Source/JavaScriptCore/ChangeLog

   1 2012-11-20  Yong Li  <yoli@rim.com>
   2
   3         [ARMv7] Neither linkCall() nor linkPointer() should flush code.
   4         https://bugs.webkit.org/show_bug.cgi?id=99213
   5
   6         Reviewed by George Staikos.
   7
   8         LinkBuffer doesn't need to flush code during linking. It will
   9         eventually flush the whole executable. Fixing this gives >%5
  10         sunspider boost (on QNX).
  11
  12         Also make replaceWithLoad() and replaceWithAddressComputation() flush
  13         only when necessary.
  14
  15         * assembler/ARMv7Assembler.h:
  16         (JSC::ARMv7Assembler::linkCall):
  17         (JSC::ARMv7Assembler::linkPointer):
  18         (JSC::ARMv7Assembler::relinkCall):
  19         (JSC::ARMv7Assembler::repatchInt32):
  20         (JSC::ARMv7Assembler::repatchPointer):
  21         (JSC::ARMv7Assembler::replaceWithLoad): Flush only after it did write.
  22         (JSC::ARMv7Assembler::replaceWithAddressComputation): Flush only after it did write.
  23         (JSC::ARMv7Assembler::setInt32):
  24         (JSC::ARMv7Assembler::setPointer):
  25
  26 2012-08-30  Byungwoo Lee  <bw80.lee@samsung.com>
  27
  28         Build warning : -Wsign-compare on DFGByteCodeParser.cpp.
  29         https://bugs.webkit.org/show_bug.cgi?id=95418
  30
  31         Reviewed by Filip Pizlo.
  32
  33         There is a build warning '-Wsign-compare' on
  34         findArgumentPositionForLocal() in DFGByteCodeParser.cpp.
  35
  36         For removing this warning, casting statement is added explicitly.
  37
  38         * dfg/DFGByteCodeParser.cpp:
  39         (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
  40         (JSC::DFG::ByteCodeParser::findArgumentPosition):
  41
  42 2012-11-13  Cosmin Truta  <ctruta@rim.com>
  43
  44         Uninitialized fields in class JSLock
  45         https://bugs.webkit.org/show_bug.cgi?id=101695
  46
  47         Reviewed by Mark Hahnenberg.
  48
  49         Initialize JSLock::m_ownerThread and JSLock::m_lockDropDepth.
  50
  51         * runtime/JSLock.cpp:
  52         (JSC::JSLock::JSLock):
  53
  54 2012-09-17  Filip Pizlo  <fpizlo@apple.com>
  55
  56         Unreviewed, fix a broken assertion in offlineasm.
  57
  58         * offlineasm/armv7.rb:
  59         * offlineasm/backends.rb:
  60
  61 2012-09-10  Thiago Marcos P. Santos  <thiago.santos@intel.com>
  62
  63         [CMake][EFL] Enable the LLInt
  64         https://bugs.webkit.org/show_bug.cgi?id=92682
  65
  66         Reviewed by Csaba Osztrogonác.
  67
  68         Generate the headers needed by LLint when LLint is enabled.
  69
  70         * CMakeLists.txt:
  71
  72 2012-09-09  Mark Lam  <mark.lam@apple.com>
  73
  74         Fixed a few llint C++ interpreter bugs.
  75         https://bugs.webkit.org/show_bug.cgi?id=96127.
  76
  77         Reviewed by Geoffrey Garen.
  78
  79         * llint/LLIntCLoop.h:
  80             CLoop::execute()'s bootstrapOpcodeId does not need a default
  81             value. There is no case when this function is called without
  82             that parameter being specified.
  83         * llint/LowLevelInterpreter.asm:
  84             Moved the dispatchAfterCall() call to where it is needed.
  85             For the C_LOOP back-end, it generates unreachable code.
  86         * llint/LowLevelInterpreter.cpp:
  87             #include <wtf/Assertions.h> because LLIntAssembly.h needs it.
  88         (JSC):
  89             Fixed bug in SIGN_BIT32() macro.
  90             Placate a MSVC warning for t0, and t1 being uninitialized.
  91         (JSC::CLoop::execute):
  92             The bootstrapOpcodeId arg should always be specified.
  93             MSVC doesn't like UNUSED_PARAM() for labels. Switch to using
  94                 the new UNUSED_LABEL() macro.
  95         * offlineasm/cloop.rb:
  96         * offlineasm/generate_offset_extractor.rb:
  97             Resolved a compiler warning found via MSVC.
  98
  99 2012-09-07  Sheriff Bot  <webkit.review.bot@gmail.com>
 100
 101         Unreviewed, rolling out r127938.
 102         http://trac.webkit.org/changeset/127938
 103         https://bugs.webkit.org/show_bug.cgi?id=96166
 104
 105         It broke the build (Requested by smfr on #webkit).
 106
 107         * llint/LowLevelInterpreter.cpp:
 108         (JSC):
 109         (JSC::CLoop::execute):
 110         * offlineasm/cloop.rb:
 111
 112 2012-09-07  Mark Lam  <mark.lam@apple.com>
 113
 114         Fix a llint C++ interpreter bugs.
 115         https://bugs.webkit.org/show_bug.cgi?id=96127.
 116
 117         Reviewed by Filip Pizlo.
 118
 119         * llint/LowLevelInterpreter.cpp:
 120         (JSC):
 121         (JSC::CLoop::execute):
 122         * offlineasm/cloop.rb:
 123
 124 2012-09-01  Mark Lam  <mark.lam@apple.com>
 125
 126         LLInt C loop backend.
 127         https://bugs.webkit.org/show_bug.cgi?id=91052.
 128
 129         Reviewed by Filip Pizlo.
 130
 131         * JavaScriptCore.xcodeproj/project.pbxproj:
 132         * bytecode/CodeBlock.cpp:
 133         (JSC::CodeBlock::dump):
 134         (JSC::CodeBlock::bytecodeOffset):
 135         * interpreter/Interpreter.cpp:
 136         (JSC::Interpreter::execute):
 137         (JSC::Interpreter::executeCall):
 138         (JSC::Interpreter::executeConstruct):
 139         (JSC):
 140         * interpreter/Interpreter.h:
 141         * jit/JITStubs.h:
 142         (JITStackFrame):
 143         (JSC):
 144         * llint/LLIntCLoop.cpp: Added.
 145         (JSC):
 146         (LLInt):
 147         (JSC::LLInt::CLoop::initialize):
 148         (JSC::LLInt::CLoop::catchRoutineFor):
 149         (JSC::LLInt::CLoop::hostCodeEntryFor):
 150         (JSC::LLInt::CLoop::jsCodeEntryWithArityCheckFor):
 151         (JSC::LLInt::CLoop::jsCodeEntryFor):
 152         * llint/LLIntCLoop.h: Added.
 153         (JSC):
 154         (LLInt):
 155         (CLoop):
 156         * llint/LLIntData.cpp:
 157         (JSC::LLInt::initialize):
 158         * llint/LLIntData.h:
 159         (JSC):
 160         * llint/LLIntOfflineAsmConfig.h:
 161         * llint/LLIntOpcode.h:
 162         * llint/LLIntThunks.cpp:
 163         (LLInt):
 164         * llint/LowLevelInterpreter.asm:
 165         * llint/LowLevelInterpreter.cpp:
 166         (LLInt):
 167         (JSC::LLInt::Ints2Double):
 168         (JSC):
 169         (JSC::CLoop::execute):
 170         * llint/LowLevelInterpreter.h:
 171         (JSC):
 172         * llint/LowLevelInterpreter32_64.asm:
 173         * llint/LowLevelInterpreter64.asm:
 174         * offlineasm/asm.rb:
 175         * offlineasm/backends.rb:
 176         * offlineasm/cloop.rb: Added.
 177         * offlineasm/instructions.rb:
 178         * runtime/Executable.h:
 179         (ExecutableBase):
 180         (JSC::ExecutableBase::hostCodeEntryFor):
 181         (JSC::ExecutableBase::jsCodeEntryFor):
 182         (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor):
 183         (JSC::ExecutableBase::catchRoutineFor):
 184         (NativeExecutable):
 185         * runtime/JSValue.h:
 186         (JSC):
 187         (LLInt):
 188         (JSValue):
 189         * runtime/JSValueInlineMethods.h:
 190         (JSC):
 191         (JSC::JSValue::JSValue):
 192         * runtime/Options.cpp:
 193         (JSC::Options::initialize):
 194
 195 2012-08-31  Mark Lam  <mark.lam@apple.com>
 196
 197         Refactor LLInt and supporting code in preparation for the C Loop backend.
 198         https://bugs.webkit.org/show_bug.cgi?id=95531.
 199
 200         Reviewed by Filip Pizlo.
 201
 202         * bytecode/GetByIdStatus.cpp:
 203         (JSC::GetByIdStatus::computeFromLLInt):
 204         * bytecode/PutByIdStatus.cpp:
 205         (JSC::PutByIdStatus::computeFromLLInt):
 206         * jit/JITExceptions.cpp:
 207         (JSC::genericThrow): Use ExecutableBase::catchRoutineFor() to fetch
 208             fetch the catch routine for a thrown exception.  This will allow
 209             us to redefine that for the C loop later, and still keep this
 210             code readable.
 211         * llint/LLIntOfflineAsmConfig.h: Moved ASM macros to
 212             LowLevelInterpreter.cpp which is the only place they are used. This
 213             will make it more convenient to redefine them for the C loop later.
 214         * llint/LLIntSlowPaths.cpp:
 215         (JSC::LLInt::setUpCall): Use ExecutableBase's hostCodeEntry()
 216             jsCodeEntryFor(), and jsCodeWithArityCheckEntryFor() for computing
 217             the entry points to functions being called.
 218         * llint/LLIntSlowPaths.h:
 219         (SlowPathReturnType):
 220         (JSC::LLInt::encodeResult):
 221         (LLInt):
 222         (JSC::LLInt::decodeResult): Added.  Needed by LLInt C Loop later.
 223         * llint/LowLevelInterpreter.asm:
 224         * llint/LowLevelInterpreter.cpp:
 225         * llint/LowLevelInterpreter32_64.asm:
 226         * llint/LowLevelInterpreter64.asm:
 227         * offlineasm/asm.rb: Disambiguate between opcodes and other labels.
 228         * offlineasm/config.rb:
 229         * runtime/Executable.h:
 230         (JSC::ExecutableBase::hostCodeEntryFor): Added.
 231         (ExecutableBase):
 232         (JSC::ExecutableBase::jsCodeEntryFor): Added.
 233         (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor): Added.
 234         (JSC::ExecutableBase::catchRoutineFor): Added.
 235         * runtime/JSValueInlineMethods.h:
 236         (JSC):
 237
 238 2012-08-30  Mark Lam  <mark.lam@apple.com>
 239
 240         Render unto #ifdef's that which belong to them.
 241         https://bugs.webkit.org/show_bug.cgi?id=95482.
 242
 243         Reviewed by Filip Pizlo.
 244
 245         Refining / disambiguating between #ifdefs and adding some. For
 246         example, ENABLE(JIT) is conflated with ENABLE(LLINT) in some places.
 247         Also, we need to add ENABLE(COMPUTED_GOTO_OPCODES) to indicate that we
 248         want interpreted opcodes to use COMPUTED GOTOs apart from ENABLE(LLINT)
 249         and ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER). Also cleaned up #ifdefs
 250         in certain places which were previously incorrect.
 251
 252         * bytecode/CodeBlock.cpp:
 253         (JSC):
 254         (JSC::CodeBlock::bytecodeOffset):
 255         * bytecode/CodeBlock.h:
 256         (CodeBlock):
 257         * bytecode/Opcode.h:
 258         (JSC::padOpcodeName):
 259         * config.h:
 260         * dfg/DFGOperations.cpp:
 261         * interpreter/AbstractPC.cpp:
 262         (JSC::AbstractPC::AbstractPC):
 263         * interpreter/CallFrame.h:
 264         (ExecState):
 265         * interpreter/Interpreter.cpp:
 266         (JSC::Interpreter::~Interpreter):
 267         (JSC::Interpreter::initialize):
 268         (JSC::Interpreter::isOpcode):
 269         (JSC::Interpreter::unwindCallFrame):
 270         (JSC::getLineNumberForCallFrame):
 271         (JSC::getCallerInfo):
 272         (JSC::Interpreter::execute):
 273         (JSC::Interpreter::executeCall):
 274         (JSC::Interpreter::executeConstruct):
 275         (JSC::Interpreter::privateExecute):
 276         * interpreter/Interpreter.h:
 277         (JSC::Interpreter::getOpcode):
 278         (JSC::Interpreter::getOpcodeID):
 279         (Interpreter):
 280         * jit/HostCallReturnValue.h:
 281         * jit/JITCode.h:
 282         (JITCode):
 283         * jit/JITExceptions.cpp:
 284         * jit/JITExceptions.h:
 285         * jit/JSInterfaceJIT.h:
 286         * llint/LLIntData.h:
 287         (JSC::LLInt::getOpcode):
 288         * llint/LLIntEntrypoints.cpp:
 289         (JSC::LLInt::getFunctionEntrypoint):
 290         (JSC::LLInt::getEvalEntrypoint):
 291         (JSC::LLInt::getProgramEntrypoint):
 292         * llint/LLIntOffsetsExtractor.cpp:
 293         (JSC::LLIntOffsetsExtractor::dummy):
 294         * llint/LLIntSlowPaths.cpp:
 295         (LLInt):
 296         * runtime/JSGlobalData.cpp:
 297         (JSC):
 298
 299 2012-08-23  Christophe Dumez  <christophe.dumez@intel.com>
 300
 301         Serialization of JavaScript values does not appear to respect new HTML5 Structured Clone semantics
 302         https://bugs.webkit.org/show_bug.cgi?id=65292
 303
 304         Reviewed by Oliver Hunt.
 305
 306         Add function to construct a StringObject from a JSValue.
 307         Similar functions already exist for NumberObject and
 308         BooleanObject for example.
 309
 310         Export several symbols so address linking errors in
 311         WebCore.
 312
 313         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 314         * runtime/BooleanObject.h:
 315         (BooleanObject):
 316         * runtime/NumberObject.h:
 317         (NumberObject):
 318         (JSC):
 319         * runtime/StringObject.cpp:
 320         (JSC::constructString):
 321         (JSC):
 322         * runtime/StringObject.h:
 323         (JSC):
 324
 325 2012-08-30  Mark Lam  <mark.lam@apple.com>
 326
 327         Fix broken classic intrpreter build.
 328         https://bugs.webkit.org/show_bug.cgi?id=95484.
 329
 330         Reviewed by Filip Pizlo.
 331
 332         * interpreter/Interpreter.cpp:
 333         (JSC::Interpreter::privateExecute):
 334
 335 2012-08-29  Mark Lam  <mark.lam@apple.com>
 336
 337         Refactoring LLInt::Data.
 338         https://bugs.webkit.org/show_bug.cgi?id=95316.
 339
 340         Reviewed by Geoff Garen.
 341
 342         This change allows its opcodeMap to be easily queried from any function
 343         without needing to go through a GlobalData object.  It also introduces
 344         the LLInt::getCodePtr() methods that will be used by the LLInt C loop
 345         later to redefine how llint symbols (opcodes and trampoline glue
 346         labels) get resolved.
 347
 348         * assembler/MacroAssemblerCodeRef.h:
 349         (MacroAssemblerCodePtr):
 350         (JSC::MacroAssemblerCodePtr::createLLIntCodePtr):
 351         (MacroAssemblerCodeRef):
 352         (JSC::MacroAssemblerCodeRef::createLLIntCodeRef):
 353         * bytecode/CodeBlock.cpp:
 354         (JSC::CodeBlock::adjustPCIfAtCallSite):
 355         (JSC::CodeBlock::bytecodeOffset):
 356         * bytecode/Opcode.h:
 357             Remove the 'const' to simplify things and avoid having to do
 358             additional casts and #ifdefs in many places.
 359         * bytecode/ResolveGlobalStatus.cpp:
 360         (JSC::computeForLLInt):
 361         * bytecompiler/BytecodeGenerator.cpp:
 362         (JSC::BytecodeGenerator::generate):
 363         * interpreter/Interpreter.cpp:
 364         (JSC::Interpreter::initialize):
 365         * interpreter/Interpreter.h:
 366         (Interpreter):
 367         * jit/JITExceptions.cpp:
 368         (JSC::genericThrow):
 369         * llint/LLIntData.cpp:
 370         (LLInt):
 371         (JSC::LLInt::initialize):
 372         * llint/LLIntData.h:
 373         (JSC):
 374         (LLInt):
 375         (Data):
 376         (JSC::LLInt::exceptionInstructions):
 377         (JSC::LLInt::opcodeMap):
 378         (JSC::LLInt::getOpcode):
 379         (JSC::LLInt::getCodePtr):
 380         (JSC::LLInt::Data::performAssertions):
 381         * llint/LLIntExceptions.cpp:
 382         (JSC::LLInt::returnToThrowForThrownException):
 383         (JSC::LLInt::returnToThrow):
 384         (JSC::LLInt::callToThrow):
 385         * llint/LLIntSlowPaths.cpp:
 386         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
 387         (JSC::LLInt::handleHostCall):
 388         * runtime/InitializeThreading.cpp:
 389         (JSC::initializeThreadingOnce): Initialize the singleton LLInt data.
 390         * runtime/JSGlobalData.cpp:
 391         (JSC::JSGlobalData::JSGlobalData):
 392         * runtime/JSGlobalData.h:
 393         (JSGlobalData): Removed the now unneeded LLInt::Data instance in
 394             JSGlobalData.
 395         * runtime/JSValue.h:
 396         (JSValue):
 397
 398 2012-08-24  Filip Pizlo  <fpizlo@apple.com>
 399
 400         Finally inlining should correctly track the catch context
 401         https://bugs.webkit.org/show_bug.cgi?id=94986
 402         <rdar://problem/11753784>
 403
 404         Reviewed by Sam Weinig.
 405
 406         This fixes two behaviors:
 407
 408         1) Throwing from a finally block. Previously, we would seem to reenter the finally
 409            block - though only once.
 410
 411         2) Executing a finally block from some nested context, for example due to a
 412            'continue', 'break', or 'return' in the try. This would execute the finally
 413            block in the context of of the try block, which could lead to either scope depth
 414            mismatches or reexecutions of the finally block on throw, similarly to (1) but
 415            for different reasons.
 416
 417         * bytecompiler/BytecodeGenerator.cpp:
 418         (JSC):
 419         (JSC::BytecodeGenerator::pushFinallyContext):
 420         (JSC::BytecodeGenerator::emitComplexJumpScopes):
 421         (JSC::BytecodeGenerator::pushTry):
 422         (JSC::BytecodeGenerator::popTryAndEmitCatch):
 423         * bytecompiler/BytecodeGenerator.h:
 424         (FinallyContext):
 425         (TryData):
 426         (JSC):
 427         (TryContext):
 428         (TryRange):
 429         (BytecodeGenerator):
 430         * bytecompiler/NodesCodegen.cpp:
 431         (JSC::TryNode::emitBytecode):
 432
 433 2012-08-28  Mark Lam  <mark.lam@apple.com>
 434
 435         Adding support for adding LLInt opcode extensions.  This will be needed
 436         by the LLInt C loop interpreter later.
 437         https://bugs.webkit.org/show_bug.cgi?id=95277.
 438
 439         Reviewed by Geoffrey Garen.
 440
 441         * JavaScriptCore.xcodeproj/project.pbxproj:
 442         * bytecode/Opcode.h:
 443         * llint/LLIntOpcode.h: Added.
 444         * llint/LowLevelInterpreter.h:
 445
 446 2012-08-28  Filip Pizlo  <fpizlo@apple.com>
 447
 448         LLInt should not rely on ordering of global labels
 449         https://bugs.webkit.org/show_bug.cgi?id=95221
 450
 451         Reviewed by Oliver Hunt.
 452
 453         * llint/LowLevelInterpreter.asm:
 454         * llint/LowLevelInterpreter32_64.asm:
 455         * llint/LowLevelInterpreter64.asm:
 456
 457 2012-08-20  Mark Lam  <mark.lam@apple.com>
 458
 459         Fix broken non-JIT build.
 460         https://bugs.webkit.org/show_bug.cgi?id=94564.
 461
 462         Reviewed by Filip Pizlo.
 463
 464         Added some UNUSED_PARAM() macros to make the compiler happy.
 465
 466         * runtime/Executable.cpp:
 467         (JSC::EvalExecutable::compileInternal):
 468         (JSC::ProgramExecutable::compileInternal):
 469         (JSC::FunctionExecutable::compileForCallInternal):
 470         (JSC::FunctionExecutable::compileForConstructInternal):
 471
 472 2012-08-20  Mark Lam  <mark.lam@apple.com>
 473
 474         Fixed erroneous line number for LLint frame when throwing exceptions.
 475         https://bugs.webkit.org/show_bug.cgi?id=94051.
 476
 477         Reviewed by Filip Pizlo.
 478
 479         For LLInt frames, before throwing an exception, adjust the PC from the
 480         return PC back to the call PC if we are indeed at a call site.
 481
 482         * bytecode/CodeBlock.cpp:
 483         (JSC::CodeBlock::adjustPCIfAtCallSite):
 484         (JSC):
 485         (JSC::CodeBlock::bytecodeOffset):
 486         * bytecode/CodeBlock.h:
 487         (CodeBlock):
 488         * llint/LLIntExceptions.cpp:
 489         (JSC::LLInt::fixupPCforExceptionIfNeeded):
 490         (LLInt):
 491         (JSC::LLInt::interpreterThrowInCaller):
 492         (JSC::LLInt::returnToThrow):
 493         (JSC::LLInt::callToThrow):
 494
 495 2012-08-03  Filip Pizlo  <fpizlo@apple.com>
 496
 497         Crashes in dfgBuildPutByIdList when clicking on just about anything on Google Maps
 498         https://bugs.webkit.org/show_bug.cgi?id=92691
 499
 500         Reviewed by Mark Hahnenberg.
 501
 502         The state of the stubs was changing after we determined the type (by virtue of the slow path
 503         function that was called), since the get or put (in this case put) could cause arbitrary
 504         side effects. Perhaps a full-blown fix would be to eliminate our reliance of the slow path
 505         function to determine what to do, but an easier fix for now is to have the slow path give up
 506         if its assumptions were invalidated by a side effect.
 507
 508         * dfg/DFGOperations.cpp:
 509         * jit/JITStubs.cpp:
 510         (JSC::DEFINE_STUB_FUNCTION):
 511
 512 2012-08-03  Filip Pizlo  <fpizlo@apple.com>
 513
 514         DFG handling of get_by_id should always inject a ForceOSRExit node if there is no prediction
 515         https://bugs.webkit.org/show_bug.cgi?id=93162
 516
 517         Reviewed by Mark Hahnenberg.
 518
 519         This simplifies the DFG IR by ensuring that all nodes that use value profiles will be preceded
 520         by a ForceOSRExit if the value profile had no data.
 521
 522         * dfg/DFGByteCodeParser.cpp:
 523         (JSC::DFG::ByteCodeParser::parseBlock):
 524
 525 2012-08-03  Filip Pizlo  <fpizlo@apple.com>
 526
 527         DFG::StructureCheckHoistingPhase keeps a Node& around for too long
 528         https://bugs.webkit.org/show_bug.cgi?id=93157
 529
 530         Reviewed by Mark Hahnenberg.
 531
 532         * dfg/DFGStructureCheckHoistingPhase.cpp:
 533         (JSC::DFG::StructureCheckHoistingPhase::run):
 534
 535 2012-08-02  Filip Pizlo  <fpizlo@apple.com>
 536
 537         ASSERTION FAILED: at(m_compileIndex).canExit() || m_isCheckingArgumentTypes
 538         https://bugs.webkit.org/show_bug.cgi?id=91074
 539
 540         Reviewed by Mark Hahnenberg.
 541
 542         Fixes a bug where the speculative JIT was performing an unnecessary speculation that the
 543         CFA had proven shouldn't be performed, leading to asserts that a node should not have
 544         exit sites. This is a debug-only assert with no release symptom - we were just emitting
 545         a check that was not reachable.
 546
 547         Also found, and fixed, a bug where structure check hoisting was slightly confusing the
 548         CFA by inserting GetLocal's into the graph. CSE would clean the GetLocal's up, which
 549         would make the backend happy - but the CFA would produce subtly wrong results.
 550
 551         * bytecode/SpeculatedType.h:
 552         (JSC::isOtherOrEmptySpeculation):
 553         (JSC):
 554         * dfg/DFGDriver.cpp:
 555         (JSC::DFG::compile):
 556         * dfg/DFGGraph.cpp:
 557         (JSC::DFG::Graph::dump):
 558         * dfg/DFGSpeculativeJIT64.cpp:
 559         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
 560         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
 561
 562 2012-08-02  Filip Pizlo  <fpizlo@apple.com>
 563
 564         Unreviewed, build fix for DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE).
 565
 566         * dfg/DFGStructureCheckHoistingPhase.cpp:
 567         (JSC::DFG::StructureCheckHoistingPhase::run):
 568
 569 2012-08-01  Mark Hahnenberg  <mhahnenberg@apple.com>
 570
 571         Remove all uses of ClassInfo for JSStrings in JIT code
 572         https://bugs.webkit.org/show_bug.cgi?id=92935
 573
 574         Reviewed by Geoffrey Garen.
 575
 576         This is the first step in removing our dependence on in-object ClassInfo pointers
 577         in JIT code. Most of the changes are to check the Structure, which is unique for
 578         JSString primitives.
 579
 580         * bytecode/SpeculatedType.cpp:
 581         (JSC::speculationFromClassInfo):
 582         (JSC::speculationFromStructure): Changed to check the TypeInfo in the Structure
 583         since there wasn't a JSGlobalData immediately available to grab the JSString
 584         Structure out of.
 585         * dfg/DFGSpeculativeJIT.cpp:
 586         (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
 587         * dfg/DFGSpeculativeJIT32_64.cpp:
 588         (JSC::DFG::SpeculativeJIT::compile):
 589         * dfg/DFGSpeculativeJIT64.cpp:
 590         (JSC::DFG::SpeculativeJIT::compile):
 591         * jit/JITInlineMethods.h:
 592         (JSC::JIT::emitLoadCharacterString):
 593         * jit/JITOpcodes.cpp:
 594         (JSC::JIT::privateCompileCTIMachineTrampolines):
 595         (JSC::JIT::emit_op_to_primitive):
 596         (JSC::JIT::emit_op_convert_this):
 597         * jit/JITOpcodes32_64.cpp:
 598         (JSC::JIT::privateCompileCTIMachineTrampolines):
 599         (JSC::JIT::emit_op_to_primitive):
 600         (JSC::JIT::emitSlow_op_eq):
 601         (JSC::JIT::emitSlow_op_neq):
 602         (JSC::JIT::compileOpStrictEq):
 603         (JSC::JIT::emit_op_convert_this):
 604         * jit/JITPropertyAccess.cpp:
 605         (JSC::JIT::stringGetByValStubGenerator):
 606         (JSC::JIT::emitSlow_op_get_by_val):
 607         * jit/JITPropertyAccess32_64.cpp:
 608         (JSC::JIT::stringGetByValStubGenerator):
 609         (JSC::JIT::emitSlow_op_get_by_val):
 610         * jit/SpecializedThunkJIT.h:
 611         (JSC::SpecializedThunkJIT::loadJSStringArgument):
 612         * jit/ThunkGenerators.cpp:
 613         (JSC::stringCharLoad):
 614         (JSC::charCodeAtThunkGenerator):
 615         (JSC::charAtThunkGenerator):
 616
 617 2012-08-02  Filip Pizlo  <fpizlo@apple.com>
 618
 619         Unreviewed, missed a style goof in the previous patch: "NodeIndex nodeIndex"
 620         in a method signature is painfully redundant.
 621
 622         * dfg/DFGSpeculativeJIT.h:
 623         (SpeculativeJIT):
 624
 625 2012-08-02  Filip Pizlo  <fpizlo@apple.com>
 626
 627         DFGSpeculativeJIT.h has too many inline method bodies
 628         https://bugs.webkit.org/show_bug.cgi?id=92957
 629
 630         Reviewed by Antti Koivisto.
 631
 632         * dfg/DFGSpeculativeJIT.cpp:
 633         (JSC::DFG::SpeculativeJIT::speculationCheck):
 634         (DFG):
 635         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
 636         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
 637         (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection):
 638         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
 639         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
 640         * dfg/DFGSpeculativeJIT.h:
 641         (SpeculativeJIT):
 642
 643 2012-08-01  Filip Pizlo  <fpizlo@apple.com>
 644
 645         DFG should hoist structure checks
 646         https://bugs.webkit.org/show_bug.cgi?id=92696
 647
 648         Reviewed by Gavin Barraclough.
 649
 650         This hoists structure checks in the same way that we would hoist array checks, but with added
 651         complexity to cope with the fact that the structure of an object may change. This is handled
 652         by performing a side effects analysis over the region in which the respective variable is
 653         live. If a structure clobbering side effect may happen then we either hoist the structure
 654         checks and fall back on structure transition watchpoints (if the watchpoint set is still
 655         valid), or we avoid hoisting altogether.
 656
 657         Doing this required teaching the CFA that we may have an expectation that an object has a
 658         particular structure even after structure clobbering happens, in the sense that structure
 659         proofs that were cobbered can be revived using watchpoints. CFA must know about this so that
 660         OSR entry may know about it, since we cannot allow entry to happen if the variable has a
 661         clobbered structure proof, will have a watchpoint to revive the proof, and the variable in
 662         the baseline JIT has a completely unrelated structure.
 663
 664         This is mostly performance neutral.
 665
 666         * CMakeLists.txt:
 667         * GNUmakefile.list.am:
 668         * JavaScriptCore.xcodeproj/project.pbxproj:
 669         * Target.pri:
 670         * bytecode/ValueRecovery.h:
 671         (JSC::ValueRecovery::isSet):
 672         (JSC::ValueRecovery::operator!):
 673         (ValueRecovery):
 674         * dfg/DFGAbstractState.cpp:
 675         (JSC::DFG::AbstractState::execute):
 676         (JSC::DFG::AbstractState::clobberWorld):
 677         (DFG):
 678         (JSC::DFG::AbstractState::clobberCapturedVars):
 679         * dfg/DFGAbstractState.h:
 680         (AbstractState):
 681         * dfg/DFGAbstractValue.h:
 682         (JSC::DFG::AbstractValue::clear):
 683         (JSC::DFG::AbstractValue::isClear):
 684         (JSC::DFG::AbstractValue::makeTop):
 685         (JSC::DFG::AbstractValue::isTop):
 686         (JSC::DFG::AbstractValue::set):
 687         (JSC::DFG::AbstractValue::operator==):
 688         (JSC::DFG::AbstractValue::merge):
 689         (JSC::DFG::AbstractValue::filter):
 690         (JSC::DFG::AbstractValue::validate):
 691         (JSC::DFG::AbstractValue::validateForEntry):
 692         (AbstractValue):
 693         (JSC::DFG::AbstractValue::checkConsistency):
 694         (JSC::DFG::AbstractValue::dump):
 695         * dfg/DFGByteCodeParser.cpp:
 696         (JSC::DFG::ByteCodeParser::setLocal):
 697         (JSC::DFG::ByteCodeParser::getArgument):
 698         (JSC::DFG::ByteCodeParser::setArgument):
 699         (JSC::DFG::ByteCodeParser::parseBlock):
 700         (JSC::DFG::ByteCodeParser::fixVariableAccessSpeculations):
 701         * dfg/DFGCSEPhase.cpp:
 702         (JSC::DFG::CSEPhase::checkStructureLoadElimination):
 703         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
 704         (JSC::DFG::CSEPhase::putStructureStoreElimination):
 705         (JSC::DFG::CSEPhase::getLocalLoadElimination):
 706         (JSC::DFG::CSEPhase::performNodeCSE):
 707         * dfg/DFGDriver.cpp:
 708         (JSC::DFG::compile):
 709         * dfg/DFGGraph.cpp:
 710         (JSC::DFG::Graph::dump):
 711         * dfg/DFGGraph.h:
 712         (JSC::DFG::Graph::vote):
 713         (Graph):
 714         * dfg/DFGNode.h:
 715         (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
 716         (Node):
 717         (JSC::DFG::Node::hasStructureSet):
 718         * dfg/DFGNodeType.h:
 719         (DFG):
 720         * dfg/DFGOSREntry.cpp:
 721         (JSC::DFG::prepareOSREntry):
 722         * dfg/DFGPredictionPropagationPhase.cpp:
 723         (JSC::DFG::PredictionPropagationPhase::propagate):
 724         (PredictionPropagationPhase):
 725         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
 726         * dfg/DFGSpeculativeJIT.h:
 727         (SpeculativeJIT):
 728         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
 729         (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection):
 730         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
 731         (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
 732         (JSC::DFG::SpeculateCellOperand::gpr):
 733         (SpeculateCellOperand):
 734         * dfg/DFGSpeculativeJIT32_64.cpp:
 735         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
 736         (JSC::DFG::SpeculativeJIT::compile):
 737         * dfg/DFGSpeculativeJIT64.cpp:
 738         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
 739         (JSC::DFG::SpeculativeJIT::compile):
 740         * dfg/DFGStructureCheckHoistingPhase.cpp: Added.
 741         (DFG):
 742         (StructureCheckHoistingPhase):
 743         (JSC::DFG::StructureCheckHoistingPhase::StructureCheckHoistingPhase):
 744         (JSC::DFG::StructureCheckHoistingPhase::run):
 745         (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
 746         (JSC::DFG::StructureCheckHoistingPhase::noticeClobber):
 747         (JSC::DFG::StructureCheckHoistingPhase::clobber):
 748         (CheckData):
 749         (JSC::DFG::StructureCheckHoistingPhase::CheckData::CheckData):
 750         (JSC::DFG::performStructureCheckHoisting):
 751         * dfg/DFGStructureCheckHoistingPhase.h: Added.
 752         (DFG):
 753         * dfg/DFGVariableAccessData.h:
 754         (VariableAccessData):
 755         (JSC::DFG::VariableAccessData::VariableAccessData):
 756         (JSC::DFG::VariableAccessData::mergeStructureCheckHoistingFailed):
 757         (JSC::DFG::VariableAccessData::structureCheckHoistingFailed):
 758         (JSC::DFG::VariableAccessData::clearVotes):
 759         (JSC::DFG::VariableAccessData::vote):
 760         (JSC::DFG::VariableAccessData::voteRatio):
 761         (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
 762         * runtime/Options.h:
 763         (JSC):
 764
 765 2012-08-01  Filip Pizlo  <fpizlo@apple.com>
 766
 767         DFG should distinguish between PutByVal's that clobber the world and ones that don't
 768         https://bugs.webkit.org/show_bug.cgi?id=92923
 769
 770         Reviewed by Mark Hahnenberg.
 771
 772         This is performance-neutral. I also confirmed that it's neutral if we make the
 773         clobbering variant (PutByValSafe) clobber all knowledge of what is an array,
 774         which should feed nicely into work on removing uses of ClassInfo.
 775
 776         * bytecode/DFGExitProfile.h:
 777         * dfg/DFGAbstractState.cpp:
 778         (JSC::DFG::AbstractState::execute):
 779         * dfg/DFGByteCodeParser.cpp:
 780         (JSC::DFG::ByteCodeParser::parseBlock):
 781         * dfg/DFGCSEPhase.cpp:
 782         (JSC::DFG::CSEPhase::getByValLoadElimination):
 783         (JSC::DFG::CSEPhase::checkStructureLoadElimination):
 784         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
 785         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
 786         (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
 787         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
 788         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
 789         (JSC::DFG::CSEPhase::performNodeCSE):
 790         * dfg/DFGFixupPhase.cpp:
 791         (JSC::DFG::FixupPhase::fixupNode):
 792         * dfg/DFGGraph.h:
 793         (JSC::DFG::Graph::byValIsPure):
 794         (JSC::DFG::Graph::clobbersWorld):
 795         * dfg/DFGNodeType.h:
 796         (DFG):
 797         * dfg/DFGPredictionPropagationPhase.cpp:
 798         (JSC::DFG::PredictionPropagationPhase::propagate):
 799         * dfg/DFGSpeculativeJIT32_64.cpp:
 800         (JSC::DFG::SpeculativeJIT::compile):
 801         * dfg/DFGSpeculativeJIT64.cpp:
 802         (JSC::DFG::SpeculativeJIT::compile):
 803
 804 2012-08-01  Mark Hahnenberg  <mhahnenberg@apple.com>
 805
 806         C++ code should get ClassInfo from the Structure
 807         https://bugs.webkit.org/show_bug.cgi?id=92892
 808
 809         Reviewed by Geoffrey Garen.
 810
 811         In our march to remove ClassInfo from our JSCell object headers, we can switch
 812         C++ code over to grabbing the ClassInfo from the Structure since it is finally
 813         safe to do so now that Structure access is safe during finalization/destruction.
 814         The remaining JIT code changes can be done in a separate patch.
 815
 816         * heap/MarkedBlock.cpp:
 817         (JSC::MarkedBlock::callDestructor): We don't want to clear the Structure any more
 818         since the Structure should still be valid at this point.
 819         * heap/WeakSetInlines.h:
 820         (JSC::WeakBlock::finalize): Ditto.
 821         * runtime/JSCell.h:
 822         (JSC):
 823         * runtime/Structure.h:
 824         (JSC::JSCell::classInfo): Move JSCell's classInfo() to Structure.h so it can be
 825         inline. Use a different method of getting the JSCell's Structure based on
 826         whether we're in GC_VALIDATION mode or not, since always using get() will cause
 827         infinite recursion in GC_VALIDATION mode.
 828         (JSC):
 829
 830 2012-07-31  Mark Hahnenberg  <mhahnenberg@apple.com>
 831
 832         MarkedBlock::sweep() should sweep another block if it can't sweep a Structure block
 833         https://bugs.webkit.org/show_bug.cgi?id=92819
 834
 835         Reviewed by Geoffrey Garen.
 836
 837         If we are forced to allocate a new block for Structures because we are unable to safely
 838         sweep our pre-existing Structure blocks, we should sweep another random block so that we
 839         can start sweeping Structure blocks sooner.
 840
 841         * heap/IncrementalSweeper.cpp:
 842         (JSC::IncrementalSweeper::doSweep): Change to use sweepNextBlock.
 843         (JSC):
 844         (JSC::IncrementalSweeper::sweepNextBlock):
 845         * heap/IncrementalSweeper.h:
 846         (IncrementalSweeper):
 847         * heap/MarkedAllocator.cpp:
 848         (JSC::MarkedAllocator::tryAllocateHelper): When we can't safely sweep
 849         our Structure blocks, call sweepNextBlock instead.
 850
 851 2012-07-31  Sam Weinig  <sam@webkit.org>
 852
 853         Fix the Windows build.
 854
 855         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 856
 857 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 858
 859         Maybe fix the GCC build.
 860
 861         * heap/HeapBlock.h:
 862         (HeapBlock): Accommodate incorrect parsing in GCC.
 863
 864 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 865
 866         Maybe break the Windows build.
 867
 868         Reviewed by Anders Carlsson.
 869
 870         Formally objected to by Sam Weinig.
 871
 872         * heap/HeapBlock.h:
 873         (HeapBlock): Try to slightly improve this because we don't want Windows to control our lives.
 874
 875 2012-07-30  Mark Hahnenberg  <mhahnenberg@apple.com>
 876
 877         Structures should be swept after all other objects
 878         https://bugs.webkit.org/show_bug.cgi?id=92679
 879
 880         Reviewed by Filip Pizlo.
 881
 882         In order to get rid of ClassInfo from our objects, we need to be able to safely get the
 883         ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the
 884         Structure, but currently it is not safe to do so because the order of destruction of objects
 885         is not guaranteed to sweep objects before their corresponding Structure. We can fix this by
 886         sweeping Structures after everything else.
 887
 888         * heap/Heap.cpp:
 889         (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures.
 890         If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is
 891         safe to sweep structures since we'll always do Structures last anyways due to the ordering of
 892         MarkedSpace::forEachBlock.
 893         (JSC):
 894         (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now
 895         calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out
 896         these pointers after it has invalidated them to prevent accidental use-after-free in the sweep()
 897         calls during lastChanceToFinalize().
 898         * heap/Heap.h:
 899         (Heap):
 900         * heap/HeapTimer.h:
 901         (HeapTimer):
 902         * heap/IncrementalSweeper.cpp:
 903         (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures.
 904         This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping
 905         the first time.
 906         (JSC):
 907         (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we
 908         make our first pass. We now null out the slots as we sweep them so that we can quickly find the
 909         Structures during the second pass.
 910         (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index.
 911         (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify
 912         the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can
 913         assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock
 914         iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds.
 915         (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index.
 916         * heap/IncrementalSweeper.h: Add declarations for new stuff.
 917         (IncrementalSweeper):
 918         * heap/MarkedAllocator.cpp:
 919         (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and
 920         if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing
 921         the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that
 922         will sweep some number of other blocks in place of the current block to mitigate the cost of the floating
 923         Structure garbage.
 924         (JSC::MarkedAllocator::addBlock):
 925         * heap/MarkedAllocator.h:
 926         (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no
 927         longer valid to allocate from, so we set the current block to null.
 928         * heap/MarkedBlock.cpp:
 929         (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures
 930         at an unsafe time.
 931         * heap/MarkedSpace.cpp:
 932         (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping.
 933         (JSC):
 934         * heap/MarkedSpace.h:
 935         (JSC):
 936         * runtime/JSGlobalData.cpp:
 937         (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown.
 938
 939 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 940
 941         Fix all the other builds I just broke. Maybe fix the Windows build.
 942
 943         * heap/HeapBlock.h:
 944         (HeapBlock): WTF?
 945
 946 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 947
 948         Maybe fix the Windows build.
 949
 950         * heap/HeapBlock.h:
 951         (HeapBlock): WTF?
 952
 953 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 954
 955         Maybe fix the Windows build.
 956
 957         * heap/HeapBlock.h:
 958         (HeapBlock): WTF?
 959
 960 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 961
 962         Removed some public data and casting from the Heap
 963         https://bugs.webkit.org/show_bug.cgi?id=92777
 964
 965         Reviewed by Oliver Hunt.
 966
 967         * heap/BlockAllocator.cpp:
 968         (JSC::BlockAllocator::releaseFreeBlocks):
 969         (JSC::BlockAllocator::blockFreeingThreadMain): Use the DeadBlock class
 970         since HeapBlock is a template, and not a class, now. Call destroy()
 971         instead of monkeying around with DeadBlock's internal data because
 972         encapsulation is good.
 973
 974         * heap/BlockAllocator.h:
 975         (DeadBlock): Added a class to represent a dead block, since HeapBlock is
 976         a template now, and can't be instantiated directly.
 977
 978         (JSC::DeadBlock::DeadBlock):
 979         (JSC::DeadBlock::create):
 980         (BlockAllocator):
 981         (JSC::BlockAllocator::allocate):
 982         (JSC::BlockAllocator::deallocate): Use the DeadBlock class because
 983         encapsulation is good.
 984
 985         * heap/CopiedBlock.h:
 986         (CopiedBlock::destroy): No need for a destroy() function, since we
 987         inherit one now.
 988
 989         (JSC::CopiedBlock::CopiedBlock):
 990         (JSC::CopiedBlock::payloadEnd):
 991         (JSC::CopiedBlock::capacity): Updated for some encapsulation inside
 992         HeapBlock.
 993
 994         * heap/CopiedSpace.cpp:
 995         (JSC::CopiedSpace::~CopiedSpace):
 996         (JSC::CopiedSpace::doneCopying):
 997         (JSC::CopiedSpace::size):
 998         (JSC::CopiedSpace::capacity):
 999         (JSC::isBlockListPagedOut): Removed a bunch of casting. This is no longer
1000         necessary, now that our list and its nodes have the right type.
1001
1002         * heap/CopiedSpace.h: Use the right type in our data structures because
1003         it improves clarity.
1004
1005         * heap/CopiedSpaceInlineMethods.h:
1006         (JSC::CopiedSpace::startedCopying): Use swap to avoid duplicating it.
1007
1008         * heap/HeapBlock.h:
1009         (HeapBlock): Made this a class template so we can return the right type
1010         in linked list operations. Made our data private because encapsulation
1011         is good.
1012
1013         (JSC::HeapBlock::destroy): Since we know our type, we can also eliminate
1014         duplicate destroy() functions in our subclasses.
1015
1016         (JSC::HeapBlock::allocation): Added an accessor so we can hide our data.
1017         By using const, this accessor prevents clients from accidentally deleting
1018         our allocation.
1019
1020         * heap/MarkedAllocator.cpp:
1021         (JSC::MarkedAllocator::isPagedOut):
1022         (JSC::MarkedAllocator::tryAllocateHelper):
1023         (JSC::MarkedAllocator::removeBlock): Removed a bunch of casting. This is
1024         no longer necessary, now that our list and its nodes have the right type.
1025
1026         * heap/MarkedAllocator.h:
1027         (MarkedAllocator):
1028         (JSC::MarkedAllocator::reset):
1029         (JSC::MarkedAllocator::forEachBlock): Use the right type, do less casting.
1030
1031         * heap/MarkedBlock.cpp:
1032         (JSC::MarkedBlock::destroy): Removed this function because our parent
1033         class provides it for us now.
1034
1035         (JSC::MarkedBlock::MarkedBlock):
1036         * heap/MarkedBlock.h:
1037         (MarkedBlock):
1038         (JSC::MarkedBlock::capacity): Updated for encapsulation.
1039
1040 2012-07-31  Filip Pizlo  <fpizlo@apple.com>
1041
1042         DFG OSR exit profiling has unusual oversights
1043         https://bugs.webkit.org/show_bug.cgi?id=92728
1044
1045         Reviewed by Geoffrey Garen.
1046
1047         * dfg/DFGOSRExit.cpp:
1048         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
1049         * dfg/DFGSpeculativeJIT.h:
1050         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
1051         * dfg/DFGSpeculativeJIT32_64.cpp:
1052         (JSC::DFG::SpeculativeJIT::compile):
1053         * dfg/DFGSpeculativeJIT64.cpp:
1054         (JSC::DFG::SpeculativeJIT::compile):
1055
1056 2012-07-31  Chao-ying Fu  <fu@mips.com>
1057
1058         Add MIPS add32 function
1059         https://bugs.webkit.org/show_bug.cgi?id=91522
1060
1061         Reviewed by Oliver Hunt.
1062
1063         Add isCompactPtrAlignedAddressOffset.
1064         Add a new version of add32 that accepts AbsoluteAddress as inputs.
1065
1066         * assembler/MacroAssemblerMIPS.h:
1067         (JSC::MacroAssemblerMIPS::isCompactPtrAlignedAddressOffset): New.
1068         (MacroAssemblerMIPS):
1069         (JSC::MacroAssemblerMIPS::add32): Support AbsoluteAddress as inputs.
1070
1071 2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
1072
1073         Unreviewed, rolling out r124123.
1074         http://trac.webkit.org/changeset/124123
1075         https://bugs.webkit.org/show_bug.cgi?id=92700
1076
1077         ASSERT crashes terminate webkit Layout tests (Requested by
1078         msaboff on #webkit).
1079
1080         * heap/Heap.cpp:
1081         * heap/Heap.h:
1082         (Heap):
1083         * heap/IncrementalSweeper.cpp:
1084         (JSC::IncrementalSweeper::doSweep):
1085         (JSC::IncrementalSweeper::startSweeping):
1086         (JSC::IncrementalSweeper::IncrementalSweeper):
1087         (JSC):
1088         * heap/IncrementalSweeper.h:
1089         (IncrementalSweeper):
1090         * heap/MarkedAllocator.cpp:
1091         (JSC::MarkedAllocator::tryAllocateHelper):
1092         (JSC::MarkedAllocator::addBlock):
1093         * heap/MarkedAllocator.h:
1094         (JSC::MarkedAllocator::zapFreeList):
1095         * heap/MarkedBlock.cpp:
1096         (JSC::MarkedBlock::sweepHelper):
1097         * heap/MarkedSpace.cpp:
1098         * heap/MarkedSpace.h:
1099         (JSC::MarkedSpace::sweep):
1100         (JSC):
1101         * runtime/JSGlobalData.cpp:
1102         (JSC::JSGlobalData::~JSGlobalData):
1103
1104 2012-07-30  Mark Hahnenberg  <mhahnenberg@apple.com>
1105
1106         Structures should be swept after all other objects
1107         https://bugs.webkit.org/show_bug.cgi?id=92679
1108
1109         Reviewed by Filip Pizlo.
1110
1111         In order to get rid of ClassInfo from our objects, we need to be able to safely get the
1112         ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the
1113         Structure, but currently it is not safe to do so because the order of destruction of objects
1114         is not guaranteed to sweep objects before their corresponding Structure. We can fix this by
1115         sweeping Structures after everything else.
1116
1117         * heap/Heap.cpp:
1118         (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures.
1119         If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is
1120         safe to sweep structures since we'll always do Structures last anyways due to the ordering of
1121         MarkedSpace::forEachBlock.
1122         (JSC):
1123         (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now
1124         calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out
1125         these pointers after it has invalidated them to prevent accidental use-after-free in the sweep()
1126         calls during lastChanceToFinalize().
1127         * heap/Heap.h:
1128         (Heap):
1129         * heap/HeapTimer.h:
1130         (HeapTimer):
1131         * heap/IncrementalSweeper.cpp:
1132         (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures.
1133         This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping
1134         the first time.
1135         (JSC):
1136         (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we
1137         make our first pass. We now null out the slots as we sweep them so that we can quickly find the
1138         Structures during the second pass.
1139         (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index.
1140         (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify
1141         the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can
1142         assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock
1143         iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds.
1144         (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index.
1145         * heap/IncrementalSweeper.h: Add declarations for new stuff.
1146         (IncrementalSweeper):
1147         * heap/MarkedAllocator.cpp:
1148         (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and
1149         if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing
1150         the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that
1151         will sweep some number of other blocks in place of the current block to mitigate the cost of the floating
1152         Structure garbage.
1153         (JSC::MarkedAllocator::addBlock):
1154         * heap/MarkedAllocator.h:
1155         (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no
1156         longer valid to allocate from, so we set the current block to null.
1157         * heap/MarkedBlock.cpp:
1158         (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures
1159         at an unsafe time.
1160         * heap/MarkedSpace.cpp:
1161         (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping.
1162         (JSC):
1163         * heap/MarkedSpace.h:
1164         (JSC):
1165         * runtime/JSGlobalData.cpp:
1166         (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown.
1167
1168 2012-07-29  Filip Pizlo  <fpizlo@apple.com>
1169
1170         PropertyNameArray::m_shouldCache is only assigned and never used
1171         https://bugs.webkit.org/show_bug.cgi?id=92598
1172
1173         Reviewed by Dan Bernstein.
1174
1175         * runtime/PropertyNameArray.h:
1176         (JSC::PropertyNameArray::PropertyNameArray):
1177         (PropertyNameArray):
1178
1179 2012-07-29  Rik Cabanier  <cabanier@adobe.com>
1180
1181         Add ENABLE_CSS_COMPOSITING flag
1182         https://bugs.webkit.org/show_bug.cgi?id=92553
1183
1184         Reviewed by Dirk Schulze.
1185
1186         Adds compiler flag CSS_COMPOSITING to build systems to enable CSS blending and compositing. See spec https://dvcs.w3.org/hg/FXTF/rawfile/tip/compositing/index.html
1187
1188         * Configurations/FeatureDefines.xcconfig:
1189
1190 2012-07-27  Mark Hahnenberg  <mhahnenberg@apple.com>
1191
1192         Split functionality of MarkedAllocator::m_currentBlock
1193         https://bugs.webkit.org/show_bug.cgi?id=92550
1194
1195         Reviewed by Filip Pizlo.
1196
1197         MarkedAllocator::m_currentBlock serves two purposes right now; it indicates the block that is currently
1198         being used for allocation and the beginning of the list of blocks that need to be swept. We should split
1199         these two functionalities into two separate fields.
