Reviewed by Geoffrey Garen.
1561
1562         Moving GregorianDateTime into the WTF namespace allows us to us to
1563         use it in WebCore too. The new class has the same behaviour as the
1564         old struct. Only the unused timeZone member has been removed.
1565
1566         * runtime/DateConstructor.cpp:
1567         * runtime/DateConversion.cpp:
1568         * runtime/DateConversion.h:
1569         * runtime/DateInstance.h:
1570         * runtime/DatePrototype.cpp:
1571         * runtime/JSDateMath.cpp:
1572         * runtime/JSDateMath.h:
1573
1574 2012-07-23  Filip Pizlo  <fpizlo@apple.com>
1575
1576         Property storage should grow in reverse address direction, to support butterflies
1577         https://bugs.webkit.org/show_bug.cgi?id=91788
1578
1579         Reviewed by Geoffrey Garen.
1580
1581         Changes property storage to grow to the left, and changes the property storage pointer to point
1582         one 8-byte word (i.e. JSValue) to the right of the first value in the storage.
1583
1584         Also improved debug support somewhat, by adding a describe() function to the jsc command-line,
1585         and a slow mode of object access in LLInt.
1586
1587         * assembler/ARMv7Assembler.h:
1588         (JSC::ARMv7Assembler::repatchCompact):
1589         * assembler/MacroAssemblerARMv7.h:
1590         (MacroAssemblerARMv7):
1591         (JSC::MacroAssemblerARMv7::isCompactPtrAlignedAddressOffset):
1592         (JSC::MacroAssemblerARMv7::load32WithCompactAddressOffsetPatch):
1593         * assembler/MacroAssemblerX86Common.h:
1594         (JSC::MacroAssemblerX86Common::isCompactPtrAlignedAddressOffset):
1595         (JSC::MacroAssemblerX86Common::repatchCompact):
1596         * assembler/X86Assembler.h:
1597         (JSC::X86Assembler::repatchCompact):
1598         * bytecode/CodeBlock.cpp:
1599         (JSC::dumpStructure):
1600         * bytecode/GetByIdStatus.h:
1601         (JSC::GetByIdStatus::GetByIdStatus):
1602         * dfg/DFGOperations.cpp:
1603         * dfg/DFGOperations.h:
1604         * dfg/DFGRepatch.cpp:
1605         (JSC::DFG::tryCacheGetByID):
1606         (JSC::DFG::emitPutTransitionStub):
1607         * dfg/DFGSpeculativeJIT.cpp:
1608         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
1609         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
1610         * dfg/DFGSpeculativeJIT.h:
1611         (JSC::DFG::SpeculativeJIT::callOperation):
1612         * dfg/DFGSpeculativeJIT32_64.cpp:
1613         (JSC::DFG::SpeculativeJIT::compile):
1614         * dfg/DFGSpeculativeJIT64.cpp:
1615         (JSC::DFG::SpeculativeJIT::compile):
1616         * heap/ConservativeRoots.cpp:
1617         (JSC::ConservativeRoots::genericAddPointer):
1618         * heap/CopiedSpace.h:
1619         (CopiedSpace):
1620         * heap/CopiedSpaceInlineMethods.h:
1621         (JSC::CopiedSpace::pinIfNecessary):
1622         (JSC):
1623         * jit/JITPropertyAccess.cpp:
1624         (JSC::JIT::compileGetDirectOffset):
1625         * jit/JITPropertyAccess32_64.cpp:
1626         (JSC::JIT::compileGetDirectOffset):
1627         * jit/JITStubs.cpp:
1628         (JSC::JITThunks::tryCacheGetByID):
1629         * jsc.cpp:
1630         (GlobalObject::finishCreation):
1631         (functionDescribe):
1632         * llint/LLIntCommon.h:
1633         * llint/LLIntSlowPaths.cpp:
1634         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1635         * llint/LowLevelInterpreter32_64.asm:
1636         * llint/LowLevelInterpreter64.asm:
1637         * runtime/JSObject.cpp:
1638         (JSC::JSObject::visitChildren):
1639         (JSC::JSFinalObject::visitChildren):
1640         (JSC::JSObject::growOutOfLineStorage):
1641         * runtime/JSObject.h:
1642         (JSC::JSObject::getDirectLocation):
1643         (JSC::JSObject::offsetForLocation):
1644         * runtime/JSValue.h:
1645         (JSValue):
1646         * runtime/PropertyOffset.h:
1647         (JSC::offsetInOutOfLineStorage):
1648
1649 2012-07-23  Filip Pizlo  <fpizlo@apple.com>
1650
1651         DFG is too aggressive in performing the specific value optimization on loads
1652         https://bugs.webkit.org/show_bug.cgi?id=92034
1653
1654         Reviewed by Mark Hahnenberg.
1655
1656         This ensures that we don't do optimizations based on a structure having a specific
1657         value, if there is no way to detect that the value is despecified. This is the
1658         case for dictionaries, since despecifying a value in a dictionary does not lead to
1659         a transition and so cannot be caught by either structure checks or structure
1660         transition watchpoints.
1661
1662         * bytecode/GetByIdStatus.cpp:
1663         (JSC::GetByIdStatus::computeFromLLInt):
1664         (JSC::GetByIdStatus::computeForChain):
1665         (JSC::GetByIdStatus::computeFor):
1666         * bytecode/ResolveGlobalStatus.cpp:
1667         (JSC::computeForStructure):
1668
1669 2012-07-23  Filip Pizlo  <fpizlo@apple.com>
1670
1671         REGRESSION(r123169): It made fast/js/dfg-inline-arguments-use-from-uninlined-code.html fail on 32 bit platforms
1672         https://bugs.webkit.org/show_bug.cgi?id=92002
1673
1674         Reviewed by Mark Hahnenberg.
1675
1676         In the process of changing the nature of local variable typing, I forgot to modify one of the places where
1677         we glue the DFG's notion of variable prediction to the runtime's notion of variable tagging.
1678
1679         * dfg/DFGSpeculativeJIT.cpp:
1680         (JSC::DFG::SpeculativeJIT::compile):
1681
1682 2012-07-23  Simon Fraser  <simon.fraser@apple.com>
1683
1684         Part 2 of: Implement sticky positioning
1685         https://bugs.webkit.org/show_bug.cgi?id=90046
1686
1687         Reviewed by Ojan Vafai.
1688
1689         Turn on ENABLE_CSS_STICKY_POSITION.
1690
1691         * Configurations/FeatureDefines.xcconfig:
1692
1693 2012-07-23  Patrick Gansterer  <paroga@webkit.org>
1694
1695         Move JSC::parseDate() from DateConversion to JSDateMath
1696         https://bugs.webkit.org/show_bug.cgi?id=91982
1697
1698         Reviewed by Geoffrey Garen.
1699
1700         Moveing this function into the other files removes the dependency
1701         on JSC spcific classes in DateConversion.{cpp|h}.
1702
1703         * runtime/DateConversion.cpp:
1704         * runtime/DateConversion.h:
1705         (JSC):
1706         * runtime/JSDateMath.cpp:
1707         (JSC::parseDate):
1708         (JSC):
1709         * runtime/JSDateMath.h:
1710         (JSC):
1711
1712 2012-07-23  Simon Fraser  <simon.fraser@apple.com>
1713
1714         Part 1 of: Implement sticky positioning
1715         https://bugs.webkit.org/show_bug.cgi?id=90046
1716
1717         Reviewed by Ojan Vafai.
1718
1719         Add ENABLE_CSS_STICKY_POSITION, defaulting to off initially.
1720
1721         Sort the ENABLE_CSS lines in the file. Make sure all the flags
1722         are in FEATURE_DEFINES.
1723
1724         * Configurations/FeatureDefines.xcconfig:
1725
1726 2012-07-23  Yong Li  <yoli@rim.com>
1727
1728         [BlackBerry] Implement GCActivityCallback with platform timer
1729         https://bugs.webkit.org/show_bug.cgi?id=90175
1730
1731         Reviewed by Rob Buis.
1732
1733         Use JSLock when performing GC to avoid assertions.
1734
1735         * runtime/GCActivityCallbackBlackBerry.cpp:
1736         (JSC::DefaultGCActivityCallback::doWork):
1737
1738 2012-07-23  Kent Tamura  <tkent@chromium.org>
1739
1740         Rename ENABLE_METER_TAG and ENABLE_PROGRESS_TAG to ENABLE_METER_ELEMENT and ENABLE_PROGRESS_ELEMENT respectively
1741         https://bugs.webkit.org/show_bug.cgi?id=91941
1742
1743         Reviewed by Kentaro Hara.
1744
1745         A flag name for an elmement should be ENABLE_*_ELEMENT.
1746
1747         * Configurations/FeatureDefines.xcconfig:
1748
1749 2012-07-22  Kent Tamura  <tkent@chromium.org>
1750
1751         Rename ENABLE_DETAILS to ENABLE_DETAILS_ELEMENT
1752         https://bugs.webkit.org/show_bug.cgi?id=91928
1753
1754         Reviewed by Kentaro Hara.
1755
1756         A flag name for an elmement should be ENABLE_*_ELEMENT.
1757
1758         * Configurations/FeatureDefines.xcconfig:
1759
1760 2012-07-21  Patrick Gansterer  <paroga@webkit.org>
1761
1762         [WIN] Use GetDateFormat and GetTimeFormat instead of strftime
1763         https://bugs.webkit.org/show_bug.cgi?id=83436
1764
1765         Reviewed by Brent Fulgham.
1766
1767         The MS CRT implementation of strftime calls the same two functions.
1768         Using them directly avoids the overhead of parsing the format string and removes
1769         the dependency on strftime() for WinCE where this function does not exist.
1770
1771         * runtime/DatePrototype.cpp:
1772         (JSC::formatLocaleDate):
1773
1774 2012-07-20  Kent Tamura  <tkent@chromium.org>
1775
1776         Rename ENABLE_DATALIST to ENABLE_DATALIST_ELEMENT
1777         https://bugs.webkit.org/show_bug.cgi?id=91846
1778
1779         Reviewed by Kentaro Hara.
1780
1781         A flag name for an elmement should be ENABLE_*_ELEMENT.
1782
1783         * Configurations/FeatureDefines.xcconfig:
1784
1785 2012-07-20  Han Shen  <shenhan@google.com>
1786
1787         [Chromium] Compilation fails under gcc 4.7
1788         https://bugs.webkit.org/show_bug.cgi?id=90227
1789
1790         Reviewed by Tony Chang.
1791
1792         Disable warnings about c++0x compatibility in gcc newer than 4.6.
1793
1794         * JavaScriptCore.gyp/JavaScriptCore.gyp:
1795
1796 2012-07-18  Filip Pizlo  <fpizlo@apple.com>
1797
1798         DFG cell checks should be hoisted
1799         https://bugs.webkit.org/show_bug.cgi?id=91717
1800
1801         Reviewed by Geoffrey Garen.
1802
1803         The DFG has always had the policy of hoisting array and integer checks to
1804         the point of variable assignment. Eventually, we added doubles and booleans
1805         to the mix. But cells should really be part of this as well, particularly
1806         for 32-bit where accessing a known-type variable is dramatically cheaper
1807         than accessing a variable whose types is only predicted but otherwise
1808         unproven.
1809
1810         This appears to be a definite speed-up for V8 on 32-bit, a possible speed-up
1811         for Kraken, and a possible slow-down for V8 on 64-bit (around 0.2% if at
1812         all). Any slow-downs can, and should, be addressed by making the hoisting
1813         logic cognizant of variables that are never used in a manner that requires
1814         type checks, and by sinking argument checks to the point(s) of first use.
1815
1816         To make this work I had to change some OSR machinery, and special-case the
1817         type predictions of the 'this' argument for constructors. OSR exit normally
1818         assumes that arguments are boxed, which happens to be true because the
1819         type prediction used for check hoisting is LUB'd with the type of the
1820         argument that was passed in - so either the arguments are always stored to
1821         with the full tag+payload, or if only the payload is stored then the tag
1822         matches whatever the caller would have set. But not so with the 'this'
1823         argument for constructors, which is not initialized by the caller. We
1824         could make this more precise by having argument types for OSR be inferred
1825         using similar machinery to other locals, but I figured that for this patch
1826         I should use the surgical fix.
1827
1828         * assembler/MacroAssemblerX86_64.h:
1829         (JSC::MacroAssemblerX86_64::branchTestPtr):
1830         (MacroAssemblerX86_64):
1831         * assembler/X86Assembler.h:
1832         (JSC::X86Assembler::testq_rm):
1833         (X86Assembler):
1834         * dfg/DFGAbstractState.cpp:
1835         (JSC::DFG::AbstractState::initialize):
1836         (JSC::DFG::AbstractState::execute):
1837         * dfg/DFGDriver.cpp:
1838         (JSC::DFG::compile):
1839         * dfg/DFGGraph.h:
1840         (JSC::DFG::Graph::isCreatedThisArgument):
1841         (Graph):
1842         * dfg/DFGSpeculativeJIT.cpp:
1843         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
1844         * dfg/DFGSpeculativeJIT32_64.cpp:
1845         (JSC::DFG::SpeculativeJIT::compile):
1846         * dfg/DFGSpeculativeJIT64.cpp:
1847         (JSC::DFG::SpeculativeJIT::compile):
1848         * dfg/DFGValueSource.h:
1849         (JSC::DFG::ValueSource::forSpeculation):
1850
1851 2012-07-19  Filip Pizlo  <fpizlo@apple.com>
1852
1853         Fast path of storage resize should be removed from property storage reallocation, since it is only useful for arrays
1854         https://bugs.webkit.org/show_bug.cgi?id=91796
1855
1856         Reviewed by Geoffrey Garen.
1857
1858         * dfg/DFGRepatch.cpp:
1859         (JSC::DFG::emitPutTransitionStub):
1860         * dfg/DFGSpeculativeJIT.cpp:
1861         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
1862         * runtime/JSObject.cpp:
1863         (JSC::JSObject::growOutOfLineStorage):
1864
1865 2012-07-19  Mark Lam  <mark.lam@apple.com>
1866
1867         Bug fixes and enhancements for OfflineASM annotation system.
1868         https://bugs.webkit.org/show_bug.cgi?id=91690
1869
1870         Reviewed by Filip Pizlo.
1871
1872         * offlineasm/armv7.rb: added default handling of Instruction lower().
1873         * offlineasm/asm.rb: added more support for annotations and more pretty printing.
1874         * offlineasm/ast.rb: added more support for annotations.
1875         * offlineasm/config.rb: added $preferredCommentStartColumn, simplified $enableInstrAnnotations.
1876         * offlineasm/parser.rb: added more support for annotations.
1877         * offlineasm/transform.rb: added more support for annotations.
1878         * offlineasm/x86.rb: added default handling of Instruction lower().
1879
1880 2012-07-19  Patrick Gansterer  <paroga@webkit.org>
1881
1882         [WIN] Fix compilation of JSGlobalData.h with ENABLE(DFG_JIT)
1883         https://bugs.webkit.org/show_bug.cgi?id=91243
1884
1885         Reviewed by Geoffrey Garen.
1886
1887         Disable MSVC warning 4200 "zero-sized array in struct/union" for JSC::ScratchBuffer.
1888
1889         * runtime/JSGlobalData.h:
1890         (JSC):
1891
1892 2012-07-19  Mark Lam  <mark.lam@apple.com>
1893
1894         Fixed broken ENABLE_JIT=0 build.
1895         https://bugs.webkit.org/show_bug.cgi?id=91725
1896
1897         Reviewed by Oliver Hunt.
1898
1899         * bytecode/Watchpoint.cpp:
1900         * heap/JITStubRoutineSet.h:
1901         (JSC):
1902         (JITStubRoutineSet):
1903         (JSC::JITStubRoutineSet::JITStubRoutineSet):
1904         (JSC::JITStubRoutineSet::~JITStubRoutineSet):
1905         (JSC::JITStubRoutineSet::add):
1906         (JSC::JITStubRoutineSet::clearMarks):
1907         (JSC::JITStubRoutineSet::mark):
1908         (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
1909         (JSC::JITStubRoutineSet::traceMarkedStubRoutines):
1910
1911 2012-07-19  Kristóf Kosztyó  <kkristof@inf.u-szeged.hu>
1912
1913         [Qt] Unreviewed buildfix after r123042.
1914
1915         * interpreter/Interpreter.cpp:
1916         (JSC::Interpreter::dumpRegisters):
1917
1918 2012-07-18  Filip Pizlo  <fpizlo@apple.com>
1919
1920         DFG should emit inline code for property storage (re)allocation
1921         https://bugs.webkit.org/show_bug.cgi?id=91597
1922
1923         Reviewed by Oliver Hunt.
1924
1925         This adds two new ops to the DFG IR: AllocatePropertyStorage and
1926         ReallocatePropertyStorage. It enables these to interact properly with
1927         CSE so that a GetPropertyStorage on something for which we have
1928         obviously done a (Re)AllocatePropertyStorage will result in the
1929         GetPropertyStorage being eliminated. Other than that, the code
1930         emitted for these ops is identical to the code we were emitting in
1931         the corresponding PutById stub.
1932
1933         * dfg/DFGAbstractState.cpp:
1934         (JSC::DFG::AbstractState::execute):
1935         * dfg/DFGByteCodeParser.cpp:
1936         (JSC::DFG::ByteCodeParser::parseBlock):
1937         * dfg/DFGCSEPhase.cpp:
1938         (JSC::DFG::CSEPhase::putStructureStoreElimination):
1939         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
1940         * dfg/DFGNode.h:
1941         (JSC::DFG::Node::hasStructureTransitionData):
1942         * dfg/DFGNodeType.h:
1943         (DFG):
1944         * dfg/DFGOperations.cpp:
1945         * dfg/DFGOperations.h:
1946         * dfg/DFGPredictionPropagationPhase.cpp:
1947         (JSC::DFG::PredictionPropagationPhase::propagate):
1948         * dfg/DFGSpeculativeJIT.cpp:
1949         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
1950         (DFG):
1951         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
1952         * dfg/DFGSpeculativeJIT.h:
1953         (JSC::DFG::SpeculativeJIT::callOperation):
1954         (SpeculativeJIT):
1955         * dfg/DFGSpeculativeJIT32_64.cpp:
1956         (JSC::DFG::SpeculativeJIT::compile):
1957         * dfg/DFGSpeculativeJIT64.cpp:
1958         (JSC::DFG::SpeculativeJIT::compile):
1959         * runtime/Structure.cpp:
1960         (JSC::nextOutOfLineStorageCapacity):
1961         * runtime/Structure.h:
1962         (JSC):
1963
1964 2012-07-16  Oliver Hunt  <oliver@apple.com>
1965
1966         dumpCallFrame is broken in ToT
1967         https://bugs.webkit.org/show_bug.cgi?id=91444
1968
1969         Reviewed by Gavin Barraclough.
1970
1971         Various changes have been made to the SF calling convention, but
1972         dumpCallFrame has not been updated to reflect these changes.
1973         That resulted in both bogus information, as well as numerous
1974         assertions of sadness.
1975
1976         This patch makes dumpCallFrame actually work again and adds the
1977         wonderful feature of telling you the name of the variable that a
1978         register reflects, or what value it contains.
1979
1980         * bytecode/CodeBlock.cpp:
1981         (JSC::CodeBlock::nameForRegister):
1982             A really innefficient mechanism for finding the name of a local register.
1983             This should only ever be used by debug code so this should be okay.
1984         * bytecode/CodeBlock.h:
1985         (CodeBlock):
1986         * bytecompiler/BytecodeGenerator.cpp:
1987         (JSC::BytecodeGenerator::generate):
1988             Debug builds no longer throw away a functions symbol table, this allows
1989             us to actually perform a register# to name mapping
1990         * dfg/DFGJITCompiler.cpp:
1991         (JSC::DFG::JITCompiler::link):
1992             We weren't propogating the bytecode offset here leading to assertions
1993             in debug builds when dumping bytecode of DFG compiled code.
1994         * interpreter/Interpreter.cpp:
1995         (JSC):
1996         (JSC::Interpreter::dumpRegisters):
1997              Rework to actually be correct.
1998         (JSC::getCallerInfo):
1999              Return the byteocde offset as well now, given we have to determine it
2000              anyway.
2001         (JSC::Interpreter::getStackTrace):
2002         (JSC::Interpreter::retrieveCallerFromVMCode):
2003         * interpreter/Interpreter.h:
2004         (Interpreter):
2005         * jsc.cpp:
2006         (GlobalObject::finishCreation):
2007         (functionDumpCallFrame):
2008              Give debug builds of JSC a method for calling dumpCallFrame so we can
2009              inspect a callframe without requiring us to break in a debugger.
2010
2011 2012-07-18  Filip Pizlo  <fpizlo@apple.com>
2012
2013         DFG 32-bit PutById transition stub storage reallocation case copies the first pointer of each JSValue instead of the whole JSValue
2014         https://bugs.webkit.org/show_bug.cgi?id=91599
2015
2016         Reviewed by Geoffrey Garen.
2017
2018         * dfg/DFGRepatch.cpp:
2019         (JSC::DFG::emitPutTransitionStub):
2020
2021 2012-07-17  Filip Pizlo  <fpizlo@apple.com>
2022
2023         DFG 32-bit PutById transition stub passes the payload/tag arguments to a DFG operation in the wrong order
2024         https://bugs.webkit.org/show_bug.cgi?id=91576
2025
2026         Reviewed by Gavin Barraclough.
2027
2028         * dfg/DFGRepatch.cpp:
2029         (JSC::DFG::emitPutTransitionStub):
2030
2031 2012-07-17  Filip Pizlo  <fpizlo@apple.com>
2032
2033         [Qt] REGRESSION(r122768, r122771): They broke jquery/data.html and inspector/elements/edit-dom-actions.html
2034         https://bugs.webkit.org/show_bug.cgi?id=91476
2035
2036         Reviewed by Mark Hahnenberg.
2037
2038         The 32-bit repatching code was not correctly adapted to the new world where there may not always
2039         be an available scratch register. Fixed it by ensuring that the scratch register we select does
2040         not overlap with the value tag.
2041
2042         * dfg/DFGRepatch.cpp:
2043         (JSC::DFG::generateProtoChainAccessStub):
2044         (JSC::DFG::tryCacheGetByID):
2045         (JSC::DFG::tryBuildGetByIDList):
2046         (JSC::DFG::emitPutReplaceStub):
2047
2048 2012-07-17  Gabor Rapcsanyi  <rgabor@webkit.org>
2049
2050         Unreviewed buildfix from Zoltan Herczeg after 122768.
2051
2052         * dfg/DFGCCallHelpers.h:
2053         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
2054         (CCallHelpers):
2055
2056 2012-07-17  David Barr  <davidbarr@chromium.org>
2057
2058         Introduce ENABLE_CSS_IMAGE_ORIENTATION compile flag
2059         https://bugs.webkit.org/show_bug.cgi?id=89055
2060
2061         Reviewed by Kent Tamura.
2062
2063         The css3-images module is at candidate recommendation.
2064         http://www.w3.org/TR/2012/CR-css3-images-20120417/#the-image-orientation
2065
2066         Add a configuration option for CSS image-orientation support, disabling it by default.
2067
2068         * Configurations/FeatureDefines.xcconfig:
2069
2070 2012-07-16  Filip Pizlo  <fpizlo@apple.com>
2071
2072         Unreviewed, roll out 122790 because it broke the Windows build. I'm not
2073         sure what to do with exported symbols that are predicated on NDEBUG.
2074
2075         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2076         * bytecode/CodeBlock.cpp:
2077         (JSC):
2078         * bytecode/CodeBlock.h:
2079         (CodeBlock):
2080         * bytecompiler/BytecodeGenerator.cpp:
2081         (JSC::BytecodeGenerator::generate):
2082         * dfg/DFGJITCompiler.cpp:
2083         (JSC::DFG::JITCompiler::link):
2084         * interpreter/Interpreter.cpp:
2085         (JSC):
2086         (JSC::Interpreter::dumpRegisters):
2087         (JSC::getCallerInfo):
2088         (JSC::Interpreter::getStackTrace):
2089         (JSC::Interpreter::retrieveCallerFromVMCode):
2090         * interpreter/Interpreter.h:
2091         (Interpreter):
2092         * jsc.cpp:
2093         (GlobalObject::finishCreation):
2094
2095 2012-07-16  Oliver Hunt  <oliver@apple.com>
2096
2097         dumpCallFrame is broken in ToT
2098         https://bugs.webkit.org/show_bug.cgi?id=91444
2099
2100         Reviewed by Gavin Barraclough.
2101
2102         Various changes have been made to the SF calling convention, but
2103         dumpCallFrame has not been updated to reflect these changes.
2104         That resulted in both bogus information, as well as numerous
2105         assertions of sadness.
2106
2107         This patch makes dumpCallFrame actually work again and adds the
2108         wonderful feature of telling you the name of the variable that a
2109         register reflects, or what value it contains.
2110
2111         * bytecode/CodeBlock.cpp:
2112         (JSC::CodeBlock::nameForRegister):
2113             A really innefficient mechanism for finding the name of a local register.
2114             This should only ever be used by debug code so this should be okay.
2115         * bytecode/CodeBlock.h:
2116         (CodeBlock):
2117         * bytecompiler/BytecodeGenerator.cpp:
2118         (JSC::BytecodeGenerator::generate):
2119             Debug builds no longer throw away a functions symbol table, this allows
2120             us to actually perform a register# to name mapping
2121         * dfg/DFGJITCompiler.cpp:
2122         (JSC::DFG::JITCompiler::link):
2123             We weren't propogating the bytecode offset here leading to assertions
2124             in debug builds when dumping bytecode of DFG compiled code.
2125         * interpreter/Interpreter.cpp:
2126         (JSC):
2127         (JSC::Interpreter::dumpRegisters):
2128              Rework to actually be correct.
2129         (JSC::getCallerInfo):
2130              Return the byteocde offset as well now, given we have to determine it
2131              anyway.
2132         (JSC::Interpreter::getStackTrace):
2133         (JSC::Interpreter::retrieveCallerFromVMCode):
2134         * interpreter/Interpreter.h:
2135         (Interpreter):
2136         * jsc.cpp:
2137         (GlobalObject::finishCreation):
2138         (functionDumpCallFrame):
2139              Give debug builds of JSC a method for calling dumpCallFrame so we can
2140              inspect a callframe without requiring us to break in a debugger.
2141
2142 2012-07-16  Filip Pizlo  <fpizlo@apple.com>
2143
2144         Unreviewed, adding forgotten files.
2145
2146         * dfg/DFGRegisterSet.h: Added.
2147         (DFG):
2148         (RegisterSet):
2149         (JSC::DFG::RegisterSet::RegisterSet):
2150         (JSC::DFG::RegisterSet::asPOD):
2151         (JSC::DFG::RegisterSet::copyInfo):
2152         (JSC::DFG::RegisterSet::set):
2153         (JSC::DFG::RegisterSet::setGPRByIndex):
2154         (JSC::DFG::RegisterSet::clear):
2155         (JSC::DFG::RegisterSet::get):
2156         (JSC::DFG::RegisterSet::getGPRByIndex):
2157         (JSC::DFG::RegisterSet::getFreeGPR):
2158         (JSC::DFG::RegisterSet::setFPRByIndex):
2159         (JSC::DFG::RegisterSet::getFPRByIndex):
2160         (JSC::DFG::RegisterSet::setByIndex):
2161         (JSC::DFG::RegisterSet::getByIndex):
2162         (JSC::DFG::RegisterSet::numberOfSetGPRs):
2163         (JSC::DFG::RegisterSet::numberOfSetFPRs):
2164         (JSC::DFG::RegisterSet::numberOfSetRegisters):
2165         (JSC::DFG::RegisterSet::setBit):
2166         (JSC::DFG::RegisterSet::clearBit):
2167         (JSC::DFG::RegisterSet::getBit):
2168         * dfg/DFGScratchRegisterAllocator.h: Added.
2169         (DFG):
2170         (ScratchRegisterAllocator):
2171         (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator):
2172         (JSC::DFG::ScratchRegisterAllocator::lock):
2173         (JSC::DFG::ScratchRegisterAllocator::allocateScratch):
2174         (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR):
2175         (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR):
2176         (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters):
2177         (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
2178         (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
2179         (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize):
2180         (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
2181         (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
2182
2183 2012-07-15  Filip Pizlo  <fpizlo@apple.com>
2184
2185         DFG PutById transition should handle storage allocation, and inline it
2186         https://bugs.webkit.org/show_bug.cgi?id=91337
2187
2188         Reviewed by Oliver Hunt.
2189
2190         This enables the patching of DFG PutById to handle the out-of-line storage
2191         allocation case. Furthermore, it inlines out-of-line storage allocation (and
2192         reallocation) into the generated stubs.
2193
2194         To do this, this patch adds the ability to store the relevant register
2195         allocation state (i.e. the set of in-use registers) in the structure stub
2196         info so that the stub generation code can more flexibly select scratch
2197         registers: sometimes it needs none, sometimes one - or sometimes up to
2198         three. Moreover, to make the stub generation register allocation simple and
2199         maintainable, this patch introduces a reusable scratch register allocator
2200         class. This register allocator understands that some registers are in use by
2201         the main path code and so must be spilled as necessary, other registers are
2202         locked for use in the stub itself and so cannot even be spilled, while still
2203         others may be allocated for scratch purposes. A scratch register that is
2204         used must be spilled. If a register is locked, it cannot be used as a
2205         scratch register. If a register is used, it can be used as a scratch
2206         register so long as it is spilled.
2207
2208         This is a sub-1% speed-up on V8 and neutral elsewhere.
2209
2210         * GNUmakefile.list.am:
2211         * JavaScriptCore.xcodeproj/project.pbxproj:
2212         * assembler/MacroAssemblerCodeRef.h:
2213         (FunctionPtr):
2214         (JSC::FunctionPtr::FunctionPtr):
2215         * bytecode/StructureStubInfo.h:
2216         * dfg/DFGCCallHelpers.h:
2217         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
2218         (CCallHelpers):
2219         * dfg/DFGGPRInfo.h:
2220         * dfg/DFGJITCompiler.cpp:
2221         (JSC::DFG::JITCompiler::link):
2222         * dfg/DFGJITCompiler.h:
2223         (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
2224         (PropertyAccessRecord):
2225         * dfg/DFGOperations.cpp:
2226         * dfg/DFGOperations.h:
2227         * dfg/DFGRegisterBank.h:
2228         (JSC::DFG::RegisterBank::isInUse):
2229         (RegisterBank):
2230         * dfg/DFGRegisterSet.h: Added.
2231         (DFG):
2232         (RegisterSet):
2233         (JSC::DFG::RegisterSet::RegisterSet):
2234         (JSC::DFG::RegisterSet::asPOD):
2235         (JSC::DFG::RegisterSet::copyInfo):
2236         (JSC::DFG::RegisterSet::set):
2237         (JSC::DFG::RegisterSet::setGPRByIndex):
2238         (JSC::DFG::RegisterSet::clear):
2239         (JSC::DFG::RegisterSet::get):
2240         (JSC::DFG::RegisterSet::getGPRByIndex):
2241         (JSC::DFG::RegisterSet::getFreeGPR):
2242         (JSC::DFG::RegisterSet::setFPRByIndex):
2243         (JSC::DFG::RegisterSet::getFPRByIndex):
2244         (JSC::DFG::RegisterSet::setByIndex):
2245         (JSC::DFG::RegisterSet::getByIndex):
2246         (JSC::DFG::RegisterSet::numberOfSetGPRs):
2247         (JSC::DFG::RegisterSet::numberOfSetFPRs):
2248         (JSC::DFG::RegisterSet::numberOfSetRegisters):
2249         (JSC::DFG::RegisterSet::setBit):
2250         (JSC::DFG::RegisterSet::clearBit):
2251         (JSC::DFG::RegisterSet::getBit):
2252         * dfg/DFGRepatch.cpp:
2253         (JSC::DFG::generateProtoChainAccessStub):
2254         (JSC::DFG::tryCacheGetByID):
2255         (JSC::DFG::tryBuildGetByIDList):
2256         (JSC::DFG::emitPutReplaceStub):
2257         (JSC::DFG::emitPutTransitionStub):
2258         (JSC::DFG::tryCachePutByID):
2259         (JSC::DFG::tryBuildPutByIdList):
2260         * dfg/DFGScratchRegisterAllocator.h: Added.
2261         (DFG):
2262         (ScratchRegisterAllocator):
2263         (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator):
2264         (JSC::DFG::ScratchRegisterAllocator::lock):
2265         (JSC::DFG::ScratchRegisterAllocator::allocateScratch):
2266         (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR):
2267         (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR):
2268         (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters):
2269         (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
2270         (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
2271         (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize):
2272         (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
2273         (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
2274         * dfg/DFGSpeculativeJIT.h:
2275         (SpeculativeJIT):
2276         (JSC::DFG::SpeculativeJIT::usedRegisters):
2277         * dfg/DFGSpeculativeJIT32_64.cpp:
2278         (JSC::DFG::SpeculativeJIT::cachedGetById):
2279         (JSC::DFG::SpeculativeJIT::cachedPutById):
2280         (JSC::DFG::SpeculativeJIT::compile):
2281         * dfg/DFGSpeculativeJIT64.cpp:
2282         (JSC::DFG::SpeculativeJIT::cachedGetById):
2283         (JSC::DFG::SpeculativeJIT::cachedPutById):
2284         (JSC::DFG::SpeculativeJIT::compile):
2285         * heap/CopiedAllocator.h:
2286         (CopiedAllocator):
2287         (JSC::CopiedAllocator::fastPathShouldSucceed):
2288         (JSC):
2289
2290 2012-07-16  Patrick Gansterer  <paroga@webkit.org>
2291
2292         Add dfg switch to create_jit_stubs script
2293         https://bugs.webkit.org/show_bug.cgi?id=91256
2294
2295         Reviewed by Geoffrey Garen.
2296
2297         * create_jit_stubs: Add a switch to enable or disable the generation of
2298                             stub functions in #if ENABLE(DFG_JIT) conditions.
2299
2300 2012-07-16  Gabor Rapcsanyi  <rgabor@webkit.org>
2301
2302         Unreviewed buildfix after r122729. Typo fix.
2303
2304         * assembler/MacroAssemblerARM.h:
2305         (JSC::MacroAssemblerARM::add32):
2306
2307 2012-07-16  Gabor Rapcsanyi  <rgabor@webkit.org>
2308
2309         Unreviewed buildfix from Zoltan Herczeg after r122677.
2310         Implement missing add32 function to MacroAssemblerARM.
2311
2312         * assembler/MacroAssemblerARM.h:
2313         (JSC::MacroAssemblerARM::add32):
2314         (MacroAssemblerARM):
2315
2316 2012-07-14  Filip Pizlo  <fpizlo@apple.com>
2317
2318         DFG PutByVal opcodes should accept more than 3 operands
2319         https://bugs.webkit.org/show_bug.cgi?id=91332
2320
2321         Reviewed by Oliver Hunt.
2322
2323         Turned PutByVal/PutByValAlias into var-arg nodes, so that we can give them
2324         4 or more operands in the future.
2325
2326         * dfg/DFGAbstractState.cpp:
2327         (JSC::DFG::AbstractState::execute):
2328         * dfg/DFGByteCodeParser.cpp:
2329         (JSC::DFG::ByteCodeParser::parseBlock):
2330         * dfg/DFGCSEPhase.cpp:
2331         (JSC::DFG::CSEPhase::getByValLoadElimination):
2332         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
2333         (JSC::DFG::CSEPhase::performNodeCSE):
2334         * dfg/DFGFixupPhase.cpp:
2335         (JSC::DFG::FixupPhase::fixupNode):
2336         (JSC::DFG::FixupPhase::fixDoubleEdge):
2337         * dfg/DFGGraph.h:
2338         (JSC::DFG::Graph::byValIsPure):
2339         (JSC::DFG::Graph::varArgNumChildren):
2340         (Graph):
2341         (JSC::DFG::Graph::numChildren):
2342         (JSC::DFG::Graph::varArgChild):
2343         (JSC::DFG::Graph::child):
2344         * dfg/DFGNodeType.h:
2345         (DFG):
2346         * dfg/DFGPredictionPropagationPhase.cpp:
2347         (JSC::DFG::PredictionPropagationPhase::propagate):
2348         * dfg/DFGSpeculativeJIT.cpp:
2349         (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
2350         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
2351         * dfg/DFGSpeculativeJIT32_64.cpp:
2352         (JSC::DFG::SpeculativeJIT::compile):
2353         * dfg/DFGSpeculativeJIT64.cpp:
2354         (JSC::DFG::SpeculativeJIT::compile):
2355
2356 2012-07-14  Filip Pizlo  <fpizlo@apple.com>
2357
2358         Rationalize and optimize storage allocation
2359         https://bugs.webkit.org/show_bug.cgi?id=91303
2360
2361         Reviewed by Oliver Hunt.
2362
2363         This implements a backwards bump allocator for copied space storage
2364         allocation, shown in pseudo-code below:
2365
2366             pointer bump(size) {
2367                 pointer tmp = allocator->remaining;
2368                 tmp -= size;
2369                 if (tmp < 0)
2370                     fail;
2371                 allocator->remaining = tmp;
2372                 return allocator->payloadEnd - tmp - size;
2373             }
2374
2375         The advantage of this allocator is that it:
2376
2377         - Only requires one comparison in the common case where size is known to
2378           not be huge, and this comparison can be done by checking the sign bit
2379           of the subtraction.
2380
2381         - Can be implemented even when only one register is available. This
2382           register is reused for both temporary storage during allocation and
2383           for the result.
2384
2385         - Preserves the behavior that memory in a block is filled in from lowest
2386           address to highest address, which allows for a cheap reallocation fast
2387           path.
2388
2389         - Is resilient against the block used for allocation being the last one
2390           in virtual memory, thereby otherwise leading to the risk of overflow
2391           in the bump pointer, despite only doing one branch.
2392
2393         In order to implement this allocator using the smallest possible chunk
2394         of code, I refactored the copied space code so that all of the allocation
2395         logic is in CopiedAllocator, and all of the state is in either
2396         CopiedBlock or CopiedAllocator. This should make changing the allocation
2397         fast path easier in the future.
2398
2399         In order to do this, I needed to add some new assembler support,
2400         particularly for various forms of add(address, register) and negPtr().
2401
2402         This is performance neutral. The purpose of this change is to facilitate
2403         further inlining of storage allocation without having to reserve
2404         additional registers or emit too much code.
2405
2406         * assembler/MacroAssembler.h:
2407         (JSC::MacroAssembler::addPtr):
2408         (MacroAssembler):
2409         (JSC::MacroAssembler::negPtr):
2410         * assembler/MacroAssemblerARMv7.h:
2411         (MacroAssemblerARMv7):
2412         (JSC::MacroAssemblerARMv7::add32):
2413         * assembler/MacroAssemblerX86.h:
2414         (JSC::MacroAssemblerX86::add32):
2415         (MacroAssemblerX86):
2416         * assembler/MacroAssemblerX86_64.h:
2417         (MacroAssemblerX86_64):
2418         (JSC::MacroAssemblerX86_64::addPtr):
2419         (JSC::MacroAssemblerX86_64::negPtr):
2420         * assembler/X86Assembler.h:
2421         (X86Assembler):
2422         (JSC::X86Assembler::addl_mr):
2423         (JSC::X86Assembler::addq_mr):
2424         (JSC::X86Assembler::negq_r):
2425         * heap/CopiedAllocator.h:
2426         (CopiedAllocator):
2427         (JSC::CopiedAllocator::isValid):
2428         (JSC::CopiedAllocator::CopiedAllocator):
2429         (JSC::CopiedAllocator::tryAllocate):
2430         (JSC):
2431         (JSC::CopiedAllocator::tryReallocate):
2432         (JSC::CopiedAllocator::forceAllocate):
2433         (JSC::CopiedAllocator::resetCurrentBlock):
2434         (JSC::CopiedAllocator::setCurrentBlock):
2435         (JSC::CopiedAllocator::currentCapacity):
2436         * heap/CopiedBlock.h:
2437         (CopiedBlock):
2438         (JSC::CopiedBlock::create):
2439         (JSC::CopiedBlock::zeroFillWilderness):
2440         (JSC::CopiedBlock::CopiedBlock):
2441         (JSC::CopiedBlock::payloadEnd):
2442         (JSC):
2443         (JSC::CopiedBlock::payloadCapacity):
2444         (JSC::CopiedBlock::data):
2445         (JSC::CopiedBlock::dataEnd):
2446         (JSC::CopiedBlock::dataSize):
2447         (JSC::CopiedBlock::wilderness):
2448         (JSC::CopiedBlock::wildernessEnd):
2449         (JSC::CopiedBlock::wildernessSize):
2450         (JSC::CopiedBlock::size):
2451         * heap/CopiedSpace.cpp:
2452         (JSC::CopiedSpace::tryAllocateSlowCase):
2453         (JSC::CopiedSpace::tryAllocateOversize):
2454         (JSC::CopiedSpace::tryReallocate):
2455         (JSC::CopiedSpace::doneFillingBlock):
2456         (JSC::CopiedSpace::doneCopying):
2457         * heap/CopiedSpace.h:
2458         (CopiedSpace):
2459         * heap/CopiedSpaceInlineMethods.h:
2460         (JSC::CopiedSpace::startedCopying):
2461         (JSC::CopiedSpace::allocateBlockForCopyingPhase):
2462         (JSC::CopiedSpace::allocateBlock):
2463         (JSC::CopiedSpace::tryAllocate):
2464         (JSC):
2465         * heap/MarkStack.cpp:
2466         (JSC::SlotVisitor::startCopying):
2467         (JSC::SlotVisitor::allocateNewSpace):
2468         (JSC::SlotVisitor::doneCopying):
2469         * heap/SlotVisitor.h:
2470         (JSC::SlotVisitor::SlotVisitor):
2471         * jit/JIT.h:
2472         * jit/JITInlineMethods.h:
2473         (JSC::JIT::emitAllocateBasicStorage):
2474         (JSC::JIT::emitAllocateJSArray):
2475
2476 2012-07-13  Mark Lam  <mark.lam@apple.com>
2477
2478         OfflineASM Pretty printing and commenting enhancements.
2479         https://bugs.webkit.org/show_bug.cgi?id=91281
2480
2481         Reviewed by Filip Pizlo.
2482
2483         Added some minor pretty printing in the OfflineASM.
2484         Also added infrastruture for adding multiple types of comments and
2485         annotations with the ability to enable/disable them in the generated
2486         output as desired.
2487
2488         * GNUmakefile.list.am: add new file config.rb.
2489         * llint/LLIntOfflineAsmConfig.h:
2490           Added OFFLINE_ASM_BEGIN, OFFLINE_ASM_END, and OFFLINE_ASM_LOCAL_LABEL macros.
2491           This will allow us to redefine these for other backends later.
2492         * llint/LowLevelInterpreter32_64.asm:
2493           Add a small example of instruction annotations for now.
2494         * llint/LowLevelInterpreter64.asm:
2495           Add a small example of instruction annotations for now.
2496         * offlineasm/armv7.rb: Added handling of annotations.
2497         * offlineasm/asm.rb:
2498           Added machinery to dump the new comments and annotations.
2499           Also added some indentations to make the output a little prettier.
2500         * offlineasm/ast.rb: Added annotation field in class Instruction.
2501         * offlineasm/backends.rb:
2502         * offlineasm/config.rb: Added.
2503           Currently only contains commenting options.  This file is meant to be
2504           a centralized place for build config values much like config.h for
2505           JavaScriptCore.
2506         * offlineasm/generate_offset_extractor.rb:
2507         * offlineasm/instructions.rb:
2508         * offlineasm/offsets.rb:
2509         * offlineasm/opt.rb:
2510         * offlineasm/parser.rb: Parse and record annotations.
2511         * offlineasm/registers.rb:
2512         * offlineasm/self_hash.rb:
2513         * offlineasm/settings.rb:
2514         * offlineasm/transform.rb:
2515         * offlineasm/x86.rb: Added handling of annotations.
2516
2517 2012-07-13  Filip Pizlo  <fpizlo@apple.com>
2518
2519         ASSERTION FAILED: use.useKind() != DoubleUse
2520         https://bugs.webkit.org/show_bug.cgi?id=91082
2521
2522         Reviewed by Geoffrey Garen.
2523
2524         The implementation of Branch() was unwisely relying on register allocation state
2525         to decide what speculations to perform. That's never correct.
2526
2527         * dfg/DFGSpeculativeJIT32_64.cpp:
2528         (JSC::DFG::SpeculativeJIT::compile):
2529         * dfg/DFGSpeculativeJIT64.cpp:
2530         (JSC::DFG::SpeculativeJIT::compile):
2531
2532 2012-07-13  Sheriff Bot  <webkit.review.bot@gmail.com>
2533
2534         Unreviewed, rolling out r122640.
2535         http://trac.webkit.org/changeset/122640
2536         https://bugs.webkit.org/show_bug.cgi?id=91298
2537
2538         LLInt apparently does not expect to mark these (Requested by
2539         olliej on #webkit).
2540
2541         * bytecode/CodeBlock.cpp:
2542         (JSC::CodeBlock::visitStructures):
2543         (JSC::CodeBlock::stronglyVisitStrongReferences):
2544
2545 2012-07-13  Oliver Hunt  <oliver@apple.com>
2546
2547         LLInt fails to mark structures stored in the bytecode
2548         https://bugs.webkit.org/show_bug.cgi?id=91296
2549
2550         Reviewed by Geoffrey Garen.
2551
2552         LLInt stores structures in the bytecode, so we need to visit the appropriate
2553         instructions as we would if we were running in the classic interpreter.
2554         This requires adding additional checks for the LLInt specific opcodes, and
2555         the lint specific variants of operand ordering.
2556
2557         * bytecode/CodeBlock.cpp:
2558         (JSC::CodeBlock::visitStructures):
2559         (JSC::CodeBlock::stronglyVisitStrongReferences):
2560
2561 2012-07-13  Yong Li  <yoli@rim.com>
2562
2563         [BlackBerry] Implement GCActivityCallback with platform timer
2564         https://bugs.webkit.org/show_bug.cgi?id=90175
2565
2566         Reviewed by Rob Buis.
2567
2568         Implement GCActivityCallback and HeapTimer for BlackBerry port.
2569
2570         * heap/HeapTimer.cpp:
2571         (JSC):
2572         (JSC::HeapTimer::HeapTimer):
2573         (JSC::HeapTimer::~HeapTimer):
2574         (JSC::HeapTimer::timerDidFire):
2575         (JSC::HeapTimer::synchronize):
2576         (JSC::HeapTimer::invalidate):
2577         (JSC::HeapTimer::didStartVMShutdown):
2578         * heap/HeapTimer.h:
2579         (HeapTimer):
2580         * runtime/GCActivityCallbackBlackBerry.cpp:
2581         (JSC):
2582         (JSC::DefaultGCActivityCallback::doWork):
2583         (JSC::DefaultGCActivityCallback::didAllocate):
2584         (JSC::DefaultGCActivityCallback::willCollect):
2585         (JSC::DefaultGCActivityCallback::cancel):
2586
2587 2012-07-13  Patrick Gansterer  <paroga@webkit.org>
2588
2589         [WIN] Fix compilation of DFGRepatch.cpp
2590         https://bugs.webkit.org/show_bug.cgi?id=91241
2591
2592         Reviewed by Geoffrey Garen.
2593
2594         Use intptr_t instead of uintptr_t when calling CodeLocationCommon::dataLabelPtrAtOffset(int)
2595         to fix MSVC "unary minus operator applied to unsigned type, result still unsigned" warning.
2596
2597         * dfg/DFGRepatch.cpp:
2598         (JSC::DFG::dfgResetGetByID):
2599         (JSC::DFG::dfgResetPutByID):
2600
2601 2012-07-13  Patrick Gansterer  <paroga@webkit.org>
2602
2603         Fix ARM_TRADITIONAL JIT for COMPILER(MSVC) and COMPILER(RVCT) after r121885
2604         https://bugs.webkit.org/show_bug.cgi?id=91238
2605
2606         Reviewed by Zoltan Herczeg.
2607
2608         r121885 changed the assembler instruction only for COMPILER(GCC).
2609         Use the same instructions for the other compilers too.
2610
2611         * jit/JITStubs.cpp:
2612         (JSC::ctiTrampoline):
2613         (JSC::ctiTrampolineEnd):
2614         (JSC::ctiVMThrowTrampoline):
2615
2616 2012-07-12  Filip Pizlo  <fpizlo@apple.com>
2617
2618         DFG property access stubs should use structure transition watchpoints
2619         https://bugs.webkit.org/show_bug.cgi?id=91135
2620
2621         Reviewed by Geoffrey Garen.
2622
2623         This adds a Watchpoint subclass that will clear a structure stub (i.e.
2624         a property access stub) when fired. The DFG stub generation code now
2625         uses this optimization.
2626
2627         * CMakeLists.txt:
2628         * GNUmakefile.list.am:
2629         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2630         * JavaScriptCore.xcodeproj/project.pbxproj:
2631         * Target.pri:
2632         * bytecode/CodeBlock.cpp:
2633         (JSC):
2634         (JSC::CodeBlock::finalizeUnconditionally):
2635         (JSC::CodeBlock::resetStub):
2636         (JSC::CodeBlock::resetStubInternal):
2637         * bytecode/CodeBlock.h:
2638         (JSC):
2639         (CodeBlock):
2640         * bytecode/StructureStubClearingWatchpoint.cpp: Added.
2641         (JSC):
2642         (JSC::StructureStubClearingWatchpoint::~StructureStubClearingWatchpoint):
2643         (JSC::StructureStubClearingWatchpoint::push):
2644         (JSC::StructureStubClearingWatchpoint::fireInternal):
2645         (JSC::WatchpointsOnStructureStubInfo::~WatchpointsOnStructureStubInfo):
2646         (JSC::WatchpointsOnStructureStubInfo::addWatchpoint):
2647         (JSC::WatchpointsOnStructureStubInfo::ensureReferenceAndAddWatchpoint):
2648         * bytecode/StructureStubClearingWatchpoint.h: Added.
2649         (JSC):
2650         (StructureStubClearingWatchpoint):
2651         (JSC::StructureStubClearingWatchpoint::StructureStubClearingWatchpoint):
2652         (WatchpointsOnStructureStubInfo):
2653         (JSC::WatchpointsOnStructureStubInfo::WatchpointsOnStructureStubInfo):
2654         (JSC::WatchpointsOnStructureStubInfo::codeBlock):
2655         (JSC::WatchpointsOnStructureStubInfo::stubInfo):
2656         * bytecode/StructureStubInfo.h:
2657         (JSC::StructureStubInfo::reset):
2658         (JSC::StructureStubInfo::addWatchpoint):
2659         (StructureStubInfo):
2660         * dfg/DFGRepatch.cpp:
2661         (JSC::DFG::addStructureTransitionCheck):
2662         (DFG):
2663         (JSC::DFG::generateProtoChainAccessStub):
2664         (JSC::DFG::emitPutTransitionStub):
2665         * jit/JumpReplacementWatchpoint.h:
2666
2667 2012-07-12  Filip Pizlo  <fpizlo@apple.com>
2668
2669         DFG CFA may get overzealous in loops that have code that must exit
2670         https://bugs.webkit.org/show_bug.cgi?id=91188
2671
2672         Reviewed by Gavin Barraclough.
2673
2674         Ensure that if the CFA assumes that an operation must exit, then it will always exit
2675         no matter what happens after. That's necessary to preserve soundness.
2676
2677         Remove a broken fixup done by the DFG simplifier, where it was trying to say that the
2678         variable-at-head was the first access in the second block in the merge, if the first
2679         block did not read the variable. That's totally wrong, if the first block was in fact
2680         doing a phantom read. I removed that fixup and instead hardened the rest of the
2681         compiler.
2682
2683         * dfg/DFGAbstractState.cpp:
2684         (JSC::DFG::AbstractState::endBasicBlock):
2685         * dfg/DFGBasicBlock.h:
2686         (JSC::DFG::BasicBlock::BasicBlock):
2687         (BasicBlock):
2688         * dfg/DFGCFAPhase.cpp:
2689         (JSC::DFG::CFAPhase::performBlockCFA):
2690         * dfg/DFGCFGSimplificationPhase.cpp:
2691         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
2692         * dfg/DFGConstantFoldingPhase.cpp:
2693         (JSC::DFG::ConstantFoldingPhase::ConstantFoldingPhase):
2694         (JSC::DFG::ConstantFoldingPhase::run):
2695         (ConstantFoldingPhase):
2696         (JSC::DFG::ConstantFoldingPhase::foldConstants):
2697         (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
2698         * dfg/DFGVariableEventStream.cpp:
2699         (JSC::DFG::VariableEventStream::reconstruct):
2700
2701 2012-07-12  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
2702
2703         [Qt] Implement MemoryUsageSupport
2704         https://bugs.webkit.org/show_bug.cgi?id=91094
2705
2706         Reviewed by Adam Barth.
2707
2708         Compile in MemoryStatistics so we can make use of the interface.
2709
2710         * Target.pri:
2711
2712 2012-07-12  Csaba Osztrogonác  <ossy@webkit.org>
2713
2714         Remove dead code after r122392.
2715         https://bugs.webkit.org/show_bug.cgi?id=91049
2716
2717         Reviewed by Filip Pizlo.
2718
2719         * dfg/DFGSpeculativeJIT64.cpp:
2720         (JSC::DFG::SpeculativeJIT::emitCall):
2721
2722 2012-07-11  Adenilson Cavalcanti  <cavalcantii@gmail.com>
2723
2724         Build fix + remove dead code
2725         https://bugs.webkit.org/show_bug.cgi?id=91039
2726
2727         Reviewed by Filip Pizlo.
2728
2729         An unused variable was breaking compilation (thanks to warnings being treated as errors).
2730
2731         * dfg/DFGSpeculativeJIT32_64.cpp:
2732         (JSC::DFG::SpeculativeJIT::emitCall):
2733
2734 2012-07-11  Mark Rowe  <mrowe@apple.com>
2735
2736         <http://webkit.org/b/91024> Build against the latest SDK when targeting older OS X versions.
2737
2738         Reviewed by Dan Bernstein.
2739
2740         The deployment target is already set to the version that we're targeting, and it's that setting
2741         which determines which functionality from the SDK is available to us.
2742
2743         * Configurations/Base.xcconfig:
2744
2745 2012-07-11  Filip Pizlo  <fpizlo@apple.com>
2746
2747         DFG should have fast virtual calls
2748         https://bugs.webkit.org/show_bug.cgi?id=90924
2749
2750         Reviewed by Gavin Barraclough.
2751
2752         Implements virtual call support in the style of the old JIT, with the
2753         caveat that we still use the same slow path for both InternalFunction
2754         calls and JSFunction calls. Also rationalized the way that our
2755         CodeOrigin indices tie into exception checks (previously it was a
2756         strange one-to-one mapping with fairly limited assertions; now it's a
2757         one-to-many mapping for CodeOrigins to exception checks, respectively).
2758         I also took the opportunity to clean up
2759         CallLinkInfo::callReturnLocation, which previously was either a Call or
2760         a NearCall. Now it's just a NearCall. As well, exceptions during slow
2761         path call resolution are now handled by returning an exception throwing
2762         thunk rather than returning null. And finally, I made a few things
2763         public that were previously private-with-lots-of-friends, because I
2764         truly despise the thought of listing each thunk generating function as
2765         a friend of JSValue and friends.
2766
2767         * bytecode/CallLinkInfo.cpp:
2768         (JSC::CallLinkInfo::unlink):
2769         * bytecode/CallLinkInfo.h:
2770         (CallLinkInfo):
2771         * bytecode/CodeOrigin.h:
2772         (JSC::CodeOrigin::CodeOrigin):
2773         (JSC::CodeOrigin::isSet):
2774         * dfg/DFGAssemblyHelpers.h:
2775         (JSC::DFG::AssemblyHelpers::AssemblyHelpers):
2776         * dfg/DFGCCallHelpers.h:
2777         (JSC::DFG::CCallHelpers::CCallHelpers):
2778         * dfg/DFGGPRInfo.h:
2779         (GPRInfo):
2780         * dfg/DFGJITCompiler.cpp:
2781         (JSC::DFG::JITCompiler::link):
2782         (JSC::DFG::JITCompiler::compileFunction):
2783         * dfg/DFGJITCompiler.h:
2784         (JSC::DFG::CallBeginToken::CallBeginToken):
2785         (JSC::DFG::CallBeginToken::~CallBeginToken):
2786         (CallBeginToken):
2787         (JSC::DFG::CallBeginToken::set):
2788         (JSC::DFG::CallBeginToken::registerWithExceptionCheck):
2789         (JSC::DFG::CallBeginToken::codeOrigin):
2790         (JSC::DFG::CallExceptionRecord::CallExceptionRecord):
2791         (CallExceptionRecord):
2792         (JSC::DFG::JITCompiler::currentCodeOriginIndex):
2793         (JITCompiler):
2794         (JSC::DFG::JITCompiler::beginCall):
2795         (JSC::DFG::JITCompiler::notifyCall):
2796         (JSC::DFG::JITCompiler::prepareForExceptionCheck):
2797         (JSC::DFG::JITCompiler::addExceptionCheck):
2798         (JSC::DFG::JITCompiler::addFastExceptionCheck):
2799         * dfg/DFGOperations.cpp:
2800         * dfg/DFGRepatch.cpp:
2801         (JSC::DFG::dfgLinkFor):
2802         * dfg/DFGSpeculativeJIT.h:
2803         (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
2804         * dfg/DFGSpeculativeJIT32_64.cpp:
2805         (JSC::DFG::SpeculativeJIT::emitCall):
2806         * dfg/DFGSpeculativeJIT64.cpp:
2807         (JSC::DFG::SpeculativeJIT::emitCall):
2808         * dfg/DFGThunks.cpp:
2809         (JSC::DFG::emitPointerValidation):
2810         (DFG):
2811         (JSC::DFG::throwExceptionFromCallSlowPathGenerator):
2812         (JSC::DFG::slowPathFor):
2813         (JSC::DFG::linkForThunkGenerator):
2814         (JSC::DFG::linkCallThunkGenerator):
2815         (JSC::DFG::linkConstructThunkGenerator):
2816         (JSC::DFG::virtualForThunkGenerator):
2817         (JSC::DFG::virtualCallThunkGenerator):
2818         (JSC::DFG::virtualConstructThunkGenerator):
2819         * dfg/DFGThunks.h:
2820         (DFG):
2821         * jit/JIT.cpp:
2822         (JSC::JIT::privateCompile):
2823         (JSC::JIT::linkFor):
2824         * runtime/Executable.h:
2825         (ExecutableBase):
2826         (JSC::ExecutableBase::offsetOfJITCodeFor):
2827         (JSC::ExecutableBase::offsetOfNumParametersFor):
2828         * runtime/JSValue.h:
2829         (JSValue):
2830
2831 2012-07-11  Filip Pizlo  <fpizlo@apple.com>
2832
2833         Accidentally used the wrong license (3-clause instead of 2-clause) in some
2834         files I just committed.
2835
2836         Rubber stamped by Oliver Hunt.
2837
2838         * bytecode/Watchpoint.cpp:
2839         * bytecode/Watchpoint.h:
2840         * jit/JumpReplacementWatchpoint.cpp:
2841         * jit/JumpReplacementWatchpoint.h:
2842
2843 2012-07-11  Filip Pizlo  <fpizlo@apple.com>
2844
2845         Watchpoints and jump replacement should be decoupled
2846         https://bugs.webkit.org/show_bug.cgi?id=91016
2847
2848         Reviewed by Oliver Hunt.
2849
2850         * CMakeLists.txt:
2851         * GNUmakefile.list.am:
2852         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2853         * JavaScriptCore.xcodeproj/project.pbxproj:
2854         * Target.pri:
2855         * assembler/AbstractMacroAssembler.h:
2856         (JSC):
2857         (Label):
2858         * bytecode/CodeBlock.h:
2859         (JSC::CodeBlock::appendWatchpoint):
2860         (JSC::CodeBlock::watchpoint):
2861         (DFGData):
2862         * bytecode/Watchpoint.cpp:
2863         (JSC):
2864         * bytecode/Watchpoint.h:
2865         (JSC::Watchpoint::Watchpoint):
2866         (Watchpoint):
2867         (JSC::Watchpoint::fire):
2868         * dfg/DFGSpeculativeJIT.h:
2869         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
2870         * jit/JumpReplacementWatchpoint.cpp: Added.
2871         (JSC):
2872         (JSC::JumpReplacementWatchpoint::correctLabels):
2873         (JSC::JumpReplacementWatchpoint::fireInternal):
2874         * jit/JumpReplacementWatchpoint.h: Added.
2875         (JSC):
2876         (JumpReplacementWatchpoint):
2877         (JSC::JumpReplacementWatchpoint::JumpReplacementWatchpoint):
2878         (JSC::JumpReplacementWatchpoint::setDestination):
2879
2880 2012-07-11  Kevin Ollivier  <kevino@theolliviers.com>
2881
2882         [wx] Unreviewed build fix. Don't try to build udis86_itab.c since it's included by
2883         another file.
2884
2885         * wscript:
2886
2887 2012-07-11  Chao-ying Fu  <fu@mips.com>
2888
2889         Add MIPS convertibleLoadPtr and other functions
2890         https://bugs.webkit.org/show_bug.cgi?id=90714
2891
2892         Reviewed by Oliver Hunt.
2893
2894         * assembler/MIPSAssembler.h:
2895         (JSC::MIPSAssembler::labelIgnoringWatchpoints):
2896         (MIPSAssembler):
2897         (JSC::MIPSAssembler::replaceWithLoad):
2898         (JSC::MIPSAssembler::replaceWithAddressComputation):
2899         * assembler/MacroAssemblerMIPS.h:
2900         (JSC::MacroAssemblerMIPS::convertibleLoadPtr):
2901         (MacroAssemblerMIPS):
2902
2903 2012-07-11  Anders Carlsson  <andersca@apple.com>
2904
2905         Add -Wtautological-compare and -Wsign-compare warning flags
2906         https://bugs.webkit.org/show_bug.cgi?id=90994
2907
2908         Reviewed by Mark Rowe.
2909
2910         * Configurations/Base.xcconfig:
2911
2912 2012-07-11  Benjamin Poulain  <bpoulain@apple.com>
2913
2914         Simplify the copying of JSC ARMv7's LinkRecord
2915         https://bugs.webkit.org/show_bug.cgi?id=90930
2916
2917         Reviewed by Filip Pizlo.
2918
2919         The class LinkRecord is used by value everywhere in ARMv7Assembler. The compiler uses
2920         memmove() to move the objects.
2921
2922         The problem is memmove() is overkill for this object, moving the value can be done with
2923         3 load-store. This patch adds an operator= to the class doing more efficient copying.
2924         This reduces the link time by 19%.
2925
2926         * assembler/ARMv7Assembler.h:
2927         (JSC::ARMv7Assembler::LinkRecord::LinkRecord):
2928         (JSC::ARMv7Assembler::LinkRecord::operator=):
2929         (JSC::ARMv7Assembler::LinkRecord::from):
2930         (JSC::ARMv7Assembler::LinkRecord::setFrom):
2931         (JSC::ARMv7Assembler::LinkRecord::to):
2932         (JSC::ARMv7Assembler::LinkRecord::type):
2933         (JSC::ARMv7Assembler::LinkRecord::linkType):
2934         (JSC::ARMv7Assembler::LinkRecord::setLinkType):
2935         (JSC::ARMv7Assembler::LinkRecord::condition):
2936
2937 2012-07-11  Andy Wingo  <wingo@igalia.com>
2938
2939         jsc: Parse options before creating global data
2940         https://bugs.webkit.org/show_bug.cgi?id=90975
2941
2942         Reviewed by Filip Pizlo.
2943
2944         This patch moves the options parsing in "jsc" before the creation
2945         of the JSGlobalData, so that --useJIT=no has a chance to take
2946         effect.
2947
2948         * jsc.cpp:
2949         (CommandLine::parseArguments): Refactor to be a class, and take
2950         argc and argv as constructor arguments.
2951         (jscmain): Move arg parsing before JSGlobalData creation.
2952
2953 2012-07-10  Filip Pizlo  <fpizlo@apple.com>
2954
2955         REGRESSION(r122166): It made 170 tests crash on 32 bit platforms
2956         https://bugs.webkit.org/show_bug.cgi?id=90852
2957
2958         Reviewed by Zoltan Herczeg.
2959
2960         If we can't use the range filter, we should still make sure that the
2961         address is remotely sane, otherwise the hashtables will assert.
2962
2963         * jit/JITStubRoutine.h:
2964         (JSC::JITStubRoutine::passesFilter):
2965
2966 2012-07-10  Filip Pizlo  <fpizlo@apple.com>
2967
2968         DFG recompilation heuristics should be based on count, not rate
2969         https://bugs.webkit.org/show_bug.cgi?id=90146
2970
2971         Reviewed by Oliver Hunt.
2972
2973         Rolling r121511 back in after fixing the DFG's interpretation of op_div
2974         profiling, with Gavin's rubber stamp.
2975
2976         This removes a bunch of code that was previously trying to prevent spurious
2977         reoptimizations if a large enough majority of executions of a code block did
2978         not result in OSR exit. It turns out that this code was purely harmful. This
2979         patch removes all of that logic and replaces it with a dead-simple
2980         heuristic: if you exit more than N times (where N is an exponential function
2981         of the number of times the code block has already been recompiled) then we
2982         will recompile.
2983
2984         This appears to be a broad ~1% win on many benchmarks large and small.
2985
2986         * bytecode/CodeBlock.cpp:
2987         (JSC::CodeBlock::CodeBlock):
2988         * bytecode/CodeBlock.h:
2989         (JSC::CodeBlock::couldTakeSpecialFastCase):
2990         (CodeBlock):
2991         (JSC::CodeBlock::osrExitCounter):
2992         (JSC::CodeBlock::countOSRExit):
2993         (JSC::CodeBlock::addressOfOSRExitCounter):
2994         (JSC::CodeBlock::offsetOfOSRExitCounter):
2995         (JSC::CodeBlock::adjustedExitCountThreshold):
2996         (JSC::CodeBlock::exitCountThresholdForReoptimization):
2997         (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
2998         (JSC::CodeBlock::shouldReoptimizeNow):
2999         (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
3000         * bytecode/ExecutionCounter.cpp:
3001         (JSC::ExecutionCounter::setThreshold):
3002         * bytecode/ExecutionCounter.h:
3003         (ExecutionCounter):
3004         (JSC::ExecutionCounter::clippedThreshold):
3005         * dfg/DFGByteCodeParser.cpp:
3006         (JSC::DFG::ByteCodeParser::makeDivSafe):
3007         * dfg/DFGJITCompiler.cpp:
3008         (JSC::DFG::JITCompiler::compileBody):
3009         * dfg/DFGOSRExit.cpp:
3010         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
3011         * dfg/DFGOSRExitCompiler.cpp:
3012         (JSC::DFG::OSRExitCompiler::handleExitCounts):
3013         * dfg/DFGOperations.cpp:
3014         * jit/JITStubs.cpp:
3015         (JSC::DEFINE_STUB_FUNCTION):
3016         * runtime/Options.h:
3017         (JSC):
3018
3019 2012-07-09  Matt Falkenhagen  <falken@chromium.org>
3020
3021         Add ENABLE_DIALOG_ELEMENT and skeleton files
3022         https://bugs.webkit.org/show_bug.cgi?id=90521
3023
3024         Reviewed by Kent Tamura.
3025
3026         * Configurations/FeatureDefines.xcconfig:
3027
3028 2012-07-09  Filip Pizlo  <fpizlo@apple.com>
3029
3030         Unreviewed, roll out http://trac.webkit.org/changeset/121511
3031         It made in-browser V8v7 10% slower.
3032
3033         * bytecode/CodeBlock.cpp:
3034         (JSC::CodeBlock::CodeBlock):
3035         * bytecode/CodeBlock.h:
3036         (CodeBlock):
3037         (JSC::CodeBlock::countSpeculationSuccess):
3038         (JSC::CodeBlock::countSpeculationFailure):
3039         (JSC::CodeBlock::speculativeSuccessCounter):
3040         (JSC::CodeBlock::speculativeFailCounter):
3041         (JSC::CodeBlock::forcedOSRExitCounter):
3042         (JSC::CodeBlock::addressOfSpeculativeSuccessCounter):
3043         (JSC::CodeBlock::addressOfSpeculativeFailCounter):
3044         (JSC::CodeBlock::addressOfForcedOSRExitCounter):
3045         (JSC::CodeBlock::offsetOfSpeculativeSuccessCounter):
3046         (JSC::CodeBlock::offsetOfSpeculativeFailCounter):
3047         (JSC::CodeBlock::offsetOfForcedOSRExitCounter):
3048         (JSC::CodeBlock::largeFailCountThreshold):
3049         (JSC::CodeBlock::largeFailCountThresholdForLoop):
3050         (JSC::CodeBlock::shouldReoptimizeNow):
3051         (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
3052         * bytecode/ExecutionCounter.cpp:
3053         (JSC::ExecutionCounter::setThreshold):
3054         * bytecode/ExecutionCounter.h:
3055         (ExecutionCounter):
3056         * dfg/DFGJITCompiler.cpp:
3057         (JSC::DFG::JITCompiler::compileBody):
3058         * dfg/DFGOSRExit.cpp:
3059         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
3060         * dfg/DFGOSRExitCompiler.cpp:
3061         (JSC::DFG::OSRExitCompiler::handleExitCounts):
3062         * dfg/DFGOperations.cpp:
3063         * jit/JITStubs.cpp:
3064         (JSC::DEFINE_STUB_FUNCTION):
3065         * runtime/Options.h:
3066         (JSC):
3067
3068 2012-07-09  Filip Pizlo  <fpizlo@apple.com>
3069
3070         DFG may get stuck in an infinite fix point if it constant folds a mispredicted node
3071         https://bugs.webkit.org/show_bug.cgi?id=90829
3072         <rdar://problem/11823843>
3073
3074         Reviewed by Oliver Hunt.
3075
3076         If a node is shown to have been mispredicted during CFA, then don't allow constant
3077         folding to make the graph even more degenerate. Instead, pull back on constant folding
3078         and allow the normal OSR machinery to fix our profiling so that a future recompilation
3079         doesn't see the same mistake.
3080
3081         * dfg/DFGAbstractState.cpp:
3082         (JSC::DFG::AbstractState::execute):
3083         * dfg/DFGAbstractState.h:
3084         (JSC::DFG::AbstractState::trySetConstant):
3085         (AbstractState):
3086         * dfg/DFGPhase.h:
3087         (JSC::DFG::Phase::name):
3088         (Phase):
3089         (JSC::DFG::runAndLog):
3090         (DFG):
3091         (JSC::DFG::runPhase):
3092
3093 2012-07-09  Filip Pizlo  <fpizlo@apple.com>
3094
3095         It should be possible to jettison JIT stub routines even if they are currently running
3096         https://bugs.webkit.org/show_bug.cgi?id=90731
3097
3098         Reviewed by Gavin Barraclough.
3099
3100         This gives the GC awareness of all JIT-generated stubs for inline caches. That
3101         means that if you want to delete a JIT-generated stub, you don't have to worry
3102         about whether or not it is currently running: if there is a chance that it might
3103         be, the GC will kindly defer deletion until non-running-ness is proved.
3104
3105         * CMakeLists.txt:
3106         * GNUmakefile.list.am:
3107         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3108         * JavaScriptCore.xcodeproj/project.pbxproj:
3109         * Target.pri:
3110         * bytecode/Instruction.h:
3111         (JSC):
3112         (PolymorphicStubInfo):
3113         (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
3114         (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
3115         * bytecode/PolymorphicPutByIdList.cpp:
3116         (JSC::PutByIdAccess::fromStructureStubInfo):
3117         * bytecode/PolymorphicPutByIdList.h:
3118         (JSC::PutByIdAccess::transition):
3119         (JSC::PutByIdAccess::replace):
3120         (JSC::PutByIdAccess::stubRoutine):
3121         (PutByIdAccess):
3122         (JSC::PolymorphicPutByIdList::currentSlowPathTarget):
3123         * bytecode/StructureStubInfo.h:
3124         (JSC::StructureStubInfo::reset):
3125         * dfg/DFGRepatch.cpp:
3126         (JSC::DFG::generateProtoChainAccessStub):
3127         (JSC::DFG::tryCacheGetByID):
3128         (JSC::DFG::tryBuildGetByIDList):
3129         (JSC::DFG::tryBuildGetByIDProtoList):
3130         (JSC::DFG::emitPutReplaceStub):
3131         (JSC::DFG::emitPutTransitionStub):
3132         (JSC::DFG::tryCachePutByID):
3133         (JSC::DFG::tryBuildPutByIdList):
3134         * heap/ConservativeRoots.cpp:
3135         (JSC):
3136         (DummyMarkHook):
3137         (JSC::DummyMarkHook::mark):
3138         (JSC::ConservativeRoots::add):
3139         (CompositeMarkHook):
3140         (JSC::CompositeMarkHook::CompositeMarkHook):
3141         (JSC::CompositeMarkHook::mark):
3142         * heap/ConservativeRoots.h:
3143         (JSC):
3144         (ConservativeRoots):
3145         * heap/Heap.cpp:
3146         (JSC::Heap::markRoots):
3147         (JSC::Heap::deleteUnmarkedCompiledCode):
3148         * heap/Heap.h:
3149         (JSC):
3150         (Heap):
3151         * heap/JITStubRoutineSet.cpp: Added.
3152         (JSC):
3153         (JSC::JITStubRoutineSet::JITStubRoutineSet):
3154         (JSC::JITStubRoutineSet::~JITStubRoutineSet):
3155         (JSC::JITStubRoutineSet::add):
3156         (JSC::JITStubRoutineSet::clearMarks):
3157         (JSC::JITStubRoutineSet::markSlow):
3158         (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
3159         (JSC::JITStubRoutineSet::traceMarkedStubRoutines):
3160         * heap/JITStubRoutineSet.h: Added.
3161         (JSC):
3162         (JITStubRoutineSet):
3163         (JSC::JITStubRoutineSet::mark):
3164         * heap/MachineStackMarker.h:
3165         (JSC):
3166         * interpreter/RegisterFile.cpp:
3167         (JSC::RegisterFile::gatherConservativeRoots):
3168         * interpreter/RegisterFile.h:
3169         (JSC):
3170         * jit/ExecutableAllocator.cpp:
3171         (JSC::DemandExecutableAllocator::DemandExecutableAllocator):
3172         * jit/ExecutableAllocator.h:
3173         (JSC):
3174         * jit/ExecutableAllocatorFixedVMPool.cpp:
3175         (JSC):
3176         (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
3177         * jit/GCAwareJITStubRoutine.cpp: Added.
3178         (JSC):
3179         (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
3180         (JSC::GCAwareJITStubRoutine::~GCAwareJITStubRoutine):
3181         (JSC::GCAwareJITStubRoutine::observeZeroRefCount):
3182         (JSC::GCAwareJITStubRoutine::deleteFromGC):
3183         (JSC::GCAwareJITStubRoutine::markRequiredObjectsInternal):
3184         (JSC::MarkingGCAwareJITStubRoutineWithOneObject::MarkingGCAwareJITStubRoutineWithOneObject):
3185         (JSC::MarkingGCAwareJITStubRoutineWithOneObject::~MarkingGCAwareJITStubRoutineWithOneObject):
3186         (JSC::MarkingGCAwareJITStubRoutineWithOneObject::markRequiredObjectsInternal):
3187         (JSC::createJITStubRoutine):
3188         * jit/GCAwareJITStubRoutine.h: Added.
3189         (JSC):
3190         (GCAwareJITStubRoutine):
3191         (JSC::GCAwareJITStubRoutine::markRequiredObjects):
3192         (MarkingGCAwareJITStubRoutineWithOneObject):
3193         * jit/JITPropertyAccess.cpp:
3194         (JSC::JIT::privateCompilePutByIdTransition):
3195         (JSC::JIT::privateCompilePatchGetArrayLength):
3196         (JSC::JIT::privateCompileGetByIdProto):
3197         (JSC::JIT::privateCompileGetByIdSelfList):
3198         (JSC::JIT::privateCompileGetByIdProtoList):
3199         (JSC::JIT::privateCompileGetByIdChainList):
3200         (JSC::JIT::privateCompileGetByIdChain):
3201         * jit/JITPropertyAccess32_64.cpp:
3202         (JSC::JIT::privateCompilePutByIdTransition):
3203         (JSC::JIT::privateCompilePatchGetArrayLength):
3204         (JSC::JIT::privateCompileGetByIdProto):
3205         (JSC::JIT::privateCompileGetByIdSelfList):
3206         (JSC::JIT::privateCompileGetByIdProtoList):
3207         (JSC::JIT::privateCompileGetByIdChainList):
3208         (JSC::JIT::privateCompileGetByIdChain):
3209         * jit/JITStubRoutine.cpp: Added.
3210         (JSC):
3211         (JSC::JITStubRoutine::~JITStubRoutine):
3212         (JSC::JITStubRoutine::observeZeroRefCount):
3213         * jit/JITStubRoutine.h: Added.
3214         (JSC):
3215         (JITStubRoutine):
3216         (JSC::JITStubRoutine::JITStubRoutine):
3217         (JSC::JITStubRoutine::createSelfManagedRoutine):
3218         (JSC::JITStubRoutine::code):
3219         (JSC::JITStubRoutine::asCodePtr):
3220         (JSC::JITStubRoutine::ref):
3221         (JSC::JITStubRoutine::deref):
3222         (JSC::JITStubRoutine::startAddress):
3223         (JSC::JITStubRoutine::endAddress):
3224         (JSC::JITStubRoutine::addressStep):
3225         (JSC::JITStubRoutine::canPerformRangeFilter):
3226         (JSC::JITStubRoutine::filteringStartAddress):
3227         (JSC::JITStubRoutine::filteringExtentSize):
3228         (JSC::JITStubRoutine::passesFilter):
3229         * jit/JITStubs.cpp:
3230         (JSC::DEFINE_STUB_FUNCTION):
3231         (JSC::getPolymorphicAccessStructureListSlot):
3232
3233 2012-07-09  Sheriff Bot  <webkit.review.bot@gmail.com>
3234
3235         Unreviewed, rolling out r122107.
3236         http://trac.webkit.org/changeset/122107
3237         https://bugs.webkit.org/show_bug.cgi?id=90794
3238
3239         Build failure on Mac debug bots (Requested by falken_ on
3240         #webkit).
3241
3242         * Configurations/FeatureDefines.xcconfig:
3243
3244 2012-07-09  Matt Falkenhagen  <falken@chromium.org>
3245
3246         Add ENABLE_DIALOG_ELEMENT and skeleton files
3247         https://bugs.webkit.org/show_bug.cgi?id=90521
3248
3249         Reviewed by Kent Tamura.
3250
3251         * Configurations/FeatureDefines.xcconfig:
3252
3253 2012-07-08  Ryosuke Niwa  <rniwa@webkit.org>
3254
3255         gcc build fix after r121925.
3256
3257         * runtime/JSObject.h:
3258         (JSC::JSFinalObject::finishCreation):
3259
3260 2012-07-08  Zoltan Herczeg  <zherczeg@webkit.org>
3261
3262         [Qt][ARM] Implementing missing macro assembler instructions after r121925
3263         https://bugs.webkit.org/show_bug.cgi?id=90657
3264
3265         Reviewed by Csaba Osztrogonác.
3266
3267         Implementing convertibleLoadPtr, replaceWithLoad and
3268         replaceWithAddressComputation.
3269
3270         * assembler/ARMAssembler.h:
3271         (JSC::ARMAssembler::replaceWithLoad):
3272         (ARMAssembler):
3273         (JSC::ARMAssembler::replaceWithAddressComputation):
3274         * assembler/MacroAssemblerARM.h:
3275         (JSC::MacroAssemblerARM::convertibleLoadPtr):
3276         (MacroAssemblerARM):
3277
3278 2012-07-06  Filip Pizlo  <fpizlo@apple.com>
3279
3280         WebKit Version 5.1.7 (6534.57.2, r121935): Double-click no longer works on OpenStreetMap
3281         https://bugs.webkit.org/show_bug.cgi?id=90703
3282
3283         Reviewed by Michael Saboff.
3284
3285         It turns out that in my object model refactoring, I managed to fix get_by_pname in all
3286         execution engines except 64-bit baseline JIT.
3287
3288         * jit/JITPropertyAccess.cpp:
3289         (JSC::JIT::emit_op_get_by_pname):
3290
3291 2012-07-06  Pravin D  <pravind.2k4@gmail.com>
3292
3293         Build Error on Qt Linux build
3294         https://bugs.webkit.org/show_bug.cgi?id=90699
3295
3296         Reviewed by Laszlo Gombos.
3297
3298         * parser/Parser.cpp:
3299         (JSC::::parseForStatement):
3300         Removed unused boolean variable as this was causing build error on Qt Linux.
3301
3302 2012-07-06  Nuno Lopes  <nlopes@apple.com>
3303
3304         Fix build with recent clang.
3305         https://bugs.webkit.org/show_bug.cgi?id=90634
3306
3307         Reviewed by Oliver Hunt.
3308
3309         * jit/SpecializedThunkJIT.h:
3310         (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
3311         (SpecializedThunkJIT):
3312         * jit/ThunkGenerators.cpp:
3313         (JSC::charCodeAtThunkGenerator):
3314         (JSC::charAtThunkGenerator):
3315         (JSC::fromCharCodeThunkGenerator):
3316         (JSC::sqrtThunkGenerator):
3317         (JSC::floorThunkGenerator):
3318         (JSC::ceilThunkGenerator):
3319         (JSC::roundThunkGenerator):
3320         (JSC::expThunkGenerator):
3321         (JSC::logThunkGenerator):
3322         (JSC::absThunkGenerator):
3323         (JSC::powThunkGenerator):
3324         * parser/ASTBuilder.h:
3325         (JSC::ASTBuilder::createAssignResolve):
3326         (JSC::ASTBuilder::createForLoop):
3327         (JSC::ASTBuilder::createForInLoop):
3328         (JSC::ASTBuilder::makeAssignNode):
3329         (JSC::ASTBuilder::makePrefixNode):
3330         (JSC::ASTBuilder::makePostfixNode):
3331         * parser/NodeConstructors.h:
3332         (JSC::PostfixErrorNode::PostfixErrorNode):
3333         (JSC::PrefixErrorNode::PrefixErrorNode):
3334         (JSC::AssignResolveNode::AssignResolveNode):
3335         (JSC::AssignErrorNode::AssignErrorNode):
3336         (JSC::ForNode::ForNode):
3337         (JSC::ForInNode::ForInNode):
3338         * parser/Nodes.h:
3339         (FunctionCallResolveNode):
3340         (PostfixErrorNode):
3341         (PrefixErrorNode):
3342         (ReadModifyResolveNode):
3343         (AssignResolveNode):
3344         (AssignErrorNode):
3345         (ForNode):
3346         (ForInNode):
3347         * parser/Parser.cpp:
3348         (JSC::::parseVarDeclarationList):
3349         (JSC::::parseForStatement):
3350         * parser/SyntaxChecker.h:
3351         (JSC::SyntaxChecker::createAssignResolve):
3352         (JSC::SyntaxChecker::createForLoop):
3353
3354 2012-07-06  Zoltan Herczeg  <zherczeg@webkit.org>
3355
3356         [Qt][ARM] REGRESSION(r121885): It broke 30 jsc tests, 500+ layout tests
3357         https://bugs.webkit.org/show_bug.cgi?id=90656
3358
3359         Reviewed by Csaba Osztrogonác.
3360
3361         Typo fixes.
3362
3363         * assembler/MacroAssemblerARM.cpp:
3364         (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
3365         Rename getOp2Byte() -> getOp2Half()
3366         * assembler/MacroAssemblerARMv7.h:
3367         (JSC::MacroAssemblerARMv7::convertibleLoadPtr):
3368         Add a necessary space.
3369         * jit/JITStubs.cpp:
3370         (JSC):
3371         Revert INLINE_ARM_FUNCTION macro.
3372
3373 2012-07-05  Filip Pizlo  <fpizlo@apple.com>
3374
3375         REGRESSION(r121925): It broke 5 sputnik tests on x86 platforms
3376         https://bugs.webkit.org/show_bug.cgi?id=90658
3377
3378         Reviewed by Zoltan Herczeg.
3379
3380         Under the new object model, out-of-line property accesses such as those
3381         in ResolveGlobal must account for the fact that the offset to the Kth
3382         property is represented by K + inlineStorageCapacity. Hence, the property
3383         loads in ResolveGlobal must have an additional -inlineStorageCapacity *
3384         sizeof(JSValue) offset.
3385
3386         * dfg/DFGSpeculativeJIT32_64.cpp:
3387         (JSC::DFG::SpeculativeJIT::compile):
3388
3389 2012-07-05  Csaba Osztrogonác  <ossy@webkit.org>
3390
3391         [Qt] Unreviewed 64 bit buildfix after r121925.
3392
3393         * bytecode/PutByIdStatus.cpp:
3394         (JSC::PutByIdStatus::computeFromLLInt):
3395
3396 2012-07-05  Michael Saboff  <msaboff@apple.com>
3397
3398         JSString::tryHashConstLock() fails to get exclusive lock
3399         https://bugs.webkit.org/show_bug.cgi?id=90639
3400
3401         Reviewed by Oliver Hunt.
3402
3403         Added check that the string is already locked even before compare and swap.
3404
3405         * heap/MarkStack.cpp:
3406         (JSC::JSString::tryHashConstLock):
3407
3408 2012-07-04  Filip Pizlo  <fpizlo@apple.com>
3409
3410         Inline property storage should not be wasted when it is exhausted
3411         https://bugs.webkit.org/show_bug.cgi?id=90347
3412
3413         Reviewed by Gavin Barraclough.
3414
3415         Previously, if we switched an object from using inline storage to out-of-line
3416         storage, we would abandon the inline storage. This would have two main implications:
3417         (i) all accesses to the object, even for properties that were previously in inline
3418         storage, must now take an extra indirection; and (ii) we waste a non-trivial amount
3419         of space since we must allocate additional out-of-line storage to hold properties
3420         that would have fit in the inline storage. There's also the copying cost when
3421         switching to out-of-line storage - we must copy all inline properties into ouf-of-line
3422         storage.
3423
3424         This patch changes the way that object property storage works so that we can use both
3425         inline and out-of-line storage concurrently. This is accomplished by introducing a
3426         new notion of property offset. This PropertyOffset is a 32-bit signed integer and it
3427         behaves as follows:
3428
3429         offset == -1: invalid offset, indicating a property that does not exist.
3430
3431         0 <= offset <= inlineStorageCapacity: offset into inline storage.
3432
3433         inlineStorageCapacity < offset: offset into out-of-line storage.
3434
3435         Because non-final objects don't have inline storage, the only valid PropertyOffsets
3436         for those objects' properties are -1 or > inlineStorageCapacity.
3437
3438         This now means that the decision to use inline or out-of-line storage for an access is
3439         made based on the offset, rather than the structure. It also means that any access
3440         where the offset is a variable must have an extra branch, unless the type of the
3441         object is also known (if it's known to be a non-final object then we can just assert
3442         that the offset is >= inlineStorageCapacity).
3443
3444         This looks like a big Kraken speed-up and a slight V8 speed-up.
3445
3446         * GNUmakefile.list.am:
3447         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3448         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3449         * JavaScriptCore.xcodeproj/project.pbxproj:
3450         * assembler/ARMv7Assembler.h:
3451         (ARMv7Assembler):
3452         (JSC::ARMv7Assembler::ldrWide8BitImmediate):
3453         (JSC::ARMv7Assembler::replaceWithLoad):
3454         (JSC::ARMv7Assembler::replaceWithAddressComputation):
3455         * assembler/AbstractMacroAssembler.h:
3456         (AbstractMacroAssembler):
3457         (ConvertibleLoadLabel):
3458         (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::ConvertibleLoadLabel):
3459         (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::isSet):
3460         (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints):
3461         (JSC::AbstractMacroAssembler::replaceWithLoad):
3462         (JSC::AbstractMacroAssembler::replaceWithAddressComputation):
3463         * assembler/CodeLocation.h:
3464         (JSC):
3465         (CodeLocationCommon):
3466         (CodeLocationConvertibleLoad):
3467         (JSC::CodeLocationConvertibleLoad::CodeLocationConvertibleLoad):
3468         (JSC::CodeLocationCommon::convertibleLoadAtOffset):
3469         * assembler/LinkBuffer.cpp:
3470         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
3471         * assembler/LinkBuffer.h:
3472         (LinkBuffer):
3473         (JSC::LinkBuffer::locationOf):
3474         * assembler/MacroAssemblerARMv7.h:
3475         (MacroAssemblerARMv7):
3476         (JSC::MacroAssemblerARMv7::convertibleLoadPtr):
3477         * assembler/MacroAssemblerX86.h:
3478         (JSC::MacroAssemblerX86::convertibleLoadPtr):
3479         (MacroAssemblerX86):
3480         * assembler/MacroAssemblerX86_64.h:
3481         (JSC::MacroAssemblerX86_64::convertibleLoadPtr):
3482         (MacroAssemblerX86_64):
3483         * assembler/RepatchBuffer.h:
3484         (RepatchBuffer):
3485         (JSC::RepatchBuffer::replaceWithLoad):
3486         (JSC::RepatchBuffer::replaceWithAddressComputation):
3487         (JSC::RepatchBuffer::setLoadInstructionIsActive):
3488         * assembler/X86Assembler.h:
3489         (JSC::X86Assembler::replaceWithLoad):
3490         (X86Assembler):
3491         (JSC::X86Assembler::replaceWithAddressComputation):
3492         * bytecode/CodeBlock.cpp:
3493         (JSC::CodeBlock::printGetByIdOp):
3494         (JSC::CodeBlock::dump):
3495         (JSC::CodeBlock::finalizeUnconditionally):
3496         * bytecode/GetByIdStatus.cpp:
3497         (JSC::GetByIdStatus::computeFromLLInt):
3498         (JSC::GetByIdStatus::computeForChain):
3499         (JSC::GetByIdStatus::computeFor):
3500         * bytecode/GetByIdStatus.h:
3501         (JSC::GetByIdStatus::GetByIdStatus):
3502         (JSC::GetByIdStatus::offset):
3503         (GetByIdStatus):
3504         * bytecode/Opcode.h:
3505         (JSC):
3506         (JSC::padOpcodeName):
3507         * bytecode/PutByIdStatus.cpp:
3508         (JSC::PutByIdStatus::computeFromLLInt):
3509         (JSC::PutByIdStatus::computeFor):
3510         * bytecode/PutByIdStatus.h:
3511         (JSC::PutByIdStatus::PutByIdStatus):
3512         (JSC::PutByIdStatus::offset):
3513         (PutByIdStatus):
3514         * bytecode/ResolveGlobalStatus.cpp:
3515         (JSC):
3516         (JSC::computeForStructure):
3517         * bytecode/ResolveGlobalStatus.h:
3518         (JSC::ResolveGlobalStatus::ResolveGlobalStatus):
3519         (JSC::ResolveGlobalStatus::offset):
3520         (ResolveGlobalStatus):
3521         * bytecode/StructureSet.h:
3522         (StructureSet):
3523         * bytecode/StructureStubInfo.h:
3524         * dfg/DFGByteCodeParser.cpp:
3525         (ByteCodeParser):
3526         (JSC::DFG::ByteCodeParser::handleGetByOffset):
3527         (JSC::DFG::ByteCodeParser::handleGetById):
3528         (JSC::DFG::ByteCodeParser::parseBlock):
3529         * dfg/DFGCapabilities.h:
3530         (JSC::DFG::canCompileOpcode):
3531         * dfg/DFGJITCompiler.cpp:
3532         (JSC::DFG::JITCompiler::link):
3533         * dfg/DFGJITCompiler.h:
3534         (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
3535         (PropertyAccessRecord):
3536         * dfg/DFGRepatch.cpp:
3537         (JSC::DFG::dfgRepatchByIdSelfAccess):
3538         (JSC::DFG::generateProtoChainAccessStub):
3539         (JSC::DFG::tryCacheGetByID):
3540         (JSC::DFG::tryBuildGetByIDList):
3541         (JSC::DFG::tryBuildGetByIDProtoList):
3542         (JSC::DFG::emitPutReplaceStub):
3543         (JSC::DFG::emitPutTransitionStub):
3544         (JSC::DFG::tryCachePutByID):
3545         (JSC::DFG::tryBuildPutByIdList):
3546         * dfg/DFGSpeculativeJIT.h:
3547         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
3548         * dfg/DFGSpeculativeJIT32_64.cpp:
3549         (JSC::DFG::SpeculativeJIT::cachedGetById):
3550         (JSC::DFG::SpeculativeJIT::cachedPutById):
3551         (JSC::DFG::SpeculativeJIT::compile):
3552         * dfg/DFGSpeculativeJIT64.cpp:
3553         (JSC::DFG::SpeculativeJIT::cachedGetById):
3554         (JSC::DFG::SpeculativeJIT::cachedPutById):
3555         (JSC::DFG::SpeculativeJIT::compile):
3556         * heap/MarkStack.cpp:
3557         (JSC::visitChildren):
3558         * interpreter/Interpreter.cpp:
3559         (JSC::Interpreter::tryCacheGetByID):
3560         (JSC::Interpreter::privateExecute):
3561         * jit/JIT.cpp:
3562         (JSC::JIT::privateCompileMainPass):
3563         (JSC::JIT::privateCompileSlowCases):
3564         (JSC::PropertyStubCompilationInfo::copyToStubInfo):
3565         * jit/JIT.h:
3566         (JSC::PropertyStubCompilationInfo::PropertyStubCompilationInfo):
3567         (JSC::JIT::compileGetByIdProto):
3568         (JSC::JIT::compileGetByIdSelfList):
3569         (JSC::JIT::compileGetByIdProtoList):
3570         (JSC::JIT::compileGetByIdChainList):
3571         (JSC::JIT::compileGetByIdChain):
3572         (JSC::JIT::compilePutByIdTransition):
3573         (JIT):
3574         * jit/JITInlineMethods.h:
3575         (JSC::JIT::emitAllocateBasicJSObject):
3576         * jit/JITOpcodes.cpp:
3577         (JSC::JIT::emit_op_resolve_global):
3578         * jit/JITOpcodes32_64.cpp:
3579         (JSC::JIT::emit_op_resolve_global):
3580         * jit/JITPropertyAccess.cpp:
3581         (JSC::JIT::compileGetDirectOffset):
3582         (JSC::JIT::emit_op_method_check):
3583         (JSC::JIT::compileGetByIdHotPath):
3584         (JSC::JIT::emit_op_put_by_id):
3585         (JSC::JIT::compilePutDirectOffset):
3586         (JSC::JIT::privateCompilePutByIdTransition):
3587         (JSC::JIT::patchGetByIdSelf):
3588         (JSC::JIT::patchPutByIdReplace):
3589         (JSC::JIT::privateCompileGetByIdProto):
3590         (JSC::JIT::privateCompileGetByIdSelfList):
3591         (JSC::JIT::privateCompileGetByIdProtoList):
3592         (JSC::JIT::privateCompileGetByIdChainList):
3593         (JSC::JIT::privateCompileGetByIdChain):
3594         * jit/JITPropertyAccess32_64.cpp:
3595         (JSC::JIT::emit_op_method_check):
3596         (JSC::JIT::compileGetByIdHotPath):
3597         (JSC::JIT::emit_op_put_by_id):
3598         (JSC::JIT::compilePutDirectOffset):
3599         (JSC::JIT::compileGetDirectOffset):
3600         (JSC::JIT::privateCompilePutByIdTransition):
3601         (JSC::JIT::patchGetByIdSelf):
3602         (JSC::JIT::patchPutByIdReplace):
3603         (JSC::JIT::privateCompileGetByIdProto):
3604         (JSC::JIT::privateCompileGetByIdSelfList):
3605         (JSC::JIT::privateCompileGetByIdProtoList):
3606         (JSC::JIT::privateCompileGetByIdChainList):
3607         (JSC::JIT::privateCompileGetByIdChain):
3608         (JSC::JIT::emit_op_get_by_pname):
3609         * jit/JITStubs.cpp:
3610         (JSC::JITThunks::tryCacheGetByID):
3611         (JSC::DEFINE_STUB_FUNCTION):
3612         * llint/LLIntSlowPaths.cpp:
3613         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3614         * llint/LowLevelInterpreter.asm:
3615         * llint/LowLevelInterpreter32_64.asm:
3616         * llint/LowLevelInterpreter64.asm:
3617         * offlineasm/x86.rb:
3618         * runtime/JSGlobalObject.h:
3619         (JSGlobalObject):
3620         (JSC::JSGlobalObject::functionNameOffset):
3621         * runtime/JSObject.cpp:
3622         (JSC::JSObject::visitChildren):
3623         (JSC):
3624         (JSC::JSFinalObject::visitChildren):
3625         (JSC::JSObject::put):
3626         (JSC::JSObject::deleteProperty):
3627         (JSC::JSObject::getPropertySpecificValue):
3628         (JSC::JSObject::removeDirect):
3629         (JSC::JSObject::growOutOfLineStorage):
3630         (JSC::JSObject::getOwnPropertyDescriptor):
3631         * runtime/JSObject.h:
3632         (JSObject):
3633         (JSC::JSObject::getDirect):
3634         (JSC::JSObject::getDirectLocation):
3635         (JSC::JSObject::hasInlineStorage):
3636         (JSC::JSObject::inlineStorageUnsafe):
3637         (JSC::JSObject::inlineStorage):
3638         (JSC::JSObject::outOfLineStorage):
3639         (JSC::JSObject::locationForOffset):
3640         (JSC::JSObject::offsetForLocation):
3641         (JSC::JSObject::getDirectOffset):
3642         (JSC::JSObject::putDirectOffset):
3643         (JSC::JSObject::putUndefinedAtDirectOffset):
3644         (JSC::JSObject::addressOfOutOfLineStorage):
3645         (JSC::JSObject::finishCreation):
3646         (JSC::JSNonFinalObject::JSNonFinalObject):
3647         (JSC::JSNonFinalObject::finishCreation):
3648         (JSFinalObject):
3649         (JSC::JSFinalObject::finishCreation):
3650         (JSC::JSFinalObject::JSFinalObject):
3651         (JSC::JSObject::offsetOfOutOfLineStorage):
3652         (JSC::JSObject::setOutOfLineStorage):
3653         (JSC::JSObject::JSObject):
3654         (JSC):
3655         (JSC::JSCell::fastGetOwnProperty):
3656         (JSC::JSObject::putDirectInternal):
3657         (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
3658         (JSC::JSObject::putDirectWithoutTransition):
3659         (JSC::offsetRelativeToPatchedStorage):
3660         (JSC::indexRelativeToBase):
3661         (JSC::offsetRelativeToBase):
3662         * runtime/JSPropertyNameIterator.cpp:
3663         (JSC::JSPropertyNameIterator::create):
3664         * runtime/JSPropertyNameIterator.h:
3665         (JSPropertyNameIterator):
3666         (JSC::JSPropertyNameIterator::getOffset):
3667         (JSC::JSPropertyNameIterator::finishCreation):
3668         * runtime/JSValue.cpp:
3669         (JSC::JSValue::putToPrimitive):
3670         * runtime/Operations.h:
3671         (JSC::normalizePrototypeChain):
3672         * runtime/Options.cpp:
3673         (JSC):
3674         (JSC::Options::initialize):
3675         * runtime/PropertyMapHashTable.h:
3676         (PropertyMapEntry):
3677         (JSC::PropertyMapEntry::PropertyMapEntry):
3678         (PropertyTable):
3679         (JSC::PropertyTable::PropertyTable):
3680         (JSC::PropertyTable::getDeletedOffset):
3681         (JSC::PropertyTable::addDeletedOffset):
3682         (JSC::PropertyTable::nextOffset):
3683         (JSC):
3684         (JSC::PropertyTable::sizeInMemory):
3685         * runtime/PropertyOffset.h: Added.
3686         (JSC):
3687         (JSC::checkOffset):
3688         (JSC::validateOffset):
3689         (JSC::isValidOffset):
3690         (JSC::isInlineOffset):
3691         (JSC::isOutOfLineOffset):
3692         (JSC::offsetInInlineStorage):
3693         (JSC::offsetInOutOfLineStorage):
3694         (JSC::offsetInRespectiveStorage):
3695         (JSC::numberOfOutOfLineSlotsForLastOffset):
3696         (JSC::numberOfSlotsForLastOffset):
3697         (JSC::nextPropertyOffsetFor):
3698         (JSC::firstPropertyOffsetFor):
3699         * runtime/PropertySlot.h:
3700         (JSC::PropertySlot::cachedOffset):
3701         (JSC::PropertySlot::setValue):
3702         (JSC::PropertySlot::setCacheableGetterSlot):
3703         (JSC::PropertySlot::clearOffset):
3704         * runtime/PutPropertySlot.h:
3705         (JSC::PutPropertySlot::setExistingProperty):
3706         (JSC::PutPropertySlot::setNewProperty):
3707         (JSC::PutPropertySlot::cachedOffset):
3708         (PutPropertySlot):
3709         * runtime/Structure.cpp:
3710         (JSC::Structure::Structure):
3711         (JSC::Structure::materializePropertyMap):
3712         (JSC::nextOutOfLineStorageCapacity):
3713         (JSC::Structure::growOutOfLineCapacity):
3714         (JSC::Structure::suggestedNewOutOfLineStorageCapacity):
3715         (JSC::Structure::addPropertyTransitionToExistingStructure):
3716         (JSC::Structure::addPropertyTransition):
3717         (JSC::Structure::removePropertyTransition):
3718         (JSC::Structure::flattenDictionaryStructure):
3719         (JSC::Structure::addPropertyWithoutTransition):
3720         (JSC::Structure::removePropertyWithoutTransition):
3721         (JSC::Structure::copyPropertyTableForPinning):
3722         (JSC::Structure::get):
3723         (JSC::Structure::putSpecificValue):
3724         (JSC::Structure::remove):
3725         * runtime/Structure.h:
3726         (Structure):
3727         (JSC::Structure::putWillGrowOutOfLineStorage):
3728         (JSC::Structure::previousID):
3729         (JSC::Structure::outOfLineCapacity):
3730         (JSC::Structure::outOfLineSizeForKnownFinalObject):
3731         (JSC::Structure::outOfLineSizeForKnownNonFinalObject):
3732         (JSC::Structure::outOfLineSize):
3733         (JSC::Structure::hasInlineStorage):
3734         (JSC::Structure::inlineCapacity):
3735         (JSC::Structure::inlineSizeForKnownFinalObject):
3736         (JSC::Structure::inlineSize):
3737         (JSC::Structure::totalStorageSize):
3738         (JSC::Structure::totalStorageCapacity):
3739         (JSC::Structure::firstValidOffset):
3740         (JSC::Structure::lastValidOffset):
3741         (JSC::Structure::isValidOffset):
3742         (JSC::Structure::isEmpty):
3743         (JSC::Structure::transitionCount):
3744         (JSC::Structure::get):
3745
3746 2012-07-05  Oliver Hunt  <oliver@apple.com>
3747
3748         JSObjectCallAsFunction should thisConvert the provided thisObject
3749         https://bugs.webkit.org/show_bug.cgi?id=90628
3750
3751         Reviewed by Gavin Barraclough.
3752
3753         Perform this conversion on the provided this object.
3754
3755         * API/JSObjectRef.cpp:
3756         (JSObjectCallAsFunction):
3757
3758 2012-07-05  Zoltan Herczeg  <zherczeg@webkit.org>
3759
3760         [Qt] Unreviewed buildfix after r121886. Typo fix.
3761
3762         * assembler/MacroAssemblerARM.cpp:
3763         (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
3764
3765 2012-07-05  Zoltan Herczeg  <zherczeg@webkit.org>
3766
3767         Port DFG JIT to traditional ARM
3768         https://bugs.webkit.org/show_bug.cgi?id=90198
3769
3770         Reviewed by Filip Pizlo.
3771
3772         This patch contains the macro assembler part of the
3773         DFG JIT support on ARM systems with fixed 32 bit instruction
3774         width. A large amount of old code was refactored, and the ARMv4
3775         or lower support is removed from the macro assembler.
3776
3777         Sunspider is improved by 8%, and V8 is 92%.
3778
3779         * assembler/ARMAssembler.cpp:
3780         (JSC::ARMAssembler::dataTransfer32):
3781         (JSC::ARMAssembler::baseIndexTransfer32):
3782         (JSC):
3783         (JSC::ARMAssembler::dataTransfer16):
3784         (JSC::ARMAssembler::baseIndexTransfer16):
3785         (JSC::ARMAssembler::dataTransferFloat):
3786         (JSC::ARMAssembler::baseIndexTransferFloat):
3787         (JSC::ARMAssembler::executableCopy):
3788         * assembler/ARMAssembler.h:
3789         (JSC::ARMAssembler::ARMAssembler):
3790         (JSC::ARMAssembler::emitInst):
3791         (JSC::ARMAssembler::vmov_f64_r):
3792         (ARMAssembler):
3793         (JSC::ARMAssembler::vabs_f64_r):
3794         (JSC::ARMAssembler::vneg_f64_r):
3795         (JSC::ARMAssembler::ldr_imm):
3796         (JSC::ARMAssembler::ldr_un_imm):
3797         (JSC::ARMAssembler::dtr_u):
3798         (JSC::ARMAssembler::dtr_ur):
3799         (JSC::ARMAssembler::dtr_d):
3800         (JSC::ARMAssembler::dtr_dr):
3801         (JSC::ARMAssembler::dtrh_u):
3802         (JSC::ARMAssembler::dtrh_ur):
3803         (JSC::ARMAssembler::dtrh_d):
3804         (JSC::ARMAssembler::dtrh_dr):
3805         (JSC::ARMAssembler::fdtr_u):
3806         (JSC::ARMAssembler::fdtr_d):
3807         (JSC::ARMAssembler::push_r):
3808         (JSC::ARMAssembler::pop_r):
3809         (JSC::ARMAssembler::poke_r):
3810         (JSC::ARMAssembler::peek_r):
3811         (JSC::ARMAssembler::vmov_vfp64_r):
3812         (JSC::ARMAssembler::vmov_arm64_r):
3813         (JSC::ARMAssembler::vmov_vfp32_r):
3814         (JSC::ARMAssembler::vmov_arm32_r):
3815         (JSC::ARMAssembler::vcvt_u32_f64_r):
3816         (JSC::ARMAssembler::vcvt_f64_f32_r):
3817         (JSC::ARMAssembler::vcvt_f32_f64_r):
3818         (JSC::ARMAssembler::clz_r):
3819         (JSC::ARMAssembler::bkpt):
3820         (JSC::ARMAssembler::bx):
3821         (JSC::ARMAssembler::blx):
3822         (JSC::ARMAssembler::labelIgnoringWatchpoints):
3823         (JSC::ARMAssembler::labelForWatchpoint):
3824         (JSC::ARMAssembler::label):
3825         (JSC::ARMAssembler::getLdrImmAddress):
3826         (JSC::ARMAssembler::replaceWithJump):
3827         (JSC::ARMAssembler::maxJumpReplacementSize):
3828         (JSC::ARMAssembler::getOp2Byte):
3829         (JSC::ARMAssembler::getOp2Half):
3830         (JSC::ARMAssembler::RM):
3831         (JSC::ARMAssembler::RS):
3832         (JSC::ARMAssembler::RD):
3833         (JSC::ARMAssembler::RN):
3834         * assembler/AssemblerBufferWithConstantPool.h:
3835         (JSC::AssemblerBufferWithConstantPool::ensureSpaceForAnyInstruction):
3836         * assembler/MacroAssemblerARM.cpp:
3837         (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
3838         * assembler/MacroAssemblerARM.h:
3839         (JSC::MacroAssemblerARM::add32):
3840         (MacroAssemblerARM):
3841         (JSC::MacroAssemblerARM::and32):
3842         (JSC::MacroAssemblerARM::lshift32):
3843         (JSC::MacroAssemblerARM::mul32):
3844         (JSC::MacroAssemblerARM::neg32):
3845         (JSC::MacroAssemblerARM::rshift32):
3846         (JSC::MacroAssemblerARM::urshift32):
3847         (JSC::MacroAssemblerARM::xor32):
3848         (JSC::MacroAssemblerARM::load8):
3849         (JSC::MacroAssemblerARM::load8Signed):
3850         (JSC::MacroAssemblerARM::load16):
3851         (JSC::MacroAssemblerARM::load16Signed):
3852         (JSC::MacroAssemblerARM::load32):
3853         (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch):
3854         (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch):
3855         (JSC::MacroAssemblerARM::store8):
3856         (JSC::MacroAssemblerARM::store16):
3857         (JSC::MacroAssemblerARM::store32):
3858         (JSC::MacroAssemblerARM::move):
3859         (JSC::MacroAssemblerARM::jump):
3860         (JSC::MacroAssemblerARM::branchAdd32):
3861         (JSC::MacroAssemblerARM::mull32):
3862         (JSC::MacroAssemblerARM::branchMul32):
3863         (JSC::MacroAssemblerARM::nearCall):
3864         (JSC::MacroAssemblerARM::compare32):
3865         (JSC::MacroAssemblerARM::test32):
3866         (JSC::MacroAssemblerARM::sub32):
3867         (JSC::MacroAssemblerARM::call):
3868         (JSC::MacroAssemblerARM::loadFloat):
3869         (JSC::MacroAssemblerARM::loadDouble):
3870         (JSC::MacroAssemblerARM::storeFloat):
3871         (JSC::MacroAssemblerARM::storeDouble):
3872         (JSC::MacroAssemblerARM::moveDouble):
3873         (JSC::MacroAssemblerARM::addDouble):
3874         (JSC::MacroAssemblerARM::divDouble):
3875         (JSC::MacroAssemblerARM::subDouble):
3876         (JSC::MacroAssemblerARM::mulDouble):
3877         (JSC::MacroAssemblerARM::absDouble):
3878         (JSC::MacroAssemblerARM::negateDouble):
3879         (JSC::MacroAssemblerARM::convertInt32ToDouble):
3880         (JSC::MacroAssemblerARM::convertFloatToDouble):
3881         (JSC::MacroAssemblerARM::convertDoubleToFloat):
3882         (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
3883         (JSC::MacroAssemblerARM::branchTruncateDoubleToUint32):
3884         (JSC::MacroAssemblerARM::truncateDoubleToInt32):
3885         (JSC::MacroAssemblerARM::truncateDoubleToUint32):
3886         (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
3887         (JSC::MacroAssemblerARM::branchDoubleNonZero):
3888         (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN):
3889         (JSC::MacroAssemblerARM::invert):
3890         (JSC::MacroAssemblerARM::replaceWithJump):
3891         (JSC::MacroAssemblerARM::maxJumpReplacementSize):
3892         (JSC::MacroAssemblerARM::call32):
3893         * assembler/SH4Assembler.h:
3894         (JSC::SH4Assembler::label):
3895         * dfg/DFGAssemblyHelpers.h:
3896         (JSC::DFG::AssemblyHelpers::debugCall):
3897         (JSC::DFG::AssemblyHelpers::boxDouble):
3898         (JSC::DFG::AssemblyHelpers::unboxDouble):
3899         * dfg/DFGCCallHelpers.h:
3900         (CCallHelpers):
3901         (JSC::DFG::CCallHelpers::setupArguments):
3902         * dfg/DFGFPRInfo.h:
3903         (DFG):
3904         * dfg/DFGGPRInfo.h:
3905         (DFG):
3906         (GPRInfo):
3907         * dfg/DFGOperations.cpp:
3908         (JSC):
3909         * dfg/DFGSpeculativeJIT.h:
3910         (SpeculativeJIT):
3911         (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult):
3912         (JSC::DFG::SpeculativeJIT::appendCallSetResult):
3913         * jit/JITStubs.cpp:
3914         (JSC):
3915         * jit/JITStubs.h:
3916         (JITStackFrame):
3917         * jit/JSInterfaceJIT.h:
3918         (JSInterfaceJIT):
3919
3920 2012-07-04  Anthony Scian  <ascian@rim.com>
3921
3922         Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
3923         https://bugs.webkit.org/show_bug.cgi?id=40118
3924
3925         Reviewed by Yong Li.
3926
3927         Added member functions to expose function name, urlString, and line #.
3928         Refactored toString to make use of these member functions to reduce
3929         duplicated code for future maintenance.