1200
1201         * heap/MarkedAllocator.cpp:
1202         (JSC::MarkedAllocator::tryAllocateHelper): Use m_blocksToSweep instead of m_currentBlock as the
1203         initializer/reference of the loop. Only change m_currentBlock when we know what the result will be.
1204         (JSC::MarkedAllocator::addBlock): When we add a new block we know that both m_blocksToSweep and
1205         m_currentBlock are null. In order to preserve the invariant that m_currentBlock <= m_blocksToSweep,
1206         we assign both of them to point to the new block.
1207         (JSC::MarkedAllocator::removeBlock): We need a separate check to see if the block we're removing is
1208         m_blocksToSweep and if so, advance it to the next block in the list.
1209         * heap/MarkedAllocator.h:
1210         (MarkedAllocator): Initialize m_blocksToSweep.
1211         (JSC::MarkedAllocator::MarkedAllocator):
1212         (JSC::MarkedAllocator::reset): We set m_blocksToSweep to be the head of our list. This function is called
1213         at the end of a collection, so all of the blocks in our allocator need to be swept. We need to sweep a
1214         block before we can start allocating, so m_currentBlock is set to null. We also set the freeList to
1215         the empty FreeList to emphasize the fact that we can't start allocating until we do some sweeping.
1216
1217 2012-07-27  Mark Hahnenberg  <mhahnenberg@apple.com>
1218
1219         Increase inline storage for JSFinalObjects by one
1220         https://bugs.webkit.org/show_bug.cgi?id=92526
1221
1222         Reviewed by Geoffrey Garen.
1223
1224         Now that we've removed the inheritorID from objects, we can increase our inline storage for JSFinalObjects on
1225         64-bit platforms by 1.
1226
1227         * llint/LowLevelInterpreter.asm: Change the constant.
1228         * runtime/PropertyOffset.h: Change the constant.
1229         (JSC):
1230
1231 2012-07-27  Jer Noble  <jer.noble@apple.com>
1232
1233         Support a rational time class for use by media elements.
1234         https://bugs.webkit.org/show_bug.cgi?id=88787
1235
1236         Re-export WTF::MediaTime from JavaScriptCore.
1237
1238         Reviewed by Eric Carlson.
1239
1240         * JavaScriptCore.order:
1241         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1242
1243 2012-07-26  Filip Pizlo  <fpizlo@apple.com>
1244
1245         JSObject::reallocateStorageIfNecessary is neither used nor defined
1246         https://bugs.webkit.org/show_bug.cgi?id=92417
1247
1248         Reviewed by Mark Rowe.
1249
1250         * runtime/JSObject.h:
1251         (JSObject):
1252
1253 2012-07-26  Mark Hahnenberg  <mhahnenberg@apple.com>
1254
1255         Allocate Structures in a separate part of the Heap
1256         https://bugs.webkit.org/show_bug.cgi?id=92420
1257
1258         Reviewed by Filip Pizlo.
1259
1260         To fix our issue with destruction/finalization of Structures before their objects, we can move Structures to a separate
1261         part of the Heap that will be swept after all other objects. This first patch will just be separating Structures
1262         out into their own separate MarkedAllocator. Everything else will behave identically.
1263
1264         * heap/Heap.h: New function to allocate Structures in the Heap.
1265         (Heap):
1266         (JSC):
1267         (JSC::Heap::allocateStructure):
1268         * heap/MarkedAllocator.cpp: Pass whether or not we're allocated Structures to the MarkedBlock.
1269         (JSC::MarkedAllocator::allocateBlock):
1270         * heap/MarkedAllocator.h: Add tracking for whether or not we're allocating only Structures.
1271         (JSC::MarkedAllocator::onlyContainsStructures):
1272         (MarkedAllocator):
1273         (JSC::MarkedAllocator::MarkedAllocator):
1274         (JSC::MarkedAllocator::init):
1275         * heap/MarkedBlock.cpp: Add tracking for whether or not we're allocating only Structures. We need this to be able to
1276         distinguish the various MarkedBlock types in MarkedSpace::allocatorFor(MarkedBlock*).
1277         (JSC::MarkedBlock::create):
1278         (JSC::MarkedBlock::MarkedBlock):
1279         * heap/MarkedBlock.h:
1280         (MarkedBlock):
1281         (JSC::MarkedBlock::onlyContainsStructures):
1282         (JSC):
1283         * heap/MarkedSpace.cpp: Include the new Structure allocator in all the places that all the other allocators are used/modified.
1284         (JSC::MarkedSpace::MarkedSpace):
1285         (JSC::MarkedSpace::resetAllocators):
1286         (JSC::MarkedSpace::canonicalizeCellLivenessData):
1287         (JSC::MarkedSpace::isPagedOut):
1288         * heap/MarkedSpace.h: Add new MarkedAllocator just for Structures.
1289         (MarkedSpace):
1290         (JSC::MarkedSpace::allocatorFor):
1291         (JSC::MarkedSpace::allocateStructure):
1292         (JSC):
1293         (JSC::MarkedSpace::forEachBlock):
1294         * runtime/Structure.h: Move all of the functions that call allocateCell<Structure> down below the explicit template specialization
1295         for allocateCell<Structure>. The new inline specialization for allocateCell directly calls the allocateStructure() function in the
1296         Heap.
1297         (Structure):
1298         (JSC::Structure):
1299         (JSC):
1300         (JSC::Structure::create):
1301         (JSC::Structure::createStructure):
1302
1303 2012-07-26  Filip Pizlo  <fpizlo@apple.com>
1304
1305         JSArray has methods that are neither used nor defined
1306         https://bugs.webkit.org/show_bug.cgi?id=92416
1307
1308         Reviewed by Simon Fraser.
1309
1310         * runtime/JSArray.h:
1311         (JSArray):
1312
1313 2012-07-26  Zoltan Herczeg  <zherczeg@webkit.org>
1314
1315         [Qt][ARM]ARMAssembler needs buildfix afert r123417
1316         https://bugs.webkit.org/show_bug.cgi?id=92086
1317
1318         Reviewed by Csaba Osztrogonác.
1319
1320         The ARM implementation of this should be optimized code path
1321         is covered by a non-optimized code path. This patch fixes this,
1322         and adds a new function which returns with the offset range.
1323
1324         * assembler/ARMAssembler.h:
1325         (JSC::ARMAssembler::readPointer):
1326         (ARMAssembler):
1327         (JSC::ARMAssembler::repatchInt32):
1328         (JSC::ARMAssembler::repatchCompact):
1329         * assembler/MacroAssemblerARM.h:
1330         (MacroAssemblerARM):
1331         (JSC::MacroAssemblerARM::isCompactPtrAlignedAddressOffset):
1332         (JSC::MacroAssemblerARM::load32WithCompactAddressOffsetPatch):
1333
1334 2012-07-25  Mark Hahnenberg  <mhahnenberg@apple.com>
1335
1336         Build fix for 32-bit after r123682
1337
1338         * runtime/JSObject.h: Need to pad out JSObjects on 32-bit so that they're the correct size since
1339         we only removed one 4-byte word and we need to be 8-byte aligned.
1340         (JSObject):
1341
1342 2012-07-25  Filip Pizlo  <fpizlo@apple.com>
1343
1344         JSC GC object copying APIs should allow for greater flexibility
1345         https://bugs.webkit.org/show_bug.cgi?id=92316
1346
1347         Reviewed by Mark Hahnenberg.
1348
1349         It's now the case that visitChildren() methods can directly pin and allocate in new space during copying.
1350         They can also do the copying and marking themselves. This new API is only used for JSObjects for now.
1351
1352         * JavaScriptCore.xcodeproj/project.pbxproj:
1353         * heap/MarkStack.cpp:
1354         (JSC::SlotVisitor::allocateNewSpaceSlow):
1355         (JSC::SlotVisitor::allocateNewSpaceOrPin):
1356         (JSC):
1357         (JSC::SlotVisitor::copyAndAppend):
1358         * heap/MarkStack.h:
1359         (MarkStack):
1360         (JSC::MarkStack::appendUnbarrieredValue):
1361         (JSC):
1362         * heap/SlotVisitor.h:
1363         * heap/SlotVisitorInlineMethods.h: Added.
1364         (JSC):
1365         (JSC::SlotVisitor::checkIfShouldCopyAndPinOtherwise):
1366         (JSC::SlotVisitor::allocateNewSpace):
1367         * runtime/JSObject.cpp:
1368         (JSC::JSObject::visitOutOfLineStorage):
1369         (JSC):
1370         (JSC::JSObject::visitChildren):
1371         (JSC::JSFinalObject::visitChildren):
1372         * runtime/JSObject.h:
1373         (JSObject):
1374
1375 2012-07-25  Mark Hahnenberg  <mhahnenberg@apple.com>
1376
1377         Remove JSObject::m_inheritorID
1378         https://bugs.webkit.org/show_bug.cgi?id=88378
1379
1380         Reviewed by Filip Pizlo.
1381
1382         This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
1383         and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
1384         Instead use a private named value in the object's property storage.
1385
1386         * dfg/DFGSpeculativeJIT.h:
1387         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): No need m_inheritorID to initialize!
1388         * jit/JITInlineMethods.h:
1389         (JSC::JIT::emitAllocateBasicJSObject): No need m_inheritorID to initialize!
1390         * llint/LowLevelInterpreter.asm: No need m_inheritorID to initialize!
1391         * runtime/JSGlobalData.h:
1392         (JSGlobalData): Added private name 'm_inheritorIDKey'.
1393         * runtime/JSGlobalThis.cpp:
1394         (JSC::JSGlobalThis::setUnwrappedObject): resetInheritorID is now passed a JSGlobalData&.
1395         * runtime/JSObject.cpp:
1396         (JSC::JSObject::visitChildren): No m_inheritorID to be marked.
1397         (JSC::JSFinalObject::visitChildren): No m_inheritorID to be marked.
1398         (JSC::JSObject::createInheritorID): Store the newly created inheritorID in the property map. Make sure
1399         it's got the DontEnum attribute!!
1400         * runtime/JSObject.h:
1401         (JSObject):
1402         (JSC::JSObject::resetInheritorID): Remove the inheritorID from property storage.
1403         (JSC):
1404         (JSC::JSObject::inheritorID): Read the inheritorID from property storage.
1405
1406 2012-07-25  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
1407
1408         Create a specialized pair for use in HashMap iterators
1409         https://bugs.webkit.org/show_bug.cgi?id=92137
1410
1411         Reviewed by Ryosuke Niwa.
1412
1413         Update a couple of sites that relied on the fact that "contents" of iterators were
1414         std::pairs.
1415
1416         * profiler/Profile.cpp:
1417         (JSC): This code kept a vector of the pairs that were the "contents" of the iterators. This
1418         is changed to use a KeyValuePair. We make use HashCount's ValueType (which represents only
1419         the key) to get the proper key parameter for KeyValuePair.
1420         * tools/ProfileTreeNode.h:
1421         (ProfileTreeNode): Use HashMap::ValueType to declare the type of the contents of the hash
1422         instead of declaring it manually. This will make use of the new KeyValuePair.
1423
1424 2012-07-25  Patrick Gansterer  <paroga@webkit.org>
1425
1426         REGRESSION(r123505): Date.getYear() returns the same as Date.getFullYear()
1427         https://bugs.webkit.org/show_bug.cgi?id=92218
1428
1429         Reviewed by Csaba Osztrogonác.
1430
1431         * runtime/DatePrototype.cpp:
1432         (JSC::dateProtoFuncGetYear): Added the missing offset of 1900 to the return value.
1433
1434 2012-07-24  Filip Pizlo  <fpizlo@apple.com>
1435
1436         REGRESSION(r123417): It made tests assert/crash on 32 bit
1437         https://bugs.webkit.org/show_bug.cgi?id=92088
1438
1439         Reviewed by Mark Hahnenberg.
1440
1441         The pointer arithmetic was wrong, because negative numbers are hard to think about.
1442
1443         * dfg/DFGRepatch.cpp:
1444         (JSC::DFG::emitPutTransitionStub):
1445         * dfg/DFGSpeculativeJIT.cpp:
1446         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
1447
1448 2012-07-24  Patrick Gansterer  <paroga@webkit.org>
1449
1450         Store the full year in GregorianDateTime
1451         https://bugs.webkit.org/show_bug.cgi?id=92067
1452
1453         Reviewed by Geoffrey Garen.
1454
1455         Use the full year instead of the offset from year 1900
1456         for the year member variable of GregorianDateTime.
1457
1458         * runtime/DateConstructor.cpp:
1459         (JSC::constructDate):
1460         (JSC::dateUTC):
1461         * runtime/DateConversion.cpp:
1462         (JSC::formatDate):
1463         (JSC::formatDateUTCVariant):
1464         * runtime/DatePrototype.cpp:
1465         (JSC::formatLocaleDate):
1466         (JSC::fillStructuresUsingDateArgs):
1467         (JSC::dateProtoFuncToISOString):
1468         (JSC::dateProtoFuncGetFullYear):
1469         (JSC::dateProtoFuncGetUTCFullYear):
1470         (JSC::dateProtoFuncSetYear):
1471         * runtime/JSDateMath.cpp:
1472         (JSC::gregorianDateTimeToMS):
1473         (JSC::msToGregorianDateTime):
1474
1475 2012-07-24  Patrick Gansterer  <paroga@webkit.org>
1476
1477         [WIN] Build fix after r123417.
1478
1479         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1480
1481 2012-07-23  Patrick Gansterer  <paroga@webkit.org>
1482
1483         Move GregorianDateTime from JSC to WTF namespace
1484         https://bugs.webkit.org/show_bug.cgi?id=91948
1485
1486         Reviewed by Geoffrey Garen.
1487
1488         Moving GregorianDateTime into the WTF namespace allows us to us to
1489         use it in WebCore too. The new class has the same behaviour as the
1490         old struct. Only the unused timeZone member has been removed.
1491
1492         * runtime/DateConstructor.cpp:
1493         * runtime/DateConversion.cpp:
1494         * runtime/DateConversion.h:
1495         * runtime/DateInstance.h:
1496         * runtime/DatePrototype.cpp:
1497         * runtime/JSDateMath.cpp:
1498         * runtime/JSDateMath.h:
1499
1500 2012-07-23  Filip Pizlo  <fpizlo@apple.com>
1501
1502         Property storage should grow in reverse address direction, to support butterflies
1503         https://bugs.webkit.org/show_bug.cgi?id=91788
1504
1505         Reviewed by Geoffrey Garen.
1506
1507         Changes property storage to grow to the left, and changes the property storage pointer to point
1508         one 8-byte word (i.e. JSValue) to the right of the first value in the storage.
1509
1510         Also improved debug support somewhat, by adding a describe() function to the jsc command-line,
1511         and a slow mode of object access in LLInt.
1512
1513         * assembler/ARMv7Assembler.h:
1514         (JSC::ARMv7Assembler::repatchCompact):
1515         * assembler/MacroAssemblerARMv7.h:
1516         (MacroAssemblerARMv7):
1517         (JSC::MacroAssemblerARMv7::isCompactPtrAlignedAddressOffset):
1518         (JSC::MacroAssemblerARMv7::load32WithCompactAddressOffsetPatch):
1519         * assembler/MacroAssemblerX86Common.h:
1520         (JSC::MacroAssemblerX86Common::isCompactPtrAlignedAddressOffset):
1521         (JSC::MacroAssemblerX86Common::repatchCompact):
1522         * assembler/X86Assembler.h:
1523         (JSC::X86Assembler::repatchCompact):
1524         * bytecode/CodeBlock.cpp:
1525         (JSC::dumpStructure):
1526         * bytecode/GetByIdStatus.h:
1527         (JSC::GetByIdStatus::GetByIdStatus):
1528         * dfg/DFGOperations.cpp:
1529         * dfg/DFGOperations.h:
1530         * dfg/DFGRepatch.cpp:
1531         (JSC::DFG::tryCacheGetByID):
1532         (JSC::DFG::emitPutTransitionStub):
1533         * dfg/DFGSpeculativeJIT.cpp:
1534         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
1535         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
1536         * dfg/DFGSpeculativeJIT.h:
1537         (JSC::DFG::SpeculativeJIT::callOperation):
1538         * dfg/DFGSpeculativeJIT32_64.cpp:
1539         (JSC::DFG::SpeculativeJIT::compile):
1540         * dfg/DFGSpeculativeJIT64.cpp:
1541         (JSC::DFG::SpeculativeJIT::compile):
1542         * heap/ConservativeRoots.cpp:
1543         (JSC::ConservativeRoots::genericAddPointer):
1544         * heap/CopiedSpace.h:
1545         (CopiedSpace):
1546         * heap/CopiedSpaceInlineMethods.h:
1547         (JSC::CopiedSpace::pinIfNecessary):
1548         (JSC):
1549         * jit/JITPropertyAccess.cpp:
1550         (JSC::JIT::compileGetDirectOffset):
1551         * jit/JITPropertyAccess32_64.cpp:
1552         (JSC::JIT::compileGetDirectOffset):
1553         * jit/JITStubs.cpp:
1554         (JSC::JITThunks::tryCacheGetByID):
1555         * jsc.cpp:
1556         (GlobalObject::finishCreation):
1557         (functionDescribe):
1558         * llint/LLIntCommon.h:
1559         * llint/LLIntSlowPaths.cpp:
1560         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1561         * llint/LowLevelInterpreter32_64.asm:
1562         * llint/LowLevelInterpreter64.asm:
1563         * runtime/JSObject.cpp:
1564         (JSC::JSObject::visitChildren):
1565         (JSC::JSFinalObject::visitChildren):
1566         (JSC::JSObject::growOutOfLineStorage):
1567         * runtime/JSObject.h:
1568         (JSC::JSObject::getDirectLocation):
1569         (JSC::JSObject::offsetForLocation):
1570         * runtime/JSValue.h:
1571         (JSValue):
1572         * runtime/PropertyOffset.h:
1573         (JSC::offsetInOutOfLineStorage):
1574
1575 2012-07-23  Filip Pizlo  <fpizlo@apple.com>
1576
1577         DFG is too aggressive in performing the specific value optimization on loads
1578         https://bugs.webkit.org/show_bug.cgi?id=92034
1579
1580         Reviewed by Mark Hahnenberg.
1581
1582         This ensures that we don't do optimizations based on a structure having a specific
1583         value, if there is no way to detect that the value is despecified. This is the
1584         case for dictionaries, since despecifying a value in a dictionary does not lead to
1585         a transition and so cannot be caught by either structure checks or structure
1586         transition watchpoints.
1587
1588         * bytecode/GetByIdStatus.cpp:
1589         (JSC::GetByIdStatus::computeFromLLInt):
1590         (JSC::GetByIdStatus::computeForChain):
1591         (JSC::GetByIdStatus::computeFor):
1592         * bytecode/ResolveGlobalStatus.cpp:
1593         (JSC::computeForStructure):
1594
1595 2012-07-23  Filip Pizlo  <fpizlo@apple.com>
1596
1597         REGRESSION(r123169): It made fast/js/dfg-inline-arguments-use-from-uninlined-code.html fail on 32 bit platforms
1598         https://bugs.webkit.org/show_bug.cgi?id=92002
1599
1600         Reviewed by Mark Hahnenberg.
1601
1602         In the process of changing the nature of local variable typing, I forgot to modify one of the places where
1603         we glue the DFG's notion of variable prediction to the runtime's notion of variable tagging.
1604
1605         * dfg/DFGSpeculativeJIT.cpp:
1606         (JSC::DFG::SpeculativeJIT::compile):
1607
1608 2012-07-23  Simon Fraser  <simon.fraser@apple.com>
1609
1610         Part 2 of: Implement sticky positioning
1611         https://bugs.webkit.org/show_bug.cgi?id=90046
1612
1613         Reviewed by Ojan Vafai.
1614
1615         Turn on ENABLE_CSS_STICKY_POSITION.
1616
1617         * Configurations/FeatureDefines.xcconfig:
1618
1619 2012-07-23  Patrick Gansterer  <paroga@webkit.org>
1620
1621         Move JSC::parseDate() from DateConversion to JSDateMath
1622         https://bugs.webkit.org/show_bug.cgi?id=91982
1623
1624         Reviewed by Geoffrey Garen.
1625
1626         Moveing this function into the other files removes the dependency
1627         on JSC spcific classes in DateConversion.{cpp|h}.
1628
1629         * runtime/DateConversion.cpp:
1630         * runtime/DateConversion.h:
1631         (JSC):
1632         * runtime/JSDateMath.cpp:
1633         (JSC::parseDate):
1634         (JSC):
1635         * runtime/JSDateMath.h:
1636         (JSC):
1637
1638 2012-07-23  Simon Fraser  <simon.fraser@apple.com>
1639
1640         Part 1 of: Implement sticky positioning
1641         https://bugs.webkit.org/show_bug.cgi?id=90046
1642
1643         Reviewed by Ojan Vafai.
1644
1645         Add ENABLE_CSS_STICKY_POSITION, defaulting to off initially.
1646
1647         Sort the ENABLE_CSS lines in the file. Make sure all the flags
1648         are in FEATURE_DEFINES.
1649
1650         * Configurations/FeatureDefines.xcconfig:
1651
1652 2012-07-23  Yong Li  <yoli@rim.com>
1653
1654         [BlackBerry] Implement GCActivityCallback with platform timer
1655         https://bugs.webkit.org/show_bug.cgi?id=90175
1656
1657         Reviewed by Rob Buis.
1658
1659         Use JSLock when performing GC to avoid assertions.
1660
1661         * runtime/GCActivityCallbackBlackBerry.cpp:
1662         (JSC::DefaultGCActivityCallback::doWork):
1663
1664 2012-07-23  Kent Tamura  <tkent@chromium.org>
1665
1666         Rename ENABLE_METER_TAG and ENABLE_PROGRESS_TAG to ENABLE_METER_ELEMENT and ENABLE_PROGRESS_ELEMENT respectively
1667         https://bugs.webkit.org/show_bug.cgi?id=91941
1668
1669         Reviewed by Kentaro Hara.
1670
1671         A flag name for an elmement should be ENABLE_*_ELEMENT.
1672
1673         * Configurations/FeatureDefines.xcconfig:
1674
1675 2012-07-22  Kent Tamura  <tkent@chromium.org>
1676
1677         Rename ENABLE_DETAILS to ENABLE_DETAILS_ELEMENT
1678         https://bugs.webkit.org/show_bug.cgi?id=91928
1679
1680         Reviewed by Kentaro Hara.
1681
1682         A flag name for an elmement should be ENABLE_*_ELEMENT.
1683
1684         * Configurations/FeatureDefines.xcconfig:
1685
1686 2012-07-21  Patrick Gansterer  <paroga@webkit.org>
1687
1688         [WIN] Use GetDateFormat and GetTimeFormat instead of strftime
1689         https://bugs.webkit.org/show_bug.cgi?id=83436
1690
1691         Reviewed by Brent Fulgham.
1692
1693         The MS CRT implementation of strftime calls the same two functions.
1694         Using them directly avoids the overhead of parsing the format string and removes
1695         the dependency on strftime() for WinCE where this function does not exist.
1696
1697         * runtime/DatePrototype.cpp:
1698         (JSC::formatLocaleDate):
1699
1700 2012-07-20  Kent Tamura  <tkent@chromium.org>
1701
1702         Rename ENABLE_DATALIST to ENABLE_DATALIST_ELEMENT
1703         https://bugs.webkit.org/show_bug.cgi?id=91846
1704
1705         Reviewed by Kentaro Hara.
1706
1707         A flag name for an elmement should be ENABLE_*_ELEMENT.
1708
1709         * Configurations/FeatureDefines.xcconfig:
1710
1711 2012-07-20  Han Shen  <shenhan@google.com>
1712
1713         [Chromium] Compilation fails under gcc 4.7
1714         https://bugs.webkit.org/show_bug.cgi?id=90227
1715
1716         Reviewed by Tony Chang.
1717
1718         Disable warnings about c++0x compatibility in gcc newer than 4.6.
1719
1720         * JavaScriptCore.gyp/JavaScriptCore.gyp:
1721
1722 2012-07-18  Filip Pizlo  <fpizlo@apple.com>
1723
1724         DFG cell checks should be hoisted
1725         https://bugs.webkit.org/show_bug.cgi?id=91717
1726
1727         Reviewed by Geoffrey Garen.
1728
1729         The DFG has always had the policy of hoisting array and integer checks to
1730         the point of variable assignment. Eventually, we added doubles and booleans
1731         to the mix. But cells should really be part of this as well, particularly
1732         for 32-bit where accessing a known-type variable is dramatically cheaper
1733         than accessing a variable whose types is only predicted but otherwise
1734         unproven.
1735
1736         This appears to be a definite speed-up for V8 on 32-bit, a possible speed-up
1737         for Kraken, and a possible slow-down for V8 on 64-bit (around 0.2% if at
1738         all). Any slow-downs can, and should, be addressed by making the hoisting
1739         logic cognizant of variables that are never used in a manner that requires
1740         type checks, and by sinking argument checks to the point(s) of first use.
1741
1742         To make this work I had to change some OSR machinery, and special-case the
1743         type predictions of the 'this' argument for constructors. OSR exit normally
1744         assumes that arguments are boxed, which happens to be true because the
1745         type prediction used for check hoisting is LUB'd with the type of the
1746         argument that was passed in - so either the arguments are always stored to
1747         with the full tag+payload, or if only the payload is stored then the tag
1748         matches whatever the caller would have set. But not so with the 'this'
1749         argument for constructors, which is not initialized by the caller. We
1750         could make this more precise by having argument types for OSR be inferred
1751         using similar machinery to other locals, but I figured that for this patch
1752         I should use the surgical fix.
1753
1754         * assembler/MacroAssemblerX86_64.h:
1755         (JSC::MacroAssemblerX86_64::branchTestPtr):
1756         (MacroAssemblerX86_64):
1757         * assembler/X86Assembler.h:
1758         (JSC::X86Assembler::testq_rm):
1759         (X86Assembler):
1760         * dfg/DFGAbstractState.cpp:
1761         (JSC::DFG::AbstractState::initialize):
1762         (JSC::DFG::AbstractState::execute):
1763         * dfg/DFGDriver.cpp:
1764         (JSC::DFG::compile):
1765         * dfg/DFGGraph.h:
1766         (JSC::DFG::Graph::isCreatedThisArgument):
1767         (Graph):
1768         * dfg/DFGSpeculativeJIT.cpp:
1769         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
1770         * dfg/DFGSpeculativeJIT32_64.cpp:
1771         (JSC::DFG::SpeculativeJIT::compile):
1772         * dfg/DFGSpeculativeJIT64.cpp:
1773         (JSC::DFG::SpeculativeJIT::compile):
1774         * dfg/DFGValueSource.h:
1775         (JSC::DFG::ValueSource::forSpeculation):
1776
1777 2012-07-19  Filip Pizlo  <fpizlo@apple.com>
1778
1779         Fast path of storage resize should be removed from property storage reallocation, since it is only useful for arrays
1780         https://bugs.webkit.org/show_bug.cgi?id=91796
1781
1782         Reviewed by Geoffrey Garen.
1783
1784         * dfg/DFGRepatch.cpp:
1785         (JSC::DFG::emitPutTransitionStub):
1786         * dfg/DFGSpeculativeJIT.cpp:
1787         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
1788         * runtime/JSObject.cpp:
1789         (JSC::JSObject::growOutOfLineStorage):
1790
1791 2012-07-19  Mark Lam  <mark.lam@apple.com>
1792
1793         Bug fixes and enhancements for OfflineASM annotation system.
1794         https://bugs.webkit.org/show_bug.cgi?id=91690
1795
1796         Reviewed by Filip Pizlo.
1797
1798         * offlineasm/armv7.rb: added default handling of Instruction lower().
1799         * offlineasm/asm.rb: added more support for annotations and more pretty printing.
1800         * offlineasm/ast.rb: added more support for annotations.
1801         * offlineasm/config.rb: added $preferredCommentStartColumn, simplified $enableInstrAnnotations.
1802         * offlineasm/parser.rb: added more support for annotations.
1803         * offlineasm/transform.rb: added more support for annotations.
1804         * offlineasm/x86.rb: added default handling of Instruction lower().
1805
1806 2012-07-19  Patrick Gansterer  <paroga@webkit.org>
1807
1808         [WIN] Fix compilation of JSGlobalData.h with ENABLE(DFG_JIT)
1809         https://bugs.webkit.org/show_bug.cgi?id=91243
1810
1811         Reviewed by Geoffrey Garen.
1812
1813         Disable MSVC warning 4200 "zero-sized array in struct/union" for JSC::ScratchBuffer.
1814
1815         * runtime/JSGlobalData.h:
1816         (JSC):
1817
1818 2012-07-19  Mark Lam  <mark.lam@apple.com>
1819
1820         Fixed broken ENABLE_JIT=0 build.
1821         https://bugs.webkit.org/show_bug.cgi?id=91725
1822
1823         Reviewed by Oliver Hunt.
1824
1825         * bytecode/Watchpoint.cpp:
1826         * heap/JITStubRoutineSet.h:
1827         (JSC):
1828         (JITStubRoutineSet):
1829         (JSC::JITStubRoutineSet::JITStubRoutineSet):
1830         (JSC::JITStubRoutineSet::~JITStubRoutineSet):
1831         (JSC::JITStubRoutineSet::add):
1832         (JSC::JITStubRoutineSet::clearMarks):
1833         (JSC::JITStubRoutineSet::mark):
1834         (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
1835         (JSC::JITStubRoutineSet::traceMarkedStubRoutines):
1836
1837 2012-07-19  Kristóf Kosztyó  <kkristof@inf.u-szeged.hu>
1838
1839         [Qt] Unreviewed buildfix after r123042.
1840
1841         * interpreter/Interpreter.cpp:
1842         (JSC::Interpreter::dumpRegisters):
1843
1844 2012-07-18  Filip Pizlo  <fpizlo@apple.com>
1845
1846         DFG should emit inline code for property storage (re)allocation
1847         https://bugs.webkit.org/show_bug.cgi?id=91597
1848
1849         Reviewed by Oliver Hunt.
1850
1851         This adds two new ops to the DFG IR: AllocatePropertyStorage and
1852         ReallocatePropertyStorage. It enables these to interact properly with
1853         CSE so that a GetPropertyStorage on something for which we have
1854         obviously done a (Re)AllocatePropertyStorage will result in the
1855         GetPropertyStorage being eliminated. Other than that, the code
1856         emitted for these ops is identical to the code we were emitting in
1857         the corresponding PutById stub.
1858
1859         * dfg/DFGAbstractState.cpp:
1860         (JSC::DFG::AbstractState::execute):
1861         * dfg/DFGByteCodeParser.cpp:
1862         (JSC::DFG::ByteCodeParser::parseBlock):
1863         * dfg/DFGCSEPhase.cpp:
1864         (JSC::DFG::CSEPhase::putStructureStoreElimination):
1865         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
1866         * dfg/DFGNode.h:
1867         (JSC::DFG::Node::hasStructureTransitionData):
1868         * dfg/DFGNodeType.h:
1869         (DFG):
1870         * dfg/DFGOperations.cpp:
1871         * dfg/DFGOperations.h:
1872         * dfg/DFGPredictionPropagationPhase.cpp:
1873         (JSC::DFG::PredictionPropagationPhase::propagate):
1874         * dfg/DFGSpeculativeJIT.cpp:
1875         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
1876         (DFG):
1877         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
1878         * dfg/DFGSpeculativeJIT.h:
1879         (JSC::DFG::SpeculativeJIT::callOperation):
1880         (SpeculativeJIT):
1881         * dfg/DFGSpeculativeJIT32_64.cpp:
1882         (JSC::DFG::SpeculativeJIT::compile):
1883         * dfg/DFGSpeculativeJIT64.cpp:
1884         (JSC::DFG::SpeculativeJIT::compile):
1885         * runtime/Structure.cpp:
1886         (JSC::nextOutOfLineStorageCapacity):
1887         * runtime/Structure.h:
1888         (JSC):
1889
1890 2012-07-16  Oliver Hunt  <oliver@apple.com>
1891
1892         dumpCallFrame is broken in ToT
1893         https://bugs.webkit.org/show_bug.cgi?id=91444
1894
1895         Reviewed by Gavin Barraclough.
1896
1897         Various changes have been made to the SF calling convention, but
1898         dumpCallFrame has not been updated to reflect these changes.
1899         That resulted in both bogus information, as well as numerous
1900         assertions of sadness.
1901
1902         This patch makes dumpCallFrame actually work again and adds the
1903         wonderful feature of telling you the name of the variable that a
1904         register reflects, or what value it contains.
1905
1906         * bytecode/CodeBlock.cpp:
1907         (JSC::CodeBlock::nameForRegister):
1908             A really innefficient mechanism for finding the name of a local register.
1909             This should only ever be used by debug code so this should be okay.
1910         * bytecode/CodeBlock.h:
1911         (CodeBlock):
1912         * bytecompiler/BytecodeGenerator.cpp:
1913         (JSC::BytecodeGenerator::generate):
1914             Debug builds no longer throw away a functions symbol table, this allows
1915             us to actually perform a register# to name mapping
1916         * dfg/DFGJITCompiler.cpp:
1917         (JSC::DFG::JITCompiler::link):
1918             We weren't propogating the bytecode offset here leading to assertions
1919             in debug builds when dumping bytecode of DFG compiled code.
1920         * interpreter/Interpreter.cpp:
1921         (JSC):
1922         (JSC::Interpreter::dumpRegisters):
1923              Rework to actually be correct.
1924         (JSC::getCallerInfo):
1925              Return the byteocde offset as well now, given we have to determine it
1926              anyway.
1927         (JSC::Interpreter::getStackTrace):
1928         (JSC::Interpreter::retrieveCallerFromVMCode):
1929         * interpreter/Interpreter.h:
1930         (Interpreter):
1931         * jsc.cpp:
1932         (GlobalObject::finishCreation):
1933         (functionDumpCallFrame):
1934              Give debug builds of JSC a method for calling dumpCallFrame so we can
1935              inspect a callframe without requiring us to break in a debugger.
1936
1937 2012-07-18  Filip Pizlo  <fpizlo@apple.com>
1938
1939         DFG 32-bit PutById transition stub storage reallocation case copies the first pointer of each JSValue instead of the whole JSValue
1940         https://bugs.webkit.org/show_bug.cgi?id=91599
1941
1942         Reviewed by Geoffrey Garen.
1943
1944         * dfg/DFGRepatch.cpp:
1945         (JSC::DFG::emitPutTransitionStub):
1946
1947 2012-07-17  Filip Pizlo  <fpizlo@apple.com>
1948
1949         DFG 32-bit PutById transition stub passes the payload/tag arguments to a DFG operation in the wrong order
1950         https://bugs.webkit.org/show_bug.cgi?id=91576
1951
1952         Reviewed by Gavin Barraclough.
1953
1954         * dfg/DFGRepatch.cpp:
1955         (JSC::DFG::emitPutTransitionStub):
1956
1957 2012-07-17  Filip Pizlo  <fpizlo@apple.com>
1958
1959         [Qt] REGRESSION(r122768, r122771): They broke jquery/data.html and inspector/elements/edit-dom-actions.html
1960         https://bugs.webkit.org/show_bug.cgi?id=91476
1961
1962         Reviewed by Mark Hahnenberg.
1963
1964         The 32-bit repatching code was not correctly adapted to the new world where there may not always
1965         be an available scratch register. Fixed it by ensuring that the scratch register we select does
1966         not overlap with the value tag.
1967
1968         * dfg/DFGRepatch.cpp:
1969         (JSC::DFG::generateProtoChainAccessStub):
1970         (JSC::DFG::tryCacheGetByID):
1971         (JSC::DFG::tryBuildGetByIDList):
1972         (JSC::DFG::emitPutReplaceStub):
1973
1974 2012-07-17  Gabor Rapcsanyi  <rgabor@webkit.org>
1975
1976         Unreviewed buildfix from Zoltan Herczeg after 122768.
1977
1978         * dfg/DFGCCallHelpers.h:
1979         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
1980         (CCallHelpers):
1981
1982 2012-07-17  David Barr  <davidbarr@chromium.org>
1983
1984         Introduce ENABLE_CSS_IMAGE_ORIENTATION compile flag
1985         https://bugs.webkit.org/show_bug.cgi?id=89055
1986
1987         Reviewed by Kent Tamura.
1988
1989         The css3-images module is at candidate recommendation.
1990         http://www.w3.org/TR/2012/CR-css3-images-20120417/#the-image-orientation
1991
1992         Add a configuration option for CSS image-orientation support, disabling it by default.
1993
1994         * Configurations/FeatureDefines.xcconfig:
1995
1996 2012-07-16  Filip Pizlo  <fpizlo@apple.com>
1997
1998         Unreviewed, roll out 122790 because it broke the Windows build. I'm not
1999         sure what to do with exported symbols that are predicated on NDEBUG.
2000
2001         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2002         * bytecode/CodeBlock.cpp:
2003         (JSC):
2004         * bytecode/CodeBlock.h:
2005         (CodeBlock):
2006         * bytecompiler/BytecodeGenerator.cpp:
2007         (JSC::BytecodeGenerator::generate):
2008         * dfg/DFGJITCompiler.cpp:
2009         (JSC::DFG::JITCompiler::link):
2010         * interpreter/Interpreter.cpp:
2011         (JSC):
2012         (JSC::Interpreter::dumpRegisters):
2013         (JSC::getCallerInfo):
2014         (JSC::Interpreter::getStackTrace):
2015         (JSC::Interpreter::retrieveCallerFromVMCode):
2016         * interpreter/Interpreter.h:
2017         (Interpreter):
2018         * jsc.cpp:
2019         (GlobalObject::finishCreation):
2020
2021 2012-07-16  Oliver Hunt  <oliver@apple.com>
2022
2023         dumpCallFrame is broken in ToT
2024         https://bugs.webkit.org/show_bug.cgi?id=91444
2025
2026         Reviewed by Gavin Barraclough.
2027
2028         Various changes have been made to the SF calling convention, but
2029         dumpCallFrame has not been updated to reflect these changes.
2030         That resulted in both bogus information, as well as numerous
2031         assertions of sadness.
2032
2033         This patch makes dumpCallFrame actually work again and adds the
2034         wonderful feature of telling you the name of the variable that a
2035         register reflects, or what value it contains.
2036
2037         * bytecode/CodeBlock.cpp:
2038         (JSC::CodeBlock::nameForRegister):
2039             A really innefficient mechanism for finding the name of a local register.
2040             This should only ever be used by debug code so this should be okay.
2041         * bytecode/CodeBlock.h:
2042         (CodeBlock):
2043         * bytecompiler/BytecodeGenerator.cpp:
2044         (JSC::BytecodeGenerator::generate):
2045             Debug builds no longer throw away a functions symbol table, this allows
2046             us to actually perform a register# to name mapping
2047         * dfg/DFGJITCompiler.cpp:
2048         (JSC::DFG::JITCompiler::link):
2049             We weren't propogating the bytecode offset here leading to assertions
2050             in debug builds when dumping bytecode of DFG compiled code.
2051         * interpreter/Interpreter.cpp:
2052         (JSC):
2053         (JSC::Interpreter::dumpRegisters):
2054              Rework to actually be correct.
2055         (JSC::getCallerInfo):
2056              Return the byteocde offset as well now, given we have to determine it
2057              anyway.
2058         (JSC::Interpreter::getStackTrace):
2059         (JSC::Interpreter::retrieveCallerFromVMCode):
2060         * interpreter/Interpreter.h:
2061         (Interpreter):
2062         * jsc.cpp:
2063         (GlobalObject::finishCreation):
2064         (functionDumpCallFrame):
2065              Give debug builds of JSC a method for calling dumpCallFrame so we can
2066              inspect a callframe without requiring us to break in a debugger.
2067
2068 2012-07-16  Filip Pizlo  <fpizlo@apple.com>
2069
2070         Unreviewed, adding forgotten files.
2071
2072         * dfg/DFGRegisterSet.h: Added.
2073         (DFG):
2074         (RegisterSet):
2075         (JSC::DFG::RegisterSet::RegisterSet):
2076         (JSC::DFG::RegisterSet::asPOD):
2077         (JSC::DFG::RegisterSet::copyInfo):
2078         (JSC::DFG::RegisterSet::set):
2079         (JSC::DFG::RegisterSet::setGPRByIndex):
2080         (JSC::DFG::RegisterSet::clear):
2081         (JSC::DFG::RegisterSet::get):
2082         (JSC::DFG::RegisterSet::getGPRByIndex):
2083         (JSC::DFG::RegisterSet::getFreeGPR):
2084         (JSC::DFG::RegisterSet::setFPRByIndex):
2085         (JSC::DFG::RegisterSet::getFPRByIndex):
2086         (JSC::DFG::RegisterSet::setByIndex):
2087         (JSC::DFG::RegisterSet::getByIndex):
2088         (JSC::DFG::RegisterSet::numberOfSetGPRs):
2089         (JSC::DFG::RegisterSet::numberOfSetFPRs):
2090         (JSC::DFG::RegisterSet::numberOfSetRegisters):
2091         (JSC::DFG::RegisterSet::setBit):
2092         (JSC::DFG::RegisterSet::clearBit):
2093         (JSC::DFG::RegisterSet::getBit):
2094         * dfg/DFGScratchRegisterAllocator.h: Added.
2095         (DFG):
2096         (ScratchRegisterAllocator):
2097         (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator):
2098         (JSC::DFG::ScratchRegisterAllocator::lock):
2099         (JSC::DFG::ScratchRegisterAllocator::allocateScratch):
2100         (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR):
2101         (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR):
2102         (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters):
2103         (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
2104         (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
2105         (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize):
2106         (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
2107         (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
2108
2109 2012-07-15  Filip Pizlo  <fpizlo@apple.com>
2110
2111         DFG PutById transition should handle storage allocation, and inline it
2112         https://bugs.webkit.org/show_bug.cgi?id=91337
2113
2114         Reviewed by Oliver Hunt.
2115
2116         This enables the patching of DFG PutById to handle the out-of-line storage
2117         allocation case. Furthermore, it inlines out-of-line storage allocation (and
2118         reallocation) into the generated stubs.
2119
2120         To do this, this patch adds the ability to store the relevant register
2121         allocation state (i.e. the set of in-use registers) in the structure stub
2122         info so that the stub generation code can more flexibly select scratch
2123         registers: sometimes it needs none, sometimes one - or sometimes up to
2124         three. Moreover, to make the stub generation register allocation simple and
2125         maintainable, this patch introduces a reusable scratch register allocator
2126         class. This register allocator understands that some registers are in use by
2127         the main path code and so must be spilled as necessary, other registers are
2128         locked for use in the stub itself and so cannot even be spilled, while still
2129         others may be allocated for scratch purposes. A scratch register that is
2130         used must be spilled. If a register is locked, it cannot be used as a
2131         scratch register. If a register is used, it can be used as a scratch
2132         register so long as it is spilled.
2133
2134         This is a sub-1% speed-up on V8 and neutral elsewhere.
2135
2136         * GNUmakefile.list.am:
2137         * JavaScriptCore.xcodeproj/project.pbxproj:
2138         * assembler/MacroAssemblerCodeRef.h:
2139         (FunctionPtr):
2140         (JSC::FunctionPtr::FunctionPtr):
2141         * bytecode/StructureStubInfo.h:
2142         * dfg/DFGCCallHelpers.h:
2143         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
2144         (CCallHelpers):
2145         * dfg/DFGGPRInfo.h:
2146         * dfg/DFGJITCompiler.cpp:
2147         (JSC::DFG::JITCompiler::link):
2148         * dfg/DFGJITCompiler.h:
2149         (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
2150         (PropertyAccessRecord):
2151         * dfg/DFGOperations.cpp:
2152         * dfg/DFGOperations.h:
2153         * dfg/DFGRegisterBank.h:
2154         (JSC::DFG::RegisterBank::isInUse):
2155         (RegisterBank):
2156         * dfg/DFGRegisterSet.h: Added.
2157         (DFG):
2158         (RegisterSet):
2159         (JSC::DFG::RegisterSet::RegisterSet):
2160         (JSC::DFG::RegisterSet::asPOD):
2161         (JSC::DFG::RegisterSet::copyInfo):
2162         (JSC::DFG::RegisterSet::set):
2163         (JSC::DFG::RegisterSet::setGPRByIndex):
2164         (JSC::DFG::RegisterSet::clear):
2165         (JSC::DFG::RegisterSet::get):
2166         (JSC::DFG::RegisterSet::getGPRByIndex):
2167         (JSC::DFG::RegisterSet::getFreeGPR):
2168         (JSC::DFG::RegisterSet::setFPRByIndex):
2169         (JSC::DFG::RegisterSet::getFPRByIndex):
2170         (JSC::DFG::RegisterSet::setByIndex):
2171         (JSC::DFG::RegisterSet::getByIndex):
2172         (JSC::DFG::RegisterSet::numberOfSetGPRs):
2173         (JSC::DFG::RegisterSet::numberOfSetFPRs):
2174         (JSC::DFG::RegisterSet::numberOfSetRegisters):
2175         (JSC::DFG::RegisterSet::setBit):
2176         (JSC::DFG::RegisterSet::clearBit):
2177         (JSC::DFG::RegisterSet::getBit):
2178         * dfg/DFGRepatch.cpp:
2179         (JSC::DFG::generateProtoChainAccessStub):
2180         (JSC::DFG::tryCacheGetByID):
2181         (JSC::DFG::tryBuildGetByIDList):
2182         (JSC::DFG::emitPutReplaceStub):
2183         (JSC::DFG::emitPutTransitionStub):
2184         (JSC::DFG::tryCachePutByID):
2185         (JSC::DFG::tryBuildPutByIdList):
2186         * dfg/DFGScratchRegisterAllocator.h: Added.
2187         (DFG):
2188         (ScratchRegisterAllocator):
2189         (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator):
2190         (JSC::DFG::ScratchRegisterAllocator::lock):
2191         (JSC::DFG::ScratchRegisterAllocator::allocateScratch):
2192         (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR):
2193         (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR):
2194         (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters):
2195         (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
2196         (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
2197         (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize):
2198         (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
2199         (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
2200         * dfg/DFGSpeculativeJIT.h:
2201         (SpeculativeJIT):
2202         (JSC::DFG::SpeculativeJIT::usedRegisters):
2203         * dfg/DFGSpeculativeJIT32_64.cpp:
2204         (JSC::DFG::SpeculativeJIT::cachedGetById):
2205         (JSC::DFG::SpeculativeJIT::cachedPutById):
2206         (JSC::DFG::SpeculativeJIT::compile):
2207         * dfg/DFGSpeculativeJIT64.cpp:
2208         (JSC::DFG::SpeculativeJIT::cachedGetById):
2209         (JSC::DFG::SpeculativeJIT::cachedPutById):
2210         (JSC::DFG::SpeculativeJIT::compile):
2211         * heap/CopiedAllocator.h:
2212         (CopiedAllocator):
2213         (JSC::CopiedAllocator::fastPathShouldSucceed):
2214         (JSC):
2215
2216 2012-07-16  Patrick Gansterer  <paroga@webkit.org>
2217
2218         Add dfg switch to create_jit_stubs script
2219         https://bugs.webkit.org/show_bug.cgi?id=91256
2220
2221         Reviewed by Geoffrey Garen.
2222
2223         * create_jit_stubs: Add a switch to enable or disable the generation of
2224                             stub functions in #if ENABLE(DFG_JIT) conditions.
2225
2226 2012-07-16  Gabor Rapcsanyi  <rgabor@webkit.org>
2227
2228         Unreviewed buildfix after r122729. Typo fix.
2229
2230         * assembler/MacroAssemblerARM.h:
2231         (JSC::MacroAssemblerARM::add32):
2232
2233 2012-07-16  Gabor Rapcsanyi  <rgabor@webkit.org>
2234
2235         Unreviewed buildfix from Zoltan Herczeg after r122677.
2236         Implement missing add32 function to MacroAssemblerARM.
2237
2238         * assembler/MacroAssemblerARM.h:
2239         (JSC::MacroAssemblerARM::add32):
2240         (MacroAssemblerARM):
2241
2242 2012-07-14  Filip Pizlo  <fpizlo@apple.com>
2243
2244         DFG PutByVal opcodes should accept more than 3 operands
2245         https://bugs.webkit.org/show_bug.cgi?id=91332
2246
2247         Reviewed by Oliver Hunt.
2248
2249         Turned PutByVal/PutByValAlias into var-arg nodes, so that we can give them
2250         4 or more operands in the future.
2251
2252         * dfg/DFGAbstractState.cpp:
2253         (JSC::DFG::AbstractState::execute):
2254         * dfg/DFGByteCodeParser.cpp:
2255         (JSC::DFG::ByteCodeParser::parseBlock):
2256         * dfg/DFGCSEPhase.cpp:
2257         (JSC::DFG::CSEPhase::getByValLoadElimination):
2258         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
2259         (JSC::DFG::CSEPhase::performNodeCSE):
2260         * dfg/DFGFixupPhase.cpp:
2261         (JSC::DFG::FixupPhase::fixupNode):
2262         (JSC::DFG::FixupPhase::fixDoubleEdge):
2263         * dfg/DFGGraph.h:
2264         (JSC::DFG::Graph::byValIsPure):
2265         (JSC::DFG::Graph::varArgNumChildren):
2266         (Graph):
2267         (JSC::DFG::Graph::numChildren):
2268         (JSC::DFG::Graph::varArgChild):
2269         (JSC::DFG::Graph::child):
2270         * dfg/DFGNodeType.h:
2271         (DFG):
2272         * dfg/DFGPredictionPropagationPhase.cpp:
2273         (JSC::DFG::PredictionPropagationPhase::propagate):
2274         * dfg/DFGSpeculativeJIT.cpp:
2275         (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
2276         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
2277         * dfg/DFGSpeculativeJIT32_64.cpp:
2278         (JSC::DFG::SpeculativeJIT::compile):
2279         * dfg/DFGSpeculativeJIT64.cpp:
2280         (JSC::DFG::SpeculativeJIT::compile):
2281
2282 2012-07-14  Filip Pizlo  <fpizlo@apple.com>
2283
2284         Rationalize and optimize storage allocation
2285         https://bugs.webkit.org/show_bug.cgi?id=91303
2286
2287         Reviewed by Oliver Hunt.
2288
2289         This implements a backwards bump allocator for copied space storage
2290         allocation, shown in pseudo-code below:
2291
2292             pointer bump(size) {
2293                 pointer tmp = allocator->remaining;
2294                 tmp -= size;
2295                 if (tmp < 0)
2296                     fail;
2297                 allocator->remaining = tmp;
2298                 return allocator->payloadEnd - tmp - size;
2299             }
2300
2301         The advantage of this allocator is that it:
2302
2303         - Only requires one comparison in the common case where size is known to
2304           not be huge, and this comparison can be done by checking the sign bit
2305           of the subtraction.
2306
2307         - Can be implemented even when only one register is available. This
2308           register is reused for both temporary storage during allocation and
2309           for the result.