3930
3931         Manually tested refactoring of toString by tracing thrown exceptions.
3932
3933         * interpreter/Interpreter.h:
3934         (JSC::StackFrame::toString):
3935         (JSC::StackFrame::friendlySourceURL):
3936         (JSC::StackFrame::friendlyFunctionName):
3937         (JSC::StackFrame::friendlyLineNumber):
3938
3939 2012-07-04  Andy Wingo  <wingo@igalia.com>
3940
3941         [GTK] Enable parallel GC
3942         https://bugs.webkit.org/show_bug.cgi?id=90568
3943
3944         Reviewed by Martin Robinson.
3945
3946         * runtime/Options.cpp: Include <algorithm.h> for std::min.
3947
3948 2012-07-04  John Mellor  <johnme@chromium.org>
3949
3950         Text Autosizing: Add compile flag and runtime setting
3951         https://bugs.webkit.org/show_bug.cgi?id=87394
3952
3953         This patch renames Font Boosting to Text Autosizing.
3954
3955         Reviewed by Adam Barth.
3956
3957         * Configurations/FeatureDefines.xcconfig:
3958
3959 2012-07-03  Michael Saboff  <msaboff@apple.com>
3960
3961         Enh: Hash Const JSString in Backing Stores to Save Memory
3962         https://bugs.webkit.org/show_bug.cgi?id=86024
3963
3964         Reviewed by Oliver Hunt.
3965
3966         During garbage collection, each marking thread keeps a HashMap of
3967         strings.  While visiting via MarkStack::copyAndAppend(), we check to
3968         see if the string we are visiting is already in the HashMap.  If not
3969         we add it. If so, we change the reference to the current string we're
3970         visiting to the prior string.
3971
3972         To reduce the performance impact of this change, two throttles have
3973         ben added.  1) We only try hash consting if a significant number of new
3974         strings have been created since the last hash const.  Currently this is
3975         set at 100 strings.  2) If a string is unique at the end of a marking
3976         it will not be checked during further GC phases. In some cases this
3977         won't catch all duplicates, but we are trying to catch the growth of
3978         duplicate strings.
3979
3980         * heap/Heap.cpp:
3981         (JSC::Heap::markRoots):
3982         * heap/MarkStack.cpp:
3983         (JSC::MarkStackThreadSharedData::resetChildren):
3984         (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
3985         (JSC::MarkStackThreadSharedData::reset):
3986         (JSC::MarkStack::setup): Check to see if enough strings have been created
3987         to hash const.
3988         (JSC::MarkStack::reset): Added call to clear m_uniqueStrings.
3989         (JSC::JSString::tryHashConstLock): New method to lock JSString for
3990         hash consting.
3991         (JSC::JSString::releaseHashConstLock): New unlock method.
3992         (JSC::JSString::shouldTryHashConst): Set of checks to see if we should
3993         try to hash const the string.
3994         (JSC::MarkStack::internalAppend): New method that performs the hash consting.
3995         (JSC::SlotVisitor::copyAndAppend): Changed to call the new hash
3996         consting internalAppend().
3997         * heap/MarkStack.h:
3998         (MarkStackThreadSharedData):
3999         (MarkStack):
4000         * runtime/JSGlobalData.cpp:
4001         (JSC::JSGlobalData::JSGlobalData):
4002         * runtime/JSGlobalData.h:
4003         (JSGlobalData):
4004         (JSC::JSGlobalData::haveEnoughNewStringsToHashConst):
4005         (JSC::JSGlobalData::resetNewStringsSinceLastHashConst):
4006         * runtime/JSString.h:
4007         (JSString): Changed from using bool flags to using an unsigned
4008         m_flags field.  This works better with the weakCompareAndSwap in
4009         JSString::tryHashConstLock(). Changed the 8bitness setting and
4010         checking to use new accessors.
4011         (JSC::JSString::JSString):
4012         (JSC::JSString::finishCreation):
4013         (JSC::JSString::is8Bit): Updated for new m_flags.
4014         (JSC::JSString::setIs8Bit): New setter.
4015         New hash const flags accessors:
4016         (JSC::JSString::isHashConstSingleton):
4017         (JSC::JSString::clearHashConstSingleton):
4018         (JSC::JSString::setHashConstSingleton):
4019         (JSC::JSRopeString::finishCreation):
4020         (JSC::JSRopeString::append):
4021
4022 2012-07-03  Tony Chang  <tony@chromium.org>
4023
4024         [chromium] Unreviewed, update .gitignore to handle VS2010 files.
4025
4026         * JavaScriptCore.gyp/.gitignore:
4027
4028 2012-07-03  Mark Lam  <mark.lam@apple.com>
4029
4030         Add ability to symbolically set and dump JSC VM options.
4031         See comments in runtime/Options.h for details on how the options work.
4032         https://bugs.webkit.org/show_bug.cgi?id=90420
4033
4034         Reviewed by Filip Pizlo.
4035
4036         * assembler/LinkBuffer.cpp:
4037         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
4038         * assembler/LinkBuffer.h:
4039         (JSC):
4040         * bytecode/CodeBlock.cpp:
4041         (JSC::CodeBlock::shouldOptimizeNow):
4042         * bytecode/CodeBlock.h:
4043         (JSC::CodeBlock::likelyToTakeSlowCase):
4044         (JSC::CodeBlock::couldTakeSlowCase):
4045         (JSC::CodeBlock::likelyToTakeSpecialFastCase):
4046         (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
4047         (JSC::CodeBlock::likelyToTakeAnySlowCase):
4048         (JSC::CodeBlock::jitAfterWarmUp):
4049         (JSC::CodeBlock::jitSoon):
4050         (JSC::CodeBlock::reoptimizationRetryCounter):
4051         (JSC::CodeBlock::countReoptimization):
4052         (JSC::CodeBlock::counterValueForOptimizeAfterWarmUp):
4053         (JSC::CodeBlock::counterValueForOptimizeAfterLongWarmUp):
4054         (JSC::CodeBlock::optimizeSoon):
4055         (JSC::CodeBlock::exitCountThresholdForReoptimization):
4056         (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
4057         * bytecode/ExecutionCounter.h:
4058         (JSC::ExecutionCounter::clippedThreshold):
4059         * dfg/DFGByteCodeParser.cpp:
4060         (JSC::DFG::ByteCodeParser::handleInlining):
4061         * dfg/DFGCapabilities.h:
4062         (JSC::DFG::mightCompileEval):
4063         (JSC::DFG::mightCompileProgram):
4064         (JSC::DFG::mightCompileFunctionForCall):
4065         (JSC::DFG::mightCompileFunctionForConstruct):
4066         (JSC::DFG::mightInlineFunctionForCall):
4067         (JSC::DFG::mightInlineFunctionForConstruct):
4068         * dfg/DFGCommon.h:
4069         (JSC::DFG::shouldShowDisassembly):
4070         * dfg/DFGDriver.cpp:
4071         (JSC::DFG::compile):
4072         * dfg/DFGOSRExit.cpp:
4073         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
4074         * dfg/DFGVariableAccessData.h:
4075         (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
4076         * heap/MarkStack.cpp:
4077         (JSC::MarkStackSegmentAllocator::allocate):
4078         (JSC::MarkStackSegmentAllocator::shrinkReserve):
4079         (JSC::MarkStackArray::MarkStackArray):
4080         (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
4081         (JSC::SlotVisitor::donateKnownParallel):
4082         (JSC::SlotVisitor::drain):
4083         (JSC::SlotVisitor::drainFromShared):
4084         * heap/MarkStack.h:
4085         (JSC::MarkStack::mergeOpaqueRootsIfProfitable):
4086         (JSC::MarkStack::addOpaqueRoot):
4087         * heap/SlotVisitor.h:
4088         (JSC::SlotVisitor::donate):
4089         * jit/JIT.cpp:
4090         (JSC::JIT::emitOptimizationCheck):
4091         * jsc.cpp:
4092         (printUsageStatement):
4093         (parseArguments):
4094         * runtime/InitializeThreading.cpp:
4095         (JSC::initializeThreadingOnce):
4096         * runtime/JSGlobalData.cpp:
4097         (JSC::enableAssembler):
4098         * runtime/JSGlobalObject.cpp:
4099         (JSC::JSGlobalObject::JSGlobalObject):
4100         * runtime/Options.cpp:
4101         (JSC):
4102         (JSC::overrideOptionWithHeuristic):
4103         (JSC::Options::initialize):
4104         (JSC::Options::setOption):
4105         (JSC::Options::dumpAllOptions):
4106         (JSC::Options::dumpOption):
4107         * runtime/Options.h:
4108         (JSC):
4109         (Options):
4110         (EntryInfo):
4111
4112 2012-07-03  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>  Joel Dillon <joel.dillon@codethink.co.uk>
4113
4114         [Qt][Win] Fix broken QtWebKit5.lib linking
4115         https://bugs.webkit.org/show_bug.cgi?id=88321
4116
4117         Reviewed by Kenneth Rohde Christiansen.
4118
4119         The goal is to have different ports build systems define STATICALLY_LINKED_WITH_WTF
4120         when building JavaScriptCore, if both are packaged in the same DLL, instead
4121         of relying on the code to handle this.
4122         The effects of BUILDING_* and STATICALLY_LINKED_WITH_* are currently the same
4123         except for a check in Source/JavaScriptCore/config.h.
4124
4125         Keeping the old way for the WX port as requested by the port's contributors.
4126         For non-Windows ports there is no difference between IMPORT and EXPORT, no
4127         change is needed.
4128
4129         * API/JSBase.h:
4130           JS symbols shouldn't be included by WTF objects anymore. Remove the export when BUILDING_WTF.
4131         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
4132           Make sure that JavaScriptCore uses import symbols of WTF for the Win port.
4133         * runtime/JSExportMacros.h:
4134
4135 2012-07-02  Filip Pizlo  <fpizlo@apple.com>
4136
4137         DFG OSR exit value recoveries should be computed lazily
4138         https://bugs.webkit.org/show_bug.cgi?id=82155
4139
4140         Reviewed by Gavin Barraclough.
4141
4142         This change aims to reduce one aspect of DFG compile times: the fact
4143         that we currently compute the value recoveries for each local and
4144         argument on every speculation check. We compile many speculation checks,
4145         so this can add up quick. The strategy that this change takes is to
4146         have the DFG save just enough information about how the compiler is
4147         choosing to represent state, that the DFG::OSRExitCompiler can reify
4148         the value recoveries lazily.
4149
4150         This appears to be an 0.3% SunSpider speed-up and is neutral elsewhere.
4151
4152         I also took the opportunity to fix the sampling regions profiler (it
4153         was missing an export macro) and to put in more sampling regions in
4154         the DFG (which are disabled so long as ENABLE(SAMPLING_REGIONS) is
4155         false).
4156
4157         * CMakeLists.txt:
4158         * GNUmakefile.list.am:
4159         * JavaScriptCore.xcodeproj/project.pbxproj:
4160         * Target.pri:
4161         * bytecode/CodeBlock.cpp:
4162         (JSC):
4163         (JSC::CodeBlock::shrinkDFGDataToFit):
4164         * bytecode/CodeBlock.h:
4165         (CodeBlock):
4166         (JSC::CodeBlock::minifiedDFG):
4167         (JSC::CodeBlock::variableEventStream):
4168         (DFGData):
4169         * bytecode/Operands.h:
4170         (JSC::Operands::hasOperand):
4171         (Operands):
4172         (JSC::Operands::size):
4173         (JSC::Operands::at):
4174         (JSC::Operands::operator[]):
4175         (JSC::Operands::isArgument):
4176         (JSC::Operands::isVariable):
4177         (JSC::Operands::argumentForIndex):
4178         (JSC::Operands::variableForIndex):
4179         (JSC::Operands::operandForIndex):
4180         (JSC):
4181         (JSC::dumpOperands):
4182         * bytecode/SamplingTool.h:
4183         (SamplingRegion):
4184         * dfg/DFGByteCodeParser.cpp:
4185         (JSC::DFG::parse):
4186         * dfg/DFGCFAPhase.cpp:
4187         (JSC::DFG::performCFA):
4188         * dfg/DFGCSEPhase.cpp:
4189         (JSC::DFG::performCSE):
4190         * dfg/DFGFixupPhase.cpp:
4191         (JSC::DFG::performFixup):
4192         * dfg/DFGGenerationInfo.h:
4193         (JSC::DFG::GenerationInfo::GenerationInfo):
4194         (JSC::DFG::GenerationInfo::initConstant):
4195         (JSC::DFG::GenerationInfo::initInteger):
4196         (JSC::DFG::GenerationInfo::initJSValue):
4197         (JSC::DFG::GenerationInfo::initCell):
4198         (JSC::DFG::GenerationInfo::initBoolean):
4199         (JSC::DFG::GenerationInfo::initDouble):
4200         (JSC::DFG::GenerationInfo::initStorage):
4201         (GenerationInfo):
4202         (JSC::DFG::GenerationInfo::noticeOSRBirth):
4203         (JSC::DFG::GenerationInfo::use):
4204         (JSC::DFG::GenerationInfo::spill):
4205         (JSC::DFG::GenerationInfo::setSpilled):
4206         (JSC::DFG::GenerationInfo::fillJSValue):
4207         (JSC::DFG::GenerationInfo::fillCell):
4208         (JSC::DFG::GenerationInfo::fillInteger):
4209         (JSC::DFG::GenerationInfo::fillBoolean):
4210         (JSC::DFG::GenerationInfo::fillDouble):
4211         (JSC::DFG::GenerationInfo::fillStorage):
4212         (JSC::DFG::GenerationInfo::appendFill):
4213         (JSC::DFG::GenerationInfo::appendSpill):
4214         * dfg/DFGJITCompiler.cpp:
4215         (JSC::DFG::JITCompiler::link):
4216         (JSC::DFG::JITCompiler::compile):
4217         (JSC::DFG::JITCompiler::compileFunction):
4218         * dfg/DFGMinifiedGraph.h: Added.
4219         (DFG):
4220         (MinifiedGraph):
4221         (JSC::DFG::MinifiedGraph::MinifiedGraph):
4222         (JSC::DFG::MinifiedGraph::at):
4223         (JSC::DFG::MinifiedGraph::append):
4224         (JSC::DFG::MinifiedGraph::prepareAndShrink):
4225         (JSC::DFG::MinifiedGraph::setOriginalGraphSize):
4226         (JSC::DFG::MinifiedGraph::originalGraphSize):
4227         * dfg/DFGMinifiedNode.cpp: Added.
4228         (DFG):
4229         (JSC::DFG::MinifiedNode::fromNode):
4230         * dfg/DFGMinifiedNode.h: Added.
4231         (DFG):
4232         (JSC::DFG::belongsInMinifiedGraph):
4233         (MinifiedNode):
4234         (JSC::DFG::MinifiedNode::MinifiedNode):
4235         (JSC::DFG::MinifiedNode::index):
4236         (JSC::DFG::MinifiedNode::op):
4237         (JSC::DFG::MinifiedNode::hasChild1):
4238         (JSC::DFG::MinifiedNode::child1):
4239         (JSC::DFG::MinifiedNode::hasConstant):
4240         (JSC::DFG::MinifiedNode::hasConstantNumber):
4241         (JSC::DFG::MinifiedNode::constantNumber):
4242         (JSC::DFG::MinifiedNode::hasWeakConstant):
4243         (JSC::DFG::MinifiedNode::weakConstant):
4244         (JSC::DFG::MinifiedNode::getIndex):
4245         (JSC::DFG::MinifiedNode::compareByNodeIndex):
4246         (JSC::DFG::MinifiedNode::hasChild):
4247         * dfg/DFGNode.h:
4248         (Node):
4249         * dfg/DFGOSRExit.cpp:
4250         (JSC::DFG::OSRExit::OSRExit):
4251         * dfg/DFGOSRExit.h:
4252         (OSRExit):
4253         * dfg/DFGOSRExitCompiler.cpp:
4254         * dfg/DFGOSRExitCompiler.h:
4255         (OSRExitCompiler):
4256         * dfg/DFGOSRExitCompiler32_64.cpp:
4257         (JSC::DFG::OSRExitCompiler::compileExit):
4258         * dfg/DFGOSRExitCompiler64.cpp:
4259         (JSC::DFG::OSRExitCompiler::compileExit):
4260         * dfg/DFGPredictionPropagationPhase.cpp:
4261         (JSC::DFG::performPredictionPropagation):
4262         * dfg/DFGRedundantPhiEliminationPhase.cpp:
4263         (JSC::DFG::performRedundantPhiElimination):
4264         * dfg/DFGSpeculativeJIT.cpp:
4265         (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
4266         (DFG):
4267         (JSC::DFG::SpeculativeJIT::fillStorage):
4268         (JSC::DFG::SpeculativeJIT::noticeOSRBirth):
4269         (JSC::DFG::SpeculativeJIT::compileMovHint):
4270         (JSC::DFG::SpeculativeJIT::compile):
4271         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
4272         * dfg/DFGSpeculativeJIT.h:
4273         (DFG):
4274         (JSC::DFG::SpeculativeJIT::use):
4275         (SpeculativeJIT):
4276         (JSC::DFG::SpeculativeJIT::spill):
4277         (JSC::DFG::SpeculativeJIT::speculationCheck):
4278         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
4279         (JSC::DFG::SpeculativeJIT::recordSetLocal):
4280         * dfg/DFGSpeculativeJIT32_64.cpp:
4281         (JSC::DFG::SpeculativeJIT::fillInteger):
4282         (JSC::DFG::SpeculativeJIT::fillDouble):
4283         (JSC::DFG::SpeculativeJIT::fillJSValue):
4284         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
4285         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
4286         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
4287         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
4288         (JSC::DFG::SpeculativeJIT::compile):
4289         * dfg/DFGSpeculativeJIT64.cpp:
4290         (JSC::DFG::SpeculativeJIT::fillInteger):
4291         (JSC::DFG::SpeculativeJIT::fillDouble):
4292         (JSC::DFG::SpeculativeJIT::fillJSValue):
4293         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
4294         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
4295         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
4296         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
4297         (JSC::DFG::SpeculativeJIT::compile):
4298         * dfg/DFGValueRecoveryOverride.h: Added.
4299         (DFG):
4300         (ValueRecoveryOverride):
4301         (JSC::DFG::ValueRecoveryOverride::ValueRecoveryOverride):
4302         * dfg/DFGValueSource.cpp: Added.
4303         (DFG):
4304         (JSC::DFG::ValueSource::dump):
4305         * dfg/DFGValueSource.h: Added.
4306         (DFG):
4307         (JSC::DFG::dataFormatToValueSourceKind):
4308         (JSC::DFG::valueSourceKindToDataFormat):
4309         (JSC::DFG::isInRegisterFile):
4310         (ValueSource):
4311         (JSC::DFG::ValueSource::ValueSource):
4312         (JSC::DFG::ValueSource::forPrediction):
4313         (JSC::DFG::ValueSource::forDataFormat):
4314         (JSC::DFG::ValueSource::isSet):
4315         (JSC::DFG::ValueSource::kind):
4316         (JSC::DFG::ValueSource::isInRegisterFile):
4317         (JSC::DFG::ValueSource::dataFormat):
4318         (JSC::DFG::ValueSource::valueRecovery):
4319         (JSC::DFG::ValueSource::nodeIndex):
4320         (JSC::DFG::ValueSource::nodeIndexFromKind):
4321         (JSC::DFG::ValueSource::kindFromNodeIndex):
4322         * dfg/DFGVariableEvent.cpp: Added.
4323         (DFG):
4324         (JSC::DFG::VariableEvent::dump):
4325         (JSC::DFG::VariableEvent::dumpFillInfo):
4326         (JSC::DFG::VariableEvent::dumpSpillInfo):
4327         * dfg/DFGVariableEvent.h: Added.
4328         (DFG):
4329         (VariableEvent):
4330         (JSC::DFG::VariableEvent::VariableEvent):
4331         (JSC::DFG::VariableEvent::reset):
4332         (JSC::DFG::VariableEvent::fillGPR):
4333         (JSC::DFG::VariableEvent::fillPair):
4334         (JSC::DFG::VariableEvent::fillFPR):
4335         (JSC::DFG::VariableEvent::spill):
4336         (JSC::DFG::VariableEvent::death):
4337         (JSC::DFG::VariableEvent::setLocal):
4338         (JSC::DFG::VariableEvent::movHint):
4339         (JSC::DFG::VariableEvent::kind):
4340         (JSC::DFG::VariableEvent::nodeIndex):
4341         (JSC::DFG::VariableEvent::dataFormat):
4342         (JSC::DFG::VariableEvent::gpr):
4343         (JSC::DFG::VariableEvent::tagGPR):
4344         (JSC::DFG::VariableEvent::payloadGPR):
4345         (JSC::DFG::VariableEvent::fpr):
4346         (JSC::DFG::VariableEvent::virtualRegister):
4347         (JSC::DFG::VariableEvent::operand):
4348         (JSC::DFG::VariableEvent::variableRepresentation):
4349         * dfg/DFGVariableEventStream.cpp: Added.
4350         (DFG):
4351         (JSC::DFG::VariableEventStream::logEvent):
4352         (MinifiedGenerationInfo):
4353         (JSC::DFG::MinifiedGenerationInfo::MinifiedGenerationInfo):
4354         (JSC::DFG::MinifiedGenerationInfo::update):
4355         (JSC::DFG::VariableEventStream::reconstruct):
4356         * dfg/DFGVariableEventStream.h: Added.
4357         (DFG):
4358         (VariableEventStream):
4359         (JSC::DFG::VariableEventStream::appendAndLog):
4360         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
4361         (JSC::DFG::performVirtualRegisterAllocation):
4362
4363 2012-07-02  Filip Pizlo  <fpizlo@apple.com>
4364
4365         DFG::ArgumentsSimplificationPhase should assert that the PhantomArguments nodes it creates are not shouldGenerate()
4366         https://bugs.webkit.org/show_bug.cgi?id=90407
4367
4368         Reviewed by Mark Hahnenberg.
4369
4370         * dfg/DFGArgumentsSimplificationPhase.cpp:
4371         (JSC::DFG::ArgumentsSimplificationPhase::run):
4372
4373 2012-07-02  Gavin Barraclough  <barraclough@apple.com>
4374
4375         Array.prototype.pop should throw if property is not configurable
4376         https://bugs.webkit.org/show_bug.cgi?id=75788
4377
4378         Rubber Stamped by Oliver Hunt.
4379
4380         No real bug here any more, but the error we throw sometimes has a misleading message.
4381
4382         * runtime/JSArray.cpp:
4383         (JSC::JSArray::pop):
4384
4385 2012-06-29  Filip Pizlo  <fpizlo@apple.com>
4386
4387         JSObject wastes too much memory on unused property slots
4388         https://bugs.webkit.org/show_bug.cgi?id=90255
4389
4390         Reviewed by Mark Hahnenberg.
4391
4392         Rolling back in after applying a simple fix: it appears that
4393         JSObject::setStructureAndReallocateStorageIfNecessary() was allocating more
4394         property storage than necessary. Fixing this appears to resolve the crash.
4395
4396         This does a few things:
4397
4398         - JSNonFinalObject no longer has inline property storage.
4399
4400         - Initial out-of-line property storage size is 4 slots for JSNonFinalObject,
4401           or 2x the inline storage for JSFinalObject.
4402
4403         - Property storage is only reallocated if it needs to be. Previously, we
4404           would reallocate the property storage on any transition where the original
4405           structure said shouldGrowProperyStorage(), but this led to spurious
4406           reallocations when doing transitionless property adds and there are
4407           deleted property slots available. That in turn led to crashes, because we
4408           would switch to out-of-line storage even if the capacity matched the
4409           criteria for inline storage.
4410
4411         - Inline JSFunction allocation is killed off because we don't have a good
4412           way of inlining property storage allocation. This didn't hurt performance.
4413           Killing off code is better than fixing it if that code wasn't doing any
4414           good.
4415
4416         This looks like a 1% progression on V8.
4417
4418         * interpreter/Interpreter.cpp:
4419         (JSC::Interpreter::privateExecute):
4420         * jit/JIT.cpp:
4421         (JSC::JIT::privateCompileSlowCases):
4422         * jit/JIT.h:
4423         * jit/JITInlineMethods.h:
4424         (JSC::JIT::emitAllocateBasicJSObject):
4425         (JSC):
4426         * jit/JITOpcodes.cpp:
4427         (JSC::JIT::emit_op_new_func):
4428         (JSC):
4429         (JSC::JIT::emit_op_new_func_exp):
4430         * runtime/JSFunction.cpp:
4431         (JSC::JSFunction::finishCreation):
4432         * runtime/JSObject.h:
4433         (JSC::JSObject::isUsingInlineStorage):
4434         (JSObject):
4435         (JSC::JSObject::finishCreation):
4436         (JSC):
4437         (JSC::JSNonFinalObject::hasInlineStorage):
4438         (JSNonFinalObject):
4439         (JSC::JSNonFinalObject::JSNonFinalObject):
4440         (JSC::JSNonFinalObject::finishCreation):
4441         (JSC::JSFinalObject::hasInlineStorage):
4442         (JSC::JSFinalObject::finishCreation):
4443         (JSC::JSObject::offsetOfInlineStorage):
4444         (JSC::JSObject::setPropertyStorage):
4445         (JSC::Structure::inlineStorageCapacity):
4446         (JSC::Structure::isUsingInlineStorage):
4447         (JSC::JSObject::putDirectInternal):
4448         (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
4449         (JSC::JSObject::putDirectWithoutTransition):
4450         * runtime/Structure.cpp:
4451         (JSC::Structure::Structure):
4452         (JSC::nextPropertyStorageCapacity):
4453         (JSC):
4454         (JSC::Structure::growPropertyStorageCapacity):
4455         (JSC::Structure::suggestedNewPropertyStorageSize):
4456         * runtime/Structure.h:
4457         (JSC::Structure::putWillGrowPropertyStorage):
4458         (Structure):
4459
4460 2012-06-29  Filip Pizlo  <fpizlo@apple.com>
4461
4462         Webkit crashes in DFG on Google Docs when creating a new document
4463         https://bugs.webkit.org/show_bug.cgi?id=90209
4464
4465         Reviewed by Gavin Barraclough.
4466
4467         Don't attempt to short-circuit Phantom(GetLocal) if the GetLocal is for a
4468         captured variable.
4469
4470         * dfg/DFGCFGSimplificationPhase.cpp:
4471         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
4472
4473 2012-06-30  Zan Dobersek  <zandobersek@gmail.com>
4474
4475         Unreviewed, rolling out r121605.
4476         http://trac.webkit.org/changeset/121605
4477         https://bugs.webkit.org/show_bug.cgi?id=90336
4478
4479         Changes caused flaky crashes in sputnik/Unicode tests on Apple
4480         WK1 and GTK Linux builders
4481
4482         * interpreter/Interpreter.cpp:
4483         (JSC::Interpreter::privateExecute):
4484         * jit/JIT.cpp:
4485         (JSC::JIT::privateCompileSlowCases):
4486         * jit/JIT.h:
4487         * jit/JITInlineMethods.h:
4488         (JSC::JIT::emitAllocateBasicJSObject):
4489         (JSC::JIT::emitAllocateJSFinalObject):
4490         (JSC):
4491         (JSC::JIT::emitAllocateJSFunction):
4492         * jit/JITOpcodes.cpp:
4493         (JSC::JIT::emit_op_new_func):
4494         (JSC::JIT::emitSlow_op_new_func):
4495         (JSC):
4496         (JSC::JIT::emit_op_new_func_exp):
4497         (JSC::JIT::emitSlow_op_new_func_exp):
4498         * runtime/JSFunction.cpp:
4499         (JSC::JSFunction::finishCreation):
4500         * runtime/JSObject.h:
4501         (JSC::JSObject::isUsingInlineStorage):
4502         (JSObject):
4503         (JSC::JSObject::finishCreation):
4504         (JSC):
4505         (JSNonFinalObject):
4506         (JSC::JSNonFinalObject::JSNonFinalObject):
4507         (JSC::JSNonFinalObject::finishCreation):
4508         (JSFinalObject):
4509         (JSC::JSFinalObject::finishCreation):
4510         (JSC::JSObject::offsetOfInlineStorage):
4511         (JSC::JSObject::setPropertyStorage):
4512         (JSC::Structure::isUsingInlineStorage):
4513         (JSC::JSObject::putDirectInternal):
4514         (JSC::JSObject::putDirectWithoutTransition):
4515         (JSC::JSObject::transitionTo):
4516         * runtime/Structure.cpp:
4517         (JSC::Structure::Structure):
4518         (JSC):
4519         (JSC::Structure::growPropertyStorageCapacity):
4520         (JSC::Structure::suggestedNewPropertyStorageSize):
4521         * runtime/Structure.h:
4522         (JSC::Structure::shouldGrowPropertyStorage):
4523         (JSC::Structure::propertyStorageSize):
4524
4525 2012-06-29  Mark Hahnenberg  <mhahnenberg@apple.com>
4526
4527         Remove warning about protected values when the Heap is being destroyed
4528         https://bugs.webkit.org/show_bug.cgi?id=90302
4529
4530         Reviewed by Geoffrey Garen.
4531
4532         Having to do book-keeping about whether values allocated from a certain
4533         VM are or are not protected makes the JSC API much more difficult to use
4534         correctly. Clients should be able to throw an entire VM away and not have
4535         to worry about unprotecting all of the values that they protected earlier.
4536
4537         * heap/Heap.cpp:
4538         (JSC::Heap::lastChanceToFinalize):
4539
4540 2012-06-29  Filip Pizlo  <fpizlo@apple.com>
4541
4542         JSObject wastes too much memory on unused property slots
4543         https://bugs.webkit.org/show_bug.cgi?id=90255
4544
4545         Reviewed by Mark Hahnenberg.
4546
4547         This does a few things:
4548
4549         - JSNonFinalObject no longer has inline property storage.
4550
4551         - Initial out-of-line property storage size is 4 slots for JSNonFinalObject,
4552           or 2x the inline storage for JSFinalObject.
4553
4554         - Property storage is only reallocated if it needs to be. Previously, we
4555           would reallocate the property storage on any transition where the original
4556           structure said shouldGrowProperyStorage(), but this led to spurious
4557           reallocations when doing transitionless property adds and there are
4558           deleted property slots available. That in turn led to crashes, because we
4559           would switch to out-of-line storage even if the capacity matched the
4560           criteria for inline storage.
4561
4562         - Inline JSFunction allocation is killed off because we don't have a good
4563           way of inlining property storage allocation. This didn't hurt performance.
4564           Killing off code is better than fixing it if that code wasn't doing any
4565           good.
4566
4567         This looks like a 1% progression on V8.
4568
4569         * interpreter/Interpreter.cpp:
4570         (JSC::Interpreter::privateExecute):
4571         * jit/JIT.cpp:
4572         (JSC::JIT::privateCompileSlowCases):
4573         * jit/JIT.h:
4574         * jit/JITInlineMethods.h:
4575         (JSC::JIT::emitAllocateBasicJSObject):
4576         (JSC):
4577         * jit/JITOpcodes.cpp:
4578         (JSC::JIT::emit_op_new_func):
4579         (JSC):
4580         (JSC::JIT::emit_op_new_func_exp):
4581         * runtime/JSFunction.cpp:
4582         (JSC::JSFunction::finishCreation):
4583         * runtime/JSObject.h:
4584         (JSC::JSObject::isUsingInlineStorage):
4585         (JSObject):
4586         (JSC::JSObject::finishCreation):
4587         (JSC):
4588         (JSC::JSNonFinalObject::hasInlineStorage):
4589         (JSNonFinalObject):
4590         (JSC::JSNonFinalObject::JSNonFinalObject):
4591         (JSC::JSNonFinalObject::finishCreation):
4592         (JSC::JSFinalObject::hasInlineStorage):
4593         (JSC::JSFinalObject::finishCreation):
4594         (JSC::JSObject::offsetOfInlineStorage):
4595         (JSC::JSObject::setPropertyStorage):
4596         (JSC::Structure::inlineStorageCapacity):
4597         (JSC::Structure::isUsingInlineStorage):
4598         (JSC::JSObject::putDirectInternal):
4599         (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
4600         (JSC::JSObject::putDirectWithoutTransition):
4601         * runtime/Structure.cpp:
4602         (JSC::Structure::Structure):
4603         (JSC::nextPropertyStorageCapacity):
4604         (JSC):
4605         (JSC::Structure::growPropertyStorageCapacity):
4606         (JSC::Structure::suggestedNewPropertyStorageSize):
4607         * runtime/Structure.h:
4608         (JSC::Structure::putWillGrowPropertyStorage):
4609         (Structure):
4610
4611 2012-06-28  Filip Pizlo  <fpizlo@apple.com>
4612
4613         DFG recompilation heuristics should be based on count, not rate
4614         https://bugs.webkit.org/show_bug.cgi?id=90146
4615
4616         Reviewed by Oliver Hunt.
4617
4618         This removes a bunch of code that was previously trying to prevent spurious
4619         reoptimizations if a large enough majority of executions of a code block did
4620         not result in OSR exit. It turns out that this code was purely harmful. This
4621         patch removes all of that logic and replaces it with a dead-simple
4622         heuristic: if you exit more than N times (where N is an exponential function
4623         of the number of times the code block has already been recompiled) then we
4624         will recompile.
4625
4626         This appears to be a broad ~1% win on many benchmarks large and small.
4627
4628         * bytecode/CodeBlock.cpp:
4629         (JSC::CodeBlock::CodeBlock):
4630         * bytecode/CodeBlock.h:
4631         (JSC::CodeBlock::osrExitCounter):
4632         (JSC::CodeBlock::countOSRExit):
4633         (CodeBlock):
4634         (JSC::CodeBlock::addressOfOSRExitCounter):
4635         (JSC::CodeBlock::offsetOfOSRExitCounter):
4636         (JSC::CodeBlock::adjustedExitCountThreshold):
4637         (JSC::CodeBlock::exitCountThresholdForReoptimization):
4638         (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
4639         (JSC::CodeBlock::shouldReoptimizeNow):
4640         (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
4641         * bytecode/ExecutionCounter.cpp:
4642         (JSC::ExecutionCounter::setThreshold):
4643         * bytecode/ExecutionCounter.h:
4644         (ExecutionCounter):
4645         (JSC::ExecutionCounter::clippedThreshold):
4646         * dfg/DFGJITCompiler.cpp:
4647         (JSC::DFG::JITCompiler::compileBody):
4648         * dfg/DFGOSRExit.cpp:
4649         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
4650         * dfg/DFGOSRExitCompiler.cpp:
4651         (JSC::DFG::OSRExitCompiler::handleExitCounts):
4652         * dfg/DFGOperations.cpp:
4653         * jit/JITStubs.cpp:
4654         (JSC::DEFINE_STUB_FUNCTION):
4655         * runtime/Options.cpp:
4656         (Options):
4657         (JSC::Options::initializeOptions):
4658         * runtime/Options.h:
4659         (Options):
4660
4661 2012-06-28  Mark Lam  <mark.lam@apple.com>
4662
4663         Adding a commenting utility to record BytecodeGenerator comments
4664         with opcodes that are emitted.  Presently, the comments can only
4665         be constant strings.  Adding comments for opcodes is optional.
4666         If a comment is added, the comment will be printed following the
4667         opcode when CodeBlock::dump() is called.
4668
4669         This utility is disabled by default, and is only meant for VM
4670         development purposes.  It should not be enabled for product builds.
4671
4672         To enable this utility, set ENABLE_BYTECODE_COMMENTS in CodeBlock.h
4673         to 1.
4674
4675         https://bugs.webkit.org/show_bug.cgi?id=90095
4676
4677         Reviewed by Geoffrey Garen.
4678
4679         * GNUmakefile.list.am:
4680         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
4681         * JavaScriptCore.xcodeproj/project.pbxproj:
4682         * bytecode/CodeBlock.cpp:
4683         (JSC::CodeBlock::dumpBytecodeCommentAndNewLine): Dumps the comment.
4684         (JSC):
4685         (JSC::CodeBlock::printUnaryOp): Add comment dumps.
4686         (JSC::CodeBlock::printBinaryOp): Add comment dumps.
4687         (JSC::CodeBlock::printConditionalJump): Add comment dumps.
4688         (JSC::CodeBlock::printCallOp): Add comment dumps.
4689         (JSC::CodeBlock::printPutByIdOp): Add comment dumps.
4690         (JSC::CodeBlock::dump): Add comment dumps.
4691         (JSC::CodeBlock::CodeBlock):
4692         (JSC::CodeBlock::commentForBytecodeOffset):
4693             Finds the comment for an opcode if available.
4694         (JSC::CodeBlock::dumpBytecodeComments):
4695             For debugging whether comments are collected.
4696             It is not being called anywhere.
4697         * bytecode/CodeBlock.h:
4698         (CodeBlock):
4699         (JSC::CodeBlock::bytecodeComments):
4700         * bytecode/Comment.h: Added.
4701         (JSC):
4702         (Comment):
4703         * bytecompiler/BytecodeGenerator.cpp:
4704         (JSC::BytecodeGenerator::BytecodeGenerator):
4705         (JSC::BytecodeGenerator::emitOpcode): Calls emitComment().
4706         (JSC):
4707         (JSC::BytecodeGenerator::emitComment): Adds comment to CodeBlock.
4708         (JSC::BytecodeGenerator::prependComment):
4709             Registers a comment for emitComemnt() to use later.
4710         * bytecompiler/BytecodeGenerator.h:
4711         (BytecodeGenerator):
4712         (JSC::BytecodeGenerator::emitComment):
4713         (JSC::BytecodeGenerator::prependComment):
4714             These are inlined versions of these functions that nullify them
4715             when ENABLE_BYTECODE_COMMENTS is 0.
4716         (JSC::BytecodeGenerator::comments):
4717
4718 2012-06-28  Oliver Hunt  <oliver@apple.com>
4719
4720         32bit DFG incorrectly claims an fpr is fillable even if it has not been proven double
4721         https://bugs.webkit.org/show_bug.cgi?id=90127
4722
4723         Reviewed by Filip Pizlo.
4724
4725         The 32-bit version of fillSpeculateDouble doesn't handle Number->fpr loads
4726         correctly.  This patch fixes this by killing the fill info in the GenerationInfo
4727         when the spillFormat doesn't guarantee the value is a double.
4728
4729         * dfg/DFGSpeculativeJIT32_64.cpp:
4730         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
4731
4732 2012-06-28  Kent Tamura  <tkent@chromium.org>
4733
4734         Classify form control states by their owner forms
4735         https://bugs.webkit.org/show_bug.cgi?id=89950
4736
4737         Reviewed by Hajime Morita.
4738
4739         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
4740         Expose WTF::StringBuilder::canShrink()
4741
4742 2012-06-27  Michael Saboff  <msaboff@apple.com>
4743
4744         [Win] jscore-tests flakey
4745         https://bugs.webkit.org/show_bug.cgi?id=88118
4746
4747         Reviewed by Jessie Berlin.
4748
4749         jsDriver.pl on windows intermittently doesn't get the returned value from jsc,
4750         instead it gets 126.  Added a new option to jsc (-x) which prints the exit
4751         code before exiting.  jsDriver.pl uses this option on Windows and parses the
4752         exit code output for the exit code, removing it before comparing the actual
4753         and expected outputs.  Filed a follow on "FIXME" defect:
4754         [WIN] Intermittent failure for jsc return value to propagate through jsDriver.pl
4755         https://bugs.webkit.org/show_bug.cgi?id=90119
4756
4757         * jsc.cpp:
4758         (CommandLine::CommandLine):
4759         (CommandLine):
4760         (printUsageStatement):
4761         (parseArguments):
4762         (jscmain):
4763         * tests/mozilla/jsDriver.pl:
4764         (execute_tests):
4765
4766 2012-06-27  Sheriff Bot  <webkit.review.bot@gmail.com>
4767
4768         Unreviewed, rolling out r121359.
4769         http://trac.webkit.org/changeset/121359
4770         https://bugs.webkit.org/show_bug.cgi?id=90115
4771
4772         Broke many inspector tests (Requested by jpfau on #webkit).
4773
4774         * interpreter/Interpreter.h:
4775         (JSC::StackFrame::toString):
4776
4777 2012-06-27  Filip Pizlo  <fpizlo@apple.com>
4778
4779         Javascript SHA-512 gives wrong hash on second and subsequent runs unless Web Inspector Javascript Debugging is on
4780         https://bugs.webkit.org/show_bug.cgi?id=90053
4781         <rdar://problem/11764613>
4782
4783         Reviewed by Mark Hahnenberg.
4784
4785         The problem is that the code was assuming that the recovery should be Undefined if the source of
4786         the SetLocal was !shouldGenerate(). But that's wrong, since the DFG optimizer may skip around a
4787         UInt32ToNumber node (hence making it !shouldGenerate()) and keep the source of that node alive.
4788         In that case we should base the recovery on the source of the UInt32ToNumber. The logic for this
4789         was already in place but the fast check for !shouldGenerate() broke it.
4790
4791         * dfg/DFGSpeculativeJIT.cpp:
4792         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
4793
4794 2012-06-27  Filip Pizlo  <fpizlo@apple.com>
4795
4796         DFG disassembly should be easier to read
4797         https://bugs.webkit.org/show_bug.cgi?id=90106
4798
4799         Reviewed by Mark Hahnenberg.
4800
4801         Did a few things:
4802
4803         - Options::showDFGDisassembly now shows OSR exit disassembly as well.
4804
4805         - Phi node dumping doesn't attempt to do line wrapping since it just made the dump harder
4806           to read.
4807
4808         - DFG graph disassembly view shows a few additional node types that turn out to be
4809           essential for understanding OSR exits.
4810
4811         Put together, these changes reinforce the philosophy that anything needed for computing
4812         OSR exit is just as important as the machine code itself. Of course, we still don't take
4813         that philosophy to its full extreme - for example Phantom nodes are not dumped. We may
4814         revisit that in the future.
4815
4816         * assembler/LinkBuffer.cpp:
4817         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
4818         * assembler/LinkBuffer.h:
4819         (JSC):
4820         * dfg/DFGDisassembler.cpp:
4821         (JSC::DFG::Disassembler::dump):
4822         * dfg/DFGGraph.cpp:
4823         (JSC::DFG::Graph::dumpBlockHeader):
4824         * dfg/DFGNode.h:
4825         (JSC::DFG::Node::willHaveCodeGenOrOSR):
4826         * dfg/DFGOSRExitCompiler.cpp:
4827         * jit/JIT.cpp:
4828         (JSC::JIT::privateCompile):
4829
4830 2012-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
4831
4832         JSLock should be per-JSGlobalData
4833         https://bugs.webkit.org/show_bug.cgi?id=89123
4834
4835         Reviewed by Geoffrey Garen.
4836
4837         * API/APIShims.h:
4838         (APIEntryShimWithoutLock):
4839         (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to
4840         determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the
4841         HeapTimer class because timerDidFire could run after somebody has started to tear down that particular
4842         JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after
4843         its destruction has begun.
4844         (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
4845         (JSC::APIEntryShim::APIEntryShim):
4846         (APIEntryShim):
4847         (JSC::APIEntryShim::~APIEntryShim):
4848         (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors.
4849         Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock
4850         and before we've released it, which can only done in APIEntryShim.
4851         (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here.
4852         * API/JSContextRef.cpp:
4853         (JSGlobalContextCreate):
4854         (JSGlobalContextCreateInGroup):
4855         (JSGlobalContextRelease):
4856         (JSContextCreateBacktrace):
4857         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
4858         * heap/CopiedSpace.cpp:
4859         (JSC::CopiedSpace::tryAllocateSlowCase):
4860         * heap/Heap.cpp:
4861         (JSC::Heap::protect):
4862         (JSC::Heap::unprotect):
4863         (JSC::Heap::collect):
4864         (JSC::Heap::setActivityCallback):
4865         (JSC::Heap::activityCallback):
4866         (JSC::Heap::sweeper):
4867         * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they
4868         are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback
4869         and the IncrementalSweeper to make sure they're the last things that get initialized during construction to
4870         prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about.
4871         (Heap):
4872         * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown.
4873         (JSC::HeapTimer::~HeapTimer):
4874         (JSC::HeapTimer::invalidate):
4875         (JSC):
4876         (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread
4877         that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the
4878         HeapTimer and schedule it to fire immediately so that it can notice and kill itself.
4879         (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed
4880         out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim,
4881         but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case
4882         we were interrupted between releasing our mutex and trying to grab the APILock.
4883         * heap/HeapTimer.h:
4884         (HeapTimer):
4885         * heap/IncrementalSweeper.cpp:
4886         (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles
4887         all of that for us.
4888         (JSC::IncrementalSweeper::create):
4889         * heap/IncrementalSweeper.h:
4890         (IncrementalSweeper):
4891         * heap/MarkedAllocator.cpp:
4892         (JSC::MarkedAllocator::allocateSlowCase):
4893         * heap/WeakBlock.cpp:
4894         (JSC::WeakBlock::reap):
4895         * jsc.cpp:
4896         (functionGC):
4897         (functionReleaseExecutableMemory):
4898         (jscmain):
4899         * runtime/Completion.cpp:
4900         (JSC::checkSyntax):
4901         (JSC::evaluate):
4902         * runtime/GCActivityCallback.h:
4903         (DefaultGCActivityCallback):
4904         (JSC::DefaultGCActivityCallback::create):
4905         * runtime/JSGlobalData.cpp:
4906         (JSC::JSGlobalData::JSGlobalData):
4907         (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper)
4908         that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity
4909         it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the
4910         APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes.
4911         (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock.
4912         (JSC::JSGlobalData::sharedInstanceInternal):
4913         * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and
4914         de-refing JSGlobalDatas on separate threads since we don't do it that often anyways.
4915         (JSGlobalData):
4916         (JSC::JSGlobalData::apiLock):
4917         * runtime/JSGlobalObject.cpp:
4918         (JSC::JSGlobalObject::~JSGlobalObject):
4919         (JSC::JSGlobalObject::init):
4920         * runtime/JSLock.cpp:
4921         (JSC):
4922         (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance.
4923         (JSC::GlobalJSLock::~GlobalJSLock):
4924         (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that
4925         it can successfully unlock it later without it disappearing from underneath it.
4926         (JSC::JSLockHolder::~JSLockHolder):
4927         (JSC::JSLock::JSLock):
4928         (JSC::JSLock::~JSLock):
4929         (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for
4930         actually waiting for long periods.
4931         (JSC::JSLock::unlock):
4932         (JSC::JSLock::currentThreadIsHoldingLock):
4933         (JSC::JSLock::dropAllLocks):
4934         (JSC::JSLock::dropAllLocksUnconditionally):
4935         (JSC::JSLock::grabAllLocks):
4936         (JSC::JSLock::DropAllLocks::DropAllLocks):
4937         (JSC::JSLock::DropAllLocks::~DropAllLocks):
4938         * runtime/JSLock.h:
4939         (JSC):
4940         (GlobalJSLock):
4941         (JSLockHolder):
4942         (JSLock):
4943         (DropAllLocks):
4944         * runtime/WeakGCMap.h:
4945         (JSC::WeakGCMap::set):
4946         * testRegExp.cpp:
4947         (realMain):
4948
4949 2012-06-27  Filip Pizlo  <fpizlo@apple.com>
4950
4951         x86 disassembler confuses immediates with addresses
4952         https://bugs.webkit.org/show_bug.cgi?id=90099
4953
4954         Reviewed by Mark Hahnenberg.
4955
4956         Prepend "$" to immediates to disambiguate between immediates and addresses. This is in
4957         accordance with the gas and AT&T syntax.
4958
4959         * disassembler/udis86/udis86_syn-att.c:
4960         (gen_operand):
4961
4962 2012-06-27  Filip Pizlo  <fpizlo@apple.com>
4963
4964         Add a comment clarifying Options::showDisassembly versus Options::showDFGDisassembly.
4965
4966         Rubber stamped by Mark Hahnenberg.
4967
4968         * runtime/Options.cpp:
4969         (JSC::Options::initializeOptions):
4970
4971 2012-06-27  Anthony Scian  <ascian@rim.com>
4972
4973         Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
4974         https://bugs.webkit.org/show_bug.cgi?id=40118
4975
4976         Reviewed by Yong Li.
4977
4978         Added member functions to expose function name, urlString, and line #.
4979         Refactored toString to make use of these member functions to reduce
4980         duplicated code for future maintenance.
4981
4982         Manually tested refactoring of toString by tracing thrown exceptions.
4983
4984         * interpreter/Interpreter.h:
4985         (StackFrame):
4986         (JSC::StackFrame::toString):
4987         (JSC::StackFrame::friendlySourceURL):
4988         (JSC::StackFrame::friendlyFunctionName):
4989         (JSC::StackFrame::friendlyLineNumber):
4990
4991 2012-06-27  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
4992
4993         [Qt] Remove redundant c++11 warning suppression code
4994
4995         This is already handled in default_post.
4996
4997         Reviewed by Tor Arne Vestbø.
4998
4999         * Target.pri:
5000
5001 2012-06-26  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
5002
5003         [Qt] Add missing heades to HEADERS
5004
5005         For JavaScriptCore there aren't any Qt specific files, so we include all
5006         headers for easy editing in Qt Creator.
5007
5008         Reviewed by Simon Hausmann.
5009
5010         * Target.pri:
5011
5012 2012-06-26  Dominic Cooney  <dominicc@chromium.org>
5013
5014         [Chromium] Remove unused build scripts and empty folders for JavaScriptCore w/ gyp
5015         https://bugs.webkit.org/show_bug.cgi?id=90029
5016
5017         Reviewed by Adam Barth.
5018
5019         * gyp: Removed.
5020         * gyp/generate-derived-sources.sh: Removed.
5021         * gyp/generate-dtrace-header.sh: Removed.
5022         * gyp/run-if-exists.sh: Removed.
5023         * gyp/update-info-plist.sh: Removed.
5024
5025 2012-06-26  Geoffrey Garen  <ggaren@apple.com>
5026
5027         Reduced (but did not eliminate) use of "berzerker GC"
5028         https://bugs.webkit.org/show_bug.cgi?id=89237
5029
5030         Reviewed by Gavin Barraclough.
5031
5032         (PART 2)
5033
5034         This part turns off "berzerker GC" and turns on incremental shrinking.
5035
5036         * heap/IncrementalSweeper.cpp:
5037         (JSC::IncrementalSweeper::doSweep): Free or shrink after sweeping to
5038         maintain the behavior we used to get from the occasional berzerker GC,
5039         which would run all finalizers and then free or shrink all blocks
5040         synchronously.