2310
2311         - Preserves the behavior that memory in a block is filled in from lowest
2312           address to highest address, which allows for a cheap reallocation fast
2313           path.
2314
2315         - Is resilient against the block used for allocation being the last one
2316           in virtual memory, thereby otherwise leading to the risk of overflow
2317           in the bump pointer, despite only doing one branch.
2318
2319         In order to implement this allocator using the smallest possible chunk
2320         of code, I refactored the copied space code so that all of the allocation
2321         logic is in CopiedAllocator, and all of the state is in either
2322         CopiedBlock or CopiedAllocator. This should make changing the allocation
2323         fast path easier in the future.
2324
2325         In order to do this, I needed to add some new assembler support,
2326         particularly for various forms of add(address, register) and negPtr().
2327
2328         This is performance neutral. The purpose of this change is to facilitate
2329         further inlining of storage allocation without having to reserve
2330         additional registers or emit too much code.
2331
2332         * assembler/MacroAssembler.h:
2333         (JSC::MacroAssembler::addPtr):
2334         (MacroAssembler):
2335         (JSC::MacroAssembler::negPtr):
2336         * assembler/MacroAssemblerARMv7.h:
2337         (MacroAssemblerARMv7):
2338         (JSC::MacroAssemblerARMv7::add32):
2339         * assembler/MacroAssemblerX86.h:
2340         (JSC::MacroAssemblerX86::add32):
2341         (MacroAssemblerX86):
2342         * assembler/MacroAssemblerX86_64.h:
2343         (MacroAssemblerX86_64):
2344         (JSC::MacroAssemblerX86_64::addPtr):
2345         (JSC::MacroAssemblerX86_64::negPtr):
2346         * assembler/X86Assembler.h:
2347         (X86Assembler):
2348         (JSC::X86Assembler::addl_mr):
2349         (JSC::X86Assembler::addq_mr):
2350         (JSC::X86Assembler::negq_r):
2351         * heap/CopiedAllocator.h:
2352         (CopiedAllocator):
2353         (JSC::CopiedAllocator::isValid):
2354         (JSC::CopiedAllocator::CopiedAllocator):
2355         (JSC::CopiedAllocator::tryAllocate):
2356         (JSC):
2357         (JSC::CopiedAllocator::tryReallocate):
2358         (JSC::CopiedAllocator::forceAllocate):
2359         (JSC::CopiedAllocator::resetCurrentBlock):
2360         (JSC::CopiedAllocator::setCurrentBlock):
2361         (JSC::CopiedAllocator::currentCapacity):
2362         * heap/CopiedBlock.h:
2363         (CopiedBlock):
2364         (JSC::CopiedBlock::create):
2365         (JSC::CopiedBlock::zeroFillWilderness):
2366         (JSC::CopiedBlock::CopiedBlock):
2367         (JSC::CopiedBlock::payloadEnd):
2368         (JSC):
2369         (JSC::CopiedBlock::payloadCapacity):
2370         (JSC::CopiedBlock::data):
2371         (JSC::CopiedBlock::dataEnd):
2372         (JSC::CopiedBlock::dataSize):
2373         (JSC::CopiedBlock::wilderness):
2374         (JSC::CopiedBlock::wildernessEnd):
2375         (JSC::CopiedBlock::wildernessSize):
2376         (JSC::CopiedBlock::size):
2377         * heap/CopiedSpace.cpp:
2378         (JSC::CopiedSpace::tryAllocateSlowCase):
2379         (JSC::CopiedSpace::tryAllocateOversize):
2380         (JSC::CopiedSpace::tryReallocate):
2381         (JSC::CopiedSpace::doneFillingBlock):
2382         (JSC::CopiedSpace::doneCopying):
2383         * heap/CopiedSpace.h:
2384         (CopiedSpace):
2385         * heap/CopiedSpaceInlineMethods.h:
2386         (JSC::CopiedSpace::startedCopying):
2387         (JSC::CopiedSpace::allocateBlockForCopyingPhase):
2388         (JSC::CopiedSpace::allocateBlock):
2389         (JSC::CopiedSpace::tryAllocate):
2390         (JSC):
2391         * heap/MarkStack.cpp:
2392         (JSC::SlotVisitor::startCopying):
2393         (JSC::SlotVisitor::allocateNewSpace):
2394         (JSC::SlotVisitor::doneCopying):
2395         * heap/SlotVisitor.h:
2396         (JSC::SlotVisitor::SlotVisitor):
2397         * jit/JIT.h:
2398         * jit/JITInlineMethods.h:
2399         (JSC::JIT::emitAllocateBasicStorage):
2400         (JSC::JIT::emitAllocateJSArray):
2401
2402 2012-07-13  Mark Lam  <mark.lam@apple.com>
2403
2404         OfflineASM Pretty printing and commenting enhancements.
2405         https://bugs.webkit.org/show_bug.cgi?id=91281
2406
2407         Reviewed by Filip Pizlo.
2408
2409         Added some minor pretty printing in the OfflineASM.
2410         Also added infrastruture for adding multiple types of comments and
2411         annotations with the ability to enable/disable them in the generated
2412         output as desired.
2413
2414         * GNUmakefile.list.am: add new file config.rb.
2415         * llint/LLIntOfflineAsmConfig.h:
2416           Added OFFLINE_ASM_BEGIN, OFFLINE_ASM_END, and OFFLINE_ASM_LOCAL_LABEL macros.
2417           This will allow us to redefine these for other backends later.
2418         * llint/LowLevelInterpreter32_64.asm:
2419           Add a small example of instruction annotations for now.
2420         * llint/LowLevelInterpreter64.asm:
2421           Add a small example of instruction annotations for now.
2422         * offlineasm/armv7.rb: Added handling of annotations.
2423         * offlineasm/asm.rb:
2424           Added machinery to dump the new comments and annotations.
2425           Also added some indentations to make the output a little prettier.
2426         * offlineasm/ast.rb: Added annotation field in class Instruction.
2427         * offlineasm/backends.rb:
2428         * offlineasm/config.rb: Added.
2429           Currently only contains commenting options.  This file is meant to be
2430           a centralized place for build config values much like config.h for
2431           JavaScriptCore.
2432         * offlineasm/generate_offset_extractor.rb:
2433         * offlineasm/instructions.rb:
2434         * offlineasm/offsets.rb:
2435         * offlineasm/opt.rb:
2436         * offlineasm/parser.rb: Parse and record annotations.
2437         * offlineasm/registers.rb:
2438         * offlineasm/self_hash.rb:
2439         * offlineasm/settings.rb:
2440         * offlineasm/transform.rb:
2441         * offlineasm/x86.rb: Added handling of annotations.
2442
2443 2012-07-13  Filip Pizlo  <fpizlo@apple.com>
2444
2445         ASSERTION FAILED: use.useKind() != DoubleUse
2446         https://bugs.webkit.org/show_bug.cgi?id=91082
2447
2448         Reviewed by Geoffrey Garen.
2449
2450         The implementation of Branch() was unwisely relying on register allocation state
2451         to decide what speculations to perform. That's never correct.
2452
2453         * dfg/DFGSpeculativeJIT32_64.cpp:
2454         (JSC::DFG::SpeculativeJIT::compile):
2455         * dfg/DFGSpeculativeJIT64.cpp:
2456         (JSC::DFG::SpeculativeJIT::compile):
2457
2458 2012-07-13  Sheriff Bot  <webkit.review.bot@gmail.com>
2459
2460         Unreviewed, rolling out r122640.
2461         http://trac.webkit.org/changeset/122640
2462         https://bugs.webkit.org/show_bug.cgi?id=91298
2463
2464         LLInt apparently does not expect to mark these (Requested by
2465         olliej on #webkit).
2466
2467         * bytecode/CodeBlock.cpp:
2468         (JSC::CodeBlock::visitStructures):
2469         (JSC::CodeBlock::stronglyVisitStrongReferences):
2470
2471 2012-07-13  Oliver Hunt  <oliver@apple.com>
2472
2473         LLInt fails to mark structures stored in the bytecode
2474         https://bugs.webkit.org/show_bug.cgi?id=91296
2475
2476         Reviewed by Geoffrey Garen.
2477
2478         LLInt stores structures in the bytecode, so we need to visit the appropriate
2479         instructions as we would if we were running in the classic interpreter.
2480         This requires adding additional checks for the LLInt specific opcodes, and
2481         the lint specific variants of operand ordering.
2482
2483         * bytecode/CodeBlock.cpp:
2484         (JSC::CodeBlock::visitStructures):
2485         (JSC::CodeBlock::stronglyVisitStrongReferences):
2486
2487 2012-07-13  Yong Li  <yoli@rim.com>
2488
2489         [BlackBerry] Implement GCActivityCallback with platform timer
2490         https://bugs.webkit.org/show_bug.cgi?id=90175
2491
2492         Reviewed by Rob Buis.
2493
2494         Implement GCActivityCallback and HeapTimer for BlackBerry port.
2495
2496         * heap/HeapTimer.cpp:
2497         (JSC):
2498         (JSC::HeapTimer::HeapTimer):
2499         (JSC::HeapTimer::~HeapTimer):
2500         (JSC::HeapTimer::timerDidFire):
2501         (JSC::HeapTimer::synchronize):
2502         (JSC::HeapTimer::invalidate):
2503         (JSC::HeapTimer::didStartVMShutdown):
2504         * heap/HeapTimer.h:
2505         (HeapTimer):
2506         * runtime/GCActivityCallbackBlackBerry.cpp:
2507         (JSC):
2508         (JSC::DefaultGCActivityCallback::doWork):
2509         (JSC::DefaultGCActivityCallback::didAllocate):
2510         (JSC::DefaultGCActivityCallback::willCollect):
2511         (JSC::DefaultGCActivityCallback::cancel):
2512
2513 2012-07-13  Patrick Gansterer  <paroga@webkit.org>
2514
2515         [WIN] Fix compilation of DFGRepatch.cpp
2516         https://bugs.webkit.org/show_bug.cgi?id=91241
2517
2518         Reviewed by Geoffrey Garen.
2519
2520         Use intptr_t instead of uintptr_t when calling CodeLocationCommon::dataLabelPtrAtOffset(int)
2521         to fix MSVC "unary minus operator applied to unsigned type, result still unsigned" warning.
2522
2523         * dfg/DFGRepatch.cpp:
2524         (JSC::DFG::dfgResetGetByID):
2525         (JSC::DFG::dfgResetPutByID):
2526
2527 2012-07-13  Patrick Gansterer  <paroga@webkit.org>
2528
2529         Fix ARM_TRADITIONAL JIT for COMPILER(MSVC) and COMPILER(RVCT) after r121885
2530         https://bugs.webkit.org/show_bug.cgi?id=91238
2531
2532         Reviewed by Zoltan Herczeg.
2533
2534         r121885 changed the assembler instruction only for COMPILER(GCC).
2535         Use the same instructions for the other compilers too.
2536
2537         * jit/JITStubs.cpp:
2538         (JSC::ctiTrampoline):
2539         (JSC::ctiTrampolineEnd):
2540         (JSC::ctiVMThrowTrampoline):
2541
2542 2012-07-12  Filip Pizlo  <fpizlo@apple.com>
2543
2544         DFG property access stubs should use structure transition watchpoints
2545         https://bugs.webkit.org/show_bug.cgi?id=91135
2546
2547         Reviewed by Geoffrey Garen.
2548
2549         This adds a Watchpoint subclass that will clear a structure stub (i.e.
2550         a property access stub) when fired. The DFG stub generation code now
2551         uses this optimization.
2552
2553         * CMakeLists.txt:
2554         * GNUmakefile.list.am:
2555         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2556         * JavaScriptCore.xcodeproj/project.pbxproj:
2557         * Target.pri:
2558         * bytecode/CodeBlock.cpp:
2559         (JSC):
2560         (JSC::CodeBlock::finalizeUnconditionally):
2561         (JSC::CodeBlock::resetStub):
2562         (JSC::CodeBlock::resetStubInternal):
2563         * bytecode/CodeBlock.h:
2564         (JSC):
2565         (CodeBlock):
2566         * bytecode/StructureStubClearingWatchpoint.cpp: Added.
2567         (JSC):
2568         (JSC::StructureStubClearingWatchpoint::~StructureStubClearingWatchpoint):
2569         (JSC::StructureStubClearingWatchpoint::push):
2570         (JSC::StructureStubClearingWatchpoint::fireInternal):
2571         (JSC::WatchpointsOnStructureStubInfo::~WatchpointsOnStructureStubInfo):
2572         (JSC::WatchpointsOnStructureStubInfo::addWatchpoint):
2573         (JSC::WatchpointsOnStructureStubInfo::ensureReferenceAndAddWatchpoint):
2574         * bytecode/StructureStubClearingWatchpoint.h: Added.
2575         (JSC):
2576         (StructureStubClearingWatchpoint):
2577         (JSC::StructureStubClearingWatchpoint::StructureStubClearingWatchpoint):
2578         (WatchpointsOnStructureStubInfo):
2579         (JSC::WatchpointsOnStructureStubInfo::WatchpointsOnStructureStubInfo):
2580         (JSC::WatchpointsOnStructureStubInfo::codeBlock):
2581         (JSC::WatchpointsOnStructureStubInfo::stubInfo):
2582         * bytecode/StructureStubInfo.h:
2583         (JSC::StructureStubInfo::reset):
2584         (JSC::StructureStubInfo::addWatchpoint):
2585         (StructureStubInfo):
2586         * dfg/DFGRepatch.cpp:
2587         (JSC::DFG::addStructureTransitionCheck):
2588         (DFG):
2589         (JSC::DFG::generateProtoChainAccessStub):
2590         (JSC::DFG::emitPutTransitionStub):
2591         * jit/JumpReplacementWatchpoint.h:
2592
2593 2012-07-12  Filip Pizlo  <fpizlo@apple.com>
2594
2595         DFG CFA may get overzealous in loops that have code that must exit
2596         https://bugs.webkit.org/show_bug.cgi?id=91188
2597
2598         Reviewed by Gavin Barraclough.
2599
2600         Ensure that if the CFA assumes that an operation must exit, then it will always exit
2601         no matter what happens after. That's necessary to preserve soundness.
2602
2603         Remove a broken fixup done by the DFG simplifier, where it was trying to say that the
2604         variable-at-head was the first access in the second block in the merge, if the first
2605         block did not read the variable. That's totally wrong, if the first block was in fact
2606         doing a phantom read. I removed that fixup and instead hardened the rest of the
2607         compiler.
2608
2609         * dfg/DFGAbstractState.cpp:
2610         (JSC::DFG::AbstractState::endBasicBlock):
2611         * dfg/DFGBasicBlock.h:
2612         (JSC::DFG::BasicBlock::BasicBlock):
2613         (BasicBlock):
2614         * dfg/DFGCFAPhase.cpp:
2615         (JSC::DFG::CFAPhase::performBlockCFA):
2616         * dfg/DFGCFGSimplificationPhase.cpp:
2617         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
2618         * dfg/DFGConstantFoldingPhase.cpp:
2619         (JSC::DFG::ConstantFoldingPhase::ConstantFoldingPhase):
2620         (JSC::DFG::ConstantFoldingPhase::run):
2621         (ConstantFoldingPhase):
2622         (JSC::DFG::ConstantFoldingPhase::foldConstants):
2623         (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
2624         * dfg/DFGVariableEventStream.cpp:
2625         (JSC::DFG::VariableEventStream::reconstruct):
2626
2627 2012-07-12  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
2628
2629         [Qt] Implement MemoryUsageSupport
2630         https://bugs.webkit.org/show_bug.cgi?id=91094
2631
2632         Reviewed by Adam Barth.
2633
2634         Compile in MemoryStatistics so we can make use of the interface.
2635
2636         * Target.pri:
2637
2638 2012-07-12  Csaba Osztrogonác  <ossy@webkit.org>
2639
2640         Remove dead code after r122392.
2641         https://bugs.webkit.org/show_bug.cgi?id=91049
2642
2643         Reviewed by Filip Pizlo.
2644
2645         * dfg/DFGSpeculativeJIT64.cpp:
2646         (JSC::DFG::SpeculativeJIT::emitCall):
2647
2648 2012-07-11  Adenilson Cavalcanti  <cavalcantii@gmail.com>
2649
2650         Build fix + remove dead code
2651         https://bugs.webkit.org/show_bug.cgi?id=91039
2652
2653         Reviewed by Filip Pizlo.
2654
2655         An unused variable was breaking compilation (thanks to warnings being treated as errors).
2656
2657         * dfg/DFGSpeculativeJIT32_64.cpp:
2658         (JSC::DFG::SpeculativeJIT::emitCall):
2659
2660 2012-07-11  Mark Rowe  <mrowe@apple.com>
2661
2662         <http://webkit.org/b/91024> Build against the latest SDK when targeting older OS X versions.
2663
2664         Reviewed by Dan Bernstein.
2665
2666         The deployment target is already set to the version that we're targeting, and it's that setting
2667         which determines which functionality from the SDK is available to us.
2668
2669         * Configurations/Base.xcconfig:
2670
2671 2012-07-11  Filip Pizlo  <fpizlo@apple.com>
2672
2673         DFG should have fast virtual calls
2674         https://bugs.webkit.org/show_bug.cgi?id=90924
2675
2676         Reviewed by Gavin Barraclough.
2677
2678         Implements virtual call support in the style of the old JIT, with the
2679         caveat that we still use the same slow path for both InternalFunction
2680         calls and JSFunction calls. Also rationalized the way that our
2681         CodeOrigin indices tie into exception checks (previously it was a
2682         strange one-to-one mapping with fairly limited assertions; now it's a
2683         one-to-many mapping for CodeOrigins to exception checks, respectively).
2684         I also took the opportunity to clean up
2685         CallLinkInfo::callReturnLocation, which previously was either a Call or
2686         a NearCall. Now it's just a NearCall. As well, exceptions during slow
2687         path call resolution are now handled by returning an exception throwing
2688         thunk rather than returning null. And finally, I made a few things
2689         public that were previously private-with-lots-of-friends, because I
2690         truly despise the thought of listing each thunk generating function as
2691         a friend of JSValue and friends.
2692
2693         * bytecode/CallLinkInfo.cpp:
2694         (JSC::CallLinkInfo::unlink):
2695         * bytecode/CallLinkInfo.h:
2696         (CallLinkInfo):
2697         * bytecode/CodeOrigin.h:
2698         (JSC::CodeOrigin::CodeOrigin):
2699         (JSC::CodeOrigin::isSet):
2700         * dfg/DFGAssemblyHelpers.h:
2701         (JSC::DFG::AssemblyHelpers::AssemblyHelpers):
2702         * dfg/DFGCCallHelpers.h:
2703         (JSC::DFG::CCallHelpers::CCallHelpers):
2704         * dfg/DFGGPRInfo.h:
2705         (GPRInfo):
2706         * dfg/DFGJITCompiler.cpp:
2707         (JSC::DFG::JITCompiler::link):
2708         (JSC::DFG::JITCompiler::compileFunction):
2709         * dfg/DFGJITCompiler.h:
2710         (JSC::DFG::CallBeginToken::CallBeginToken):
2711         (JSC::DFG::CallBeginToken::~CallBeginToken):
2712         (CallBeginToken):
2713         (JSC::DFG::CallBeginToken::set):
2714         (JSC::DFG::CallBeginToken::registerWithExceptionCheck):
2715         (JSC::DFG::CallBeginToken::codeOrigin):
2716         (JSC::DFG::CallExceptionRecord::CallExceptionRecord):
2717         (CallExceptionRecord):
2718         (JSC::DFG::JITCompiler::currentCodeOriginIndex):
2719         (JITCompiler):
2720         (JSC::DFG::JITCompiler::beginCall):
2721         (JSC::DFG::JITCompiler::notifyCall):
2722         (JSC::DFG::JITCompiler::prepareForExceptionCheck):
2723         (JSC::DFG::JITCompiler::addExceptionCheck):
2724         (JSC::DFG::JITCompiler::addFastExceptionCheck):
2725         * dfg/DFGOperations.cpp:
2726         * dfg/DFGRepatch.cpp:
2727         (JSC::DFG::dfgLinkFor):
2728         * dfg/DFGSpeculativeJIT.h:
2729         (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
2730         * dfg/DFGSpeculativeJIT32_64.cpp:
2731         (JSC::DFG::SpeculativeJIT::emitCall):
2732         * dfg/DFGSpeculativeJIT64.cpp:
2733         (JSC::DFG::SpeculativeJIT::emitCall):
2734         * dfg/DFGThunks.cpp:
2735         (JSC::DFG::emitPointerValidation):
2736         (DFG):
2737         (JSC::DFG::throwExceptionFromCallSlowPathGenerator):
2738         (JSC::DFG::slowPathFor):
2739         (JSC::DFG::linkForThunkGenerator):
2740         (JSC::DFG::linkCallThunkGenerator):
2741         (JSC::DFG::linkConstructThunkGenerator):
2742         (JSC::DFG::virtualForThunkGenerator):
2743         (JSC::DFG::virtualCallThunkGenerator):
2744         (JSC::DFG::virtualConstructThunkGenerator):
2745         * dfg/DFGThunks.h:
2746         (DFG):
2747         * jit/JIT.cpp:
2748         (JSC::JIT::privateCompile):
2749         (JSC::JIT::linkFor):
2750         * runtime/Executable.h:
2751         (ExecutableBase):
2752         (JSC::ExecutableBase::offsetOfJITCodeFor):
2753         (JSC::ExecutableBase::offsetOfNumParametersFor):
2754         * runtime/JSValue.h:
2755         (JSValue):
2756
2757 2012-07-11  Filip Pizlo  <fpizlo@apple.com>
2758
2759         Accidentally used the wrong license (3-clause instead of 2-clause) in some
2760         files I just committed.
2761
2762         Rubber stamped by Oliver Hunt.
2763
2764         * bytecode/Watchpoint.cpp:
2765         * bytecode/Watchpoint.h:
2766         * jit/JumpReplacementWatchpoint.cpp:
2767         * jit/JumpReplacementWatchpoint.h:
2768
2769 2012-07-11  Filip Pizlo  <fpizlo@apple.com>
2770
2771         Watchpoints and jump replacement should be decoupled
2772         https://bugs.webkit.org/show_bug.cgi?id=91016
2773
2774         Reviewed by Oliver Hunt.
2775
2776         * CMakeLists.txt:
2777         * GNUmakefile.list.am:
2778         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2779         * JavaScriptCore.xcodeproj/project.pbxproj:
2780         * Target.pri:
2781         * assembler/AbstractMacroAssembler.h:
2782         (JSC):
2783         (Label):
2784         * bytecode/CodeBlock.h:
2785         (JSC::CodeBlock::appendWatchpoint):
2786         (JSC::CodeBlock::watchpoint):
2787         (DFGData):
2788         * bytecode/Watchpoint.cpp:
2789         (JSC):
2790         * bytecode/Watchpoint.h:
2791         (JSC::Watchpoint::Watchpoint):
2792         (Watchpoint):
2793         (JSC::Watchpoint::fire):
2794         * dfg/DFGSpeculativeJIT.h:
2795         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
2796         * jit/JumpReplacementWatchpoint.cpp: Added.
2797         (JSC):
2798         (JSC::JumpReplacementWatchpoint::correctLabels):
2799         (JSC::JumpReplacementWatchpoint::fireInternal):
2800         * jit/JumpReplacementWatchpoint.h: Added.
2801         (JSC):
2802         (JumpReplacementWatchpoint):
2803         (JSC::JumpReplacementWatchpoint::JumpReplacementWatchpoint):
2804         (JSC::JumpReplacementWatchpoint::setDestination):
2805
2806 2012-07-11  Kevin Ollivier  <kevino@theolliviers.com>
2807
2808         [wx] Unreviewed build fix. Don't try to build udis86_itab.c since it's included by
2809         another file.
2810
2811         * wscript:
2812
2813 2012-07-11  Chao-ying Fu  <fu@mips.com>
2814
2815         Add MIPS convertibleLoadPtr and other functions
2816         https://bugs.webkit.org/show_bug.cgi?id=90714
2817
2818         Reviewed by Oliver Hunt.
2819
2820         * assembler/MIPSAssembler.h:
2821         (JSC::MIPSAssembler::labelIgnoringWatchpoints):
2822         (MIPSAssembler):
2823         (JSC::MIPSAssembler::replaceWithLoad):
2824         (JSC::MIPSAssembler::replaceWithAddressComputation):
2825         * assembler/MacroAssemblerMIPS.h:
2826         (JSC::MacroAssemblerMIPS::convertibleLoadPtr):
2827         (MacroAssemblerMIPS):
2828
2829 2012-07-11  Anders Carlsson  <andersca@apple.com>
2830
2831         Add -Wtautological-compare and -Wsign-compare warning flags
2832         https://bugs.webkit.org/show_bug.cgi?id=90994
2833
2834         Reviewed by Mark Rowe.
2835
2836         * Configurations/Base.xcconfig:
2837
2838 2012-07-11  Benjamin Poulain  <bpoulain@apple.com>
2839
2840         Simplify the copying of JSC ARMv7's LinkRecord
2841         https://bugs.webkit.org/show_bug.cgi?id=90930
2842
2843         Reviewed by Filip Pizlo.
2844
2845         The class LinkRecord is used by value everywhere in ARMv7Assembler. The compiler uses
2846         memmove() to move the objects.
2847
2848         The problem is memmove() is overkill for this object, moving the value can be done with
2849         3 load-store. This patch adds an operator= to the class doing more efficient copying.
2850         This reduces the link time by 19%.
2851
2852         * assembler/ARMv7Assembler.h:
2853         (JSC::ARMv7Assembler::LinkRecord::LinkRecord):
2854         (JSC::ARMv7Assembler::LinkRecord::operator=):
2855         (JSC::ARMv7Assembler::LinkRecord::from):
2856         (JSC::ARMv7Assembler::LinkRecord::setFrom):
2857         (JSC::ARMv7Assembler::LinkRecord::to):
2858         (JSC::ARMv7Assembler::LinkRecord::type):
2859         (JSC::ARMv7Assembler::LinkRecord::linkType):
2860         (JSC::ARMv7Assembler::LinkRecord::setLinkType):
2861         (JSC::ARMv7Assembler::LinkRecord::condition):
2862
2863 2012-07-11  Andy Wingo  <wingo@igalia.com>
2864
2865         jsc: Parse options before creating global data
2866         https://bugs.webkit.org/show_bug.cgi?id=90975
2867
2868         Reviewed by Filip Pizlo.
2869
2870         This patch moves the options parsing in "jsc" before the creation
2871         of the JSGlobalData, so that --useJIT=no has a chance to take
2872         effect.
2873
2874         * jsc.cpp:
2875         (CommandLine::parseArguments): Refactor to be a class, and take
2876         argc and argv as constructor arguments.
2877         (jscmain): Move arg parsing before JSGlobalData creation.
2878
2879 2012-07-10  Filip Pizlo  <fpizlo@apple.com>
2880
2881         REGRESSION(r122166): It made 170 tests crash on 32 bit platforms
2882         https://bugs.webkit.org/show_bug.cgi?id=90852
2883
2884         Reviewed by Zoltan Herczeg.
2885
2886         If we can't use the range filter, we should still make sure that the
2887         address is remotely sane, otherwise the hashtables will assert.
2888
2889         * jit/JITStubRoutine.h:
2890         (JSC::JITStubRoutine::passesFilter):
2891
2892 2012-07-10  Filip Pizlo  <fpizlo@apple.com>
2893
2894         DFG recompilation heuristics should be based on count, not rate
2895         https://bugs.webkit.org/show_bug.cgi?id=90146
2896
2897         Reviewed by Oliver Hunt.
2898
2899         Rolling r121511 back in after fixing the DFG's interpretation of op_div
2900         profiling, with Gavin's rubber stamp.
2901
2902         This removes a bunch of code that was previously trying to prevent spurious
2903         reoptimizations if a large enough majority of executions of a code block did
2904         not result in OSR exit. It turns out that this code was purely harmful. This
2905         patch removes all of that logic and replaces it with a dead-simple
2906         heuristic: if you exit more than N times (where N is an exponential function
2907         of the number of times the code block has already been recompiled) then we
2908         will recompile.
2909
2910         This appears to be a broad ~1% win on many benchmarks large and small.
2911
2912         * bytecode/CodeBlock.cpp:
2913         (JSC::CodeBlock::CodeBlock):
2914         * bytecode/CodeBlock.h:
2915         (JSC::CodeBlock::couldTakeSpecialFastCase):
2916         (CodeBlock):
2917         (JSC::CodeBlock::osrExitCounter):
2918         (JSC::CodeBlock::countOSRExit):
2919         (JSC::CodeBlock::addressOfOSRExitCounter):
2920         (JSC::CodeBlock::offsetOfOSRExitCounter):
2921         (JSC::CodeBlock::adjustedExitCountThreshold):
2922         (JSC::CodeBlock::exitCountThresholdForReoptimization):
2923         (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
2924         (JSC::CodeBlock::shouldReoptimizeNow):
2925         (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
2926         * bytecode/ExecutionCounter.cpp:
2927         (JSC::ExecutionCounter::setThreshold):
2928         * bytecode/ExecutionCounter.h:
2929         (ExecutionCounter):
2930         (JSC::ExecutionCounter::clippedThreshold):
2931         * dfg/DFGByteCodeParser.cpp:
2932         (JSC::DFG::ByteCodeParser::makeDivSafe):
2933         * dfg/DFGJITCompiler.cpp:
2934         (JSC::DFG::JITCompiler::compileBody):
2935         * dfg/DFGOSRExit.cpp:
2936         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
2937         * dfg/DFGOSRExitCompiler.cpp:
2938         (JSC::DFG::OSRExitCompiler::handleExitCounts):
2939         * dfg/DFGOperations.cpp:
2940         * jit/JITStubs.cpp:
2941         (JSC::DEFINE_STUB_FUNCTION):
2942         * runtime/Options.h:
2943         (JSC):
2944
2945 2012-07-09  Matt Falkenhagen  <falken@chromium.org>
2946
2947         Add ENABLE_DIALOG_ELEMENT and skeleton files
2948         https://bugs.webkit.org/show_bug.cgi?id=90521
2949
2950         Reviewed by Kent Tamura.
2951
2952         * Configurations/FeatureDefines.xcconfig:
2953
2954 2012-07-09  Filip Pizlo  <fpizlo@apple.com>
2955
2956         Unreviewed, roll out http://trac.webkit.org/changeset/121511
2957         It made in-browser V8v7 10% slower.
2958
2959         * bytecode/CodeBlock.cpp:
2960         (JSC::CodeBlock::CodeBlock):
2961         * bytecode/CodeBlock.h:
2962         (CodeBlock):
2963         (JSC::CodeBlock::countSpeculationSuccess):
2964         (JSC::CodeBlock::countSpeculationFailure):
2965         (JSC::CodeBlock::speculativeSuccessCounter):
2966         (JSC::CodeBlock::speculativeFailCounter):
2967         (JSC::CodeBlock::forcedOSRExitCounter):
2968         (JSC::CodeBlock::addressOfSpeculativeSuccessCounter):
2969         (JSC::CodeBlock::addressOfSpeculativeFailCounter):
2970         (JSC::CodeBlock::addressOfForcedOSRExitCounter):
2971         (JSC::CodeBlock::offsetOfSpeculativeSuccessCounter):
2972         (JSC::CodeBlock::offsetOfSpeculativeFailCounter):
2973         (JSC::CodeBlock::offsetOfForcedOSRExitCounter):
2974         (JSC::CodeBlock::largeFailCountThreshold):
2975         (JSC::CodeBlock::largeFailCountThresholdForLoop):
2976         (JSC::CodeBlock::shouldReoptimizeNow):
2977         (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
2978         * bytecode/ExecutionCounter.cpp:
2979         (JSC::ExecutionCounter::setThreshold):
2980         * bytecode/ExecutionCounter.h:
2981         (ExecutionCounter):
2982         * dfg/DFGJITCompiler.cpp:
2983         (JSC::DFG::JITCompiler::compileBody):
2984         * dfg/DFGOSRExit.cpp:
2985         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
2986         * dfg/DFGOSRExitCompiler.cpp:
2987         (JSC::DFG::OSRExitCompiler::handleExitCounts):
2988         * dfg/DFGOperations.cpp:
2989         * jit/JITStubs.cpp:
2990         (JSC::DEFINE_STUB_FUNCTION):
2991         * runtime/Options.h:
2992         (JSC):
2993
2994 2012-07-09  Filip Pizlo  <fpizlo@apple.com>
2995
2996         DFG may get stuck in an infinite fix point if it constant folds a mispredicted node
2997         https://bugs.webkit.org/show_bug.cgi?id=90829
2998         <rdar://problem/11823843>
2999
3000         Reviewed by Oliver Hunt.
3001
3002         If a node is shown to have been mispredicted during CFA, then don't allow constant
3003         folding to make the graph even more degenerate. Instead, pull back on constant folding
3004         and allow the normal OSR machinery to fix our profiling so that a future recompilation
3005         doesn't see the same mistake.
3006
3007         * dfg/DFGAbstractState.cpp:
3008         (JSC::DFG::AbstractState::execute):
3009         * dfg/DFGAbstractState.h:
3010         (JSC::DFG::AbstractState::trySetConstant):
3011         (AbstractState):
3012         * dfg/DFGPhase.h:
3013         (JSC::DFG::Phase::name):
3014         (Phase):
3015         (JSC::DFG::runAndLog):
3016         (DFG):
3017         (JSC::DFG::runPhase):
3018
3019 2012-07-09  Filip Pizlo  <fpizlo@apple.com>
3020
3021         It should be possible to jettison JIT stub routines even if they are currently running
3022         https://bugs.webkit.org/show_bug.cgi?id=90731
3023
3024         Reviewed by Gavin Barraclough.
3025
3026         This gives the GC awareness of all JIT-generated stubs for inline caches. That
3027         means that if you want to delete a JIT-generated stub, you don't have to worry
3028         about whether or not it is currently running: if there is a chance that it might
3029         be, the GC will kindly defer deletion until non-running-ness is proved.
3030
3031         * CMakeLists.txt:
3032         * GNUmakefile.list.am:
3033         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3034         * JavaScriptCore.xcodeproj/project.pbxproj:
3035         * Target.pri:
3036         * bytecode/Instruction.h:
3037         (JSC):
3038         (PolymorphicStubInfo):
3039         (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
3040         (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
3041         * bytecode/PolymorphicPutByIdList.cpp:
3042         (JSC::PutByIdAccess::fromStructureStubInfo):
3043         * bytecode/PolymorphicPutByIdList.h:
3044         (JSC::PutByIdAccess::transition):
3045         (JSC::PutByIdAccess::replace):
3046         (JSC::PutByIdAccess::stubRoutine):
3047         (PutByIdAccess):
3048         (JSC::PolymorphicPutByIdList::currentSlowPathTarget):
3049         * bytecode/StructureStubInfo.h:
3050         (JSC::StructureStubInfo::reset):
3051         * dfg/DFGRepatch.cpp:
3052         (JSC::DFG::generateProtoChainAccessStub):
3053         (JSC::DFG::tryCacheGetByID):
3054         (JSC::DFG::tryBuildGetByIDList):
3055         (JSC::DFG::tryBuildGetByIDProtoList):
3056         (JSC::DFG::emitPutReplaceStub):
3057         (JSC::DFG::emitPutTransitionStub):
3058         (JSC::DFG::tryCachePutByID):
3059         (JSC::DFG::tryBuildPutByIdList):
3060         * heap/ConservativeRoots.cpp:
3061         (JSC):
3062         (DummyMarkHook):
3063         (JSC::DummyMarkHook::mark):
3064         (JSC::ConservativeRoots::add):
3065         (CompositeMarkHook):
3066         (JSC::CompositeMarkHook::CompositeMarkHook):
3067         (JSC::CompositeMarkHook::mark):
3068         * heap/ConservativeRoots.h:
3069         (JSC):
3070         (ConservativeRoots):
3071         * heap/Heap.cpp:
3072         (JSC::Heap::markRoots):
3073         (JSC::Heap::deleteUnmarkedCompiledCode):
3074         * heap/Heap.h:
3075         (JSC):
3076         (Heap):
3077         * heap/JITStubRoutineSet.cpp: Added.
3078         (JSC):
3079         (JSC::JITStubRoutineSet::JITStubRoutineSet):
3080         (JSC::JITStubRoutineSet::~JITStubRoutineSet):
3081         (JSC::JITStubRoutineSet::add):
3082         (JSC::JITStubRoutineSet::clearMarks):
3083         (JSC::JITStubRoutineSet::markSlow):
3084         (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
3085         (JSC::JITStubRoutineSet::traceMarkedStubRoutines):
3086         * heap/JITStubRoutineSet.h: Added.
3087         (JSC):
3088         (JITStubRoutineSet):
3089         (JSC::JITStubRoutineSet::mark):
3090         * heap/MachineStackMarker.h:
3091         (JSC):
3092         * interpreter/RegisterFile.cpp:
3093         (JSC::RegisterFile::gatherConservativeRoots):
3094         * interpreter/RegisterFile.h:
3095         (JSC):
3096         * jit/ExecutableAllocator.cpp:
3097         (JSC::DemandExecutableAllocator::DemandExecutableAllocator):
3098         * jit/ExecutableAllocator.h:
3099         (JSC):
3100         * jit/ExecutableAllocatorFixedVMPool.cpp:
3101         (JSC):
3102         (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
3103         * jit/GCAwareJITStubRoutine.cpp: Added.
3104         (JSC):
3105         (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
3106         (JSC::GCAwareJITStubRoutine::~GCAwareJITStubRoutine):
3107         (JSC::GCAwareJITStubRoutine::observeZeroRefCount):
3108         (JSC::GCAwareJITStubRoutine::deleteFromGC):
3109         (JSC::GCAwareJITStubRoutine::markRequiredObjectsInternal):
3110         (JSC::MarkingGCAwareJITStubRoutineWithOneObject::MarkingGCAwareJITStubRoutineWithOneObject):
3111         (JSC::MarkingGCAwareJITStubRoutineWithOneObject::~MarkingGCAwareJITStubRoutineWithOneObject):
3112         (JSC::MarkingGCAwareJITStubRoutineWithOneObject::markRequiredObjectsInternal):
3113         (JSC::createJITStubRoutine):
3114         * jit/GCAwareJITStubRoutine.h: Added.
3115         (JSC):
3116         (GCAwareJITStubRoutine):
3117         (JSC::GCAwareJITStubRoutine::markRequiredObjects):
3118         (MarkingGCAwareJITStubRoutineWithOneObject):
3119         * jit/JITPropertyAccess.cpp:
3120         (JSC::JIT::privateCompilePutByIdTransition):
3121         (JSC::JIT::privateCompilePatchGetArrayLength):
3122         (JSC::JIT::privateCompileGetByIdProto):
3123         (JSC::JIT::privateCompileGetByIdSelfList):
3124         (JSC::JIT::privateCompileGetByIdProtoList):
3125         (JSC::JIT::privateCompileGetByIdChainList):
3126         (JSC::JIT::privateCompileGetByIdChain):
3127         * jit/JITPropertyAccess32_64.cpp:
3128         (JSC::JIT::privateCompilePutByIdTransition):
3129         (JSC::JIT::privateCompilePatchGetArrayLength):
3130         (JSC::JIT::privateCompileGetByIdProto):
3131         (JSC::JIT::privateCompileGetByIdSelfList):
3132         (JSC::JIT::privateCompileGetByIdProtoList):
3133         (JSC::JIT::privateCompileGetByIdChainList):
3134         (JSC::JIT::privateCompileGetByIdChain):
3135         * jit/JITStubRoutine.cpp: Added.
3136         (JSC):
3137         (JSC::JITStubRoutine::~JITStubRoutine):
3138         (JSC::JITStubRoutine::observeZeroRefCount):
3139         * jit/JITStubRoutine.h: Added.
3140         (JSC):
3141         (JITStubRoutine):
3142         (JSC::JITStubRoutine::JITStubRoutine):
3143         (JSC::JITStubRoutine::createSelfManagedRoutine):
3144         (JSC::JITStubRoutine::code):
3145         (JSC::JITStubRoutine::asCodePtr):
3146         (JSC::JITStubRoutine::ref):
3147         (JSC::JITStubRoutine::deref):
3148         (JSC::JITStubRoutine::startAddress):
3149         (JSC::JITStubRoutine::endAddress):
3150         (JSC::JITStubRoutine::addressStep):
3151         (JSC::JITStubRoutine::canPerformRangeFilter):
3152         (JSC::JITStubRoutine::filteringStartAddress):
3153         (JSC::JITStubRoutine::filteringExtentSize):
3154         (JSC::JITStubRoutine::passesFilter):
3155         * jit/JITStubs.cpp:
3156         (JSC::DEFINE_STUB_FUNCTION):
3157         (JSC::getPolymorphicAccessStructureListSlot):
3158
3159 2012-07-09  Sheriff Bot  <webkit.review.bot@gmail.com>
3160
3161         Unreviewed, rolling out r122107.
3162         http://trac.webkit.org/changeset/122107
3163         https://bugs.webkit.org/show_bug.cgi?id=90794
3164
3165         Build failure on Mac debug bots (Requested by falken_ on
3166         #webkit).
3167
3168         * Configurations/FeatureDefines.xcconfig:
3169
3170 2012-07-09  Matt Falkenhagen  <falken@chromium.org>
3171
3172         Add ENABLE_DIALOG_ELEMENT and skeleton files
3173         https://bugs.webkit.org/show_bug.cgi?id=90521
3174
3175         Reviewed by Kent Tamura.
3176
3177         * Configurations/FeatureDefines.xcconfig:
3178
3179 2012-07-08  Ryosuke Niwa  <rniwa@webkit.org>
3180
3181         gcc build fix after r121925.
3182
3183         * runtime/JSObject.h:
3184         (JSC::JSFinalObject::finishCreation):
3185
3186 2012-07-08  Zoltan Herczeg  <zherczeg@webkit.org>
3187
3188         [Qt][ARM] Implementing missing macro assembler instructions after r121925
3189         https://bugs.webkit.org/show_bug.cgi?id=90657
3190
3191         Reviewed by Csaba Osztrogonác.
3192
3193         Implementing convertibleLoadPtr, replaceWithLoad and
3194         replaceWithAddressComputation.
3195
3196         * assembler/ARMAssembler.h:
3197         (JSC::ARMAssembler::replaceWithLoad):
3198         (ARMAssembler):
3199         (JSC::ARMAssembler::replaceWithAddressComputation):
3200         * assembler/MacroAssemblerARM.h:
3201         (JSC::MacroAssemblerARM::convertibleLoadPtr):
3202         (MacroAssemblerARM):
3203
3204 2012-07-06  Filip Pizlo  <fpizlo@apple.com>
3205
3206         WebKit Version 5.1.7 (6534.57.2, r121935): Double-click no longer works on OpenStreetMap
3207         https://bugs.webkit.org/show_bug.cgi?id=90703
3208
3209         Reviewed by Michael Saboff.
3210
3211         It turns out that in my object model refactoring, I managed to fix get_by_pname in all
3212         execution engines except 64-bit baseline JIT.
3213
3214         * jit/JITPropertyAccess.cpp:
3215         (JSC::JIT::emit_op_get_by_pname):
3216
3217 2012-07-06  Pravin D  <pravind.2k4@gmail.com>
3218
3219         Build Error on Qt Linux build
3220         https://bugs.webkit.org/show_bug.cgi?id=90699
3221
3222         Reviewed by Laszlo Gombos.
3223
3224         * parser/Parser.cpp:
3225         (JSC::::parseForStatement):
3226         Removed unused boolean variable as this was causing build error on Qt Linux.
3227
3228 2012-07-06  Nuno Lopes  <nlopes@apple.com>
3229
3230         Fix build with recent clang.
3231         https://bugs.webkit.org/show_bug.cgi?id=90634
3232
3233         Reviewed by Oliver Hunt.
3234
3235         * jit/SpecializedThunkJIT.h:
3236         (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
3237         (SpecializedThunkJIT):
3238         * jit/ThunkGenerators.cpp:
3239         (JSC::charCodeAtThunkGenerator):
3240         (JSC::charAtThunkGenerator):
3241         (JSC::fromCharCodeThunkGenerator):
3242         (JSC::sqrtThunkGenerator):
3243         (JSC::floorThunkGenerator):
3244         (JSC::ceilThunkGenerator):
3245         (JSC::roundThunkGenerator):
3246         (JSC::expThunkGenerator):
3247         (JSC::logThunkGenerator):
3248         (JSC::absThunkGenerator):
3249         (JSC::powThunkGenerator):
3250         * parser/ASTBuilder.h:
3251         (JSC::ASTBuilder::createAssignResolve):
3252         (JSC::ASTBuilder::createForLoop):
3253         (JSC::ASTBuilder::createForInLoop):
3254         (JSC::ASTBuilder::makeAssignNode):
3255         (JSC::ASTBuilder::makePrefixNode):
3256         (JSC::ASTBuilder::makePostfixNode):
3257         * parser/NodeConstructors.h:
3258         (JSC::PostfixErrorNode::PostfixErrorNode):
3259         (JSC::PrefixErrorNode::PrefixErrorNode):
3260         (JSC::AssignResolveNode::AssignResolveNode):
3261         (JSC::AssignErrorNode::AssignErrorNode):
3262         (JSC::ForNode::ForNode):
3263         (JSC::ForInNode::ForInNode):
3264         * parser/Nodes.h:
3265         (FunctionCallResolveNode):
3266         (PostfixErrorNode):
3267         (PrefixErrorNode):
3268         (ReadModifyResolveNode):
3269         (AssignResolveNode):
3270         (AssignErrorNode):
3271         (ForNode):
3272         (ForInNode):
3273         * parser/Parser.cpp:
3274         (JSC::::parseVarDeclarationList):
3275         (JSC::::parseForStatement):
3276         * parser/SyntaxChecker.h:
3277         (JSC::SyntaxChecker::createAssignResolve):
3278         (JSC::SyntaxChecker::createForLoop):
3279
3280 2012-07-06  Zoltan Herczeg  <zherczeg@webkit.org>
3281
3282         [Qt][ARM] REGRESSION(r121885): It broke 30 jsc tests, 500+ layout tests
3283         https://bugs.webkit.org/show_bug.cgi?id=90656
3284
3285         Reviewed by Csaba Osztrogonác.
3286
3287         Typo fixes.
3288
3289         * assembler/MacroAssemblerARM.cpp:
3290         (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
3291         Rename getOp2Byte() -> getOp2Half()
3292         * assembler/MacroAssemblerARMv7.h:
3293         (JSC::MacroAssemblerARMv7::convertibleLoadPtr):
3294         Add a necessary space.
3295         * jit/JITStubs.cpp:
3296         (JSC):
3297         Revert INLINE_ARM_FUNCTION macro.
3298
3299 2012-07-05  Filip Pizlo  <fpizlo@apple.com>
3300
3301         REGRESSION(r121925): It broke 5 sputnik tests on x86 platforms
3302         https://bugs.webkit.org/show_bug.cgi?id=90658
3303
3304         Reviewed by Zoltan Herczeg.
3305
3306         Under the new object model, out-of-line property accesses such as those
3307         in ResolveGlobal must account for the fact that the offset to the Kth
3308         property is represented by K + inlineStorageCapacity. Hence, the property
3309         loads in ResolveGlobal must have an additional -inlineStorageCapacity *
3310         sizeof(JSValue) offset.
3311
3312         * dfg/DFGSpeculativeJIT32_64.cpp:
3313         (JSC::DFG::SpeculativeJIT::compile):
3314
3315 2012-07-05  Csaba Osztrogonác  <ossy@webkit.org>
3316
3317         [Qt] Unreviewed 64 bit buildfix after r121925.
3318
3319         * bytecode/PutByIdStatus.cpp:
3320         (JSC::PutByIdStatus::computeFromLLInt):
3321
3322 2012-07-05  Michael Saboff  <msaboff@apple.com>
3323
3324         JSString::tryHashConstLock() fails to get exclusive lock
3325         https://bugs.webkit.org/show_bug.cgi?id=90639
3326
3327         Reviewed by Oliver Hunt.
3328
3329         Added check that the string is already locked even before compare and swap.
3330
3331         * heap/MarkStack.cpp:
3332         (JSC::JSString::tryHashConstLock):
3333
3334 2012-07-04  Filip Pizlo  <fpizlo@apple.com>
3335
3336         Inline property storage should not be wasted when it is exhausted
3337         https://bugs.webkit.org/show_bug.cgi?id=90347
3338
3339         Reviewed by Gavin Barraclough.
3340
3341         Previously, if we switched an object from using inline storage to out-of-line
3342         storage, we would abandon the inline storage. This would have two main implications:
3343         (i) all accesses to the object, even for properties that were previously in inline
3344         storage, must now take an extra indirection; and (ii) we waste a non-trivial amount
3345         of space since we must allocate additional out-of-line storage to hold properties
3346         that would have fit in the inline storage. There's also the copying cost when
3347         switching to out-of-line storage - we must copy all inline properties into ouf-of-line
3348         storage.
3349
3350         This patch changes the way that object property storage works so that we can use both
3351         inline and out-of-line storage concurrently. This is accomplished by introducing a
3352         new notion of property offset. This PropertyOffset is a 32-bit signed integer and it
3353         behaves as follows:
3354
3355         offset == -1: invalid offset, indicating a property that does not exist.
3356
3357         0 <= offset <= inlineStorageCapacity: offset into inline storage.
3358
3359         inlineStorageCapacity < offset: offset into out-of-line storage.
3360
3361         Because non-final objects don't have inline storage, the only valid PropertyOffsets
3362         for those objects' properties are -1 or > inlineStorageCapacity.
3363
3364         This now means that the decision to use inline or out-of-line storage for an access is
3365         made based on the offset, rather than the structure. It also means that any access
3366         where the offset is a variable must have an extra branch, unless the type of the
3367         object is also known (if it's known to be a non-final object then we can just assert
3368         that the offset is >= inlineStorageCapacity).
3369
3370         This looks like a big Kraken speed-up and a slight V8 speed-up.
3371
3372         * GNUmakefile.list.am:
3373         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3374         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3375         * JavaScriptCore.xcodeproj/project.pbxproj:
3376         * assembler/ARMv7Assembler.h:
3377         (ARMv7Assembler):
3378         (JSC::ARMv7Assembler::ldrWide8BitImmediate):
3379         (JSC::ARMv7Assembler::replaceWithLoad):
3380         (JSC::ARMv7Assembler::replaceWithAddressComputation):
3381         * assembler/AbstractMacroAssembler.h:
3382         (AbstractMacroAssembler):
3383         (ConvertibleLoadLabel):
3384         (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::ConvertibleLoadLabel):
3385         (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::isSet):
3386         (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints):
3387         (JSC::AbstractMacroAssembler::replaceWithLoad):
3388         (JSC::AbstractMacroAssembler::replaceWithAddressComputation):
3389         * assembler/CodeLocation.h:
3390         (JSC):
3391         (CodeLocationCommon):
3392         (CodeLocationConvertibleLoad):
3393         (JSC::CodeLocationConvertibleLoad::CodeLocationConvertibleLoad):
3394         (JSC::CodeLocationCommon::convertibleLoadAtOffset):
3395         * assembler/LinkBuffer.cpp:
3396         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
3397         * assembler/LinkBuffer.h:
3398         (LinkBuffer):
3399         (JSC::LinkBuffer::locationOf):
3400         * assembler/MacroAssemblerARMv7.h:
3401         (MacroAssemblerARMv7):
3402         (JSC::MacroAssemblerARMv7::convertibleLoadPtr):
3403         * assembler/MacroAssemblerX86.h:
3404         (JSC::MacroAssemblerX86::convertibleLoadPtr):
3405         (MacroAssemblerX86):
3406         * assembler/MacroAssemblerX86_64.h:
3407         (JSC::MacroAssemblerX86_64::convertibleLoadPtr):
3408         (MacroAssemblerX86_64):
3409         * assembler/RepatchBuffer.h:
3410         (RepatchBuffer):
3411         (JSC::RepatchBuffer::replaceWithLoad):
3412         (JSC::RepatchBuffer::replaceWithAddressComputation):
3413         (JSC::RepatchBuffer::setLoadInstructionIsActive):
3414         * assembler/X86Assembler.h:
3415         (JSC::X86Assembler::replaceWithLoad):
3416         (X86Assembler):
3417         (JSC::X86Assembler::replaceWithAddressComputation):
3418         * bytecode/CodeBlock.cpp:
3419         (JSC::CodeBlock::printGetByIdOp):
3420         (JSC::CodeBlock::dump):
3421         (JSC::CodeBlock::finalizeUnconditionally):
3422         * bytecode/GetByIdStatus.cpp:
3423         (JSC::GetByIdStatus::computeFromLLInt):
3424         (JSC::GetByIdStatus::computeForChain):
3425         (JSC::GetByIdStatus::computeFor):
3426         * bytecode/GetByIdStatus.h:
3427         (JSC::GetByIdStatus::GetByIdStatus):
3428         (JSC::GetByIdStatus::offset):
3429         (GetByIdStatus):
3430         * bytecode/Opcode.h:
3431         (JSC):
3432         (JSC::padOpcodeName):
3433         * bytecode/PutByIdStatus.cpp:
3434         (JSC::PutByIdStatus::computeFromLLInt):
3435         (JSC::PutByIdStatus::computeFor):
3436         * bytecode/PutByIdStatus.h:
3437         (JSC::PutByIdStatus::PutByIdStatus):
3438         (JSC::PutByIdStatus::offset):
3439         (PutByIdStatus):
3440         * bytecode/ResolveGlobalStatus.cpp:
3441         (JSC):
3442         (JSC::computeForStructure):
3443         * bytecode/ResolveGlobalStatus.h:
3444         (JSC::ResolveGlobalStatus::ResolveGlobalStatus):
3445         (JSC::ResolveGlobalStatus::offset):
3446         (ResolveGlobalStatus):
3447         * bytecode/StructureSet.h:
3448         (StructureSet):
3449         * bytecode/StructureStubInfo.h:
3450         * dfg/DFGByteCodeParser.cpp:
3451         (ByteCodeParser):
3452         (JSC::DFG::ByteCodeParser::handleGetByOffset):
3453         (JSC::DFG::ByteCodeParser::handleGetById):
3454         (JSC::DFG::ByteCodeParser::parseBlock):
3455         * dfg/DFGCapabilities.h:
3456         (JSC::DFG::canCompileOpcode):
3457         * dfg/DFGJITCompiler.cpp:
3458         (JSC::DFG::JITCompiler::link):
3459         * dfg/DFGJITCompiler.h:
3460         (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
3461         (PropertyAccessRecord):
3462         * dfg/DFGRepatch.cpp:
3463         (JSC::DFG::dfgRepatchByIdSelfAccess):
3464         (JSC::DFG::generateProtoChainAccessStub):
3465         (JSC::DFG::tryCacheGetByID):
3466         (JSC::DFG::tryBuildGetByIDList):
3467         (JSC::DFG::tryBuildGetByIDProtoList):
3468         (JSC::DFG::emitPutReplaceStub):
3469         (JSC::DFG::emitPutTransitionStub):
3470         (JSC::DFG::tryCachePutByID):
3471         (JSC::DFG::tryBuildPutByIdList):
3472         * dfg/DFGSpeculativeJIT.h:
3473         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
3474         * dfg/DFGSpeculativeJIT32_64.cpp:
3475         (JSC::DFG::SpeculativeJIT::cachedGetById):
3476         (JSC::DFG::SpeculativeJIT::cachedPutById):
3477         (JSC::DFG::SpeculativeJIT::compile):
3478         * dfg/DFGSpeculativeJIT64.cpp:
3479         (JSC::DFG::SpeculativeJIT::cachedGetById):
3480         (JSC::DFG::SpeculativeJIT::cachedPutById):
3481         (JSC::DFG::SpeculativeJIT::compile):
3482         * heap/MarkStack.cpp:
3483         (JSC::visitChildren):
3484         * interpreter/Interpreter.cpp:
3485         (JSC::Interpreter::tryCacheGetByID):
3486         (JSC::Interpreter::privateExecute):
3487         * jit/JIT.cpp:
3488         (JSC::JIT::privateCompileMainPass):
3489         (JSC::JIT::privateCompileSlowCases):
3490         (JSC::PropertyStubCompilationInfo::copyToStubInfo):
3491         * jit/JIT.h:
3492         (JSC::PropertyStubCompilationInfo::PropertyStubCompilationInfo):
3493         (JSC::JIT::compileGetByIdProto):
3494         (JSC::JIT::compileGetByIdSelfList):
3495         (JSC::JIT::compileGetByIdProtoList):
3496         (JSC::JIT::compileGetByIdChainList):
3497         (JSC::JIT::compileGetByIdChain):
3498         (JSC::JIT::compilePutByIdTransition):
3499         (JIT):
3500         * jit/JITInlineMethods.h:
3501         (JSC::JIT::emitAllocateBasicJSObject):
3502         * jit/JITOpcodes.cpp:
3503         (JSC::JIT::emit_op_resolve_global):
3504         * jit/JITOpcodes32_64.cpp:
3505         (JSC::JIT::emit_op_resolve_global):
3506         * jit/JITPropertyAccess.cpp:
3507         (JSC::JIT::compileGetDirectOffset):
3508         (JSC::JIT::emit_op_method_check):
3509         (JSC::JIT::compileGetByIdHotPath):
3510         (JSC::JIT::emit_op_put_by_id):
3511         (JSC::JIT::compilePutDirectOffset):
3512         (JSC::JIT::privateCompilePutByIdTransition):
3513         (JSC::JIT::patchGetByIdSelf):
3514         (JSC::JIT::patchPutByIdReplace):
3515         (JSC::JIT::privateCompileGetByIdProto):
3516         (JSC::JIT::privateCompileGetByIdSelfList):
3517         (JSC::JIT::privateCompileGetByIdProtoList):
3518         (JSC::JIT::privateCompileGetByIdChainList):
3519         (JSC::JIT::privateCompileGetByIdChain):
3520         * jit/JITPropertyAccess32_64.cpp:
3521         (JSC::JIT::emit_op_method_check):
3522         (JSC::JIT::compileGetByIdHotPath):
3523         (JSC::JIT::emit_op_put_by_id):
3524         (JSC::JIT::compilePutDirectOffset):
3525         (JSC::JIT::compileGetDirectOffset):
3526         (JSC::JIT::privateCompilePutByIdTransition):
3527         (JSC::JIT::patchGetByIdSelf):
3528         (JSC::JIT::patchPutByIdReplace):
3529         (JSC::JIT::privateCompileGetByIdProto):
3530         (JSC::JIT::privateCompileGetByIdSelfList):
3531         (JSC::JIT::privateCompileGetByIdProtoList):
3532         (JSC::JIT::privateCompileGetByIdChainList):
3533         (JSC::JIT::privateCompileGetByIdChain):
3534         (JSC::JIT::emit_op_get_by_pname):
3535         * jit/JITStubs.cpp:
3536         (JSC::JITThunks::tryCacheGetByID):
3537         (JSC::DEFINE_STUB_FUNCTION):
3538         * llint/LLIntSlowPaths.cpp:
3539         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3540         * llint/LowLevelInterpreter.asm:
3541         * llint/LowLevelInterpreter32_64.asm:
3542         * llint/LowLevelInterpreter64.asm:
3543         * offlineasm/x86.rb:
3544         * runtime/JSGlobalObject.h:
3545         (JSGlobalObject):
3546         (JSC::JSGlobalObject::functionNameOffset):
3547         * runtime/JSObject.cpp:
3548         (JSC::JSObject::visitChildren):
3549         (JSC):
3550         (JSC::JSFinalObject::visitChildren):
3551         (JSC::JSObject::put):
3552         (JSC::JSObject::deleteProperty):
3553         (JSC::JSObject::getPropertySpecificValue):
3554         (JSC::JSObject::removeDirect):
3555         (JSC::JSObject::growOutOfLineStorage):
3556         (JSC::JSObject::getOwnPropertyDescriptor):
3557         * runtime/JSObject.h:
3558         (JSObject):
3559         (JSC::JSObject::getDirect):
3560         (JSC::JSObject::getDirectLocation):
3561         (JSC::JSObject::hasInlineStorage):
3562         (JSC::JSObject::inlineStorageUnsafe):
3563         (JSC::JSObject::inlineStorage):
3564         (JSC::JSObject::outOfLineStorage):
3565         (JSC::JSObject::locationForOffset):
3566         (JSC::JSObject::offsetForLocation):
3567         (JSC::JSObject::getDirectOffset):
3568         (JSC::JSObject::putDirectOffset):
3569         (JSC::JSObject::putUndefinedAtDirectOffset):
3570         (JSC::JSObject::addressOfOutOfLineStorage):
3571         (JSC::JSObject::finishCreation):
3572         (JSC::JSNonFinalObject::JSNonFinalObject):
3573         (JSC::JSNonFinalObject::finishCreation):
3574         (JSFinalObject):
3575         (JSC::JSFinalObject::finishCreation):
3576         (JSC::JSFinalObject::JSFinalObject):
3577         (JSC::JSObject::offsetOfOutOfLineStorage):
3578         (JSC::JSObject::setOutOfLineStorage):
3579         (JSC::JSObject::JSObject):
3580         (JSC):
3581         (JSC::JSCell::fastGetOwnProperty):
3582         (JSC::JSObject::putDirectInternal):
3583         (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
3584         (JSC::JSObject::putDirectWithoutTransition):
3585         (JSC::offsetRelativeToPatchedStorage):
3586         (JSC::indexRelativeToBase):
3587         (JSC::offsetRelativeToBase):
3588         * runtime/JSPropertyNameIterator.cpp:
3589         (JSC::JSPropertyNameIterator::create):
3590         * runtime/JSPropertyNameIterator.h:
3591         (JSPropertyNameIterator):
3592         (JSC::JSPropertyNameIterator::getOffset):
3593         (JSC::JSPropertyNameIterator::finishCreation):
3594         * runtime/JSValue.cpp:
3595         (JSC::JSValue::putToPrimitive):
3596         * runtime/Operations.h:
3597         (JSC::normalizePrototypeChain):
3598         * runtime/Options.cpp:
3599         (JSC):
3600         (JSC::Options::initialize):
3601         * runtime/PropertyMapHashTable.h:
3602         (PropertyMapEntry):
3603         (JSC::PropertyMapEntry::PropertyMapEntry):
3604         (PropertyTable):
3605         (JSC::PropertyTable::PropertyTable):
3606         (JSC::PropertyTable::getDeletedOffset):
3607         (JSC::PropertyTable::addDeletedOffset):
3608         (JSC::PropertyTable::nextOffset):
3609         (JSC):
3610         (JSC::PropertyTable::sizeInMemory):
3611         * runtime/PropertyOffset.h: Added.
3612         (JSC):
3613         (JSC::checkOffset):
3614         (JSC::validateOffset):
3615         (JSC::isValidOffset):
3616         (JSC::isInlineOffset):
3617         (JSC::isOutOfLineOffset):
3618         (JSC::offsetInInlineStorage):
3619         (JSC::offsetInOutOfLineStorage):
3620         (JSC::offsetInRespectiveStorage):
3621         (JSC::numberOfOutOfLineSlotsForLastOffset):
3622         (JSC::numberOfSlotsForLastOffset):
3623         (JSC::nextPropertyOffsetFor):
3624         (JSC::firstPropertyOffsetFor):
3625         * runtime/PropertySlot.h:
3626         (JSC::PropertySlot::cachedOffset):
3627         (JSC::PropertySlot::setValue):
3628         (JSC::PropertySlot::setCacheableGetterSlot):
3629         (JSC::PropertySlot::clearOffset):
3630         * runtime/PutPropertySlot.h:
3631         (JSC::PutPropertySlot::setExistingProperty):
3632         (JSC::PutPropertySlot::setNewProperty):
3633         (JSC::PutPropertySlot::cachedOffset):
3634         (PutPropertySlot):
3635         * runtime/Structure.cpp:
3636         (JSC::Structure::Structure):
3637         (JSC::Structure::materializePropertyMap):
3638         (JSC::nextOutOfLineStorageCapacity):
3639         (JSC::Structure::growOutOfLineCapacity):
3640         (JSC::Structure::suggestedNewOutOfLineStorageCapacity):
3641         (JSC::Structure::addPropertyTransitionToExistingStructure):
3642         (JSC::Structure::addPropertyTransition):
3643         (JSC::Structure::removePropertyTransition):
3644         (JSC::Structure::flattenDictionaryStructure):
3645         (JSC::Structure::addPropertyWithoutTransition):
3646         (JSC::Structure::removePropertyWithoutTransition):
3647         (JSC::Structure::copyPropertyTableForPinning):
3648         (JSC::Structure::get):
3649         (JSC::Structure::putSpecificValue):
3650         (JSC::Structure::remove):
3651         * runtime/Structure.h:
3652         (Structure):
3653         (JSC::Structure::putWillGrowOutOfLineStorage):
3654         (JSC::Structure::previousID):
3655         (JSC::Structure::outOfLineCapacity):
3656         (JSC::Structure::outOfLineSizeForKnownFinalObject):
3657         (JSC::Structure::outOfLineSizeForKnownNonFinalObject):
3658         (JSC::Structure::outOfLineSize):
3659         (JSC::Structure::hasInlineStorage):
3660         (JSC::Structure::inlineCapacity):
3661         (JSC::Structure::inlineSizeForKnownFinalObject):
3662         (JSC::Structure::inlineSize):
3663         (JSC::Structure::totalStorageSize):
3664         (JSC::Structure::totalStorageCapacity):
3665         (JSC::Structure::firstValidOffset):
3666         (JSC::Structure::lastValidOffset):
3667         (JSC::Structure::isValidOffset):
3668         (JSC::Structure::isEmpty):
3669         (JSC::Structure::transitionCount):
3670         (JSC::Structure::get):
3671
3672 2012-07-05  Oliver Hunt  <oliver@apple.com>
3673
3674         JSObjectCallAsFunction should thisConvert the provided thisObject
3675         https://bugs.webkit.org/show_bug.cgi?id=90628
3676
3677         Reviewed by Gavin Barraclough.
3678
3679         Perform this conversion on the provided this object.
3680
3681         * API/JSObjectRef.cpp:
3682         (JSObjectCallAsFunction):
3683
3684 2012-07-05  Zoltan Herczeg  <zherczeg@webkit.org>
3685
3686         [Qt] Unreviewed buildfix after r121886. Typo fix.
3687
3688         * assembler/MacroAssemblerARM.cpp:
3689         (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
3690
3691 2012-07-05  Zoltan Herczeg  <zherczeg@webkit.org>
3692
3693         Port DFG JIT to traditional ARM
3694         https://bugs.webkit.org/show_bug.cgi?id=90198
3695
3696         Reviewed by Filip Pizlo.
3697
3698         This patch contains the macro assembler part of the
3699         DFG JIT support on ARM systems with fixed 32 bit instruction
3700         width. A large amount of old code was refactored, and the ARMv4
3701         or lower support is removed from the macro assembler.
3702
3703         Sunspider is improved by 8%, and V8 is 92%.
3704
3705         * assembler/ARMAssembler.cpp:
3706         (JSC::ARMAssembler::dataTransfer32):
3707         (JSC::ARMAssembler::baseIndexTransfer32):
3708         (JSC):
3709         (JSC::ARMAssembler::dataTransfer16):
3710         (JSC::ARMAssembler::baseIndexTransfer16):
3711         (JSC::ARMAssembler::dataTransferFloat):
3712         (JSC::ARMAssembler::baseIndexTransferFloat):
3713         (JSC::ARMAssembler::executableCopy):
3714         * assembler/ARMAssembler.h:
3715         (JSC::ARMAssembler::ARMAssembler):
3716         (JSC::ARMAssembler::emitInst):
3717         (JSC::ARMAssembler::vmov_f64_r):
3718         (ARMAssembler):
3719         (JSC::ARMAssembler::vabs_f64_r):
3720         (JSC::ARMAssembler::vneg_f64_r):
3721         (JSC::ARMAssembler::ldr_imm):
3722         (JSC::ARMAssembler::ldr_un_imm):
3723         (JSC::ARMAssembler::dtr_u):
3724         (JSC::ARMAssembler::dtr_ur):
3725         (JSC::ARMAssembler::dtr_d):
3726         (JSC::ARMAssembler::dtr_dr):
3727         (JSC::ARMAssembler::dtrh_u):
3728         (JSC::ARMAssembler::dtrh_ur):
3729         (JSC::ARMAssembler::dtrh_d):
3730         (JSC::ARMAssembler::dtrh_dr):
3731         (JSC::ARMAssembler::fdtr_u):
3732         (JSC::ARMAssembler::fdtr_d):
3733         (JSC::ARMAssembler::push_r):
3734         (JSC::ARMAssembler::pop_r):
3735         (JSC::ARMAssembler::poke_r):
3736         (JSC::ARMAssembler::peek_r):
3737         (JSC::ARMAssembler::vmov_vfp64_r):
3738         (JSC::ARMAssembler::vmov_arm64_r):
3739         (JSC::ARMAssembler::vmov_vfp32_r):
3740         (JSC::ARMAssembler::vmov_arm32_r):
3741         (JSC::ARMAssembler::vcvt_u32_f64_r):
3742         (JSC::ARMAssembler::vcvt_f64_f32_r):
3743         (JSC::ARMAssembler::vcvt_f32_f64_r):
3744         (JSC::ARMAssembler::clz_r):
3745         (JSC::ARMAssembler::bkpt):
3746         (JSC::ARMAssembler::bx):
3747         (JSC::ARMAssembler::blx):
3748         (JSC::ARMAssembler::labelIgnoringWatchpoints):
3749         (JSC::ARMAssembler::labelForWatchpoint):
3750         (JSC::ARMAssembler::label):
3751         (JSC::ARMAssembler::getLdrImmAddress):
3752         (JSC::ARMAssembler::replaceWithJump):
3753         (JSC::ARMAssembler::maxJumpReplacementSize):
3754         (JSC::ARMAssembler::getOp2Byte):
3755         (JSC::ARMAssembler::getOp2Half):
3756         (JSC::ARMAssembler::RM):
3757         (JSC::ARMAssembler::RS):
3758         (JSC::ARMAssembler::RD):
3759         (JSC::ARMAssembler::RN):
3760         * assembler/AssemblerBufferWithConstantPool.h:
3761         (JSC::AssemblerBufferWithConstantPool::ensureSpaceForAnyInstruction):
3762         * assembler/MacroAssemblerARM.cpp:
3763         (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
3764         * assembler/MacroAssemblerARM.h:
3765         (JSC::MacroAssemblerARM::add32):
3766         (MacroAssemblerARM):
3767         (JSC::MacroAssemblerARM::and32):
3768         (JSC::MacroAssemblerARM::lshift32):
3769         (JSC::MacroAssemblerARM::mul32):
3770         (JSC::MacroAssemblerARM::neg32):
3771         (JSC::MacroAssemblerARM::rshift32):
3772         (JSC::MacroAssemblerARM::urshift32):
3773         (JSC::MacroAssemblerARM::xor32):
3774         (JSC::MacroAssemblerARM::load8):
3775         (JSC::MacroAssemblerARM::load8Signed):
3776         (JSC::MacroAssemblerARM::load16):
3777         (JSC::MacroAssemblerARM::load16Signed):
3778         (JSC::MacroAssemblerARM::load32):
3779         (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch):
3780         (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch):
3781         (JSC::MacroAssemblerARM::store8):
3782         (JSC::MacroAssemblerARM::store16):
3783         (JSC::MacroAssemblerARM::store32):
3784         (JSC::MacroAssemblerARM::move):
3785         (JSC::MacroAssemblerARM::jump):
3786         (JSC::MacroAssemblerARM::branchAdd32):
3787         (JSC::MacroAssemblerARM::mull32):
3788         (JSC::MacroAssemblerARM::branchMul32):
3789         (JSC::MacroAssemblerARM::nearCall):
3790         (JSC::MacroAssemblerARM::compare32):
3791         (JSC::MacroAssemblerARM::test32):
3792         (JSC::MacroAssemblerARM::sub32):
3793         (JSC::MacroAssemblerARM::call):
3794         (JSC::MacroAssemblerARM::loadFloat):
3795         (JSC::MacroAssemblerARM::loadDouble):
3796         (JSC::MacroAssemblerARM::storeFloat):
3797         (JSC::MacroAssemblerARM::storeDouble):
3798         (JSC::MacroAssemblerARM::moveDouble):
3799         (JSC::MacroAssemblerARM::addDouble):
3800         (JSC::MacroAssemblerARM::divDouble):
3801         (JSC::MacroAssemblerARM::subDouble):
3802         (JSC::MacroAssemblerARM::mulDouble):
3803         (JSC::MacroAssemblerARM::absDouble):
3804         (JSC::MacroAssemblerARM::negateDouble):
3805         (JSC::MacroAssemblerARM::convertInt32ToDouble):
3806         (JSC::MacroAssemblerARM::convertFloatToDouble):
3807         (JSC::MacroAssemblerARM::convertDoubleToFloat):
3808         (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
3809         (JSC::MacroAssemblerARM::branchTruncateDoubleToUint32):
3810         (JSC::MacroAssemblerARM::truncateDoubleToInt32):
3811         (JSC::MacroAssemblerARM::truncateDoubleToUint32):
3812         (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
3813         (JSC::MacroAssemblerARM::branchDoubleNonZero):
3814         (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN):
3815         (JSC::MacroAssemblerARM::invert):
3816         (JSC::MacroAssemblerARM::replaceWithJump):
3817         (JSC::MacroAssemblerARM::maxJumpReplacementSize):
3818         (JSC::MacroAssemblerARM::call32):
3819         * assembler/SH4Assembler.h:
3820         (JSC::SH4Assembler::label):
3821         * dfg/DFGAssemblyHelpers.h:
3822         (JSC::DFG::AssemblyHelpers::debugCall):
3823         (JSC::DFG::AssemblyHelpers::boxDouble):
3824         (JSC::DFG::AssemblyHelpers::unboxDouble):
3825         * dfg/DFGCCallHelpers.h:
3826         (CCallHelpers):
3827         (JSC::DFG::CCallHelpers::setupArguments):
3828         * dfg/DFGFPRInfo.h:
3829         (DFG):
3830         * dfg/DFGGPRInfo.h:
3831         (DFG):
3832         (GPRInfo):
3833         * dfg/DFGOperations.cpp:
3834         (JSC):
3835         * dfg/DFGSpeculativeJIT.h:
3836         (SpeculativeJIT):
3837         (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult):
3838         (JSC::DFG::SpeculativeJIT::appendCallSetResult):
3839         * jit/JITStubs.cpp:
3840         (JSC):
3841         * jit/JITStubs.h:
3842         (JITStackFrame):
3843         * jit/JSInterfaceJIT.h:
3844         (JSInterfaceJIT):
3845
3846 2012-07-04  Anthony Scian  <ascian@rim.com>
3847
3848         Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
3849         https://bugs.webkit.org/show_bug.cgi?id=40118
3850
3851         Reviewed by Yong Li.
3852
3853         Added member functions to expose function name, urlString, and line #.
3854         Refactored toString to make use of these member functions to reduce
3855         duplicated code for future maintenance.
3856
3857         Manually tested refactoring of toString by tracing thrown exceptions.
3858
3859         * interpreter/Interpreter.h:
3860         (JSC::StackFrame::toString):
3861         (JSC::StackFrame::friendlySourceURL):
3862         (JSC::StackFrame::friendlyFunctionName):
3863         (JSC::StackFrame::friendlyLineNumber):
3864
3865 2012-07-04  Andy Wingo  <wingo@igalia.com>
3866
3867         [GTK] Enable parallel GC
3868         https://bugs.webkit.org/show_bug.cgi?id=90568
3869
3870         Reviewed by Martin Robinson.
3871
3872         * runtime/Options.cpp: Include <algorithm.h> for std::min.
3873
3874 2012-07-04  John Mellor  <johnme@chromium.org>
3875
3876         Text Autosizing: Add compile flag and runtime setting
3877         https://bugs.webkit.org/show_bug.cgi?id=87394
3878
3879         This patch renames Font Boosting to Text Autosizing.
3880
3881         Reviewed by Adam Barth.
3882
3883         * Configurations/FeatureDefines.xcconfig:
3884
3885 2012-07-03  Michael Saboff  <msaboff@apple.com>
3886
3887         Enh: Hash Const JSString in Backing Stores to Save Memory
3888         https://bugs.webkit.org/show_bug.cgi?id=86024
3889
3890         Reviewed by Oliver Hunt.
3891
3892         During garbage collection, each marking thread keeps a HashMap of
3893         strings.  While visiting via MarkStack::copyAndAppend(), we check to
3894         see if the string we are visiting is already in the HashMap.  If not
3895         we add it. If so, we change the reference to the current string we're
3896         visiting to the prior string.
3897
3898         To reduce the performance impact of this change, two throttles have
3899         ben added.  1) We only try hash consting if a significant number of new
3900         strings have been created since the last hash const.  Currently this is
3901         set at 100 strings.  2) If a string is unique at the end of a marking
3902         it will not be checked during further GC phases. In some cases this
3903         won't catch all duplicates, but we are trying to catch the growth of
3904         duplicate strings.
3905
3906         * heap/Heap.cpp:
3907         (JSC::Heap::markRoots):
3908         * heap/MarkStack.cpp:
3909         (JSC::MarkStackThreadSharedData::resetChildren):
3910         (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
3911         (JSC::MarkStackThreadSharedData::reset):
3912         (JSC::MarkStack::setup): Check to see if enough strings have been created
3913         to hash const.
3914         (JSC::MarkStack::reset): Added call to clear m_uniqueStrings.
3915         (JSC::JSString::tryHashConstLock): New method to lock JSString for
3916         hash consting.
3917         (JSC::JSString::releaseHashConstLock): New unlock method.
3918         (JSC::JSString::shouldTryHashConst): Set of checks to see if we should
3919         try to hash const the string.
3920         (JSC::MarkStack::internalAppend): New method that performs the hash consting.
3921         (JSC::SlotVisitor::copyAndAppend): Changed to call the new hash
3922         consting internalAppend().
3923         * heap/MarkStack.h:
3924         (MarkStackThreadSharedData):
3925         (MarkStack):
3926         * runtime/JSGlobalData.cpp:
3927         (JSC::JSGlobalData::JSGlobalData):
3928         * runtime/JSGlobalData.h:
3929         (JSGlobalData):
3930         (JSC::JSGlobalData::haveEnoughNewStringsToHashConst):
3931         (JSC::JSGlobalData::resetNewStringsSinceLastHashConst):
3932         * runtime/JSString.h:
3933         (JSString): Changed from using bool flags to using an unsigned
3934         m_flags field.  This works better with the weakCompareAndSwap in
3935         JSString::tryHashConstLock(). Changed the 8bitness setting and
3936         checking to use new accessors.
3937         (JSC::JSString::JSString):
3938         (JSC::JSString::finishCreation):
3939         (JSC::JSString::is8Bit): Updated for new m_flags.
3940         (JSC::JSString::setIs8Bit): New setter.
3941         New hash const flags accessors:
3942         (JSC::JSString::isHashConstSingleton):
3943         (JSC::JSString::clearHashConstSingleton):
3944         (JSC::JSString::setHashConstSingleton):
3945         (JSC::JSRopeString::finishCreation):
3946         (JSC::JSRopeString::append):
3947
3948 2012-07-03  Tony Chang  <tony@chromium.org>
3949
3950         [chromium] Unreviewed, update .gitignore to handle VS2010 files.
3951
3952         * JavaScriptCore.gyp/.gitignore:
3953
3954 2012-07-03  Mark Lam  <mark.lam@apple.com>
3955
3956         Add ability to symbolically set and dump JSC VM options.
3957         See comments in runtime/Options.h for details on how the options work.
3958         https://bugs.webkit.org/show_bug.cgi?id=90420
3959
3960         Reviewed by Filip Pizlo.
3961
3962         * assembler/LinkBuffer.cpp:
3963         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
3964         * assembler/LinkBuffer.h:
3965         (JSC):
3966         * bytecode/CodeBlock.cpp:
3967         (JSC::CodeBlock::shouldOptimizeNow):
3968         * bytecode/CodeBlock.h:
3969         (JSC::CodeBlock::likelyToTakeSlowCase):
3970         (JSC::CodeBlock::couldTakeSlowCase):
3971         (JSC::CodeBlock::likelyToTakeSpecialFastCase):
3972         (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
3973         (JSC::CodeBlock::likelyToTakeAnySlowCase):
3974         (JSC::CodeBlock::jitAfterWarmUp):
3975         (JSC::CodeBlock::jitSoon):
3976         (JSC::CodeBlock::reoptimizationRetryCounter):
3977         (JSC::CodeBlock::countReoptimization):
3978         (JSC::CodeBlock::counterValueForOptimizeAfterWarmUp):
3979         (JSC::CodeBlock::counterValueForOptimizeAfterLongWarmUp):
3980         (JSC::CodeBlock::optimizeSoon):
3981         (JSC::CodeBlock::exitCountThresholdForReoptimization):
3982         (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
3983         * bytecode/ExecutionCounter.h:
3984         (JSC::ExecutionCounter::clippedThreshold):
3985         * dfg/DFGByteCodeParser.cpp:
3986         (JSC::DFG::ByteCodeParser::handleInlining):
3987         * dfg/DFGCapabilities.h:
3988         (JSC::DFG::mightCompileEval):
3989         (JSC::DFG::mightCompileProgram):
3990         (JSC::DFG::mightCompileFunctionForCall):
3991         (JSC::DFG::mightCompileFunctionForConstruct):
3992         (JSC::DFG::mightInlineFunctionForCall):
3993         (JSC::DFG::mightInlineFunctionForConstruct):
3994         * dfg/DFGCommon.h:
3995         (JSC::DFG::shouldShowDisassembly):
3996         * dfg/DFGDriver.cpp:
3997         (JSC::DFG::compile):
3998         * dfg/DFGOSRExit.cpp:
3999         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
4000         * dfg/DFGVariableAccessData.h:
4001         (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
4002         * heap/MarkStack.cpp:
4003         (JSC::MarkStackSegmentAllocator::allocate):
4004         (JSC::MarkStackSegmentAllocator::shrinkReserve):
4005         (JSC::MarkStackArray::MarkStackArray):
4006         (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
4007         (JSC::SlotVisitor::donateKnownParallel):
4008         (JSC::SlotVisitor::drain):
4009         (JSC::SlotVisitor::drainFromShared):
4010         * heap/MarkStack.h:
4011         (JSC::MarkStack::mergeOpaqueRootsIfProfitable):
4012         (JSC::MarkStack::addOpaqueRoot):
4013         * heap/SlotVisitor.h:
4014         (JSC::SlotVisitor::donate):
4015         * jit/JIT.cpp:
4016         (JSC::JIT::emitOptimizationCheck):
4017         * jsc.cpp:
4018         (printUsageStatement):
4019         (parseArguments):
4020         * runtime/InitializeThreading.cpp:
4021         (JSC::initializeThreadingOnce):
4022         * runtime/JSGlobalData.cpp:
4023         (JSC::enableAssembler):
4024         * runtime/JSGlobalObject.cpp:
4025         (JSC::JSGlobalObject::JSGlobalObject):
4026         * runtime/Options.cpp:
4027         (JSC):
4028         (JSC::overrideOptionWithHeuristic):
4029         (JSC::Options::initialize):
4030         (JSC::Options::setOption):
4031         (JSC::Options::dumpAllOptions):
4032         (JSC::Options::dumpOption):
4033         * runtime/Options.h:
4034         (JSC):
4035         (Options):
4036         (EntryInfo):
4037
4038 2012-07-03  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>  Joel Dillon <joel.dillon@codethink.co.uk>
4039
4040         [Qt][Win] Fix broken QtWebKit5.lib linking
4041         https://bugs.webkit.org/show_bug.cgi?id=88321
4042
4043         Reviewed by Kenneth Rohde Christiansen.
4044
4045         The goal is to have different ports build systems define STATICALLY_LINKED_WITH_WTF
4046         when building JavaScriptCore, if both are packaged in the same DLL, instead
4047         of relying on the code to handle this.
4048         The effects of BUILDING_* and STATICALLY_LINKED_WITH_* are currently the same
4049         except for a check in Source/JavaScriptCore/config.h.
4050
4051         Keeping the old way for the WX port as requested by the port's contributors.
4052         For non-Windows ports there is no difference between IMPORT and EXPORT, no
4053         change is needed.
4054
4055         * API/JSBase.h:
4056           JS symbols shouldn't be included by WTF objects anymore. Remove the export when BUILDING_WTF.
4057         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
4058           Make sure that JavaScriptCore uses import symbols of WTF for the Win port.
4059         * runtime/JSExportMacros.h:
4060
4061 2012-07-02  Filip Pizlo  <fpizlo@apple.com>
4062
4063         DFG OSR exit value recoveries should be computed lazily
4064         https://bugs.webkit.org/show_bug.cgi?id=82155
4065
4066         Reviewed by Gavin Barraclough.
4067
4068         This change aims to reduce one aspect of DFG compile times: the fact
4069         that we currently compute the value recoveries for each local and
4070         argument on every speculation check. We compile many speculation checks,
4071         so this can add up quick. The strategy that this change takes is to
4072         have the DFG save just enough information about how the compiler is
4073         choosing to represent state, that the DFG::OSRExitCompiler can reify
4074         the value recoveries lazily.
4075
4076         This appears to be an 0.3% SunSpider speed-up and is neutral elsewhere.
4077
4078         I also took the opportunity to fix the sampling regions profiler (it
4079         was missing an export macro) and to put in more sampling regions in
4080         the DFG (which are disabled so long as ENABLE(SAMPLING_REGIONS) is
4081         false).
4082
4083         * CMakeLists.txt:
4084         * GNUmakefile.list.am:
4085         * JavaScriptCore.xcodeproj/project.pbxproj:
4086         * Target.pri:
4087         * bytecode/CodeBlock.cpp:
4088         (JSC):
4089         (JSC::CodeBlock::shrinkDFGDataToFit):
4090         * bytecode/CodeBlock.h:
4091         (CodeBlock):
4092         (JSC::CodeBlock::minifiedDFG):
4093         (JSC::CodeBlock::variableEventStream):
4094         (DFGData):
4095         * bytecode/Operands.h:
4096         (JSC::Operands::hasOperand):
4097         (Operands):
4098         (JSC::Operands::size):
4099         (JSC::Operands::at):
4100         (JSC::Operands::operator[]):
4101         (JSC::Operands::isArgument):
4102         (JSC::Operands::isVariable):
4103         (JSC::Operands::argumentForIndex):
4104         (JSC::Operands::variableForIndex):
4105         (JSC::Operands::operandForIndex):
4106         (JSC):
4107         (JSC::dumpOperands):
4108         * bytecode/SamplingTool.h:
4109         (SamplingRegion):
4110         * dfg/DFGByteCodeParser.cpp:
4111         (JSC::DFG::parse):
4112         * dfg/DFGCFAPhase.cpp:
4113         (JSC::DFG::performCFA):
4114         * dfg/DFGCSEPhase.cpp:
4115         (JSC::DFG::performCSE):
4116         * dfg/DFGFixupPhase.cpp:
4117         (JSC::DFG::performFixup):
4118         * dfg/DFGGenerationInfo.h:
4119         (JSC::DFG::GenerationInfo::GenerationInfo):
4120         (JSC::DFG::GenerationInfo::initConstant):
4121         (JSC::DFG::GenerationInfo::initInteger):
4122         (JSC::DFG::GenerationInfo::initJSValue):
4123         (JSC::DFG::GenerationInfo::initCell):
4124         (JSC::DFG::GenerationInfo::initBoolean):
4125         (JSC::DFG::GenerationInfo::initDouble):
4126         (JSC::DFG::GenerationInfo::initStorage):
4127         (GenerationInfo):
4128         (JSC::DFG::GenerationInfo::noticeOSRBirth):
4129         (JSC::DFG::GenerationInfo::use):
4130         (JSC::DFG::GenerationInfo::spill):
4131         (JSC::DFG::GenerationInfo::setSpilled):
4132         (JSC::DFG::GenerationInfo::fillJSValue):
4133         (JSC::DFG::GenerationInfo::fillCell):
4134         (JSC::DFG::GenerationInfo::fillInteger):
4135         (JSC::DFG::GenerationInfo::fillBoolean):
4136         (JSC::DFG::GenerationInfo::fillDouble):
4137         (JSC::DFG::GenerationInfo::fillStorage):
4138         (JSC::DFG::GenerationInfo::appendFill):
4139         (JSC::DFG::GenerationInfo::appendSpill):
4140         * dfg/DFGJITCompiler.cpp:
4141         (JSC::DFG::JITCompiler::link):
4142         (JSC::DFG::JITCompiler::compile):
4143         (JSC::DFG::JITCompiler::compileFunction):
4144         * dfg/DFGMinifiedGraph.h: Added.
4145         (DFG):
4146         (MinifiedGraph):
4147         (JSC::DFG::MinifiedGraph::MinifiedGraph):
4148         (JSC::DFG::MinifiedGraph::at):
4149         (JSC::DFG::MinifiedGraph::append):
4150         (JSC::DFG::MinifiedGraph::prepareAndShrink):
4151         (JSC::DFG::MinifiedGraph::setOriginalGraphSize):
4152         (JSC::DFG::MinifiedGraph::originalGraphSize):
4153         * dfg/DFGMinifiedNode.cpp: Added.
4154         (DFG):
4155         (JSC::DFG::MinifiedNode::fromNode):
4156         * dfg/DFGMinifiedNode.h: Added.
4157         (DFG):
4158         (JSC::DFG::belongsInMinifiedGraph):
4159         (MinifiedNode):
4160         (JSC::DFG::MinifiedNode::MinifiedNode):
4161         (JSC::DFG::MinifiedNode::index):
4162         (JSC::DFG::MinifiedNode::op):
4163         (JSC::DFG::MinifiedNode::hasChild1):
4164         (JSC::DFG::MinifiedNode::child1):
4165         (JSC::DFG::MinifiedNode::hasConstant):
4166         (JSC::DFG::MinifiedNode::hasConstantNumber):
4167         (JSC::DFG::MinifiedNode::constantNumber):
4168         (JSC::DFG::MinifiedNode::hasWeakConstant):
4169         (JSC::DFG::MinifiedNode::weakConstant):
4170         (JSC::DFG::MinifiedNode::getIndex):
4171         (JSC::DFG::MinifiedNode::compareByNodeIndex):
4172         (JSC::DFG::MinifiedNode::hasChild):
4173         * dfg/DFGNode.h:
4174         (Node):
4175         * dfg/DFGOSRExit.cpp:
4176         (JSC::DFG::OSRExit::OSRExit):
4177         * dfg/DFGOSRExit.h:
4178         (OSRExit):
4179         * dfg/DFGOSRExitCompiler.cpp:
4180         * dfg/DFGOSRExitCompiler.h:
4181         (OSRExitCompiler):
4182         * dfg/DFGOSRExitCompiler32_64.cpp:
4183         (JSC::DFG::OSRExitCompiler::compileExit):
4184         * dfg/DFGOSRExitCompiler64.cpp:
4185         (JSC::DFG::OSRExitCompiler::compileExit):
4186         * dfg/DFGPredictionPropagationPhase.cpp:
4187         (JSC::DFG::performPredictionPropagation):
4188         * dfg/DFGRedundantPhiEliminationPhase.cpp:
4189         (JSC::DFG::performRedundantPhiElimination):
4190         * dfg/DFGSpeculativeJIT.cpp:
4191         (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
4192         (DFG):
4193         (JSC::DFG::SpeculativeJIT::fillStorage):
4194         (JSC::DFG::SpeculativeJIT::noticeOSRBirth):
4195         (JSC::DFG::SpeculativeJIT::compileMovHint):
4196         (JSC::DFG::SpeculativeJIT::compile):
4197         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
4198         * dfg/DFGSpeculativeJIT.h:
4199         (DFG):
4200         (JSC::DFG::SpeculativeJIT::use):
4201         (SpeculativeJIT):
4202         (JSC::DFG::SpeculativeJIT::spill):
4203         (JSC::DFG::SpeculativeJIT::speculationCheck):
4204         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
4205         (JSC::DFG::SpeculativeJIT::recordSetLocal):
4206         * dfg/DFGSpeculativeJIT32_64.cpp:
4207         (JSC::DFG::SpeculativeJIT::fillInteger):
4208         (JSC::DFG::SpeculativeJIT::fillDouble):
4209         (JSC::DFG::SpeculativeJIT::fillJSValue):
4210         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
4211         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
4212         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
4213         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
4214         (JSC::DFG::SpeculativeJIT::compile):
4215         * dfg/DFGSpeculativeJIT64.cpp:
4216         (JSC::DFG::SpeculativeJIT::fillInteger):
4217         (JSC::DFG::SpeculativeJIT::fillDouble):
4218         (JSC::DFG::SpeculativeJIT::fillJSValue):
4219         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
4220         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
4221         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
4222         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
4223         (JSC::DFG::SpeculativeJIT::compile):
4224         * dfg/DFGValueRecoveryOverride.h: Added.
4225         (DFG):
4226         (ValueRecoveryOverride):
4227         (JSC::DFG::ValueRecoveryOverride::ValueRecoveryOverride):
4228         * dfg/DFGValueSource.cpp: Added.
4229         (DFG):
4230         (JSC::DFG::ValueSource::dump):
4231         * dfg/DFGValueSource.h: Added.
4232         (DFG):
4233         (JSC::DFG::dataFormatToValueSourceKind):
4234         (JSC::DFG::valueSourceKindToDataFormat):
4235         (JSC::DFG::isInRegisterFile):
4236         (ValueSource):
4237         (JSC::DFG::ValueSource::ValueSource):
4238         (JSC::DFG::ValueSource::forPrediction):
4239         (JSC::DFG::ValueSource::forDataFormat):
4240         (JSC::DFG::ValueSource::isSet):
4241         (JSC::DFG::ValueSource::kind):
4242         (JSC::DFG::ValueSource::isInRegisterFile):
4243         (JSC::DFG::ValueSource::dataFormat):
4244         (JSC::DFG::ValueSource::valueRecovery):
4245         (JSC::DFG::ValueSource::nodeIndex):
4246         (JSC::DFG::ValueSource::nodeIndexFromKind):
4247         (JSC::DFG::ValueSource::kindFromNodeIndex):
4248         * dfg/DFGVariableEvent.cpp: Added.
4249         (DFG):
4250         (JSC::DFG::VariableEvent::dump):
4251         (JSC::DFG::VariableEvent::dumpFillInfo):
4252         (JSC::DFG::VariableEvent::dumpSpillInfo):
4253         * dfg/DFGVariableEvent.h: Added.
4254         (DFG):
4255         (VariableEvent):
4256         (JSC::DFG::VariableEvent::VariableEvent):
4257         (JSC::DFG::VariableEvent::reset):
4258         (JSC::DFG::VariableEvent::fillGPR):
4259         (JSC::DFG::VariableEvent::fillPair):
4260         (JSC::DFG::VariableEvent::fillFPR):
4261         (JSC::DFG::VariableEvent::spill):
4262         (JSC::DFG::VariableEvent::death):
4263         (JSC::DFG::VariableEvent::setLocal):
4264         (JSC::DFG::VariableEvent::movHint):
4265         (JSC::DFG::VariableEvent::kind):
4266         (JSC::DFG::VariableEvent::nodeIndex):
4267         (JSC::DFG::VariableEvent::dataFormat):
4268         (JSC::DFG::VariableEvent::gpr):
4269         (JSC::DFG::VariableEvent::tagGPR):
4270         (JSC::DFG::VariableEvent::payloadGPR):
4271         (JSC::DFG::VariableEvent::fpr):
4272         (JSC::DFG::VariableEvent::virtualRegister):
4273         (JSC::DFG::VariableEvent::operand):
4274         (JSC::DFG::VariableEvent::variableRepresentation):
4275         * dfg/DFGVariableEventStream.cpp: Added.
4276         (DFG):
4277         (JSC::DFG::VariableEventStream::logEvent):
4278         (MinifiedGenerationInfo):
4279         (JSC::DFG::MinifiedGenerationInfo::MinifiedGenerationInfo):
4280         (JSC::DFG::MinifiedGenerationInfo::update):
4281         (JSC::DFG::VariableEventStream::reconstruct):
4282         * dfg/DFGVariableEventStream.h: Added.
4283         (DFG):
4284         (VariableEventStream):
4285         (JSC::DFG::VariableEventStream::appendAndLog):
4286         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
4287         (JSC::DFG::performVirtualRegisterAllocation):
4288
4289 2012-07-02  Filip Pizlo  <fpizlo@apple.com>
4290
4291         DFG::ArgumentsSimplificationPhase should assert that the PhantomArguments nodes it creates are not shouldGenerate()
4292         https://bugs.webkit.org/show_bug.cgi?id=90407
4293
4294         Reviewed by Mark Hahnenberg.
4295
4296         * dfg/DFGArgumentsSimplificationPhase.cpp:
4297         (JSC::DFG::ArgumentsSimplificationPhase::run):
4298
4299 2012-07-02  Gavin Barraclough  <barraclough@apple.com>
4300
4301         Array.prototype.pop should throw if property is not configurable
4302         https://bugs.webkit.org/show_bug.cgi?id=75788
4303
4304         Rubber Stamped by Oliver Hunt.
4305
4306         No real bug here any more, but the error we throw sometimes has a misleading message.
4307
4308         * runtime/JSArray.cpp:
4309         (JSC::JSArray::pop):
4310
4311 2012-06-29  Filip Pizlo  <fpizlo@apple.com>
4312
4313         JSObject wastes too much memory on unused property slots
4314         https://bugs.webkit.org/show_bug.cgi?id=90255
4315
4316         Reviewed by Mark Hahnenberg.
4317
4318         Rolling back in after applying a simple fix: it appears that
4319         JSObject::setStructureAndReallocateStorageIfNecessary() was allocating more
4320         property storage than necessary. Fixing this appears to resolve the crash.
4321
4322         This does a few things:
4323
4324         - JSNonFinalObject no longer has inline property storage.
4325
4326         - Initial out-of-line property storage size is 4 slots for JSNonFinalObject,
4327           or 2x the inline storage for JSFinalObject.
4328
4329         - Property storage is only reallocated if it needs to be. Previously, we
4330           would reallocate the property storage on any transition where the original
4331           structure said shouldGrowProperyStorage(), but this led to spurious
4332           reallocations when doing transitionless property adds and there are
4333           deleted property slots available. That in turn led to crashes, because we
4334           would switch to out-of-line storage even if the capacity matched the
4335           criteria for inline storage.
4336
4337         - Inline JSFunction allocation is killed off because we don't have a good
4338           way of inlining property storage allocation. This didn't hurt performance.
4339           Killing off code is better than fixing it if that code wasn't doing any
4340           good.
4341
4342         This looks like a 1% progression on V8.
4343
4344         * interpreter/Interpreter.cpp:
4345         (JSC::Interpreter::privateExecute):
4346         * jit/JIT.cpp:
4347         (JSC::JIT::privateCompileSlowCases):
4348         * jit/JIT.h:
4349         * jit/JITInlineMethods.h:
4350         (JSC::JIT::emitAllocateBasicJSObject):
4351         (JSC):
4352         * jit/JITOpcodes.cpp:
4353         (JSC::JIT::emit_op_new_func):
4354         (JSC):
4355         (JSC::JIT::emit_op_new_func_exp):
4356         * runtime/JSFunction.cpp:
4357         (JSC::JSFunction::finishCreation):
4358         * runtime/JSObject.h:
4359         (JSC::JSObject::isUsingInlineStorage):
4360         (JSObject):
4361         (JSC::JSObject::finishCreation):
4362         (JSC):
4363         (JSC::JSNonFinalObject::hasInlineStorage):
4364         (JSNonFinalObject):
4365         (JSC::JSNonFinalObject::JSNonFinalObject):
4366         (JSC::JSNonFinalObject::finishCreation):
4367         (JSC::JSFinalObject::hasInlineStorage):
4368         (JSC::JSFinalObject::finishCreation):
4369         (JSC::JSObject::offsetOfInlineStorage):
4370         (JSC::JSObject::setPropertyStorage):
4371         (JSC::Structure::inlineStorageCapacity):
4372         (JSC::Structure::isUsingInlineStorage):
4373         (JSC::JSObject::putDirectInternal):
4374         (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
4375         (JSC::JSObject::putDirectWithoutTransition):
4376         * runtime/Structure.cpp:
4377         (JSC::Structure::Structure):
4378         (JSC::nextPropertyStorageCapacity):
4379         (JSC):
4380         (JSC::Structure::growPropertyStorageCapacity):
4381         (JSC::Structure::suggestedNewPropertyStorageSize):
4382         * runtime/Structure.h:
4383         (JSC::Structure::putWillGrowPropertyStorage):
4384         (Structure):
4385
4386 2012-06-29  Filip Pizlo  <fpizlo@apple.com>
4387
4388         Webkit crashes in DFG on Google Docs when creating a new document
4389         https://bugs.webkit.org/show_bug.cgi?id=90209
4390
4391         Reviewed by Gavin Barraclough.
4392
4393         Don't attempt to short-circuit Phantom(GetLocal) if the GetLocal is for a
4394         captured variable.
4395
4396         * dfg/DFGCFGSimplificationPhase.cpp:
4397         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
4398
4399 2012-06-30  Zan Dobersek  <zandobersek@gmail.com>
4400
4401         Unreviewed, rolling out r121605.
4402         http://trac.webkit.org/changeset/121605
4403         https://bugs.webkit.org/show_bug.cgi?id=90336
4404
4405         Changes caused flaky crashes in sputnik/Unicode tests on Apple
4406         WK1 and GTK Linux builders
4407
4408         * interpreter/Interpreter.cpp:
4409         (JSC::Interpreter::privateExecute):
4410         * jit/JIT.cpp:
4411         (JSC::JIT::privateCompileSlowCases):
4412         * jit/JIT.h:
4413         * jit/JITInlineMethods.h:
4414         (JSC::JIT::emitAllocateBasicJSObject):
4415         (JSC::JIT::emitAllocateJSFinalObject):
4416         (JSC):
4417         (JSC::JIT::emitAllocateJSFunction):
4418         * jit/JITOpcodes.cpp:
4419         (JSC::JIT::emit_op_new_func):
4420         (JSC::JIT::emitSlow_op_new_func):
4421         (JSC):
4422         (JSC::JIT::emit_op_new_func_exp):
4423         (JSC::JIT::emitSlow_op_new_func_exp):
4424         * runtime/JSFunction.cpp:
4425         (JSC::JSFunction::finishCreation):
4426         * runtime/JSObject.h:
4427         (JSC::JSObject::isUsingInlineStorage):
4428         (JSObject):
4429         (JSC::JSObject::finishCreation):
4430         (JSC):
4431         (JSNonFinalObject):
4432         (JSC::JSNonFinalObject::JSNonFinalObject):
4433         (JSC::JSNonFinalObject::finishCreation):
4434         (JSFinalObject):
4435         (JSC::JSFinalObject::finishCreation):
4436         (JSC::JSObject::offsetOfInlineStorage):
4437         (JSC::JSObject::setPropertyStorage):
4438         (JSC::Structure::isUsingInlineStorage):
4439         (JSC::JSObject::putDirectInternal):
4440         (JSC::JSObject::putDirectWithoutTransition):
4441         (JSC::JSObject::transitionTo):
4442         * runtime/Structure.cpp:
4443         (JSC::Structure::Structure):
4444         (JSC):
4445         (JSC::Structure::growPropertyStorageCapacity):
4446         (JSC::Structure::suggestedNewPropertyStorageSize):
4447         * runtime/Structure.h:
4448         (JSC::Structure::shouldGrowPropertyStorage):
4449         (JSC::Structure::propertyStorageSize):
4450
4451 2012-06-29  Mark Hahnenberg  <mhahnenberg@apple.com>
4452
4453         Remove warning about protected values when the Heap is being destroyed
4454         https://bugs.webkit.org/show_bug.cgi?id=90302
4455
4456         Reviewed by Geoffrey Garen.
4457
4458         Having to do book-keeping about whether values allocated from a certain
4459         VM are or are not protected makes the JSC API much more difficult to use
4460         correctly. Clients should be able to throw an entire VM away and not have
4461         to worry about unprotecting all of the values that they protected earlier.