5041
5042         * heap/MarkedBlock.h:
5043         (JSC::MarkedBlock::needsSweeping): Sweep zapped blocks, too. It's always
5044         safe to sweep a zapped block (that's the point of zapping), and it's
5045         sometimes profitable. For example, consider this case: Block A does some
5046         allocation (transitioning Block A from Marked to FreeListed), then GC
5047         happens (transitioning Block A to Zapped), then all objects in Block A
5048         are free, then the incremental sweeper visits Block A. If we skipped
5049         Zapped blocks, we'd skip Block A, even though it would be profitable to
5050         run its destructors and free its memory.
5051
5052         * runtime/GCActivityCallback.cpp:
5053         (JSC::DefaultGCActivityCallback::doWork): Don't sweep eagerly; we'll do
5054         this incrementally.
5055
5056 2012-06-26  Filip Pizlo  <fpizlo@apple.com>
5057
5058         DFG PutByValAlias is too aggressive
5059         https://bugs.webkit.org/show_bug.cgi?id=90026
5060         <rdar://problem/11751830>
5061
5062         Reviewed by Gavin Barraclough.
5063
5064         For CSE on normal arrays, we now treat PutByVal as impure. This does not appear to affect
5065         performance by much.
5066
5067         For CSE on typed arrays, we fix PutByValAlias by making GetByVal speculate that the access
5068         is within bounds. This also has the effect of making our out-of-bounds handling consistent
5069         with WebCore.
5070
5071         * dfg/DFGCSEPhase.cpp:
5072         (JSC::DFG::CSEPhase::performNodeCSE):
5073         * dfg/DFGGraph.h:
5074         (JSC::DFG::Graph::byValIsPure):
5075         (JSC::DFG::Graph::clobbersWorld):
5076         * dfg/DFGNodeType.h:
5077         (DFG):
5078         * dfg/DFGSpeculativeJIT.cpp:
5079         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
5080         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
5081
5082 2012-06-26  Yong Li  <yoli@rim.com>
5083
5084         [BlackBerry] Add JSC statistics into about:memory
5085         https://bugs.webkit.org/show_bug.cgi?id=89779
5086
5087         Reviewed by Rob Buis.
5088
5089         Fix non-JIT build on BlackBerry broken by r121196.
5090
5091         * runtime/MemoryStatistics.cpp:
5092         (JSC::globalMemoryStatistics):
5093
5094 2012-06-25  Filip Pizlo  <fpizlo@apple.com>
5095
5096         DFG::operationNewArray is unnecessarily slow, and may use the wrong array
5097         prototype when inlined
5098         https://bugs.webkit.org/show_bug.cgi?id=89821
5099
5100         Reviewed by Geoffrey Garen.
5101
5102         Fixes all array allocations to use the right structure, and hence the right prototype. Adds
5103         inlining of new Array(...) with a non-zero number of arguments. Optimizes allocations of
5104         empty arrays.
5105
5106         * dfg/DFGAbstractState.cpp:
5107         (JSC::DFG::AbstractState::execute):
5108         * dfg/DFGByteCodeParser.cpp:
5109         (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
5110         * dfg/DFGCCallHelpers.h:
5111         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
5112         (CCallHelpers):
5113         * dfg/DFGNodeType.h:
5114         (DFG):
5115         * dfg/DFGOperations.cpp:
5116         * dfg/DFGOperations.h:
5117         * dfg/DFGPredictionPropagationPhase.cpp:
5118         (JSC::DFG::PredictionPropagationPhase::propagate):
5119         * dfg/DFGSpeculativeJIT.h:
5120         (JSC::DFG::SpeculativeJIT::callOperation):
5121         * dfg/DFGSpeculativeJIT32_64.cpp:
5122         (JSC::DFG::SpeculativeJIT::compile):
5123         * dfg/DFGSpeculativeJIT64.cpp:
5124         (JSC::DFG::SpeculativeJIT::compile):
5125         * runtime/JSArray.h:
5126         (JSC):
5127         (JSC::constructArray):
5128         * runtime/JSGlobalObject.h:
5129         (JSC):
5130         (JSC::constructArray):
5131
5132 2012-06-26  Filip Pizlo  <fpizlo@apple.com>
5133
5134         New fast/js/dfg-store-unexpected-value-into-argument-and-osr-exit.html fails on 32 bit
5135         https://bugs.webkit.org/show_bug.cgi?id=89953
5136
5137         Reviewed by Zoltan Herczeg.
5138
5139         DFG 32-bit JIT was confused about the difference between a predicted type and a
5140         proven type. This is easy to get confused about, since a local that is predicted int32
5141         almost always means that the local must be an int32 since speculations are hoisted to
5142         stores to locals. But that is less likely to be the case for arguments, where there is
5143         an additional least-upper-bounding step: any store to an argument with a weird type
5144         may force the argument to be any type.
5145
5146         This patch basically duplicates the functionality in DFGSpeculativeJIT64.cpp for
5147         GetLocal: the decision of whether to load a local as an int32 (or as an array, or as
5148         a boolean) is made based on the AbstractValue::m_type, which is a type proof, rather
5149         than the VariableAccessData::prediction(), which is a predicted type.
5150
5151         * dfg/DFGSpeculativeJIT32_64.cpp:
5152         (JSC::DFG::SpeculativeJIT::compile):
5153
5154 2012-06-25  Filip Pizlo  <fpizlo@apple.com>
5155
5156         JSC should try to make profiling deterministic because otherwise reproducing failures is
5157         nearly impossible
5158         https://bugs.webkit.org/show_bug.cgi?id=89940
5159
5160         Rubber stamped by Gavin Barraclough.
5161
5162         This rolls out the part of http://trac.webkit.org/changeset/121215 that introduced randomness
5163         into the system. Now, instead of randomizing the tier-up threshold, we always set it to an
5164         artificially low (and statically predetermined!) value. This gives most of the benefit of
5165         threshold randomization without actually making the system behave completely differently on
5166         each invocation.
5167
5168         * bytecode/ExecutionCounter.cpp:
5169         (JSC::ExecutionCounter::setThreshold):
5170         * runtime/Options.cpp:
5171         (Options):
5172         (JSC::Options::initializeOptions):
5173         * runtime/Options.h:
5174         (Options):
5175
5176 2012-06-22  Filip Pizlo  <fpizlo@apple.com>
5177
5178         Value profiling should use tier-up threshold randomization to get more coverage
5179         https://bugs.webkit.org/show_bug.cgi?id=89802
5180
5181         Reviewed by Gavin Barraclough.
5182
5183         This patch causes both LLInt and Baseline JIT code to take the OSR slow path several
5184         times before actually doing OSR. If we take the OSR slow path before the execution
5185         count threshold is reached, then we just call CodeBlock::updateAllPredictions() to
5186         compute the current latest least-upper-bound SpecType of all values seen in each
5187         ValueProfile.
5188
5189         * bytecode/CodeBlock.cpp:
5190         (JSC::CodeBlock::stronglyVisitStrongReferences):
5191         (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
5192         (JSC):
5193         (JSC::CodeBlock::updateAllPredictions):
5194         (JSC::CodeBlock::shouldOptimizeNow):
5195         * bytecode/CodeBlock.h:
5196         (JSC::CodeBlock::llintExecuteCounter):
5197         (JSC::CodeBlock::jitExecuteCounter):
5198         (CodeBlock):
5199         (JSC::CodeBlock::updateAllPredictions):
5200         * bytecode/ExecutionCounter.cpp:
5201         (JSC::ExecutionCounter::setThreshold):
5202         (JSC::ExecutionCounter::status):
5203         (JSC):
5204         * bytecode/ExecutionCounter.h:
5205         (JSC::ExecutionCounter::count):
5206         (ExecutionCounter):
5207         * dfg/DFGAbstractState.cpp:
5208         (JSC::DFG::AbstractState::execute):
5209         * dfg/DFGOperations.cpp:
5210         * dfg/DFGSpeculativeJIT.cpp:
5211         (JSC::DFG::SpeculativeJIT::compile):
5212         * jit/JITStubs.cpp:
5213         (JSC::DEFINE_STUB_FUNCTION):
5214         * llint/LLIntSlowPaths.cpp:
5215         (JSC::LLInt::jitCompileAndSetHeuristics):
5216         (JSC::LLInt::entryOSR):
5217         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
5218         * runtime/JSGlobalObject.cpp:
5219         (JSC::JSGlobalObject::JSGlobalObject):
5220         (JSC):
5221         * runtime/JSGlobalObject.h:
5222         (JSGlobalObject):
5223         (JSC::JSGlobalObject::weakRandomInteger):
5224         * runtime/Options.cpp:
5225         (Options):
5226         (JSC::Options::initializeOptions):
5227         * runtime/Options.h:
5228         (Options):
5229         * runtime/WeakRandom.h:
5230         (WeakRandom):
5231         (JSC::WeakRandom::seedUnsafe):
5232
5233 2012-06-25  Yong Li  <yoli@rim.com>
5234
5235         [BlackBerry] Add JSC statistics into about:memory
5236         https://bugs.webkit.org/show_bug.cgi?id=89779
5237
5238         Reviewed by Rob Buis.
5239
5240         Add MemoryStatistics.cpp into build, and fill JITBytes for BlackBerry port.
5241
5242         * PlatformBlackBerry.cmake:
5243         * runtime/MemoryStatistics.cpp:
5244         (JSC::globalMemoryStatistics):
5245
5246 2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
5247
5248         Unreviewed, rolling out r121058.
5249         http://trac.webkit.org/changeset/121058
5250         https://bugs.webkit.org/show_bug.cgi?id=89809
5251
5252         Patch causes plugins tests to crash in GTK debug builds
5253         (Requested by zdobersek on #webkit).
5254
5255         * API/APIShims.h:
5256         (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
5257         (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
5258         (APIEntryShimWithoutLock):
5259         (JSC::APIEntryShim::APIEntryShim):
5260         (APIEntryShim):
5261         (JSC::APICallbackShim::~APICallbackShim):
5262         * API/JSContextRef.cpp:
5263         (JSGlobalContextCreate):
5264         (JSGlobalContextCreateInGroup):
5265         (JSGlobalContextRelease):
5266         (JSContextCreateBacktrace):
5267         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
5268         * heap/CopiedSpace.cpp:
5269         (JSC::CopiedSpace::tryAllocateSlowCase):
5270         * heap/Heap.cpp:
5271         (JSC::Heap::protect):
5272         (JSC::Heap::unprotect):
5273         (JSC::Heap::collect):
5274         (JSC::Heap::setActivityCallback):
5275         (JSC::Heap::activityCallback):
5276         (JSC::Heap::sweeper):
5277         * heap/Heap.h:
5278         (Heap):
5279         * heap/HeapTimer.cpp:
5280         (JSC::HeapTimer::~HeapTimer):
5281         (JSC::HeapTimer::invalidate):
5282         (JSC::HeapTimer::timerDidFire):
5283         (JSC):
5284         * heap/HeapTimer.h:
5285         (HeapTimer):
5286         * heap/IncrementalSweeper.cpp:
5287         (JSC::IncrementalSweeper::doWork):
5288         (JSC::IncrementalSweeper::create):
5289         * heap/IncrementalSweeper.h:
5290         (IncrementalSweeper):
5291         * heap/MarkedAllocator.cpp:
5292         (JSC::MarkedAllocator::allocateSlowCase):
5293         * heap/WeakBlock.cpp:
5294         (JSC::WeakBlock::reap):
5295         * jsc.cpp:
5296         (functionGC):
5297         (functionReleaseExecutableMemory):
5298         (jscmain):
5299         * runtime/Completion.cpp:
5300         (JSC::checkSyntax):
5301         (JSC::evaluate):
5302         * runtime/GCActivityCallback.h:
5303         (DefaultGCActivityCallback):
5304         (JSC::DefaultGCActivityCallback::create):
5305         * runtime/JSGlobalData.cpp:
5306         (JSC::JSGlobalData::JSGlobalData):
5307         (JSC::JSGlobalData::~JSGlobalData):
5308         (JSC::JSGlobalData::sharedInstance):
5309         (JSC::JSGlobalData::sharedInstanceInternal):
5310         * runtime/JSGlobalData.h:
5311         (JSGlobalData):
5312         * runtime/JSGlobalObject.cpp:
5313         (JSC::JSGlobalObject::~JSGlobalObject):
5314         (JSC::JSGlobalObject::init):
5315         * runtime/JSLock.cpp:
5316         (JSC):
5317         (JSC::createJSLockCount):
5318         (JSC::JSLock::lockCount):
5319         (JSC::setLockCount):
5320         (JSC::JSLock::JSLock):
5321         (JSC::JSLock::lock):
5322         (JSC::JSLock::unlock):
5323         (JSC::JSLock::currentThreadIsHoldingLock):
5324         (JSC::JSLock::DropAllLocks::DropAllLocks):
5325         (JSC::JSLock::DropAllLocks::~DropAllLocks):
5326         * runtime/JSLock.h:
5327         (JSC):
5328         (JSLock):
5329         (JSC::JSLock::JSLock):
5330         (JSC::JSLock::~JSLock):
5331         (DropAllLocks):
5332         * runtime/WeakGCMap.h:
5333         (JSC::WeakGCMap::set):
5334         * testRegExp.cpp:
5335         (realMain):
5336
5337 2012-06-22  Alexandru Chiculita  <achicu@adobe.com>
5338
5339         [CSS Shaders] Re-enable the CSS Shaders compile time flag on Safari Mac
5340         https://bugs.webkit.org/show_bug.cgi?id=89781
5341
5342         Reviewed by Dean Jackson.
5343
5344         Added ENABLE_CSS_SHADERS flag as enabled by default on Safari for Mac.
5345
5346         * Configurations/FeatureDefines.xcconfig:
5347
5348 2012-06-22  Filip Pizlo  <fpizlo@apple.com>
5349
5350         DFG tier-up should happen in prologues, not epilogues
5351         https://bugs.webkit.org/show_bug.cgi?id=89752
5352
5353         Reviewed by Geoffrey Garen.
5354
5355         This change has two outcomes:
5356
5357         1) Slightly reduces the likelihood that a function will be optimized both
5358         standalone and via inlining.  Previously, if you had a call sequence like foo()
5359         calls bar() exactly once, and nobody else calls bar(), then bar() would get
5360         optimized first (because it returns first) and then foo() gets optimized.  If foo()
5361         can inline bar() then that means that bar() gets optimized twice.  But now, if we
5362         optimize in prologues, then foo() will be optimized first.  If it inlines bar(),
5363         that means that there will no longer be any calls to bar().
5364
5365         2) It lets us kill some code in JITStubs.  Epilogue tier-up was very different from
5366         loop tier-up, since epilogue tier-up should not attempt OSR.  But prologue tier-up
5367         requires OSR (albeit really easy OSR since it's the top of the compilation unit),
5368         so it becomes just like loop tier-up.  As a result, we now have one optimization
5369         hook (cti_optimize) instead of two (cti_optimize_from_loop and
5370         cti_optimize_from_ret).
5371
5372         As a consequence of not having an optimization check in epilogues, the OSR exit
5373         code must now trigger reoptimization itself instead of just signaling the epilogue
5374         check to fire.
5375
5376         This also adds the ability to count the number of DFG compilations, which was
5377         useful for debugging this patch and might be useful for other things in the future.
5378
5379         * bytecode/CodeBlock.cpp:
5380         (JSC::CodeBlock::reoptimize):
5381         (JSC):
5382         * bytecode/CodeBlock.h:
5383         (CodeBlock):
5384         * dfg/DFGByteCodeParser.cpp:
5385         (JSC::DFG::ByteCodeParser::parseCodeBlock):
5386         * dfg/DFGDriver.cpp:
5387         (DFG):
5388         (JSC::DFG::getNumCompilations):
5389         (JSC::DFG::compile):
5390         * dfg/DFGDriver.h:
5391         (DFG):
5392         * dfg/DFGOSRExitCompiler.cpp:
5393         (JSC::DFG::OSRExitCompiler::handleExitCounts):
5394         * dfg/DFGOperations.cpp:
5395         * dfg/DFGOperations.h:
5396         * jit/JIT.cpp:
5397         (JSC::JIT::emitOptimizationCheck):
5398         * jit/JIT.h:
5399         * jit/JITCall32_64.cpp:
5400         (JSC::JIT::emit_op_ret):
5401         (JSC::JIT::emit_op_ret_object_or_this):
5402         * jit/JITOpcodes.cpp:
5403         (JSC::JIT::emit_op_ret):
5404         (JSC::JIT::emit_op_ret_object_or_this):
5405         (JSC::JIT::emit_op_enter):
5406         * jit/JITOpcodes32_64.cpp:
5407         (JSC::JIT::emit_op_enter):
5408         * jit/JITStubs.cpp:
5409         (JSC::DEFINE_STUB_FUNCTION):
5410         * jit/JITStubs.h:
5411
5412 2012-06-20  Mark Hahnenberg  <mhahnenberg@apple.com>
5413
5414         JSLock should be per-JSGlobalData
5415         https://bugs.webkit.org/show_bug.cgi?id=89123
5416
5417         Reviewed by Gavin Barraclough.
5418
5419         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
5420         * API/APIShims.h:
5421         (APIEntryShimWithoutLock):
5422         (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to
5423         determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the
5424         HeapTimer class because timerDidFire could run after somebody has started to tear down that particular
5425         JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after
5426         its destruction has begun.
5427         (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock): Now derefs if it also refed.
5428         (JSC::APIEntryShim::APIEntryShim):
5429         (APIEntryShim):
5430         (JSC::APIEntryShim::~APIEntryShim):
5431         (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors.
5432         Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock
5433         and before we've released it, which can only done in APIEntryShim.
5434         (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here.
5435         * API/JSContextRef.cpp:
5436         (JSGlobalContextCreate):
5437         (JSGlobalContextCreateInGroup):
5438         (JSGlobalContextRelease):
5439         (JSContextCreateBacktrace):
5440         * heap/CopiedSpace.cpp:
5441         (JSC::CopiedSpace::tryAllocateSlowCase):
5442         * heap/Heap.cpp:
5443         (JSC::Heap::protect):
5444         (JSC::Heap::unprotect):
5445         (JSC::Heap::collect):
5446         (JSC::Heap::setActivityCallback):
5447         (JSC::Heap::activityCallback):
5448         (JSC::Heap::sweeper):
5449         * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they
5450         are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback
5451         and the IncrementalSweeper to make sure they're the last things that get initialized during construction to
5452         prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about.
5453         (Heap):
5454         * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown.
5455         (JSC::HeapTimer::~HeapTimer):
5456         (JSC::HeapTimer::invalidate):
5457         (JSC):
5458         (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread
5459         that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the
5460         HeapTimer and schedule it to fire immediately so that it can notice and kill itself.
5461         (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed
5462         out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim,
5463         but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case
5464         we were interrupted between releasing our mutex and trying to grab the APILock.
5465         * heap/HeapTimer.h:
5466         (HeapTimer):
5467         * heap/IncrementalSweeper.cpp:
5468         (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles
5469         all of that for us.
5470         (JSC::IncrementalSweeper::create):
5471         * heap/IncrementalSweeper.h:
5472         (IncrementalSweeper):
5473         * heap/MarkedAllocator.cpp:
5474         (JSC::MarkedAllocator::allocateSlowCase):
5475         * heap/WeakBlock.cpp:
5476         (JSC::WeakBlock::reap):
5477         * jsc.cpp:
5478         (functionGC):
5479         (functionReleaseExecutableMemory):
5480         (jscmain):
5481         * runtime/Completion.cpp:
5482         (JSC::checkSyntax):
5483         (JSC::evaluate):
5484         * runtime/GCActivityCallback.h:
5485         (DefaultGCActivityCallback):
5486         (JSC::DefaultGCActivityCallback::create):
5487         * runtime/JSGlobalData.cpp:
5488         (JSC::JSGlobalData::JSGlobalData):
5489         (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper)
5490         that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity
5491         it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the
5492         APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes.
5493         (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock.
5494         (JSC::JSGlobalData::sharedInstanceInternal):
5495         * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and
5496         de-refing JSGlobalDatas on separate threads since we don't do it that often anyways.
5497         (JSGlobalData):
5498         (JSC::JSGlobalData::apiLock):
5499         * runtime/JSGlobalObject.cpp:
5500         (JSC::JSGlobalObject::~JSGlobalObject):
5501         (JSC::JSGlobalObject::init):
5502         * runtime/JSLock.cpp:
5503         (JSC):
5504         (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance.
5505         (JSC::GlobalJSLock::~GlobalJSLock):
5506         (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that
5507         it can successfully unlock it later without it disappearing from underneath it.
5508         (JSC::JSLockHolder::~JSLockHolder):
5509         (JSC::JSLock::JSLock):
5510         (JSC::JSLock::~JSLock):
5511         (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for
5512         actually waiting for long periods.
5513         (JSC::JSLock::unlock):
5514         (JSC::JSLock::currentThreadIsHoldingLock):
5515         (JSC::JSLock::dropAllLocks):
5516         (JSC::JSLock::dropAllLocksUnconditionally):
5517         (JSC::JSLock::grabAllLocks):
5518         (JSC::JSLock::DropAllLocks::DropAllLocks):
5519         (JSC::JSLock::DropAllLocks::~DropAllLocks):
5520         * runtime/JSLock.h:
5521         (JSC):
5522         (GlobalJSLock):
5523         (JSLockHolder):
5524         (JSLock):
5525         (DropAllLocks):
5526         * runtime/WeakGCMap.h:
5527         (JSC::WeakGCMap::set):
5528         * testRegExp.cpp:
5529         (realMain):
5530
5531 2012-06-22  Peter Beverloo  <peter@chromium.org>
5532
5533         [Chromium] Disable c++0x compatibility warnings in JavaScriptCore.gyp when building for Android
5534         https://bugs.webkit.org/show_bug.cgi?id=88853
5535
5536         Reviewed by Steve Block.
5537
5538         The Android exclusions were necessary to fix a gyp generation error, as
5539         the gcc_version variable wasn't being defined for Android. Remove these
5540         exceptions when Chromium is able to define the gcc_version variable.
5541
5542         * JavaScriptCore.gyp/JavaScriptCore.gyp:
5543
5544 2012-06-21  Filip Pizlo  <fpizlo@apple.com>
5545
5546         op_resolve_global should not prevent DFG inlining
5547         https://bugs.webkit.org/show_bug.cgi?id=89726
5548
5549         Reviewed by Gavin Barraclough.
5550
5551         * bytecode/CodeBlock.cpp:
5552         (JSC::CodeBlock::CodeBlock):
5553         (JSC::CodeBlock::shrinkToFit):
5554         * bytecode/GlobalResolveInfo.h:
5555         (JSC::GlobalResolveInfo::GlobalResolveInfo):
5556         (GlobalResolveInfo):
5557         * dfg/DFGByteCodeParser.cpp:
5558         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
5559         * dfg/DFGCapabilities.h:
5560         (JSC::DFG::canInlineOpcode):
5561         * dfg/DFGOperations.cpp:
5562         * dfg/DFGOperations.h:
5563         * dfg/DFGSpeculativeJIT.h:
5564         (JSC::DFG::SpeculativeJIT::callOperation):
5565         * dfg/DFGSpeculativeJIT32_64.cpp:
5566         (JSC::DFG::SpeculativeJIT::compile):
5567         * dfg/DFGSpeculativeJIT64.cpp:
5568         (JSC::DFG::SpeculativeJIT::compile):
5569
5570 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5571
5572         DFG should inline 'new Array()'
5573         https://bugs.webkit.org/show_bug.cgi?id=89632
5574
5575         Reviewed by Geoffrey Garen.
5576
5577         This adds support for treating InternalFunction like intrinsics. The code
5578         to do so is actually quite clean, so I don't feel bad about perpetuating
5579         the InternalFunction vs. JSFunction-with-NativeExecutable dichotomy.
5580
5581         Currently this newfound power is only used to inline 'new Array()'.
5582
5583         * dfg/DFGByteCodeParser.cpp:
5584         (ByteCodeParser):
5585         (JSC::DFG::ByteCodeParser::handleCall):
5586         (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
5587         (DFG):
5588         * dfg/DFGGraph.h:
5589         (JSC::DFG::Graph::isInternalFunctionConstant):
5590         (JSC::DFG::Graph::valueOfInternalFunctionConstant):
5591
5592 2012-06-21  Mark Hahnenberg  <mhahnenberg@apple.com>
5593
5594         Adding copyrights to new files.
5595
5596         * heap/HeapTimer.cpp:
5597         * heap/HeapTimer.h:
5598         * heap/IncrementalSweeper.cpp:
5599         * heap/IncrementalSweeper.h:
5600
5601 2012-06-21  Arnaud Renevier  <arno@renevier.net>
5602
5603         make sure headers are included only once per file
5604         https://bugs.webkit.org/show_bug.cgi?id=88922
5605
5606         Reviewed by Alexey Proskuryakov.
5607
5608         * bytecode/CodeBlock.h:
5609         * heap/MachineStackMarker.cpp:
5610         * runtime/JSVariableObject.h:
5611
5612 2012-06-21  Ryuan Choi  <ryuan.choi@gmail.com>
5613
5614         [EFL][WK2] Make WebKit2/Efl headers and resources installable.
5615         https://bugs.webkit.org/show_bug.cgi?id=88207
5616
5617         Reviewed by Chang Shu.
5618
5619         * shell/CMakeLists.txt: Use ${EXEC_INSTALL_DIR} instead of hardcoding "bin"
5620
5621 2012-06-20  Geoffrey Garen  <ggaren@apple.com>
5622
5623         Reduced (but did not eliminate) use of "berzerker GC"
5624         https://bugs.webkit.org/show_bug.cgi?id=89237
5625
5626         Reviewed by Gavin Barraclough.
5627
5628         (PART 1)
5629
5630         This patch turned out to be crashy, so I'm landing the non-crashy bits
5631         first.
5632
5633         This part is pre-requisite refactoring. I didn't actually turn off
5634         "berzerker GC" or turn on incremental shrinking.
5635
5636         * heap/MarkedAllocator.cpp:
5637         (JSC::MarkedAllocator::removeBlock): Make sure to clear the free list when
5638         we throw away the block we're currently allocating out of. Otherwise, we'll
5639         allocate out of a stale free list.
5640
5641         * heap/MarkedSpace.cpp:
5642         (JSC::Free::Free):
5643         (JSC::Free::operator()):
5644         (JSC::Free::returnValue): Refactored this functor to use a shared helper
5645         function, so we can share our implementation with the incremental sweeper.
5646
5647         Also changed to freeing individual blocks immediately instead of linking
5648         them into a list for later freeing. This makes the programming interface
5649         simpler, and it's slightly more efficient to boot.
5650
5651         (JSC::MarkedSpace::~MarkedSpace): Updated for rename.
5652
5653         (JSC::MarkedSpace::freeBlock):
5654         (JSC::MarkedSpace::freeOrShrinkBlock): New helper functions to share behavior
5655         with the incremental sweeper.
5656
5657         (JSC::MarkedSpace::shrink): Updated for new functor behavior.
5658
5659         * heap/MarkedSpace.h: Statically typed languages are awesome.
5660
5661 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5662
5663         DFG should optimize ResolveGlobal
5664         https://bugs.webkit.org/show_bug.cgi?id=89617
5665
5666         Reviewed by Oliver Hunt.
5667
5668         This adds inlining of ResolveGlobal accesses that are known monomorphic. It also
5669         adds the specific function optimization to ResolveGlobal, when it is inlined. And,
5670         it makes internal functions act like specific functions, since that will be the
5671         most common use-case of this optimization.
5672
5673         This is only a slighy speed-up (sub 1%), since we don't yet do the obvious thing
5674         with this optimization, which is to completely inline common "globally resolved"
5675         function and constructor calls, like "new Array()".
5676
5677         * CMakeLists.txt:
5678         * GNUmakefile.list.am:
5679         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
5680         * JavaScriptCore.xcodeproj/project.pbxproj:
5681         * Target.pri:
5682         * bytecode/CodeBlock.cpp:
5683         (JSC::CodeBlock::globalResolveInfoForBytecodeOffset):
5684         * bytecode/CodeBlock.h:
5685         (CodeBlock):
5686         (JSC::CodeBlock::numberOfGlobalResolveInfos):
5687         * bytecode/GlobalResolveInfo.h:
5688         (JSC::getGlobalResolveInfoBytecodeOffset):
5689         (JSC):
5690         * bytecode/ResolveGlobalStatus.cpp: Added.
5691         (JSC):
5692         (JSC::computeForStructure):
5693         (JSC::computeForLLInt):
5694         (JSC::ResolveGlobalStatus::computeFor):
5695         * bytecode/ResolveGlobalStatus.h: Added.
5696         (JSC):
5697         (ResolveGlobalStatus):
5698         (JSC::ResolveGlobalStatus::ResolveGlobalStatus):
5699         (JSC::ResolveGlobalStatus::state):
5700         (JSC::ResolveGlobalStatus::isSet):
5701         (JSC::ResolveGlobalStatus::operator!):
5702         (JSC::ResolveGlobalStatus::isSimple):
5703         (JSC::ResolveGlobalStatus::takesSlowPath):
5704         (JSC::ResolveGlobalStatus::structure):
5705         (JSC::ResolveGlobalStatus::offset):
5706         (JSC::ResolveGlobalStatus::specificValue):
5707         * dfg/DFGByteCodeParser.cpp:
5708         (ByteCodeParser):
5709         (JSC::DFG::ByteCodeParser::handleGetByOffset):
5710         (DFG):
5711         (JSC::DFG::ByteCodeParser::handleGetById):
5712         (JSC::DFG::ByteCodeParser::parseBlock):
5713         * runtime/JSObject.cpp:
5714         (JSC::getCallableObjectSlow):
5715         (JSC):
5716         (JSC::JSObject::put):
5717         (JSC::JSObject::putDirectVirtual):
5718         (JSC::JSObject::putDirectAccessor):
5719         * runtime/JSObject.h:
5720         (JSC):
5721         (JSC::getCallableObject):
5722         (JSC::JSObject::putOwnDataProperty):
5723         (JSC::JSObject::putDirect):
5724         (JSC::JSObject::putDirectWithoutTransition):
5725
5726 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5727
5728         Functions on global objects should be specializable
5729         https://bugs.webkit.org/show_bug.cgi?id=89615
5730
5731         Reviewed by Oliver Hunt.
5732
5733         I tested to see if this brought back the bug in https://bugs.webkit.org/show_bug.cgi?id=33343,
5734         and it didn't. Bug 33343 was the reason why we disabled global object function specialization
5735         to begin with. So I'm guessing this is safe.
5736
5737         * runtime/JSGlobalObject.cpp:
5738         (JSC::JSGlobalObject::init):
5739
5740 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5741
5742         build-webkit failure due to illegal 32-bit integer constants in code
5743         generated by offlineasm
5744         https://bugs.webkit.org/show_bug.cgi?id=89347
5745
5746         Reviewed by Geoffrey Garen.
5747
5748         The offending constants are the magic numbers used by offlineasm to find
5749         offsets in the generated machine code. Added code to turn them into what
5750         the C++ compiler will believe to be valid 32-bit values.
5751
5752         * offlineasm/offsets.rb:
5753
5754 2012-06-19  Geoffrey Garen  <ggaren@apple.com>
5755
5756         Made the incremental sweeper more aggressive
5757         https://bugs.webkit.org/show_bug.cgi?id=89527
5758
5759         Reviewed by Oliver Hunt.
5760
5761         This is a pre-requisite to getting rid of "berzerker GC" because we need
5762         the sweeper to reclaim memory in a timely fashion, or we'll see a memory
5763         footprint regression.
5764
5765         * heap/IncrementalSweeper.h:
5766         * heap/IncrementalSweeper.cpp:
5767         (JSC::IncrementalSweeper::scheduleTimer): Since the time slice is predictable,
5768         no need to use a data member to record it.
5769
5770         (JSC::IncrementalSweeper::doSweep): Sweep as many blocks as we can in a
5771         small time slice. This is better than sweeping only one block per timer
5772         fire because that strategy has a heavy timer overhead, and artificially
5773         delays memory reclamation.
5774
5775 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5776
5777         DFG should be able to print disassembly interleaved with the IR
5778         https://bugs.webkit.org/show_bug.cgi?id=89551
5779
5780         Reviewed by Geoffrey Garen.
5781
5782         This change also removes running Dominators unconditionally on every DFG
5783         compile. Dominators are designed to be computed on-demand, and currently
5784         the only demand is graph dumps.
5785
5786         * CMakeLists.txt:
5787         * GNUmakefile.list.am:
5788         * JavaScriptCore.xcodeproj/project.pbxproj:
5789         * Target.pri:
5790         * assembler/ARMv7Assembler.h:
5791         (JSC::ARMv7Assembler::labelIgnoringWatchpoints):
5792         (ARMv7Assembler):
5793         * assembler/AbstractMacroAssembler.h:
5794         (AbstractMacroAssembler):
5795         (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints):
5796         * assembler/X86Assembler.h:
5797         (X86Assembler):
5798         (JSC::X86Assembler::labelIgnoringWatchpoints):
5799         * dfg/DFGCommon.h:
5800         (JSC::DFG::shouldShowDisassembly):
5801         (DFG):
5802         * dfg/DFGDisassembler.cpp: Added.
5803         (DFG):
5804         (JSC::DFG::Disassembler::Disassembler):
5805         (JSC::DFG::Disassembler::dump):
5806         (JSC::DFG::Disassembler::dumpDisassembly):
5807         * dfg/DFGDisassembler.h: Added.
5808         (DFG):
5809         (Disassembler):
5810         (JSC::DFG::Disassembler::setStartOfCode):
5811         (JSC::DFG::Disassembler::setForBlock):
5812         (JSC::DFG::Disassembler::setForNode):
5813         (JSC::DFG::Disassembler::setEndOfMainPath):
5814         (JSC::DFG::Disassembler::setEndOfCode):
5815         * dfg/DFGDriver.cpp:
5816         (JSC::DFG::compile):
5817         * dfg/DFGGraph.cpp:
5818         (JSC::DFG::Graph::dumpCodeOrigin):
5819         (JSC::DFG::Graph::amountOfNodeWhiteSpace):
5820         (DFG):
5821         (JSC::DFG::Graph::printNodeWhiteSpace):
5822         (JSC::DFG::Graph::dump):
5823         (JSC::DFG::Graph::dumpBlockHeader):
5824         * dfg/DFGGraph.h:
5825         * dfg/DFGJITCompiler.cpp:
5826         (JSC::DFG::JITCompiler::JITCompiler):
5827         (DFG):
5828         (JSC::DFG::JITCompiler::compile):
5829         (JSC::DFG::JITCompiler::compileFunction):
5830         * dfg/DFGJITCompiler.h:
5831         (JITCompiler):
5832         (JSC::DFG::JITCompiler::setStartOfCode):
5833         (JSC::DFG::JITCompiler::setForBlock):
5834         (JSC::DFG::JITCompiler::setForNode):
5835         (JSC::DFG::JITCompiler::setEndOfMainPath):
5836         (JSC::DFG::JITCompiler::setEndOfCode):
5837         * dfg/DFGNode.h:
5838         (Node):
5839         (JSC::DFG::Node::willHaveCodeGen):
5840         * dfg/DFGNodeFlags.cpp:
5841         (JSC::DFG::nodeFlagsAsString):
5842         * dfg/DFGSpeculativeJIT.cpp:
5843         (JSC::DFG::SpeculativeJIT::compile):
5844         * dfg/DFGSpeculativeJIT.h:
5845         (SpeculativeJIT):
5846         * runtime/Options.cpp:
5847         (Options):
5848         (JSC::Options::initializeOptions):
5849         * runtime/Options.h:
5850         (Options):
5851
5852 2012-06-19  Filip Pizlo  <fpizlo@apple.com>
5853
5854         JSC should be able to show disassembly for all generated JIT code
5855         https://bugs.webkit.org/show_bug.cgi?id=89536
5856
5857         Reviewed by Gavin Barraclough.
5858
5859         Now instead of doing linkBuffer.finalizeCode(), you do
5860         FINALIZE_CODE(linkBuffer, (... explanation ...)). FINALIZE_CODE() then
5861         prints your explanation and the disassembled code, if
5862         Options::showDisassembly is set to true.
5863
5864         * CMakeLists.txt:
5865         * GNUmakefile.list.am:
5866         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
5867         * JavaScriptCore.xcodeproj/project.pbxproj:
5868         * Target.pri:
5869         * assembler/LinkBuffer.cpp: Added.
5870         (JSC):
5871         (JSC::LinkBuffer::finalizeCodeWithoutDisassembly):
5872         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
5873         (JSC::LinkBuffer::linkCode):
5874         (JSC::LinkBuffer::performFinalization):
5875         (JSC::LinkBuffer::dumpLinkStatistics):
5876         (JSC::LinkBuffer::dumpCode):
5877         * assembler/LinkBuffer.h:
5878         (LinkBuffer):
5879         (JSC):
5880         * assembler/MacroAssemblerCodeRef.h:
5881         (JSC::MacroAssemblerCodeRef::tryToDisassemble):
5882         (MacroAssemblerCodeRef):
5883         * dfg/DFGJITCompiler.cpp:
5884         (JSC::DFG::JITCompiler::compile):
5885         (JSC::DFG::JITCompiler::compileFunction):
5886         * dfg/DFGOSRExitCompiler.cpp:
5887         * dfg/DFGRepatch.cpp:
5888         (JSC::DFG::generateProtoChainAccessStub):
5889         (JSC::DFG::tryCacheGetByID):
5890         (JSC::DFG::tryBuildGetByIDList):
5891         (JSC::DFG::emitPutReplaceStub):
5892         (JSC::DFG::emitPutTransitionStub):
5893         * dfg/DFGThunks.cpp:
5894         (JSC::DFG::osrExitGenerationThunkGenerator):
5895         * disassembler/Disassembler.h:
5896         (JSC):
5897         (JSC::tryToDisassemble):
5898         * disassembler/UDis86Disassembler.cpp:
5899         (JSC::tryToDisassemble):
5900         * jit/JIT.cpp:
5901         (JSC::JIT::privateCompile):
5902         * jit/JITCode.h:
5903         (JSC::JITCode::tryToDisassemble):
5904         * jit/JITOpcodes.cpp:
5905         (JSC::JIT::privateCompileCTIMachineTrampolines):
5906         * jit/JITOpcodes32_64.cpp:
5907         (JSC::JIT::privateCompileCTIMachineTrampolines):
5908         (JSC::JIT::privateCompileCTINativeCall):
5909         * jit/JITPropertyAccess.cpp:
5910         (JSC::JIT::stringGetByValStubGenerator):
5911         (JSC::JIT::privateCompilePutByIdTransition):
5912         (JSC::JIT::privateCompilePatchGetArrayLength):
5913         (JSC::JIT::privateCompileGetByIdProto):
5914         (JSC::JIT::privateCompileGetByIdSelfList):
5915         (JSC::JIT::privateCompileGetByIdProtoList):
5916         (JSC::JIT::privateCompileGetByIdChainList):
5917         (JSC::JIT::privateCompileGetByIdChain):
5918         * jit/JITPropertyAccess32_64.cpp:
5919         (JSC::JIT::stringGetByValStubGenerator):
5920         (JSC::JIT::privateCompilePutByIdTransition):
5921         (JSC::JIT::privateCompilePatchGetArrayLength):
5922         (JSC::JIT::privateCompileGetByIdProto):
5923         (JSC::JIT::privateCompileGetByIdSelfList):
5924         (JSC::JIT::privateCompileGetByIdProtoList):
5925         (JSC::JIT::privateCompileGetByIdChainList):
5926         (JSC::JIT::privateCompileGetByIdChain):
5927         * jit/SpecializedThunkJIT.h:
5928         (JSC::SpecializedThunkJIT::finalize):
5929         * jit/ThunkGenerators.cpp:
5930         (JSC::charCodeAtThunkGenerator):
5931         (JSC::charAtThunkGenerator):
5932         (JSC::fromCharCodeThunkGenerator):
5933         (JSC::sqrtThunkGenerator):
5934         (JSC::floorThunkGenerator):
5935         (JSC::ceilThunkGenerator):
5936         (JSC::roundThunkGenerator):
5937         (JSC::expThunkGenerator):
5938         (JSC::logThunkGenerator):
5939         (JSC::absThunkGenerator):
5940         (JSC::powThunkGenerator):
5941         * llint/LLIntThunks.cpp:
5942         (JSC::LLInt::generateThunkWithJumpTo):
5943         (JSC::LLInt::functionForCallEntryThunkGenerator):
5944         (JSC::LLInt::functionForConstructEntryThunkGenerator):
5945         (JSC::LLInt::functionForCallArityCheckThunkGenerator):
5946         (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
5947         (JSC::LLInt::evalEntryThunkGenerator):
5948         (JSC::LLInt::programEntryThunkGenerator):
5949         * runtime/Options.cpp:
5950         (Options):
5951         (JSC::Options::initializeOptions):
5952         * runtime/Options.h:
5953         (Options):
5954         * yarr/YarrJIT.cpp:
5955         (JSC::Yarr::YarrGenerator::compile):
5956
5957 2012-06-19  Mark Hahnenberg  <mhahnenberg@apple.com>
5958
5959         [Qt][Mac] REGRESSION(r120742): It broke the build
5960         https://bugs.webkit.org/show_bug.cgi?id=89516
5961
5962         Reviewed by Geoffrey Garen.
5963
5964         Removing GCActivityCallbackCF.cpp because it doesn't mesh well with cross-platform
5965         code on Darwin (e.g. Qt). We now use plain ol' vanilla ifdefs to handle platforms
5966         without CF support. These if-defs will probably disappear in the future when we
5967         use cross-platform timers in HeapTimer.
5968
5969         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
5970         * JavaScriptCore.xcodeproj/project.pbxproj:
5971         * runtime/GCActivityCallback.cpp:
5972         (JSC):
5973         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
5974         (JSC::DefaultGCActivityCallback::doWork):
5975         (JSC::DefaultGCActivityCallback::scheduleTimer):
5976         (JSC::DefaultGCActivityCallback::cancelTimer):
5977         (JSC::DefaultGCActivityCallback::didAllocate):
5978         (JSC::DefaultGCActivityCallback::willCollect):
5979         (JSC::DefaultGCActivityCallback::cancel):
5980         * runtime/GCActivityCallbackCF.cpp: Removed.
5981
5982 2012-06-19  Filip Pizlo  <fpizlo@apple.com>
5983
5984         DFG CFA forgets to notify subsequent phases of found constants if it proves LogicalNot to be a constant
5985         https://bugs.webkit.org/show_bug.cgi?id=89511
5986         <rdar://problem/11700089>
5987
5988         Reviewed by Geoffrey Garen.
5989
5990         * dfg/DFGAbstractState.cpp:
5991         (JSC::DFG::AbstractState::execute):
5992
5993 2012-06-19  Mark Lam  <mark.lam@apple.com>
5994
5995         CodeBlock::needsCallReturnIndices() is no longer needed.
5996         https://bugs.webkit.org/show_bug.cgi?id=89490
5997
5998         Reviewed by Geoffrey Garen.
5999
6000         * bytecode/CodeBlock.h:
6001         (JSC::CodeBlock::needsCallReturnIndices): removed.
6002         * dfg/DFGJITCompiler.cpp:
6003         (JSC::DFG::JITCompiler::link):
6004         * jit/JIT.cpp:
6005         (JSC::JIT::privateCompile):
6006
6007 2012-06-19  Filip Pizlo  <fpizlo@apple.com>
6008
6009         Unreviewed, try to fix Windows build.
6010
6011         * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
6012
6013 2012-06-17  Filip Pizlo  <fpizlo@apple.com>
6014
6015         It should be possible to look at disassembly
6016         https://bugs.webkit.org/show_bug.cgi?id=89319
6017
6018         Reviewed by Sam Weinig.
6019
6020         This imports the udis86 disassembler library. The library is placed
6021         behind an abstraction in disassembler/Disassembler.h, so that we can
6022         in the future use other disassemblers (for other platforms) whenever
6023         appropriate. As a first step, the disassembler is being invoked for
6024         DFG verbose dumps.
6025
6026         If we ever want to merge a new version of udis86 in the future, I've
6027         made notes about changes I made to the library in
6028         disassembler/udis86/differences.txt.
6029
6030         * CMakeLists.txt:
6031         * DerivedSources.make:
6032         * GNUmakefile.list.am:
6033         * JavaScriptCore.pri:
6034         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6035         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
6036         * JavaScriptCore.xcodeproj/project.pbxproj:
6037         * dfg/DFGJITCompiler.cpp:
6038         (JSC::DFG::JITCompiler::compile):
6039         (JSC::DFG::JITCompiler::compileFunction):
6040         * disassembler: Added.
6041         * disassembler/Disassembler.h: Added.
6042         (JSC):
6043         (JSC::tryToDisassemble):
6044         * disassembler/UDis86Disassembler.cpp: Added.
6045         (JSC):
6046         (JSC::tryToDisassemble):
6047         * disassembler/udis86: Added.
6048         * disassembler/udis86/differences.txt: Added.
6049         * disassembler/udis86/itab.py: Added.
6050         (UdItabGenerator):
6051         (UdItabGenerator.__init__):
6052         (UdItabGenerator.toGroupId):
6053         (UdItabGenerator.genLookupTable):
6054         (UdItabGenerator.genLookupTableList):
6055         (UdItabGenerator.genInsnTable):
6056         (genItabH):
6057         (genItabH.UD_ITAB_H):
6058         (genItabC):
6059         (genItab):
6060         (main):
6061         * disassembler/udis86/optable.xml: Added.
6062         * disassembler/udis86/ud_opcode.py: Added.
6063         (UdOpcodeTables):
6064         (UdOpcodeTables.sizeOfTable):
6065         (UdOpcodeTables.nameOfTable):
6066         (UdOpcodeTables.updateTable):
6067         (UdOpcodeTables.Insn):
6068         (UdOpcodeTables.Insn.__init__):
6069         (UdOpcodeTables.Insn.__init__.opcode):
6070         (UdOpcodeTables.parse):
6071         (UdOpcodeTables.addInsnDef):
6072         (UdOpcodeTables.print_table):
6073         (UdOpcodeTables.print_tree):
6074         * disassembler/udis86/ud_optable.py: Added.
6075         (UdOptableXmlParser):
6076         (UdOptableXmlParser.parseDef):
6077         (UdOptableXmlParser.parse):
6078         (printFn):
6079         (parse):
6080         (main):
6081         * disassembler/udis86/udis86.c: Added.
6082         (ud_init):
6083         (ud_disassemble):
6084         (ud_set_mode):
6085         (ud_set_vendor):
6086         (ud_set_pc):
6087         (ud):
6088         (ud_insn_asm):
6089         (ud_insn_off):
6090         (ud_insn_hex):
6091         (ud_insn_ptr):
6092         (ud_insn_len):
6093         * disassembler/udis86/udis86.h: Added.
6094         * disassembler/udis86/udis86_decode.c: Added.
6095         (eff_adr_mode):
6096         (ud_lookup_mnemonic):
6097         (decode_prefixes):
6098         (modrm):
6099         (resolve_operand_size):
6100         (resolve_mnemonic):
6101         (decode_a):
6102         (decode_gpr):
6103         (resolve_gpr64):
6104         (resolve_gpr32):
6105         (resolve_reg):
6106         (decode_imm):
6107         (decode_modrm_reg):
6108         (decode_modrm_rm):
6109         (decode_o):
6110         (decode_operand):
6111         (decode_operands):
6112         (clear_insn):
6113         (resolve_mode):
6114         (gen_hex):
6115         (decode_insn):
6116         (decode_3dnow):
6117         (decode_ssepfx):
6118         (decode_ext):
6119         (decode_opcode):
6120         (ud_decode):
6121         * disassembler/udis86/udis86_decode.h: Added.
6122         (ud_itab_entry_operand):
6123         (ud_itab_entry):
6124         (ud_lookup_table_list_entry):
6125         (sse_pfx_idx):
6126         (mode_idx):
6127         (modrm_mod_idx):
6128         (vendor_idx):
6129         (is_group_ptr):
6130         (group_idx):
6131         * disassembler/udis86/udis86_extern.h: Added.
6132         * disassembler/udis86/udis86_input.c: Added.
6133         (inp_buff_hook):
6134         (inp_file_hook):
6135         (ud):
6136         (ud_set_user_opaque_data):
6137         (ud_get_user_opaque_data):
6138         (ud_set_input_buffer):
6139         (ud_set_input_file):
6140         (ud_input_skip):
6141         (ud_input_end):
6142         (ud_inp_next):
6143         (ud_inp_back):
6144         (ud_inp_peek):
6145         (ud_inp_move):
6146         (ud_inp_uint8):
6147         (ud_inp_uint16):
6148         (ud_inp_uint32):
6149         (ud_inp_uint64):
6150         * disassembler/udis86/udis86_input.h: Added.
6151         * disassembler/udis86/udis86_itab_holder.c: Added.
6152         * disassembler/udis86/udis86_syn-att.c: Added.
6153         (opr_cast):
6154         (gen_operand):
6155         (ud_translate_att):
6156         * disassembler/udis86/udis86_syn-intel.c: Added.
6157         (opr_cast):
6158         (gen_operand):
6159         (ud_translate_intel):
6160         * disassembler/udis86/udis86_syn.c: Added.
6161         * disassembler/udis86/udis86_syn.h: Added.
6162         (mkasm):
6163         * disassembler/udis86/udis86_types.h: Added.
6164         (ud_operand):
6165         (ud):
6166         * jit/JITCode.h:
6167         (JITCode):
6168         (JSC::JITCode::tryToDisassemble):
6169
6170 2012-06-19  Mark Hahnenberg  <mhahnenberg@apple.com>
6171
6172         GCActivityCallback and IncrementalSweeper should share code
6173         https://bugs.webkit.org/show_bug.cgi?id=89400
6174
6175         Reviewed by Geoffrey Garen.
6176
6177         A lot of functionality is duplicated between GCActivityCallback and IncrementalSweeper.
6178         We should extract the common functionality out into a separate class that both of them
6179         can inherit from. This refactoring will be an even greater boon when we add the ability
6180         to shut these two agents down in a thread-safe fashion
6181
6182         * CMakeLists.txt:
6183         * GNUmakefile.list.am:
6184         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6185         * JavaScriptCore.xcodeproj/project.pbxproj:
6186         * Target.pri:
6187         * heap/Heap.cpp:
6188         (JSC::Heap::Heap): Move initialization down so that the JSGlobalData has a valid Heap when
6189         we're initializing the GCActivityCallback and the IncrementalSweeper.
6190         * heap/Heap.h:
6191         (Heap):
6192         * heap/HeapTimer.cpp: Added.
6193         (JSC):
6194         (JSC::HeapTimer::HeapTimer): Initialize the various base class data that
6195         DefaultGCActivityCallback::commonConstructor() used to do.
6196         (JSC::HeapTimer::~HeapTimer): Call to invalidate().
6197         (JSC::HeapTimer::synchronize): Same functionality as the old DefaultGCActivityCallback::synchronize().
6198         Virtual so that non-CF subclasses can override.
6199         (JSC::HeapTimer::invalidate): Tears down the runloop timer to prevent any future firing.
6200         (JSC::HeapTimer::timerDidFire): Callback to pass to the timer function. Casts and calls the virtual doWork().
6201         * heap/HeapTimer.h: Added. This is the class that serves as the common base class for
6202         both GCActivityCallback and IncrementalSweeper. It handles setting up and tearing down run loops and synchronizing
6203         across threads for its subclasses.
6204         (JSC):
6205         (HeapTimer):
6206         * heap/IncrementalSweeper.cpp: Changes to accomodate the extraction of common functionality
6207         between IncrementalSweeper and GCActivityCallback into a common ancestor.
6208         (JSC):
6209         (JSC::IncrementalSweeper::doWork):
6210         (JSC::IncrementalSweeper::IncrementalSweeper):
6211         (JSC::IncrementalSweeper::cancelTimer):
6212         (JSC::IncrementalSweeper::create):
6213         * heap/IncrementalSweeper.h:
6214         (IncrementalSweeper):
6215         * runtime/GCActivityCallback.cpp:
6216         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
6217         (JSC::DefaultGCActivityCallback::doWork):
6218         * runtime/GCActivityCallback.h:
6219         (GCActivityCallback):
6220         (JSC::GCActivityCallback::willCollect):
6221         (JSC::GCActivityCallback::GCActivityCallback):
6222         (JSC):
6223         (DefaultGCActivityCallback): Remove the platform data struct. The platform data should be kept in
6224         the class itself so as to be accessible by doWork(). Most of the platform data for CF is kept in
6225         HeapTimer anyways, so we only need the m_delay field now.
6226         * runtime/GCActivityCallbackBlackBerry.cpp:
6227         (JSC):
6228         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
6229         (JSC::DefaultGCActivityCallback::doWork):
6230         (JSC::DefaultGCActivityCallback::didAllocate):
6231         * runtime/GCActivityCallbackCF.cpp:
6232         (JSC):
6233         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
6234         (JSC::DefaultGCActivityCallback::doWork):
6235         (JSC::DefaultGCActivityCallback::scheduleTimer):
6236         (JSC::DefaultGCActivityCallback::cancelTimer):
6237         (JSC::DefaultGCActivityCallback::didAllocate):
6238         (JSC::DefaultGCActivityCallback::willCollect):
6239         (JSC::DefaultGCActivityCallback::cancel):
6240
6241
6242 2012-06-19  Mike West  <mkwst@chromium.org>
6243
6244         Introduce ENABLE_CSP_NEXT configuration flag.
6245         https://bugs.webkit.org/show_bug.cgi?id=89300
6246
6247         Reviewed by Adam Barth.
6248
6249         The 1.0 draft of the Content Security Policy spec is just about to
6250         move to Last Call. We'll hide work on the upcoming 1.1 spec behind
6251         this ENABLE flag, disabled by default.
6252
6253         Spec: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html
6254
6255         * Configurations/FeatureDefines.xcconfig:
6256
6257 2012-06-18  Mark Lam  <mark.lam@apple.com>
6258
6259         Changed JSC to always record line number information so that error.stack
6260         and window.onerror() can report proper line numbers.
6261         https://bugs.webkit.org/show_bug.cgi?id=89410
6262
6263         Reviewed by Geoffrey Garen.
6264
6265         * bytecode/CodeBlock.cpp:
6266         (JSC::CodeBlock::CodeBlock):
6267         (JSC::CodeBlock::lineNumberForBytecodeOffset):
6268         (JSC::CodeBlock::shrinkToFit): m_lineInfo is now available unconditionally.
6269
6270         * bytecode/CodeBlock.h:
6271         (JSC::CodeBlock::addLineInfo):
6272         (JSC::CodeBlock::hasLineInfo): Unused.  Now removed.
6273         (JSC::CodeBlock::needsCallReturnIndices):
6274         (CodeBlock):
6275         (RareData):  Hoisted m_lineInfo out of m_rareData.  m_lineInfo is now
6276         filled in unconditionally.
6277
6278         * bytecompiler/BytecodeGenerator.h:
6279         (JSC::BytecodeGenerator::addLineInfo):
6280
6281 2012-06-18  Andy Estes  <aestes@apple.com>
6282
6283         Fix r120663, which didn't land the change that was reviewed.
6284
6285 2012-06-18  Andy Estes  <aestes@apple.com>
6286
6287         [JSC] In JSGlobalData.cpp, enableAssembler() sometimes leaks two CF objects
6288         https://bugs.webkit.org/show_bug.cgi?id=89415
6289
6290         Reviewed by Sam Weinig.
6291
6292         In the case where canUseJIT was a non-NULL CFBooleanRef,
6293         enableAssembler() would leak both canUseJITKey and canUseJIT by
6294         returning before calling CFRelease. Fix this by using RetainPtr.
6295
6296         * runtime/JSGlobalData.cpp:
6297         (JSC::enableAssembler):
6298
6299 2012-06-17  Geoffrey Garen  <ggaren@apple.com>
6300
6301         GC copy phase spends needless cycles zero-filling blocks
6302         https://bugs.webkit.org/show_bug.cgi?id=89128
6303
6304         Reviewed by Gavin Barraclough.
6305
6306         We only need to zero-fill when we're allocating memory that might not
6307         get fully initialized before GC.
6308
6309         * heap/CopiedBlock.h:
6310         (JSC::CopiedBlock::createNoZeroFill):
6311         (JSC::CopiedBlock::create): Added a way to create without zero-filling.
6312         This is our optimization.
6313
6314         (JSC::CopiedBlock::zeroFillToEnd):
6315         (JSC::CopiedBlock::CopiedBlock): Split zero-filling out from creation,
6316         so we can sometimes create without zero-filling.
6317
6318         * heap/CopiedSpace.cpp:
6319         (JSC::CopiedSpace::init):
6320         (JSC::CopiedSpace::tryAllocateSlowCase):
6321         (JSC::CopiedSpace::doneCopying): Renamed addNewBlock to allocateBlock()
6322         to clarify that the new block is always newly-allocated.
6323
6324         (JSC::CopiedSpace::doneFillingBlock): Make sure to zero-fill to the end
6325         of a block that might be used in the future for allocation. (Most of the
6326         time, this is a no-op, since we've already filled the block completely.)
6327
6328         (JSC::CopiedSpace::getFreshBlock): Removed this function because the
6329         abstraction of "allocation must succeed" is no longer useful.
6330
6331         * heap/CopiedSpace.h: Updated declarations to match.
6332
6333         * heap/CopiedSpaceInlineMethods.h:
6334         (JSC::CopiedSpace::allocateBlockForCopyingPhase): New function, which
6335         knows that it can skip zero-filling.
6336
6337         Added tighter scoping to our lock, to improve parallelism.
6338
6339         (JSC::CopiedSpace::allocateBlock): Folded getFreshBlock functionality
6340         into this function, for simplicity.
6341
6342         * heap/MarkStack.cpp:
6343         (JSC::SlotVisitor::startCopying):
6344         (JSC::SlotVisitor::allocateNewSpace): Use our new zero-fill-free helper
6345         function for great good.
6346
6347 2012-06-17  Filip Pizlo  <fpizlo@apple.com>
6348
6349         DFG should attempt to use structure watchpoints for all inlined get_by_id's and put_by_id's
6350         https://bugs.webkit.org/show_bug.cgi?id=89316
6351
6352         Reviewed by Oliver Hunt.
6353
6354         * dfg/DFGByteCodeParser.cpp:
6355         (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
6356         (ByteCodeParser):
6357         (JSC::DFG::ByteCodeParser::handleGetById):
6358         (JSC::DFG::ByteCodeParser::parseBlock):
6359
6360 2012-06-15  Yong Li  <yoli@rim.com>
6361
6362         [BlackBerry] Put platform-specific GC policy in GCActivityCallback
6363         https://bugs.webkit.org/show_bug.cgi?id=89236
6364
6365         Reviewed by Rob Buis.
6366
6367         Add GCActivityCallbackBlackBerry.cpp and implement platform-specific
6368         low memory GC policy there.
6369
6370         * PlatformBlackBerry.cmake:
6371         * heap/Heap.h:
6372         (JSC::Heap::isSafeToCollect): Added.
6373         * runtime/GCActivityCallbackBlackBerry.cpp: Added.
6374         (JSC):
6375         (JSC::DefaultGCActivityCallbackPlatformData::DefaultGCActivityCallbackPlatformData):
6376         (DefaultGCActivityCallbackPlatformData):
6377         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
6378         (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
6379         (JSC::DefaultGCActivityCallback::didAllocate):
6380         (JSC::DefaultGCActivityCallback::willCollect):
6381         (JSC::DefaultGCActivityCallback::synchronize):
6382         (JSC::DefaultGCActivityCallback::cancel):
6383
6384 2012-06-15  Filip Pizlo  <fpizlo@apple.com>
6385
6386         DFG should be able to set watchpoints on structure transitions in the
6387         method check prototype chain
6388         https://bugs.webkit.org/show_bug.cgi?id=89058
6389
6390         Adding the same assertion to 32-bit that I added to 64-bit. This change
6391         does not affect correctness but it's a good thing for assertion coverage.
6392
6393         * dfg/DFGSpeculativeJIT32_64.cpp:
6394         (JSC::DFG::SpeculativeJIT::compile):
6395
6396 2012-06-13  Filip Pizlo  <fpizlo@apple.com>
6397
6398         DFG should be able to set watchpoints on structure transitions in the
6399         method check prototype chain
6400         https://bugs.webkit.org/show_bug.cgi?id=89058
6401
6402         Reviewed by Gavin Barraclough.
6403
6404         This adds the ability to set watchpoints on Structures, and then does
6405         the most modest thing we can do with this ability: the DFG now sets
6406         watchpoints on structure transitions in the prototype chain of method
6407         checks.
6408
6409         This appears to be a >1% speed-up on V8.
6410
6411         * bytecode/PutByIdStatus.cpp:
6412         (JSC::PutByIdStatus::computeFromLLInt):
6413         (JSC::PutByIdStatus::computeFor):
6414         * bytecode/StructureSet.h:
6415         (JSC::StructureSet::containsOnly):
6416         (StructureSet):
6417         * bytecode/Watchpoint.cpp:
6418         (JSC::WatchpointSet::WatchpointSet):
6419         (JSC::InlineWatchpointSet::add):
6420         (JSC):
6421         (JSC::InlineWatchpointSet::inflateSlow):
6422         (JSC::InlineWatchpointSet::freeFat):
6423         * bytecode/Watchpoint.h:
6424         (WatchpointSet):
6425         (JSC):
6426         (InlineWatchpointSet):
6427         (JSC::InlineWatchpointSet::InlineWatchpointSet):
6428         (JSC::InlineWatchpointSet::~InlineWatchpointSet):
6429         (JSC::InlineWatchpointSet::hasBeenInvalidated):
6430         (JSC::InlineWatchpointSet::isStillValid):
6431         (JSC::InlineWatchpointSet::startWatching):
6432         (JSC::InlineWatchpointSet::notifyWrite):
6433         (JSC::InlineWatchpointSet::isFat):
6434         (JSC::InlineWatchpointSet::fat):
6435         (JSC::InlineWatchpointSet::inflate):
6436         * dfg/DFGAbstractState.cpp:
6437         (JSC::DFG::AbstractState::execute):
6438         * dfg/DFGByteCodeParser.cpp:
6439         (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
6440         (ByteCodeParser):
6441         (JSC::DFG::ByteCodeParser::parseBlock):
6442         * dfg/DFGCSEPhase.cpp:
6443         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
6444         (CSEPhase):
6445         (JSC::DFG::CSEPhase::performNodeCSE):
6446         * dfg/DFGCommon.h:
6447         * dfg/DFGGraph.cpp:
6448         (JSC::DFG::Graph::dump):
6449         * dfg/DFGGraph.h:
6450         (JSC::DFG::Graph::isCellConstant):
6451         * dfg/DFGJITCompiler.h:
6452         (JSC::DFG::JITCompiler::addWeakReferences):
6453         (JITCompiler):
6454         * dfg/DFGNode.h:
6455         (JSC::DFG::Node::hasStructure):
6456         (Node):
6457         (JSC::DFG::Node::structure):
6458         * dfg/DFGNodeType.h:
6459         (DFG):
6460         * dfg/DFGPredictionPropagationPhase.cpp:
6461         (JSC::DFG::PredictionPropagationPhase::propagate):
6462         * dfg/DFGRepatch.cpp:
6463         (JSC::DFG::emitPutTransitionStub):
6464         * dfg/DFGSpeculativeJIT64.cpp:
6465         (JSC::DFG::SpeculativeJIT::compile):
6466         * jit/JITStubs.cpp:
6467         (JSC::JITThunks::tryCachePutByID):
6468         * llint/LLIntSlowPaths.cpp:
6469         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
6470         * runtime/Structure.cpp:
6471         (JSC::Structure::Structure):
6472         * runtime/Structure.h:
6473         (JSC::Structure::transitionWatchpointSetHasBeenInvalidated):
6474         (Structure):
6475         (JSC::Structure::transitionWatchpointSetIsStillValid):
6476         (JSC::Structure::addTransitionWatchpoint):
6477         (JSC::Structure::notifyTransitionFromThisStructure):
6478         (JSC::JSCell::setStructure):
6479         * runtime/SymbolTable.cpp:
6480         (JSC::SymbolTableEntry::attemptToWatch):
6481
6482 2012-06-13  Filip Pizlo  <fpizlo@apple.com>
6483
6484         DFG should be able to set watchpoints on global variables
6485         https://bugs.webkit.org/show_bug.cgi?id=88692
6486
6487         Reviewed by Geoffrey Garen.
6488
6489         Rolling back in after fixing Windows build issues, and implementing
6490         branchTest8 for the Qt port's strange assemblers.
6491
6492         This implements global variable constant folding by allowing the optimizing
6493         compiler to set a "watchpoint" on globals that it wishes to constant fold.
6494         If the watchpoint fires, then an OSR exit is forced by overwriting the
6495         machine code that the optimizing compiler generated with a jump.
6496
6497         As such, this patch is adding quite a bit of stuff:
6498
6499         - Jump replacement on those hardware targets supported by the optimizing
6500           JIT. It is now possible to patch in a jump instruction over any recorded
6501           watchpoint label. The jump must be "local" in the sense that it must be
6502           within the range of the largest jump distance supported by a one
6503           instruction jump.
6504
6505         - WatchpointSets and Watchpoints. A Watchpoint is a doubly-linked list node
6506           that records the location where a jump must be inserted and the
6507           destination to which it should jump. Watchpoints can be added to a
6508           WatchpointSet. The WatchpointSet can be fired all at once, which plants
6509           all jumps. WatchpointSet also remembers if it had ever been invalidated,
6510           which allows for monotonicity: we typically don't want to optimize using
6511           watchpoints on something for which watchpoints had previously fired. The
6512           act of notifying a WatchpointSet has a trivial fast path in case no
6513           Watchpoints are registered (one-byte load+branch).
6514
6515         - SpeculativeJIT::speculationWatchpoint(). It's like speculationCheck(),
6516           except that you don't have to emit branches. But, you need to know what
6517           WatchpointSet to add the resulting Watchpoint to. Not everything that
6518           you could write a speculationCheck() for will have a WatchpointSet that
6519           would get notified if the condition you were speculating against became
6520           invalid.
6521
6522         - SymbolTableEntry now has the ability to refer to a WatchpointSet. It can
6523           do so without incurring any space overhead for those entries that don't
6524           have WatchpointSets.
6525
6526         - The bytecode generator infers all global function variables to be
6527           watchable, and makes all stores perform the WatchpointSet's write check,
6528           and marks all loads as being potentially watchable (i.e. you can compile
6529           them to a watchpoint and a constant).
6530
6531         Put together, this allows for fully sleazy inlining of calls to globally
6532         declared functions. The inline prologue will no longer contain the load of
6533         the function, or any checks of the function you're calling. I.e. it's
6534         pretty much like the kind of inlining you would see in Java or C++.
6535         Furthermore, the watchpointing functionality is built to be fairly general,
6536         and should allow setting watchpoints on all sorts of interesting things
6537         in the future.
6538
6539         The sleazy inlining means that we will now sometimes inline in code paths
6540         that have never executed. Previously, to inline we would have either had
6541         to have executed the call (to read the call's inline cache) or have
6542         executed the method check (to read the method check's inline cache). Now,
6543         we might inline when the callee is a watched global variable. This
6544         revealed some humorous bugs. First, constant folding disagreed with CFA
6545         over what kinds of operations can clobber (example: code path A is dead
6546         but stores a String into variable X, all other code paths store 0 into
6547         X, and then you do CompareEq(X, 0) - CFA will say that this is a non-
6548         clobbering constant, but constant folding thought it was clobbering
6549         because it saw the String prediction). Second, inlining would crash if
6550         the inline callee had not been compiled. This patch fixes both bugs,
6551         since otherwise run-javascriptcore-tests would report regressions.
6552
6553         * CMakeLists.txt:
6554         * GNUmakefile.list.am:
6555         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
6556         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6557         * JavaScriptCore.xcodeproj/project.pbxproj:
6558         * Target.pri:
6559         * assembler/ARMv7Assembler.h:
6560         (ARMv7Assembler):
6561         (JSC::ARMv7Assembler::ARMv7Assembler):
6562         (JSC::ARMv7Assembler::labelForWatchpoint):
6563         (JSC::ARMv7Assembler::label):
6564         (JSC::ARMv7Assembler::replaceWithJump):
6565         (JSC::ARMv7Assembler::maxJumpReplacementSize):
6566         * assembler/AbstractMacroAssembler.h:
6567         (JSC):
6568         (AbstractMacroAssembler):
6569         (Label):
6570         (JSC::AbstractMacroAssembler::watchpointLabel):
6571         (JSC::AbstractMacroAssembler::readPointer):
6572         * assembler/AssemblerBuffer.h:
6573         * assembler/MacroAssemblerARM.h:
6574         (JSC::MacroAssemblerARM::branchTest8):
6575         (MacroAssemblerARM):
6576         (JSC::MacroAssemblerARM::replaceWithJump):
6577         (JSC::MacroAssemblerARM::maxJumpReplacementSize):
6578         * assembler/MacroAssemblerARMv7.h:
6579         (JSC::MacroAssemblerARMv7::load8Signed):
6580         (JSC::MacroAssemblerARMv7::load16Signed):
6581         (MacroAssemblerARMv7):
6582         (JSC::MacroAssemblerARMv7::replaceWithJump):
6583         (JSC::MacroAssemblerARMv7::maxJumpReplacementSize):
6584         (JSC::MacroAssemblerARMv7::branchTest8):
6585         (JSC::MacroAssemblerARMv7::jump):
6586         (JSC::MacroAssemblerARMv7::makeBranch):
6587         * assembler/MacroAssemblerMIPS.h:
6588         (JSC::MacroAssemblerMIPS::branchTest8):
6589         (MacroAssemblerMIPS):
6590         (JSC::MacroAssemblerMIPS::replaceWithJump):
6591         (JSC::MacroAssemblerMIPS::maxJumpReplacementSize):
6592         * assembler/MacroAssemblerSH4.h:
6593         (JSC::MacroAssemblerSH4::branchTest8):
6594         (MacroAssemblerSH4):
6595         (JSC::MacroAssemblerSH4::replaceWithJump):
6596         (JSC::MacroAssemblerSH4::maxJumpReplacementSize):
6597         * assembler/MacroAssemblerX86.h:
6598         (MacroAssemblerX86):
6599         (JSC::MacroAssemblerX86::branchTest8):
6600         * assembler/MacroAssemblerX86Common.h:
6601         (JSC::MacroAssemblerX86Common::replaceWithJump):
6602         (MacroAssemblerX86Common):
6603         (JSC::MacroAssemblerX86Common::maxJumpReplacementSize):
6604         * assembler/MacroAssemblerX86_64.h:
6605         (MacroAssemblerX86_64):
6606         (JSC::MacroAssemblerX86_64::branchTest8):
6607         * assembler/X86Assembler.h:
6608         (JSC::X86Assembler::X86Assembler):
6609         (X86Assembler):
6610         (JSC::X86Assembler::cmpb_im):
6611         (JSC::X86Assembler::testb_im):
6612         (JSC::X86Assembler::labelForWatchpoint):
6613         (JSC::X86Assembler::label):
6614         (JSC::X86Assembler::replaceWithJump):
6615         (JSC::X86Assembler::maxJumpReplacementSize):
6616         (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
6617         * bytecode/CodeBlock.cpp:
6618         (JSC):
6619         (JSC::CodeBlock::printGetByIdCacheStatus):
6620         (JSC::CodeBlock::dump):
6621         * bytecode/CodeBlock.h:
6622         (JSC::CodeBlock::appendOSRExit):
6623         (JSC::CodeBlock::appendSpeculationRecovery):
6624         (CodeBlock):
6625         (JSC::CodeBlock::appendWatchpoint):
6626         (JSC::CodeBlock::numberOfWatchpoints):
6627         (JSC::CodeBlock::watchpoint):
6628         (DFGData):
6629         * bytecode/DFGExitProfile.h:
6630         (JSC::DFG::exitKindToString):
6631         (JSC::DFG::exitKindIsCountable):
6632         * bytecode/GetByIdStatus.cpp:
6633         (JSC::GetByIdStatus::computeForChain):
6634         * bytecode/Instruction.h:
6635         (Instruction):
6636         (JSC::Instruction::Instruction):
6637         * bytecode/Opcode.h:
6638         (JSC):
6639         (JSC::padOpcodeName):
6640         * bytecode/Watchpoint.cpp: Added.
6641         (JSC):
6642         (JSC::Watchpoint::~Watchpoint):
6643         (JSC::Watchpoint::correctLabels):
6644         (JSC::Watchpoint::fire):
6645         (JSC::WatchpointSet::WatchpointSet):
6646         (JSC::WatchpointSet::~WatchpointSet):
6647         (JSC::WatchpointSet::add):
6648         (JSC::WatchpointSet::notifyWriteSlow):
6649         (JSC::WatchpointSet::fireAllWatchpoints):
6650         * bytecode/Watchpoint.h: Added.
6651         (JSC):
6652         (Watchpoint):
6653         (JSC::Watchpoint::Watchpoint):
6654         (JSC::Watchpoint::setDestination):
6655         (WatchpointSet):
6656         (JSC::WatchpointSet::isStillValid):
6657         (JSC::WatchpointSet::hasBeenInvalidated):
6658         (JSC::WatchpointSet::startWatching):
6659         (JSC::WatchpointSet::notifyWrite):
6660         (JSC::WatchpointSet::addressOfIsWatched):
6661         * bytecompiler/BytecodeGenerator.cpp:
6662         (JSC::ResolveResult::checkValidity):
6663         (JSC::BytecodeGenerator::addGlobalVar):
6664         (JSC::BytecodeGenerator::BytecodeGenerator):
6665         (JSC::BytecodeGenerator::resolve):
6666         (JSC::BytecodeGenerator::emitResolve):
6667         (JSC::BytecodeGenerator::emitResolveWithBase):
6668         (JSC::BytecodeGenerator::emitResolveWithThis):
6669         (JSC::BytecodeGenerator::emitGetStaticVar):
6670         (JSC::BytecodeGenerator::emitPutStaticVar):
6671         * bytecompiler/BytecodeGenerator.h:
6672         (BytecodeGenerator):
6673         * bytecompiler/NodesCodegen.cpp:
6674         (JSC::FunctionCallResolveNode::emitBytecode):
6675         (JSC::PostfixResolveNode::emitBytecode):
6676         (JSC::PrefixResolveNode::emitBytecode):
6677         (JSC::ReadModifyResolveNode::emitBytecode):
6678         (JSC::AssignResolveNode::emitBytecode):
6679         (JSC::ConstDeclNode::emitCodeSingle):
6680         * dfg/DFGAbstractState.cpp:
6681         (JSC::DFG::AbstractState::execute):
6682         (JSC::DFG::AbstractState::clobberStructures):
6683         * dfg/DFGAbstractState.h:
6684         (AbstractState):
6685         (JSC::DFG::AbstractState::didClobber):
6686         * dfg/DFGByteCodeParser.cpp:
6687         (JSC::DFG::ByteCodeParser::handleInlining):
6688         (JSC::DFG::ByteCodeParser::parseBlock):
6689         * dfg/DFGCCallHelpers.h:
6690         (CCallHelpers):
6691         (JSC::DFG::CCallHelpers::setupArguments):
6692         * dfg/DFGCSEPhase.cpp:
6693         (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
6694         (CSEPhase):
6695         (JSC::DFG::CSEPhase::globalVarStoreElimination):
6696         (JSC::DFG::CSEPhase::performNodeCSE):
6697         * dfg/DFGCapabilities.h:
6698         (JSC::DFG::canCompileOpcode):
6699         * dfg/DFGConstantFoldingPhase.cpp:
6700         (JSC::DFG::ConstantFoldingPhase::run):
6701         * dfg/DFGCorrectableJumpPoint.h:
6702         (JSC::DFG::CorrectableJumpPoint::isSet):
6703         (CorrectableJumpPoint):
6704         * dfg/DFGJITCompiler.cpp:
6705         (JSC::DFG::JITCompiler::linkOSRExits):
6706         (JSC::DFG::JITCompiler::link):
6707         * dfg/DFGNode.h:
6708         (JSC::DFG::Node::hasIdentifierNumberForCheck):
6709         (Node):
6710         (JSC::DFG::Node::identifierNumberForCheck):
6711         (JSC::DFG::Node::hasRegisterPointer):
6712         * dfg/DFGNodeType.h:
6713         (DFG):
6714         * dfg/DFGOSRExit.cpp:
6715         (JSC::DFG::OSRExit::OSRExit):
6716         * dfg/DFGOSRExit.h:
6717         (OSRExit):
6718         * dfg/DFGOperations.cpp:
6719         * dfg/DFGOperations.h:
6720         * dfg/DFGPredictionPropagationPhase.cpp:
6721         (JSC::DFG::PredictionPropagationPhase::propagate):
6722         * dfg/DFGSpeculativeJIT.h:
6723         (JSC::DFG::SpeculativeJIT::callOperation):
6724         (JSC::DFG::SpeculativeJIT::appendCall):
6725         (SpeculativeJIT):
6726         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
6727         * dfg/DFGSpeculativeJIT32_64.cpp:
6728         (JSC::DFG::SpeculativeJIT::compile):
6729         * dfg/DFGSpeculativeJIT64.cpp:
6730         (JSC::DFG::SpeculativeJIT::compile):
6731         * interpreter/Interpreter.cpp:
6732         (JSC::Interpreter::privateExecute):
6733         * jit/JIT.cpp:
6734         (JSC::JIT::privateCompileMainPass):
6735         (JSC::JIT::privateCompileSlowCases):
6736         * jit/JIT.h:
6737         * jit/JITPropertyAccess.cpp:
6738         (JSC::JIT::emit_op_put_global_var_check):
6739         (JSC):
6740         (JSC::JIT::emitSlow_op_put_global_var_check):
6741         * jit/JITPropertyAccess32_64.cpp:
6742         (JSC::JIT::emit_op_put_global_var_check):
6743         (JSC):
6744         (JSC::JIT::emitSlow_op_put_global_var_check):
6745         * jit/JITStubs.cpp:
6746         (JSC::DEFINE_STUB_FUNCTION):
6747         (JSC):
6748         * jit/JITStubs.h:
6749         * llint/LLIntSlowPaths.cpp:
6750         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
6751         (LLInt):
6752         * llint/LLIntSlowPaths.h:
6753         (LLInt):
6754         * llint/LowLevelInterpreter32_64.asm:
6755         * llint/LowLevelInterpreter64.asm:
6756         * runtime/JSObject.cpp:
6757         (JSC::JSObject::removeDirect):
6758         * runtime/JSObject.h:
6759         (JSObject):
6760         * runtime/JSSymbolTableObject.h:
6761         (JSC::symbolTableGet):
6762         (JSC::symbolTablePut):
6763         (JSC::symbolTablePutWithAttributes):
6764         * runtime/SymbolTable.cpp: Added.
6765         (JSC):
6766         (JSC::SymbolTableEntry::copySlow):
6767         (JSC::SymbolTableEntry::freeFatEntrySlow):
6768         (JSC::SymbolTableEntry::couldBeWatched):
6769         (JSC::SymbolTableEntry::attemptToWatch):
6770         (JSC::SymbolTableEntry::addressOfIsWatched):
6771         (JSC::SymbolTableEntry::addWatchpoint):
6772         (JSC::SymbolTableEntry::notifyWriteSlow):
6773         (JSC::SymbolTableEntry::inflateSlow):
6774         * runtime/SymbolTable.h:
6775         (JSC):
6776         (SymbolTableEntry):
6777         (Fast):
6778         (JSC::SymbolTableEntry::Fast::Fast):
6779         (JSC::SymbolTableEntry::Fast::isNull):
6780         (JSC::SymbolTableEntry::Fast::getIndex):
6781         (JSC::SymbolTableEntry::Fast::isReadOnly):
6782         (JSC::SymbolTableEntry::Fast::getAttributes):
6783         (JSC::SymbolTableEntry::Fast::isFat):
6784         (JSC::SymbolTableEntry::SymbolTableEntry):
6785         (JSC::SymbolTableEntry::~SymbolTableEntry):
6786         (JSC::SymbolTableEntry::operator=):
6787         (JSC::SymbolTableEntry::isNull):
6788         (JSC::SymbolTableEntry::getIndex):
6789         (JSC::SymbolTableEntry::getFast):
6790         (JSC::SymbolTableEntry::getAttributes):
6791         (JSC::SymbolTableEntry::isReadOnly):
6792         (JSC::SymbolTableEntry::watchpointSet):
6793         (JSC::SymbolTableEntry::notifyWrite):
6794         (FatEntry):
6795         (JSC::SymbolTableEntry::FatEntry::FatEntry):
6796         (JSC::SymbolTableEntry::isFat):
6797         (JSC::SymbolTableEntry::fatEntry):
6798         (JSC::SymbolTableEntry::inflate):
6799         (JSC::SymbolTableEntry::bits):
6800         (JSC::SymbolTableEntry::freeFatEntry):
6801         (JSC::SymbolTableEntry::pack):
6802         (JSC::SymbolTableEntry::isValidIndex):
6803
6804 2012-06-13  Sheriff Bot  <webkit.review.bot@gmail.com>
6805
6806         Unreviewed, rolling out r120172.
6807         http://trac.webkit.org/changeset/120172
6808         https://bugs.webkit.org/show_bug.cgi?id=88976
6809
6810         The patch causes compilation failures on Gtk, Qt and Apple Win
6811         bots (Requested by zdobersek on #webkit).
6812
6813         * CMakeLists.txt:
6814         * GNUmakefile.list.am:
6815         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
6816         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6817         * JavaScriptCore.xcodeproj/project.pbxproj:
6818         * Target.pri:
6819         * assembler/ARMv7Assembler.h:
6820         (JSC::ARMv7Assembler::nop):
6821         (JSC::ARMv7Assembler::label):
6822         (JSC::ARMv7Assembler::readPointer):
6823         (ARMv7Assembler):
6824         * assembler/AbstractMacroAssembler.h:
6825         (JSC):
6826         (AbstractMacroAssembler):
6827         (Label):
6828         * assembler/AssemblerBuffer.h:
6829         * assembler/MacroAssemblerARM.h:
6830         * assembler/MacroAssemblerARMv7.h:
6831         (JSC::MacroAssemblerARMv7::nop):
6832         (JSC::MacroAssemblerARMv7::jump):
6833         (JSC::MacroAssemblerARMv7::makeBranch):
6834         * assembler/MacroAssemblerMIPS.h:
6835         * assembler/MacroAssemblerSH4.h:
6836         * assembler/MacroAssemblerX86.h:
6837         (MacroAssemblerX86):
6838         (JSC::MacroAssemblerX86::moveWithPatch):
6839         * assembler/MacroAssemblerX86Common.h:
6840         * assembler/MacroAssemblerX86_64.h:
6841         (JSC::MacroAssemblerX86_64::branchTest8):
6842         * assembler/X86Assembler.h:
6843         (JSC::X86Assembler::cmpb_im):
6844         (JSC::X86Assembler::codeSize):
6845         (JSC::X86Assembler::label):
6846         (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
6847         * bytecode/CodeBlock.cpp:
6848         (JSC::CodeBlock::dump):
6849         * bytecode/CodeBlock.h:
6850         (JSC::CodeBlock::appendOSRExit):
6851         (JSC::CodeBlock::appendSpeculationRecovery):
6852         (DFGData):
6853         * bytecode/DFGExitProfile.h:
6854         (JSC::DFG::exitKindToString):
6855         (JSC::DFG::exitKindIsCountable):
6856         * bytecode/Instruction.h:
6857         * bytecode/Opcode.h:
6858         (JSC):
6859         (JSC::padOpcodeName):
6860         * bytecode/Watchpoint.cpp: Removed.
6861         * bytecode/Watchpoint.h: Removed.
6862         * bytecompiler/BytecodeGenerator.cpp:
6863         (JSC::ResolveResult::checkValidity):
6864         (JSC::BytecodeGenerator::addGlobalVar):
6865         (JSC::BytecodeGenerator::BytecodeGenerator):
6866         (JSC::BytecodeGenerator::resolve):
6867         (JSC::BytecodeGenerator::emitResolve):
6868         (JSC::BytecodeGenerator::emitResolveWithBase):
6869         (JSC::BytecodeGenerator::emitResolveWithThis):
6870         (JSC::BytecodeGenerator::emitGetStaticVar):
6871         (JSC::BytecodeGenerator::emitPutStaticVar):
6872         * bytecompiler/BytecodeGenerator.h:
6873         (BytecodeGenerator):
6874         * bytecompiler/NodesCodegen.cpp:
6875         (JSC::FunctionCallResolveNode::emitBytecode):
6876         (JSC::PostfixResolveNode::emitBytecode):
6877         (JSC::PrefixResolveNode::emitBytecode):
6878         (JSC::ReadModifyResolveNode::emitBytecode):
6879         (JSC::AssignResolveNode::emitBytecode):
6880         (JSC::ConstDeclNode::emitCodeSingle):
6881         * dfg/DFGAbstractState.cpp:
6882         (JSC::DFG::AbstractState::execute):
6883         (JSC::DFG::AbstractState::clobberStructures):
6884         * dfg/DFGAbstractState.h:
6885         (AbstractState):
6886         * dfg/DFGByteCodeParser.cpp:
6887         (JSC::DFG::ByteCodeParser::handleInlining):
6888         (JSC::DFG::ByteCodeParser::parseBlock):
6889         * dfg/DFGCCallHelpers.h:
6890         (JSC::DFG::CCallHelpers::setupArguments):
6891         * dfg/DFGCSEPhase.cpp:
6892         (JSC::DFG::CSEPhase::globalVarStoreElimination):
6893         (JSC::DFG::CSEPhase::performNodeCSE):
6894         * dfg/DFGCapabilities.h:
6895         (JSC::DFG::canCompileOpcode):
6896         * dfg/DFGConstantFoldingPhase.cpp:
6897         (JSC::DFG::ConstantFoldingPhase::run):
6898         * dfg/DFGCorrectableJumpPoint.h:
6899         * dfg/DFGJITCompiler.cpp:
6900         (JSC::DFG::JITCompiler::linkOSRExits):
6901         (JSC::DFG::JITCompiler::link):
6902         * dfg/DFGNode.h:
6903         (JSC::DFG::Node::hasRegisterPointer):
6904         * dfg/DFGNodeType.h:
6905         (DFG):
6906         * dfg/DFGOSRExit.cpp:
6907         (JSC::DFG::OSRExit::OSRExit):
6908         * dfg/DFGOSRExit.h:
6909         (OSRExit):
6910         * dfg/DFGOperations.cpp:
6911         * dfg/DFGOperations.h:
6912         * dfg/DFGPredictionPropagationPhase.cpp:
6913         (JSC::DFG::PredictionPropagationPhase::propagate):
6914         * dfg/DFGSpeculativeJIT.h:
6915         (JSC::DFG::SpeculativeJIT::callOperation):
6916         (JSC::DFG::SpeculativeJIT::appendCallSetResult):
6917         (JSC::DFG::SpeculativeJIT::speculationCheck):
6918         * dfg/DFGSpeculativeJIT32_64.cpp:
6919         (JSC::DFG::SpeculativeJIT::compile):
6920         * dfg/DFGSpeculativeJIT64.cpp:
6921         (JSC::DFG::SpeculativeJIT::compile):
6922         * jit/JIT.cpp:
6923         (JSC::JIT::privateCompileMainPass):
6924         (JSC::JIT::privateCompileSlowCases):
6925         * jit/JIT.h:
6926         * jit/JITPropertyAccess.cpp:
6927         * jit/JITPropertyAccess32_64.cpp:
6928         * jit/JITStubs.cpp:
6929         * jit/JITStubs.h:
6930         * llint/LLIntSlowPaths.cpp:
6931         * llint/LLIntSlowPaths.h:
6932         (LLInt):
6933         * llint/LowLevelInterpreter32_64.asm:
6934         * llint/LowLevelInterpreter64.asm:
6935         * runtime/JSObject.cpp:
6936         (JSC::JSObject::removeDirect):
6937         * runtime/JSObject.h:
6938         (JSObject):
6939         * runtime/JSSymbolTableObject.h:
6940         (JSC::symbolTableGet):
6941         (JSC::symbolTablePut):
6942         (JSC::symbolTablePutWithAttributes):
6943         * runtime/SymbolTable.cpp: Removed.
6944         * runtime/SymbolTable.h:
6945         (JSC):
6946         (JSC::SymbolTableEntry::isNull):
6947         (JSC::SymbolTableEntry::getIndex):
6948         (SymbolTableEntry):
6949         (JSC::SymbolTableEntry::getAttributes):
6950         (JSC::SymbolTableEntry::isReadOnly):
6951         (JSC::SymbolTableEntry::pack):
6952         (JSC::SymbolTableEntry::isValidIndex):
6953
6954 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
6955
6956         DFG should be able to set watchpoints on global variables
6957         https://bugs.webkit.org/show_bug.cgi?id=88692
6958
6959         Reviewed by Geoffrey Garen.
6960
6961         This implements global variable constant folding by allowing the optimizing
6962         compiler to set a "watchpoint" on globals that it wishes to constant fold.
6963         If the watchpoint fires, then an OSR exit is forced by overwriting the
6964         machine code that the optimizing compiler generated with a jump.
6965
6966         As such, this patch is adding quite a bit of stuff:
6967
6968         - Jump replacement on those hardware targets supported by the optimizing
6969           JIT. It is now possible to patch in a jump instruction over any recorded
6970           watchpoint label. The jump must be "local" in the sense that it must be
6971           within the range of the largest jump distance supported by a one
6972           instruction jump.
6973
6974         - WatchpointSets and Watchpoints. A Watchpoint is a doubly-linked list node
6975           that records the location where a jump must be inserted and the
6976           destination to which it should jump. Watchpoints can be added to a
6977           WatchpointSet. The WatchpointSet can be fired all at once, which plants
6978           all jumps. WatchpointSet also remembers if it had ever been invalidated,
6979           which allows for monotonicity: we typically don't want to optimize using
6980           watchpoints on something for which watchpoints had previously fired. The
6981           act of notifying a WatchpointSet has a trivial fast path in case no
6982           Watchpoints are registered (one-byte load+branch).
6983
6984         - SpeculativeJIT::speculationWatchpoint(). It's like speculationCheck(),
6985           except that you don't have to emit branches. But, you need to know what
6986           WatchpointSet to add the resulting Watchpoint to. Not everything that
6987           you could write a speculationCheck() for will have a WatchpointSet that
6988           would get notified if the condition you were speculating against became
6989           invalid.
6990
6991         - SymbolTableEntry now has the ability to refer to a WatchpointSet. It can
6992           do so without incurring any space overhead for those entries that don't
6993           have WatchpointSets.
6994
6995         - The bytecode generator infers all global function variables to be
6996           watchable, and makes all stores perform the WatchpointSet's write check,
6997           and marks all loads as being potentially watchable (i.e. you can compile
6998           them to a watchpoint and a constant).
6999
7000         Put together, this allows for fully sleazy inlining of calls to globally
7001         declared functions. The inline prologue will no longer contain the load of
7002         the function, or any checks of the function you're calling. I.e. it's
7003         pretty much like the kind of inlining you would see in Java or C++.
7004         Furthermore, the watchpointing functionality is built to be fairly general,
7005         and should allow setting watchpoints on all sorts of interesting things
7006         in the future.
7007
7008         The sleazy inlining means that we will now sometimes inline in code paths
7009         that have never executed. Previously, to inline we would have either had
7010         to have executed the call (to read the call's inline cache) or have
7011         executed the method check (to read the method check's inline cache). Now,
7012         we might inline when the callee is a watched global variable. This
7013         revealed some humorous bugs. First, constant folding disagreed with CFA
7014         over what kinds of operations can clobber (example: code path A is dead
7015         but stores a String into variable X, all other code paths store 0 into
7016         X, and then you do CompareEq(X, 0) - CFA will say that this is a non-
7017         clobbering constant, but constant folding thought it was clobbering
7018         because it saw the String prediction). Second, inlining would crash if
7019         the inline callee had not been compiled. This patch fixes both bugs,
7020         since otherwise run-javascriptcore-tests would report regressions.
7021
7022         * CMakeLists.txt:
7023         * GNUmakefile.list.am:
7024         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
7025         * JavaScriptCore.xcodeproj/project.pbxproj:
7026         * Target.pri:
7027         * assembler/ARMv7Assembler.h:
7028         (ARMv7Assembler):
7029         (JSC::ARMv7Assembler::ARMv7Assembler):
7030         (JSC::ARMv7Assembler::labelForWatchpoint):
7031         (JSC::ARMv7Assembler::label):
7032         (JSC::ARMv7Assembler::replaceWithJump):
7033         (JSC::ARMv7Assembler::maxJumpReplacementSize):
7034         * assembler/AbstractMacroAssembler.h:
7035         (JSC):
7036         (AbstractMacroAssembler):
7037         (Label):
7038         (JSC::AbstractMacroAssembler::watchpointLabel):
7039         * assembler/AssemblerBuffer.h:
7040         * assembler/MacroAssemblerARM.h:
7041         (JSC::MacroAssemblerARM::replaceWithJump):
7042         (MacroAssemblerARM):
7043         (JSC::MacroAssemblerARM::maxJumpReplacementSize):
7044         * assembler/MacroAssemblerARMv7.h:
7045         (MacroAssemblerARMv7):
7046         (JSC::MacroAssemblerARMv7::replaceWithJump):
7047         (JSC::MacroAssemblerARMv7::maxJumpReplacementSize):
7048         (JSC::MacroAssemblerARMv7::branchTest8):
7049         (JSC::MacroAssemblerARMv7::jump):
7050         (JSC::MacroAssemblerARMv7::makeBranch):
7051         * assembler/MacroAssemblerMIPS.h:
7052         (JSC::MacroAssemblerMIPS::replaceWithJump):
7053         (MacroAssemblerMIPS):
7054         (JSC::MacroAssemblerMIPS::maxJumpReplacementSize):
7055         * assembler/MacroAssemblerSH4.h:
7056         (JSC::MacroAssemblerSH4::replaceWithJump):
7057         (MacroAssemblerSH4):
7058         (JSC::MacroAssemblerSH4::maxJumpReplacementSize):
7059         * assembler/MacroAssemblerX86.h:
7060         (MacroAssemblerX86):
7061         (JSC::MacroAssemblerX86::branchTest8):
7062         * assembler/MacroAssemblerX86Common.h:
7063         (JSC::MacroAssemblerX86Common::replaceWithJump):
7064         (MacroAssemblerX86Common):
7065         (JSC::MacroAssemblerX86Common::maxJumpReplacementSize):
7066         * assembler/MacroAssemblerX86_64.h:
7067         (MacroAssemblerX86_64):
7068         (JSC::MacroAssemblerX86_64::branchTest8):
7069         * assembler/X86Assembler.h:
7070         (JSC::X86Assembler::X86Assembler):
7071         (X86Assembler):
7072         (JSC::X86Assembler::cmpb_im):
7073         (JSC::X86Assembler::testb_im):
7074         (JSC::X86Assembler::labelForWatchpoint):
7075         (JSC::X86Assembler::label):
7076         (JSC::X86Assembler::replaceWithJump):
7077         (JSC::X86Assembler::maxJumpReplacementSize):
7078         (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
7079         * bytecode/CodeBlock.cpp:
7080         (JSC::CodeBlock::dump):
7081         * bytecode/CodeBlock.h:
7082         (JSC::CodeBlock::appendOSRExit):
7083         (JSC::CodeBlock::appendSpeculationRecovery):
7084         (CodeBlock):
7085         (JSC::CodeBlock::appendWatchpoint):
7086         (JSC::CodeBlock::numberOfWatchpoints):
7087         (JSC::CodeBlock::watchpoint):
7088         (DFGData):
7089         * bytecode/DFGExitProfile.h:
7090         (JSC::DFG::exitKindToString):
7091         (JSC::DFG::exitKindIsCountable):
7092         * bytecode/Instruction.h:
7093         (Instruction):
7094         (JSC::Instruction::Instruction):
7095         * bytecode/Opcode.h:
7096         (JSC):
7097         (JSC::padOpcodeName):
7098         * bytecode/Watchpoint.cpp: Added.
7099         (JSC):
7100         (JSC::Watchpoint::~Watchpoint):
7101         (JSC::Watchpoint::correctLabels):
7102         (JSC::Watchpoint::fire):
7103         (JSC::WatchpointSet::WatchpointSet):
7104         (JSC::WatchpointSet::~WatchpointSet):
7105         (JSC::WatchpointSet::add):
7106         (JSC::WatchpointSet::notifyWriteSlow):
7107         (JSC::WatchpointSet::fireAllWatchpoints):
7108         * bytecode/Watchpoint.h: Added.
7109         (JSC):
7110         (Watchpoint):
7111         (JSC::Watchpoint::Watchpoint):
7112         (JSC::Watchpoint::setDestination):
7113         (WatchpointSet):
7114         (JSC::WatchpointSet::isStillValid):
7115         (JSC::WatchpointSet::hasBeenInvalidated):
7116         (JSC::WatchpointSet::startWatching):
7117         (JSC::WatchpointSet::notifyWrite):
7118         (JSC::WatchpointSet::addressOfIsWatched):
7119         * bytecompiler/BytecodeGenerator.cpp:
7120         (JSC::ResolveResult::checkValidity):
7121         (JSC::BytecodeGenerator::addGlobalVar):
7122         (JSC::BytecodeGenerator::BytecodeGenerator):
7123         (JSC::BytecodeGenerator::resolve):
7124         (JSC::BytecodeGenerator::emitResolve):
7125         (JSC::BytecodeGenerator::emitResolveWithBase):
7126         (JSC::BytecodeGenerator::emitResolveWithThis):
7127         (JSC::BytecodeGenerator::emitGetStaticVar):
7128         (JSC::BytecodeGenerator::emitPutStaticVar):
7129         * bytecompiler/BytecodeGenerator.h:
7130         (BytecodeGenerator):
7131         * bytecompiler/NodesCodegen.cpp:
7132         (JSC::FunctionCallResolveNode::emitBytecode):
7133         (JSC::PostfixResolveNode::emitBytecode):
7134         (JSC::PrefixResolveNode::emitBytecode):
7135         (JSC::ReadModifyResolveNode::emitBytecode):
7136         (JSC::AssignResolveNode::emitBytecode):
7137         (JSC::ConstDeclNode::emitCodeSingle):
7138         * dfg/DFGAbstractState.cpp:
7139         (JSC::DFG::AbstractState::execute):
7140         (JSC::DFG::AbstractState::clobberStructures):
7141         * dfg/DFGAbstractState.h:
7142         (AbstractState):
7143         (JSC::DFG::AbstractState::didClobber):
7144         * dfg/DFGByteCodeParser.cpp:
7145         (JSC::DFG::ByteCodeParser::handleInlining):
7146         (JSC::DFG::ByteCodeParser::parseBlock):
7147         * dfg/DFGCCallHelpers.h:
7148         (CCallHelpers):
7149         (JSC::DFG::CCallHelpers::setupArguments):
7150         * dfg/DFGCSEPhase.cpp:
7151         (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
7152         (CSEPhase):
7153         (JSC::DFG::CSEPhase::globalVarStoreElimination):
7154         (JSC::DFG::CSEPhase::performNodeCSE):
7155         * dfg/DFGCapabilities.h:
7156         (JSC::DFG::canCompileOpcode):
7157         * dfg/DFGConstantFoldingPhase.cpp:
7158         (JSC::DFG::ConstantFoldingPhase::run):
7159         * dfg/DFGCorrectableJumpPoint.h:
7160         (JSC::DFG::CorrectableJumpPoint::isSet):
7161         (CorrectableJumpPoint):
7162         * dfg/DFGJITCompiler.cpp:
7163         (JSC::DFG::JITCompiler::linkOSRExits):
7164         (JSC::DFG::JITCompiler::link):
7165         * dfg/DFGNode.h:
7166         (JSC::DFG::Node::hasIdentifierNumberForCheck):
7167         (Node):
7168         (JSC::DFG::Node::identifierNumberForCheck):
7169         (JSC::DFG::Node::hasRegisterPointer):
7170         * dfg/DFGNodeType.h:
7171         (DFG):
7172         * dfg/DFGOSRExit.cpp:
7173         (JSC::DFG::OSRExit::OSRExit):
7174         * dfg/DFGOSRExit.h:
7175         (OSRExit):
7176         * dfg/DFGOperations.cpp:
7177         * dfg/DFGOperations.h:
7178         * dfg/DFGPredictionPropagationPhase.cpp:
7179         (JSC::DFG::PredictionPropagationPhase::propagate):
7180         * dfg/DFGSpeculativeJIT.h:
7181         (JSC::DFG::SpeculativeJIT::callOperation):
7182         (JSC::DFG::SpeculativeJIT::appendCall):
7183         (SpeculativeJIT):
7184         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
7185         * dfg/DFGSpeculativeJIT32_64.cpp:
7186         (JSC::DFG::SpeculativeJIT::compile):
7187         * dfg/DFGSpeculativeJIT64.cpp:
7188         (JSC::DFG::SpeculativeJIT::compile):
7189         * jit/JIT.cpp:
7190         (JSC::JIT::privateCompileMainPass):
7191         (JSC::JIT::privateCompileSlowCases):
7192         * jit/JIT.h:
7193         * jit/JITPropertyAccess.cpp:
7194         (JSC::JIT::emit_op_put_global_var_check):
7195         (JSC):
7196         (JSC::JIT::emitSlow_op_put_global_var_check):
7197         * jit/JITPropertyAccess32_64.cpp:
7198         (JSC::JIT::emit_op_put_global_var_check):
7199         (JSC):
7200         (JSC::JIT::emitSlow_op_put_global_var_check):
7201         * jit/JITStubs.cpp:
7202         (JSC::JITThunks::JITThunks):
7203         (JSC::DEFINE_STUB_FUNCTION):
7204         (JSC):
7205         * jit/JITStubs.h:
7206         * llint/LLIntSlowPaths.cpp:
7207         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
7208         (LLInt):
7209         * llint/LLIntSlowPaths.h:
7210         (LLInt):
7211         * llint/LowLevelInterpreter32_64.asm:
7212         * llint/LowLevelInterpreter64.asm:
7213         * runtime/JSObject.cpp:
7214         (JSC::JSObject::removeDirect):
7215         * runtime/JSObject.h:
7216         (JSObject):
7217         * runtime/JSSymbolTableObject.h:
7218         (JSC::symbolTableGet):
7219         (JSC::symbolTablePut):
7220         (JSC::symbolTablePutWithAttributes):
7221         * runtime/SymbolTable.cpp: Added.
7222         (JSC):
7223         (JSC::SymbolTableEntry::copySlow):
7224         (JSC::SymbolTableEntry::freeFatEntrySlow):
7225         (JSC::SymbolTableEntry::couldBeWatched):
7226         (JSC::SymbolTableEntry::attemptToWatch):
7227         (JSC::SymbolTableEntry::addressOfIsWatched):
7228         (JSC::SymbolTableEntry::addWatchpoint):
7229         (JSC::SymbolTableEntry::notifyWriteSlow):
7230         (JSC::SymbolTableEntry::inflateSlow):
7231         * runtime/SymbolTable.h:
7232         (JSC):
7233         (SymbolTableEntry):
7234         (Fast):
7235         (JSC::SymbolTableEntry::Fast::Fast):
7236         (JSC::SymbolTableEntry::Fast::isNull):
7237         (JSC::SymbolTableEntry::Fast::getIndex):
7238         (JSC::SymbolTableEntry::Fast::isReadOnly):
7239         (JSC::SymbolTableEntry::Fast::getAttributes):
7240         (JSC::SymbolTableEntry::Fast::isFat):
7241         (JSC::SymbolTableEntry::SymbolTableEntry):
7242         (JSC::SymbolTableEntry::~SymbolTableEntry):
7243         (JSC::SymbolTableEntry::operator=):
7244         (JSC::SymbolTableEntry::isNull):
7245         (JSC::SymbolTableEntry::getIndex):
7246         (JSC::SymbolTableEntry::getFast):
7247         (JSC::SymbolTableEntry::getAttributes):
7248         (JSC::SymbolTableEntry::isReadOnly):
7249         (JSC::SymbolTableEntry::watchpointSet):
7250         (JSC::SymbolTableEntry::notifyWrite):
7251         (FatEntry):
7252         (JSC::SymbolTableEntry::FatEntry::FatEntry):
7253         (JSC::SymbolTableEntry::isFat):
7254         (JSC::SymbolTableEntry::fatEntry):
7255         (JSC::SymbolTableEntry::inflate):
7256         (JSC::SymbolTableEntry::bits):
7257         (JSC::SymbolTableEntry::freeFatEntry):
7258         (JSC::SymbolTableEntry::pack):
7259         (JSC::SymbolTableEntry::isValidIndex):
7260
7261 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
7262
7263         Unreviewed build fix for ARMv7 debug builds.
7264
7265         * jit/JITStubs.cpp:
7266         (JSC::JITThunks::JITThunks):
7267
7268 2012-06-12  Geoffrey Garen  <ggaren@apple.com>
7269
7270         Build fix for case-sensitive file systems: use the right case.
7271
7272         * heap/ListableHandler.h:
7273
7274 2012-06-11  Geoffrey Garen  <ggaren@apple.com>
7275
7276         GC should be 1.7X faster
7277         https://bugs.webkit.org/show_bug.cgi?id=88840
7278
7279         Reviewed by Oliver Hunt.
7280
7281         I profiled, and removed anything that showed up as a concurrency
7282         bottleneck. Then, I added 3 threads to our max thread count, since we
7283         can scale up to more threads now.
7284
7285         * heap/BlockAllocator.cpp:
7286         (JSC::BlockAllocator::BlockAllocator):
7287         (JSC::BlockAllocator::~BlockAllocator):
7288         (JSC::BlockAllocator::releaseFreeBlocks):
7289         (JSC::BlockAllocator::waitForRelativeTimeWhileHoldingLock):
7290         (JSC::BlockAllocator::waitForRelativeTime):
7291         (JSC::BlockAllocator::blockFreeingThreadMain):
7292         * heap/BlockAllocator.h:
7293         (BlockAllocator):
7294         (JSC::BlockAllocator::allocate):
7295         (JSC::BlockAllocator::deallocate): Use a spin lock for the common case
7296         where we're just popping a linked list. (A pthread mutex would sleep our
7297         thread even if the lock were only contended for a microsecond.)
7298
7299         Scope the lock to avoid holding it while allocating VM, since that's a
7300         slow activity and it doesn't modify any of our data structures.
7301
7302         We still use a pthread mutex to handle our condition variable since we
7303         have to, and it's not a hot path.
7304
7305         * heap/CopiedSpace.cpp:
7306         (JSC::CopiedSpace::CopiedSpace):
7307         (JSC::CopiedSpace::doneFillingBlock):
7308         * heap/CopiedSpace.h:
7309         (JSC::CopiedSpace::CopiedSpace): Use a spin lock for the to space lock,
7310         since it just guards linked list and hash table manipulation.
7311
7312         * heap/MarkStack.cpp:
7313         (JSC::MarkStackSegmentAllocator::MarkStackSegmentAllocator):
7314         (JSC::MarkStackSegmentAllocator::allocate):
7315         (JSC::MarkStackSegmentAllocator::release):
7316         (JSC::MarkStackSegmentAllocator::shrinkReserve): Use a spin lock, since
7317         we're just managing a linked list.
7318
7319         (JSC::MarkStackArray::donateSomeCellsTo): Changed donation to be proportional
7320         to our current stack size. This fixes cases where we used to donate too
7321         much. Interestingly, donating too much was starving the donor (when it
7322         ran out of work later) *and* the recipient (since it had to wait on a
7323         long donation operation to complete before it could acquire the lock).
7324
7325         In the worst case, we're still guaranteed to donate N cells in roughly log N time.
7326
7327         This change also fixes cases where we used to donate too little, since
7328         we would always keep a fixed minimum number of cells. In the worst case,
7329         with N marking threads, would could have N large object graph roots in
7330         our stack for the duration of GC, and scale to only 1 thread.
7331
7332         It's an interesting observation that a single object in the mark stack
7333         might represent an arbitrarily large object graph -- and only the act
7334         of marking can find out.
7335
7336         (JSC::MarkStackArray::stealSomeCellsFrom): Steal in proportion to idle
7337         threads. Once again, this fixes cases where constants could cause us
7338         to steal too much or too little.
7339
7340         (JSC::SlotVisitor::donateKnownParallel): Always wake up other threads
7341         if they're idle. We can afford to do this because we're conservative
7342         about when we donate.
7343
7344         (JSC::SlotVisitor::drainFromShared):
7345         * heap/MarkStack.h:
7346         (MarkStackSegmentAllocator):
7347         (MarkStackArray):
7348         (JSC):
7349         * heap/SlotVisitor.h: Merged the "should I donate?" decision into a
7350         single function, for simplicity.