4462
4463         * heap/Heap.cpp:
4464         (JSC::Heap::lastChanceToFinalize):
4465
4466 2012-06-29  Filip Pizlo  <fpizlo@apple.com>
4467
4468         JSObject wastes too much memory on unused property slots
4469         https://bugs.webkit.org/show_bug.cgi?id=90255
4470
4471         Reviewed by Mark Hahnenberg.
4472
4473         This does a few things:
4474
4475         - JSNonFinalObject no longer has inline property storage.
4476
4477         - Initial out-of-line property storage size is 4 slots for JSNonFinalObject,
4478           or 2x the inline storage for JSFinalObject.
4479
4480         - Property storage is only reallocated if it needs to be. Previously, we
4481           would reallocate the property storage on any transition where the original
4482           structure said shouldGrowProperyStorage(), but this led to spurious
4483           reallocations when doing transitionless property adds and there are
4484           deleted property slots available. That in turn led to crashes, because we
4485           would switch to out-of-line storage even if the capacity matched the
4486           criteria for inline storage.
4487
4488         - Inline JSFunction allocation is killed off because we don't have a good
4489           way of inlining property storage allocation. This didn't hurt performance.
4490           Killing off code is better than fixing it if that code wasn't doing any
4491           good.
4492
4493         This looks like a 1% progression on V8.
4494
4495         * interpreter/Interpreter.cpp:
4496         (JSC::Interpreter::privateExecute):
4497         * jit/JIT.cpp:
4498         (JSC::JIT::privateCompileSlowCases):
4499         * jit/JIT.h:
4500         * jit/JITInlineMethods.h:
4501         (JSC::JIT::emitAllocateBasicJSObject):
4502         (JSC):
4503         * jit/JITOpcodes.cpp:
4504         (JSC::JIT::emit_op_new_func):
4505         (JSC):
4506         (JSC::JIT::emit_op_new_func_exp):
4507         * runtime/JSFunction.cpp:
4508         (JSC::JSFunction::finishCreation):
4509         * runtime/JSObject.h:
4510         (JSC::JSObject::isUsingInlineStorage):
4511         (JSObject):
4512         (JSC::JSObject::finishCreation):
4513         (JSC):
4514         (JSC::JSNonFinalObject::hasInlineStorage):
4515         (JSNonFinalObject):
4516         (JSC::JSNonFinalObject::JSNonFinalObject):
4517         (JSC::JSNonFinalObject::finishCreation):
4518         (JSC::JSFinalObject::hasInlineStorage):
4519         (JSC::JSFinalObject::finishCreation):
4520         (JSC::JSObject::offsetOfInlineStorage):
4521         (JSC::JSObject::setPropertyStorage):
4522         (JSC::Structure::inlineStorageCapacity):
4523         (JSC::Structure::isUsingInlineStorage):
4524         (JSC::JSObject::putDirectInternal):
4525         (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
4526         (JSC::JSObject::putDirectWithoutTransition):
4527         * runtime/Structure.cpp:
4528         (JSC::Structure::Structure):
4529         (JSC::nextPropertyStorageCapacity):
4530         (JSC):
4531         (JSC::Structure::growPropertyStorageCapacity):
4532         (JSC::Structure::suggestedNewPropertyStorageSize):
4533         * runtime/Structure.h:
4534         (JSC::Structure::putWillGrowPropertyStorage):
4535         (Structure):
4536
4537 2012-06-28  Filip Pizlo  <fpizlo@apple.com>
4538
4539         DFG recompilation heuristics should be based on count, not rate
4540         https://bugs.webkit.org/show_bug.cgi?id=90146
4541
4542         Reviewed by Oliver Hunt.
4543
4544         This removes a bunch of code that was previously trying to prevent spurious
4545         reoptimizations if a large enough majority of executions of a code block did
4546         not result in OSR exit. It turns out that this code was purely harmful. This
4547         patch removes all of that logic and replaces it with a dead-simple
4548         heuristic: if you exit more than N times (where N is an exponential function
4549         of the number of times the code block has already been recompiled) then we
4550         will recompile.
4551
4552         This appears to be a broad ~1% win on many benchmarks large and small.
4553
4554         * bytecode/CodeBlock.cpp:
4555         (JSC::CodeBlock::CodeBlock):
4556         * bytecode/CodeBlock.h:
4557         (JSC::CodeBlock::osrExitCounter):
4558         (JSC::CodeBlock::countOSRExit):
4559         (CodeBlock):
4560         (JSC::CodeBlock::addressOfOSRExitCounter):
4561         (JSC::CodeBlock::offsetOfOSRExitCounter):
4562         (JSC::CodeBlock::adjustedExitCountThreshold):
4563         (JSC::CodeBlock::exitCountThresholdForReoptimization):
4564         (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
4565         (JSC::CodeBlock::shouldReoptimizeNow):
4566         (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
4567         * bytecode/ExecutionCounter.cpp:
4568         (JSC::ExecutionCounter::setThreshold):
4569         * bytecode/ExecutionCounter.h:
4570         (ExecutionCounter):
4571         (JSC::ExecutionCounter::clippedThreshold):
4572         * dfg/DFGJITCompiler.cpp:
4573         (JSC::DFG::JITCompiler::compileBody):
4574         * dfg/DFGOSRExit.cpp:
4575         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
4576         * dfg/DFGOSRExitCompiler.cpp:
4577         (JSC::DFG::OSRExitCompiler::handleExitCounts):
4578         * dfg/DFGOperations.cpp:
4579         * jit/JITStubs.cpp:
4580         (JSC::DEFINE_STUB_FUNCTION):
4581         * runtime/Options.cpp:
4582         (Options):
4583         (JSC::Options::initializeOptions):
4584         * runtime/Options.h:
4585         (Options):
4586
4587 2012-06-28  Mark Lam  <mark.lam@apple.com>
4588
4589         Adding a commenting utility to record BytecodeGenerator comments
4590         with opcodes that are emitted.  Presently, the comments can only
4591         be constant strings.  Adding comments for opcodes is optional.
4592         If a comment is added, the comment will be printed following the
4593         opcode when CodeBlock::dump() is called.
4594
4595         This utility is disabled by default, and is only meant for VM
4596         development purposes.  It should not be enabled for product builds.
4597
4598         To enable this utility, set ENABLE_BYTECODE_COMMENTS in CodeBlock.h
4599         to 1.
4600
4601         https://bugs.webkit.org/show_bug.cgi?id=90095
4602
4603         Reviewed by Geoffrey Garen.
4604
4605         * GNUmakefile.list.am:
4606         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
4607         * JavaScriptCore.xcodeproj/project.pbxproj:
4608         * bytecode/CodeBlock.cpp:
4609         (JSC::CodeBlock::dumpBytecodeCommentAndNewLine): Dumps the comment.
4610         (JSC):
4611         (JSC::CodeBlock::printUnaryOp): Add comment dumps.
4612         (JSC::CodeBlock::printBinaryOp): Add comment dumps.
4613         (JSC::CodeBlock::printConditionalJump): Add comment dumps.
4614         (JSC::CodeBlock::printCallOp): Add comment dumps.
4615         (JSC::CodeBlock::printPutByIdOp): Add comment dumps.
4616         (JSC::CodeBlock::dump): Add comment dumps.
4617         (JSC::CodeBlock::CodeBlock):
4618         (JSC::CodeBlock::commentForBytecodeOffset):
4619             Finds the comment for an opcode if available.
4620         (JSC::CodeBlock::dumpBytecodeComments):
4621             For debugging whether comments are collected.
4622             It is not being called anywhere.
4623         * bytecode/CodeBlock.h:
4624         (CodeBlock):
4625         (JSC::CodeBlock::bytecodeComments):
4626         * bytecode/Comment.h: Added.
4627         (JSC):
4628         (Comment):
4629         * bytecompiler/BytecodeGenerator.cpp:
4630         (JSC::BytecodeGenerator::BytecodeGenerator):
4631         (JSC::BytecodeGenerator::emitOpcode): Calls emitComment().
4632         (JSC):
4633         (JSC::BytecodeGenerator::emitComment): Adds comment to CodeBlock.
4634         (JSC::BytecodeGenerator::prependComment):
4635             Registers a comment for emitComemnt() to use later.
4636         * bytecompiler/BytecodeGenerator.h:
4637         (BytecodeGenerator):
4638         (JSC::BytecodeGenerator::emitComment):
4639         (JSC::BytecodeGenerator::prependComment):
4640             These are inlined versions of these functions that nullify them
4641             when ENABLE_BYTECODE_COMMENTS is 0.
4642         (JSC::BytecodeGenerator::comments):
4643
4644 2012-06-28  Oliver Hunt  <oliver@apple.com>
4645
4646         32bit DFG incorrectly claims an fpr is fillable even if it has not been proven double
4647         https://bugs.webkit.org/show_bug.cgi?id=90127
4648
4649         Reviewed by Filip Pizlo.
4650
4651         The 32-bit version of fillSpeculateDouble doesn't handle Number->fpr loads
4652         correctly.  This patch fixes this by killing the fill info in the GenerationInfo
4653         when the spillFormat doesn't guarantee the value is a double.
4654
4655         * dfg/DFGSpeculativeJIT32_64.cpp:
4656         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
4657
4658 2012-06-28  Kent Tamura  <tkent@chromium.org>
4659
4660         Classify form control states by their owner forms
4661         https://bugs.webkit.org/show_bug.cgi?id=89950
4662
4663         Reviewed by Hajime Morita.
4664
4665         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
4666         Expose WTF::StringBuilder::canShrink()
4667
4668 2012-06-27  Michael Saboff  <msaboff@apple.com>
4669
4670         [Win] jscore-tests flakey
4671         https://bugs.webkit.org/show_bug.cgi?id=88118
4672
4673         Reviewed by Jessie Berlin.
4674
4675         jsDriver.pl on windows intermittently doesn't get the returned value from jsc,
4676         instead it gets 126.  Added a new option to jsc (-x) which prints the exit
4677         code before exiting.  jsDriver.pl uses this option on Windows and parses the
4678         exit code output for the exit code, removing it before comparing the actual
4679         and expected outputs.  Filed a follow on "FIXME" defect:
4680         [WIN] Intermittent failure for jsc return value to propagate through jsDriver.pl
4681         https://bugs.webkit.org/show_bug.cgi?id=90119
4682
4683         * jsc.cpp:
4684         (CommandLine::CommandLine):
4685         (CommandLine):
4686         (printUsageStatement):
4687         (parseArguments):
4688         (jscmain):
4689         * tests/mozilla/jsDriver.pl:
4690         (execute_tests):
4691
4692 2012-06-27  Sheriff Bot  <webkit.review.bot@gmail.com>
4693
4694         Unreviewed, rolling out r121359.
4695         http://trac.webkit.org/changeset/121359
4696         https://bugs.webkit.org/show_bug.cgi?id=90115
4697
4698         Broke many inspector tests (Requested by jpfau on #webkit).
4699
4700         * interpreter/Interpreter.h:
4701         (JSC::StackFrame::toString):
4702
4703 2012-06-27  Filip Pizlo  <fpizlo@apple.com>
4704
4705         Javascript SHA-512 gives wrong hash on second and subsequent runs unless Web Inspector Javascript Debugging is on
4706         https://bugs.webkit.org/show_bug.cgi?id=90053
4707         <rdar://problem/11764613>
4708
4709         Reviewed by Mark Hahnenberg.
4710
4711         The problem is that the code was assuming that the recovery should be Undefined if the source of
4712         the SetLocal was !shouldGenerate(). But that's wrong, since the DFG optimizer may skip around a
4713         UInt32ToNumber node (hence making it !shouldGenerate()) and keep the source of that node alive.
4714         In that case we should base the recovery on the source of the UInt32ToNumber. The logic for this
4715         was already in place but the fast check for !shouldGenerate() broke it.
4716
4717         * dfg/DFGSpeculativeJIT.cpp:
4718         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
4719
4720 2012-06-27  Filip Pizlo  <fpizlo@apple.com>
4721
4722         DFG disassembly should be easier to read
4723         https://bugs.webkit.org/show_bug.cgi?id=90106
4724
4725         Reviewed by Mark Hahnenberg.
4726
4727         Did a few things:
4728
4729         - Options::showDFGDisassembly now shows OSR exit disassembly as well.
4730
4731         - Phi node dumping doesn't attempt to do line wrapping since it just made the dump harder
4732           to read.
4733
4734         - DFG graph disassembly view shows a few additional node types that turn out to be
4735           essential for understanding OSR exits.
4736
4737         Put together, these changes reinforce the philosophy that anything needed for computing
4738         OSR exit is just as important as the machine code itself. Of course, we still don't take
4739         that philosophy to its full extreme - for example Phantom nodes are not dumped. We may
4740         revisit that in the future.
4741
4742         * assembler/LinkBuffer.cpp:
4743         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
4744         * assembler/LinkBuffer.h:
4745         (JSC):
4746         * dfg/DFGDisassembler.cpp:
4747         (JSC::DFG::Disassembler::dump):
4748         * dfg/DFGGraph.cpp:
4749         (JSC::DFG::Graph::dumpBlockHeader):
4750         * dfg/DFGNode.h:
4751         (JSC::DFG::Node::willHaveCodeGenOrOSR):
4752         * dfg/DFGOSRExitCompiler.cpp:
4753         * jit/JIT.cpp:
4754         (JSC::JIT::privateCompile):
4755
4756 2012-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
4757
4758         JSLock should be per-JSGlobalData
4759         https://bugs.webkit.org/show_bug.cgi?id=89123
4760
4761         Reviewed by Geoffrey Garen.
4762
4763         * API/APIShims.h:
4764         (APIEntryShimWithoutLock):
4765         (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to
4766         determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the
4767         HeapTimer class because timerDidFire could run after somebody has started to tear down that particular
4768         JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after
4769         its destruction has begun.
4770         (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
4771         (JSC::APIEntryShim::APIEntryShim):
4772         (APIEntryShim):
4773         (JSC::APIEntryShim::~APIEntryShim):
4774         (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors.
4775         Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock
4776         and before we've released it, which can only done in APIEntryShim.
4777         (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here.
4778         * API/JSContextRef.cpp:
4779         (JSGlobalContextCreate):
4780         (JSGlobalContextCreateInGroup):
4781         (JSGlobalContextRelease):
4782         (JSContextCreateBacktrace):
4783         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
4784         * heap/CopiedSpace.cpp:
4785         (JSC::CopiedSpace::tryAllocateSlowCase):
4786         * heap/Heap.cpp:
4787         (JSC::Heap::protect):
4788         (JSC::Heap::unprotect):
4789         (JSC::Heap::collect):
4790         (JSC::Heap::setActivityCallback):
4791         (JSC::Heap::activityCallback):
4792         (JSC::Heap::sweeper):
4793         * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they
4794         are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback
4795         and the IncrementalSweeper to make sure they're the last things that get initialized during construction to
4796         prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about.
4797         (Heap):
4798         * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown.
4799         (JSC::HeapTimer::~HeapTimer):
4800         (JSC::HeapTimer::invalidate):
4801         (JSC):
4802         (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread
4803         that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the
4804         HeapTimer and schedule it to fire immediately so that it can notice and kill itself.
4805         (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed
4806         out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim,
4807         but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case
4808         we were interrupted between releasing our mutex and trying to grab the APILock.
4809         * heap/HeapTimer.h:
4810         (HeapTimer):
4811         * heap/IncrementalSweeper.cpp:
4812         (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles
4813         all of that for us.
4814         (JSC::IncrementalSweeper::create):
4815         * heap/IncrementalSweeper.h:
4816         (IncrementalSweeper):
4817         * heap/MarkedAllocator.cpp:
4818         (JSC::MarkedAllocator::allocateSlowCase):
4819         * heap/WeakBlock.cpp:
4820         (JSC::WeakBlock::reap):
4821         * jsc.cpp:
4822         (functionGC):
4823         (functionReleaseExecutableMemory):
4824         (jscmain):
4825         * runtime/Completion.cpp:
4826         (JSC::checkSyntax):
4827         (JSC::evaluate):
4828         * runtime/GCActivityCallback.h:
4829         (DefaultGCActivityCallback):
4830         (JSC::DefaultGCActivityCallback::create):
4831         * runtime/JSGlobalData.cpp:
4832         (JSC::JSGlobalData::JSGlobalData):
4833         (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper)
4834         that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity
4835         it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the
4836         APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes.
4837         (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock.
4838         (JSC::JSGlobalData::sharedInstanceInternal):
4839         * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and
4840         de-refing JSGlobalDatas on separate threads since we don't do it that often anyways.
4841         (JSGlobalData):
4842         (JSC::JSGlobalData::apiLock):
4843         * runtime/JSGlobalObject.cpp:
4844         (JSC::JSGlobalObject::~JSGlobalObject):
4845         (JSC::JSGlobalObject::init):
4846         * runtime/JSLock.cpp:
4847         (JSC):
4848         (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance.
4849         (JSC::GlobalJSLock::~GlobalJSLock):
4850         (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that
4851         it can successfully unlock it later without it disappearing from underneath it.
4852         (JSC::JSLockHolder::~JSLockHolder):
4853         (JSC::JSLock::JSLock):
4854         (JSC::JSLock::~JSLock):
4855         (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for
4856         actually waiting for long periods.
4857         (JSC::JSLock::unlock):
4858         (JSC::JSLock::currentThreadIsHoldingLock):
4859         (JSC::JSLock::dropAllLocks):
4860         (JSC::JSLock::dropAllLocksUnconditionally):
4861         (JSC::JSLock::grabAllLocks):
4862         (JSC::JSLock::DropAllLocks::DropAllLocks):
4863         (JSC::JSLock::DropAllLocks::~DropAllLocks):
4864         * runtime/JSLock.h:
4865         (JSC):
4866         (GlobalJSLock):
4867         (JSLockHolder):
4868         (JSLock):
4869         (DropAllLocks):
4870         * runtime/WeakGCMap.h:
4871         (JSC::WeakGCMap::set):
4872         * testRegExp.cpp:
4873         (realMain):
4874
4875 2012-06-27  Filip Pizlo  <fpizlo@apple.com>
4876
4877         x86 disassembler confuses immediates with addresses
4878         https://bugs.webkit.org/show_bug.cgi?id=90099
4879
4880         Reviewed by Mark Hahnenberg.
4881
4882         Prepend "$" to immediates to disambiguate between immediates and addresses. This is in
4883         accordance with the gas and AT&T syntax.
4884
4885         * disassembler/udis86/udis86_syn-att.c:
4886         (gen_operand):
4887
4888 2012-06-27  Filip Pizlo  <fpizlo@apple.com>
4889
4890         Add a comment clarifying Options::showDisassembly versus Options::showDFGDisassembly.
4891
4892         Rubber stamped by Mark Hahnenberg.
4893
4894         * runtime/Options.cpp:
4895         (JSC::Options::initializeOptions):
4896
4897 2012-06-27  Anthony Scian  <ascian@rim.com>
4898
4899         Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
4900         https://bugs.webkit.org/show_bug.cgi?id=40118
4901
4902         Reviewed by Yong Li.
4903
4904         Added member functions to expose function name, urlString, and line #.
4905         Refactored toString to make use of these member functions to reduce
4906         duplicated code for future maintenance.
4907
4908         Manually tested refactoring of toString by tracing thrown exceptions.
4909
4910         * interpreter/Interpreter.h:
4911         (StackFrame):
4912         (JSC::StackFrame::toString):
4913         (JSC::StackFrame::friendlySourceURL):
4914         (JSC::StackFrame::friendlyFunctionName):
4915         (JSC::StackFrame::friendlyLineNumber):
4916
4917 2012-06-27  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
4918
4919         [Qt] Remove redundant c++11 warning suppression code
4920
4921         This is already handled in default_post.
4922
4923         Reviewed by Tor Arne Vestbø.
4924
4925         * Target.pri:
4926
4927 2012-06-26  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
4928
4929         [Qt] Add missing heades to HEADERS
4930
4931         For JavaScriptCore there aren't any Qt specific files, so we include all
4932         headers for easy editing in Qt Creator.
4933
4934         Reviewed by Simon Hausmann.
4935
4936         * Target.pri:
4937
4938 2012-06-26  Dominic Cooney  <dominicc@chromium.org>
4939
4940         [Chromium] Remove unused build scripts and empty folders for JavaScriptCore w/ gyp
4941         https://bugs.webkit.org/show_bug.cgi?id=90029
4942
4943         Reviewed by Adam Barth.
4944
4945         * gyp: Removed.
4946         * gyp/generate-derived-sources.sh: Removed.
4947         * gyp/generate-dtrace-header.sh: Removed.
4948         * gyp/run-if-exists.sh: Removed.
4949         * gyp/update-info-plist.sh: Removed.
4950
4951 2012-06-26  Geoffrey Garen  <ggaren@apple.com>
4952
4953         Reduced (but did not eliminate) use of "berzerker GC"
4954         https://bugs.webkit.org/show_bug.cgi?id=89237
4955
4956         Reviewed by Gavin Barraclough.
4957
4958         (PART 2)
4959
4960         This part turns off "berzerker GC" and turns on incremental shrinking.
4961
4962         * heap/IncrementalSweeper.cpp:
4963         (JSC::IncrementalSweeper::doSweep): Free or shrink after sweeping to
4964         maintain the behavior we used to get from the occasional berzerker GC,
4965         which would run all finalizers and then free or shrink all blocks
4966         synchronously.
4967
4968         * heap/MarkedBlock.h:
4969         (JSC::MarkedBlock::needsSweeping): Sweep zapped blocks, too. It's always
4970         safe to sweep a zapped block (that's the point of zapping), and it's
4971         sometimes profitable. For example, consider this case: Block A does some
4972         allocation (transitioning Block A from Marked to FreeListed), then GC
4973         happens (transitioning Block A to Zapped), then all objects in Block A
4974         are free, then the incremental sweeper visits Block A. If we skipped
4975         Zapped blocks, we'd skip Block A, even though it would be profitable to
4976         run its destructors and free its memory.
4977
4978         * runtime/GCActivityCallback.cpp:
4979         (JSC::DefaultGCActivityCallback::doWork): Don't sweep eagerly; we'll do
4980         this incrementally.
4981
4982 2012-06-26  Filip Pizlo  <fpizlo@apple.com>
4983
4984         DFG PutByValAlias is too aggressive
4985         https://bugs.webkit.org/show_bug.cgi?id=90026
4986         <rdar://problem/11751830>
4987
4988         Reviewed by Gavin Barraclough.
4989
4990         For CSE on normal arrays, we now treat PutByVal as impure. This does not appear to affect
4991         performance by much.
4992
4993         For CSE on typed arrays, we fix PutByValAlias by making GetByVal speculate that the access
4994         is within bounds. This also has the effect of making our out-of-bounds handling consistent
4995         with WebCore.
4996
4997         * dfg/DFGCSEPhase.cpp:
4998         (JSC::DFG::CSEPhase::performNodeCSE):
4999         * dfg/DFGGraph.h:
5000         (JSC::DFG::Graph::byValIsPure):
5001         (JSC::DFG::Graph::clobbersWorld):
5002         * dfg/DFGNodeType.h:
5003         (DFG):
5004         * dfg/DFGSpeculativeJIT.cpp:
5005         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
5006         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
5007
5008 2012-06-26  Yong Li  <yoli@rim.com>
5009
5010         [BlackBerry] Add JSC statistics into about:memory
5011         https://bugs.webkit.org/show_bug.cgi?id=89779
5012
5013         Reviewed by Rob Buis.
5014
5015         Fix non-JIT build on BlackBerry broken by r121196.
5016
5017         * runtime/MemoryStatistics.cpp:
5018         (JSC::globalMemoryStatistics):
5019
5020 2012-06-25  Filip Pizlo  <fpizlo@apple.com>
5021
5022         DFG::operationNewArray is unnecessarily slow, and may use the wrong array
5023         prototype when inlined
5024         https://bugs.webkit.org/show_bug.cgi?id=89821
5025
5026         Reviewed by Geoffrey Garen.
5027
5028         Fixes all array allocations to use the right structure, and hence the right prototype. Adds
5029         inlining of new Array(...) with a non-zero number of arguments. Optimizes allocations of
5030         empty arrays.
5031
5032         * dfg/DFGAbstractState.cpp:
5033         (JSC::DFG::AbstractState::execute):
5034         * dfg/DFGByteCodeParser.cpp:
5035         (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
5036         * dfg/DFGCCallHelpers.h:
5037         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
5038         (CCallHelpers):
5039         * dfg/DFGNodeType.h:
5040         (DFG):
5041         * dfg/DFGOperations.cpp:
5042         * dfg/DFGOperations.h:
5043         * dfg/DFGPredictionPropagationPhase.cpp:
5044         (JSC::DFG::PredictionPropagationPhase::propagate):
5045         * dfg/DFGSpeculativeJIT.h:
5046         (JSC::DFG::SpeculativeJIT::callOperation):
5047         * dfg/DFGSpeculativeJIT32_64.cpp:
5048         (JSC::DFG::SpeculativeJIT::compile):
5049         * dfg/DFGSpeculativeJIT64.cpp:
5050         (JSC::DFG::SpeculativeJIT::compile):
5051         * runtime/JSArray.h:
5052         (JSC):
5053         (JSC::constructArray):
5054         * runtime/JSGlobalObject.h:
5055         (JSC):
5056         (JSC::constructArray):
5057
5058 2012-06-26  Filip Pizlo  <fpizlo@apple.com>
5059
5060         New fast/js/dfg-store-unexpected-value-into-argument-and-osr-exit.html fails on 32 bit
5061         https://bugs.webkit.org/show_bug.cgi?id=89953
5062
5063         Reviewed by Zoltan Herczeg.
5064
5065         DFG 32-bit JIT was confused about the difference between a predicted type and a
5066         proven type. This is easy to get confused about, since a local that is predicted int32
5067         almost always means that the local must be an int32 since speculations are hoisted to
5068         stores to locals. But that is less likely to be the case for arguments, where there is
5069         an additional least-upper-bounding step: any store to an argument with a weird type
5070         may force the argument to be any type.
5071
5072         This patch basically duplicates the functionality in DFGSpeculativeJIT64.cpp for
5073         GetLocal: the decision of whether to load a local as an int32 (or as an array, or as
5074         a boolean) is made based on the AbstractValue::m_type, which is a type proof, rather
5075         than the VariableAccessData::prediction(), which is a predicted type.
5076
5077         * dfg/DFGSpeculativeJIT32_64.cpp:
5078         (JSC::DFG::SpeculativeJIT::compile):
5079
5080 2012-06-25  Filip Pizlo  <fpizlo@apple.com>
5081
5082         JSC should try to make profiling deterministic because otherwise reproducing failures is
5083         nearly impossible
5084         https://bugs.webkit.org/show_bug.cgi?id=89940
5085
5086         Rubber stamped by Gavin Barraclough.
5087
5088         This rolls out the part of http://trac.webkit.org/changeset/121215 that introduced randomness
5089         into the system. Now, instead of randomizing the tier-up threshold, we always set it to an
5090         artificially low (and statically predetermined!) value. This gives most of the benefit of
5091         threshold randomization without actually making the system behave completely differently on
5092         each invocation.
5093
5094         * bytecode/ExecutionCounter.cpp:
5095         (JSC::ExecutionCounter::setThreshold):
5096         * runtime/Options.cpp:
5097         (Options):
5098         (JSC::Options::initializeOptions):
5099         * runtime/Options.h:
5100         (Options):
5101
5102 2012-06-22  Filip Pizlo  <fpizlo@apple.com>
5103
5104         Value profiling should use tier-up threshold randomization to get more coverage
5105         https://bugs.webkit.org/show_bug.cgi?id=89802
5106
5107         Reviewed by Gavin Barraclough.
5108
5109         This patch causes both LLInt and Baseline JIT code to take the OSR slow path several
5110         times before actually doing OSR. If we take the OSR slow path before the execution
5111         count threshold is reached, then we just call CodeBlock::updateAllPredictions() to
5112         compute the current latest least-upper-bound SpecType of all values seen in each
5113         ValueProfile.
5114
5115         * bytecode/CodeBlock.cpp:
5116         (JSC::CodeBlock::stronglyVisitStrongReferences):
5117         (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
5118         (JSC):
5119         (JSC::CodeBlock::updateAllPredictions):
5120         (JSC::CodeBlock::shouldOptimizeNow):
5121         * bytecode/CodeBlock.h:
5122         (JSC::CodeBlock::llintExecuteCounter):
5123         (JSC::CodeBlock::jitExecuteCounter):
5124         (CodeBlock):
5125         (JSC::CodeBlock::updateAllPredictions):
5126         * bytecode/ExecutionCounter.cpp:
5127         (JSC::ExecutionCounter::setThreshold):
5128         (JSC::ExecutionCounter::status):
5129         (JSC):
5130         * bytecode/ExecutionCounter.h:
5131         (JSC::ExecutionCounter::count):
5132         (ExecutionCounter):
5133         * dfg/DFGAbstractState.cpp:
5134         (JSC::DFG::AbstractState::execute):
5135         * dfg/DFGOperations.cpp:
5136         * dfg/DFGSpeculativeJIT.cpp:
5137         (JSC::DFG::SpeculativeJIT::compile):
5138         * jit/JITStubs.cpp:
5139         (JSC::DEFINE_STUB_FUNCTION):
5140         * llint/LLIntSlowPaths.cpp:
5141         (JSC::LLInt::jitCompileAndSetHeuristics):
5142         (JSC::LLInt::entryOSR):
5143         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
5144         * runtime/JSGlobalObject.cpp:
5145         (JSC::JSGlobalObject::JSGlobalObject):
5146         (JSC):
5147         * runtime/JSGlobalObject.h:
5148         (JSGlobalObject):
5149         (JSC::JSGlobalObject::weakRandomInteger):
5150         * runtime/Options.cpp:
5151         (Options):
5152         (JSC::Options::initializeOptions):
5153         * runtime/Options.h:
5154         (Options):
5155         * runtime/WeakRandom.h:
5156         (WeakRandom):
5157         (JSC::WeakRandom::seedUnsafe):
5158
5159 2012-06-25  Yong Li  <yoli@rim.com>
5160
5161         [BlackBerry] Add JSC statistics into about:memory
5162         https://bugs.webkit.org/show_bug.cgi?id=89779
5163
5164         Reviewed by Rob Buis.
5165
5166         Add MemoryStatistics.cpp into build, and fill JITBytes for BlackBerry port.
5167
5168         * PlatformBlackBerry.cmake:
5169         * runtime/MemoryStatistics.cpp:
5170         (JSC::globalMemoryStatistics):
5171
5172 2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
5173
5174         Unreviewed, rolling out r121058.
5175         http://trac.webkit.org/changeset/121058
5176         https://bugs.webkit.org/show_bug.cgi?id=89809
5177
5178         Patch causes plugins tests to crash in GTK debug builds
5179         (Requested by zdobersek on #webkit).
5180
5181         * API/APIShims.h:
5182         (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
5183         (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
5184         (APIEntryShimWithoutLock):
5185         (JSC::APIEntryShim::APIEntryShim):
5186         (APIEntryShim):
5187         (JSC::APICallbackShim::~APICallbackShim):
5188         * API/JSContextRef.cpp:
5189         (JSGlobalContextCreate):
5190         (JSGlobalContextCreateInGroup):
5191         (JSGlobalContextRelease):
5192         (JSContextCreateBacktrace):
5193         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
5194         * heap/CopiedSpace.cpp:
5195         (JSC::CopiedSpace::tryAllocateSlowCase):
5196         * heap/Heap.cpp:
5197         (JSC::Heap::protect):
5198         (JSC::Heap::unprotect):
5199         (JSC::Heap::collect):
5200         (JSC::Heap::setActivityCallback):
5201         (JSC::Heap::activityCallback):
5202         (JSC::Heap::sweeper):
5203         * heap/Heap.h:
5204         (Heap):
5205         * heap/HeapTimer.cpp:
5206         (JSC::HeapTimer::~HeapTimer):
5207         (JSC::HeapTimer::invalidate):
5208         (JSC::HeapTimer::timerDidFire):
5209         (JSC):
5210         * heap/HeapTimer.h:
5211         (HeapTimer):
5212         * heap/IncrementalSweeper.cpp:
5213         (JSC::IncrementalSweeper::doWork):
5214         (JSC::IncrementalSweeper::create):
5215         * heap/IncrementalSweeper.h:
5216         (IncrementalSweeper):
5217         * heap/MarkedAllocator.cpp:
5218         (JSC::MarkedAllocator::allocateSlowCase):
5219         * heap/WeakBlock.cpp:
5220         (JSC::WeakBlock::reap):
5221         * jsc.cpp:
5222         (functionGC):
5223         (functionReleaseExecutableMemory):
5224         (jscmain):
5225         * runtime/Completion.cpp:
5226         (JSC::checkSyntax):
5227         (JSC::evaluate):
5228         * runtime/GCActivityCallback.h:
5229         (DefaultGCActivityCallback):
5230         (JSC::DefaultGCActivityCallback::create):
5231         * runtime/JSGlobalData.cpp:
5232         (JSC::JSGlobalData::JSGlobalData):
5233         (JSC::JSGlobalData::~JSGlobalData):
5234         (JSC::JSGlobalData::sharedInstance):
5235         (JSC::JSGlobalData::sharedInstanceInternal):
5236         * runtime/JSGlobalData.h:
5237         (JSGlobalData):
5238         * runtime/JSGlobalObject.cpp:
5239         (JSC::JSGlobalObject::~JSGlobalObject):
5240         (JSC::JSGlobalObject::init):
5241         * runtime/JSLock.cpp:
5242         (JSC):
5243         (JSC::createJSLockCount):
5244         (JSC::JSLock::lockCount):
5245         (JSC::setLockCount):
5246         (JSC::JSLock::JSLock):
5247         (JSC::JSLock::lock):
5248         (JSC::JSLock::unlock):
5249         (JSC::JSLock::currentThreadIsHoldingLock):
5250         (JSC::JSLock::DropAllLocks::DropAllLocks):
5251         (JSC::JSLock::DropAllLocks::~DropAllLocks):
5252         * runtime/JSLock.h:
5253         (JSC):
5254         (JSLock):
5255         (JSC::JSLock::JSLock):
5256         (JSC::JSLock::~JSLock):
5257         (DropAllLocks):
5258         * runtime/WeakGCMap.h:
5259         (JSC::WeakGCMap::set):
5260         * testRegExp.cpp:
5261         (realMain):
5262
5263 2012-06-22  Alexandru Chiculita  <achicu@adobe.com>
5264
5265         [CSS Shaders] Re-enable the CSS Shaders compile time flag on Safari Mac
5266         https://bugs.webkit.org/show_bug.cgi?id=89781
5267
5268         Reviewed by Dean Jackson.
5269
5270         Added ENABLE_CSS_SHADERS flag as enabled by default on Safari for Mac.
5271
5272         * Configurations/FeatureDefines.xcconfig:
5273
5274 2012-06-22  Filip Pizlo  <fpizlo@apple.com>
5275
5276         DFG tier-up should happen in prologues, not epilogues
5277         https://bugs.webkit.org/show_bug.cgi?id=89752
5278
5279         Reviewed by Geoffrey Garen.
5280
5281         This change has two outcomes:
5282
5283         1) Slightly reduces the likelihood that a function will be optimized both
5284         standalone and via inlining.  Previously, if you had a call sequence like foo()
5285         calls bar() exactly once, and nobody else calls bar(), then bar() would get
5286         optimized first (because it returns first) and then foo() gets optimized.  If foo()
5287         can inline bar() then that means that bar() gets optimized twice.  But now, if we
5288         optimize in prologues, then foo() will be optimized first.  If it inlines bar(),
5289         that means that there will no longer be any calls to bar().
5290
5291         2) It lets us kill some code in JITStubs.  Epilogue tier-up was very different from
5292         loop tier-up, since epilogue tier-up should not attempt OSR.  But prologue tier-up
5293         requires OSR (albeit really easy OSR since it's the top of the compilation unit),
5294         so it becomes just like loop tier-up.  As a result, we now have one optimization
5295         hook (cti_optimize) instead of two (cti_optimize_from_loop and
5296         cti_optimize_from_ret).
5297
5298         As a consequence of not having an optimization check in epilogues, the OSR exit
5299         code must now trigger reoptimization itself instead of just signaling the epilogue
5300         check to fire.
5301
5302         This also adds the ability to count the number of DFG compilations, which was
5303         useful for debugging this patch and might be useful for other things in the future.
5304
5305         * bytecode/CodeBlock.cpp:
5306         (JSC::CodeBlock::reoptimize):
5307         (JSC):
5308         * bytecode/CodeBlock.h:
5309         (CodeBlock):
5310         * dfg/DFGByteCodeParser.cpp:
5311         (JSC::DFG::ByteCodeParser::parseCodeBlock):
5312         * dfg/DFGDriver.cpp:
5313         (DFG):
5314         (JSC::DFG::getNumCompilations):
5315         (JSC::DFG::compile):
5316         * dfg/DFGDriver.h:
5317         (DFG):
5318         * dfg/DFGOSRExitCompiler.cpp:
5319         (JSC::DFG::OSRExitCompiler::handleExitCounts):
5320         * dfg/DFGOperations.cpp:
5321         * dfg/DFGOperations.h:
5322         * jit/JIT.cpp:
5323         (JSC::JIT::emitOptimizationCheck):
5324         * jit/JIT.h:
5325         * jit/JITCall32_64.cpp:
5326         (JSC::JIT::emit_op_ret):
5327         (JSC::JIT::emit_op_ret_object_or_this):
5328         * jit/JITOpcodes.cpp:
5329         (JSC::JIT::emit_op_ret):
5330         (JSC::JIT::emit_op_ret_object_or_this):
5331         (JSC::JIT::emit_op_enter):
5332         * jit/JITOpcodes32_64.cpp:
5333         (JSC::JIT::emit_op_enter):
5334         * jit/JITStubs.cpp:
5335         (JSC::DEFINE_STUB_FUNCTION):
5336         * jit/JITStubs.h:
5337
5338 2012-06-20  Mark Hahnenberg  <mhahnenberg@apple.com>
5339
5340         JSLock should be per-JSGlobalData
5341         https://bugs.webkit.org/show_bug.cgi?id=89123
5342
5343         Reviewed by Gavin Barraclough.
5344
5345         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
5346         * API/APIShims.h:
5347         (APIEntryShimWithoutLock):
5348         (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to
5349         determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the
5350         HeapTimer class because timerDidFire could run after somebody has started to tear down that particular
5351         JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after
5352         its destruction has begun.
5353         (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock): Now derefs if it also refed.
5354         (JSC::APIEntryShim::APIEntryShim):
5355         (APIEntryShim):
5356         (JSC::APIEntryShim::~APIEntryShim):
5357         (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors.
5358         Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock
5359         and before we've released it, which can only done in APIEntryShim.
5360         (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here.
5361         * API/JSContextRef.cpp:
5362         (JSGlobalContextCreate):
5363         (JSGlobalContextCreateInGroup):
5364         (JSGlobalContextRelease):
5365         (JSContextCreateBacktrace):
5366         * heap/CopiedSpace.cpp:
5367         (JSC::CopiedSpace::tryAllocateSlowCase):
5368         * heap/Heap.cpp:
5369         (JSC::Heap::protect):
5370         (JSC::Heap::unprotect):
5371         (JSC::Heap::collect):
5372         (JSC::Heap::setActivityCallback):
5373         (JSC::Heap::activityCallback):
5374         (JSC::Heap::sweeper):
5375         * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they
5376         are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback
5377         and the IncrementalSweeper to make sure they're the last things that get initialized during construction to
5378         prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about.
5379         (Heap):
5380         * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown.
5381         (JSC::HeapTimer::~HeapTimer):
5382         (JSC::HeapTimer::invalidate):
5383         (JSC):
5384         (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread
5385         that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the
5386         HeapTimer and schedule it to fire immediately so that it can notice and kill itself.
5387         (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed
5388         out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim,
5389         but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case
5390         we were interrupted between releasing our mutex and trying to grab the APILock.
5391         * heap/HeapTimer.h:
5392         (HeapTimer):
5393         * heap/IncrementalSweeper.cpp:
5394         (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles
5395         all of that for us.
5396         (JSC::IncrementalSweeper::create):
5397         * heap/IncrementalSweeper.h:
5398         (IncrementalSweeper):
5399         * heap/MarkedAllocator.cpp:
5400         (JSC::MarkedAllocator::allocateSlowCase):
5401         * heap/WeakBlock.cpp:
5402         (JSC::WeakBlock::reap):
5403         * jsc.cpp:
5404         (functionGC):
5405         (functionReleaseExecutableMemory):
5406         (jscmain):
5407         * runtime/Completion.cpp:
5408         (JSC::checkSyntax):
5409         (JSC::evaluate):
5410         * runtime/GCActivityCallback.h:
5411         (DefaultGCActivityCallback):
5412         (JSC::DefaultGCActivityCallback::create):
5413         * runtime/JSGlobalData.cpp:
5414         (JSC::JSGlobalData::JSGlobalData):
5415         (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper)
5416         that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity
5417         it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the
5418         APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes.
5419         (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock.
5420         (JSC::JSGlobalData::sharedInstanceInternal):
5421         * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and
5422         de-refing JSGlobalDatas on separate threads since we don't do it that often anyways.
5423         (JSGlobalData):
5424         (JSC::JSGlobalData::apiLock):
5425         * runtime/JSGlobalObject.cpp:
5426         (JSC::JSGlobalObject::~JSGlobalObject):
5427         (JSC::JSGlobalObject::init):
5428         * runtime/JSLock.cpp:
5429         (JSC):
5430         (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance.
5431         (JSC::GlobalJSLock::~GlobalJSLock):
5432         (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that
5433         it can successfully unlock it later without it disappearing from underneath it.
5434         (JSC::JSLockHolder::~JSLockHolder):
5435         (JSC::JSLock::JSLock):
5436         (JSC::JSLock::~JSLock):
5437         (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for
5438         actually waiting for long periods.
5439         (JSC::JSLock::unlock):
5440         (JSC::JSLock::currentThreadIsHoldingLock):
5441         (JSC::JSLock::dropAllLocks):
5442         (JSC::JSLock::dropAllLocksUnconditionally):
5443         (JSC::JSLock::grabAllLocks):
5444         (JSC::JSLock::DropAllLocks::DropAllLocks):
5445         (JSC::JSLock::DropAllLocks::~DropAllLocks):
5446         * runtime/JSLock.h:
5447         (JSC):
5448         (GlobalJSLock):
5449         (JSLockHolder):
5450         (JSLock):
5451         (DropAllLocks):
5452         * runtime/WeakGCMap.h:
5453         (JSC::WeakGCMap::set):
5454         * testRegExp.cpp:
5455         (realMain):
5456
5457 2012-06-22  Peter Beverloo  <peter@chromium.org>
5458
5459         [Chromium] Disable c++0x compatibility warnings in JavaScriptCore.gyp when building for Android
5460         https://bugs.webkit.org/show_bug.cgi?id=88853
5461
5462         Reviewed by Steve Block.
5463
5464         The Android exclusions were necessary to fix a gyp generation error, as
5465         the gcc_version variable wasn't being defined for Android. Remove these
5466         exceptions when Chromium is able to define the gcc_version variable.
5467
5468         * JavaScriptCore.gyp/JavaScriptCore.gyp:
5469
5470 2012-06-21  Filip Pizlo  <fpizlo@apple.com>
5471
5472         op_resolve_global should not prevent DFG inlining
5473         https://bugs.webkit.org/show_bug.cgi?id=89726
5474
5475         Reviewed by Gavin Barraclough.
5476
5477         * bytecode/CodeBlock.cpp:
5478         (JSC::CodeBlock::CodeBlock):
5479         (JSC::CodeBlock::shrinkToFit):
5480         * bytecode/GlobalResolveInfo.h:
5481         (JSC::GlobalResolveInfo::GlobalResolveInfo):
5482         (GlobalResolveInfo):
5483         * dfg/DFGByteCodeParser.cpp:
5484         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
5485         * dfg/DFGCapabilities.h:
5486         (JSC::DFG::canInlineOpcode):
5487         * dfg/DFGOperations.cpp:
5488         * dfg/DFGOperations.h:
5489         * dfg/DFGSpeculativeJIT.h:
5490         (JSC::DFG::SpeculativeJIT::callOperation):
5491         * dfg/DFGSpeculativeJIT32_64.cpp:
5492         (JSC::DFG::SpeculativeJIT::compile):
5493         * dfg/DFGSpeculativeJIT64.cpp:
5494         (JSC::DFG::SpeculativeJIT::compile):
5495
5496 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5497
5498         DFG should inline 'new Array()'
5499         https://bugs.webkit.org/show_bug.cgi?id=89632
5500
5501         Reviewed by Geoffrey Garen.
5502
5503         This adds support for treating InternalFunction like intrinsics. The code
5504         to do so is actually quite clean, so I don't feel bad about perpetuating
5505         the InternalFunction vs. JSFunction-with-NativeExecutable dichotomy.
5506
5507         Currently this newfound power is only used to inline 'new Array()'.
5508
5509         * dfg/DFGByteCodeParser.cpp:
5510         (ByteCodeParser):
5511         (JSC::DFG::ByteCodeParser::handleCall):
5512         (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
5513         (DFG):
5514         * dfg/DFGGraph.h:
5515         (JSC::DFG::Graph::isInternalFunctionConstant):
5516         (JSC::DFG::Graph::valueOfInternalFunctionConstant):
5517
5518 2012-06-21  Mark Hahnenberg  <mhahnenberg@apple.com>
5519
5520         Adding copyrights to new files.
5521
5522         * heap/HeapTimer.cpp:
5523         * heap/HeapTimer.h:
5524         * heap/IncrementalSweeper.cpp:
5525         * heap/IncrementalSweeper.h:
5526
5527 2012-06-21  Arnaud Renevier  <arno@renevier.net>
5528
5529         make sure headers are included only once per file
5530         https://bugs.webkit.org/show_bug.cgi?id=88922
5531
5532         Reviewed by Alexey Proskuryakov.
5533
5534         * bytecode/CodeBlock.h:
5535         * heap/MachineStackMarker.cpp:
5536         * runtime/JSVariableObject.h:
5537
5538 2012-06-21  Ryuan Choi  <ryuan.choi@gmail.com>
5539
5540         [EFL][WK2] Make WebKit2/Efl headers and resources installable.
5541         https://bugs.webkit.org/show_bug.cgi?id=88207
5542
5543         Reviewed by Chang Shu.
5544
5545         * shell/CMakeLists.txt: Use ${EXEC_INSTALL_DIR} instead of hardcoding "bin"
5546
5547 2012-06-20  Geoffrey Garen  <ggaren@apple.com>
5548
5549         Reduced (but did not eliminate) use of "berzerker GC"
5550         https://bugs.webkit.org/show_bug.cgi?id=89237
5551
5552         Reviewed by Gavin Barraclough.
5553
5554         (PART 1)
5555
5556         This patch turned out to be crashy, so I'm landing the non-crashy bits
5557         first.
5558
5559         This part is pre-requisite refactoring. I didn't actually turn off
5560         "berzerker GC" or turn on incremental shrinking.
5561
5562         * heap/MarkedAllocator.cpp:
5563         (JSC::MarkedAllocator::removeBlock): Make sure to clear the free list when
5564         we throw away the block we're currently allocating out of. Otherwise, we'll
5565         allocate out of a stale free list.
5566
5567         * heap/MarkedSpace.cpp:
5568         (JSC::Free::Free):
5569         (JSC::Free::operator()):
5570         (JSC::Free::returnValue): Refactored this functor to use a shared helper
5571         function, so we can share our implementation with the incremental sweeper.
5572
5573         Also changed to freeing individual blocks immediately instead of linking
5574         them into a list for later freeing. This makes the programming interface
5575         simpler, and it's slightly more efficient to boot.
5576
5577         (JSC::MarkedSpace::~MarkedSpace): Updated for rename.
5578
5579         (JSC::MarkedSpace::freeBlock):
5580         (JSC::MarkedSpace::freeOrShrinkBlock): New helper functions to share behavior
5581         with the incremental sweeper.
5582
5583         (JSC::MarkedSpace::shrink): Updated for new functor behavior.
5584
5585         * heap/MarkedSpace.h: Statically typed languages are awesome.
5586
5587 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5588
5589         DFG should optimize ResolveGlobal
5590         https://bugs.webkit.org/show_bug.cgi?id=89617
5591
5592         Reviewed by Oliver Hunt.
5593
5594         This adds inlining of ResolveGlobal accesses that are known monomorphic. It also
5595         adds the specific function optimization to ResolveGlobal, when it is inlined. And,
5596         it makes internal functions act like specific functions, since that will be the
5597         most common use-case of this optimization.
5598
5599         This is only a slighy speed-up (sub 1%), since we don't yet do the obvious thing
5600         with this optimization, which is to completely inline common "globally resolved"
5601         function and constructor calls, like "new Array()".
5602
5603         * CMakeLists.txt:
5604         * GNUmakefile.list.am:
5605         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
5606         * JavaScriptCore.xcodeproj/project.pbxproj:
5607         * Target.pri:
5608         * bytecode/CodeBlock.cpp:
5609         (JSC::CodeBlock::globalResolveInfoForBytecodeOffset):
5610         * bytecode/CodeBlock.h:
5611         (CodeBlock):
5612         (JSC::CodeBlock::numberOfGlobalResolveInfos):
5613         * bytecode/GlobalResolveInfo.h:
5614         (JSC::getGlobalResolveInfoBytecodeOffset):
5615         (JSC):
5616         * bytecode/ResolveGlobalStatus.cpp: Added.
5617         (JSC):
5618         (JSC::computeForStructure):
5619         (JSC::computeForLLInt):
5620         (JSC::ResolveGlobalStatus::computeFor):
5621         * bytecode/ResolveGlobalStatus.h: Added.