7351
7352         * runtime/Options.cpp:
7353         (minimumNumberOfScansBetweenRebalance): Reduced the delay before donation
7354         a lot. We can afford to do this because, in the common case, donation is
7355         a single branch that decides not to donate.
7356
7357         (cpusToUse): Use more CPUs now, since we scale better now.
7358
7359         * runtime/Options.h:
7360         (Options): Removed now-unused variables.
7361
7362 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
7363
7364         REGRESSION(120121): inspector tests crash in DFG
7365         https://bugs.webkit.org/show_bug.cgi?id=88941
7366
7367         Reviewed by Geoffrey Garen.
7368
7369         The CFG simplifier has two different ways of fixing up GetLocal, Phantom, and Flush. If we've
7370         already fixed up the node one way, we shouldn't try the other way. The reason why we shouldn't
7371         is that the second way depends on the node referring to other nodes in the to-be-jettisoned
7372         block. After fixup they potentially will refer to nodes in the block being merged to.
7373
7374         * dfg/DFGCFGSimplificationPhase.cpp:
7375         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
7376         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
7377
7378 2012-06-12  Leo Yang  <leo.yang@torchmobile.com.cn>
7379
7380         Dynamic hash table in DOMObjectHashTableMap is wrong in multiple threads
7381         https://bugs.webkit.org/show_bug.cgi?id=87334
7382
7383         Reviewed by Geoffrey Garen.
7384
7385         Add a copy member function to JSC::HasTable. This function will copy all data
7386         members except for *table* which contains thread specific data that prevents
7387         up copying it. When you want to copy a JSC::HashTable that was constructed
7388         on another thread you should call JSC::HashTable::copy().
7389
7390         * runtime/Lookup.h:
7391         (JSC::HashTable::copy):
7392         (HashTable):
7393
7394 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
7395
7396         DFG should not ASSERT if you have a double use of a variable that is not revealed to be a double
7397         until after CFG simplification
7398         https://bugs.webkit.org/show_bug.cgi?id=88927
7399         <rdar://problem/11513971>
7400
7401         Reviewed by Geoffrey Garen.
7402
7403         Speculation fixup needs to run if simplification did things, because simplification can change
7404         predictions - particularly if you had a control flow path that stored weird things into a
7405         variable, but that path got axed by the simplifier.
7406
7407         Running fixup in the fixpoint requires making it idempotent, which it previously wasn't. Only
7408         one place needed to be changed, namely the un-MustGenerate-ion of ValueToInt32.
7409
7410         * dfg/DFGDriver.cpp:
7411         (JSC::DFG::compile):
7412         * dfg/DFGFixupPhase.cpp:
7413         (JSC::DFG::FixupPhase::fixupNode):
7414
7415 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
7416
7417         REGRESSION (r119779): Javascript TypeError: 'undefined' is not an object
7418         https://bugs.webkit.org/show_bug.cgi?id=88783
7419         <rdar://problem/11640299>
7420
7421         Reviewed by Geoffrey Garen.
7422
7423         If you don't keep alive the base of an object access over the various checks
7424         you do for the prototype chain, you're going to have a bad time.
7425
7426         * dfg/DFGByteCodeParser.cpp:
7427         (JSC::DFG::ByteCodeParser::handleGetById):
7428
7429 2012-06-12  Hojong Han  <hojong.han@samsung.com>
7430
7431         Property names of the built-in object cannot be retrieved
7432         after trying to delete one of its properties
7433         https://bugs.webkit.org/show_bug.cgi?id=86461
7434
7435         Reviewed by Gavin Barraclough.
7436
7437         * runtime/JSObject.cpp:
7438         (JSC::getClassPropertyNames):
7439         (JSC::JSObject::getOwnPropertyNames):
7440
7441 2012-06-11  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
7442
7443         [CMAKE][EFL] Remove duplicated executable output path
7444         https://bugs.webkit.org/show_bug.cgi?id=88765
7445
7446         Reviewed by Daniel Bates.
7447
7448         CMake files for EFL port have redefined executable output path. However, EFL port doesn't
7449         need to define again because it is already defined in top-level CMake file.
7450
7451         * shell/CMakeLists.txt:
7452
7453 2012-06-11  Carlos Garcia Campos  <cgarcia@igalia.com>
7454
7455         Unreviewed. Fix make distcheck issues.
7456
7457         * GNUmakefile.list.am: Remove non existent header file.
7458
7459 2012-06-10  Patrick Gansterer  <paroga@webkit.org>
7460
7461         Unreviewed. Build fix for !ENABLE(JIT) after r119844 and r119925.
7462
7463         * runtime/Executable.h:
7464         (ExecutableBase):
7465         (JSC::ExecutableBase::clearCodeVirtual):
7466
7467 2012-06-10  Patrick Gansterer  <paroga@webkit.org>
7468
7469         Unreviewed. Build fix for !ENABLE(JIT) after r119844.
7470
7471         * runtime/Executable.h:
7472         (ExecutableBase):
7473         (JSC):
7474
7475 2012-06-09  Dominic Cooney  <dominicc@chromium.org>
7476
7477         [Chromium] Remove JavaScriptCore dependencies from gyp
7478         https://bugs.webkit.org/show_bug.cgi?id=88510
7479
7480         Reviewed by Adam Barth.
7481
7482         Chromium doesn't support JSC any more and there doesn't seem to be
7483         a strong interest in using GYP as the common build system in other
7484         ports.
7485
7486         * JavaScriptCore.gyp/JavaScriptCore.gyp: WebCore still depends on YARR interpreter.
7487         * JavaScriptCore.gypi: Only include YARR source.
7488         * gyp/JavaScriptCore.gyp: Removed.
7489         * gyp/gtk.gyp: Removed.
7490
7491 2012-06-09  Geoffrey Garen  <ggaren@apple.com>
7492
7493         Unreviewed, rolling back in part2 of r118646.
7494
7495         This patch removes eager finalization.
7496
7497         Weak pointer finalization should be lazy
7498         https://bugs.webkit.org/show_bug.cgi?id=87599
7499
7500         Reviewed by Sam Weinig.
7501
7502         * heap/Heap.cpp:
7503         (JSC::Heap::collect): Don't finalize eagerly -- we'll do it lazily.
7504
7505         * heap/MarkedBlock.cpp:
7506         (JSC::MarkedBlock::sweep): Do sweep weak sets when sweeping a block,
7507         since we won't get another chance.
7508
7509         * heap/MarkedBlock.h:
7510         (JSC::MarkedBlock::sweepWeakSet):
7511         * heap/MarkedSpace.cpp:
7512         (MarkedSpace::WeakSetSweep):
7513         * heap/MarkedSpace.h:
7514         (JSC::MarkedSpace::sweepWeakSets): Removed now-unused code.
7515
7516 2012-06-09  Sukolsak Sakshuwong  <sukolsak@google.com>
7517
7518         Add UNDO_MANAGER flag
7519         https://bugs.webkit.org/show_bug.cgi?id=87908
7520
7521         Reviewed by Tony Chang.
7522
7523         * Configurations/FeatureDefines.xcconfig:
7524
7525 2012-06-08  Geoffrey Garen  <ggaren@apple.com>
7526
7527         Unreviewed, rolling back in part1 of r118646.
7528
7529         This patch includes everything necessary for lazy finalization, but
7530         keeps eager finalization enabled for the time being.
7531
7532         Weak pointer finalization should be lazy
7533         https://bugs.webkit.org/show_bug.cgi?id=87599
7534
7535         Reviewed by Sam Weinig.
7536
7537         * heap/MarkedBlock.cpp:
7538         * heap/MarkedBlock.h:
7539         (JSC::MarkedBlock::resetAllocator):
7540         * heap/MarkedSpace.cpp:
7541         (JSC::MarkedSpace::resetAllocators):
7542         * heap/MarkedSpace.h:
7543         (JSC::MarkedSpace::resetAllocators): Don't force allocator reset anymore.
7544         It will happen automatically when a weak set is swept. It's simpler to
7545         have only one canonical way for this to happen, and it wasn't buying
7546         us anything to do it eagerly.
7547         * heap/WeakBlock.cpp:
7548         (JSC::WeakBlock::sweep): Don't short-circuit a sweep unless we know
7549         the sweep would be a no-op. If even one finalizer is pending, we need to
7550         run it, since we won't get another chance.
7551         * heap/WeakSet.cpp:
7552         (JSC::WeakSet::sweep): This loop can be simpler now that
7553         WeakBlock::sweep() does what we mean.
7554         Reset our allocator after a sweep because this is the optimal time to
7555         start trying to recycle old weak pointers.
7556         (JSC::WeakSet::tryFindAllocator): Don't sweep when searching for an
7557         allocator because we've swept already, and forcing a new sweep would be
7558         wasteful.
7559         * heap/WeakSet.h:
7560         (JSC::WeakSet::shrink): Be sure to reset our allocator after a shrink
7561         because the shrink may have removed the block the allocator was going to
7562         allocate out of.
7563
7564 2012-06-08  Gavin Barraclough  <barraclough@apple.com>
7565
7566         Unreviewed roll out r119795.
7567
7568         This broke jquery/core.html
7569
7570         * dfg/DFGSpeculativeJIT.h:
7571         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
7572         * jit/JITInlineMethods.h:
7573         (JSC::JIT::emitAllocateBasicJSObject):
7574         * llint/LowLevelInterpreter.asm:
7575         * runtime/JSGlobalData.h:
7576         (JSGlobalData):
7577         * runtime/JSGlobalThis.cpp:
7578         (JSC::JSGlobalThis::setUnwrappedObject):
7579         * runtime/JSObject.cpp:
7580         (JSC::JSObject::visitChildren):
7581         (JSC::JSObject::createInheritorID):
7582         * runtime/JSObject.h:
7583         (JSObject):
7584         (JSC::JSObject::resetInheritorID):
7585         (JSC):
7586         (JSC::JSObject::offsetOfInheritorID):
7587         (JSC::JSObject::inheritorID):
7588
7589 2012-06-08  Filip Pizlo  <fpizlo@apple.com>
7590
7591         PredictedType should be called SpeculatedType
7592         https://bugs.webkit.org/show_bug.cgi?id=88477
7593
7594         Unreviewed, fix a renaming goof from http://trac.webkit.org/changeset/119660.
7595         I accidentally renamed ByteCodeParser::getPrediction to
7596         ByteCodeParser::getSpeculation.  That was not the intent. This changes it
7597         back.
7598
7599         * dfg/DFGByteCodeParser.cpp:
7600         (JSC::DFG::ByteCodeParser::addCall):
7601         (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
7602         (JSC::DFG::ByteCodeParser::getPrediction):
7603         (JSC::DFG::ByteCodeParser::handleCall):
7604         (JSC::DFG::ByteCodeParser::parseBlock):
7605
7606 2012-06-08  Andy Wingo  <wingo@igalia.com>
7607
7608         Explictly mark stubs called by JIT as being internal
7609         https://bugs.webkit.org/show_bug.cgi?id=88552
7610
7611         Reviewed by Filip Pizlo.
7612
7613         * dfg/DFGOSRExitCompiler.h:
7614         * dfg/DFGOperations.cpp:
7615         * dfg/DFGOperations.h:
7616         * jit/HostCallReturnValue.h:
7617         * jit/JITStubs.cpp:
7618         * jit/JITStubs.h:
7619         * jit/ThunkGenerators.cpp:
7620         * llint/LLIntSlowPaths.h: Mark a bunch of stubs as being
7621         WTF_INTERNAL.  Change most calls to SYMBOL_STRING_RELOCATION to
7622         LOCAL_REFERENCE, or GLOBAL_REFERENCE in the case of the wrappers
7623         to truly global symbols.
7624         * offlineasm/asm.rb: Generate LOCAL_REFERENCE instead of
7625         SYMBOL_STRING_RELOCATION.
7626
7627 2012-06-08  Geoffrey Garen  <ggaren@apple.com>
7628
7629         Don't rely on weak pointers for eager CodeBlock finalization
7630         https://bugs.webkit.org/show_bug.cgi?id=88465
7631
7632         Reviewed by Gavin Barraclough.
7633
7634         This is incompatible with lazy weak pointer finalization.
7635
7636         I considered just making CodeBlock finalization lazy-friendly, but it
7637         turns out that the heap is already way up in CodeBlock's business when
7638         it comes to finalization, so I decided to finish the job and move full
7639         responsibility for CodeBlock finalization into the heap.
7640
7641         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Maybe this
7642         will build.
7643
7644         * debugger/Debugger.cpp: Updated for rename.
7645
7646         * heap/Heap.cpp:
7647         (JSC::Heap::deleteAllCompiledCode): Renamed for consistency. Fixed a bug
7648         where we would not delete code for a code block that had been previously
7649         jettisoned. I don't know if this happens in practice -- I mostly did
7650         this to improve consistency with deleteUnmarkedCompiledCode.
7651
7652         (JSC::Heap::deleteUnmarkedCompiledCode): New function, responsible for
7653         eager finalization of unmarked code blocks.
7654
7655         (JSC::Heap::collect): Updated for rename. Updated to call
7656         deleteUnmarkedCompiledCode(), which takes care of jettisoned DFG code
7657         blocks too.
7658
7659         (JSC::Heap::addCompiledCode): Renamed, since this points to all code
7660         now, not just functions.
7661
7662         * heap/Heap.h:
7663         (Heap): Keep track of all user code, not just functions. This is a
7664         negligible additional overhead, since most code is function code.
7665
7666         * runtime/Executable.cpp:
7667         (JSC::*::finalize): Removed these functions, since we don't rely on
7668         weak pointer finalization anymore.
7669
7670         (JSC::FunctionExecutable::FunctionExecutable): Moved linked-list stuff
7671         into base class so all executables can be in the list.
7672
7673         (JSC::EvalExecutable::clearCode):
7674         (JSC::ProgramExecutable::clearCode):
7675         (JSC::FunctionExecutable::clearCode): All we need to do is delete our
7676         CodeBlock -- that will delete all of its internal data structures.
7677
7678         (JSC::FunctionExecutable::clearCodeIfNotCompiling): Factored out a helper
7679         function to improve clarity.
7680
7681         * runtime/Executable.h:
7682         (JSC::ExecutableBase): Moved linked-list stuff
7683         into base class so all executables can be in the list.
7684
7685         (JSC::NativeExecutable::create):
7686         (NativeExecutable):
7687         (ScriptExecutable):
7688         (JSC::ScriptExecutable::finishCreation):
7689         (JSC::EvalExecutable::create):
7690         (EvalExecutable):
7691         (JSC::ProgramExecutable::create):
7692         (ProgramExecutable):
7693         (FunctionExecutable):
7694         (JSC::FunctionExecutable::create): Don't use a finalizer -- the heap
7695         will call us back to destroy our code block.
7696
7697         (JSC::FunctionExecutable::discardCode): Renamed to clearCodeIfNotCompiling()
7698         for clarity.
7699
7700         (JSC::FunctionExecutable::isCompiling): New helper function, for clarity.
7701
7702         (JSC::ScriptExecutable::clearCodeVirtual): New helper function, since
7703         the heap needs to make polymorphic calls to clear code.
7704
7705         * runtime/JSGlobalData.cpp:
7706         (JSC::StackPreservingRecompiler::operator()):
7707         * runtime/JSGlobalObject.cpp:
7708         (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Updated for
7709         renames.
7710
7711 2012-06-07  Filip Pizlo  <fpizlo@apple.com>
7712
7713         DFG should inline prototype chain accesses, and do the right things if the
7714         specific function optimization is available
7715         https://bugs.webkit.org/show_bug.cgi?id=88594
7716
7717         Reviewed by Gavin Barraclough.
7718
7719         Looks like a 3% win on V8.
7720
7721         * bytecode/CodeBlock.h:
7722         (JSC::Structure::prototypeForLookup):
7723         (JSC):
7724         * bytecode/GetByIdStatus.cpp:
7725         (JSC::GetByIdStatus::computeFromLLInt):
7726         (JSC):
7727         (JSC::GetByIdStatus::computeForChain):
7728         (JSC::GetByIdStatus::computeFor):
7729         * bytecode/GetByIdStatus.h:
7730         (JSC::GetByIdStatus::GetByIdStatus):
7731         (JSC::GetByIdStatus::isSimple):
7732         (JSC::GetByIdStatus::chain):
7733         (JSC::GetByIdStatus::specificValue):
7734         (GetByIdStatus):
7735         * bytecode/StructureSet.h:
7736         (StructureSet):
7737         (JSC::StructureSet::singletonStructure):
7738         * bytecode/StructureStubInfo.h:
7739         (JSC::StructureStubInfo::initGetByIdProto):
7740         (JSC::StructureStubInfo::initGetByIdChain):
7741         * dfg/DFGByteCodeParser.cpp:
7742         (JSC::DFG::ByteCodeParser::handleGetById):
7743         * dfg/DFGRepatch.cpp:
7744         (JSC::DFG::tryCacheGetByID):
7745         * jit/JITStubs.cpp:
7746         (JSC::JITThunks::tryCacheGetByID):
7747         * runtime/JSGlobalObject.h:
7748         (JSC::Structure::prototypeForLookup):
7749         (JSC):
7750         * runtime/Structure.h:
7751         (Structure):
7752
7753 2012-06-07  Gavin Barraclough  <barraclough@apple.com>
7754
7755         Remove JSObject::m_inheritorID
7756         https://bugs.webkit.org/show_bug.cgi?id=88378
7757
7758         Reviewed by Geoff Garen.
7759
7760         This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
7761         and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
7762         Instead use a private named value in the object's property storage.
7763
7764         * dfg/DFGSpeculativeJIT.h:
7765         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
7766             - No need m_inheritorID to initialize!
7767         * jit/JITInlineMethods.h:
7768         (JSC::JIT::emitAllocateBasicJSObject):
7769             - No need m_inheritorID to initialize!
7770         * llint/LowLevelInterpreter.asm:
7771             - No need m_inheritorID to initialize!
7772         * runtime/JSGlobalData.h:
7773         (JSGlobalData):
7774             - Added private name 'm_inheritorIDKey'.
7775         * runtime/JSGlobalThis.cpp:
7776         (JSC::JSGlobalThis::setUnwrappedObject):
7777             - resetInheritorID is now passed a JSGlobalData&.
7778         * runtime/JSObject.cpp:
7779         (JSC::JSObject::visitChildren):
7780             - No m_inheritorID to be marked.
7781         (JSC::JSObject::createInheritorID):
7782             - Store the newly created inheritorID in the property map.
7783         * runtime/JSObject.h:
7784         (JSC::JSObject::resetInheritorID):
7785             - Remove the inheritorID from property storage.
7786         (JSC::JSObject::inheritorID):
7787             - Read the inheritorID from property storage.
7788
7789 2012-06-07  Gavin Barraclough  <barraclough@apple.com>
7790
7791         Math.pow on iOS does not support denormal numbers.
7792         https://bugs.webkit.org/show_bug.cgi?id=88592
7793
7794         Reviewed by Filip Pizlo.
7795
7796         Import an implementation from fdlibm, detect cases where it is safe to use the system
7797         implementation & where we should fall back to fdlibm.
7798
7799         * runtime/MathObject.cpp:
7800         (JSC::isDenormal):
7801         (JSC::isEdgeCase):
7802         (JSC::mathPow):
7803             - On iOS, detect cases where denormal support may be required & use fdlibm in these cases.
7804         (JSC::mathProtoFuncPow):
7805             - Changed to use mathPow.
7806         (JSC::fdlibmScalbn):
7807         (JSC::fdlibmPow):
7808             - These functions imported from fdlibm; original style retained to ease future merging.
7809
7810 2012-06-07  Patrick Gansterer  <paroga@webkit.org>
7811
7812         Unreviewed. Build fix for !ENABLE(JIT) after r119441.
7813
7814         * interpreter/Interpreter.cpp:
7815         (JSC::Interpreter::privateExecute):
7816
7817 2012-06-07  Andy Wingo  <wingo@igalia.com>
7818
7819         Unreviewed build fix after r119593.
7820
7821         * llint/LLIntOfflineAsmConfig.h (OFFLINE_ASM_GLOBAL_LABEL): Fix
7822         uses of "name" to be "label", the macro's parameter.  Otherwise we
7823         serialize mentions of the literal symbol "name" into the objcode.
7824         Causes a build error using GNU ld (not gold).
7825
7826 2012-06-06  Ryosuke Niwa  <rniwa@webkit.org>
7827
7828         Chromium build fix attempt. Why do we need to list these files in gyp!?
7829
7830         * JavaScriptCore.gypi:
7831
7832 2012-06-06  Filip Pizlo  <fpizlo@apple.com>
7833
7834         PredictedType should be called SpeculatedType
7835         https://bugs.webkit.org/show_bug.cgi?id=88477
7836
7837         Rubber stamped by Gavin Barraclough.
7838
7839         * CMakeLists.txt:
7840         * GNUmakefile.list.am:
7841         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
7842         * JavaScriptCore.xcodeproj/project.pbxproj:
7843         * Target.pri:
7844         * bytecode/CodeBlock.cpp:
7845         (JSC::CodeBlock::shouldOptimizeNow):
7846         (JSC::CodeBlock::dumpValueProfiles):
7847         * bytecode/CodeBlock.h:
7848         (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
7849         * bytecode/LazyOperandValueProfile.cpp:
7850         (JSC::LazyOperandValueProfileParser::prediction):
7851         * bytecode/LazyOperandValueProfile.h:
7852         (LazyOperandValueProfileParser):
7853         * bytecode/PredictedType.cpp: Removed.
7854         * bytecode/PredictedType.h: Removed.
7855         * bytecode/SpeculatedType.cpp: Copied from Source/JavaScriptCore/bytecode/PredictedType.cpp.
7856         (JSC::speculationToString):
7857         (JSC::speculationToAbbreviatedString):
7858         (JSC::speculationFromClassInfo):
7859         (JSC::speculationFromStructure):
7860         (JSC::speculationFromCell):
7861         (JSC::speculationFromValue):
7862         * bytecode/SpeculatedType.h: Copied from Source/JavaScriptCore/bytecode/PredictedType.h.
7863         (JSC):
7864         (JSC::isAnySpeculation):
7865         (JSC::isCellSpeculation):
7866         (JSC::isObjectSpeculation):
7867         (JSC::isFinalObjectSpeculation):
7868         (JSC::isFinalObjectOrOtherSpeculation):
7869         (JSC::isFixedIndexedStorageObjectSpeculation):
7870         (JSC::isStringSpeculation):
7871         (JSC::isArraySpeculation):
7872         (JSC::isFunctionSpeculation):
7873         (JSC::isInt8ArraySpeculation):
7874         (JSC::isInt16ArraySpeculation):
7875         (JSC::isInt32ArraySpeculation):
7876         (JSC::isUint8ArraySpeculation):
7877         (JSC::isUint8ClampedArraySpeculation):
7878         (JSC::isUint16ArraySpeculation):
7879         (JSC::isUint32ArraySpeculation):
7880         (JSC::isFloat32ArraySpeculation):
7881         (JSC::isFloat64ArraySpeculation):
7882         (JSC::isArgumentsSpeculation):
7883         (JSC::isActionableIntMutableArraySpeculation):
7884         (JSC::isActionableFloatMutableArraySpeculation):
7885         (JSC::isActionableTypedMutableArraySpeculation):
7886         (JSC::isActionableMutableArraySpeculation):
7887         (JSC::isActionableArraySpeculation):
7888         (JSC::isArrayOrOtherSpeculation):
7889         (JSC::isMyArgumentsSpeculation):
7890         (JSC::isInt32Speculation):
7891         (JSC::isDoubleRealSpeculation):
7892         (JSC::isDoubleSpeculation):
7893         (JSC::isNumberSpeculation):
7894         (JSC::isBooleanSpeculation):
7895         (JSC::isOtherSpeculation):
7896         (JSC::isEmptySpeculation):
7897         (JSC::mergeSpeculations):
7898         (JSC::mergeSpeculation):
7899         * bytecode/StructureSet.h:
7900         (JSC::StructureSet::speculationFromStructures):
7901         * bytecode/ValueProfile.h:
7902         (JSC::ValueProfileBase::ValueProfileBase):
7903         (JSC::ValueProfileBase::dump):
7904         (JSC::ValueProfileBase::computeUpdatedPrediction):
7905         (ValueProfileBase):
7906         * dfg/DFGAbstractState.cpp:
7907         (JSC::DFG::AbstractState::initialize):
7908         (JSC::DFG::AbstractState::execute):
7909         (JSC::DFG::AbstractState::mergeStateAtTail):
7910         * dfg/DFGAbstractState.h:
7911         (JSC::DFG::AbstractState::speculateInt32Unary):
7912         (JSC::DFG::AbstractState::speculateNumberUnary):
7913         (JSC::DFG::AbstractState::speculateBooleanUnary):
7914         (JSC::DFG::AbstractState::speculateInt32Binary):
7915         (JSC::DFG::AbstractState::speculateNumberBinary):
7916         * dfg/DFGAbstractValue.h:
7917         (JSC::DFG::StructureAbstractValue::filter):
7918         (JSC::DFG::StructureAbstractValue::speculationFromStructures):
7919         (JSC::DFG::AbstractValue::AbstractValue):
7920         (JSC::DFG::AbstractValue::clear):
7921         (JSC::DFG::AbstractValue::isClear):
7922         (JSC::DFG::AbstractValue::makeTop):
7923         (JSC::DFG::AbstractValue::clobberStructures):
7924         (JSC::DFG::AbstractValue::isTop):
7925         (JSC::DFG::AbstractValue::set):
7926         (JSC::DFG::AbstractValue::merge):
7927         (JSC::DFG::AbstractValue::filter):
7928         (JSC::DFG::AbstractValue::validateIgnoringValue):
7929         (JSC::DFG::AbstractValue::validate):
7930         (JSC::DFG::AbstractValue::checkConsistency):
7931         (JSC::DFG::AbstractValue::dump):
7932         (AbstractValue):
7933         * dfg/DFGArgumentPosition.h:
7934         (JSC::DFG::ArgumentPosition::ArgumentPosition):
7935         (JSC::DFG::ArgumentPosition::mergeArgumentAwareness):
7936         (JSC::DFG::ArgumentPosition::prediction):
7937         (ArgumentPosition):
7938         * dfg/DFGArgumentsSimplificationPhase.cpp:
7939         (JSC::DFG::ArgumentsSimplificationPhase::run):
7940         * dfg/DFGByteCodeParser.cpp:
7941         (ByteCodeParser):
7942         (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
7943         (JSC::DFG::ByteCodeParser::getLocal):
7944         (JSC::DFG::ByteCodeParser::getArgument):
7945         (JSC::DFG::ByteCodeParser::addCall):
7946         (JSC::DFG::ByteCodeParser::getSpeculationWithoutOSRExit):
7947         (JSC::DFG::ByteCodeParser::getSpeculation):
7948         (InlineStackEntry):
7949         (JSC::DFG::ByteCodeParser::handleCall):
7950         (JSC::DFG::ByteCodeParser::handleIntrinsic):
7951         (JSC::DFG::ByteCodeParser::handleGetById):
7952         (JSC::DFG::ByteCodeParser::parseBlock):
7953         (JSC::DFG::ByteCodeParser::fixVariableAccessSpeculations):
7954         (JSC::DFG::ByteCodeParser::parse):
7955         * dfg/DFGCSEPhase.cpp:
7956         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
7957         (JSC::DFG::CSEPhase::performNodeCSE):
7958         * dfg/DFGConstantFoldingPhase.cpp:
7959         (JSC::DFG::ConstantFoldingPhase::run):
7960         * dfg/DFGFixupPhase.cpp:
7961         (JSC::DFG::FixupPhase::fixupNode):
7962         (JSC::DFG::FixupPhase::fixDoubleEdge):
7963         * dfg/DFGGraph.cpp:
7964         (JSC::DFG::Graph::nameOfVariableAccessData):
7965         (JSC::DFG::Graph::dump):
7966         (JSC::DFG::Graph::predictArgumentTypes):
7967         * dfg/DFGGraph.h:
7968         (JSC::DFG::Graph::getJSConstantSpeculation):
7969         (JSC::DFG::Graph::isPredictedNumerical):
7970         (JSC::DFG::Graph::byValIsPure):
7971         * dfg/DFGJITCompiler.h:
7972         (JSC::DFG::JITCompiler::getSpeculation):
7973         * dfg/DFGNode.h:
7974         (JSC::DFG::Node::Node):
7975         (JSC::DFG::Node::getHeapPrediction):
7976         (JSC::DFG::Node::predictHeap):
7977         (JSC::DFG::Node::prediction):
7978         (JSC::DFG::Node::predict):
7979         (JSC::DFG::Node::shouldSpeculateInteger):
7980         (JSC::DFG::Node::shouldSpeculateDouble):
7981         (JSC::DFG::Node::shouldSpeculateNumber):
7982         (JSC::DFG::Node::shouldSpeculateBoolean):
7983         (JSC::DFG::Node::shouldSpeculateFinalObject):
7984         (JSC::DFG::Node::shouldSpeculateFinalObjectOrOther):
7985         (JSC::DFG::Node::shouldSpeculateArray):
7986         (JSC::DFG::Node::shouldSpeculateArguments):
7987         (JSC::DFG::Node::shouldSpeculateInt8Array):
7988         (JSC::DFG::Node::shouldSpeculateInt16Array):
7989         (JSC::DFG::Node::shouldSpeculateInt32Array):
7990         (JSC::DFG::Node::shouldSpeculateUint8Array):
7991         (JSC::DFG::Node::shouldSpeculateUint8ClampedArray):
7992         (JSC::DFG::Node::shouldSpeculateUint16Array):
7993         (JSC::DFG::Node::shouldSpeculateUint32Array):
7994         (JSC::DFG::Node::shouldSpeculateFloat32Array):
7995         (JSC::DFG::Node::shouldSpeculateFloat64Array):
7996         (JSC::DFG::Node::shouldSpeculateArrayOrOther):
7997         (JSC::DFG::Node::shouldSpeculateObject):
7998         (JSC::DFG::Node::shouldSpeculateCell):
7999         (Node):
8000         * dfg/DFGPredictionPropagationPhase.cpp:
8001         (JSC::DFG::PredictionPropagationPhase::setPrediction):
8002         (JSC::DFG::PredictionPropagationPhase::mergePrediction):
8003         (JSC::DFG::PredictionPropagationPhase::propagate):
8004         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
8005         * dfg/DFGSpeculativeJIT.cpp:
8006         (JSC::DFG::SpeculativeJIT::fillStorage):
8007         (JSC::DFG::SpeculativeJIT::writeBarrier):
8008         (JSC::DFG::GPRTemporary::GPRTemporary):
8009         (JSC::DFG::FPRTemporary::FPRTemporary):
8010         (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
8011         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
8012         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
8013         (JSC::DFG::SpeculativeJIT::compile):
8014         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
8015         (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
8016         (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
8017         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
8018         (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
8019         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
8020         (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLength):
8021         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
8022         (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
8023         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
8024         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
8025         (JSC::DFG::SpeculativeJIT::compileInstanceOf):
8026         (JSC::DFG::SpeculativeJIT::compileAdd):
8027         (JSC::DFG::SpeculativeJIT::compileArithSub):
8028         (JSC::DFG::SpeculativeJIT::compileArithNegate):
8029         (JSC::DFG::SpeculativeJIT::compileArithMul):
8030         (JSC::DFG::SpeculativeJIT::compileArithMod):
8031         (JSC::DFG::SpeculativeJIT::compare):
8032         (JSC::DFG::SpeculativeJIT::compileStrictEq):
8033         (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
8034         (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
8035         (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
8036         (JSC::DFG::SpeculativeJIT::compileRegExpExec):
8037         * dfg/DFGSpeculativeJIT.h:
8038         (DFG):
8039         (JSC::DFG::ValueSource::forSpeculation):
8040         (SpeculativeJIT):
8041         (GPRTemporary):
8042         (FPRTemporary):
8043         (JSC::DFG::SpecDoubleOperand::SpecDoubleOperand):
8044         (JSC::DFG::SpecDoubleOperand::~SpecDoubleOperand):
8045         (JSC::DFG::SpecDoubleOperand::fpr):
8046         (JSC::DFG::SpecCellOperand::SpecCellOperand):
8047         (JSC::DFG::SpecCellOperand::~SpecCellOperand):
8048         (JSC::DFG::SpecCellOperand::gpr):
8049         (JSC::DFG::SpecBooleanOperand::SpecBooleanOperand):
8050         (JSC::DFG::SpecBooleanOperand::~SpecBooleanOperand):
8051         (JSC::DFG::SpecBooleanOperand::gpr):
8052         * dfg/DFGSpeculativeJIT32_64.cpp:
8053         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
8054         (JSC::DFG::SpeculativeJIT::fillSpecDouble):
8055         (JSC::DFG::SpeculativeJIT::fillSpecCell):
8056         (JSC::DFG::SpeculativeJIT::fillSpecBoolean):
8057         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
8058         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
8059         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
8060         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
8061         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
8062         (JSC::DFG::SpeculativeJIT::emitBranch):
8063         (JSC::DFG::SpeculativeJIT::compile):
8064         * dfg/DFGSpeculativeJIT64.cpp:
8065         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
8066         (JSC::DFG::SpeculativeJIT::fillSpecDouble):
8067         (JSC::DFG::SpeculativeJIT::fillSpecCell):
8068         (JSC::DFG::SpeculativeJIT::fillSpecBoolean):
8069         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
8070         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
8071         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
8072         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
8073         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
8074         (JSC::DFG::SpeculativeJIT::emitBranch):
8075         (JSC::DFG::SpeculativeJIT::compile):
8076         * dfg/DFGVariableAccessData.h:
8077         (JSC::DFG::VariableAccessData::VariableAccessData):
8078         (JSC::DFG::VariableAccessData::predict):
8079         (JSC::DFG::VariableAccessData::nonUnifiedPrediction):
8080         (JSC::DFG::VariableAccessData::prediction):
8081         (JSC::DFG::VariableAccessData::argumentAwarePrediction):
8082         (JSC::DFG::VariableAccessData::mergeArgumentAwarePrediction):
8083         (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
8084         (JSC::DFG::VariableAccessData::makePredictionForDoubleFormat):
8085         (VariableAccessData):
8086
8087 2012-06-06  Filip Pizlo  <fpizlo@apple.com>
8088
8089         Global object variable accesses should not require an extra load
8090         https://bugs.webkit.org/show_bug.cgi?id=88385
8091
8092         Reviewed by Gavin Barraclough and Geoffrey Garen.
8093
8094         Previously, if you wanted to access a global variable, you'd first have
8095         to load the register array from the appropriate global object and then
8096         either load or store at an offset to the register array. This is because
8097         JSGlobalObject inherited from JSVariableObject, and JSVariableObject is
8098         designed with the pessimistic assumption that its register array may
8099         point into the call stack. This is never the case for global objects.
8100         Hence, even though the global object may add more registers at any time,
8101         it does not need to store them in a contiguous array. It can use a
8102         SegmentedVector or similar.
8103
8104         This patch refactors global objects and variable objects as follows:
8105
8106         - The functionality to track variables in an indexable array using a
8107           SymbolTable to map names to indices is moved into JSSymbolTableObject,
8108           which is now a supertype of JSVariableObject. JSVariableObject is now
8109           just a holder for a registers array and implements the registerAt()
8110           method that is left abstract in JSSymbolTableObject. Because all users
8111           of JSVariableObject know whether they are a JSStaticScopeObject,
8112           JSActivation, or JSGlobalObject, this "abstract" method is not virtual;
8113           instead the utility methods that would call registerAt() are now
8114           template functions that require you to know statically what subtype of
8115           JSSymbolTableObject you're using (JSVariableObject or something else),
8116           so that registerAt() can be statically bound.
8117
8118         - A new class is added called JSSegmentedVariableObject, which only
8119           differs from JSVariableObject in how it allocates registers. It uses a
8120           SegmentedVector instead of manually managing a pointer to a contiguous
8121           slab of registers. This changes the interface somewhat; for example
8122           with JSVariableObject if you wanted to add a register you had to do
8123           it yourself since the JSVariableObject didn't know how the registers
8124           array ought to be allocated. With JSSegmentedVariableObject you can
8125           just call addRegisters(). JSSegmentedVariableObject preserves the
8126           invariant that once you get a pointer into a register, that pointer
8127           will continue to be valid so long as the JSSegmentedVariableObject is
8128           alive. This allows the JITs and interpreters to skip the extra load.
8129
8130         - JSGlobalObject now inherits from JSSegmentedVariableObject. For now
8131           (and possibly forever) it is the only subtype of this new class.
8132
8133         - The bytecode format is changed so that get_global_var and
8134           put_global_var have a pointer to the register directly rather than
8135           having an index. A convenience method is provided in
8136           JSSegmentedVariableObject to get the index given a a pointer, which is
8137           used for assertions and debug dumps.
8138
8139         This appears to be a 1% across the board win.
8140
8141         * CMakeLists.txt:
8142         * GNUmakefile.list.am:
8143         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
8144         * JavaScriptCore.xcodeproj/project.pbxproj:
8145         * Target.pri:
8146         * bytecode/CodeBlock.cpp:
8147         (JSC::CodeBlock::dump):
8148         * bytecode/Instruction.h:
8149         (Instruction):
8150         (JSC::Instruction::Instruction):
8151         * bytecompiler/BytecodeGenerator.cpp:
8152         (JSC::ResolveResult::registerPointer):
8153         (JSC):
8154         (JSC::BytecodeGenerator::BytecodeGenerator):
8155         (JSC::BytecodeGenerator::retrieveLastUnaryOp):
8156         (JSC::BytecodeGenerator::resolve):
8157         (JSC::BytecodeGenerator::resolveConstDecl):
8158         (JSC::BytecodeGenerator::emitGetStaticVar):
8159         (JSC::BytecodeGenerator::emitPutStaticVar):
8160         * bytecompiler/BytecodeGenerator.h:
8161         (ResolveResult):
8162         (BytecodeGenerator):
8163         * dfg/DFGAssemblyHelpers.h:
8164         (AssemblyHelpers):
8165         * dfg/DFGByteCodeParser.cpp:
8166         (JSC::DFG::ByteCodeParser::parseBlock):
8167         * dfg/DFGCSEPhase.cpp:
8168         (JSC::DFG::CSEPhase::globalVarLoadElimination):
8169         (JSC::DFG::CSEPhase::globalVarStoreElimination):
8170         (JSC::DFG::CSEPhase::performNodeCSE):
8171         * dfg/DFGGraph.cpp:
8172         (JSC::DFG::Graph::dump):
8173         * dfg/DFGGraph.h:
8174         (JSC::DFG::Graph::globalObjectFor):
8175         (Graph):
8176         * dfg/DFGNode.h:
8177         (JSC::DFG::Node::hasVarNumber):
8178         (Node):
8179         (JSC::DFG::Node::hasRegisterPointer):
8180         (JSC::DFG::Node::registerPointer):
8181         * dfg/DFGSpeculativeJIT32_64.cpp:
8182         (JSC::DFG::SpeculativeJIT::compile):
8183         * dfg/DFGSpeculativeJIT64.cpp:
8184         (JSC::DFG::SpeculativeJIT::compile):
8185         * heap/Heap.h:
8186         (Heap):
8187         (JSC::Heap::isWriteBarrierEnabled):
8188         (JSC):
8189         * interpreter/Interpreter.cpp:
8190         (JSC::Interpreter::execute):
8191         (JSC::Interpreter::privateExecute):
8192         * jit/JITPropertyAccess.cpp:
8193         (JSC::JIT::emit_op_get_global_var):
8194         (JSC::JIT::emit_op_put_global_var):
8195         * jit/JITPropertyAccess32_64.cpp:
8196         (JSC::JIT::emit_op_get_global_var):
8197         (JSC::JIT::emit_op_put_global_var):
8198         * llint/LowLevelInterpreter32_64.asm:
8199         * llint/LowLevelInterpreter64.asm:
8200         * runtime/JSGlobalObject.cpp:
8201         (JSC):
8202         (JSC::JSGlobalObject::put):
8203         (JSC::JSGlobalObject::putDirectVirtual):
8204         (JSC::JSGlobalObject::defineOwnProperty):
8205         (JSC::JSGlobalObject::visitChildren):
8206         (JSC::JSGlobalObject::addStaticGlobals):
8207         (JSC::JSGlobalObject::getOwnPropertySlot):
8208         (JSC::JSGlobalObject::getOwnPropertyDescriptor):
8209         * runtime/JSGlobalObject.h:
8210         (JSGlobalObject):
8211         (JSC::JSGlobalObject::JSGlobalObject):
8212         (JSC):
8213         (JSC::JSGlobalObject::hasOwnPropertyForWrite):
8214         * runtime/JSSegmentedVariableObject.cpp: Added.
8215         (JSC):
8216         (JSC::JSSegmentedVariableObject::findRegisterIndex):
8217         (JSC::JSSegmentedVariableObject::addRegisters):
8218         (JSC::JSSegmentedVariableObject::visitChildren):
8219         * runtime/JSSegmentedVariableObject.h: Added.
8220         (JSC):
8221         (JSSegmentedVariableObject):
8222         (JSC::JSSegmentedVariableObject::registerAt):
8223         (JSC::JSSegmentedVariableObject::assertRegisterIsInThisObject):
8224         (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
8225         (JSC::JSSegmentedVariableObject::finishCreation):
8226         * runtime/JSStaticScopeObject.cpp:
8227         (JSC::JSStaticScopeObject::put):
8228         (JSC::JSStaticScopeObject::putDirectVirtual):
8229         (JSC::JSStaticScopeObject::getOwnPropertySlot):
8230         * runtime/JSSymbolTableObject.cpp: Added.
8231         (JSC):
8232         (JSC::JSSymbolTableObject::destroy):
8233         (JSC::JSSymbolTableObject::deleteProperty):
8234         (JSC::JSSymbolTableObject::getOwnPropertyNames):
8235         (JSC::JSSymbolTableObject::putDirectVirtual):
8236         (JSC::JSSymbolTableObject::isDynamicScope):
8237         * runtime/JSSymbolTableObject.h: Added.
8238         (JSC):
8239         (JSSymbolTableObject):
8240         (JSC::JSSymbolTableObject::symbolTable):
8241         (JSC::JSSymbolTableObject::JSSymbolTableObject):
8242         (JSC::JSSymbolTableObject::finishCreation):
8243         (JSC::symbolTableGet):
8244         (JSC::symbolTablePut):
8245         (JSC::symbolTablePutWithAttributes):
8246         * runtime/JSVariableObject.cpp:
8247         (JSC):
8248         * runtime/JSVariableObject.h:
8249         (JSVariableObject):
8250         (JSC::JSVariableObject::JSVariableObject):
8251         (JSC::JSVariableObject::finishCreation):
8252         (JSC):
8253         * runtime/WriteBarrier.h:
8254
8255 2012-06-06  Filip Pizlo  <fpizlo@apple.com>
8256
8257         DFG arguments access slow path should not crash if the arguments haven't been created
8258         https://bugs.webkit.org/show_bug.cgi?id=88471
8259
8260         Reviewed by Gavin Barraclough.
8261
8262         * dfg/DFGCCallHelpers.h:
8263         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
8264         (CCallHelpers):
8265         * dfg/DFGOperations.cpp:
8266         * dfg/DFGOperations.h:
8267         * dfg/DFGSpeculativeJIT.h:
8268         (JSC::DFG::SpeculativeJIT::callOperation):
8269         * dfg/DFGSpeculativeJIT32_64.cpp:
8270         (JSC::DFG::SpeculativeJIT::compile):
8271         * dfg/DFGSpeculativeJIT64.cpp:
8272         (JSC::DFG::SpeculativeJIT::compile):
8273
8274 2012-06-06  Michael Saboff  <msaboff@apple.com>
8275
8276         ENH: Add Logging to GC Marking Phase
8277         https://bugs.webkit.org/show_bug.cgi?id=88364
8278
8279         Reviewed by Filip Pizlo.
8280
8281         Log GC marking to stderr or a file.  The logging in controlled
8282         with the define ENABLE_OBJECT_MARK_LOGGING in wtf/Platform.h.
8283         If DATA_LOG_TO_FILE in wtf/DataLog.cpp is set to 1, output is
8284         logged to a file otherwise it is logged to stderr.
8285
8286         When logging is enabled, the GC is built single threaded since the
8287         log output from the various threads isn't buffered and output in a
8288         thread safe manner.
8289
8290         * heap/Heap.cpp:
8291         (JSC::Heap::markRoots):
8292         * heap/MarkStack.cpp:
8293         (JSC::MarkStackThreadSharedData::resetChildren):
8294         (JSC::MarkStackThreadSharedData::childVisitCount):
8295         (JSC::MarkStackThreadSharedData::markingThreadMain):
8296         (JSC::MarkStackThreadSharedData::markingThreadStartFunc):
8297         (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
8298         (JSC::MarkStackThreadSharedData::reset):
8299         * heap/MarkStack.h:
8300         (MarkStackThreadSharedData):
8301         (MarkStack):
8302         (JSC::MarkStack::sharedData):
8303         (JSC::MarkStack::resetChildCount):
8304         (JSC::MarkStack::childCount):
8305         (JSC::MarkStack::incrementChildCount):
8306         * runtime/JSArray.cpp:
8307         (JSC::JSArray::visitChildren):
8308         * runtime/JSCell.cpp:
8309         (JSC::JSCell::className):
8310         * runtime/JSCell.h:
8311         (JSCell):
8312         (JSC::JSCell::visitChildren):
8313         * runtime/JSString.cpp:
8314         (JSC::JSString::visitChildren):
8315         * runtime/JSString.h:
8316         (JSString):
8317         * runtime/Structure.h:
8318         (JSC::MarkStack::internalAppend):
8319
8320 2012-06-06  Gavin Barraclough  <barraclough@apple.com>
8321
8322         Assigning to a static property should not change iteration order
8323         https://bugs.webkit.org/show_bug.cgi?id=88401
8324
8325         Reviewed by Geoff Garen.
8326
8327         A specific iteration order is not defined by the spec, but test-262 somewhat tenuously
8328         requires that it is at least stable, e.g. ch10/10.4/10.4.2/S10.4.2_A1.1_T1.js
8329
8330         Whilst it is not clear that this behavior really arises from the specification, it
8331         would seem like common sense to conform to this.
8332
8333         The problem here is that we allow properties in the structure to shadow those in the
8334         static table, and we iterate the properties in the structure first - which means that
8335         as values of existing properties are modified, their iteration order changes too.
8336
8337         The easy fix is to iterate the properties from the static table first. This has a
8338         further benefit, since it will mean that user added properties will come after those
8339         present in the static table (respected the expected insertion-order).
8340
8341         * runtime/JSObject.cpp:
8342         (JSC::JSObject::getOwnPropertyNames):
8343             - Iterate static properties first.
8344
8345 2012-06-06  Andy Wingo  <wingo@igalia.com>
8346
8347         Ensure consistent order of evaluation in LLInt slow paths
8348         https://bugs.webkit.org/show_bug.cgi?id=88409
8349
8350         Reviewed by Geoffrey Garen.
8351
8352         * llint/LLIntSlowPaths.cpp:
8353         (slow_path_mul)
8354         (slow_path_sub)
8355         (slow_path_div)
8356         (slow_path_mod)
8357         (slow_path_lshift)
8358         (slow_path_rshift)
8359         (slow_path_urshift)
8360         (slow_path_bitand)
8361         (slow_path_bitor)
8362         (slow_path_bitxor): Avoid calling toNumber, toInt32, or toUInt32
8363         multiple times without intervening sequence points.  Fixes
8364         fast/js/exception-sequencing-binops.html with GCC 4.7 on x86-64
8365         Linux, which reordered evaluation of the arguments to fmod.
8366
8367 2012-06-06  Andy Wingo  <wingo@igalia.com>
8368
8369         [GTK] Enable the LLInt
8370         https://bugs.webkit.org/show_bug.cgi?id=88315
8371
8372         Reviewed by Filip Pizlo.
8373
8374         * GNUmakefile.am: Add rules to generate LLIntDesiredOffsets.h and
8375         LLIntAssembly.h.
8376         * GNUmakefile.list.am: Add offlineasm and llint files to the
8377         dist.  Add LLInt source files to the build.
8378         * llint/LowLevelInterpreter.asm (crash): Generate a store of
8379         0xbbadbeef to a register, not to a constant.  Otherwise, gas was
8380         failing to assemble result.
8381         * offlineasm/asm.rb (labelReference): Generate a
8382         SYMBOL_STRING_RELOCATION instead of a SYMBOL_STRING, so that we go
8383         through the PLT on ELF systems.
8384
8385 2012-06-06  Andy Wingo  <wingo@igalia.com>
8386
8387         REGRESSION (r106478): None of the Paper.js JavaScript examples work
8388         https://bugs.webkit.org/show_bug.cgi?id=87158
8389
8390         Reviewed by Michael Saboff.
8391
8392         * bytecompiler/BytecodeGenerator.cpp:
8393         (JSC::BytecodeGenerator::resolve): If we have to bail out to
8394         dynamicResolve(), only skip static scopes from the head of the
8395         scope chain.  Before, we were also skipping activations with
8396         direct eval as well, which was incorrect.
8397
8398 2012-06-06  Dan Bernstein  <mitz@apple.com>
8399
8400         Reverted r119567, the fix for <http://webkit.org/b/88378>, because it broke the 32-bit build.
8401
8402         * dfg/DFGSpeculativeJIT.h:
8403         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
8404         * jit/JITInlineMethods.h:
8405         (JSC::JIT::emitAllocateBasicJSObject):
8406         * llint/LowLevelInterpreter.asm:
8407         * runtime/JSGlobalData.h:
8408         (JSGlobalData):
8409         * runtime/JSGlobalThis.cpp:
8410         (JSC::JSGlobalThis::setUnwrappedObject):
8411         * runtime/JSObject.cpp:
8412         (JSC::JSObject::visitChildren):
8413         (JSC::JSObject::createInheritorID):
8414         * runtime/JSObject.h:
8415         (JSObject):
8416         (JSC::JSObject::resetInheritorID):
8417         (JSC):
8418         (JSC::JSObject::offsetOfInheritorID):
8419         (JSC::JSObject::inheritorID):
8420
8421 2012-06-05  Yuqiang Xian  <yuqiang.xian@intel.com>
8422
8423         Improve Math.round and Math.floor intrinsic
8424         https://bugs.webkit.org/show_bug.cgi?id=88314
8425
8426         Reviewed by Filip Pizlo.
8427
8428         Currently we call a native function from the JIT code to complete the
8429         "round" and "floor" operations. We could inline some fast paths
8430         especially for those positive values on the platforms where floating
8431         point truncation is supported.
8432         This brings 3% gain on Kraken, especially 32% on audio-oscillator,
8433         and slight win on SunSpider, measured on IA32.
8434
8435         * jit/ThunkGenerators.cpp:
8436         (JSC::floorThunkGenerator):
8437         (JSC):
8438         (JSC::roundThunkGenerator):
8439
8440 2012-06-05  Gavin Barraclough  <barraclough@apple.com>
8441
8442         Remove JSObject::m_inheritorID
8443         https://bugs.webkit.org/show_bug.cgi?id=88378
8444
8445         Reviewed by Geoff Garen.
8446
8447         This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
8448         and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
8449         Instead use a private named value in the object's property storage.
8450
8451         * dfg/DFGSpeculativeJIT.h:
8452         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
8453             - No need m_inheritorID to initialize!
8454         * jit/JITInlineMethods.h:
8455         (JSC::JIT::emitAllocateBasicJSObject):
8456             - No need m_inheritorID to initialize!
8457         * llint/LowLevelInterpreter.asm:
8458             - No need m_inheritorID to initialize!
8459         * runtime/JSGlobalData.h:
8460         (JSGlobalData):
8461             - Added private name 'm_inheritorIDKey'.
8462         * runtime/JSGlobalThis.cpp:
8463         (JSC::JSGlobalThis::setUnwrappedObject):
8464             - resetInheritorID is now passed a JSGlobalData&.
8465         * runtime/JSObject.cpp:
8466         (JSC::JSObject::visitChildren):
8467             - No m_inheritorID to be marked.
8468         (JSC::JSObject::createInheritorID):
8469             - Store the newly created inheritorID in the property map.
8470         * runtime/JSObject.h:
8471         (JSC::JSObject::resetInheritorID):
8472             - Remove the inheritorID from property storage.
8473         (JSC::JSObject::inheritorID):
8474             - Read the inheritorID from property storage.
8475
8476 2012-06-05  Filip Pizlo  <fpizlo@apple.com>
8477
8478         DFG CFG simplification should not attempt to deref nodes inside of an unreachable subgraph
8479         https://bugs.webkit.org/show_bug.cgi?id=88362
8480
8481         Reviewed by Gavin Barraclough.
8482
8483         * dfg/DFGCFGSimplificationPhase.cpp:
8484         (JSC::DFG::CFGSimplificationPhase::fixPhis):
8485         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
8486
8487 2012-06-05  Mark Hahnenberg  <mhahnenberg@apple.com>
8488
8489         Entry into JSC should CRASH() if the Heap is busy
8490         https://bugs.webkit.org/show_bug.cgi?id=88355
8491
8492         Reviewed by Geoffrey Garen.
8493
8494         Interpreter::execute() returns jsNull() right now if we try to enter it while
8495         the Heap is busy (e.g. with a collection), which is okay, but some code paths
8496         that call Interpreter::execute() allocate objects before checking if the Heap
8497         is busy. Attempting to execute JS code while the Heap is busy should not be
8498         allowed and should be enforced by a release-mode CRASH() to prevent vague,
8499         unhelpful backtraces later on if somebody makes a mistake. Normally, recursively
8500         executing JS code is okay, e.g. for evals, but it should not occur during a
8501         Heap allocation or collection because the Heap is not guaranteed to be in a
8502         consistent state (especially during collections). We are protected from
8503         executing JS on the same Heap concurrently on two separate threads because
8504         they must each take a JSLock first. However, we are not protected from reentrant
8505         execution of JS on the same thread because JSLock allows reentrancy. Therefore,
8506         we should fail early if we detect an entrance into JS code while the Heap is busy.
8507
8508         * heap/Heap.cpp: Changed Heap::collect so that it sets the m_operationInProgress field
8509         at the beginning of collection and then unsets it at the end so that it is set at all
8510         times throughout the duration of a collection rather than sporadically during various
8511         phases. There is no reason to unset during a collection because our collector does
8512         not currently support running additional JS between the phases of a collection.