5622         (JSC):
5623         (ResolveGlobalStatus):
5624         (JSC::ResolveGlobalStatus::ResolveGlobalStatus):
5625         (JSC::ResolveGlobalStatus::state):
5626         (JSC::ResolveGlobalStatus::isSet):
5627         (JSC::ResolveGlobalStatus::operator!):
5628         (JSC::ResolveGlobalStatus::isSimple):
5629         (JSC::ResolveGlobalStatus::takesSlowPath):
5630         (JSC::ResolveGlobalStatus::structure):
5631         (JSC::ResolveGlobalStatus::offset):
5632         (JSC::ResolveGlobalStatus::specificValue):
5633         * dfg/DFGByteCodeParser.cpp:
5634         (ByteCodeParser):
5635         (JSC::DFG::ByteCodeParser::handleGetByOffset):
5636         (DFG):
5637         (JSC::DFG::ByteCodeParser::handleGetById):
5638         (JSC::DFG::ByteCodeParser::parseBlock):
5639         * runtime/JSObject.cpp:
5640         (JSC::getCallableObjectSlow):
5641         (JSC):
5642         (JSC::JSObject::put):
5643         (JSC::JSObject::putDirectVirtual):
5644         (JSC::JSObject::putDirectAccessor):
5645         * runtime/JSObject.h:
5646         (JSC):
5647         (JSC::getCallableObject):
5648         (JSC::JSObject::putOwnDataProperty):
5649         (JSC::JSObject::putDirect):
5650         (JSC::JSObject::putDirectWithoutTransition):
5651
5652 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5653
5654         Functions on global objects should be specializable
5655         https://bugs.webkit.org/show_bug.cgi?id=89615
5656
5657         Reviewed by Oliver Hunt.
5658
5659         I tested to see if this brought back the bug in https://bugs.webkit.org/show_bug.cgi?id=33343,
5660         and it didn't. Bug 33343 was the reason why we disabled global object function specialization
5661         to begin with. So I'm guessing this is safe.
5662
5663         * runtime/JSGlobalObject.cpp:
5664         (JSC::JSGlobalObject::init):
5665
5666 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5667
5668         build-webkit failure due to illegal 32-bit integer constants in code
5669         generated by offlineasm
5670         https://bugs.webkit.org/show_bug.cgi?id=89347
5671
5672         Reviewed by Geoffrey Garen.
5673
5674         The offending constants are the magic numbers used by offlineasm to find
5675         offsets in the generated machine code. Added code to turn them into what
5676         the C++ compiler will believe to be valid 32-bit values.
5677
5678         * offlineasm/offsets.rb:
5679
5680 2012-06-19  Geoffrey Garen  <ggaren@apple.com>
5681
5682         Made the incremental sweeper more aggressive
5683         https://bugs.webkit.org/show_bug.cgi?id=89527
5684
5685         Reviewed by Oliver Hunt.
5686
5687         This is a pre-requisite to getting rid of "berzerker GC" because we need
5688         the sweeper to reclaim memory in a timely fashion, or we'll see a memory
5689         footprint regression.
5690
5691         * heap/IncrementalSweeper.h:
5692         * heap/IncrementalSweeper.cpp:
5693         (JSC::IncrementalSweeper::scheduleTimer): Since the time slice is predictable,
5694         no need to use a data member to record it.
5695
5696         (JSC::IncrementalSweeper::doSweep): Sweep as many blocks as we can in a
5697         small time slice. This is better than sweeping only one block per timer
5698         fire because that strategy has a heavy timer overhead, and artificially
5699         delays memory reclamation.
5700
5701 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5702
5703         DFG should be able to print disassembly interleaved with the IR
5704         https://bugs.webkit.org/show_bug.cgi?id=89551
5705
5706         Reviewed by Geoffrey Garen.
5707
5708         This change also removes running Dominators unconditionally on every DFG
5709         compile. Dominators are designed to be computed on-demand, and currently
5710         the only demand is graph dumps.
5711
5712         * CMakeLists.txt:
5713         * GNUmakefile.list.am:
5714         * JavaScriptCore.xcodeproj/project.pbxproj:
5715         * Target.pri:
5716         * assembler/ARMv7Assembler.h:
5717         (JSC::ARMv7Assembler::labelIgnoringWatchpoints):
5718         (ARMv7Assembler):
5719         * assembler/AbstractMacroAssembler.h:
5720         (AbstractMacroAssembler):
5721         (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints):
5722         * assembler/X86Assembler.h:
5723         (X86Assembler):
5724         (JSC::X86Assembler::labelIgnoringWatchpoints):
5725         * dfg/DFGCommon.h:
5726         (JSC::DFG::shouldShowDisassembly):
5727         (DFG):
5728         * dfg/DFGDisassembler.cpp: Added.
5729         (DFG):
5730         (JSC::DFG::Disassembler::Disassembler):
5731         (JSC::DFG::Disassembler::dump):
5732         (JSC::DFG::Disassembler::dumpDisassembly):
5733         * dfg/DFGDisassembler.h: Added.
5734         (DFG):
5735         (Disassembler):
5736         (JSC::DFG::Disassembler::setStartOfCode):
5737         (JSC::DFG::Disassembler::setForBlock):
5738         (JSC::DFG::Disassembler::setForNode):
5739         (JSC::DFG::Disassembler::setEndOfMainPath):
5740         (JSC::DFG::Disassembler::setEndOfCode):
5741         * dfg/DFGDriver.cpp:
5742         (JSC::DFG::compile):
5743         * dfg/DFGGraph.cpp:
5744         (JSC::DFG::Graph::dumpCodeOrigin):
5745         (JSC::DFG::Graph::amountOfNodeWhiteSpace):
5746         (DFG):
5747         (JSC::DFG::Graph::printNodeWhiteSpace):
5748         (JSC::DFG::Graph::dump):
5749         (JSC::DFG::Graph::dumpBlockHeader):
5750         * dfg/DFGGraph.h:
5751         * dfg/DFGJITCompiler.cpp:
5752         (JSC::DFG::JITCompiler::JITCompiler):
5753         (DFG):
5754         (JSC::DFG::JITCompiler::compile):
5755         (JSC::DFG::JITCompiler::compileFunction):
5756         * dfg/DFGJITCompiler.h:
5757         (JITCompiler):
5758         (JSC::DFG::JITCompiler::setStartOfCode):
5759         (JSC::DFG::JITCompiler::setForBlock):
5760         (JSC::DFG::JITCompiler::setForNode):
5761         (JSC::DFG::JITCompiler::setEndOfMainPath):
5762         (JSC::DFG::JITCompiler::setEndOfCode):
5763         * dfg/DFGNode.h:
5764         (Node):
5765         (JSC::DFG::Node::willHaveCodeGen):
5766         * dfg/DFGNodeFlags.cpp:
5767         (JSC::DFG::nodeFlagsAsString):
5768         * dfg/DFGSpeculativeJIT.cpp:
5769         (JSC::DFG::SpeculativeJIT::compile):
5770         * dfg/DFGSpeculativeJIT.h:
5771         (SpeculativeJIT):
5772         * runtime/Options.cpp:
5773         (Options):
5774         (JSC::Options::initializeOptions):
5775         * runtime/Options.h:
5776         (Options):
5777
5778 2012-06-19  Filip Pizlo  <fpizlo@apple.com>
5779
5780         JSC should be able to show disassembly for all generated JIT code
5781         https://bugs.webkit.org/show_bug.cgi?id=89536
5782
5783         Reviewed by Gavin Barraclough.
5784
5785         Now instead of doing linkBuffer.finalizeCode(), you do
5786         FINALIZE_CODE(linkBuffer, (... explanation ...)). FINALIZE_CODE() then
5787         prints your explanation and the disassembled code, if
5788         Options::showDisassembly is set to true.
5789
5790         * CMakeLists.txt:
5791         * GNUmakefile.list.am:
5792         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
5793         * JavaScriptCore.xcodeproj/project.pbxproj:
5794         * Target.pri:
5795         * assembler/LinkBuffer.cpp: Added.
5796         (JSC):
5797         (JSC::LinkBuffer::finalizeCodeWithoutDisassembly):
5798         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
5799         (JSC::LinkBuffer::linkCode):
5800         (JSC::LinkBuffer::performFinalization):
5801         (JSC::LinkBuffer::dumpLinkStatistics):
5802         (JSC::LinkBuffer::dumpCode):
5803         * assembler/LinkBuffer.h:
5804         (LinkBuffer):
5805         (JSC):
5806         * assembler/MacroAssemblerCodeRef.h:
5807         (JSC::MacroAssemblerCodeRef::tryToDisassemble):
5808         (MacroAssemblerCodeRef):
5809         * dfg/DFGJITCompiler.cpp:
5810         (JSC::DFG::JITCompiler::compile):
5811         (JSC::DFG::JITCompiler::compileFunction):
5812         * dfg/DFGOSRExitCompiler.cpp:
5813         * dfg/DFGRepatch.cpp:
5814         (JSC::DFG::generateProtoChainAccessStub):
5815         (JSC::DFG::tryCacheGetByID):
5816         (JSC::DFG::tryBuildGetByIDList):
5817         (JSC::DFG::emitPutReplaceStub):
5818         (JSC::DFG::emitPutTransitionStub):
5819         * dfg/DFGThunks.cpp:
5820         (JSC::DFG::osrExitGenerationThunkGenerator):
5821         * disassembler/Disassembler.h:
5822         (JSC):
5823         (JSC::tryToDisassemble):
5824         * disassembler/UDis86Disassembler.cpp:
5825         (JSC::tryToDisassemble):
5826         * jit/JIT.cpp:
5827         (JSC::JIT::privateCompile):
5828         * jit/JITCode.h:
5829         (JSC::JITCode::tryToDisassemble):
5830         * jit/JITOpcodes.cpp:
5831         (JSC::JIT::privateCompileCTIMachineTrampolines):
5832         * jit/JITOpcodes32_64.cpp:
5833         (JSC::JIT::privateCompileCTIMachineTrampolines):
5834         (JSC::JIT::privateCompileCTINativeCall):
5835         * jit/JITPropertyAccess.cpp:
5836         (JSC::JIT::stringGetByValStubGenerator):
5837         (JSC::JIT::privateCompilePutByIdTransition):
5838         (JSC::JIT::privateCompilePatchGetArrayLength):
5839         (JSC::JIT::privateCompileGetByIdProto):
5840         (JSC::JIT::privateCompileGetByIdSelfList):
5841         (JSC::JIT::privateCompileGetByIdProtoList):
5842         (JSC::JIT::privateCompileGetByIdChainList):
5843         (JSC::JIT::privateCompileGetByIdChain):
5844         * jit/JITPropertyAccess32_64.cpp:
5845         (JSC::JIT::stringGetByValStubGenerator):
5846         (JSC::JIT::privateCompilePutByIdTransition):
5847         (JSC::JIT::privateCompilePatchGetArrayLength):
5848         (JSC::JIT::privateCompileGetByIdProto):
5849         (JSC::JIT::privateCompileGetByIdSelfList):
5850         (JSC::JIT::privateCompileGetByIdProtoList):
5851         (JSC::JIT::privateCompileGetByIdChainList):
5852         (JSC::JIT::privateCompileGetByIdChain):
5853         * jit/SpecializedThunkJIT.h:
5854         (JSC::SpecializedThunkJIT::finalize):
5855         * jit/ThunkGenerators.cpp:
5856         (JSC::charCodeAtThunkGenerator):
5857         (JSC::charAtThunkGenerator):
5858         (JSC::fromCharCodeThunkGenerator):
5859         (JSC::sqrtThunkGenerator):
5860         (JSC::floorThunkGenerator):
5861         (JSC::ceilThunkGenerator):
5862         (JSC::roundThunkGenerator):
5863         (JSC::expThunkGenerator):
5864         (JSC::logThunkGenerator):
5865         (JSC::absThunkGenerator):
5866         (JSC::powThunkGenerator):
5867         * llint/LLIntThunks.cpp:
5868         (JSC::LLInt::generateThunkWithJumpTo):
5869         (JSC::LLInt::functionForCallEntryThunkGenerator):
5870         (JSC::LLInt::functionForConstructEntryThunkGenerator):
5871         (JSC::LLInt::functionForCallArityCheckThunkGenerator):
5872         (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
5873         (JSC::LLInt::evalEntryThunkGenerator):
5874         (JSC::LLInt::programEntryThunkGenerator):
5875         * runtime/Options.cpp:
5876         (Options):
5877         (JSC::Options::initializeOptions):
5878         * runtime/Options.h:
5879         (Options):
5880         * yarr/YarrJIT.cpp:
5881         (JSC::Yarr::YarrGenerator::compile):
5882
5883 2012-06-19  Mark Hahnenberg  <mhahnenberg@apple.com>
5884
5885         [Qt][Mac] REGRESSION(r120742): It broke the build
5886         https://bugs.webkit.org/show_bug.cgi?id=89516
5887
5888         Reviewed by Geoffrey Garen.
5889
5890         Removing GCActivityCallbackCF.cpp because it doesn't mesh well with cross-platform
5891         code on Darwin (e.g. Qt). We now use plain ol' vanilla ifdefs to handle platforms
5892         without CF support. These if-defs will probably disappear in the future when we
5893         use cross-platform timers in HeapTimer.
5894
5895         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
5896         * JavaScriptCore.xcodeproj/project.pbxproj:
5897         * runtime/GCActivityCallback.cpp:
5898         (JSC):
5899         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
5900         (JSC::DefaultGCActivityCallback::doWork):
5901         (JSC::DefaultGCActivityCallback::scheduleTimer):
5902         (JSC::DefaultGCActivityCallback::cancelTimer):
5903         (JSC::DefaultGCActivityCallback::didAllocate):
5904         (JSC::DefaultGCActivityCallback::willCollect):
5905         (JSC::DefaultGCActivityCallback::cancel):
5906         * runtime/GCActivityCallbackCF.cpp: Removed.
5907
5908 2012-06-19  Filip Pizlo  <fpizlo@apple.com>
5909
5910         DFG CFA forgets to notify subsequent phases of found constants if it proves LogicalNot to be a constant
5911         https://bugs.webkit.org/show_bug.cgi?id=89511
5912         <rdar://problem/11700089>
5913
5914         Reviewed by Geoffrey Garen.
5915
5916         * dfg/DFGAbstractState.cpp:
5917         (JSC::DFG::AbstractState::execute):
5918
5919 2012-06-19  Mark Lam  <mark.lam@apple.com>
5920
5921         CodeBlock::needsCallReturnIndices() is no longer needed.
5922         https://bugs.webkit.org/show_bug.cgi?id=89490
5923
5924         Reviewed by Geoffrey Garen.
5925
5926         * bytecode/CodeBlock.h:
5927         (JSC::CodeBlock::needsCallReturnIndices): removed.
5928         * dfg/DFGJITCompiler.cpp:
5929         (JSC::DFG::JITCompiler::link):
5930         * jit/JIT.cpp:
5931         (JSC::JIT::privateCompile):
5932
5933 2012-06-19  Filip Pizlo  <fpizlo@apple.com>
5934
5935         Unreviewed, try to fix Windows build.
5936
5937         * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
5938
5939 2012-06-17  Filip Pizlo  <fpizlo@apple.com>
5940
5941         It should be possible to look at disassembly
5942         https://bugs.webkit.org/show_bug.cgi?id=89319
5943
5944         Reviewed by Sam Weinig.
5945
5946         This imports the udis86 disassembler library. The library is placed
5947         behind an abstraction in disassembler/Disassembler.h, so that we can
5948         in the future use other disassemblers (for other platforms) whenever
5949         appropriate. As a first step, the disassembler is being invoked for
5950         DFG verbose dumps.
5951
5952         If we ever want to merge a new version of udis86 in the future, I've
5953         made notes about changes I made to the library in
5954         disassembler/udis86/differences.txt.
5955
5956         * CMakeLists.txt:
5957         * DerivedSources.make:
5958         * GNUmakefile.list.am:
5959         * JavaScriptCore.pri:
5960         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
5961         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
5962         * JavaScriptCore.xcodeproj/project.pbxproj:
5963         * dfg/DFGJITCompiler.cpp:
5964         (JSC::DFG::JITCompiler::compile):
5965         (JSC::DFG::JITCompiler::compileFunction):
5966         * disassembler: Added.
5967         * disassembler/Disassembler.h: Added.
5968         (JSC):
5969         (JSC::tryToDisassemble):
5970         * disassembler/UDis86Disassembler.cpp: Added.
5971         (JSC):
5972         (JSC::tryToDisassemble):
5973         * disassembler/udis86: Added.
5974         * disassembler/udis86/differences.txt: Added.
5975         * disassembler/udis86/itab.py: Added.
5976         (UdItabGenerator):
5977         (UdItabGenerator.__init__):
5978         (UdItabGenerator.toGroupId):
5979         (UdItabGenerator.genLookupTable):
5980         (UdItabGenerator.genLookupTableList):
5981         (UdItabGenerator.genInsnTable):
5982         (genItabH):
5983         (genItabH.UD_ITAB_H):
5984         (genItabC):
5985         (genItab):
5986         (main):
5987         * disassembler/udis86/optable.xml: Added.
5988         * disassembler/udis86/ud_opcode.py: Added.
5989         (UdOpcodeTables):
5990         (UdOpcodeTables.sizeOfTable):
5991         (UdOpcodeTables.nameOfTable):
5992         (UdOpcodeTables.updateTable):
5993         (UdOpcodeTables.Insn):
5994         (UdOpcodeTables.Insn.__init__):
5995         (UdOpcodeTables.Insn.__init__.opcode):
5996         (UdOpcodeTables.parse):
5997         (UdOpcodeTables.addInsnDef):
5998         (UdOpcodeTables.print_table):
5999         (UdOpcodeTables.print_tree):
6000         * disassembler/udis86/ud_optable.py: Added.
6001         (UdOptableXmlParser):
6002         (UdOptableXmlParser.parseDef):
6003         (UdOptableXmlParser.parse):
6004         (printFn):
6005         (parse):
6006         (main):
6007         * disassembler/udis86/udis86.c: Added.
6008         (ud_init):
6009         (ud_disassemble):
6010         (ud_set_mode):
6011         (ud_set_vendor):
6012         (ud_set_pc):
6013         (ud):
6014         (ud_insn_asm):
6015         (ud_insn_off):
6016         (ud_insn_hex):
6017         (ud_insn_ptr):
6018         (ud_insn_len):
6019         * disassembler/udis86/udis86.h: Added.
6020         * disassembler/udis86/udis86_decode.c: Added.
6021         (eff_adr_mode):
6022         (ud_lookup_mnemonic):
6023         (decode_prefixes):
6024         (modrm):
6025         (resolve_operand_size):
6026         (resolve_mnemonic):
6027         (decode_a):
6028         (decode_gpr):
6029         (resolve_gpr64):
6030         (resolve_gpr32):
6031         (resolve_reg):
6032         (decode_imm):
6033         (decode_modrm_reg):
6034         (decode_modrm_rm):
6035         (decode_o):
6036         (decode_operand):
6037         (decode_operands):
6038         (clear_insn):
6039         (resolve_mode):
6040         (gen_hex):
6041         (decode_insn):
6042         (decode_3dnow):
6043         (decode_ssepfx):
6044         (decode_ext):
6045         (decode_opcode):
6046         (ud_decode):
6047         * disassembler/udis86/udis86_decode.h: Added.
6048         (ud_itab_entry_operand):
6049         (ud_itab_entry):
6050         (ud_lookup_table_list_entry):
6051         (sse_pfx_idx):
6052         (mode_idx):
6053         (modrm_mod_idx):
6054         (vendor_idx):
6055         (is_group_ptr):
6056         (group_idx):
6057         * disassembler/udis86/udis86_extern.h: Added.
6058         * disassembler/udis86/udis86_input.c: Added.
6059         (inp_buff_hook):
6060         (inp_file_hook):
6061         (ud):
6062         (ud_set_user_opaque_data):
6063         (ud_get_user_opaque_data):
6064         (ud_set_input_buffer):
6065         (ud_set_input_file):
6066         (ud_input_skip):
6067         (ud_input_end):
6068         (ud_inp_next):
6069         (ud_inp_back):
6070         (ud_inp_peek):
6071         (ud_inp_move):
6072         (ud_inp_uint8):
6073         (ud_inp_uint16):
6074         (ud_inp_uint32):
6075         (ud_inp_uint64):
6076         * disassembler/udis86/udis86_input.h: Added.
6077         * disassembler/udis86/udis86_itab_holder.c: Added.
6078         * disassembler/udis86/udis86_syn-att.c: Added.
6079         (opr_cast):
6080         (gen_operand):
6081         (ud_translate_att):
6082         * disassembler/udis86/udis86_syn-intel.c: Added.
6083         (opr_cast):
6084         (gen_operand):
6085         (ud_translate_intel):
6086         * disassembler/udis86/udis86_syn.c: Added.
6087         * disassembler/udis86/udis86_syn.h: Added.
6088         (mkasm):
6089         * disassembler/udis86/udis86_types.h: Added.
6090         (ud_operand):
6091         (ud):
6092         * jit/JITCode.h:
6093         (JITCode):
6094         (JSC::JITCode::tryToDisassemble):
6095
6096 2012-06-19  Mark Hahnenberg  <mhahnenberg@apple.com>
6097
6098         GCActivityCallback and IncrementalSweeper should share code
6099         https://bugs.webkit.org/show_bug.cgi?id=89400
6100
6101         Reviewed by Geoffrey Garen.
6102
6103         A lot of functionality is duplicated between GCActivityCallback and IncrementalSweeper.
6104         We should extract the common functionality out into a separate class that both of them
6105         can inherit from. This refactoring will be an even greater boon when we add the ability
6106         to shut these two agents down in a thread-safe fashion
6107
6108         * CMakeLists.txt:
6109         * GNUmakefile.list.am:
6110         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6111         * JavaScriptCore.xcodeproj/project.pbxproj:
6112         * Target.pri:
6113         * heap/Heap.cpp:
6114         (JSC::Heap::Heap): Move initialization down so that the JSGlobalData has a valid Heap when
6115         we're initializing the GCActivityCallback and the IncrementalSweeper.
6116         * heap/Heap.h:
6117         (Heap):
6118         * heap/HeapTimer.cpp: Added.
6119         (JSC):
6120         (JSC::HeapTimer::HeapTimer): Initialize the various base class data that
6121         DefaultGCActivityCallback::commonConstructor() used to do.
6122         (JSC::HeapTimer::~HeapTimer): Call to invalidate().
6123         (JSC::HeapTimer::synchronize): Same functionality as the old DefaultGCActivityCallback::synchronize().
6124         Virtual so that non-CF subclasses can override.
6125         (JSC::HeapTimer::invalidate): Tears down the runloop timer to prevent any future firing.
6126         (JSC::HeapTimer::timerDidFire): Callback to pass to the timer function. Casts and calls the virtual doWork().
6127         * heap/HeapTimer.h: Added. This is the class that serves as the common base class for
6128         both GCActivityCallback and IncrementalSweeper. It handles setting up and tearing down run loops and synchronizing
6129         across threads for its subclasses.
6130         (JSC):
6131         (HeapTimer):
6132         * heap/IncrementalSweeper.cpp: Changes to accomodate the extraction of common functionality
6133         between IncrementalSweeper and GCActivityCallback into a common ancestor.
6134         (JSC):
6135         (JSC::IncrementalSweeper::doWork):
6136         (JSC::IncrementalSweeper::IncrementalSweeper):
6137         (JSC::IncrementalSweeper::cancelTimer):
6138         (JSC::IncrementalSweeper::create):
6139         * heap/IncrementalSweeper.h:
6140         (IncrementalSweeper):
6141         * runtime/GCActivityCallback.cpp:
6142         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
6143         (JSC::DefaultGCActivityCallback::doWork):
6144         * runtime/GCActivityCallback.h:
6145         (GCActivityCallback):
6146         (JSC::GCActivityCallback::willCollect):
6147         (JSC::GCActivityCallback::GCActivityCallback):
6148         (JSC):
6149         (DefaultGCActivityCallback): Remove the platform data struct. The platform data should be kept in
6150         the class itself so as to be accessible by doWork(). Most of the platform data for CF is kept in
6151         HeapTimer anyways, so we only need the m_delay field now.
6152         * runtime/GCActivityCallbackBlackBerry.cpp:
6153         (JSC):
6154         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
6155         (JSC::DefaultGCActivityCallback::doWork):
6156         (JSC::DefaultGCActivityCallback::didAllocate):
6157         * runtime/GCActivityCallbackCF.cpp:
6158         (JSC):
6159         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
6160         (JSC::DefaultGCActivityCallback::doWork):
6161         (JSC::DefaultGCActivityCallback::scheduleTimer):
6162         (JSC::DefaultGCActivityCallback::cancelTimer):
6163         (JSC::DefaultGCActivityCallback::didAllocate):
6164         (JSC::DefaultGCActivityCallback::willCollect):
6165         (JSC::DefaultGCActivityCallback::cancel):
6166
6167
6168 2012-06-19  Mike West  <mkwst@chromium.org>
6169
6170         Introduce ENABLE_CSP_NEXT configuration flag.
6171         https://bugs.webkit.org/show_bug.cgi?id=89300
6172
6173         Reviewed by Adam Barth.
6174
6175         The 1.0 draft of the Content Security Policy spec is just about to
6176         move to Last Call. We'll hide work on the upcoming 1.1 spec behind
6177         this ENABLE flag, disabled by default.
6178
6179         Spec: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html
6180
6181         * Configurations/FeatureDefines.xcconfig:
6182
6183 2012-06-18  Mark Lam  <mark.lam@apple.com>
6184
6185         Changed JSC to always record line number information so that error.stack
6186         and window.onerror() can report proper line numbers.
6187         https://bugs.webkit.org/show_bug.cgi?id=89410
6188
6189         Reviewed by Geoffrey Garen.
6190
6191         * bytecode/CodeBlock.cpp:
6192         (JSC::CodeBlock::CodeBlock):
6193         (JSC::CodeBlock::lineNumberForBytecodeOffset):
6194         (JSC::CodeBlock::shrinkToFit): m_lineInfo is now available unconditionally.
6195
6196         * bytecode/CodeBlock.h:
6197         (JSC::CodeBlock::addLineInfo):
6198         (JSC::CodeBlock::hasLineInfo): Unused.  Now removed.
6199         (JSC::CodeBlock::needsCallReturnIndices):
6200         (CodeBlock):
6201         (RareData):  Hoisted m_lineInfo out of m_rareData.  m_lineInfo is now
6202         filled in unconditionally.
6203
6204         * bytecompiler/BytecodeGenerator.h:
6205         (JSC::BytecodeGenerator::addLineInfo):
6206
6207 2012-06-18  Andy Estes  <aestes@apple.com>
6208
6209         Fix r120663, which didn't land the change that was reviewed.
6210
6211 2012-06-18  Andy Estes  <aestes@apple.com>
6212
6213         [JSC] In JSGlobalData.cpp, enableAssembler() sometimes leaks two CF objects
6214         https://bugs.webkit.org/show_bug.cgi?id=89415
6215
6216         Reviewed by Sam Weinig.
6217
6218         In the case where canUseJIT was a non-NULL CFBooleanRef,
6219         enableAssembler() would leak both canUseJITKey and canUseJIT by
6220         returning before calling CFRelease. Fix this by using RetainPtr.
6221
6222         * runtime/JSGlobalData.cpp:
6223         (JSC::enableAssembler):
6224
6225 2012-06-17  Geoffrey Garen  <ggaren@apple.com>
6226
6227         GC copy phase spends needless cycles zero-filling blocks
6228         https://bugs.webkit.org/show_bug.cgi?id=89128
6229
6230         Reviewed by Gavin Barraclough.
6231
6232         We only need to zero-fill when we're allocating memory that might not
6233         get fully initialized before GC.
6234
6235         * heap/CopiedBlock.h:
6236         (JSC::CopiedBlock::createNoZeroFill):
6237         (JSC::CopiedBlock::create): Added a way to create without zero-filling.
6238         This is our optimization.
6239
6240         (JSC::CopiedBlock::zeroFillToEnd):
6241         (JSC::CopiedBlock::CopiedBlock): Split zero-filling out from creation,
6242         so we can sometimes create without zero-filling.
6243
6244         * heap/CopiedSpace.cpp:
6245         (JSC::CopiedSpace::init):
6246         (JSC::CopiedSpace::tryAllocateSlowCase):
6247         (JSC::CopiedSpace::doneCopying): Renamed addNewBlock to allocateBlock()
6248         to clarify that the new block is always newly-allocated.
6249
6250         (JSC::CopiedSpace::doneFillingBlock): Make sure to zero-fill to the end
6251         of a block that might be used in the future for allocation. (Most of the
6252         time, this is a no-op, since we've already filled the block completely.)
6253
6254         (JSC::CopiedSpace::getFreshBlock): Removed this function because the
6255         abstraction of "allocation must succeed" is no longer useful.
6256
6257         * heap/CopiedSpace.h: Updated declarations to match.
6258
6259         * heap/CopiedSpaceInlineMethods.h:
6260         (JSC::CopiedSpace::allocateBlockForCopyingPhase): New function, which
6261         knows that it can skip zero-filling.
6262
6263         Added tighter scoping to our lock, to improve parallelism.
6264
6265         (JSC::CopiedSpace::allocateBlock): Folded getFreshBlock functionality
6266         into this function, for simplicity.
6267
6268         * heap/MarkStack.cpp:
6269         (JSC::SlotVisitor::startCopying):
6270         (JSC::SlotVisitor::allocateNewSpace): Use our new zero-fill-free helper
6271         function for great good.
6272
6273 2012-06-17  Filip Pizlo  <fpizlo@apple.com>
6274
6275         DFG should attempt to use structure watchpoints for all inlined get_by_id's and put_by_id's
6276         https://bugs.webkit.org/show_bug.cgi?id=89316
6277
6278         Reviewed by Oliver Hunt.
6279
6280         * dfg/DFGByteCodeParser.cpp:
6281         (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
6282         (ByteCodeParser):
6283         (JSC::DFG::ByteCodeParser::handleGetById):
6284         (JSC::DFG::ByteCodeParser::parseBlock):
6285
6286 2012-06-15  Yong Li  <yoli@rim.com>
6287
6288         [BlackBerry] Put platform-specific GC policy in GCActivityCallback
6289         https://bugs.webkit.org/show_bug.cgi?id=89236
6290
6291         Reviewed by Rob Buis.
6292
6293         Add GCActivityCallbackBlackBerry.cpp and implement platform-specific
6294         low memory GC policy there.
6295
6296         * PlatformBlackBerry.cmake:
6297         * heap/Heap.h:
6298         (JSC::Heap::isSafeToCollect): Added.
6299         * runtime/GCActivityCallbackBlackBerry.cpp: Added.
6300         (JSC):
6301         (JSC::DefaultGCActivityCallbackPlatformData::DefaultGCActivityCallbackPlatformData):
6302         (DefaultGCActivityCallbackPlatformData):
6303         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
6304         (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
6305         (JSC::DefaultGCActivityCallback::didAllocate):
6306         (JSC::DefaultGCActivityCallback::willCollect):
6307         (JSC::DefaultGCActivityCallback::synchronize):
6308         (JSC::DefaultGCActivityCallback::cancel):
6309
6310 2012-06-15  Filip Pizlo  <fpizlo@apple.com>
6311
6312         DFG should be able to set watchpoints on structure transitions in the
6313         method check prototype chain
6314         https://bugs.webkit.org/show_bug.cgi?id=89058
6315
6316         Adding the same assertion to 32-bit that I added to 64-bit. This change
6317         does not affect correctness but it's a good thing for assertion coverage.
6318
6319         * dfg/DFGSpeculativeJIT32_64.cpp:
6320         (JSC::DFG::SpeculativeJIT::compile):
6321
6322 2012-06-13  Filip Pizlo  <fpizlo@apple.com>
6323
6324         DFG should be able to set watchpoints on structure transitions in the
6325         method check prototype chain
6326         https://bugs.webkit.org/show_bug.cgi?id=89058
6327
6328         Reviewed by Gavin Barraclough.
6329
6330         This adds the ability to set watchpoints on Structures, and then does
6331         the most modest thing we can do with this ability: the DFG now sets
6332         watchpoints on structure transitions in the prototype chain of method
6333         checks.
6334
6335         This appears to be a >1% speed-up on V8.
6336
6337         * bytecode/PutByIdStatus.cpp:
6338         (JSC::PutByIdStatus::computeFromLLInt):
6339         (JSC::PutByIdStatus::computeFor):
6340         * bytecode/StructureSet.h:
6341         (JSC::StructureSet::containsOnly):
6342         (StructureSet):
6343         * bytecode/Watchpoint.cpp:
6344         (JSC::WatchpointSet::WatchpointSet):
6345         (JSC::InlineWatchpointSet::add):
6346         (JSC):
6347         (JSC::InlineWatchpointSet::inflateSlow):
6348         (JSC::InlineWatchpointSet::freeFat):
6349         * bytecode/Watchpoint.h:
6350         (WatchpointSet):
6351         (JSC):
6352         (InlineWatchpointSet):
6353         (JSC::InlineWatchpointSet::InlineWatchpointSet):
6354         (JSC::InlineWatchpointSet::~InlineWatchpointSet):
6355         (JSC::InlineWatchpointSet::hasBeenInvalidated):
6356         (JSC::InlineWatchpointSet::isStillValid):
6357         (JSC::InlineWatchpointSet::startWatching):
6358         (JSC::InlineWatchpointSet::notifyWrite):
6359         (JSC::InlineWatchpointSet::isFat):
6360         (JSC::InlineWatchpointSet::fat):
6361         (JSC::InlineWatchpointSet::inflate):
6362         * dfg/DFGAbstractState.cpp:
6363         (JSC::DFG::AbstractState::execute):
6364         * dfg/DFGByteCodeParser.cpp:
6365         (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
6366         (ByteCodeParser):
6367         (JSC::DFG::ByteCodeParser::parseBlock):
6368         * dfg/DFGCSEPhase.cpp:
6369         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
6370         (CSEPhase):
6371         (JSC::DFG::CSEPhase::performNodeCSE):
6372         * dfg/DFGCommon.h:
6373         * dfg/DFGGraph.cpp:
6374         (JSC::DFG::Graph::dump):
6375         * dfg/DFGGraph.h:
6376         (JSC::DFG::Graph::isCellConstant):
6377         * dfg/DFGJITCompiler.h:
6378         (JSC::DFG::JITCompiler::addWeakReferences):
6379         (JITCompiler):
6380         * dfg/DFGNode.h:
6381         (JSC::DFG::Node::hasStructure):
6382         (Node):
6383         (JSC::DFG::Node::structure):
6384         * dfg/DFGNodeType.h:
6385         (DFG):
6386         * dfg/DFGPredictionPropagationPhase.cpp:
6387         (JSC::DFG::PredictionPropagationPhase::propagate):
6388         * dfg/DFGRepatch.cpp:
6389         (JSC::DFG::emitPutTransitionStub):
6390         * dfg/DFGSpeculativeJIT64.cpp:
6391         (JSC::DFG::SpeculativeJIT::compile):
6392         * jit/JITStubs.cpp:
6393         (JSC::JITThunks::tryCachePutByID):
6394         * llint/LLIntSlowPaths.cpp:
6395         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
6396         * runtime/Structure.cpp:
6397         (JSC::Structure::Structure):
6398         * runtime/Structure.h:
6399         (JSC::Structure::transitionWatchpointSetHasBeenInvalidated):
6400         (Structure):
6401         (JSC::Structure::transitionWatchpointSetIsStillValid):
6402         (JSC::Structure::addTransitionWatchpoint):
6403         (JSC::Structure::notifyTransitionFromThisStructure):
6404         (JSC::JSCell::setStructure):
6405         * runtime/SymbolTable.cpp:
6406         (JSC::SymbolTableEntry::attemptToWatch):
6407
6408 2012-06-13  Filip Pizlo  <fpizlo@apple.com>
6409
6410         DFG should be able to set watchpoints on global variables
6411         https://bugs.webkit.org/show_bug.cgi?id=88692
6412
6413         Reviewed by Geoffrey Garen.
6414
6415         Rolling back in after fixing Windows build issues, and implementing
6416         branchTest8 for the Qt port's strange assemblers.
6417
6418         This implements global variable constant folding by allowing the optimizing
6419         compiler to set a "watchpoint" on globals that it wishes to constant fold.
6420         If the watchpoint fires, then an OSR exit is forced by overwriting the
6421         machine code that the optimizing compiler generated with a jump.
6422
6423         As such, this patch is adding quite a bit of stuff:
6424
6425         - Jump replacement on those hardware targets supported by the optimizing
6426           JIT. It is now possible to patch in a jump instruction over any recorded
6427           watchpoint label. The jump must be "local" in the sense that it must be
6428           within the range of the largest jump distance supported by a one
6429           instruction jump.
6430
6431         - WatchpointSets and Watchpoints. A Watchpoint is a doubly-linked list node
6432           that records the location where a jump must be inserted and the
6433           destination to which it should jump. Watchpoints can be added to a
6434           WatchpointSet. The WatchpointSet can be fired all at once, which plants
6435           all jumps. WatchpointSet also remembers if it had ever been invalidated,
6436           which allows for monotonicity: we typically don't want to optimize using
6437           watchpoints on something for which watchpoints had previously fired. The
6438           act of notifying a WatchpointSet has a trivial fast path in case no
6439           Watchpoints are registered (one-byte load+branch).
6440
6441         - SpeculativeJIT::speculationWatchpoint(). It's like speculationCheck(),
6442           except that you don't have to emit branches. But, you need to know what
6443           WatchpointSet to add the resulting Watchpoint to. Not everything that
6444           you could write a speculationCheck() for will have a WatchpointSet that
6445           would get notified if the condition you were speculating against became
6446           invalid.
6447
6448         - SymbolTableEntry now has the ability to refer to a WatchpointSet. It can
6449           do so without incurring any space overhead for those entries that don't
6450           have WatchpointSets.
6451
6452         - The bytecode generator infers all global function variables to be
6453           watchable, and makes all stores perform the WatchpointSet's write check,
6454           and marks all loads as being potentially watchable (i.e. you can compile
6455           them to a watchpoint and a constant).
6456
6457         Put together, this allows for fully sleazy inlining of calls to globally
6458         declared functions. The inline prologue will no longer contain the load of
6459         the function, or any checks of the function you're calling. I.e. it's
6460         pretty much like the kind of inlining you would see in Java or C++.
6461         Furthermore, the watchpointing functionality is built to be fairly general,
6462         and should allow setting watchpoints on all sorts of interesting things
6463         in the future.
6464
6465         The sleazy inlining means that we will now sometimes inline in code paths
6466         that have never executed. Previously, to inline we would have either had
6467         to have executed the call (to read the call's inline cache) or have
6468         executed the method check (to read the method check's inline cache). Now,
6469         we might inline when the callee is a watched global variable. This
6470         revealed some humorous bugs. First, constant folding disagreed with CFA
6471         over what kinds of operations can clobber (example: code path A is dead
6472         but stores a String into variable X, all other code paths store 0 into
6473         X, and then you do CompareEq(X, 0) - CFA will say that this is a non-
6474         clobbering constant, but constant folding thought it was clobbering
6475         because it saw the String prediction). Second, inlining would crash if
6476         the inline callee had not been compiled. This patch fixes both bugs,
6477         since otherwise run-javascriptcore-tests would report regressions.
6478
6479         * CMakeLists.txt:
6480         * GNUmakefile.list.am:
6481         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
6482         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6483         * JavaScriptCore.xcodeproj/project.pbxproj:
6484         * Target.pri:
6485         * assembler/ARMv7Assembler.h:
6486         (ARMv7Assembler):
6487         (JSC::ARMv7Assembler::ARMv7Assembler):
6488         (JSC::ARMv7Assembler::labelForWatchpoint):
6489         (JSC::ARMv7Assembler::label):
6490         (JSC::ARMv7Assembler::replaceWithJump):
6491         (JSC::ARMv7Assembler::maxJumpReplacementSize):
6492         * assembler/AbstractMacroAssembler.h:
6493         (JSC):
6494         (AbstractMacroAssembler):
6495         (Label):
6496         (JSC::AbstractMacroAssembler::watchpointLabel):
6497         (JSC::AbstractMacroAssembler::readPointer):
6498         * assembler/AssemblerBuffer.h:
6499         * assembler/MacroAssemblerARM.h:
6500         (JSC::MacroAssemblerARM::branchTest8):
6501         (MacroAssemblerARM):
6502         (JSC::MacroAssemblerARM::replaceWithJump):
6503         (JSC::MacroAssemblerARM::maxJumpReplacementSize):
6504         * assembler/MacroAssemblerARMv7.h:
6505         (JSC::MacroAssemblerARMv7::load8Signed):
6506         (JSC::MacroAssemblerARMv7::load16Signed):
6507         (MacroAssemblerARMv7):
6508         (JSC::MacroAssemblerARMv7::replaceWithJump):
6509         (JSC::MacroAssemblerARMv7::maxJumpReplacementSize):
6510         (JSC::MacroAssemblerARMv7::branchTest8):
6511         (JSC::MacroAssemblerARMv7::jump):
6512         (JSC::MacroAssemblerARMv7::makeBranch):
6513         * assembler/MacroAssemblerMIPS.h:
6514         (JSC::MacroAssemblerMIPS::branchTest8):
6515         (MacroAssemblerMIPS):
6516         (JSC::MacroAssemblerMIPS::replaceWithJump):
6517         (JSC::MacroAssemblerMIPS::maxJumpReplacementSize):
6518         * assembler/MacroAssemblerSH4.h:
6519         (JSC::MacroAssemblerSH4::branchTest8):
6520         (MacroAssemblerSH4):
6521         (JSC::MacroAssemblerSH4::replaceWithJump):
6522         (JSC::MacroAssemblerSH4::maxJumpReplacementSize):
6523         * assembler/MacroAssemblerX86.h:
6524         (MacroAssemblerX86):
6525         (JSC::MacroAssemblerX86::branchTest8):
6526         * assembler/MacroAssemblerX86Common.h:
6527         (JSC::MacroAssemblerX86Common::replaceWithJump):
6528         (MacroAssemblerX86Common):
6529         (JSC::MacroAssemblerX86Common::maxJumpReplacementSize):
6530         * assembler/MacroAssemblerX86_64.h:
6531         (MacroAssemblerX86_64):
6532         (JSC::MacroAssemblerX86_64::branchTest8):
6533         * assembler/X86Assembler.h:
6534         (JSC::X86Assembler::X86Assembler):
6535         (X86Assembler):
6536         (JSC::X86Assembler::cmpb_im):
6537         (JSC::X86Assembler::testb_im):
6538         (JSC::X86Assembler::labelForWatchpoint):
6539         (JSC::X86Assembler::label):
6540         (JSC::X86Assembler::replaceWithJump):
6541         (JSC::X86Assembler::maxJumpReplacementSize):
6542         (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
6543         * bytecode/CodeBlock.cpp:
6544         (JSC):
6545         (JSC::CodeBlock::printGetByIdCacheStatus):
6546         (JSC::CodeBlock::dump):
6547         * bytecode/CodeBlock.h:
6548         (JSC::CodeBlock::appendOSRExit):
6549         (JSC::CodeBlock::appendSpeculationRecovery):
6550         (CodeBlock):
6551         (JSC::CodeBlock::appendWatchpoint):
6552         (JSC::CodeBlock::numberOfWatchpoints):
6553         (JSC::CodeBlock::watchpoint):
6554         (DFGData):
6555         * bytecode/DFGExitProfile.h:
6556         (JSC::DFG::exitKindToString):
6557         (JSC::DFG::exitKindIsCountable):
6558         * bytecode/GetByIdStatus.cpp:
6559         (JSC::GetByIdStatus::computeForChain):
6560         * bytecode/Instruction.h:
6561         (Instruction):
6562         (JSC::Instruction::Instruction):
6563         * bytecode/Opcode.h:
6564         (JSC):
6565         (JSC::padOpcodeName):
6566         * bytecode/Watchpoint.cpp: Added.
6567         (JSC):
6568         (JSC::Watchpoint::~Watchpoint):
6569         (JSC::Watchpoint::correctLabels):
6570         (JSC::Watchpoint::fire):
6571         (JSC::WatchpointSet::WatchpointSet):
6572         (JSC::WatchpointSet::~WatchpointSet):
6573         (JSC::WatchpointSet::add):
6574         (JSC::WatchpointSet::notifyWriteSlow):
6575         (JSC::WatchpointSet::fireAllWatchpoints):
6576         * bytecode/Watchpoint.h: Added.
6577         (JSC):
6578         (Watchpoint):
6579         (JSC::Watchpoint::Watchpoint):
6580         (JSC::Watchpoint::setDestination):
6581         (WatchpointSet):
6582         (JSC::WatchpointSet::isStillValid):
6583         (JSC::WatchpointSet::hasBeenInvalidated):
6584         (JSC::WatchpointSet::startWatching):
6585         (JSC::WatchpointSet::notifyWrite):
6586         (JSC::WatchpointSet::addressOfIsWatched):
6587         * bytecompiler/BytecodeGenerator.cpp:
6588         (JSC::ResolveResult::checkValidity):
6589         (JSC::BytecodeGenerator::addGlobalVar):
6590         (JSC::BytecodeGenerator::BytecodeGenerator):
6591         (JSC::BytecodeGenerator::resolve):
6592         (JSC::BytecodeGenerator::emitResolve):
6593         (JSC::BytecodeGenerator::emitResolveWithBase):
6594         (JSC::BytecodeGenerator::emitResolveWithThis):
6595         (JSC::BytecodeGenerator::emitGetStaticVar):
6596         (JSC::BytecodeGenerator::emitPutStaticVar):
6597         * bytecompiler/BytecodeGenerator.h:
6598         (BytecodeGenerator):
6599         * bytecompiler/NodesCodegen.cpp:
6600         (JSC::FunctionCallResolveNode::emitBytecode):
6601         (JSC::PostfixResolveNode::emitBytecode):
6602         (JSC::PrefixResolveNode::emitBytecode):
6603         (JSC::ReadModifyResolveNode::emitBytecode):
6604         (JSC::AssignResolveNode::emitBytecode):
6605         (JSC::ConstDeclNode::emitCodeSingle):
6606         * dfg/DFGAbstractState.cpp:
6607         (JSC::DFG::AbstractState::execute):
6608         (JSC::DFG::AbstractState::clobberStructures):
6609         * dfg/DFGAbstractState.h:
6610         (AbstractState):
6611         (JSC::DFG::AbstractState::didClobber):
6612         * dfg/DFGByteCodeParser.cpp:
6613         (JSC::DFG::ByteCodeParser::handleInlining):
6614         (JSC::DFG::ByteCodeParser::parseBlock):
6615         * dfg/DFGCCallHelpers.h:
6616         (CCallHelpers):
6617         (JSC::DFG::CCallHelpers::setupArguments):
6618         * dfg/DFGCSEPhase.cpp:
6619         (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
6620         (CSEPhase):
6621         (JSC::DFG::CSEPhase::globalVarStoreElimination):
6622         (JSC::DFG::CSEPhase::performNodeCSE):
6623         * dfg/DFGCapabilities.h:
6624         (JSC::DFG::canCompileOpcode):
6625         * dfg/DFGConstantFoldingPhase.cpp:
6626         (JSC::DFG::ConstantFoldingPhase::run):
6627         * dfg/DFGCorrectableJumpPoint.h:
6628         (JSC::DFG::CorrectableJumpPoint::isSet):
6629         (CorrectableJumpPoint):
6630         * dfg/DFGJITCompiler.cpp:
6631         (JSC::DFG::JITCompiler::linkOSRExits):
6632         (JSC::DFG::JITCompiler::link):
6633         * dfg/DFGNode.h:
6634         (JSC::DFG::Node::hasIdentifierNumberForCheck):
6635         (Node):
6636         (JSC::DFG::Node::identifierNumberForCheck):
6637         (JSC::DFG::Node::hasRegisterPointer):
6638         * dfg/DFGNodeType.h:
6639         (DFG):
6640         * dfg/DFGOSRExit.cpp:
6641         (JSC::DFG::OSRExit::OSRExit):
6642         * dfg/DFGOSRExit.h:
6643         (OSRExit):
6644         * dfg/DFGOperations.cpp:
6645         * dfg/DFGOperations.h:
6646         * dfg/DFGPredictionPropagationPhase.cpp:
6647         (JSC::DFG::PredictionPropagationPhase::propagate):
6648         * dfg/DFGSpeculativeJIT.h:
6649         (JSC::DFG::SpeculativeJIT::callOperation):
6650         (JSC::DFG::SpeculativeJIT::appendCall):
6651         (SpeculativeJIT):
6652         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
6653         * dfg/DFGSpeculativeJIT32_64.cpp:
6654         (JSC::DFG::SpeculativeJIT::compile):
6655         * dfg/DFGSpeculativeJIT64.cpp:
6656         (JSC::DFG::SpeculativeJIT::compile):
6657         * interpreter/Interpreter.cpp:
6658         (JSC::Interpreter::privateExecute):
6659         * jit/JIT.cpp:
6660         (JSC::JIT::privateCompileMainPass):
6661         (JSC::JIT::privateCompileSlowCases):
6662         * jit/JIT.h:
6663         * jit/JITPropertyAccess.cpp:
6664         (JSC::JIT::emit_op_put_global_var_check):
6665         (JSC):
6666         (JSC::JIT::emitSlow_op_put_global_var_check):
6667         * jit/JITPropertyAccess32_64.cpp:
6668         (JSC::JIT::emit_op_put_global_var_check):
6669         (JSC):
6670         (JSC::JIT::emitSlow_op_put_global_var_check):
6671         * jit/JITStubs.cpp:
6672         (JSC::DEFINE_STUB_FUNCTION):
6673         (JSC):
6674         * jit/JITStubs.h:
6675         * llint/LLIntSlowPaths.cpp:
6676         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
6677         (LLInt):
6678         * llint/LLIntSlowPaths.h:
6679         (LLInt):
6680         * llint/LowLevelInterpreter32_64.asm:
6681         * llint/LowLevelInterpreter64.asm:
6682         * runtime/JSObject.cpp:
6683         (JSC::JSObject::removeDirect):
6684         * runtime/JSObject.h:
6685         (JSObject):
6686         * runtime/JSSymbolTableObject.h:
6687         (JSC::symbolTableGet):
6688         (JSC::symbolTablePut):
6689         (JSC::symbolTablePutWithAttributes):
6690         * runtime/SymbolTable.cpp: Added.
6691         (JSC):
6692         (JSC::SymbolTableEntry::copySlow):
6693         (JSC::SymbolTableEntry::freeFatEntrySlow):
6694         (JSC::SymbolTableEntry::couldBeWatched):
6695         (JSC::SymbolTableEntry::attemptToWatch):
6696         (JSC::SymbolTableEntry::addressOfIsWatched):
6697         (JSC::SymbolTableEntry::addWatchpoint):
6698         (JSC::SymbolTableEntry::notifyWriteSlow):
6699         (JSC::SymbolTableEntry::inflateSlow):
6700         * runtime/SymbolTable.h:
6701         (JSC):
6702         (SymbolTableEntry):
6703         (Fast):
6704         (JSC::SymbolTableEntry::Fast::Fast):
6705         (JSC::SymbolTableEntry::Fast::isNull):
6706         (JSC::SymbolTableEntry::Fast::getIndex):
6707         (JSC::SymbolTableEntry::Fast::isReadOnly):
6708         (JSC::SymbolTableEntry::Fast::getAttributes):
6709         (JSC::SymbolTableEntry::Fast::isFat):
6710         (JSC::SymbolTableEntry::SymbolTableEntry):
6711         (JSC::SymbolTableEntry::~SymbolTableEntry):
6712         (JSC::SymbolTableEntry::operator=):
6713         (JSC::SymbolTableEntry::isNull):
6714         (JSC::SymbolTableEntry::getIndex):
6715         (JSC::SymbolTableEntry::getFast):
6716         (JSC::SymbolTableEntry::getAttributes):
6717         (JSC::SymbolTableEntry::isReadOnly):
6718         (JSC::SymbolTableEntry::watchpointSet):
6719         (JSC::SymbolTableEntry::notifyWrite):
6720         (FatEntry):
6721         (JSC::SymbolTableEntry::FatEntry::FatEntry):
6722         (JSC::SymbolTableEntry::isFat):
6723         (JSC::SymbolTableEntry::fatEntry):
6724         (JSC::SymbolTableEntry::inflate):
6725         (JSC::SymbolTableEntry::bits):
6726         (JSC::SymbolTableEntry::freeFatEntry):
6727         (JSC::SymbolTableEntry::pack):
6728         (JSC::SymbolTableEntry::isValidIndex):
6729
6730 2012-06-13  Sheriff Bot  <webkit.review.bot@gmail.com>
6731
6732         Unreviewed, rolling out r120172.
6733         http://trac.webkit.org/changeset/120172
6734         https://bugs.webkit.org/show_bug.cgi?id=88976
6735
6736         The patch causes compilation failures on Gtk, Qt and Apple Win
6737         bots (Requested by zdobersek on #webkit).