8513         (JSC::Heap::getConservativeRegisterRoots):
8514         (JSC::Heap::markRoots):
8515         (JSC::Heap::collect):
8516         * interpreter/Interpreter.cpp:
8517         (JSC::Interpreter::execute): Crash if the Heap is busy.
8518         * runtime/Completion.cpp: Crash if the Heap is busy. We do it here before we call
8519         Interpreter::execute() because we do some allocation prior to calling execute() which
8520         could cause Heap corruption if, for example, that allocation caused a collection.
8521         (JSC::evaluate):
8522
8523 2012-06-05  Dongwoo Im  <dw.im@samsung.com>
8524
8525         Add 'isProtocolHandlerRegistered' and 'unregisterProtocolHandler'.
8526         https://bugs.webkit.org/show_bug.cgi?id=73176
8527
8528         Reviewed by Adam Barth.
8529
8530         Two more APIs are added in Custom Scheme Handler specification.
8531         http://dev.w3.org/html5/spec/Overview.html#custom-handlers
8532         One is 'isProtocolHandlerRegistered' to query whether the specific URL
8533         is registered or not.
8534         The other is 'unregisterProtocolHandler' to remove the registered URL.
8535
8536         * Configurations/FeatureDefines.xcconfig: Add a macro 'ENABLE_CUSTOM_SCHEME_HANDLER'.
8537
8538 2012-06-04  Filip Pizlo  <fpizlo@apple.com>
8539
8540         DFG CFG simplification should correct the variables at the head of the predecessor block
8541         https://bugs.webkit.org/show_bug.cgi?id=88284
8542
8543         Reviewed by Geoffrey Garen.
8544
8545         * dfg/DFGCFGSimplificationPhase.cpp:
8546         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
8547
8548 2012-06-04  Geoffrey Garen  <ggaren@apple.com>
8549
8550         Unreviewed.
8551
8552         Rolled out r119364 because it's still causing crashes (when running
8553         v8-earley in release builds of DRT)
8554
8555         This time for sure!
8556
8557         * heap/Heap.cpp:
8558         (JSC::Heap::collect):
8559         * heap/MarkedBlock.cpp:
8560         (JSC::MarkedBlock::sweep):
8561         * heap/MarkedBlock.h:
8562         (JSC::MarkedBlock::resetAllocator):
8563         (JSC):
8564         * heap/MarkedSpace.cpp:
8565         (JSC::ResetAllocator::operator()):
8566         (JSC):
8567         (JSC::MarkedSpace::resetAllocators):
8568         (JSC::MarkedSpace::sweepWeakSets):
8569         * heap/MarkedSpace.h:
8570         (MarkedSpace):
8571         * heap/WeakBlock.cpp:
8572         (JSC::WeakBlock::sweep):
8573         * heap/WeakSet.cpp:
8574         (JSC::WeakSet::sweep):
8575         (JSC::WeakSet::tryFindAllocator):
8576         * heap/WeakSet.h:
8577         (JSC::WeakSet::shrink):
8578
8579 2012-06-04  Filip Pizlo  <fpizlo@apple.com>
8580
8581         DFG arguments simplification should have rationalized handling of TearOffArguments
8582         https://bugs.webkit.org/show_bug.cgi?id=88206
8583
8584         Reviewed by Geoffrey Garen.
8585
8586         - Accesses to the unmodified arguments register ought to have the same effect on
8587           alias/escape analysis of arguments as accesses to the mutable arguments register.
8588
8589         - The existence of TearOffArguments should not get in the way of arguments aliasing.
8590
8591         - TearOffArguments should be eliminated if CreateArguments is eliminated.
8592
8593         * dfg/DFGArgumentsSimplificationPhase.cpp:
8594         (JSC::DFG::ArgumentsSimplificationPhase::run):
8595         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
8596
8597 2012-06-04  Gavin Barraclough  <barraclough@apple.com>
8598
8599         Remove enabledProfilerReference
8600         https://bugs.webkit.org/show_bug.cgi?id=88258
8601
8602         Reviewed by Michael Saboff.
8603
8604         Make the enabled profiler a member of JSGlobalData, and switch code that accesses it to do so directly
8605         via the JSGlobalData, rather than holding a Profiler** reference to it. Do not pass the Profiler**
8606         reference to JIT code. This patch does not change the stack layout on entry into JIT code (passing an
8607         unused void* instead), since this is an intrusive change better handled in a separate patch.
8608
8609         * interpreter/Interpreter.cpp:
8610         (JSC::Interpreter::throwException):
8611         (JSC::Interpreter::execute):
8612         (JSC::Interpreter::executeCall):
8613         (JSC::Interpreter::executeConstruct):
8614         (JSC::Interpreter::privateExecute):
8615         * jit/JITCode.h:
8616         (JSC::JITCode::execute):
8617             - Don't pass Profiler** to JIT code.
8618         * jit/JITOpcodes.cpp:
8619         (JSC::JIT::emit_op_profile_will_call):
8620         (JSC::JIT::emit_op_profile_did_call):
8621         * jit/JITOpcodes32_64.cpp:
8622         (JSC::JIT::emit_op_profile_will_call):
8623         (JSC::JIT::emit_op_profile_did_call):
8624         * jit/JITStubs.cpp:
8625         (JSC):
8626         (JSC::ctiTrampoline):
8627         (JSC::ctiVMThrowTrampoline):
8628         (JSC::ctiOpThrowNotCaught):
8629         (JSC::JITThunks::JITThunks):
8630         (JSC::DEFINE_STUB_FUNCTION):
8631             - For ARM_THUMB2, rename ENABLE_PROFILER_REFERENCE_OFFSET to FIRST_STACK_ARGUMENT (which is how it is being used).
8632             - For MIPS, remove ENABLE_PROFILER_REFERENCE_OFFSET.
8633         * jit/JITStubs.h:
8634         (JITStackFrame):
8635         (JSC):
8636             - Renamed enabledProfilerReference to unusedX.
8637         * llint/LLIntSlowPaths.cpp:
8638         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
8639         * llint/LowLevelInterpreter.asm:
8640         * profiler/Profiler.cpp:
8641         (JSC):
8642         (JSC::Profiler::startProfiling):
8643         (JSC::Profiler::stopProfiling):
8644         * profiler/Profiler.h:
8645         (Profiler):
8646             - Removed s_sharedEnabledProfilerReference, enabledProfilerReference().
8647         * runtime/JSGlobalData.cpp:
8648         (JSC::JSGlobalData::JSGlobalData):
8649         * runtime/JSGlobalData.h:
8650         (JSC):
8651         (JSC::JSGlobalData::enabledProfiler):
8652         (JSGlobalData):
8653             - Added m_enabledProfiler, enabledProfiler().
8654         * runtime/JSGlobalObject.cpp:
8655         (JSC::JSGlobalObject::~JSGlobalObject):
8656
8657 2012-06-04  Filip Pizlo  <fpizlo@apple.com>
8658
8659         get_argument_by_val should be profiled everywhere
8660         https://bugs.webkit.org/show_bug.cgi?id=88205
8661
8662         Reviewed by Geoffrey Garen.
8663
8664         * jit/JITOpcodes32_64.cpp:
8665         (JSC::JIT::emitSlow_op_get_argument_by_val):
8666         * llint/LLIntSlowPaths.cpp:
8667         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
8668
8669 2012-06-04  Filip Pizlo  <fpizlo@apple.com>
8670
8671         DFG arguments simplification takes unkindly to direct accesses to the arguments register
8672         https://bugs.webkit.org/show_bug.cgi?id=88261
8673
8674         Reviewed by Geoffrey Garen.
8675
8676         Fixed arguments simplification for direct accesses to the arguments register, which may
8677         arise if CSE had not run. Fixed CSE so that it does run prior to arguments simplification,
8678         by making it a full-fledged member of the fixpoint. Fixed other issues in arguments
8679         simplification, like realizing that it needs to bail if there is a direct assignment to
8680         the arguments register, and failing to turn CreateArguments into PhantomArguments. Also
8681         fixed CSE's handling of store elimination of captured locals in the presence of a
8682         GetMyArgumentByVal (or one of its friends), and fixed CSE to correctly fixup variables at
8683         tail if the Flush it removes is the last operation on a local in a basic block.
8684
8685         * bytecode/CodeBlock.cpp:
8686         (JSC::CodeBlock::dump):
8687         * dfg/DFGArgumentsSimplificationPhase.cpp:
8688         (JSC::DFG::ArgumentsSimplificationPhase::run):
8689         (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
8690         * dfg/DFGCSEPhase.cpp:
8691         (JSC::DFG::CSEPhase::run):
8692         (JSC::DFG::CSEPhase::setLocalStoreElimination):
8693         (JSC::DFG::CSEPhase::performNodeCSE):
8694         (CSEPhase):
8695         * dfg/DFGDriver.cpp:
8696         (JSC::DFG::compile):
8697
8698 2012-06-04  Anders Carlsson  <andersca@apple.com>
8699
8700         Fix a struct/class mismatch.
8701
8702         * heap/Handle.h:
8703         (Handle):
8704
8705 2012-06-04  David Kilzer  <ddkilzer@apple.com>
8706
8707         BUILD FIX: FeatureDefines.xcconfig should match across projects
8708
8709         * Configurations/FeatureDefines.xcconfig:
8710         - Add missing ENABLE_LEGACY_CSS_VENDOR_PREFIXES.
8711
8712 2012-06-02  Geoffrey Garen  <ggaren@apple.com>
8713
8714         Weak pointer finalization should be lazy
8715         https://bugs.webkit.org/show_bug.cgi?id=87599
8716
8717         Reviewed by Sam Weinig.
8718
8719         This time for sure!
8720
8721         * heap/Heap.cpp:
8722         (JSC::Heap::collect): Don't sweep eagerly -- we'll sweep lazily instead.
8723
8724         * heap/MarkedBlock.cpp:
8725         (JSC::MarkedBlock::sweep): Sweep our weak set before we sweep our other
8726         destructors -- this is our last chance to run weak set finalizers before
8727         we recycle our memory.
8728
8729         * heap/MarkedBlock.h:
8730         (JSC::MarkedBlock::resetAllocator):
8731         * heap/MarkedSpace.cpp:
8732         (JSC::MarkedSpace::resetAllocators):
8733         * heap/MarkedSpace.h:
8734         (JSC::MarkedSpace::resetAllocators): Don't force allocator reset anymore.
8735         It will happen automatically when a weak set is swept. It's simpler to
8736         have only one canonical way for this to happen, and it wasn't buying
8737         us anything to do it eagerly.
8738
8739         * heap/WeakBlock.cpp:
8740         (JSC::WeakBlock::sweep): Don't short-circuit a sweep unless we know
8741         the sweep would be a no-op. If even one finalizer is pending, we need to
8742         run it, since we won't get another chance.
8743
8744         * heap/WeakSet.cpp:
8745         (JSC::WeakSet::sweep): This loop can be simpler now that
8746         WeakBlock::sweep() does what we mean.
8747
8748         Reset our allocator after a sweep because this is the optimal time to
8749         start trying to recycle old weak pointers.
8750
8751         (JSC::WeakSet::tryFindAllocator): Don't sweep when searching for an
8752         allocator because we've swept already, and forcing a new sweep would be
8753         wasteful.
8754
8755         * heap/WeakSet.h:
8756         (JSC::WeakSet::shrink): Be sure to reset our allocator after a shrink
8757         because the shrink may have removed the block the allocator was going to
8758         allocate out of.
8759
8760 2012-06-02  Filip Pizlo  <fpizlo@apple.com>
8761
8762         If the DFG bytecode parser detects that op_method_check has gone polymorphic, it
8763         shouldn't revert all the way to GetById/GetByIdFlush
8764         https://bugs.webkit.org/show_bug.cgi?id=88176
8765
8766         Reviewed by Geoffrey Garen.
8767
8768         Refactored the code so that the op_method_check case of the parser gracefully falls
8769         through to all of the goodness of the normal op_get_by_id case.
8770
8771         * dfg/DFGByteCodeParser.cpp:
8772         (ByteCodeParser):
8773         (JSC::DFG::ByteCodeParser::handleGetById):
8774         (DFG):
8775         (JSC::DFG::ByteCodeParser::parseBlock):
8776
8777 2012-06-02  Filip Pizlo  <fpizlo@apple.com>
8778
8779         DFG CSE should be able to eliminate unnecessary flushes of arguments and captured variables
8780         https://bugs.webkit.org/show_bug.cgi?id=87929
8781
8782         Reviewed by Geoffrey Garen.
8783
8784         Slight speed-up on V8. Big win (up to 50%) on programs that inline very small functions.
8785
8786         This required a bunch of changes:
8787
8788         - The obvious change is making CSE essentially ignore whether or not the set of
8789           operations between the Flush and the SetLocal can exit, and instead focus on whether or
8790           not that set of operations can clobber the world or access local variables. This code
8791           is now refactored to return a set of flags indicating any of these events, and the CSE
8792           decides what to do based on those flags. If the set of operations is non-clobbering
8793           and non-accessing, then the Flush is turned into a Phantom on the child of the
8794           SetLocal. This expands the liveness of the relevant variable but virtually guarantees
8795           that it will be register allocated and not flushed to the stack. So, yeah, this patch
8796           is a lot of work to save a few stores to the stack.
8797
8798         - Previously, CheckArgumentsNotCreated was optimized "lazily" in that you only knew if
8799           it was a no-op if you were holding onto a CFA abstract state. But this would make the
8800           CSE act pessimistically, since it doesn't use the CFA. Hence, this patch changes the
8801           constant folding phase into something more broad; it now fixes up
8802           CheckArgumentsNotCreated nodes by turning them into phantoms if it knows that they are
8803           no-ops.
8804
8805         - Arguments simplification was previously relying on this very strange PhantomArguments
8806           node, which had two different meanings: for normal execution it meant the empty value
8807           but for OSR exit it meant that the arguments should be reified. This produces problems
8808           when set SetLocals to the captured arguments registers are CSE'd away, since we'd be
8809           triggering reification of arguments without having initialized the arguments registers
8810           to empty. The cleanest solution was to fix PhantomArguments to have one meaning:
8811           namely, arguments reification on OSR exit. Hence, this patch changes arguments
8812           simplification to change SetLocal of CreateArguments on the arguments registers to be
8813           a SetLocal of Empty.
8814
8815         - Argument value recoveries were previously derived from the value source of the
8816           arguments at the InlineStart. But that relies on all SetLocals to arguments having
8817           been flushed. It's possible that we could have elided the SetLocal to the arguments
8818           at the callsite because there were subsequent SetLocals to the arguments inside of the
8819           callee, in which case the InlineStart would get the wrong information. Hence, this
8820           patch changes argument value recovery computation to operate over the ArgumentPositions
8821           directly.
8822
8823         - But that doesn't actually work, because previously, there was no way to link an
8824           InlineStart back to the corresponding ArgumentPositions, at least not without some
8825           ugliness. So this patch instates the rule that the m_argumentPositions vector consists
8826           of disjoint subsequences such that each subsequence corresponds to an inline callsite
8827           and can be identified by its first index, and within each subsequence are the
8828           ArgumentPositions of all of the arguments ordered by argument index. This required
8829           flipping the order in which ArgumentPositions are added to the vector, and giving
8830           InlineStart an operand that indicates the start of that inline callsite's
8831           ArgumentPosition subsequence.
8832
8833         - This patch also revealed a nasty bug in the reification of arguments in inline call
8834           frames on OSR exit. Since the reification was happening after the values of virtual
8835           registers were recovered, the value recoveries of the inline arguments were wrong.
8836           Hence using operationCreateInlinedArguments is wrong. For example a value recovery
8837           might say that you have to box a double, but if we had already boxed it then boxing
8838           it a second time will result in garbage. The specific case of this bug was this patch
8839           uncovered was that now it is possible for an inline call frame to not have any valid
8840           value recoveries for any inline arguments, if the optimization elides all argument
8841           flushes, while at the same time optimizing away arguments creation. Then OSR exit
8842           would try to recover the arguments using the inline call frame, which had bogus
8843           information, and humorous crashes would ensue. This patch fixes this issue by moving
8844           arguments reification to after call frame reification, so that arguments reification
8845           can always use operationCreateArguments instead of operationCreateInlinedArguments.
8846
8847         - This patch may turn a Flush into a Phantom. That's kind of the whole point. But that
8848           broke forward speculation checks, which knew to look for a Flush prior to a SetLocal
8849           but didn't know that there could alternatively be a Phantom in place of the Flush.
8850           This patch fixes that by augmenting the forward speculation check logic.
8851
8852         - Finally, in the process of having fun with all of the above, I realized that my DFG
8853           validation was not actually running on every phase like I had originally designed it
8854           to. In fact it was only running just after bytecode parsing. I initially tried to
8855           make it run in every phase but found that this causes some tests to timeout
8856           (specifically the evil fuzzing ones), so I decided on a compromise where: (i) in
8857           release mode validation never runs, (ii) in debug mode validation will run just
8858           after parsing and just before the backend, and (iii) it's possible with a simple
8859           switch to enable validation to run on every phase.
8860
8861         Luckily all of the above issues were already covered by the 77 or so DFG-specific
8862         layout tests. Hence, this patch does not introduce any new tests despite being so
8863         meaty.
8864
8865         * dfg/DFGAbstractState.cpp:
8866         (JSC::DFG::AbstractState::execute):
8867         * dfg/DFGArgumentPosition.h:
8868         (JSC::DFG::ArgumentPosition::prediction):
8869         (JSC::DFG::ArgumentPosition::doubleFormatState):
8870         (JSC::DFG::ArgumentPosition::shouldUseDoubleFormat):
8871         (ArgumentPosition):
8872         * dfg/DFGArgumentsSimplificationPhase.cpp:
8873         (JSC::DFG::ArgumentsSimplificationPhase::run):
8874         * dfg/DFGByteCodeParser.cpp:
8875         (JSC::DFG::ByteCodeParser::handleInlining):
8876         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
8877         * dfg/DFGCSEPhase.cpp:
8878         (JSC::DFG::CSEPhase::SetLocalStoreEliminationResult::SetLocalStoreEliminationResult):
8879         (SetLocalStoreEliminationResult):
8880         (JSC::DFG::CSEPhase::setLocalStoreElimination):
8881         (JSC::DFG::CSEPhase::performNodeCSE):
8882         * dfg/DFGCommon.h:
8883         * dfg/DFGConstantFoldingPhase.cpp:
8884         (JSC::DFG::ConstantFoldingPhase::run):
8885         * dfg/DFGDriver.cpp:
8886         (JSC::DFG::compile):
8887         * dfg/DFGNode.h:
8888         (Node):
8889         (JSC::DFG::Node::hasArgumentPositionStart):
8890         (JSC::DFG::Node::argumentPositionStart):
8891         * dfg/DFGOSRExitCompiler32_64.cpp:
8892         (JSC::DFG::OSRExitCompiler::compileExit):
8893         * dfg/DFGOSRExitCompiler64.cpp:
8894         (JSC::DFG::OSRExitCompiler::compileExit):
8895         * dfg/DFGPhase.cpp:
8896         (DFG):
8897         * dfg/DFGPhase.h:
8898         (Phase):
8899         * dfg/DFGSpeculativeJIT.cpp:
8900         (JSC::DFG::SpeculativeJIT::compile):
8901         * dfg/DFGSpeculativeJIT.h:
8902         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
8903         * dfg/DFGSpeculativeJIT32_64.cpp:
8904         (JSC::DFG::SpeculativeJIT::compile):
8905         * dfg/DFGSpeculativeJIT64.cpp:
8906         (JSC::DFG::SpeculativeJIT::compile):
8907
8908 2012-06-02  Geoffrey Garen  <ggaren@apple.com>
8909
8910         DOM string cache should hash pointers, not characters
8911         https://bugs.webkit.org/show_bug.cgi?id=88175
8912
8913         Reviewed by Phil Pizlo and Sam Weinig.
8914
8915         * heap/Weak.h:
8916         (JSC::weakAdd):
8917         (JSC::weakRemove): Made these function templates slightly more generic
8918         to accommodate new client types.
8919
8920 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8921
8922         DFG CFA should know that PutByVal can clobber the world
8923         https://bugs.webkit.org/show_bug.cgi?id=88155
8924
8925         Reviewed by Gavin Barraclough.
8926
8927         * dfg/DFGAbstractState.cpp:
8928         (JSC::DFG::AbstractState::execute):
8929
8930 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8931
8932         DFG CFA should mark basic blocks as having constants if local accesses yield constants
8933         https://bugs.webkit.org/show_bug.cgi?id=88153
8934
8935         Reviewed by Gavin Barraclough.
8936
8937         * dfg/DFGAbstractState.cpp:
8938         (JSC::DFG::AbstractState::execute):
8939
8940 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8941
8942         DFG arguments simplification phase uses a node.codeOrigin after appending a node
8943         https://bugs.webkit.org/show_bug.cgi?id=88151
8944
8945         Reviewed by Geoffrey Garen.
8946
8947         The right thing to do is to save the CodeOrigin before appending to the graph.
8948
8949         * dfg/DFGArgumentsSimplificationPhase.cpp:
8950         (JSC::DFG::ArgumentsSimplificationPhase::run):
8951
8952 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8953
8954         DFG should not emit unnecessary speculation checks when performing an int32 to double conversion on
8955         a value that is proved to be a number, predicted to be an int32, but not proved to be an int32
8956         https://bugs.webkit.org/show_bug.cgi?id=88146
8957
8958         Reviewed by Gavin Barraclough.
8959
8960         * dfg/DFGSpeculativeJIT.cpp:
8961         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
8962
8963 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8964
8965         DFG constant folding search for the last local access skips the immediately previous local access
8966         https://bugs.webkit.org/show_bug.cgi?id=88141
8967
8968         Reviewed by Michael Saboff.
8969
8970         If you use a loop in the style of:
8971
8972         for (i = start; i--;)
8973
8974         then you need to remember that the first value of 'i' that the loop body will see is 'start - 1'.
8975         Hence the following is probably wrong:
8976
8977         for (i = start - 1; i--;)
8978
8979         * dfg/DFGConstantFoldingPhase.cpp:
8980         (JSC::DFG::ConstantFoldingPhase::run):
8981
8982 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8983
8984         DFG constant folding should be OK with GetLocal of captured variables having a constant
8985         https://bugs.webkit.org/show_bug.cgi?id=88137
8986
8987         Reviewed by Gavin Barraclough.
8988
8989         * dfg/DFGConstantFoldingPhase.cpp:
8990         (JSC::DFG::ConstantFoldingPhase::run):
8991
8992 2012-05-31  Mark Hahnenberg  <mhahnenberg@apple.com>
8993
8994         JSGlobalObject does not mark m_privateNameStructure
8995         https://bugs.webkit.org/show_bug.cgi?id=88023
8996
8997         Rubber stamped by Gavin Barraclough.
8998
8999         * runtime/JSGlobalObject.cpp:
9000         (JSC::JSGlobalObject::visitChildren): We need to mark this so it doesn't get
9001         inadvertently garbage collected.
9002
9003 2012-05-31  Erik Arvidsson  <arv@chromium.org>
9004
9005         Make DOM Exceptions Errors
9006         https://bugs.webkit.org/show_bug.cgi?id=85078
9007
9008         Reviewed by Oliver Hunt.
9009
9010         WebIDL mandates that exceptions should have Error.prototype on its prototype chain.
9011
9012         For JSC we have access to the Error.prototype from the binding code.
9013
9014         For V8 we set a field in the WrapperTypeInfo and when the constructor function is created we
9015         set the prototype as needed.
9016
9017         Updated test: fast/dom/DOMException/prototype-object.html
9018
9019         * JavaScriptCore.xcodeproj/project.pbxproj:
9020         * runtime/JSGlobalObject.cpp:
9021         (JSC::JSGlobalObject::reset):
9022         * runtime/JSGlobalObject.h:
9023         (JSC):
9024         (JSGlobalObject):
9025         (JSC::JSGlobalObject::errorPrototype):
9026
9027 2012-05-31  Andy Wingo  <wingo@igalia.com>
9028
9029         Fix reference to unset variable in debug mode
9030         https://bugs.webkit.org/show_bug.cgi?id=87981
9031
9032         Reviewed by Geoffrey Garen.
9033
9034         * runtime/JSONObject.cpp (Stringifier::Holder::Holder):
9035         Initialize m_size in debug mode, as we check it later in an assert.
9036
9037 2012-05-30  Mark Hahnenberg  <mhahnenberg@apple.com>
9038
9039         Heap should sweep incrementally
9040         https://bugs.webkit.org/show_bug.cgi?id=85429
9041
9042         We shouldn't have to wait for the opportunistic GC timer to fire in order
9043         to call object destructors. Instead, we should incrementally sweep some
9044         subset of the blocks requiring sweeping periodically. We tie this sweeping
9045         to a timer rather than to collections because we want to reclaim this memory
9046         even if we stop allocating. This way, our memory usage scales smoothly with
9047         actual use, regardless of whether we've recently done an opportunistic GC or not.
9048
9049         Reviewed by Geoffrey Garen.
9050
9051         * CMakeLists.txt:
9052         * GNUmakefile.list.am:
9053         * JavaScriptCore.gypi:
9054         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
9055         * JavaScriptCore.xcodeproj/project.pbxproj:
9056         * Target.pri:
9057         * heap/Heap.cpp:
9058         (JSC::Heap::Heap):
9059         (JSC::Heap::collect): We no longer sweep during a full sweep. We only shrink now,
9060         which we will switch over to being done during incremental sweeping too as soon as
9061         all finalizers can be run lazily (and, by extension, incrementally).
9062         (JSC::Heap::sweeper):
9063         (JSC):
9064         * heap/Heap.h:
9065         (JSC):
9066         (Heap):
9067         * heap/IncrementalSweeper.cpp: Added.
9068         (JSC):
9069         (JSC::IncrementalSweeper::timerDidFire): The IncrementalSweeper works very similarly to
9070         GCActivityCallback. It is tied to a run-loop based timer that fires periodically based
9071         on how long the previous sweep increment took to run. The IncrementalSweeper doesn't do
9072         anything if the platform doesn't support CoreFoundation.
9073         (JSC::IncrementalSweeper::IncrementalSweeper):
9074         (JSC::IncrementalSweeper::~IncrementalSweeper):
9075         (JSC::IncrementalSweeper::create):
9076         (JSC::IncrementalSweeper::scheduleTimer):
9077         (JSC::IncrementalSweeper::cancelTimer):
9078         (JSC::IncrementalSweeper::doSweep): Iterates over the snapshot of the MarkedSpace taken
9079         during the last collection, checking to see which blocks need sweeping. If it successfully
9080         gets to the end of the blocks that need sweeping then it cancels the timer.
9081         (JSC::IncrementalSweeper::startSweeping): We take a snapshot of the Heap and store it in
9082         a Vector that the incremental sweep will iterate over. We also reset our index into this Vector.
9083         * heap/IncrementalSweeper.h: Added.
9084         (JSC):
9085         (IncrementalSweeper):
9086         * heap/MarkedBlock.h:
9087         (JSC::MarkedBlock::needsSweeping): If a block is in the Marked state it needs sweeping
9088         to be usable and to run any destructors that need to be run.
9089
9090 2012-05-30  Patrick Gansterer  <paroga@webkit.org>
9091
9092         [WINCE] Fix JSString after r115516.
9093         https://bugs.webkit.org/show_bug.cgi?id=87892
9094
9095         Reviewed by Geoffrey Garen.
9096
9097         r115516 splitted JSString into two classes, with addition nested classes.
9098         Add a workaround for the WinCE compiler since it can't resolve the friend class
9099         declerations corretly and denies the access to protected members of JSString.
9100
9101         * runtime/JSString.h:
9102         (JSC::JSRopeString::RopeBuilder::append):
9103         (JSC::JSRopeString::append):
9104         (JSRopeString):
9105
9106 2012-05-30  Oliver Hunt  <oliver@apple.com>
9107
9108         Really provide error information with the inspector disabled
9109         https://bugs.webkit.org/show_bug.cgi?id=87910
9110
9111         Reviewed by Filip Pizlo.
9112
9113         Don't bother checking for anything other than pre-existing error info.
9114         In the absence of complete line number information you'll only get the
9115         line a function starts on, but at least it's something.
9116
9117         * interpreter/Interpreter.cpp:
9118         (JSC::Interpreter::throwException):
9119
9120 2012-05-30  Filip Pizlo  <fpizlo@apple.com>
9121
9122         LLInt broken on x86-32 with JIT turned off
9123         https://bugs.webkit.org/show_bug.cgi?id=87906
9124
9125         Reviewed by Geoffrey Garen.
9126
9127         Fixed the code to not clobber registers that contain important things, like the call frame.
9128
9129         * llint/LowLevelInterpreter32_64.asm:
9130
9131 2012-05-30  Filip Pizlo  <fpizlo@apple.com>
9132
9133         ScriptDebugServer wants sourceIDs that are non-zero because that's what HashMaps want, so JSC should placate it
9134         https://bugs.webkit.org/show_bug.cgi?id=87887
9135
9136         Reviewed by Darin Adler.
9137
9138         Better fix - we now never call SourceProvider::asID() if SourceProvider* is 0.
9139
9140         * parser/Nodes.h:
9141         (JSC::ScopeNode::sourceID):
9142         * parser/SourceCode.h:
9143         (JSC::SourceCode::providerID):
9144         (SourceCode):
9145         * parser/SourceProvider.h:
9146         (SourceProvider):
9147         (JSC::SourceProvider::asID):
9148         * runtime/Executable.h:
9149         (JSC::ScriptExecutable::sourceID):
9150
9151 2012-05-30  Filip Pizlo  <fpizlo@apple.com>
9152
9153         ScriptDebugServer wants sourceIDs that are non-zero because that's what HashMaps want, so JSC should placate it
9154         https://bugs.webkit.org/show_bug.cgi?id=87887
9155
9156         Reviewed by Geoffrey Garen.
9157
9158         * parser/SourceProvider.h:
9159         (JSC::SourceProvider::asID):
9160
9161 2012-05-30  Oliver Hunt  <oliver@apple.com>
9162
9163         DFG does not correctly handle exceptions caught in the LLInt
9164         https://bugs.webkit.org/show_bug.cgi?id=87885
9165
9166         Reviewed by Filip Pizlo.
9167
9168         Make the DFG use genericThrow, rather than reimplementing a small portion of it.
9169         Also make the LLInt slow paths validate that their PC is correct.
9170
9171         * dfg/DFGOperations.cpp:
9172         * llint/LLIntSlowPaths.cpp:
9173         (LLInt):
9174
9175 2012-05-29  Filip Pizlo  <fpizlo@apple.com>
9176
9177         DFG CFA should infer types and values of captured variables
9178         https://bugs.webkit.org/show_bug.cgi?id=87813
9179
9180         Reviewed by Gavin Barraclough.
9181
9182         Slight speed-up in V8/earley-boyer (~1%).
9183
9184         * bytecode/CodeBlock.h:
9185         (JSC::CodeBlock::argumentsAreCaptured):
9186         (JSC::CodeBlock::argumentIsCaptured):
9187         (CodeBlock):
9188         * dfg/DFGAbstractState.cpp:
9189         (DFG):
9190         (JSC::DFG::AbstractState::beginBasicBlock):
9191         (JSC::DFG::AbstractState::initialize):
9192         (JSC::DFG::AbstractState::endBasicBlock):
9193         (JSC::DFG::AbstractState::execute):
9194         (JSC::DFG::AbstractState::clobberWorld):
9195         (JSC::DFG::AbstractState::clobberStructures):
9196         (JSC::DFG::AbstractState::mergeStateAtTail):
9197         (JSC::DFG::AbstractState::merge):
9198         (JSC::DFG::AbstractState::mergeToSuccessors):
9199         * dfg/DFGAbstractState.h:
9200         (JSC::DFG::AbstractState::variables):
9201         (AbstractState):
9202         * dfg/DFGSpeculativeJIT32_64.cpp:
9203         (JSC::DFG::SpeculativeJIT::compile):
9204         * dfg/DFGSpeculativeJIT64.cpp:
9205         (JSC::DFG::SpeculativeJIT::compile):
9206
9207 2012-05-30  Patrick Gansterer  <paroga@webkit.org>
9208
9209         Unreviewed. Build fix for !ENABLE(JIT) after r117823.
9210
9211         * bytecode/CodeBlock.cpp:
9212         (JSC::CodeBlock::dump):
9213
9214 2012-05-30  Sheriff Bot  <webkit.review.bot@gmail.com>
9215
9216         Unreviewed, rolling out r118868.
9217         http://trac.webkit.org/changeset/118868
9218         https://bugs.webkit.org/show_bug.cgi?id=87828
9219
9220         introduced ~20 crashes on Mac and Qt bots (Requested by pizlo_
9221         on #webkit).
9222
9223         * heap/Heap.cpp:
9224         (JSC::Heap::collect):
9225         * heap/MarkedBlock.cpp:
9226         (JSC::MarkedBlock::sweep):
9227         * heap/MarkedBlock.h:
9228         (JSC::MarkedBlock::sweepWeakSet):
9229         (JSC):
9230         * heap/MarkedSpace.cpp:
9231         (JSC::SweepWeakSet::operator()):
9232         (JSC):
9233         (JSC::MarkedSpace::sweepWeakSets):
9234         * heap/MarkedSpace.h:
9235         (MarkedSpace):
9236
9237 2012-05-29  Geoffrey Garen  <ggaren@apple.com>
9238
9239         Rolled back in r118646, now that
9240         https://bugs.webkit.org/show_bug.cgi?id=87784 is fixed.
9241
9242         http://trac.webkit.org/changeset/118646
9243         https://bugs.webkit.org/show_bug.cgi?id=87599
9244
9245         * heap/Heap.cpp:
9246         (JSC::Heap::collect):
9247         * heap/MarkedBlock.cpp:
9248         (JSC::MarkedBlock::sweep):
9249         * heap/MarkedBlock.h:
9250         (JSC):
9251         * heap/MarkedSpace.cpp:
9252         (JSC):
9253         * heap/MarkedSpace.h:
9254         (MarkedSpace):
9255
9256 2012-05-29  Filip Pizlo  <fpizlo@apple.com>
9257
9258         DFG should keep captured variables alive until the (inline) return.
9259         https://bugs.webkit.org/show_bug.cgi?id=87205
9260
9261         Reviewed by Gavin Barraclough.
9262
9263         Changes the way we do flushing for captured variables and arguments. Instead of flushing
9264         each SetLocal immediately, we flush at kill points. So a SetLocal will cause a Flush of
9265         whatever was live in the variable previously, and a return will cause a Flush of all
9266         captured variables and all arguments.
9267
9268         * dfg/DFGByteCodeParser.cpp:
9269         (JSC::DFG::ByteCodeParser::setDirect):
9270         (JSC::DFG::ByteCodeParser::set):
9271         (JSC::DFG::ByteCodeParser::setLocal):
9272         (JSC::DFG::ByteCodeParser::getArgument):
9273         (JSC::DFG::ByteCodeParser::setArgument):
9274         (JSC::DFG::ByteCodeParser::findArgumentPositionForArgument):
9275         (ByteCodeParser):
9276         (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
9277         (JSC::DFG::ByteCodeParser::findArgumentPosition):
9278         (JSC::DFG::ByteCodeParser::flush):
9279         (JSC::DFG::ByteCodeParser::flushDirect):
9280         (JSC::DFG::ByteCodeParser::flushArgumentsAndCapturedVariables):
9281         (JSC::DFG::ByteCodeParser::handleInlining):
9282         (JSC::DFG::ByteCodeParser::parseBlock):
9283         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
9284         * dfg/DFGCSEPhase.cpp:
9285         (JSC::DFG::CSEPhase::setLocalStoreElimination):
9286         (JSC::DFG::CSEPhase::performNodeCSE):
9287         * dfg/DFGSpeculativeJIT.cpp:
9288         (JSC::DFG::SpeculativeJIT::compile):
9289         * dfg/DFGSpeculativeJIT.h:
9290         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
9291
9292 2012-05-29  Geoffrey Garen  <ggaren@apple.com>
9293
9294         WeakGCMap should be lazy-finalization-safe
9295         https://bugs.webkit.org/show_bug.cgi?id=87784
9296
9297         Reviewed by Darin Adler.
9298
9299         * runtime/WeakGCMap.h:
9300         (JSC::WeakGCMap::get): Since this is a map of raw WeakImpl pointers, and
9301         not Weak<T>, we need to verify manually that the WeakImpl is live before
9302         we return its payload.
9303
9304 2012-05-29  Mark Hahnenberg  <mhahnenberg@apple.com>
9305
9306         CopiedSpace::doneCopying could start another collection
9307         https://bugs.webkit.org/show_bug.cgi?id=86538
9308
9309         Reviewed by Geoffrey Garen.
9310
9311         It's possible that if we don't have anything at the head of to-space
9312         after a collection and the BlockAllocator doesn't have any fresh blocks
9313         to give us right now we could start another collection while still in
9314         the middle of the first collection when we call CopiedSpace::addNewBlock().
9315
9316         One way to resolve this would be to have Heap::shouldCollect() check that
9317         m_operationInProgress is NoOperation. This would prevent the path in
9318         getFreshBlock() that starts the collection if we're already in the middle of one.
9319
9320         I could not come up with a test case to reproduce this crash on ToT.
9321
9322         * heap/Heap.h:
9323         (JSC::Heap::shouldCollect): We shouldn't collect if we're already in the middle
9324         of a collection, i.e. the current operation should be NoOperation.
9325
9326 2012-05-29  David Barr  <davidbarr@chromium.org>
9327
9328         Introduce ENABLE_CSS_IMAGE_RESOLUTION compile flag
9329         https://bugs.webkit.org/show_bug.cgi?id=87685
9330
9331         Reviewed by Eric Seidel.
9332
9333         Add a configuration option for CSS image-resolution support, disabling it by default.
9334
9335         * Configurations/FeatureDefines.xcconfig:
9336
9337 2012-05-28  Sheriff Bot  <webkit.review.bot@gmail.com>
9338
9339         Unreviewed, rolling out r118646.
9340         http://trac.webkit.org/changeset/118646
9341         https://bugs.webkit.org/show_bug.cgi?id=87691
9342
9343         broke V8 raytrace benchmark (Requested by pizlo_ on #webkit).
9344
9345         * heap/Heap.cpp:
9346         (JSC::Heap::collect):
9347         * heap/MarkedBlock.cpp:
9348         (JSC::MarkedBlock::sweep):
9349         * heap/MarkedBlock.h:
9350         (JSC::MarkedBlock::sweepWeakSet):
9351         (JSC):
9352         * heap/MarkedSpace.cpp:
9353         (JSC::SweepWeakSet::operator()):
9354         (JSC):
9355         (JSC::MarkedSpace::sweepWeakSets):
9356         * heap/MarkedSpace.h:
9357         (MarkedSpace):
9358
9359 2012-05-28  Filip Pizlo  <fpizlo@apple.com>
9360
9361         DFG should not generate code for code that the CFA proves to be unreachable
9362         https://bugs.webkit.org/show_bug.cgi?id=87682
9363
9364         Reviewed by Sam Weinig.
9365
9366         This also fixes a small performance bug where CFA was not marking blocks
9367         as having constants (and hence not triggering constant folding) if the only
9368         constants were on GetLocals.
9369
9370         And fixing that bug revealed another bug: constant folding was assuming that
9371         a GetLocal must be the first access to a local in a basic block. This isn't
9372         true. The first access may be a Flush. This patch fixes that issue using the
9373         safest approach possible, since we don't need to be clever for something that
9374         only happens in one of our benchmarks.
9375
9376         * dfg/DFGAbstractState.cpp:
9377         (JSC::DFG::AbstractState::execute):
9378         * dfg/DFGConstantFoldingPhase.cpp:
9379         (JSC::DFG::ConstantFoldingPhase::run):
9380         * dfg/DFGJITCompiler.h:
9381         (JSC::DFG::JITCompiler::noticeOSREntry):
9382         * dfg/DFGSpeculativeJIT.cpp:
9383         (JSC::DFG::SpeculativeJIT::compile):
9384
9385 2012-05-28  Carlos Garcia Campos  <cgarcia@igalia.com>
9386
9387         Unreviewed. Fix make distcheck.
9388
9389         * GNUmakefile.list.am: Add missing header file.
9390
9391 2012-05-27  Geoffrey Garen  <ggaren@apple.com>
9392
9393         Weak pointer finalization should be lazy
9394         https://bugs.webkit.org/show_bug.cgi?id=87599
9395
9396         Reviewed by Darin Adler.
9397
9398         * heap/Heap.cpp:
9399         (JSC::Heap::collect): Don't force immediate finalization -- it will
9400         happen lazily.
9401
9402         * heap/MarkedBlock.cpp:
9403         (JSC::MarkedBlock::sweep): Sweep a block's weak set when sweeping the
9404         block. The weak set may not have been swept yet, and this is our last
9405         chance to run weak finalizers before we recycle the memory they reference.
9406
9407         * heap/MarkedBlock.h:
9408         * heap/MarkedSpace.cpp:
9409         (JSC::MarkedBlock::sweepWeakSets):
9410         * heap/MarkedSpace.h:
9411         (JSC::MarkedSpace::sweepWeakSets): Nixed sweepWeakSets because it's unused
9412         now.
9413
9414 2012-05-26  Geoffrey Garen  <ggaren@apple.com>
9415
9416         WebKit should be lazy-finalization-safe (esp. the DOM) v2
9417         https://bugs.webkit.org/show_bug.cgi?id=87581
9418
9419         Reviewed by Oliver Hunt.
9420
9421         * heap/MarkedBlock.cpp:
9422         (JSC::MarkedBlock::callDestructor):
9423         * heap/WeakBlock.h:
9424         * heap/WeakSetInlines.h:
9425         (JSC::WeakBlock::finalize): Since we don't guarantee destruction order,
9426         it's not valid to access GC pointers like the Structure pointer during
9427         finalization. We NULL out the structure pointer in debug builds to try
9428         to make this programming mistake more obvious.
9429
9430         * API/JSCallbackConstructor.cpp:
9431         (JSC::JSCallbackConstructor::destroy):
9432         * API/JSCallbackObject.cpp:
9433         (JSC::::destroy):
9434         (JSC::JSCallbackObjectData::finalize):
9435         * runtime/Arguments.cpp:
9436         (JSC::Arguments::destroy):
9437         * runtime/DateInstance.cpp:
9438         (JSC::DateInstance::destroy):
9439         * runtime/Error.cpp:
9440         (JSC::StrictModeTypeErrorFunction::destroy):
9441         * runtime/Executable.cpp:
9442         (JSC::ExecutableBase::destroy):
9443         (JSC::NativeExecutable::destroy):
9444         (JSC::ScriptExecutable::destroy):
9445         (JSC::EvalExecutable::destroy):
9446         (JSC::ProgramExecutable::destroy):
9447         (JSC::FunctionExecutable::destroy):
9448         * runtime/JSGlobalObject.cpp:
9449         (JSC::JSGlobalObject::destroy):
9450         * runtime/JSPropertyNameIterator.cpp:
9451         (JSC::JSPropertyNameIterator::destroy):
9452         * runtime/JSStaticScopeObject.cpp:
9453         (JSC::JSStaticScopeObject::destroy):
9454         * runtime/JSString.cpp:
9455         (JSC::JSString::destroy):
9456         * runtime/JSVariableObject.cpp:
9457         (JSC::JSVariableObject::destroy):
9458         * runtime/NameInstance.cpp:
9459         (JSC::NameInstance::destroy):
9460         * runtime/RegExp.cpp:
9461         (JSC::RegExp::destroy):
9462         * runtime/RegExpConstructor.cpp:
9463         (JSC::RegExpConstructor::destroy):
9464         * runtime/Structure.cpp:
9465         (JSC::Structure::destroy):
9466         * runtime/StructureChain.cpp:
9467         (JSC::StructureChain::destroy): Use static_cast instead of jsCast because
9468         jsCast does Structure-based validation, and our Structure is not guaranteed
9469         to be alive when we get finalized.
9470
9471 2012-05-22  Filip Pizlo  <fpizlo@apple.com>
9472
9473         DFG CSE should eliminate redundant WeakJSConstants
9474         https://bugs.webkit.org/show_bug.cgi?id=87179
9475
9476         Reviewed by Gavin Barraclough.
9477
9478         Merged r118141 from dfgopt.
9479
9480         * dfg/DFGCSEPhase.cpp:
9481         (JSC::DFG::CSEPhase::weakConstantCSE):
9482         (CSEPhase):
9483         (JSC::DFG::CSEPhase::performNodeCSE):
9484         * dfg/DFGNode.h:
9485         (JSC::DFG::Node::weakConstant):
9486
9487 2012-05-22  Filip Pizlo  <fpizlo@apple.com>
9488
9489         DFG CSE should do redundant store elimination
9490         https://bugs.webkit.org/show_bug.cgi?id=87161
9491
9492         Reviewed by Oliver Hunt.
9493
9494         Merge r118138 from dfgopt.
9495
9496         This patch adds redundant store elimination. For example, consider this
9497         code:
9498
9499         o.x = 42;
9500         o.x = 84;
9501
9502         If o.x is speculated to be a well-behaved field, the first assignment is
9503         unnecessary, since the second just overwrites it. We would like to
9504         eliminate the first assignment in these cases. The need for this
9505         optimization arises mostly from stores that our runtime requires. For
9506         example:
9507
9508         o = {f:1, g:2, h:3};
9509
9510         This will have four assignments to the structure for the newly created
9511         object - one assignment for the empty structure, one for {f}, one for
9512         {f, g}, and one for {f, g, h}. We would like to only have the last of
9513         those assigments in this case.
9514
9515         Intriguingly, doing so for captured variables breaks the way arguments
9516         simplification used to work. Consider that prior to either arguments
9517         simplification or store elimination we will have IR that looks like:
9518
9519         a: SetLocal(r0, Empty)
9520         b: SetLocal(r1, Empty)
9521         c: GetLocal(r0)
9522         d: CreateArguments(@c)
9523         e: SetLocal(r0, @d)
9524         f: SetLocal(r1, @d)
9525
9526         Then redundant store elimination will eliminate the stores that
9527         initialize the arguments registers to Empty, but then arguments
9528         simplification eliminates the stores that initialize the arguments to
9529         the newly created arguments - and at this point we no longer have any
9530         stores to the arguments register, leading to hilarious crashes. This
9531         patch therefore changes arguments simplification to replace
9532         CreateArguments with JSConstant(Empty) rather than eliminating the
9533         SetLocals. But this revealed bugs where arguments simplification was
9534         being overzealous, so I fixed those bugs.
9535
9536         This is a minor speed-up on V8/early and a handful of other tests.
9537
9538         * bytecode/CodeBlock.h:
9539         (JSC::CodeBlock::uncheckedActivationRegister):
9540         * dfg/DFGAbstractState.cpp:
9541         (JSC::DFG::AbstractState::execute):
9542         * dfg/DFGArgumentsSimplificationPhase.cpp:
9543         (JSC::DFG::ArgumentsSimplificationPhase::run):
9544         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
9545         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
9546         (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
9547         * dfg/DFGCSEPhase.cpp:
9548         (JSC::DFG::CSEPhase::globalVarStoreElimination):
9549         (CSEPhase):
9550         (JSC::DFG::CSEPhase::putStructureStoreElimination):
9551         (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
9552         (JSC::DFG::CSEPhase::setLocalStoreElimination):
9553         (JSC::DFG::CSEPhase::setReplacement):
9554         (JSC::DFG::CSEPhase::eliminate):
9555         (JSC::DFG::CSEPhase::performNodeCSE):
9556         * dfg/DFGGraph.h:
9557         (JSC::DFG::Graph::uncheckedActivationRegisterFor):
9558         (Graph):
9559         * dfg/DFGNode.h:
9560         (JSC::DFG::Node::isPhantomArguments):
9561         (Node):
9562         (JSC::DFG::Node::hasConstant):
9563         (JSC::DFG::Node::valueOfJSConstant):
9564         (JSC::DFG::Node::hasStructureTransitionData):
9565         * dfg/DFGNodeType.h:
9566         (DFG):
9567         * dfg/DFGPredictionPropagationPhase.cpp:
9568         (JSC::DFG::PredictionPropagationPhase::propagate):
9569         * dfg/DFGSpeculativeJIT.cpp:
9570         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
9571         * dfg/DFGSpeculativeJIT32_64.cpp:
9572         (JSC::DFG::SpeculativeJIT::compile):
9573         * dfg/DFGSpeculativeJIT64.cpp:
9574         (JSC::DFG::SpeculativeJIT::compile):
9575
9576 2012-05-21  Filip Pizlo  <fpizlo@apple.com>
9577
9578         DFG ConvertThis should just be a CheckStructure if the structure is known
9579         https://bugs.webkit.org/show_bug.cgi?id=87057
9580
9581         Reviewed by Gavin Barraclough.
9582
9583         Merged r118021 from dfgopt.
9584
9585         This gives ValueProfile the ability to track singleton values - i.e. profiling
9586         sites that always see the same value.
9587
9588         That is then used to profile the structure in op_convert_this.
9589
9590         This is then used to optimize op_convert_this into a CheckStructure if the
9591         structure is always the same.
9592
9593         That then results in better CSE in inlined code that uses 'this', since
9594         previously we couldn't CSE accesses on 'this' from different inline call frames.
9595
9596         Also fixed a bug where we were unnecessarily flushing 'this'.
9597
9598         * bytecode/CodeBlock.cpp:
9599         (JSC::CodeBlock::dump):
9600         (JSC::CodeBlock::stronglyVisitStrongReferences):
9601         * bytecode/LazyOperandValueProfile.cpp:
9602         (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions):
9603         * bytecode/LazyOperandValueProfile.h:
9604         (CompressedLazyOperandValueProfileHolder):
9605         * bytecode/Opcode.h:
9606         (JSC):
9607         (JSC::padOpcodeName):
9608         * bytecode/ValueProfile.h:
9609         (JSC::ValueProfileBase::ValueProfileBase):
9610         (JSC::ValueProfileBase::dump):
9611         (JSC::ValueProfileBase::computeUpdatedPrediction):
9612         (ValueProfileBase):
9613         * bytecompiler/BytecodeGenerator.cpp:
9614         (JSC::BytecodeGenerator::BytecodeGenerator):
9615         * dfg/DFGByteCodeParser.cpp:
9616         (JSC::DFG::ByteCodeParser::setArgument):
9617         (JSC::DFG::ByteCodeParser::parseBlock):
9618         * jit/JITOpcodes.cpp:
9619         (JSC::JIT::emit_op_convert_this):
9620         (JSC::JIT::emitSlow_op_convert_this):
9621         * jit/JITOpcodes32_64.cpp:
9622         (JSC::JIT::emit_op_convert_this):
9623         (JSC::JIT::emitSlow_op_convert_this):
9624         * llint/LLIntSlowPaths.cpp:
9625         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
9626         * llint/LowLevelInterpreter32_64.asm:
9627         * llint/LowLevelInterpreter64.asm:
9628         * runtime/JSValue.h:
9629         (JSValue):
9630         * runtime/Structure.h:
9631         (JSC::JSValue::structureOrUndefined):
9632         (JSC):
9633
9634 2012-05-24  Tim Horton  <timothy_horton@apple.com>
9635
9636         Add feature defines for web-facing parts of CSS Regions and Exclusions
9637         https://bugs.webkit.org/show_bug.cgi?id=87442
9638         <rdar://problem/10887709>
9639
9640         Reviewed by Dan Bernstein.
9641
9642         * Configurations/FeatureDefines.xcconfig:
9643
9644 2012-05-24  Geoffrey Garen  <ggaren@apple.com>
9645
9646         WebKit should be lazy-finalization-safe (esp. the DOM)
9647         https://bugs.webkit.org/show_bug.cgi?id=87456
9648
9649         Reviewed by Filip Pizlo.
9650
9651         Lazy finalization adds one twist to weak pointer use:
9652
9653                 A HashMap of weak pointers may contain logically null entries.
9654                 (Weak pointers behave as-if null once their payloads die.)
9655                 Insertion must not assume that a pre-existing entry is
9656                 necessarily valid, and iteration must not assume that all
9657                 entries can be dereferenced.
9658
9659         (Previously, I thought that it also added a second twist:
9660
9661                 A demand-allocated weak pointer may replace a dead payload
9662                 before the payload's finalizer runs. In that case, when the
9663                 payload's finalizer runs, the payload has already been
9664                 overwritten, and the finalizer should not clear the payload,
9665                 which now points to something new.
9666
9667         But that's not the case here, since we cancel the old payload's
9668         finalizer when we over-write it. I've added ASSERTs to verify this
9669         assumption, in case it ever changes.)
9670
9671         * API/JSClassRef.cpp:
9672         (OpaqueJSClass::prototype): No need to specify null; that's the default.
9673
9674         * API/JSWeakObjectMapRefPrivate.cpp: Use remove, since take() is gone.
9675
9676         * heap/PassWeak.h:
9677         (WeakImplAccessor::was): This is no longer a debug-only function, since
9678         it's required to reason about lazily finalized pointers.
9679
9680         * heap/Weak.h:
9681         (JSC::weakAdd):
9682         (JSC::weakRemove):
9683         (JSC::weakClear): Added these helper functions for the common idioms of
9684         what clients want to do in their weak pointer finalizers.
9685
9686         * jit/JITStubs.cpp:
9687         (JSC::JITThunks::hostFunctionStub): Use the new idioms. Otherwise, we
9688         would return NULL for a "zombie" executable weak pointer that was waiting
9689         for finalization (item (2)), and finalizing a dead executable weak pointer
9690         would potentially destroy a new, live one (item (1)).
9691
9692         * runtime/RegExpCache.cpp:
9693         (JSC::RegExpCache::lookupOrCreate):
9694         (JSC::RegExpCache::finalize): Ditto.
9695
9696         (JSC::RegExpCache::invalidateCode): Check for null while iterating. (See
9697         item (2).)
9698
9699         * runtime/Structure.cpp:
9700         (JSC::StructureTransitionTable::contains):
9701         (JSC::StructureTransitionTable::add): Use get and set instead of add and
9702         contains, since add and contains are not compatible with lazy finalization.
9703
9704         * runtime/WeakGCMap.h:
9705         (WeakGCMap):
9706         (JSC::WeakGCMap::clear):
9707         (JSC::WeakGCMap::remove): Removed a bunch of code that was incompatible with
9708         lazy finalization because I didn't feel like making it compatible, and I had
9709         no way to test it.