6738
6739         * CMakeLists.txt:
6740         * GNUmakefile.list.am:
6741         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
6742         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6743         * JavaScriptCore.xcodeproj/project.pbxproj:
6744         * Target.pri:
6745         * assembler/ARMv7Assembler.h:
6746         (JSC::ARMv7Assembler::nop):
6747         (JSC::ARMv7Assembler::label):
6748         (JSC::ARMv7Assembler::readPointer):
6749         (ARMv7Assembler):
6750         * assembler/AbstractMacroAssembler.h:
6751         (JSC):
6752         (AbstractMacroAssembler):
6753         (Label):
6754         * assembler/AssemblerBuffer.h:
6755         * assembler/MacroAssemblerARM.h:
6756         * assembler/MacroAssemblerARMv7.h:
6757         (JSC::MacroAssemblerARMv7::nop):
6758         (JSC::MacroAssemblerARMv7::jump):
6759         (JSC::MacroAssemblerARMv7::makeBranch):
6760         * assembler/MacroAssemblerMIPS.h:
6761         * assembler/MacroAssemblerSH4.h:
6762         * assembler/MacroAssemblerX86.h:
6763         (MacroAssemblerX86):
6764         (JSC::MacroAssemblerX86::moveWithPatch):
6765         * assembler/MacroAssemblerX86Common.h:
6766         * assembler/MacroAssemblerX86_64.h:
6767         (JSC::MacroAssemblerX86_64::branchTest8):
6768         * assembler/X86Assembler.h:
6769         (JSC::X86Assembler::cmpb_im):
6770         (JSC::X86Assembler::codeSize):
6771         (JSC::X86Assembler::label):
6772         (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
6773         * bytecode/CodeBlock.cpp:
6774         (JSC::CodeBlock::dump):
6775         * bytecode/CodeBlock.h:
6776         (JSC::CodeBlock::appendOSRExit):
6777         (JSC::CodeBlock::appendSpeculationRecovery):
6778         (DFGData):
6779         * bytecode/DFGExitProfile.h:
6780         (JSC::DFG::exitKindToString):
6781         (JSC::DFG::exitKindIsCountable):
6782         * bytecode/Instruction.h:
6783         * bytecode/Opcode.h:
6784         (JSC):
6785         (JSC::padOpcodeName):
6786         * bytecode/Watchpoint.cpp: Removed.
6787         * bytecode/Watchpoint.h: Removed.
6788         * bytecompiler/BytecodeGenerator.cpp:
6789         (JSC::ResolveResult::checkValidity):
6790         (JSC::BytecodeGenerator::addGlobalVar):
6791         (JSC::BytecodeGenerator::BytecodeGenerator):
6792         (JSC::BytecodeGenerator::resolve):
6793         (JSC::BytecodeGenerator::emitResolve):
6794         (JSC::BytecodeGenerator::emitResolveWithBase):
6795         (JSC::BytecodeGenerator::emitResolveWithThis):
6796         (JSC::BytecodeGenerator::emitGetStaticVar):
6797         (JSC::BytecodeGenerator::emitPutStaticVar):
6798         * bytecompiler/BytecodeGenerator.h:
6799         (BytecodeGenerator):
6800         * bytecompiler/NodesCodegen.cpp:
6801         (JSC::FunctionCallResolveNode::emitBytecode):
6802         (JSC::PostfixResolveNode::emitBytecode):
6803         (JSC::PrefixResolveNode::emitBytecode):
6804         (JSC::ReadModifyResolveNode::emitBytecode):
6805         (JSC::AssignResolveNode::emitBytecode):
6806         (JSC::ConstDeclNode::emitCodeSingle):
6807         * dfg/DFGAbstractState.cpp:
6808         (JSC::DFG::AbstractState::execute):
6809         (JSC::DFG::AbstractState::clobberStructures):
6810         * dfg/DFGAbstractState.h:
6811         (AbstractState):
6812         * dfg/DFGByteCodeParser.cpp:
6813         (JSC::DFG::ByteCodeParser::handleInlining):
6814         (JSC::DFG::ByteCodeParser::parseBlock):
6815         * dfg/DFGCCallHelpers.h:
6816         (JSC::DFG::CCallHelpers::setupArguments):
6817         * dfg/DFGCSEPhase.cpp:
6818         (JSC::DFG::CSEPhase::globalVarStoreElimination):
6819         (JSC::DFG::CSEPhase::performNodeCSE):
6820         * dfg/DFGCapabilities.h:
6821         (JSC::DFG::canCompileOpcode):
6822         * dfg/DFGConstantFoldingPhase.cpp:
6823         (JSC::DFG::ConstantFoldingPhase::run):
6824         * dfg/DFGCorrectableJumpPoint.h:
6825         * dfg/DFGJITCompiler.cpp:
6826         (JSC::DFG::JITCompiler::linkOSRExits):
6827         (JSC::DFG::JITCompiler::link):
6828         * dfg/DFGNode.h:
6829         (JSC::DFG::Node::hasRegisterPointer):
6830         * dfg/DFGNodeType.h:
6831         (DFG):
6832         * dfg/DFGOSRExit.cpp:
6833         (JSC::DFG::OSRExit::OSRExit):
6834         * dfg/DFGOSRExit.h:
6835         (OSRExit):
6836         * dfg/DFGOperations.cpp:
6837         * dfg/DFGOperations.h:
6838         * dfg/DFGPredictionPropagationPhase.cpp:
6839         (JSC::DFG::PredictionPropagationPhase::propagate):
6840         * dfg/DFGSpeculativeJIT.h:
6841         (JSC::DFG::SpeculativeJIT::callOperation):
6842         (JSC::DFG::SpeculativeJIT::appendCallSetResult):
6843         (JSC::DFG::SpeculativeJIT::speculationCheck):
6844         * dfg/DFGSpeculativeJIT32_64.cpp:
6845         (JSC::DFG::SpeculativeJIT::compile):
6846         * dfg/DFGSpeculativeJIT64.cpp:
6847         (JSC::DFG::SpeculativeJIT::compile):
6848         * jit/JIT.cpp:
6849         (JSC::JIT::privateCompileMainPass):
6850         (JSC::JIT::privateCompileSlowCases):
6851         * jit/JIT.h:
6852         * jit/JITPropertyAccess.cpp:
6853         * jit/JITPropertyAccess32_64.cpp:
6854         * jit/JITStubs.cpp:
6855         * jit/JITStubs.h:
6856         * llint/LLIntSlowPaths.cpp:
6857         * llint/LLIntSlowPaths.h:
6858         (LLInt):
6859         * llint/LowLevelInterpreter32_64.asm:
6860         * llint/LowLevelInterpreter64.asm:
6861         * runtime/JSObject.cpp:
6862         (JSC::JSObject::removeDirect):
6863         * runtime/JSObject.h:
6864         (JSObject):
6865         * runtime/JSSymbolTableObject.h:
6866         (JSC::symbolTableGet):
6867         (JSC::symbolTablePut):
6868         (JSC::symbolTablePutWithAttributes):
6869         * runtime/SymbolTable.cpp: Removed.
6870         * runtime/SymbolTable.h:
6871         (JSC):
6872         (JSC::SymbolTableEntry::isNull):
6873         (JSC::SymbolTableEntry::getIndex):
6874         (SymbolTableEntry):
6875         (JSC::SymbolTableEntry::getAttributes):
6876         (JSC::SymbolTableEntry::isReadOnly):
6877         (JSC::SymbolTableEntry::pack):
6878         (JSC::SymbolTableEntry::isValidIndex):
6879
6880 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
6881
6882         DFG should be able to set watchpoints on global variables
6883         https://bugs.webkit.org/show_bug.cgi?id=88692
6884
6885         Reviewed by Geoffrey Garen.
6886
6887         This implements global variable constant folding by allowing the optimizing
6888         compiler to set a "watchpoint" on globals that it wishes to constant fold.
6889         If the watchpoint fires, then an OSR exit is forced by overwriting the
6890         machine code that the optimizing compiler generated with a jump.
6891
6892         As such, this patch is adding quite a bit of stuff:
6893
6894         - Jump replacement on those hardware targets supported by the optimizing
6895           JIT. It is now possible to patch in a jump instruction over any recorded
6896           watchpoint label. The jump must be "local" in the sense that it must be
6897           within the range of the largest jump distance supported by a one
6898           instruction jump.
6899
6900         - WatchpointSets and Watchpoints. A Watchpoint is a doubly-linked list node
6901           that records the location where a jump must be inserted and the
6902           destination to which it should jump. Watchpoints can be added to a
6903           WatchpointSet. The WatchpointSet can be fired all at once, which plants
6904           all jumps. WatchpointSet also remembers if it had ever been invalidated,
6905           which allows for monotonicity: we typically don't want to optimize using
6906           watchpoints on something for which watchpoints had previously fired. The
6907           act of notifying a WatchpointSet has a trivial fast path in case no
6908           Watchpoints are registered (one-byte load+branch).
6909
6910         - SpeculativeJIT::speculationWatchpoint(). It's like speculationCheck(),
6911           except that you don't have to emit branches. But, you need to know what
6912           WatchpointSet to add the resulting Watchpoint to. Not everything that
6913           you could write a speculationCheck() for will have a WatchpointSet that
6914           would get notified if the condition you were speculating against became
6915           invalid.
6916
6917         - SymbolTableEntry now has the ability to refer to a WatchpointSet. It can
6918           do so without incurring any space overhead for those entries that don't
6919           have WatchpointSets.
6920
6921         - The bytecode generator infers all global function variables to be
6922           watchable, and makes all stores perform the WatchpointSet's write check,
6923           and marks all loads as being potentially watchable (i.e. you can compile
6924           them to a watchpoint and a constant).
6925
6926         Put together, this allows for fully sleazy inlining of calls to globally
6927         declared functions. The inline prologue will no longer contain the load of
6928         the function, or any checks of the function you're calling. I.e. it's
6929         pretty much like the kind of inlining you would see in Java or C++.
6930         Furthermore, the watchpointing functionality is built to be fairly general,
6931         and should allow setting watchpoints on all sorts of interesting things
6932         in the future.
6933
6934         The sleazy inlining means that we will now sometimes inline in code paths
6935         that have never executed. Previously, to inline we would have either had
6936         to have executed the call (to read the call's inline cache) or have
6937         executed the method check (to read the method check's inline cache). Now,
6938         we might inline when the callee is a watched global variable. This
6939         revealed some humorous bugs. First, constant folding disagreed with CFA
6940         over what kinds of operations can clobber (example: code path A is dead
6941         but stores a String into variable X, all other code paths store 0 into
6942         X, and then you do CompareEq(X, 0) - CFA will say that this is a non-
6943         clobbering constant, but constant folding thought it was clobbering
6944         because it saw the String prediction). Second, inlining would crash if
6945         the inline callee had not been compiled. This patch fixes both bugs,
6946         since otherwise run-javascriptcore-tests would report regressions.
6947
6948         * CMakeLists.txt:
6949         * GNUmakefile.list.am:
6950         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6951         * JavaScriptCore.xcodeproj/project.pbxproj:
6952         * Target.pri:
6953         * assembler/ARMv7Assembler.h:
6954         (ARMv7Assembler):
6955         (JSC::ARMv7Assembler::ARMv7Assembler):
6956         (JSC::ARMv7Assembler::labelForWatchpoint):
6957         (JSC::ARMv7Assembler::label):
6958         (JSC::ARMv7Assembler::replaceWithJump):
6959         (JSC::ARMv7Assembler::maxJumpReplacementSize):
6960         * assembler/AbstractMacroAssembler.h:
6961         (JSC):
6962         (AbstractMacroAssembler):
6963         (Label):
6964         (JSC::AbstractMacroAssembler::watchpointLabel):
6965         * assembler/AssemblerBuffer.h:
6966         * assembler/MacroAssemblerARM.h:
6967         (JSC::MacroAssemblerARM::replaceWithJump):
6968         (MacroAssemblerARM):
6969         (JSC::MacroAssemblerARM::maxJumpReplacementSize):
6970         * assembler/MacroAssemblerARMv7.h:
6971         (MacroAssemblerARMv7):
6972         (JSC::MacroAssemblerARMv7::replaceWithJump):
6973         (JSC::MacroAssemblerARMv7::maxJumpReplacementSize):
6974         (JSC::MacroAssemblerARMv7::branchTest8):
6975         (JSC::MacroAssemblerARMv7::jump):
6976         (JSC::MacroAssemblerARMv7::makeBranch):
6977         * assembler/MacroAssemblerMIPS.h:
6978         (JSC::MacroAssemblerMIPS::replaceWithJump):
6979         (MacroAssemblerMIPS):
6980         (JSC::MacroAssemblerMIPS::maxJumpReplacementSize):
6981         * assembler/MacroAssemblerSH4.h:
6982         (JSC::MacroAssemblerSH4::replaceWithJump):
6983         (MacroAssemblerSH4):
6984         (JSC::MacroAssemblerSH4::maxJumpReplacementSize):
6985         * assembler/MacroAssemblerX86.h:
6986         (MacroAssemblerX86):
6987         (JSC::MacroAssemblerX86::branchTest8):
6988         * assembler/MacroAssemblerX86Common.h:
6989         (JSC::MacroAssemblerX86Common::replaceWithJump):
6990         (MacroAssemblerX86Common):
6991         (JSC::MacroAssemblerX86Common::maxJumpReplacementSize):
6992         * assembler/MacroAssemblerX86_64.h:
6993         (MacroAssemblerX86_64):
6994         (JSC::MacroAssemblerX86_64::branchTest8):
6995         * assembler/X86Assembler.h:
6996         (JSC::X86Assembler::X86Assembler):
6997         (X86Assembler):
6998         (JSC::X86Assembler::cmpb_im):
6999         (JSC::X86Assembler::testb_im):
7000         (JSC::X86Assembler::labelForWatchpoint):
7001         (JSC::X86Assembler::label):
7002         (JSC::X86Assembler::replaceWithJump):
7003         (JSC::X86Assembler::maxJumpReplacementSize):
7004         (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
7005         * bytecode/CodeBlock.cpp:
7006         (JSC::CodeBlock::dump):
7007         * bytecode/CodeBlock.h:
7008         (JSC::CodeBlock::appendOSRExit):
7009         (JSC::CodeBlock::appendSpeculationRecovery):
7010         (CodeBlock):
7011         (JSC::CodeBlock::appendWatchpoint):
7012         (JSC::CodeBlock::numberOfWatchpoints):
7013         (JSC::CodeBlock::watchpoint):
7014         (DFGData):
7015         * bytecode/DFGExitProfile.h:
7016         (JSC::DFG::exitKindToString):
7017         (JSC::DFG::exitKindIsCountable):
7018         * bytecode/Instruction.h:
7019         (Instruction):
7020         (JSC::Instruction::Instruction):
7021         * bytecode/Opcode.h:
7022         (JSC):
7023         (JSC::padOpcodeName):
7024         * bytecode/Watchpoint.cpp: Added.
7025         (JSC):
7026         (JSC::Watchpoint::~Watchpoint):
7027         (JSC::Watchpoint::correctLabels):
7028         (JSC::Watchpoint::fire):
7029         (JSC::WatchpointSet::WatchpointSet):
7030         (JSC::WatchpointSet::~WatchpointSet):
7031         (JSC::WatchpointSet::add):
7032         (JSC::WatchpointSet::notifyWriteSlow):
7033         (JSC::WatchpointSet::fireAllWatchpoints):
7034         * bytecode/Watchpoint.h: Added.
7035         (JSC):
7036         (Watchpoint):
7037         (JSC::Watchpoint::Watchpoint):
7038         (JSC::Watchpoint::setDestination):
7039         (WatchpointSet):
7040         (JSC::WatchpointSet::isStillValid):
7041         (JSC::WatchpointSet::hasBeenInvalidated):
7042         (JSC::WatchpointSet::startWatching):
7043         (JSC::WatchpointSet::notifyWrite):
7044         (JSC::WatchpointSet::addressOfIsWatched):
7045         * bytecompiler/BytecodeGenerator.cpp:
7046         (JSC::ResolveResult::checkValidity):
7047         (JSC::BytecodeGenerator::addGlobalVar):
7048         (JSC::BytecodeGenerator::BytecodeGenerator):
7049         (JSC::BytecodeGenerator::resolve):
7050         (JSC::BytecodeGenerator::emitResolve):
7051         (JSC::BytecodeGenerator::emitResolveWithBase):
7052         (JSC::BytecodeGenerator::emitResolveWithThis):
7053         (JSC::BytecodeGenerator::emitGetStaticVar):
7054         (JSC::BytecodeGenerator::emitPutStaticVar):
7055         * bytecompiler/BytecodeGenerator.h:
7056         (BytecodeGenerator):
7057         * bytecompiler/NodesCodegen.cpp:
7058         (JSC::FunctionCallResolveNode::emitBytecode):
7059         (JSC::PostfixResolveNode::emitBytecode):
7060         (JSC::PrefixResolveNode::emitBytecode):
7061         (JSC::ReadModifyResolveNode::emitBytecode):
7062         (JSC::AssignResolveNode::emitBytecode):
7063         (JSC::ConstDeclNode::emitCodeSingle):
7064         * dfg/DFGAbstractState.cpp:
7065         (JSC::DFG::AbstractState::execute):
7066         (JSC::DFG::AbstractState::clobberStructures):
7067         * dfg/DFGAbstractState.h:
7068         (AbstractState):
7069         (JSC::DFG::AbstractState::didClobber):
7070         * dfg/DFGByteCodeParser.cpp:
7071         (JSC::DFG::ByteCodeParser::handleInlining):
7072         (JSC::DFG::ByteCodeParser::parseBlock):
7073         * dfg/DFGCCallHelpers.h:
7074         (CCallHelpers):
7075         (JSC::DFG::CCallHelpers::setupArguments):
7076         * dfg/DFGCSEPhase.cpp:
7077         (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
7078         (CSEPhase):
7079         (JSC::DFG::CSEPhase::globalVarStoreElimination):
7080         (JSC::DFG::CSEPhase::performNodeCSE):
7081         * dfg/DFGCapabilities.h:
7082         (JSC::DFG::canCompileOpcode):
7083         * dfg/DFGConstantFoldingPhase.cpp:
7084         (JSC::DFG::ConstantFoldingPhase::run):
7085         * dfg/DFGCorrectableJumpPoint.h:
7086         (JSC::DFG::CorrectableJumpPoint::isSet):
7087         (CorrectableJumpPoint):
7088         * dfg/DFGJITCompiler.cpp:
7089         (JSC::DFG::JITCompiler::linkOSRExits):
7090         (JSC::DFG::JITCompiler::link):
7091         * dfg/DFGNode.h:
7092         (JSC::DFG::Node::hasIdentifierNumberForCheck):
7093         (Node):
7094         (JSC::DFG::Node::identifierNumberForCheck):
7095         (JSC::DFG::Node::hasRegisterPointer):
7096         * dfg/DFGNodeType.h:
7097         (DFG):
7098         * dfg/DFGOSRExit.cpp:
7099         (JSC::DFG::OSRExit::OSRExit):
7100         * dfg/DFGOSRExit.h:
7101         (OSRExit):
7102         * dfg/DFGOperations.cpp:
7103         * dfg/DFGOperations.h:
7104         * dfg/DFGPredictionPropagationPhase.cpp:
7105         (JSC::DFG::PredictionPropagationPhase::propagate):
7106         * dfg/DFGSpeculativeJIT.h:
7107         (JSC::DFG::SpeculativeJIT::callOperation):
7108         (JSC::DFG::SpeculativeJIT::appendCall):
7109         (SpeculativeJIT):
7110         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
7111         * dfg/DFGSpeculativeJIT32_64.cpp:
7112         (JSC::DFG::SpeculativeJIT::compile):
7113         * dfg/DFGSpeculativeJIT64.cpp:
7114         (JSC::DFG::SpeculativeJIT::compile):
7115         * jit/JIT.cpp:
7116         (JSC::JIT::privateCompileMainPass):
7117         (JSC::JIT::privateCompileSlowCases):
7118         * jit/JIT.h:
7119         * jit/JITPropertyAccess.cpp:
7120         (JSC::JIT::emit_op_put_global_var_check):
7121         (JSC):
7122         (JSC::JIT::emitSlow_op_put_global_var_check):
7123         * jit/JITPropertyAccess32_64.cpp:
7124         (JSC::JIT::emit_op_put_global_var_check):
7125         (JSC):
7126         (JSC::JIT::emitSlow_op_put_global_var_check):
7127         * jit/JITStubs.cpp:
7128         (JSC::JITThunks::JITThunks):
7129         (JSC::DEFINE_STUB_FUNCTION):
7130         (JSC):
7131         * jit/JITStubs.h:
7132         * llint/LLIntSlowPaths.cpp:
7133         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
7134         (LLInt):
7135         * llint/LLIntSlowPaths.h:
7136         (LLInt):
7137         * llint/LowLevelInterpreter32_64.asm:
7138         * llint/LowLevelInterpreter64.asm:
7139         * runtime/JSObject.cpp:
7140         (JSC::JSObject::removeDirect):
7141         * runtime/JSObject.h:
7142         (JSObject):
7143         * runtime/JSSymbolTableObject.h:
7144         (JSC::symbolTableGet):
7145         (JSC::symbolTablePut):
7146         (JSC::symbolTablePutWithAttributes):
7147         * runtime/SymbolTable.cpp: Added.
7148         (JSC):
7149         (JSC::SymbolTableEntry::copySlow):
7150         (JSC::SymbolTableEntry::freeFatEntrySlow):
7151         (JSC::SymbolTableEntry::couldBeWatched):
7152         (JSC::SymbolTableEntry::attemptToWatch):
7153         (JSC::SymbolTableEntry::addressOfIsWatched):
7154         (JSC::SymbolTableEntry::addWatchpoint):
7155         (JSC::SymbolTableEntry::notifyWriteSlow):
7156         (JSC::SymbolTableEntry::inflateSlow):
7157         * runtime/SymbolTable.h:
7158         (JSC):
7159         (SymbolTableEntry):
7160         (Fast):
7161         (JSC::SymbolTableEntry::Fast::Fast):
7162         (JSC::SymbolTableEntry::Fast::isNull):
7163         (JSC::SymbolTableEntry::Fast::getIndex):
7164         (JSC::SymbolTableEntry::Fast::isReadOnly):
7165         (JSC::SymbolTableEntry::Fast::getAttributes):
7166         (JSC::SymbolTableEntry::Fast::isFat):
7167         (JSC::SymbolTableEntry::SymbolTableEntry):
7168         (JSC::SymbolTableEntry::~SymbolTableEntry):
7169         (JSC::SymbolTableEntry::operator=):
7170         (JSC::SymbolTableEntry::isNull):
7171         (JSC::SymbolTableEntry::getIndex):
7172         (JSC::SymbolTableEntry::getFast):
7173         (JSC::SymbolTableEntry::getAttributes):
7174         (JSC::SymbolTableEntry::isReadOnly):
7175         (JSC::SymbolTableEntry::watchpointSet):
7176         (JSC::SymbolTableEntry::notifyWrite):
7177         (FatEntry):
7178         (JSC::SymbolTableEntry::FatEntry::FatEntry):
7179         (JSC::SymbolTableEntry::isFat):
7180         (JSC::SymbolTableEntry::fatEntry):
7181         (JSC::SymbolTableEntry::inflate):
7182         (JSC::SymbolTableEntry::bits):
7183         (JSC::SymbolTableEntry::freeFatEntry):
7184         (JSC::SymbolTableEntry::pack):
7185         (JSC::SymbolTableEntry::isValidIndex):
7186
7187 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
7188
7189         Unreviewed build fix for ARMv7 debug builds.
7190
7191         * jit/JITStubs.cpp:
7192         (JSC::JITThunks::JITThunks):
7193
7194 2012-06-12  Geoffrey Garen  <ggaren@apple.com>
7195
7196         Build fix for case-sensitive file systems: use the right case.
7197
7198         * heap/ListableHandler.h:
7199
7200 2012-06-11  Geoffrey Garen  <ggaren@apple.com>
7201
7202         GC should be 1.7X faster
7203         https://bugs.webkit.org/show_bug.cgi?id=88840
7204
7205         Reviewed by Oliver Hunt.
7206
7207         I profiled, and removed anything that showed up as a concurrency
7208         bottleneck. Then, I added 3 threads to our max thread count, since we
7209         can scale up to more threads now.
7210
7211         * heap/BlockAllocator.cpp:
7212         (JSC::BlockAllocator::BlockAllocator):
7213         (JSC::BlockAllocator::~BlockAllocator):
7214         (JSC::BlockAllocator::releaseFreeBlocks):
7215         (JSC::BlockAllocator::waitForRelativeTimeWhileHoldingLock):
7216         (JSC::BlockAllocator::waitForRelativeTime):
7217         (JSC::BlockAllocator::blockFreeingThreadMain):
7218         * heap/BlockAllocator.h:
7219         (BlockAllocator):
7220         (JSC::BlockAllocator::allocate):
7221         (JSC::BlockAllocator::deallocate): Use a spin lock for the common case
7222         where we're just popping a linked list. (A pthread mutex would sleep our
7223         thread even if the lock were only contended for a microsecond.)
7224
7225         Scope the lock to avoid holding it while allocating VM, since that's a
7226         slow activity and it doesn't modify any of our data structures.
7227
7228         We still use a pthread mutex to handle our condition variable since we
7229         have to, and it's not a hot path.
7230
7231         * heap/CopiedSpace.cpp:
7232         (JSC::CopiedSpace::CopiedSpace):
7233         (JSC::CopiedSpace::doneFillingBlock):
7234         * heap/CopiedSpace.h:
7235         (JSC::CopiedSpace::CopiedSpace): Use a spin lock for the to space lock,
7236         since it just guards linked list and hash table manipulation.
7237
7238         * heap/MarkStack.cpp:
7239         (JSC::MarkStackSegmentAllocator::MarkStackSegmentAllocator):
7240         (JSC::MarkStackSegmentAllocator::allocate):
7241         (JSC::MarkStackSegmentAllocator::release):
7242         (JSC::MarkStackSegmentAllocator::shrinkReserve): Use a spin lock, since
7243         we're just managing a linked list.
7244
7245         (JSC::MarkStackArray::donateSomeCellsTo): Changed donation to be proportional
7246         to our current stack size. This fixes cases where we used to donate too
7247         much. Interestingly, donating too much was starving the donor (when it
7248         ran out of work later) *and* the recipient (since it had to wait on a
7249         long donation operation to complete before it could acquire the lock).
7250
7251         In the worst case, we're still guaranteed to donate N cells in roughly log N time.
7252
7253         This change also fixes cases where we used to donate too little, since
7254         we would always keep a fixed minimum number of cells. In the worst case,
7255         with N marking threads, would could have N large object graph roots in
7256         our stack for the duration of GC, and scale to only 1 thread.
7257
7258         It's an interesting observation that a single object in the mark stack
7259         might represent an arbitrarily large object graph -- and only the act
7260         of marking can find out.
7261
7262         (JSC::MarkStackArray::stealSomeCellsFrom): Steal in proportion to idle
7263         threads. Once again, this fixes cases where constants could cause us
7264         to steal too much or too little.
7265
7266         (JSC::SlotVisitor::donateKnownParallel): Always wake up other threads
7267         if they're idle. We can afford to do this because we're conservative
7268         about when we donate.
7269
7270         (JSC::SlotVisitor::drainFromShared):
7271         * heap/MarkStack.h:
7272         (MarkStackSegmentAllocator):
7273         (MarkStackArray):
7274         (JSC):
7275         * heap/SlotVisitor.h: Merged the "should I donate?" decision into a
7276         single function, for simplicity.
7277
7278         * runtime/Options.cpp:
7279         (minimumNumberOfScansBetweenRebalance): Reduced the delay before donation
7280         a lot. We can afford to do this because, in the common case, donation is
7281         a single branch that decides not to donate.
7282
7283         (cpusToUse): Use more CPUs now, since we scale better now.
7284
7285         * runtime/Options.h:
7286         (Options): Removed now-unused variables.
7287
7288 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
7289
7290         REGRESSION(120121): inspector tests crash in DFG
7291         https://bugs.webkit.org/show_bug.cgi?id=88941
7292
7293         Reviewed by Geoffrey Garen.
7294
7295         The CFG simplifier has two different ways of fixing up GetLocal, Phantom, and Flush. If we've
7296         already fixed up the node one way, we shouldn't try the other way. The reason why we shouldn't
7297         is that the second way depends on the node referring to other nodes in the to-be-jettisoned
7298         block. After fixup they potentially will refer to nodes in the block being merged to.
7299
7300         * dfg/DFGCFGSimplificationPhase.cpp:
7301         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
7302         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
7303
7304 2012-06-12  Leo Yang  <leo.yang@torchmobile.com.cn>
7305
7306         Dynamic hash table in DOMObjectHashTableMap is wrong in multiple threads
7307         https://bugs.webkit.org/show_bug.cgi?id=87334
7308
7309         Reviewed by Geoffrey Garen.
7310
7311         Add a copy member function to JSC::HasTable. This function will copy all data
7312         members except for *table* which contains thread specific data that prevents
7313         up copying it. When you want to copy a JSC::HashTable that was constructed
7314         on another thread you should call JSC::HashTable::copy().
7315
7316         * runtime/Lookup.h:
7317         (JSC::HashTable::copy):
7318         (HashTable):
7319
7320 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
7321
7322         DFG should not ASSERT if you have a double use of a variable that is not revealed to be a double
7323         until after CFG simplification
7324         https://bugs.webkit.org/show_bug.cgi?id=88927
7325         <rdar://problem/11513971>
7326
7327         Reviewed by Geoffrey Garen.
7328
7329         Speculation fixup needs to run if simplification did things, because simplification can change
7330         predictions - particularly if you had a control flow path that stored weird things into a
7331         variable, but that path got axed by the simplifier.
7332
7333         Running fixup in the fixpoint requires making it idempotent, which it previously wasn't. Only
7334         one place needed to be changed, namely the un-MustGenerate-ion of ValueToInt32.
7335
7336         * dfg/DFGDriver.cpp:
7337         (JSC::DFG::compile):
7338         * dfg/DFGFixupPhase.cpp:
7339         (JSC::DFG::FixupPhase::fixupNode):
7340
7341 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
7342
7343         REGRESSION (r119779): Javascript TypeError: 'undefined' is not an object
7344         https://bugs.webkit.org/show_bug.cgi?id=88783
7345         <rdar://problem/11640299>
7346
7347         Reviewed by Geoffrey Garen.
7348
7349         If you don't keep alive the base of an object access over the various checks
7350         you do for the prototype chain, you're going to have a bad time.
7351
7352         * dfg/DFGByteCodeParser.cpp:
7353         (JSC::DFG::ByteCodeParser::handleGetById):
7354
7355 2012-06-12  Hojong Han  <hojong.han@samsung.com>
7356
7357         Property names of the built-in object cannot be retrieved
7358         after trying to delete one of its properties
7359         https://bugs.webkit.org/show_bug.cgi?id=86461
7360
7361         Reviewed by Gavin Barraclough.
7362
7363         * runtime/JSObject.cpp:
7364         (JSC::getClassPropertyNames):
7365         (JSC::JSObject::getOwnPropertyNames):
7366
7367 2012-06-11  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
7368
7369         [CMAKE][EFL] Remove duplicated executable output path
7370         https://bugs.webkit.org/show_bug.cgi?id=88765
7371
7372         Reviewed by Daniel Bates.
7373
7374         CMake files for EFL port have redefined executable output path. However, EFL port doesn't
7375         need to define again because it is already defined in top-level CMake file.
7376
7377         * shell/CMakeLists.txt:
7378
7379 2012-06-11  Carlos Garcia Campos  <cgarcia@igalia.com>
7380
7381         Unreviewed. Fix make distcheck issues.
7382
7383         * GNUmakefile.list.am: Remove non existent header file.
7384
7385 2012-06-10  Patrick Gansterer  <paroga@webkit.org>
7386
7387         Unreviewed. Build fix for !ENABLE(JIT) after r119844 and r119925.
7388
7389         * runtime/Executable.h:
7390         (ExecutableBase):
7391         (JSC::ExecutableBase::clearCodeVirtual):
7392
7393 2012-06-10  Patrick Gansterer  <paroga@webkit.org>
7394
7395         Unreviewed. Build fix for !ENABLE(JIT) after r119844.
7396
7397         * runtime/Executable.h:
7398         (ExecutableBase):
7399         (JSC):
7400
7401 2012-06-09  Dominic Cooney  <dominicc@chromium.org>
7402
7403         [Chromium] Remove JavaScriptCore dependencies from gyp
7404         https://bugs.webkit.org/show_bug.cgi?id=88510
7405
7406         Reviewed by Adam Barth.
7407
7408         Chromium doesn't support JSC any more and there doesn't seem to be
7409         a strong interest in using GYP as the common build system in other
7410         ports.
7411
7412         * JavaScriptCore.gyp/JavaScriptCore.gyp: WebCore still depends on YARR interpreter.
7413         * JavaScriptCore.gypi: Only include YARR source.
7414         * gyp/JavaScriptCore.gyp: Removed.
7415         * gyp/gtk.gyp: Removed.
7416
7417 2012-06-09  Geoffrey Garen  <ggaren@apple.com>
7418
7419         Unreviewed, rolling back in part2 of r118646.
7420
7421         This patch removes eager finalization.
7422
7423         Weak pointer finalization should be lazy
7424         https://bugs.webkit.org/show_bug.cgi?id=87599
7425
7426         Reviewed by Sam Weinig.
7427
7428         * heap/Heap.cpp:
7429         (JSC::Heap::collect): Don't finalize eagerly -- we'll do it lazily.
7430
7431         * heap/MarkedBlock.cpp:
7432         (JSC::MarkedBlock::sweep): Do sweep weak sets when sweeping a block,
7433         since we won't get another chance.
7434
7435         * heap/MarkedBlock.h:
7436         (JSC::MarkedBlock::sweepWeakSet):
7437         * heap/MarkedSpace.cpp:
7438         (MarkedSpace::WeakSetSweep):
7439         * heap/MarkedSpace.h:
7440         (JSC::MarkedSpace::sweepWeakSets): Removed now-unused code.
7441
7442 2012-06-09  Sukolsak Sakshuwong  <sukolsak@google.com>
7443
7444         Add UNDO_MANAGER flag
7445         https://bugs.webkit.org/show_bug.cgi?id=87908
7446
7447         Reviewed by Tony Chang.
7448
7449         * Configurations/FeatureDefines.xcconfig:
7450
7451 2012-06-08  Geoffrey Garen  <ggaren@apple.com>
7452
7453         Unreviewed, rolling back in part1 of r118646.
7454
7455         This patch includes everything necessary for lazy finalization, but
7456         keeps eager finalization enabled for the time being.
7457
7458         Weak pointer finalization should be lazy
7459         https://bugs.webkit.org/show_bug.cgi?id=87599
7460
7461         Reviewed by Sam Weinig.
7462
7463         * heap/MarkedBlock.cpp:
7464         * heap/MarkedBlock.h:
7465         (JSC::MarkedBlock::resetAllocator):
7466         * heap/MarkedSpace.cpp:
7467         (JSC::MarkedSpace::resetAllocators):
7468         * heap/MarkedSpace.h:
7469         (JSC::MarkedSpace::resetAllocators): Don't force allocator reset anymore.
7470         It will happen automatically when a weak set is swept. It's simpler to
7471         have only one canonical way for this to happen, and it wasn't buying
7472         us anything to do it eagerly.
7473         * heap/WeakBlock.cpp:
7474         (JSC::WeakBlock::sweep): Don't short-circuit a sweep unless we know
7475         the sweep would be a no-op. If even one finalizer is pending, we need to
7476         run it, since we won't get another chance.
7477         * heap/WeakSet.cpp:
7478         (JSC::WeakSet::sweep): This loop can be simpler now that
7479         WeakBlock::sweep() does what we mean.
7480         Reset our allocator after a sweep because this is the optimal time to
7481         start trying to recycle old weak pointers.
7482         (JSC::WeakSet::tryFindAllocator): Don't sweep when searching for an
7483         allocator because we've swept already, and forcing a new sweep would be
7484         wasteful.
7485         * heap/WeakSet.h:
7486         (JSC::WeakSet::shrink): Be sure to reset our allocator after a shrink
7487         because the shrink may have removed the block the allocator was going to
7488         allocate out of.
7489
7490 2012-06-08  Gavin Barraclough  <barraclough@apple.com>
7491
7492         Unreviewed roll out r119795.
7493
7494         This broke jquery/core.html
7495
7496         * dfg/DFGSpeculativeJIT.h:
7497         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
7498         * jit/JITInlineMethods.h:
7499         (JSC::JIT::emitAllocateBasicJSObject):
7500         * llint/LowLevelInterpreter.asm:
7501         * runtime/JSGlobalData.h:
7502         (JSGlobalData):
7503         * runtime/JSGlobalThis.cpp:
7504         (JSC::JSGlobalThis::setUnwrappedObject):
7505         * runtime/JSObject.cpp:
7506         (JSC::JSObject::visitChildren):
7507         (JSC::JSObject::createInheritorID):
7508         * runtime/JSObject.h:
7509         (JSObject):
7510         (JSC::JSObject::resetInheritorID):
7511         (JSC):
7512         (JSC::JSObject::offsetOfInheritorID):
7513         (JSC::JSObject::inheritorID):
7514
7515 2012-06-08  Filip Pizlo  <fpizlo@apple.com>
7516
7517         PredictedType should be called SpeculatedType
7518         https://bugs.webkit.org/show_bug.cgi?id=88477
7519
7520         Unreviewed, fix a renaming goof from http://trac.webkit.org/changeset/119660.
7521         I accidentally renamed ByteCodeParser::getPrediction to
7522         ByteCodeParser::getSpeculation.  That was not the intent. This changes it
7523         back.
7524
7525         * dfg/DFGByteCodeParser.cpp:
7526         (JSC::DFG::ByteCodeParser::addCall):
7527         (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
7528         (JSC::DFG::ByteCodeParser::getPrediction):
7529         (JSC::DFG::ByteCodeParser::handleCall):
7530         (JSC::DFG::ByteCodeParser::parseBlock):
7531
7532 2012-06-08  Andy Wingo  <wingo@igalia.com>
7533
7534         Explictly mark stubs called by JIT as being internal
7535         https://bugs.webkit.org/show_bug.cgi?id=88552
7536
7537         Reviewed by Filip Pizlo.
7538
7539         * dfg/DFGOSRExitCompiler.h:
7540         * dfg/DFGOperations.cpp:
7541         * dfg/DFGOperations.h:
7542         * jit/HostCallReturnValue.h:
7543         * jit/JITStubs.cpp:
7544         * jit/JITStubs.h:
7545         * jit/ThunkGenerators.cpp:
7546         * llint/LLIntSlowPaths.h: Mark a bunch of stubs as being
7547         WTF_INTERNAL.  Change most calls to SYMBOL_STRING_RELOCATION to
7548         LOCAL_REFERENCE, or GLOBAL_REFERENCE in the case of the wrappers
7549         to truly global symbols.
7550         * offlineasm/asm.rb: Generate LOCAL_REFERENCE instead of
7551         SYMBOL_STRING_RELOCATION.
7552
7553 2012-06-08  Geoffrey Garen  <ggaren@apple.com>
7554
7555         Don't rely on weak pointers for eager CodeBlock finalization
7556         https://bugs.webkit.org/show_bug.cgi?id=88465
7557
7558         Reviewed by Gavin Barraclough.
7559
7560         This is incompatible with lazy weak pointer finalization.
7561
7562         I considered just making CodeBlock finalization lazy-friendly, but it
7563         turns out that the heap is already way up in CodeBlock's business when
7564         it comes to finalization, so I decided to finish the job and move full
7565         responsibility for CodeBlock finalization into the heap.
7566
7567         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Maybe this
7568         will build.
7569
7570         * debugger/Debugger.cpp: Updated for rename.
7571
7572         * heap/Heap.cpp:
7573         (JSC::Heap::deleteAllCompiledCode): Renamed for consistency. Fixed a bug
7574         where we would not delete code for a code block that had been previously
7575         jettisoned. I don't know if this happens in practice -- I mostly did
7576         this to improve consistency with deleteUnmarkedCompiledCode.
7577
7578         (JSC::Heap::deleteUnmarkedCompiledCode): New function, responsible for
7579         eager finalization of unmarked code blocks.
7580
7581         (JSC::Heap::collect): Updated for rename. Updated to call
7582         deleteUnmarkedCompiledCode(), which takes care of jettisoned DFG code
7583         blocks too.
7584
7585         (JSC::Heap::addCompiledCode): Renamed, since this points to all code
7586         now, not just functions.
7587
7588         * heap/Heap.h:
7589         (Heap): Keep track of all user code, not just functions. This is a
7590         negligible additional overhead, since most code is function code.
7591
7592         * runtime/Executable.cpp:
7593         (JSC::*::finalize): Removed these functions, since we don't rely on
7594         weak pointer finalization anymore.
7595
7596         (JSC::FunctionExecutable::FunctionExecutable): Moved linked-list stuff
7597         into base class so all executables can be in the list.
7598
7599         (JSC::EvalExecutable::clearCode):
7600         (JSC::ProgramExecutable::clearCode):
7601         (JSC::FunctionExecutable::clearCode): All we need to do is delete our
7602         CodeBlock -- that will delete all of its internal data structures.
7603
7604         (JSC::FunctionExecutable::clearCodeIfNotCompiling): Factored out a helper
7605         function to improve clarity.
7606
7607         * runtime/Executable.h:
7608         (JSC::ExecutableBase): Moved linked-list stuff
7609         into base class so all executables can be in the list.
7610
7611         (JSC::NativeExecutable::create):
7612         (NativeExecutable):
7613         (ScriptExecutable):
7614         (JSC::ScriptExecutable::finishCreation):
7615         (JSC::EvalExecutable::create):
7616         (EvalExecutable):
7617         (JSC::ProgramExecutable::create):
7618         (ProgramExecutable):
7619         (FunctionExecutable):
7620         (JSC::FunctionExecutable::create): Don't use a finalizer -- the heap
7621         will call us back to destroy our code block.
7622
7623         (JSC::FunctionExecutable::discardCode): Renamed to clearCodeIfNotCompiling()
7624         for clarity.
7625
7626         (JSC::FunctionExecutable::isCompiling): New helper function, for clarity.
7627
7628         (JSC::ScriptExecutable::clearCodeVirtual): New helper function, since
7629         the heap needs to make polymorphic calls to clear code.
7630
7631         * runtime/JSGlobalData.cpp:
7632         (JSC::StackPreservingRecompiler::operator()):
7633         * runtime/JSGlobalObject.cpp:
7634         (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Updated for
7635         renames.
7636
7637 2012-06-07  Filip Pizlo  <fpizlo@apple.com>
7638
7639         DFG should inline prototype chain accesses, and do the right things if the
7640         specific function optimization is available
7641         https://bugs.webkit.org/show_bug.cgi?id=88594
7642
7643         Reviewed by Gavin Barraclough.
7644
7645         Looks like a 3% win on V8.
7646
7647         * bytecode/CodeBlock.h:
7648         (JSC::Structure::prototypeForLookup):
7649         (JSC):
7650         * bytecode/GetByIdStatus.cpp:
7651         (JSC::GetByIdStatus::computeFromLLInt):
7652         (JSC):
7653         (JSC::GetByIdStatus::computeForChain):
7654         (JSC::GetByIdStatus::computeFor):
7655         * bytecode/GetByIdStatus.h:
7656         (JSC::GetByIdStatus::GetByIdStatus):
7657         (JSC::GetByIdStatus::isSimple):
7658         (JSC::GetByIdStatus::chain):
7659         (JSC::GetByIdStatus::specificValue):
7660         (GetByIdStatus):
7661         * bytecode/StructureSet.h:
7662         (StructureSet):
7663         (JSC::StructureSet::singletonStructure):
7664         * bytecode/StructureStubInfo.h:
7665         (JSC::StructureStubInfo::initGetByIdProto):
7666         (JSC::StructureStubInfo::initGetByIdChain):
7667         * dfg/DFGByteCodeParser.cpp:
7668         (JSC::DFG::ByteCodeParser::handleGetById):
7669         * dfg/DFGRepatch.cpp:
7670         (JSC::DFG::tryCacheGetByID):
7671         * jit/JITStubs.cpp:
7672         (JSC::JITThunks::tryCacheGetByID):
7673         * runtime/JSGlobalObject.h:
7674         (JSC::Structure::prototypeForLookup):
7675         (JSC):
7676         * runtime/Structure.h:
7677         (Structure):
7678
7679 2012-06-07  Gavin Barraclough  <barraclough@apple.com>
7680
7681         Remove JSObject::m_inheritorID
7682         https://bugs.webkit.org/show_bug.cgi?id=88378
7683
7684         Reviewed by Geoff Garen.
7685
7686         This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
7687         and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
7688         Instead use a private named value in the object's property storage.
7689
7690         * dfg/DFGSpeculativeJIT.h:
7691         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
7692             - No need m_inheritorID to initialize!
7693         * jit/JITInlineMethods.h:
7694         (JSC::JIT::emitAllocateBasicJSObject):
7695             - No need m_inheritorID to initialize!
7696         * llint/LowLevelInterpreter.asm:
7697             - No need m_inheritorID to initialize!
7698         * runtime/JSGlobalData.h:
7699         (JSGlobalData):
7700             - Added private name 'm_inheritorIDKey'.
7701         * runtime/JSGlobalThis.cpp:
7702         (JSC::JSGlobalThis::setUnwrappedObject):
7703             - resetInheritorID is now passed a JSGlobalData&.
7704         * runtime/JSObject.cpp:
7705         (JSC::JSObject::visitChildren):
7706             - No m_inheritorID to be marked.
7707         (JSC::JSObject::createInheritorID):
7708             - Store the newly created inheritorID in the property map.
7709         * runtime/JSObject.h:
7710         (JSC::JSObject::resetInheritorID):
7711             - Remove the inheritorID from property storage.
7712         (JSC::JSObject::inheritorID):
7713             - Read the inheritorID from property storage.
7714
7715 2012-06-07  Gavin Barraclough  <barraclough@apple.com>
7716
7717         Math.pow on iOS does not support denormal numbers.
7718         https://bugs.webkit.org/show_bug.cgi?id=88592
7719
7720         Reviewed by Filip Pizlo.
7721
7722         Import an implementation from fdlibm, detect cases where it is safe to use the system
7723         implementation & where we should fall back to fdlibm.
7724
7725         * runtime/MathObject.cpp:
7726         (JSC::isDenormal):
7727         (JSC::isEdgeCase):
7728         (JSC::mathPow):
7729             - On iOS, detect cases where denormal support may be required & use fdlibm in these cases.
7730         (JSC::mathProtoFuncPow):
7731             - Changed to use mathPow.
7732         (JSC::fdlibmScalbn):
7733         (JSC::fdlibmPow):
7734             - These functions imported from fdlibm; original style retained to ease future merging.
7735
7736 2012-06-07  Patrick Gansterer  <paroga@webkit.org>
7737
7738         Unreviewed. Build fix for !ENABLE(JIT) after r119441.
7739
7740         * interpreter/Interpreter.cpp:
7741         (JSC::Interpreter::privateExecute):
7742
7743 2012-06-07  Andy Wingo  <wingo@igalia.com>
7744
7745         Unreviewed build fix after r119593.
7746
7747         * llint/LLIntOfflineAsmConfig.h (OFFLINE_ASM_GLOBAL_LABEL): Fix
7748         uses of "name" to be "label", the macro's parameter.  Otherwise we
7749         serialize mentions of the literal symbol "name" into the objcode.
7750         Causes a build error using GNU ld (not gold).
7751
7752 2012-06-06  Ryosuke Niwa  <rniwa@webkit.org>
7753
7754         Chromium build fix attempt. Why do we need to list these files in gyp!?
7755
7756         * JavaScriptCore.gypi:
7757
7758 2012-06-06  Filip Pizlo  <fpizlo@apple.com>
7759
7760         PredictedType should be called SpeculatedType
7761         https://bugs.webkit.org/show_bug.cgi?id=88477
7762
7763         Rubber stamped by Gavin Barraclough.
7764
7765         * CMakeLists.txt:
7766         * GNUmakefile.list.am:
7767         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
7768         * JavaScriptCore.xcodeproj/project.pbxproj:
7769         * Target.pri:
7770         * bytecode/CodeBlock.cpp:
7771         (JSC::CodeBlock::shouldOptimizeNow):
7772         (JSC::CodeBlock::dumpValueProfiles):
7773         * bytecode/CodeBlock.h:
7774         (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
7775         * bytecode/LazyOperandValueProfile.cpp:
7776         (JSC::LazyOperandValueProfileParser::prediction):
7777         * bytecode/LazyOperandValueProfile.h:
7778         (LazyOperandValueProfileParser):
7779         * bytecode/PredictedType.cpp: Removed.
7780         * bytecode/PredictedType.h: Removed.
7781         * bytecode/SpeculatedType.cpp: Copied from Source/JavaScriptCore/bytecode/PredictedType.cpp.
7782         (JSC::speculationToString):
7783         (JSC::speculationToAbbreviatedString):
7784         (JSC::speculationFromClassInfo):
7785         (JSC::speculationFromStructure):
7786         (JSC::speculationFromCell):
7787         (JSC::speculationFromValue):
7788         * bytecode/SpeculatedType.h: Copied from Source/JavaScriptCore/bytecode/PredictedType.h.