9710
9711 2012-05-24  Filip Pizlo  <fpizlo@apple.com>
9712
9713         REGRESSION (r118013-r118031): Loops/Reloads under www.yahoo.com, quits after three tries with error
9714         https://bugs.webkit.org/show_bug.cgi?id=87327
9715
9716         Reviewed by Geoffrey Garen.
9717
9718         If you use AbstractValue::filter(StructureSet) to test subset relationships between TOP and a
9719         set containing >=2 elements, you're going to have a bad time.
9720
9721         That's because AbstractValue considers a set with >=2 elements to be equivalent to TOP, in order
9722         to save space and speed up convergence. So filtering has no effect in this case, which made
9723         the code think that the abstract value was proving that the structure check was unnecessary.
9724         The correct thing to do is to use isSubsetOf() on the StructureAbstractValue, which does the
9725         right thingies for TOP and >=2 elements.
9726
9727         * dfg/DFGAbstractState.cpp:
9728         (JSC::DFG::AbstractState::execute):
9729         * dfg/DFGSpeculativeJIT32_64.cpp:
9730         (JSC::DFG::SpeculativeJIT::compile):
9731         * dfg/DFGSpeculativeJIT64.cpp:
9732         (JSC::DFG::SpeculativeJIT::compile):
9733
9734 2012-05-24  Filip Pizlo  <fpizlo@apple.com>
9735
9736         new test fast/js/dfg-arguments-mixed-alias.html fails on JSVALUE32_64
9737         https://bugs.webkit.org/show_bug.cgi?id=87378
9738
9739         Reviewed by Gavin Barraclough.
9740
9741         - Captured variable tracking forgot did not consistently handle arguments, leading to OSR
9742           badness.
9743
9744         - Nodes capable of exiting were tracked in a non-monotonic way, leading to compiler errors.
9745
9746         * dfg/DFGByteCodeParser.cpp:
9747         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
9748         * dfg/DFGCSEPhase.cpp:
9749         (JSC::DFG::CSEPhase::CSEPhase):
9750         (CSEPhase):
9751         (JSC::DFG::performCSE):
9752         * dfg/DFGCSEPhase.h:
9753         (DFG):
9754         * dfg/DFGCommon.h:
9755         * dfg/DFGDriver.cpp:
9756         (JSC::DFG::compile):
9757         * dfg/DFGGraph.cpp:
9758         (JSC::DFG::Graph::resetExitStates):
9759         (DFG):
9760         * dfg/DFGGraph.h:
9761         (Graph):
9762         * dfg/DFGPhase.h:
9763         (DFG):
9764         (JSC::DFG::runPhase):
9765
9766 2012-05-24  Geoffrey Garen  <ggaren@apple.com>
9767
9768         Made WeakSet per-block instead of per-heap
9769         https://bugs.webkit.org/show_bug.cgi?id=87401
9770
9771         Reviewed by Oliver Hunt.
9772
9773         This allows us fast access to the set of all weak pointers for a block,
9774         which is a step toward lazy finalization.
9775
9776         No performance change.
9777
9778         * heap/Heap.cpp:
9779         (JSC::Heap::Heap):
9780         (JSC::Heap::lastChanceToFinalize): Removed the per-heap weak set, since
9781         it's per-block now.
9782
9783         (JSC::Heap::markRoots): Delegate weak set visiting to the marked space,
9784         since it knows how to iterate all blocks.
9785
9786         (JSC::Heap::collect): Moved the reaping outside of markRoots, since it
9787         doesn't mark anything.
9788
9789         Make sure to reset allocators after shrinking, since shrinking may
9790         deallocate the current allocator.
9791
9792         * heap/Heap.h:
9793         (Heap): No more per-heap weak set, since it's per-block now.
9794
9795         * heap/MarkedBlock.cpp:
9796         (JSC::MarkedBlock::MarkedBlock):
9797         * heap/MarkedBlock.h:
9798         (MarkedBlock):
9799         (JSC::MarkedBlock::lastChanceToFinalize): Migrated finalization logic
9800         here from the heap, so the heap doesn't need to know about our internal
9801         data structures like our weak set.
9802
9803         (JSC::MarkedBlock::heap):
9804         (JSC::MarkedBlock::weakSet):
9805         (JSC::MarkedBlock::shrink):
9806         (JSC::MarkedBlock::resetAllocator):
9807         (JSC::MarkedBlock::visitWeakSet):
9808         (JSC::MarkedBlock::reapWeakSet):
9809         (JSC::MarkedBlock::sweepWeakSet):
9810         * heap/MarkedSpace.cpp:
9811         (JSC::VisitWeakSet::VisitWeakSet):
9812         (JSC::VisitWeakSet::operator()):
9813         (VisitWeakSet):
9814         (JSC):
9815         (JSC::ReapWeakSet::operator()):
9816         (JSC::SweepWeakSet::operator()):
9817         (JSC::LastChanceToFinalize::operator()):
9818         (JSC::MarkedSpace::lastChanceToFinalize):
9819         (JSC::ResetAllocator::operator()):
9820         (JSC::MarkedSpace::resetAllocators):
9821         (JSC::MarkedSpace::visitWeakSets):
9822         (JSC::MarkedSpace::reapWeakSets):
9823         (JSC::MarkedSpace::sweepWeakSets):
9824         (JSC::Shrink::operator()):
9825         (JSC::MarkedSpace::shrink):
9826         * heap/MarkedSpace.h:
9827         (MarkedSpace): Make sure to account for our weak sets when sweeping,
9828         shrinking, etc.
9829
9830         * heap/WeakSet.cpp:
9831         (JSC):
9832         * heap/WeakSet.h:
9833         (WeakSet):
9834         (JSC::WeakSet::heap):
9835         (JSC):
9836         (JSC::WeakSet::lastChanceToFinalize):
9837         (JSC::WeakSet::visit):
9838         (JSC::WeakSet::reap):
9839         (JSC::WeakSet::shrink):
9840         (JSC::WeakSet::resetAllocator): Inlined some things since they're called
9841         once per block now instead of once per heap.
9842
9843         * heap/WeakSetInlines.h:
9844         (JSC::WeakSet::allocate): Use the per-block weak set since there is no
9845         per-heap weak set anymore.
9846
9847 2012-05-24  Gavin Barraclough  <barraclough@apple.com>
9848
9849         Fix arm build
9850
9851         Rubber stamped by Geoff Garen
9852
9853         * dfg/DFGGPRInfo.h:
9854         (GPRInfo):
9855
9856 2012-05-24  Gavin Barraclough  <barraclough@apple.com>
9857
9858         Move cacheFlush from ExecutableAllocator to Assembler classes
9859         https://bugs.webkit.org/show_bug.cgi?id=87420
9860
9861         Reviewed by Oliver Hunt.
9862
9863         Makes more sense there, & remove a pile of #ifdefs.
9864
9865         * assembler/ARMAssembler.cpp:
9866         (JSC):
9867         (JSC::ARMAssembler::cacheFlush):
9868         * assembler/ARMAssembler.h:
9869         (ARMAssembler):
9870         (JSC::ARMAssembler::cacheFlush):
9871         * assembler/ARMv7Assembler.h:
9872         (JSC::ARMv7Assembler::relinkJump):
9873         (JSC::ARMv7Assembler::cacheFlush):
9874         (ARMv7Assembler):
9875         (JSC::ARMv7Assembler::setInt32):
9876         (JSC::ARMv7Assembler::setUInt7ForLoad):
9877         * assembler/AbstractMacroAssembler.h:
9878         (JSC::AbstractMacroAssembler::cacheFlush):
9879         * assembler/LinkBuffer.h:
9880         (JSC::LinkBuffer::performFinalization):
9881         * assembler/MIPSAssembler.h:
9882         (JSC::MIPSAssembler::relinkJump):
9883         (JSC::MIPSAssembler::relinkCall):
9884         (JSC::MIPSAssembler::repatchInt32):
9885         (JSC::MIPSAssembler::cacheFlush):
9886         (MIPSAssembler):
9887         * assembler/SH4Assembler.h:
9888         (JSC::SH4Assembler::repatchCompact):
9889         (JSC::SH4Assembler::cacheFlush):
9890         (SH4Assembler):
9891         * assembler/X86Assembler.h:
9892         (X86Assembler):
9893         (JSC::X86Assembler::cacheFlush):
9894         * jit/ExecutableAllocator.cpp:
9895         (JSC):
9896         * jit/ExecutableAllocator.h:
9897         (ExecutableAllocator):
9898
9899 2012-05-24  John Mellor  <johnme@chromium.org>
9900
9901         Font Boosting: Add compile flag and runtime setting
9902         https://bugs.webkit.org/show_bug.cgi?id=87394
9903
9904         Reviewed by Adam Barth.
9905
9906         Add ENABLE_FONT_BOOSTING.
9907
9908         * Configurations/FeatureDefines.xcconfig:
9909
9910 2012-05-24  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
9911
9912         cti_vm_throw gets kicked out by gcc 4.6 -flto
9913         https://bugs.webkit.org/show_bug.cgi?id=56088
9914
9915         Reviewed by Darin Adler.
9916
9917         Add REFERENCED_FROM_ASM to functions only referenced from assembler.
9918
9919         * dfg/DFGOperations.cpp:
9920         * jit/HostCallReturnValue.h:
9921         * jit/JITStubs.h:
9922         * jit/ThunkGenerators.cpp:
9923
9924 2012-05-24  Filip Pizlo  <fpizlo@apple.com>
9925
9926         Incorrect merge of r117542 from dfg opt branch in r118323 is leading to fast/js/dfg-arguments-osr-exit.html failing
9927         https://bugs.webkit.org/show_bug.cgi?id=87350
9928
9929         Reviewed by Maciej Stachowiak.
9930
9931         The dfgopt branch introduced the notion of a local variable being killed because it was aliased
9932         to the Arguments object as in cases like:
9933
9934         var a = arguments;
9935         return a.length;
9936
9937         This required changes to OSR exit handling - if the variable is dead but aliased to arguments, then
9938         OSR exit should reify the arguments. But meanwhile, in tip of tree we introduced special handling for
9939         dead variables on OSR exit. When the two were merged in r118323, the structure of the if/else branches
9940         ended up being such that we would treat dead arguments variables as totally dead as opposed to treating
9941         them as variables that need arguments reification.
9942
9943         This fixes the structure of the relevant if/else block so that variables that are dead-but-arguments
9944         end up being treated as reified arguments objects, while variables that are dead but not aliased to
9945         arguments are treated as tip of tree would have treated them (initialize to Undefined).
9946
9947         * dfg/DFGSpeculativeJIT.cpp:
9948         (JSC::DFG::SpeculativeJIT::compile):
9949
9950 2012-05-24  Csaba Osztrogonác  <ossy@webkit.org>
9951
9952         Unreviewed 32 bit buildfix after r118325.
9953
9954         * dfg/DFGSpeculativeJIT32_64.cpp:
9955         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): Use ASSERT_UNUSED instead ASSERT.
9956
9957 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
9958
9959         DFG operationTearOffActivation should return after handling the null activation case
9960         https://bugs.webkit.org/show_bug.cgi?id=87348
9961         <rdar://problem/11522295>
9962
9963         Reviewed by Oliver Hunt.
9964
9965         * dfg/DFGOperations.cpp:
9966
9967 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
9968
9969         Unreviewed, merge the arguments fix in r118138 to get bots green.
9970
9971         * dfg/DFGArgumentsSimplificationPhase.cpp:
9972         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
9973
9974 2012-05-20  Filip Pizlo  <fpizlo@apple.com>
9975
9976         DFG CFA should record if a node can OSR exit
9977         https://bugs.webkit.org/show_bug.cgi?id=86905
9978
9979         Reviewed by Oliver Hunt.
9980
9981         Merged r117931 from dfgopt.
9982
9983         Adds a NodeFlag that denotes nodes that are known to not have OSR exits.
9984         This ought to aid any backwards analyses that need to know when a
9985         backward flow merge might happen due to a side exit.
9986
9987         Also added assertions into speculationCheck() that ensure that we did not
9988         mark a node as non-exiting and then promptly compile in an exit. This
9989         helped catch some minor bugs where we were doing unnecessary speculation
9990         checks.
9991
9992         This is a perf-neutral change. The speculation checks that this removes
9993         were not on hot paths of major benchmarks.
9994
9995         * bytecode/PredictedType.h:
9996         (JSC):
9997         (JSC::isAnyPrediction):
9998         * dfg/DFGAbstractState.cpp:
9999         (JSC::DFG::AbstractState::execute):
10000         * dfg/DFGAbstractState.h:
10001         (JSC::DFG::AbstractState::speculateInt32Unary):
10002         (AbstractState):
10003         (JSC::DFG::AbstractState::speculateNumberUnary):
10004         (JSC::DFG::AbstractState::speculateBooleanUnary):
10005         (JSC::DFG::AbstractState::speculateInt32Binary):
10006         (JSC::DFG::AbstractState::speculateNumberBinary):
10007         * dfg/DFGNode.h:
10008         (JSC::DFG::Node::mergeFlags):
10009         (JSC::DFG::Node::filterFlags):
10010         (Node):
10011         (JSC::DFG::Node::setCanExit):
10012         (JSC::DFG::Node::canExit):
10013         * dfg/DFGNodeFlags.cpp:
10014         (JSC::DFG::nodeFlagsAsString):
10015         * dfg/DFGNodeFlags.h:
10016         (DFG):
10017         * dfg/DFGSpeculativeJIT.cpp:
10018         (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
10019         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
10020         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
10021         * dfg/DFGSpeculativeJIT.h:
10022         (JSC::DFG::SpeculativeJIT::speculationCheck):
10023         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
10024         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
10025         (SpeculativeJIT):
10026         * dfg/DFGSpeculativeJIT32_64.cpp:
10027         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
10028         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
10029         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
10030         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
10031         (JSC::DFG::SpeculativeJIT::compile):
10032         * dfg/DFGSpeculativeJIT64.cpp:
10033         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
10034         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
10035         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
10036         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
10037         (JSC::DFG::SpeculativeJIT::compile):
10038
10039 2012-05-20  Filip Pizlo  <fpizlo@apple.com>
10040
10041         DFG should not do unnecessary indirections when storing to objects
10042         https://bugs.webkit.org/show_bug.cgi?id=86959
10043
10044         Reviewed by Oliver Hunt.
10045
10046         Merged r117819 from dfgopt.
10047
10048         * dfg/DFGByteCodeParser.cpp:
10049         (JSC::DFG::ByteCodeParser::parseBlock):
10050         * dfg/DFGCSEPhase.cpp:
10051         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
10052         * dfg/DFGSpeculativeJIT32_64.cpp:
10053         (JSC::DFG::SpeculativeJIT::compile):
10054         * dfg/DFGSpeculativeJIT64.cpp:
10055         (JSC::DFG::SpeculativeJIT::compile):
10056
10057 2012-05-17  Filip Pizlo  <fpizlo@apple.com>
10058
10059         DFG should optimize aliased uses of the Arguments object of the current call frame
10060         https://bugs.webkit.org/show_bug.cgi?id=86552
10061
10062         Reviewed by Geoff Garen.
10063
10064         Merged r117542 and r117543 from dfgopt.
10065
10066         Performs must-alias and escape analysis on uses of CreateArguments, and if
10067         a variable is must-aliased to CreateArguments and does not escape, then we
10068         turn all uses of that variable into direct arguments accesses.
10069
10070         36% speed-up on V8/earley leading to a 2.3% speed-up overall in V8.
10071
10072         * bytecode/CodeBlock.h:
10073         (JSC::CodeBlock::uncheckedArgumentsRegister):
10074         * bytecode/ValueRecovery.h:
10075         (JSC::ValueRecovery::argumentsThatWereNotCreated):
10076         (ValueRecovery):
10077         (JSC::ValueRecovery::dump):
10078         * dfg/DFGAbstractState.cpp:
10079         (JSC::DFG::AbstractState::execute):
10080         * dfg/DFGAdjacencyList.h:
10081         (AdjacencyList):
10082         (JSC::DFG::AdjacencyList::removeEdgeFromBag):
10083         * dfg/DFGArgumentsSimplificationPhase.cpp:
10084         (JSC::DFG::ArgumentsSimplificationPhase::run):
10085         (ArgumentsSimplificationPhase):
10086         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
10087         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
10088         (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
10089         (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
10090         (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
10091         * dfg/DFGAssemblyHelpers.h:
10092         (JSC::DFG::AssemblyHelpers::argumentsRegisterFor):
10093         (AssemblyHelpers):
10094         * dfg/DFGByteCodeParser.cpp:
10095         (JSC::DFG::ByteCodeParser::parseBlock):
10096         * dfg/DFGCFGSimplificationPhase.cpp:
10097         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
10098         * dfg/DFGGPRInfo.h:
10099         (GPRInfo):
10100         * dfg/DFGGraph.cpp:
10101         (JSC::DFG::Graph::collectGarbage):
10102         (DFG):
10103         * dfg/DFGGraph.h:
10104         (Graph):
10105         (JSC::DFG::Graph::executableFor):
10106         (JSC::DFG::Graph::argumentsRegisterFor):
10107         (JSC::DFG::Graph::uncheckedArgumentsRegisterFor):
10108         (JSC::DFG::Graph::clobbersWorld):
10109         * dfg/DFGNode.h:
10110         (JSC::DFG::Node::hasHeapPrediction):
10111         * dfg/DFGNodeType.h:
10112         (DFG):
10113         * dfg/DFGOSRExitCompiler.cpp:
10114         * dfg/DFGOSRExitCompiler.h:
10115         (JSC::DFG::OSRExitCompiler::OSRExitCompiler):
10116         (OSRExitCompiler):
10117         * dfg/DFGOSRExitCompiler32_64.cpp:
10118         (JSC::DFG::OSRExitCompiler::compileExit):
10119         * dfg/DFGOSRExitCompiler64.cpp:
10120         (JSC::DFG::OSRExitCompiler::compileExit):
10121         * dfg/DFGOperations.cpp:
10122         * dfg/DFGPredictionPropagationPhase.cpp:
10123         (JSC::DFG::PredictionPropagationPhase::propagate):
10124         * dfg/DFGSpeculativeJIT.cpp:
10125         (JSC::DFG::ValueSource::dump):
10126         (JSC::DFG::SpeculativeJIT::compile):
10127         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
10128         * dfg/DFGSpeculativeJIT.h:
10129         * dfg/DFGSpeculativeJIT32_64.cpp:
10130         (JSC::DFG::SpeculativeJIT::compile):
10131         * dfg/DFGSpeculativeJIT64.cpp:
10132         (JSC::DFG::SpeculativeJIT::compile):
10133         * dfg/DFGVariableAccessData.h:
10134         (JSC::DFG::VariableAccessData::VariableAccessData):
10135         (JSC::DFG::VariableAccessData::mergeIsArgumentsAlias):
10136         (VariableAccessData):
10137         (JSC::DFG::VariableAccessData::isArgumentsAlias):
10138         * jit/JITOpcodes.cpp:
10139         (JSC::JIT::emitSlow_op_get_argument_by_val):
10140
10141 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10142
10143         DFGCapabilities should not try to get an arguments register from code blocks that don't have one
10144         https://bugs.webkit.org/show_bug.cgi?id=87332
10145
10146         Reviewed by Andy Estes.
10147
10148         * dfg/DFGCapabilities.h:
10149         (JSC::DFG::canInlineOpcode):
10150
10151 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10152
10153         DFG should have sparse conditional constant propagation
10154         https://bugs.webkit.org/show_bug.cgi?id=86580
10155
10156         Reviewed by Oliver Hunt.
10157
10158         Merged r117370 from dfgopt.
10159
10160         This enhances CFA so that if it suspects at any point during the fixpoint that a
10161         branch will only go one way, then it only propagates in that one way.
10162
10163         This vastly increases the opportunities for CFG simplification. For example, it
10164         enables us to evaporate this loop:
10165
10166         for (var i = 0; i < 1; ++i) doThings(i);
10167
10168         As a result, it uncovered loads of bugs in the CFG simplifier. In particular:
10169
10170         - Phi fixup was assuming that all Phis worth fixing up are shouldGenerate().
10171           That's not true; we also fixup Phis that are dead.
10172
10173         - GetLocal fixup was assuming that it's only necessary to rewire links to a
10174           GetLocal, and that the GetLocal's own links don't need to be rewired. Untrue,
10175           because the GetLocal may not be rewirable (first block has no GetLocal for r42
10176           but second block does have a GetLocal), in which case it will refer to a Phi
10177           in the second block. We need it to refer to a Phi from the first block to
10178           ensure that subsequent transformations work.
10179
10180         - Tail operand fixup was ignoring the fact that Phis in successors may contain
10181           references to the children of our tail variables. Hence, successor Phi child
10182           substitution needs to use the original second block variable table as its
10183           prior, rather than trying to reconstruct the prior later (since by that point
10184           the children of the second block's tail variables will have been fixed up, so
10185           we will not know what the prior would have been).
10186
10187         * dfg/DFGAbstractState.cpp:
10188         (JSC::DFG::AbstractState::beginBasicBlock):
10189         (JSC::DFG::AbstractState::endBasicBlock):
10190         (JSC::DFG::AbstractState::reset):
10191         (JSC::DFG::AbstractState::execute):
10192         (JSC::DFG::AbstractState::mergeToSuccessors):
10193         * dfg/DFGAbstractState.h:
10194         (JSC::DFG::AbstractState::branchDirectionToString):
10195         (AbstractState):
10196         * dfg/DFGCFGSimplificationPhase.cpp:
10197         (JSC::DFG::CFGSimplificationPhase::run):
10198         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
10199         (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::OperandSubstitution):
10200         (OperandSubstitution):
10201         (JSC::DFG::CFGSimplificationPhase::skipGetLocal):
10202         (JSC::DFG::CFGSimplificationPhase::recordPossibleIncomingReference):
10203         (CFGSimplificationPhase):
10204         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
10205         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
10206         * dfg/DFGGraph.h:
10207         (JSC::DFG::Graph::changeEdge):
10208
10209 2012-05-23  Ojan Vafai  <ojan@chromium.org>
10210
10211         add back the ability to disable flexbox
10212         https://bugs.webkit.org/show_bug.cgi?id=87147
10213
10214         Reviewed by Tony Chang.
10215
10216         * Configurations/FeatureDefines.xcconfig:
10217
10218 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10219
10220         Unreviewed, fix Windows build.
10221
10222         * bytecode/CodeBlock.h:
10223         * dfg/DFGCapabilities.h:
10224         (JSC::DFG::canCompileOpcode):
10225         (JSC::DFG::canCompileOpcodes):
10226         * dfg/DFGCommon.h:
10227         (DFG):
10228
10229 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10230
10231         DFG should optimize inlined uses of arguments.length and arguments[i]
10232         https://bugs.webkit.org/show_bug.cgi?id=86327
10233
10234         Reviewed by Gavin Barraclough.
10235
10236         Merged r117017 from dfgopt.
10237
10238         Turns inlined uses of arguments.length into a constant.
10239
10240         Turns inlined uses of arguments[constant] into a direct reference to the
10241         argument.
10242
10243         Big win on micro-benchmarks. Not yet a win on V8 because the hot uses of
10244         arguments.length and arguments[i] are aliased. I'll leave the aliasing
10245         optimizations to a later patch.
10246
10247         * CMakeLists.txt:
10248         * GNUmakefile.list.am:
10249         * JavaScriptCore.xcodeproj/project.pbxproj:
10250         * Target.pri:
10251         * bytecode/DFGExitProfile.h:
10252         (FrequentExitSite):
10253         (JSC::DFG::FrequentExitSite::FrequentExitSite):
10254         (JSC::DFG::QueryableExitProfile::hasExitSite):
10255         (QueryableExitProfile):
10256         * dfg/DFGAbstractState.cpp:
10257         (JSC::DFG::AbstractState::execute):
10258         * dfg/DFGArgumentsSimplificationPhase.cpp: Added.
10259         (DFG):
10260         (ArgumentsSimplificationPhase):
10261         (JSC::DFG::ArgumentsSimplificationPhase::ArgumentsSimplificationPhase):
10262         (JSC::DFG::ArgumentsSimplificationPhase::run):
10263         (JSC::DFG::performArgumentsSimplification):
10264         * dfg/DFGArgumentsSimplificationPhase.h: Added.
10265         (DFG):
10266         * dfg/DFGAssemblyHelpers.cpp:
10267         (JSC::DFG::AssemblyHelpers::executableFor):
10268         (DFG):
10269         * dfg/DFGAssemblyHelpers.h:
10270         (AssemblyHelpers):
10271         * dfg/DFGByteCodeParser.cpp:
10272         (JSC::DFG::ByteCodeParser::parseBlock):
10273         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
10274         * dfg/DFGCSEPhase.cpp:
10275         (JSC::DFG::CSEPhase::getLocalLoadElimination):
10276         (JSC::DFG::CSEPhase::performNodeCSE):
10277         * dfg/DFGDriver.cpp:
10278         (JSC::DFG::compile):
10279         * dfg/DFGGraph.h:
10280         (JSC::DFG::Graph::Graph):
10281         (JSC::DFG::Graph::executableFor):
10282         (Graph):
10283         (JSC::DFG::Graph::clobbersWorld):
10284         * dfg/DFGNode.h:
10285         (JSC::DFG::Node::convertToConstant):
10286         (JSC::DFG::Node::convertToGetLocalUnlinked):
10287         (Node):
10288         (JSC::DFG::Node::unlinkedLocal):
10289         * dfg/DFGNodeType.h:
10290         (DFG):
10291         * dfg/DFGOSRExit.cpp:
10292         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
10293         * dfg/DFGPredictionPropagationPhase.cpp:
10294         (JSC::DFG::PredictionPropagationPhase::propagate):
10295         * dfg/DFGSpeculativeJIT32_64.cpp:
10296         (JSC::DFG::SpeculativeJIT::compile):
10297         * dfg/DFGSpeculativeJIT64.cpp:
10298         (JSC::DFG::SpeculativeJIT::compile):
10299
10300 2012-05-13  Filip Pizlo  <fpizlo@apple.com>
10301
10302         DFG should be able to optimize foo.apply(bar, arguments)
10303         https://bugs.webkit.org/show_bug.cgi?id=86306
10304
10305         Reviewed by Gavin Barraclough.
10306
10307         Merge r116912 from dfgopt.
10308
10309         Enables compilation of op_jneq_ptr and some forms of op_call_varargs.
10310
10311         Also includes a bunch of bug fixes that were made necessary by the increased
10312         pressure on the CFG simplifier.
10313
10314         This is a 1-2% win on V8.
10315
10316         * bytecode/CodeBlock.cpp:
10317         (JSC::CodeBlock::printCallOp):
10318         (JSC::CodeBlock::CodeBlock):
10319         (JSC::ProgramCodeBlock::canCompileWithDFGInternal):
10320         (JSC::EvalCodeBlock::canCompileWithDFGInternal):
10321         (JSC::FunctionCodeBlock::canCompileWithDFGInternal):
10322         * bytecode/CodeBlock.h:
10323         (CodeBlock):
10324         (JSC::CodeBlock::canCompileWithDFG):
10325         (JSC::CodeBlock::canCompileWithDFGState):
10326         (ProgramCodeBlock):
10327         (EvalCodeBlock):
10328         (FunctionCodeBlock):
10329         * dfg/DFGAbstractState.cpp:
10330         (JSC::DFG::AbstractState::execute):
10331         * dfg/DFGByteCodeParser.cpp:
10332         (JSC::DFG::ByteCodeParser::parseBlock):
10333         (JSC::DFG::ByteCodeParser::processPhiStack):
10334         (JSC::DFG::ByteCodeParser::parse):
10335         * dfg/DFGCFGSimplificationPhase.cpp:
10336         (JSC::DFG::CFGSimplificationPhase::run):
10337         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
10338         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
10339         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
10340         * dfg/DFGCSEPhase.cpp:
10341         (JSC::DFG::CSEPhase::getLocalLoadElimination):
10342         (CSEPhase):
10343         (JSC::DFG::CSEPhase::setReplacement):
10344         (JSC::DFG::CSEPhase::performNodeCSE):
10345         * dfg/DFGCapabilities.cpp:
10346         (JSC::DFG::debugFail):
10347         (DFG):
10348         (JSC::DFG::canHandleOpcodes):
10349         (JSC::DFG::canCompileOpcodes):
10350         (JSC::DFG::canInlineOpcodes):
10351         * dfg/DFGCapabilities.h:
10352         (JSC::DFG::canCompileOpcode):
10353         (JSC::DFG::canInlineOpcode):
10354         (DFG):
10355         (JSC::DFG::canCompileOpcodes):
10356         (JSC::DFG::canCompileEval):
10357         (JSC::DFG::canCompileProgram):
10358         (JSC::DFG::canCompileFunctionForCall):
10359         (JSC::DFG::canCompileFunctionForConstruct):
10360         * dfg/DFGCommon.h:
10361         * dfg/DFGGraph.cpp:
10362         (JSC::DFG::Graph::dump):
10363         * dfg/DFGNodeType.h:
10364         (DFG):
10365         * dfg/DFGPredictionPropagationPhase.cpp:
10366         (JSC::DFG::PredictionPropagationPhase::propagate):
10367         * dfg/DFGSpeculativeJIT32_64.cpp:
10368         (JSC::DFG::SpeculativeJIT::compile):
10369         * dfg/DFGSpeculativeJIT64.cpp:
10370         (JSC::DFG::SpeculativeJIT::emitCall):
10371         (JSC::DFG::SpeculativeJIT::compile):
10372         * dfg/DFGValidate.cpp:
10373         (Validate):
10374         (JSC::DFG::Validate::validate):
10375         (JSC::DFG::Validate::checkOperand):
10376         (JSC::DFG::Validate::reportValidationContext):
10377         * jit/JIT.cpp:
10378         (JSC::JIT::emitOptimizationCheck):
10379         (JSC::JIT::privateCompileSlowCases):
10380         (JSC::JIT::privateCompile):
10381         * jit/JIT.h:
10382         * jit/JITArithmetic.cpp:
10383         (JSC::JIT::compileBinaryArithOp):
10384         * jit/JITPropertyAccess.cpp:
10385         (JSC::JIT::privateCompilePutByIdTransition):
10386         * jit/JITPropertyAccess32_64.cpp:
10387         (JSC::JIT::privateCompilePutByIdTransition):
10388         * tools/CodeProfile.cpp:
10389         (JSC::CodeProfile::sample):
10390
10391 2012-05-23  Geoffrey Garen  <ggaren@apple.com>
10392
10393         Refactored WeakBlock to use malloc, clarify behavior
10394         https://bugs.webkit.org/show_bug.cgi?id=87318
10395
10396         Reviewed by Filip Pizlo.
10397
10398         We want to use malloc so we can make these smaller than 4KB,
10399         since an individual MarkedBlock will usually have fewer than
10400         4KB worth of weak pointers.
10401
10402         * heap/Heap.cpp:
10403         (JSC::Heap::markRoots): Renamed visitLiveWeakImpls to visit, since
10404         we no longer need to distinguish from "visitDeadWeakImpls".
10405
10406         Renamed "visitDeadWeakImpls" to "reap" because we're not actually
10407         doing any visiting -- we're just tagging things as dead.
10408
10409         * heap/WeakBlock.cpp:
10410         (JSC::WeakBlock::create):
10411         (JSC::WeakBlock::destroy):
10412         (JSC::WeakBlock::WeakBlock): Malloc!
10413
10414         (JSC::WeakBlock::visit):
10415         (JSC::WeakBlock::reap): Renamed as above.
10416
10417         * heap/WeakBlock.h:
10418         (WeakBlock): Reduced to 3KB, as explained above.
10419
10420         * heap/WeakSet.cpp:
10421         (JSC::WeakSet::visit):
10422         (JSC::WeakSet::reap):
10423         * heap/WeakSet.h:
10424         (WeakSet): Updated for renames, and to match WebKit style.
10425
10426 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10427
10428         Use after free in JSC::DFG::ByteCodeParser::processPhiStack
10429         https://bugs.webkit.org/show_bug.cgi?id=87312
10430         <rdar://problem/11518848>
10431
10432         Reviewed by Oliver Hunt.
10433
10434         * dfg/DFGByteCodeParser.cpp:
10435         (JSC::DFG::ByteCodeParser::processPhiStack):
10436         (JSC::DFG::ByteCodeParser::parse):
10437
10438 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10439
10440         It should be possible to make C function calls from DFG code on ARM in debug mode
10441         https://bugs.webkit.org/show_bug.cgi?id=87313
10442
10443         Reviewed by Gavin Barraclough.
10444
10445         * dfg/DFGSpeculativeJIT.h:
10446         (SpeculativeJIT):
10447
10448 2012-05-11  Filip Pizlo  <fpizlo@apple.com>
10449
10450         DFG should be able to inline functions that use arguments reflectively
10451         https://bugs.webkit.org/show_bug.cgi?id=86132
10452
10453         Reviewed by Oliver Hunt.
10454
10455         Merged r116838 from dfgopt.
10456
10457         This turns on inlining of functions that use arguments reflectively, but it
10458         does not do any of the obvious optimizations that this exposes. I'll save that
10459         for another patch - the important thing for now is that this contains all of
10460         the plumbing necessary to make this kind of inlining sound even in bizarro
10461         cases like an inline callee escaping the arguments object to parts of the
10462         inline caller where the arguments are otherwise dead. Or even more fun cases
10463         like where you've inlined to an inline stack that is three-deep, and the
10464         function on top of the inline stack reflectively accesses the arguments of a
10465         function that is in the middle of the inline stack. Any subsequent
10466         optimizations that we do for the obvious cases of arguments usage in inline
10467         functions will have to take care not to break the baseline functionality that
10468         this patch plumbs together.
10469
10470         * bytecode/CodeBlock.cpp:
10471         (JSC::CodeBlock::printCallOp):
10472         (JSC::CodeBlock::dump):
10473         * bytecode/CodeBlock.h:
10474         * dfg/DFGAssemblyHelpers.h:
10475         (JSC::DFG::AssemblyHelpers::argumentsRegisterFor):
10476         (AssemblyHelpers):
10477         * dfg/DFGByteCodeParser.cpp:
10478         (InlineStackEntry):
10479         (JSC::DFG::ByteCodeParser::handleCall):
10480         (JSC::DFG::ByteCodeParser::handleInlining):
10481         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
10482         (JSC::DFG::ByteCodeParser::parse):
10483         * dfg/DFGCCallHelpers.h:
10484         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
10485         (CCallHelpers):
10486         * dfg/DFGCapabilities.h:
10487         (JSC::DFG::canInlineOpcode):
10488         * dfg/DFGDriver.cpp:
10489         (JSC::DFG::compile):
10490         * dfg/DFGFixupPhase.cpp:
10491         (JSC::DFG::FixupPhase::fixupNode):
10492         * dfg/DFGOperations.cpp:
10493         * dfg/DFGOperations.h:
10494         * dfg/DFGSpeculativeJIT.h:
10495         (JSC::DFG::SpeculativeJIT::callOperation):
10496         * dfg/DFGSpeculativeJIT32_64.cpp:
10497         (JSC::DFG::SpeculativeJIT::compile):
10498         * dfg/DFGSpeculativeJIT64.cpp:
10499         (JSC::DFG::SpeculativeJIT::compile):
10500         * interpreter/CallFrame.cpp:
10501         (JSC):
10502         (JSC::CallFrame::someCodeBlockForPossiblyInlinedCode):
10503         * interpreter/CallFrame.h:
10504         (ExecState):
10505         (JSC::ExecState::someCodeBlockForPossiblyInlinedCode):
10506         * interpreter/Interpreter.cpp:
10507         (JSC::Interpreter::retrieveArgumentsFromVMCode):
10508         * runtime/Arguments.cpp:
10509         (JSC::Arguments::tearOff):
10510         (JSC):
10511         (JSC::Arguments::tearOffForInlineCallFrame):
10512         * runtime/Arguments.h:
10513         (Arguments):
10514         (JSC::Arguments::create):
10515         (JSC::Arguments::finishCreation):
10516         (JSC):
10517
10518 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10519
10520         Every OSR exit on ARM results in a crash
10521         https://bugs.webkit.org/show_bug.cgi?id=87307
10522
10523         Reviewed by Geoffrey Garen.
10524
10525         * dfg/DFGThunks.cpp:
10526         (JSC::DFG::osrExitGenerationThunkGenerator):
10527
10528 2012-05-23  Geoffrey Garen  <ggaren@apple.com>
10529
10530         Refactored heap tear-down to use normal value semantics (i.e., destructors)
10531         https://bugs.webkit.org/show_bug.cgi?id=87302
10532
10533         Reviewed by Oliver Hunt.
10534
10535         This is a step toward incremental DOM finalization.
10536
10537         * heap/CopiedSpace.cpp:
10538         (JSC::CopiedSpace::~CopiedSpace):
10539         * heap/CopiedSpace.h:
10540         (CopiedSpace): Just use our destructor, instead of relying on the heap
10541         to send us a special message at a special time.
10542
10543         * heap/Heap.cpp:
10544         (JSC::Heap::Heap): Use OwnPtr for m_markListSet because this is not Sparta.
10545
10546         (JSC::Heap::~Heap): No need for delete or freeAllBlocks because normal
10547         destructors do this work automatically now.
10548
10549         (JSC::Heap::lastChanceToFinalize): Just call lastChanceToFinalize on our
10550         sub-objects, and assume it does the right thing. This improves encapsulation,
10551         so we can add items requiring finalization to our sub-objects.
10552
10553         * heap/Heap.h: Moved m_blockAllocator to get the right destruction order.
10554
10555         * heap/MarkedSpace.cpp:
10556         (Take):
10557         (JSC):
10558         (JSC::Take::Take):
10559         (JSC::Take::operator()):
10560         (JSC::Take::returnValue): Moved to the top of the file so it can be used
10561         in another function.
10562
10563         (JSC::MarkedSpace::~MarkedSpace): Delete all outstanding memory, like a good
10564         destructor should.
10565
10566         (JSC::MarkedSpace::lastChanceToFinalize): Moved some code here from the heap,
10567         since it pertains to our internal implementation details.
10568
10569         * heap/MarkedSpace.h:
10570         (MarkedSpace):
10571         * heap/WeakBlock.cpp:
10572         (JSC::WeakBlock::lastChanceToFinalize):
10573         * heap/WeakBlock.h:
10574         (WeakBlock):
10575         * heap/WeakSet.cpp:
10576         (JSC::WeakSet::lastChanceToFinalize):
10577         * heap/WeakSet.h:
10578         (WeakSet): Stop using a special freeAllBlocks() callback and just implement
10579         lastChanceToFinalize.
10580
10581 2011-05-22  Geoffrey Garen  <ggaren@apple.com>
10582
10583         Encapsulated some calculations for whether portions of the heap are empty
10584         https://bugs.webkit.org/show_bug.cgi?id=87210
10585
10586         Reviewed by Gavin Barraclough.
10587
10588         This is a step toward incremental DOM finalization.
10589
10590         * heap/Heap.cpp:
10591         (JSC::Heap::~Heap): Explicitly call freeAllBlocks() instead of relying
10592         implicitly on all blocks thinking they're empty. In future, we may
10593         choose to tear down the heap without first setting all data structures
10594         to "empty".
10595
10596         * heap/MarkedBlock.h:
10597         (JSC::MarkedBlock::isEmpty):
10598         (JSC::MarkedBlock::gatherDirtyCells): Renamed markCountIsZero to isEmpty,
10599         in preparation for making it check for outstanding finalizers in addition
10600         to marked cells.
10601
10602         * heap/MarkedSpace.cpp:
10603         (Take):
10604         (JSC::Take::Take):
10605         (JSC::Take::operator()):
10606         (JSC::Take::returnValue):
10607         (JSC::MarkedSpace::shrink):
10608         (JSC::MarkedSpace::freeAllBlocks): Refactored the "Take" functor to support
10609         a conditional isEmpty check, so it dould be shared by shrink() and freeAllBlocks().
10610
10611         * heap/WeakBlock.cpp:
10612         (JSC::WeakBlock::WeakBlock):
10613         (JSC::WeakBlock::visitLiveWeakImpls):
10614         (JSC::WeakBlock::visitDeadWeakImpls):
10615         * heap/WeakBlock.h:
10616         (WeakBlock):
10617         (JSC::WeakBlock::isEmpty):
10618         * heap/WeakSet.cpp:
10619         (JSC::WeakSet::sweep):
10620         (JSC::WeakSet::shrink): Use isEmpty(), in preparation for changes in
10621         its implementation.
10622
10623 2012-05-23  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
10624
10625         [Qt] Remove references to $$QT_SOURCE_TREE
10626
10627         With a modularized Qt, it's ambigious. What we really want is qtbase,
10628         which qtcore is a proxy for (we assume it will always live in qtbase).
10629
10630         Reviewed by Tor Arne Vestbø.
10631
10632         * JavaScriptCore.pri:
10633         * Target.pri:
10634
10635 2012-05-09  Filip Pizlo  <fpizlo@apple.com>
10636
10637         DFG should allow inlining in case of certain arity mismatches
10638         https://bugs.webkit.org/show_bug.cgi?id=86059
10639
10640         Reviewed by Geoff Garen.
10641
10642         Merge r116620 from dfgopt.
10643
10644         * dfg/DFGByteCodeParser.cpp:
10645         (JSC::DFG::ByteCodeParser::handleInlining):
10646
10647 2012-05-08  Filip Pizlo  <fpizlo@apple.com>
10648
10649         DFG variable capture analysis should work even if the variables arose through inlining
10650         https://bugs.webkit.org/show_bug.cgi?id=85945
10651
10652         Reviewed by Oliver Hunt.
10653
10654         Merged r116555 from dfgopt.
10655
10656         This just changes how the DFG queries whether a variable is captured. It does not
10657         change any user-visible behavior.
10658
10659         As part of this change, I further solidified the policy that the CFA behaves in an
10660         undefined way for captured locals and queries about their values will not yield
10661         reliable results. This will likely be changed in the future, but for now it makes
10662         sense.
10663
10664         One fun part about this change is that it recognizes that the same variable may
10665         be both captured and not, at the same time, because their live interval spans
10666         inlining boundaries. This only happens in the case of arguments to functions that
10667         capture their arguments, and this change treats them with just the right touch of
10668         conservatism: they will be treated as if captured by the caller as well as the
10669         callee.
10670
10671         Finally, this also adds captured variable reasoning to the InlineCallFrame, which
10672         I thought might be useful for later tooling.
10673
10674         This is perf-neutral, since it does it does not make the DFG take advantage of this
10675         new functionality in any way. In particular, it is still the case that the DFG will
10676         not inline functions that use arguments reflectively or that create activations.
10677
10678         * bytecode/CodeBlock.h:
10679         (CodeBlock):
10680         (JSC::CodeBlock::needsActivation):
10681         (JSC::CodeBlock::argumentIsCaptured):
10682         (JSC::CodeBlock::localIsCaptured):
10683         (JSC::CodeBlock::isCaptured):
10684         * bytecode/CodeOrigin.h:
10685         (InlineCallFrame):
10686         * dfg/DFGAbstractState.cpp:
10687         (JSC::DFG::AbstractState::initialize):
10688         (JSC::DFG::AbstractState::endBasicBlock):
10689         (JSC::DFG::AbstractState::execute):
10690         (JSC::DFG::AbstractState::merge):
10691         * dfg/DFGByteCodeParser.cpp:
10692         (JSC::DFG::ByteCodeParser::newVariableAccessData):
10693         (JSC::DFG::ByteCodeParser::getLocal):
10694         (JSC::DFG::ByteCodeParser::setLocal):
10695         (JSC::DFG::ByteCodeParser::getArgument):
10696         (JSC::DFG::ByteCodeParser::setArgument):
10697         (JSC::DFG::ByteCodeParser::flushArgument):
10698         (JSC::DFG::ByteCodeParser::parseBlock):
10699         (JSC::DFG::ByteCodeParser::processPhiStack):
10700         (JSC::DFG::ByteCodeParser::fixVariableAccessPredictions):
10701         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
10702         * dfg/DFGCFGSimplificationPhase.cpp:
10703         (CFGSimplificationPhase):
10704         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
10705         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
10706         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
10707         * dfg/DFGCommon.h:
10708         * dfg/DFGFixupPhase.cpp:
10709         (JSC::DFG::FixupPhase::fixupNode):
10710         * dfg/DFGGraph.cpp:
10711         (JSC::DFG::Graph::nameOfVariableAccessData):
10712         * dfg/DFGGraph.h:
10713         (JSC::DFG::Graph::needsActivation):
10714         (JSC::DFG::Graph::usesArguments):
10715         * dfg/DFGPredictionPropagationPhase.cpp:
10716         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
10717         * dfg/DFGSpeculativeJIT.cpp:
10718         (JSC::DFG::SpeculativeJIT::compile):
10719         * dfg/DFGSpeculativeJIT32_64.cpp:
10720         (JSC::DFG::SpeculativeJIT::compile):
10721         * dfg/DFGSpeculativeJIT64.cpp:
10722         (JSC::DFG::SpeculativeJIT::compile):
10723         * dfg/DFGVariableAccessData.h:
10724         (JSC::DFG::VariableAccessData::VariableAccessData):
10725         (JSC::DFG::VariableAccessData::mergeIsCaptured):
10726         (VariableAccessData):
10727         (JSC::DFG::VariableAccessData::isCaptured):
10728
10729 2012-05-08  Filip Pizlo  <fpizlo@apple.com>
10730
10731         DFG should support op_get_argument_by_val and op_get_arguments_length
10732         https://bugs.webkit.org/show_bug.cgi?id=85911
10733
10734         Reviewed by Oliver Hunt.
10735
10736         Merged r116467 from dfgopt.
10737
10738         This adds a simple and relatively conservative implementation of op_get_argument_by_val
10739         and op_get_arguments_length. We can optimize these later. For now it's great to have
10740         the additional coverage.
10741
10742         This patch appears to be perf-neutral.
10743
10744         * dfg/DFGAbstractState.cpp:
10745         (JSC::DFG::AbstractState::execute):
10746         * dfg/DFGAssemblyHelpers.h:
10747         (JSC::DFG::AssemblyHelpers::addressFor):
10748         (JSC::DFG::AssemblyHelpers::tagFor):
10749         (JSC::DFG::AssemblyHelpers::payloadFor):
10750         * dfg/DFGByteCodeParser.cpp:
10751         (JSC::DFG::ByteCodeParser::parseBlock):
10752         * dfg/DFGCapabilities.h:
10753         (JSC::DFG::canCompileOpcode):
10754         (JSC::DFG::canInlineOpcode):
10755         * dfg/DFGNode.h:
10756         (JSC::DFG::Node::hasHeapPrediction):
10757         * dfg/DFGNodeType.h:
10758         (DFG):
10759         * dfg/DFGOperations.cpp:
10760         * dfg/DFGOperations.h:
10761         * dfg/DFGPredictionPropagationPhase.cpp:
10762         (JSC::DFG::PredictionPropagationPhase::propagate):
10763         * dfg/DFGSpeculativeJIT.h:
10764         (JSC::DFG::SpeculativeJIT::callOperation):
10765         (SpeculativeJIT):
10766         * dfg/DFGSpeculativeJIT32_64.cpp:
10767         (JSC::DFG::SpeculativeJIT::compile):
10768         * dfg/DFGSpeculativeJIT64.cpp:
10769         (JSC::DFG::SpeculativeJIT::compile):
10770         * jit/JITOpcodes.cpp:
10771         (JSC::JIT::emit_op_get_argument_by_val):
10772         * jit/JITOpcodes32_64.cpp:
10773         (JSC::JIT::emit_op_get_argument_by_val):
10774         * llint/LowLevelInterpreter32_64.asm:
10775         * llint/LowLevelInterpreter64.asm:
10776
10777 2012-05-07  Filip Pizlo  <fpizlo@apple.com>
10778
10779         DFG should support op_tear_off_arguments
10780         https://bugs.webkit.org/show_bug.cgi?id=85847
10781
10782         Reviewed by Michael Saboff.
10783
10784         Merged r116378 from dfgopt.
10785
10786         * dfg/DFGAbstractState.cpp:
10787         (JSC::DFG::AbstractState::execute):
10788         * dfg/DFGByteCodeParser.cpp:
10789         (JSC::DFG::ByteCodeParser::parseBlock):
10790         * dfg/DFGCapabilities.h:
10791         (JSC::DFG::canCompileOpcode):
10792         (JSC::DFG::canInlineOpcode):
10793         * dfg/DFGNodeType.h:
10794         (DFG):
10795         * dfg/DFGOperations.cpp:
10796         * dfg/DFGOperations.h:
10797         * dfg/DFGPredictionPropagationPhase.cpp:
10798         (JSC::DFG::PredictionPropagationPhase::propagate):
10799         * dfg/DFGSpeculativeJIT.h:
10800         (SpeculativeJIT):
10801         (JSC::DFG::SpeculativeJIT::callOperation):
10802         * dfg/DFGSpeculativeJIT32_64.cpp:
10803         (JSC::DFG::SpeculativeJIT::compile):
10804         * dfg/DFGSpeculativeJIT64.cpp:
10805         (JSC::DFG::SpeculativeJIT::compile):
10806
10807 2012-05-22  Mark Hahnenberg  <mhahnenberg@apple.com>
10808
10809         CopiedSpace::contains doesn't check for oversize blocks
10810         https://bugs.webkit.org/show_bug.cgi?id=87180
10811
10812         Reviewed by Geoffrey Garen.
10813
10814         When doing a conservative scan we use CopiedSpace::contains to determine if a particular
10815         address points into the CopiedSpace. Currently contains() only checks if the address
10816         points to a block in to-space, which means that pointers to oversize blocks may not get scanned.
10817
10818         * heap/CopiedSpace.cpp:
10819         (JSC::CopiedSpace::tryAllocateOversize):
10820         (JSC::CopiedSpace::tryReallocateOversize):
10821         (JSC::CopiedSpace::doneFillingBlock):
10822         (JSC::CopiedSpace::doneCopying):
10823         * heap/CopiedSpace.h: Refactored CopiedSpace so that all blocks (oversize and to-space) are
10824         in a single hash set and bloom filter for membership testing.
10825         (CopiedSpace):
10826         * heap/CopiedSpaceInlineMethods.h:
10827         (JSC::CopiedSpace::contains): We check for the normal block first. Since the oversize blocks are
10828         only page aligned, rather than block aligned, we have to re-mask the ptr to check if it's in
10829         CopiedSpace. Also added a helper function of the same name that takes a CopiedBlock* and checks
10830         if it's in CopiedSpace so that check isn't typed out twice.
10831         (JSC):
10832         (JSC::CopiedSpace::startedCopying):
10833         (JSC::CopiedSpace::addNewBlock):
10834
10835 2012-05-22  Geoffrey Garen  <ggaren@apple.com>
10836
10837         CopiedBlock and MarkedBlock should have proper value semantics (i.e., destructors)
10838         https://bugs.webkit.org/show_bug.cgi?id=87172
10839
10840         Reviewed by Oliver Hunt and Phil Pizlo.
10841
10842         This enables MarkedBlock to own non-trivial sub-objects that require
10843         destruction. It also fixes a FIXME about casting a CopiedBlock to a
10844         MarkedBlock at destroy time.
10845
10846         CopiedBlock and MarkedBlock now accept an allocation chunk at create
10847         time and return it at destroy time. Their client is expected to
10848         allocate, recycle, and destroy these chunks.
10849
10850         * heap/BlockAllocator.cpp:
10851         (JSC::BlockAllocator::releaseFreeBlocks):
10852         (JSC::BlockAllocator::blockFreeingThreadMain): Don't call MarkedBlock::destroy
10853         because we expect that to be called before a block is put on our free
10854         list now. Do manually deallocate our allocation chunk because that's
10855         our job now.
10856
10857         * heap/BlockAllocator.h:
10858         (BlockAllocator):
10859         (JSC::BlockAllocator::allocate): Allocate never fails now. This is a
10860         cleaner abstraction because only one object does all the VM allocation
10861         and deallocation. Caching is an implementation detail.
10862
10863         (JSC::BlockAllocator::deallocate): We take an allocation chunk argument
10864         instead of a block because we now expect the block to have been destroyed
10865         before we recycle its memory. For convenience, we still use the HeapBlock
10866         class as our linked list node. This is OK because HeapBlock is a POD type.
10867
10868         * heap/CopiedBlock.h:
10869         (CopiedBlock):
10870         (JSC::CopiedBlock::create):
10871         (JSC::CopiedBlock::destroy):
10872         (JSC::CopiedBlock::CopiedBlock): Added proper create and destroy functions,
10873         to match MarkedBlock.
10874
10875         * heap/CopiedSpace.cpp:
10876         (JSC::CopiedSpace::tryAllocateOversize):
10877         (JSC::CopiedSpace::tryReallocateOversize):
10878         (JSC::CopiedSpace::doneCopying):
10879         (JSC::CopiedSpace::getFreshBlock):
10880         (JSC::CopiedSpace::freeAllBlocks):
10881         * heap/CopiedSpaceInlineMethods.h:
10882         (JSC::CopiedSpace::recycleBlock): Make sure to call destroy before
10883         returning a block to the BlockAllocator. Otherwise, our destructors
10884         won't run. (If we get this wrong now, we'll get a compile error.)
10885
10886         * heap/HeapBlock.h:
10887         (JSC::HeapBlock::HeapBlock): const!
10888
10889         * heap/MarkedAllocator.cpp:
10890         (JSC::MarkedAllocator::allocateBlock): No need to distinguish between
10891         create and recycle -- MarkedBlock always accepts memory allocated by
10892         its client now.
10893
10894         * heap/MarkedBlock.cpp:
10895         (JSC::MarkedBlock::create): Don't allocate memory -- we assume that we're
10896         passed already-allocated memory, to clarify the responsibility for VM
10897         recycling.
10898
10899         (JSC::MarkedBlock::destroy): Do run our destructor before giving back
10900         our VM -- that is the whole point of this patch.
10901
10902         (JSC::MarkedBlock::MarkedBlock):
10903         * heap/MarkedBlock.h:
10904         (MarkedBlock):
10905         * heap/MarkedSpace.cpp: const!
10906
10907         (JSC::MarkedSpace::freeBlocks): Make sure to call destroy before
10908         returning a block to the BlockAllocator. Otherwise, our destructors
10909         won't run. (If we get this wrong now, we'll get a compile error.)
10910
10911 == Rolled over to ChangeLog-2012-05-22 ==