7789         (JSC):
7790         (JSC::isAnySpeculation):
7791         (JSC::isCellSpeculation):
7792         (JSC::isObjectSpeculation):
7793         (JSC::isFinalObjectSpeculation):
7794         (JSC::isFinalObjectOrOtherSpeculation):
7795         (JSC::isFixedIndexedStorageObjectSpeculation):
7796         (JSC::isStringSpeculation):
7797         (JSC::isArraySpeculation):
7798         (JSC::isFunctionSpeculation):
7799         (JSC::isInt8ArraySpeculation):
7800         (JSC::isInt16ArraySpeculation):
7801         (JSC::isInt32ArraySpeculation):
7802         (JSC::isUint8ArraySpeculation):
7803         (JSC::isUint8ClampedArraySpeculation):
7804         (JSC::isUint16ArraySpeculation):
7805         (JSC::isUint32ArraySpeculation):
7806         (JSC::isFloat32ArraySpeculation):
7807         (JSC::isFloat64ArraySpeculation):
7808         (JSC::isArgumentsSpeculation):
7809         (JSC::isActionableIntMutableArraySpeculation):
7810         (JSC::isActionableFloatMutableArraySpeculation):
7811         (JSC::isActionableTypedMutableArraySpeculation):
7812         (JSC::isActionableMutableArraySpeculation):
7813         (JSC::isActionableArraySpeculation):
7814         (JSC::isArrayOrOtherSpeculation):
7815         (JSC::isMyArgumentsSpeculation):
7816         (JSC::isInt32Speculation):
7817         (JSC::isDoubleRealSpeculation):
7818         (JSC::isDoubleSpeculation):
7819         (JSC::isNumberSpeculation):
7820         (JSC::isBooleanSpeculation):
7821         (JSC::isOtherSpeculation):
7822         (JSC::isEmptySpeculation):
7823         (JSC::mergeSpeculations):
7824         (JSC::mergeSpeculation):
7825         * bytecode/StructureSet.h:
7826         (JSC::StructureSet::speculationFromStructures):
7827         * bytecode/ValueProfile.h:
7828         (JSC::ValueProfileBase::ValueProfileBase):
7829         (JSC::ValueProfileBase::dump):
7830         (JSC::ValueProfileBase::computeUpdatedPrediction):
7831         (ValueProfileBase):
7832         * dfg/DFGAbstractState.cpp:
7833         (JSC::DFG::AbstractState::initialize):
7834         (JSC::DFG::AbstractState::execute):
7835         (JSC::DFG::AbstractState::mergeStateAtTail):
7836         * dfg/DFGAbstractState.h:
7837         (JSC::DFG::AbstractState::speculateInt32Unary):
7838         (JSC::DFG::AbstractState::speculateNumberUnary):
7839         (JSC::DFG::AbstractState::speculateBooleanUnary):
7840         (JSC::DFG::AbstractState::speculateInt32Binary):
7841         (JSC::DFG::AbstractState::speculateNumberBinary):
7842         * dfg/DFGAbstractValue.h:
7843         (JSC::DFG::StructureAbstractValue::filter):
7844         (JSC::DFG::StructureAbstractValue::speculationFromStructures):
7845         (JSC::DFG::AbstractValue::AbstractValue):
7846         (JSC::DFG::AbstractValue::clear):
7847         (JSC::DFG::AbstractValue::isClear):
7848         (JSC::DFG::AbstractValue::makeTop):
7849         (JSC::DFG::AbstractValue::clobberStructures):
7850         (JSC::DFG::AbstractValue::isTop):
7851         (JSC::DFG::AbstractValue::set):
7852         (JSC::DFG::AbstractValue::merge):
7853         (JSC::DFG::AbstractValue::filter):
7854         (JSC::DFG::AbstractValue::validateIgnoringValue):
7855         (JSC::DFG::AbstractValue::validate):
7856         (JSC::DFG::AbstractValue::checkConsistency):
7857         (JSC::DFG::AbstractValue::dump):
7858         (AbstractValue):
7859         * dfg/DFGArgumentPosition.h:
7860         (JSC::DFG::ArgumentPosition::ArgumentPosition):
7861         (JSC::DFG::ArgumentPosition::mergeArgumentAwareness):
7862         (JSC::DFG::ArgumentPosition::prediction):
7863         (ArgumentPosition):
7864         * dfg/DFGArgumentsSimplificationPhase.cpp:
7865         (JSC::DFG::ArgumentsSimplificationPhase::run):
7866         * dfg/DFGByteCodeParser.cpp:
7867         (ByteCodeParser):
7868         (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
7869         (JSC::DFG::ByteCodeParser::getLocal):
7870         (JSC::DFG::ByteCodeParser::getArgument):
7871         (JSC::DFG::ByteCodeParser::addCall):
7872         (JSC::DFG::ByteCodeParser::getSpeculationWithoutOSRExit):
7873         (JSC::DFG::ByteCodeParser::getSpeculation):
7874         (InlineStackEntry):
7875         (JSC::DFG::ByteCodeParser::handleCall):
7876         (JSC::DFG::ByteCodeParser::handleIntrinsic):
7877         (JSC::DFG::ByteCodeParser::handleGetById):
7878         (JSC::DFG::ByteCodeParser::parseBlock):
7879         (JSC::DFG::ByteCodeParser::fixVariableAccessSpeculations):
7880         (JSC::DFG::ByteCodeParser::parse):
7881         * dfg/DFGCSEPhase.cpp:
7882         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
7883         (JSC::DFG::CSEPhase::performNodeCSE):
7884         * dfg/DFGConstantFoldingPhase.cpp:
7885         (JSC::DFG::ConstantFoldingPhase::run):
7886         * dfg/DFGFixupPhase.cpp:
7887         (JSC::DFG::FixupPhase::fixupNode):
7888         (JSC::DFG::FixupPhase::fixDoubleEdge):
7889         * dfg/DFGGraph.cpp:
7890         (JSC::DFG::Graph::nameOfVariableAccessData):
7891         (JSC::DFG::Graph::dump):
7892         (JSC::DFG::Graph::predictArgumentTypes):
7893         * dfg/DFGGraph.h:
7894         (JSC::DFG::Graph::getJSConstantSpeculation):
7895         (JSC::DFG::Graph::isPredictedNumerical):
7896         (JSC::DFG::Graph::byValIsPure):
7897         * dfg/DFGJITCompiler.h:
7898         (JSC::DFG::JITCompiler::getSpeculation):
7899         * dfg/DFGNode.h:
7900         (JSC::DFG::Node::Node):
7901         (JSC::DFG::Node::getHeapPrediction):
7902         (JSC::DFG::Node::predictHeap):
7903         (JSC::DFG::Node::prediction):
7904         (JSC::DFG::Node::predict):
7905         (JSC::DFG::Node::shouldSpeculateInteger):
7906         (JSC::DFG::Node::shouldSpeculateDouble):
7907         (JSC::DFG::Node::shouldSpeculateNumber):
7908         (JSC::DFG::Node::shouldSpeculateBoolean):
7909         (JSC::DFG::Node::shouldSpeculateFinalObject):
7910         (JSC::DFG::Node::shouldSpeculateFinalObjectOrOther):
7911         (JSC::DFG::Node::shouldSpeculateArray):
7912         (JSC::DFG::Node::shouldSpeculateArguments):
7913         (JSC::DFG::Node::shouldSpeculateInt8Array):
7914         (JSC::DFG::Node::shouldSpeculateInt16Array):
7915         (JSC::DFG::Node::shouldSpeculateInt32Array):
7916         (JSC::DFG::Node::shouldSpeculateUint8Array):
7917         (JSC::DFG::Node::shouldSpeculateUint8ClampedArray):
7918         (JSC::DFG::Node::shouldSpeculateUint16Array):
7919         (JSC::DFG::Node::shouldSpeculateUint32Array):
7920         (JSC::DFG::Node::shouldSpeculateFloat32Array):
7921         (JSC::DFG::Node::shouldSpeculateFloat64Array):
7922         (JSC::DFG::Node::shouldSpeculateArrayOrOther):
7923         (JSC::DFG::Node::shouldSpeculateObject):
7924         (JSC::DFG::Node::shouldSpeculateCell):
7925         (Node):
7926         * dfg/DFGPredictionPropagationPhase.cpp:
7927         (JSC::DFG::PredictionPropagationPhase::setPrediction):
7928         (JSC::DFG::PredictionPropagationPhase::mergePrediction):
7929         (JSC::DFG::PredictionPropagationPhase::propagate):
7930         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
7931         * dfg/DFGSpeculativeJIT.cpp:
7932         (JSC::DFG::SpeculativeJIT::fillStorage):
7933         (JSC::DFG::SpeculativeJIT::writeBarrier):
7934         (JSC::DFG::GPRTemporary::GPRTemporary):
7935         (JSC::DFG::FPRTemporary::FPRTemporary):
7936         (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
7937         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
7938         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
7939         (JSC::DFG::SpeculativeJIT::compile):
7940         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
7941         (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
7942         (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
7943         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
7944         (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
7945         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
7946         (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLength):
7947         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
7948         (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
7949         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
7950         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
7951         (JSC::DFG::SpeculativeJIT::compileInstanceOf):
7952         (JSC::DFG::SpeculativeJIT::compileAdd):
7953         (JSC::DFG::SpeculativeJIT::compileArithSub):
7954         (JSC::DFG::SpeculativeJIT::compileArithNegate):
7955         (JSC::DFG::SpeculativeJIT::compileArithMul):
7956         (JSC::DFG::SpeculativeJIT::compileArithMod):
7957         (JSC::DFG::SpeculativeJIT::compare):
7958         (JSC::DFG::SpeculativeJIT::compileStrictEq):
7959         (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
7960         (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
7961         (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
7962         (JSC::DFG::SpeculativeJIT::compileRegExpExec):
7963         * dfg/DFGSpeculativeJIT.h:
7964         (DFG):
7965         (JSC::DFG::ValueSource::forSpeculation):
7966         (SpeculativeJIT):
7967         (GPRTemporary):
7968         (FPRTemporary):
7969         (JSC::DFG::SpecDoubleOperand::SpecDoubleOperand):
7970         (JSC::DFG::SpecDoubleOperand::~SpecDoubleOperand):
7971         (JSC::DFG::SpecDoubleOperand::fpr):
7972         (JSC::DFG::SpecCellOperand::SpecCellOperand):
7973         (JSC::DFG::SpecCellOperand::~SpecCellOperand):
7974         (JSC::DFG::SpecCellOperand::gpr):
7975         (JSC::DFG::SpecBooleanOperand::SpecBooleanOperand):
7976         (JSC::DFG::SpecBooleanOperand::~SpecBooleanOperand):
7977         (JSC::DFG::SpecBooleanOperand::gpr):
7978         * dfg/DFGSpeculativeJIT32_64.cpp:
7979         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
7980         (JSC::DFG::SpeculativeJIT::fillSpecDouble):
7981         (JSC::DFG::SpeculativeJIT::fillSpecCell):
7982         (JSC::DFG::SpeculativeJIT::fillSpecBoolean):
7983         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
7984         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
7985         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
7986         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
7987         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
7988         (JSC::DFG::SpeculativeJIT::emitBranch):
7989         (JSC::DFG::SpeculativeJIT::compile):
7990         * dfg/DFGSpeculativeJIT64.cpp:
7991         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
7992         (JSC::DFG::SpeculativeJIT::fillSpecDouble):
7993         (JSC::DFG::SpeculativeJIT::fillSpecCell):
7994         (JSC::DFG::SpeculativeJIT::fillSpecBoolean):
7995         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
7996         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
7997         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
7998         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
7999         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
8000         (JSC::DFG::SpeculativeJIT::emitBranch):
8001         (JSC::DFG::SpeculativeJIT::compile):
8002         * dfg/DFGVariableAccessData.h:
8003         (JSC::DFG::VariableAccessData::VariableAccessData):
8004         (JSC::DFG::VariableAccessData::predict):
8005         (JSC::DFG::VariableAccessData::nonUnifiedPrediction):
8006         (JSC::DFG::VariableAccessData::prediction):
8007         (JSC::DFG::VariableAccessData::argumentAwarePrediction):
8008         (JSC::DFG::VariableAccessData::mergeArgumentAwarePrediction):
8009         (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
8010         (JSC::DFG::VariableAccessData::makePredictionForDoubleFormat):
8011         (VariableAccessData):
8012
8013 2012-06-06  Filip Pizlo  <fpizlo@apple.com>
8014
8015         Global object variable accesses should not require an extra load
8016         https://bugs.webkit.org/show_bug.cgi?id=88385
8017
8018         Reviewed by Gavin Barraclough and Geoffrey Garen.
8019
8020         Previously, if you wanted to access a global variable, you'd first have
8021         to load the register array from the appropriate global object and then
8022         either load or store at an offset to the register array. This is because
8023         JSGlobalObject inherited from JSVariableObject, and JSVariableObject is
8024         designed with the pessimistic assumption that its register array may
8025         point into the call stack. This is never the case for global objects.
8026         Hence, even though the global object may add more registers at any time,
8027         it does not need to store them in a contiguous array. It can use a
8028         SegmentedVector or similar.
8029
8030         This patch refactors global objects and variable objects as follows:
8031
8032         - The functionality to track variables in an indexable array using a
8033           SymbolTable to map names to indices is moved into JSSymbolTableObject,
8034           which is now a supertype of JSVariableObject. JSVariableObject is now
8035           just a holder for a registers array and implements the registerAt()
8036           method that is left abstract in JSSymbolTableObject. Because all users
8037           of JSVariableObject know whether they are a JSStaticScopeObject,
8038           JSActivation, or JSGlobalObject, this "abstract" method is not virtual;
8039           instead the utility methods that would call registerAt() are now
8040           template functions that require you to know statically what subtype of
8041           JSSymbolTableObject you're using (JSVariableObject or something else),
8042           so that registerAt() can be statically bound.
8043
8044         - A new class is added called JSSegmentedVariableObject, which only
8045           differs from JSVariableObject in how it allocates registers. It uses a
8046           SegmentedVector instead of manually managing a pointer to a contiguous
8047           slab of registers. This changes the interface somewhat; for example
8048           with JSVariableObject if you wanted to add a register you had to do
8049           it yourself since the JSVariableObject didn't know how the registers
8050           array ought to be allocated. With JSSegmentedVariableObject you can
8051           just call addRegisters(). JSSegmentedVariableObject preserves the
8052           invariant that once you get a pointer into a register, that pointer
8053           will continue to be valid so long as the JSSegmentedVariableObject is
8054           alive. This allows the JITs and interpreters to skip the extra load.
8055
8056         - JSGlobalObject now inherits from JSSegmentedVariableObject. For now
8057           (and possibly forever) it is the only subtype of this new class.
8058
8059         - The bytecode format is changed so that get_global_var and
8060           put_global_var have a pointer to the register directly rather than
8061           having an index. A convenience method is provided in
8062           JSSegmentedVariableObject to get the index given a a pointer, which is
8063           used for assertions and debug dumps.
8064
8065         This appears to be a 1% across the board win.
8066
8067         * CMakeLists.txt:
8068         * GNUmakefile.list.am:
8069         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
8070         * JavaScriptCore.xcodeproj/project.pbxproj:
8071         * Target.pri:
8072         * bytecode/CodeBlock.cpp:
8073         (JSC::CodeBlock::dump):
8074         * bytecode/Instruction.h:
8075         (Instruction):
8076         (JSC::Instruction::Instruction):
8077         * bytecompiler/BytecodeGenerator.cpp:
8078         (JSC::ResolveResult::registerPointer):
8079         (JSC):
8080         (JSC::BytecodeGenerator::BytecodeGenerator):
8081         (JSC::BytecodeGenerator::retrieveLastUnaryOp):
8082         (JSC::BytecodeGenerator::resolve):
8083         (JSC::BytecodeGenerator::resolveConstDecl):
8084         (JSC::BytecodeGenerator::emitGetStaticVar):
8085         (JSC::BytecodeGenerator::emitPutStaticVar):
8086         * bytecompiler/BytecodeGenerator.h:
8087         (ResolveResult):
8088         (BytecodeGenerator):
8089         * dfg/DFGAssemblyHelpers.h:
8090         (AssemblyHelpers):
8091         * dfg/DFGByteCodeParser.cpp:
8092         (JSC::DFG::ByteCodeParser::parseBlock):
8093         * dfg/DFGCSEPhase.cpp:
8094         (JSC::DFG::CSEPhase::globalVarLoadElimination):
8095         (JSC::DFG::CSEPhase::globalVarStoreElimination):
8096         (JSC::DFG::CSEPhase::performNodeCSE):
8097         * dfg/DFGGraph.cpp:
8098         (JSC::DFG::Graph::dump):
8099         * dfg/DFGGraph.h:
8100         (JSC::DFG::Graph::globalObjectFor):
8101         (Graph):
8102         * dfg/DFGNode.h:
8103         (JSC::DFG::Node::hasVarNumber):
8104         (Node):
8105         (JSC::DFG::Node::hasRegisterPointer):
8106         (JSC::DFG::Node::registerPointer):
8107         * dfg/DFGSpeculativeJIT32_64.cpp:
8108         (JSC::DFG::SpeculativeJIT::compile):
8109         * dfg/DFGSpeculativeJIT64.cpp:
8110         (JSC::DFG::SpeculativeJIT::compile):
8111         * heap/Heap.h:
8112         (Heap):
8113         (JSC::Heap::isWriteBarrierEnabled):
8114         (JSC):
8115         * interpreter/Interpreter.cpp:
8116         (JSC::Interpreter::execute):
8117         (JSC::Interpreter::privateExecute):
8118         * jit/JITPropertyAccess.cpp:
8119         (JSC::JIT::emit_op_get_global_var):
8120         (JSC::JIT::emit_op_put_global_var):
8121         * jit/JITPropertyAccess32_64.cpp:
8122         (JSC::JIT::emit_op_get_global_var):
8123         (JSC::JIT::emit_op_put_global_var):
8124         * llint/LowLevelInterpreter32_64.asm:
8125         * llint/LowLevelInterpreter64.asm:
8126         * runtime/JSGlobalObject.cpp:
8127         (JSC):
8128         (JSC::JSGlobalObject::put):
8129         (JSC::JSGlobalObject::putDirectVirtual):
8130         (JSC::JSGlobalObject::defineOwnProperty):
8131         (JSC::JSGlobalObject::visitChildren):
8132         (JSC::JSGlobalObject::addStaticGlobals):
8133         (JSC::JSGlobalObject::getOwnPropertySlot):
8134         (JSC::JSGlobalObject::getOwnPropertyDescriptor):
8135         * runtime/JSGlobalObject.h:
8136         (JSGlobalObject):
8137         (JSC::JSGlobalObject::JSGlobalObject):
8138         (JSC):
8139         (JSC::JSGlobalObject::hasOwnPropertyForWrite):
8140         * runtime/JSSegmentedVariableObject.cpp: Added.
8141         (JSC):
8142         (JSC::JSSegmentedVariableObject::findRegisterIndex):
8143         (JSC::JSSegmentedVariableObject::addRegisters):
8144         (JSC::JSSegmentedVariableObject::visitChildren):
8145         * runtime/JSSegmentedVariableObject.h: Added.
8146         (JSC):
8147         (JSSegmentedVariableObject):
8148         (JSC::JSSegmentedVariableObject::registerAt):
8149         (JSC::JSSegmentedVariableObject::assertRegisterIsInThisObject):
8150         (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
8151         (JSC::JSSegmentedVariableObject::finishCreation):
8152         * runtime/JSStaticScopeObject.cpp:
8153         (JSC::JSStaticScopeObject::put):
8154         (JSC::JSStaticScopeObject::putDirectVirtual):
8155         (JSC::JSStaticScopeObject::getOwnPropertySlot):
8156         * runtime/JSSymbolTableObject.cpp: Added.
8157         (JSC):
8158         (JSC::JSSymbolTableObject::destroy):
8159         (JSC::JSSymbolTableObject::deleteProperty):
8160         (JSC::JSSymbolTableObject::getOwnPropertyNames):
8161         (JSC::JSSymbolTableObject::putDirectVirtual):
8162         (JSC::JSSymbolTableObject::isDynamicScope):
8163         * runtime/JSSymbolTableObject.h: Added.
8164         (JSC):
8165         (JSSymbolTableObject):
8166         (JSC::JSSymbolTableObject::symbolTable):
8167         (JSC::JSSymbolTableObject::JSSymbolTableObject):
8168         (JSC::JSSymbolTableObject::finishCreation):
8169         (JSC::symbolTableGet):
8170         (JSC::symbolTablePut):
8171         (JSC::symbolTablePutWithAttributes):
8172         * runtime/JSVariableObject.cpp:
8173         (JSC):
8174         * runtime/JSVariableObject.h:
8175         (JSVariableObject):
8176         (JSC::JSVariableObject::JSVariableObject):
8177         (JSC::JSVariableObject::finishCreation):
8178         (JSC):
8179         * runtime/WriteBarrier.h:
8180
8181 2012-06-06  Filip Pizlo  <fpizlo@apple.com>
8182
8183         DFG arguments access slow path should not crash if the arguments haven't been created
8184         https://bugs.webkit.org/show_bug.cgi?id=88471
8185
8186         Reviewed by Gavin Barraclough.
8187
8188         * dfg/DFGCCallHelpers.h:
8189         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
8190         (CCallHelpers):
8191         * dfg/DFGOperations.cpp:
8192         * dfg/DFGOperations.h:
8193         * dfg/DFGSpeculativeJIT.h:
8194         (JSC::DFG::SpeculativeJIT::callOperation):
8195         * dfg/DFGSpeculativeJIT32_64.cpp:
8196         (JSC::DFG::SpeculativeJIT::compile):
8197         * dfg/DFGSpeculativeJIT64.cpp:
8198         (JSC::DFG::SpeculativeJIT::compile):
8199
8200 2012-06-06  Michael Saboff  <msaboff@apple.com>
8201
8202         ENH: Add Logging to GC Marking Phase
8203         https://bugs.webkit.org/show_bug.cgi?id=88364
8204
8205         Reviewed by Filip Pizlo.
8206
8207         Log GC marking to stderr or a file.  The logging in controlled
8208         with the define ENABLE_OBJECT_MARK_LOGGING in wtf/Platform.h.
8209         If DATA_LOG_TO_FILE in wtf/DataLog.cpp is set to 1, output is
8210         logged to a file otherwise it is logged to stderr.
8211
8212         When logging is enabled, the GC is built single threaded since the
8213         log output from the various threads isn't buffered and output in a
8214         thread safe manner.
8215
8216         * heap/Heap.cpp:
8217         (JSC::Heap::markRoots):
8218         * heap/MarkStack.cpp:
8219         (JSC::MarkStackThreadSharedData::resetChildren):
8220         (JSC::MarkStackThreadSharedData::childVisitCount):
8221         (JSC::MarkStackThreadSharedData::markingThreadMain):
8222         (JSC::MarkStackThreadSharedData::markingThreadStartFunc):
8223         (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
8224         (JSC::MarkStackThreadSharedData::reset):
8225         * heap/MarkStack.h:
8226         (MarkStackThreadSharedData):
8227         (MarkStack):
8228         (JSC::MarkStack::sharedData):
8229         (JSC::MarkStack::resetChildCount):
8230         (JSC::MarkStack::childCount):
8231         (JSC::MarkStack::incrementChildCount):
8232         * runtime/JSArray.cpp:
8233         (JSC::JSArray::visitChildren):
8234         * runtime/JSCell.cpp:
8235         (JSC::JSCell::className):
8236         * runtime/JSCell.h:
8237         (JSCell):
8238         (JSC::JSCell::visitChildren):
8239         * runtime/JSString.cpp:
8240         (JSC::JSString::visitChildren):
8241         * runtime/JSString.h:
8242         (JSString):
8243         * runtime/Structure.h:
8244         (JSC::MarkStack::internalAppend):
8245
8246 2012-06-06  Gavin Barraclough  <barraclough@apple.com>
8247
8248         Assigning to a static property should not change iteration order
8249         https://bugs.webkit.org/show_bug.cgi?id=88401
8250
8251         Reviewed by Geoff Garen.
8252
8253         A specific iteration order is not defined by the spec, but test-262 somewhat tenuously
8254         requires that it is at least stable, e.g. ch10/10.4/10.4.2/S10.4.2_A1.1_T1.js
8255
8256         Whilst it is not clear that this behavior really arises from the specification, it
8257         would seem like common sense to conform to this.
8258
8259         The problem here is that we allow properties in the structure to shadow those in the
8260         static table, and we iterate the properties in the structure first - which means that
8261         as values of existing properties are modified, their iteration order changes too.
8262
8263         The easy fix is to iterate the properties from the static table first. This has a
8264         further benefit, since it will mean that user added properties will come after those
8265         present in the static table (respected the expected insertion-order).
8266
8267         * runtime/JSObject.cpp:
8268         (JSC::JSObject::getOwnPropertyNames):
8269             - Iterate static properties first.
8270
8271 2012-06-06  Andy Wingo  <wingo@igalia.com>
8272
8273         Ensure consistent order of evaluation in LLInt slow paths
8274         https://bugs.webkit.org/show_bug.cgi?id=88409
8275
8276         Reviewed by Geoffrey Garen.
8277
8278         * llint/LLIntSlowPaths.cpp:
8279         (slow_path_mul)
8280         (slow_path_sub)
8281         (slow_path_div)
8282         (slow_path_mod)
8283         (slow_path_lshift)
8284         (slow_path_rshift)
8285         (slow_path_urshift)
8286         (slow_path_bitand)
8287         (slow_path_bitor)
8288         (slow_path_bitxor): Avoid calling toNumber, toInt32, or toUInt32
8289         multiple times without intervening sequence points.  Fixes
8290         fast/js/exception-sequencing-binops.html with GCC 4.7 on x86-64
8291         Linux, which reordered evaluation of the arguments to fmod.
8292
8293 2012-06-06  Andy Wingo  <wingo@igalia.com>
8294
8295         [GTK] Enable the LLInt
8296         https://bugs.webkit.org/show_bug.cgi?id=88315
8297
8298         Reviewed by Filip Pizlo.
8299
8300         * GNUmakefile.am: Add rules to generate LLIntDesiredOffsets.h and
8301         LLIntAssembly.h.
8302         * GNUmakefile.list.am: Add offlineasm and llint files to the
8303         dist.  Add LLInt source files to the build.
8304         * llint/LowLevelInterpreter.asm (crash): Generate a store of
8305         0xbbadbeef to a register, not to a constant.  Otherwise, gas was
8306         failing to assemble result.
8307         * offlineasm/asm.rb (labelReference): Generate a
8308         SYMBOL_STRING_RELOCATION instead of a SYMBOL_STRING, so that we go
8309         through the PLT on ELF systems.
8310
8311 2012-06-06  Andy Wingo  <wingo@igalia.com>
8312
8313         REGRESSION (r106478): None of the Paper.js JavaScript examples work
8314         https://bugs.webkit.org/show_bug.cgi?id=87158
8315
8316         Reviewed by Michael Saboff.
8317
8318         * bytecompiler/BytecodeGenerator.cpp:
8319         (JSC::BytecodeGenerator::resolve): If we have to bail out to
8320         dynamicResolve(), only skip static scopes from the head of the
8321         scope chain.  Before, we were also skipping activations with
8322         direct eval as well, which was incorrect.
8323
8324 2012-06-06  Dan Bernstein  <mitz@apple.com>
8325
8326         Reverted r119567, the fix for <http://webkit.org/b/88378>, because it broke the 32-bit build.
8327
8328         * dfg/DFGSpeculativeJIT.h:
8329         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
8330         * jit/JITInlineMethods.h:
8331         (JSC::JIT::emitAllocateBasicJSObject):
8332         * llint/LowLevelInterpreter.asm:
8333         * runtime/JSGlobalData.h:
8334         (JSGlobalData):
8335         * runtime/JSGlobalThis.cpp:
8336         (JSC::JSGlobalThis::setUnwrappedObject):
8337         * runtime/JSObject.cpp:
8338         (JSC::JSObject::visitChildren):
8339         (JSC::JSObject::createInheritorID):
8340         * runtime/JSObject.h:
8341         (JSObject):
8342         (JSC::JSObject::resetInheritorID):
8343         (JSC):
8344         (JSC::JSObject::offsetOfInheritorID):
8345         (JSC::JSObject::inheritorID):
8346
8347 2012-06-05  Yuqiang Xian  <yuqiang.xian@intel.com>
8348
8349         Improve Math.round and Math.floor intrinsic
8350         https://bugs.webkit.org/show_bug.cgi?id=88314
8351
8352         Reviewed by Filip Pizlo.
8353
8354         Currently we call a native function from the JIT code to complete the
8355         "round" and "floor" operations. We could inline some fast paths
8356         especially for those positive values on the platforms where floating
8357         point truncation is supported.
8358         This brings 3% gain on Kraken, especially 32% on audio-oscillator,
8359         and slight win on SunSpider, measured on IA32.
8360
8361         * jit/ThunkGenerators.cpp:
8362         (JSC::floorThunkGenerator):
8363         (JSC):
8364         (JSC::roundThunkGenerator):
8365
8366 2012-06-05  Gavin Barraclough  <barraclough@apple.com>
8367
8368         Remove JSObject::m_inheritorID
8369         https://bugs.webkit.org/show_bug.cgi?id=88378
8370
8371         Reviewed by Geoff Garen.
8372
8373         This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
8374         and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
8375         Instead use a private named value in the object's property storage.
8376
8377         * dfg/DFGSpeculativeJIT.h:
8378         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
8379             - No need m_inheritorID to initialize!
8380         * jit/JITInlineMethods.h:
8381         (JSC::JIT::emitAllocateBasicJSObject):
8382             - No need m_inheritorID to initialize!
8383         * llint/LowLevelInterpreter.asm:
8384             - No need m_inheritorID to initialize!
8385         * runtime/JSGlobalData.h:
8386         (JSGlobalData):
8387             - Added private name 'm_inheritorIDKey'.
8388         * runtime/JSGlobalThis.cpp:
8389         (JSC::JSGlobalThis::setUnwrappedObject):
8390             - resetInheritorID is now passed a JSGlobalData&.
8391         * runtime/JSObject.cpp:
8392         (JSC::JSObject::visitChildren):
8393             - No m_inheritorID to be marked.
8394         (JSC::JSObject::createInheritorID):
8395             - Store the newly created inheritorID in the property map.
8396         * runtime/JSObject.h:
8397         (JSC::JSObject::resetInheritorID):
8398             - Remove the inheritorID from property storage.
8399         (JSC::JSObject::inheritorID):
8400             - Read the inheritorID from property storage.
8401
8402 2012-06-05  Filip Pizlo  <fpizlo@apple.com>
8403
8404         DFG CFG simplification should not attempt to deref nodes inside of an unreachable subgraph
8405         https://bugs.webkit.org/show_bug.cgi?id=88362
8406
8407         Reviewed by Gavin Barraclough.
8408
8409         * dfg/DFGCFGSimplificationPhase.cpp:
8410         (JSC::DFG::CFGSimplificationPhase::fixPhis):
8411         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
8412
8413 2012-06-05  Mark Hahnenberg  <mhahnenberg@apple.com>
8414
8415         Entry into JSC should CRASH() if the Heap is busy
8416         https://bugs.webkit.org/show_bug.cgi?id=88355
8417
8418         Reviewed by Geoffrey Garen.
8419
8420         Interpreter::execute() returns jsNull() right now if we try to enter it while
8421         the Heap is busy (e.g. with a collection), which is okay, but some code paths
8422         that call Interpreter::execute() allocate objects before checking if the Heap
8423         is busy. Attempting to execute JS code while the Heap is busy should not be
8424         allowed and should be enforced by a release-mode CRASH() to prevent vague,
8425         unhelpful backtraces later on if somebody makes a mistake. Normally, recursively
8426         executing JS code is okay, e.g. for evals, but it should not occur during a
8427         Heap allocation or collection because the Heap is not guaranteed to be in a
8428         consistent state (especially during collections). We are protected from
8429         executing JS on the same Heap concurrently on two separate threads because
8430         they must each take a JSLock first. However, we are not protected from reentrant
8431         execution of JS on the same thread because JSLock allows reentrancy. Therefore,
8432         we should fail early if we detect an entrance into JS code while the Heap is busy.
8433
8434         * heap/Heap.cpp: Changed Heap::collect so that it sets the m_operationInProgress field
8435         at the beginning of collection and then unsets it at the end so that it is set at all
8436         times throughout the duration of a collection rather than sporadically during various
8437         phases. There is no reason to unset during a collection because our collector does
8438         not currently support running additional JS between the phases of a collection.
8439         (JSC::Heap::getConservativeRegisterRoots):
8440         (JSC::Heap::markRoots):
8441         (JSC::Heap::collect):
8442         * interpreter/Interpreter.cpp:
8443         (JSC::Interpreter::execute): Crash if the Heap is busy.
8444         * runtime/Completion.cpp: Crash if the Heap is busy. We do it here before we call
8445         Interpreter::execute() because we do some allocation prior to calling execute() which
8446         could cause Heap corruption if, for example, that allocation caused a collection.
8447         (JSC::evaluate):
8448
8449 2012-06-05  Dongwoo Im  <dw.im@samsung.com>
8450
8451         Add 'isProtocolHandlerRegistered' and 'unregisterProtocolHandler'.
8452         https://bugs.webkit.org/show_bug.cgi?id=73176
8453
8454         Reviewed by Adam Barth.
8455
8456         Two more APIs are added in Custom Scheme Handler specification.
8457         http://dev.w3.org/html5/spec/Overview.html#custom-handlers
8458         One is 'isProtocolHandlerRegistered' to query whether the specific URL
8459         is registered or not.
8460         The other is 'unregisterProtocolHandler' to remove the registered URL.
8461
8462         * Configurations/FeatureDefines.xcconfig: Add a macro 'ENABLE_CUSTOM_SCHEME_HANDLER'.
8463
8464 2012-06-04  Filip Pizlo  <fpizlo@apple.com>
8465
8466         DFG CFG simplification should correct the variables at the head of the predecessor block
8467         https://bugs.webkit.org/show_bug.cgi?id=88284
8468
8469         Reviewed by Geoffrey Garen.
8470
8471         * dfg/DFGCFGSimplificationPhase.cpp:
8472         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
8473
8474 2012-06-04  Geoffrey Garen  <ggaren@apple.com>
8475
8476         Unreviewed.
8477
8478         Rolled out r119364 because it's still causing crashes (when running
8479         v8-earley in release builds of DRT)
8480
8481         This time for sure!
8482
8483         * heap/Heap.cpp:
8484         (JSC::Heap::collect):
8485         * heap/MarkedBlock.cpp:
8486         (JSC::MarkedBlock::sweep):
8487         * heap/MarkedBlock.h:
8488         (JSC::MarkedBlock::resetAllocator):
8489         (JSC):
8490         * heap/MarkedSpace.cpp:
8491         (JSC::ResetAllocator::operator()):
8492         (JSC):
8493         (JSC::MarkedSpace::resetAllocators):
8494         (JSC::MarkedSpace::sweepWeakSets):
8495         * heap/MarkedSpace.h:
8496         (MarkedSpace):
8497         * heap/WeakBlock.cpp:
8498         (JSC::WeakBlock::sweep):
8499         * heap/WeakSet.cpp:
8500         (JSC::WeakSet::sweep):
8501         (JSC::WeakSet::tryFindAllocator):
8502         * heap/WeakSet.h:
8503         (JSC::WeakSet::shrink):
8504
8505 2012-06-04  Filip Pizlo  <fpizlo@apple.com>
8506
8507         DFG arguments simplification should have rationalized handling of TearOffArguments
8508         https://bugs.webkit.org/show_bug.cgi?id=88206
8509
8510         Reviewed by Geoffrey Garen.
8511
8512         - Accesses to the unmodified arguments register ought to have the same effect on
8513           alias/escape analysis of arguments as accesses to the mutable arguments register.
8514
8515         - The existence of TearOffArguments should not get in the way of arguments aliasing.
8516
8517         - TearOffArguments should be eliminated if CreateArguments is eliminated.
8518
8519         * dfg/DFGArgumentsSimplificationPhase.cpp:
8520         (JSC::DFG::ArgumentsSimplificationPhase::run):
8521         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
8522
8523 2012-06-04  Gavin Barraclough  <barraclough@apple.com>
8524
8525         Remove enabledProfilerReference
8526         https://bugs.webkit.org/show_bug.cgi?id=88258
8527
8528         Reviewed by Michael Saboff.
8529
8530         Make the enabled profiler a member of JSGlobalData, and switch code that accesses it to do so directly
8531         via the JSGlobalData, rather than holding a Profiler** reference to it. Do not pass the Profiler**
8532         reference to JIT code. This patch does not change the stack layout on entry into JIT code (passing an
8533         unused void* instead), since this is an intrusive change better handled in a separate patch.
8534
8535         * interpreter/Interpreter.cpp:
8536         (JSC::Interpreter::throwException):
8537         (JSC::Interpreter::execute):
8538         (JSC::Interpreter::executeCall):
8539         (JSC::Interpreter::executeConstruct):
8540         (JSC::Interpreter::privateExecute):
8541         * jit/JITCode.h:
8542         (JSC::JITCode::execute):
8543             - Don't pass Profiler** to JIT code.
8544         * jit/JITOpcodes.cpp:
8545         (JSC::JIT::emit_op_profile_will_call):
8546         (JSC::JIT::emit_op_profile_did_call):
8547         * jit/JITOpcodes32_64.cpp:
8548         (JSC::JIT::emit_op_profile_will_call):
8549         (JSC::JIT::emit_op_profile_did_call):
8550         * jit/JITStubs.cpp:
8551         (JSC):
8552         (JSC::ctiTrampoline):
8553         (JSC::ctiVMThrowTrampoline):
8554         (JSC::ctiOpThrowNotCaught):
8555         (JSC::JITThunks::JITThunks):
8556         (JSC::DEFINE_STUB_FUNCTION):
8557             - For ARM_THUMB2, rename ENABLE_PROFILER_REFERENCE_OFFSET to FIRST_STACK_ARGUMENT (which is how it is being used).
8558             - For MIPS, remove ENABLE_PROFILER_REFERENCE_OFFSET.
8559         * jit/JITStubs.h:
8560         (JITStackFrame):
8561         (JSC):
8562             - Renamed enabledProfilerReference to unusedX.
8563         * llint/LLIntSlowPaths.cpp:
8564         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
8565         * llint/LowLevelInterpreter.asm:
8566         * profiler/Profiler.cpp:
8567         (JSC):
8568         (JSC::Profiler::startProfiling):
8569         (JSC::Profiler::stopProfiling):
8570         * profiler/Profiler.h:
8571         (Profiler):
8572             - Removed s_sharedEnabledProfilerReference, enabledProfilerReference().
8573         * runtime/JSGlobalData.cpp:
8574         (JSC::JSGlobalData::JSGlobalData):
8575         * runtime/JSGlobalData.h:
8576         (JSC):
8577         (JSC::JSGlobalData::enabledProfiler):
8578         (JSGlobalData):
8579             - Added m_enabledProfiler, enabledProfiler().
8580         * runtime/JSGlobalObject.cpp:
8581         (JSC::JSGlobalObject::~JSGlobalObject):
8582
8583 2012-06-04  Filip Pizlo  <fpizlo@apple.com>
8584
8585         get_argument_by_val should be profiled everywhere
8586         https://bugs.webkit.org/show_bug.cgi?id=88205
8587
8588         Reviewed by Geoffrey Garen.
8589
8590         * jit/JITOpcodes32_64.cpp:
8591         (JSC::JIT::emitSlow_op_get_argument_by_val):
8592         * llint/LLIntSlowPaths.cpp:
8593         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
8594
8595 2012-06-04  Filip Pizlo  <fpizlo@apple.com>
8596
8597         DFG arguments simplification takes unkindly to direct accesses to the arguments register
8598         https://bugs.webkit.org/show_bug.cgi?id=88261
8599
8600         Reviewed by Geoffrey Garen.
8601
8602         Fixed arguments simplification for direct accesses to the arguments register, which may
8603         arise if CSE had not run. Fixed CSE so that it does run prior to arguments simplification,
8604         by making it a full-fledged member of the fixpoint. Fixed other issues in arguments
8605         simplification, like realizing that it needs to bail if there is a direct assignment to
8606         the arguments register, and failing to turn CreateArguments into PhantomArguments. Also
8607         fixed CSE's handling of store elimination of captured locals in the presence of a
8608         GetMyArgumentByVal (or one of its friends), and fixed CSE to correctly fixup variables at
8609         tail if the Flush it removes is the last operation on a local in a basic block.
8610
8611         * bytecode/CodeBlock.cpp:
8612         (JSC::CodeBlock::dump):
8613         * dfg/DFGArgumentsSimplificationPhase.cpp:
8614         (JSC::DFG::ArgumentsSimplificationPhase::run):
8615         (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
8616         * dfg/DFGCSEPhase.cpp:
8617         (JSC::DFG::CSEPhase::run):
8618         (JSC::DFG::CSEPhase::setLocalStoreElimination):
8619         (JSC::DFG::CSEPhase::performNodeCSE):
8620         (CSEPhase):
8621         * dfg/DFGDriver.cpp:
8622         (JSC::DFG::compile):
8623
8624 2012-06-04  Anders Carlsson  <andersca@apple.com>
8625
8626         Fix a struct/class mismatch.
8627
8628         * heap/Handle.h:
8629         (Handle):
8630
8631 2012-06-04  David Kilzer  <ddkilzer@apple.com>
8632
8633         BUILD FIX: FeatureDefines.xcconfig should match across projects
8634
8635         * Configurations/FeatureDefines.xcconfig:
8636         - Add missing ENABLE_LEGACY_CSS_VENDOR_PREFIXES.
8637
8638 2012-06-02  Geoffrey Garen  <ggaren@apple.com>
8639
8640         Weak pointer finalization should be lazy
8641         https://bugs.webkit.org/show_bug.cgi?id=87599
8642
8643         Reviewed by Sam Weinig.
8644
8645         This time for sure!
8646
8647         * heap/Heap.cpp:
8648         (JSC::Heap::collect): Don't sweep eagerly -- we'll sweep lazily instead.
8649
8650         * heap/MarkedBlock.cpp:
8651         (JSC::MarkedBlock::sweep): Sweep our weak set before we sweep our other
8652         destructors -- this is our last chance to run weak set finalizers before
8653         we recycle our memory.
8654
8655         * heap/MarkedBlock.h:
8656         (JSC::MarkedBlock::resetAllocator):
8657         * heap/MarkedSpace.cpp:
8658         (JSC::MarkedSpace::resetAllocators):
8659         * heap/MarkedSpace.h:
8660         (JSC::MarkedSpace::resetAllocators): Don't force allocator reset anymore.
8661         It will happen automatically when a weak set is swept. It's simpler to
8662         have only one canonical way for this to happen, and it wasn't buying
8663         us anything to do it eagerly.
8664
8665         * heap/WeakBlock.cpp:
8666         (JSC::WeakBlock::sweep): Don't short-circuit a sweep unless we know
8667         the sweep would be a no-op. If even one finalizer is pending, we need to
8668         run it, since we won't get another chance.
8669
8670         * heap/WeakSet.cpp:
8671         (JSC::WeakSet::sweep): This loop can be simpler now that
8672         WeakBlock::sweep() does what we mean.
8673
8674         Reset our allocator after a sweep because this is the optimal time to
8675         start trying to recycle old weak pointers.
8676
8677         (JSC::WeakSet::tryFindAllocator): Don't sweep when searching for an
8678         allocator because we've swept already, and forcing a new sweep would be
8679         wasteful.
8680
8681         * heap/WeakSet.h:
8682         (JSC::WeakSet::shrink): Be sure to reset our allocator after a shrink
8683         because the shrink may have removed the block the allocator was going to
8684         allocate out of.
8685
8686 2012-06-02  Filip Pizlo  <fpizlo@apple.com>
8687
8688         If the DFG bytecode parser detects that op_method_check has gone polymorphic, it
8689         shouldn't revert all the way to GetById/GetByIdFlush
8690         https://bugs.webkit.org/show_bug.cgi?id=88176
8691
8692         Reviewed by Geoffrey Garen.
8693
8694         Refactored the code so that the op_method_check case of the parser gracefully falls
8695         through to all of the goodness of the normal op_get_by_id case.
8696
8697         * dfg/DFGByteCodeParser.cpp:
8698         (ByteCodeParser):
8699         (JSC::DFG::ByteCodeParser::handleGetById):
8700         (DFG):
8701         (JSC::DFG::ByteCodeParser::parseBlock):
8702
8703 2012-06-02  Filip Pizlo  <fpizlo@apple.com>
8704
8705         DFG CSE should be able to eliminate unnecessary flushes of arguments and captured variables
8706         https://bugs.webkit.org/show_bug.cgi?id=87929
8707
8708         Reviewed by Geoffrey Garen.
8709
8710         Slight speed-up on V8. Big win (up to 50%) on programs that inline very small functions.
8711
8712         This required a bunch of changes:
8713
8714         - The obvious change is making CSE essentially ignore whether or not the set of
8715           operations between the Flush and the SetLocal can exit, and instead focus on whether or
8716           not that set of operations can clobber the world or access local variables. This code
8717           is now refactored to return a set of flags indicating any of these events, and the CSE
8718           decides what to do based on those flags. If the set of operations is non-clobbering
8719           and non-accessing, then the Flush is turned into a Phantom on the child of the
8720           SetLocal. This expands the liveness of the relevant variable but virtually guarantees
8721           that it will be register allocated and not flushed to the stack. So, yeah, this patch
8722           is a lot of work to save a few stores to the stack.
8723
8724         - Previously, CheckArgumentsNotCreated was optimized "lazily" in that you only knew if
8725           it was a no-op if you were holding onto a CFA abstract state. But this would make the
8726           CSE act pessimistically, since it doesn't use the CFA. Hence, this patch changes the
8727           constant folding phase into something more broad; it now fixes up
8728           CheckArgumentsNotCreated nodes by turning them into phantoms if it knows that they are
8729           no-ops.
8730
8731         - Arguments simplification was previously relying on this very strange PhantomArguments
8732           node, which had two different meanings: for normal execution it meant the empty value
8733           but for OSR exit it meant that the arguments should be reified. This produces problems
8734           when set SetLocals to the captured arguments registers are CSE'd away, since we'd be
8735           triggering reification of arguments without having initialized the arguments registers
8736           to empty. The cleanest solution was to fix PhantomArguments to have one meaning:
8737           namely, arguments reification on OSR exit. Hence, this patch changes arguments
8738           simplification to change SetLocal of CreateArguments on the arguments registers to be
8739           a SetLocal of Empty.
8740
8741         - Argument value recoveries were previously derived from the value source of the
8742           arguments at the InlineStart. But that relies on all SetLocals to arguments having
8743           been flushed. It's possible that we could have elided the SetLocal to the arguments
8744           at the callsite because there were subsequent SetLocals to the arguments inside of the
8745           callee, in which case the InlineStart would get the wrong information. Hence, this
8746           patch changes argument value recovery computation to operate over the ArgumentPositions
8747           directly.
8748
8749         - But that doesn't actually work, because previously, there was no way to link an
8750           InlineStart back to the corresponding ArgumentPositions, at least not without some
8751           ugliness. So this patch instates the rule that the m_argumentPositions vector consists
8752           of disjoint subsequences such that each subsequence corresponds to an inline callsite
8753           and can be identified by its first index, and within each subsequence are the
8754           ArgumentPositions of all of the arguments ordered by argument index. This required
8755           flipping the order in which ArgumentPositions are added to the vector, and giving
8756           InlineStart an operand that indicates the start of that inline callsite's
8757           ArgumentPosition subsequence.
8758
8759         - This patch also revealed a nasty bug in the reification of arguments in inline call
8760           frames on OSR exit. Since the reification was happening after the values of virtual
8761           registers were recovered, the value recoveries of the inline arguments were wrong.
8762           Hence using operationCreateInlinedArguments is wrong. For example a value recovery
8763           might say that you have to box a double, but if we had already boxed it then boxing
8764           it a second time will result in garbage. The specific case of this bug was this patch
8765           uncovered was that now it is possible for an inline call frame to not have any valid
8766           value recoveries for any inline arguments, if the optimization elides all argument
8767           flushes, while at the same time optimizing away arguments creation. Then OSR exit
8768           would try to recover the arguments using the inline call frame, which had bogus
8769           information, and humorous crashes would ensue. This patch fixes this issue by moving
8770           arguments reification to after call frame reification, so that arguments reification
8771           can always use operationCreateArguments instead of operationCreateInlinedArguments.
8772
8773         - This patch may turn a Flush into a Phantom. That's kind of the whole point. But that
8774           broke forward speculation checks, which knew to look for a Flush prior to a SetLocal
8775           but didn't know that there could alternatively be a Phantom in place of the Flush.
8776           This patch fixes that by augmenting the forward speculation check logic.
8777
8778         - Finally, in the process of having fun with all of the above, I realized that my DFG
8779           validation was not actually running on every phase like I had originally designed it
8780           to. In fact it was only running just after bytecode parsing. I initially tried to
8781           make it run in every phase but found that this causes some tests to timeout
8782           (specifically the evil fuzzing ones), so I decided on a compromise where: (i) in
8783           release mode validation never runs, (ii) in debug mode validation will run just
8784           after parsing and just before the backend, and (iii) it's possible with a simple
8785           switch to enable validation to run on every phase.
8786
8787         Luckily all of the above issues were already covered by the 77 or so DFG-specific
8788         layout tests. Hence, this patch does not introduce any new tests despite being so
8789         meaty.
8790
8791         * dfg/DFGAbstractState.cpp:
8792         (JSC::DFG::AbstractState::execute):
8793         * dfg/DFGArgumentPosition.h:
8794         (JSC::DFG::ArgumentPosition::prediction):
8795         (JSC::DFG::ArgumentPosition::doubleFormatState):
8796         (JSC::DFG::ArgumentPosition::shouldUseDoubleFormat):
8797         (ArgumentPosition):
8798         * dfg/DFGArgumentsSimplificationPhase.cpp:
8799         (JSC::DFG::ArgumentsSimplificationPhase::run):
8800         * dfg/DFGByteCodeParser.cpp:
8801         (JSC::DFG::ByteCodeParser::handleInlining):
8802         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
8803         * dfg/DFGCSEPhase.cpp:
8804         (JSC::DFG::CSEPhase::SetLocalStoreEliminationResult::SetLocalStoreEliminationResult):
8805         (SetLocalStoreEliminationResult):
8806         (JSC::DFG::CSEPhase::setLocalStoreElimination):
8807         (JSC::DFG::CSEPhase::performNodeCSE):
8808         * dfg/DFGCommon.h:
8809         * dfg/DFGConstantFoldingPhase.cpp:
8810         (JSC::DFG::ConstantFoldingPhase::run):
8811         * dfg/DFGDriver.cpp:
8812         (JSC::DFG::compile):
8813         * dfg/DFGNode.h:
8814         (Node):
8815         (JSC::DFG::Node::hasArgumentPositionStart):
8816         (JSC::DFG::Node::argumentPositionStart):
8817         * dfg/DFGOSRExitCompiler32_64.cpp:
8818         (JSC::DFG::OSRExitCompiler::compileExit):
8819         * dfg/DFGOSRExitCompiler64.cpp:
8820         (JSC::DFG::OSRExitCompiler::compileExit):
8821         * dfg/DFGPhase.cpp:
8822         (DFG):
8823         * dfg/DFGPhase.h:
8824         (Phase):
8825         * dfg/DFGSpeculativeJIT.cpp:
8826         (JSC::DFG::SpeculativeJIT::compile):
8827         * dfg/DFGSpeculativeJIT.h:
8828         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
8829         * dfg/DFGSpeculativeJIT32_64.cpp:
8830         (JSC::DFG::SpeculativeJIT::compile):
8831         * dfg/DFGSpeculativeJIT64.cpp:
8832         (JSC::DFG::SpeculativeJIT::compile):
8833
8834 2012-06-02  Geoffrey Garen  <ggaren@apple.com>
8835
8836         DOM string cache should hash pointers, not characters
8837         https://bugs.webkit.org/show_bug.cgi?id=88175
8838
8839         Reviewed by Phil Pizlo and Sam Weinig.
8840
8841         * heap/Weak.h:
8842         (JSC::weakAdd):
8843         (JSC::weakRemove): Made these function templates slightly more generic
8844         to accommodate new client types.
8845
8846 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8847
8848         DFG CFA should know that PutByVal can clobber the world
8849         https://bugs.webkit.org/show_bug.cgi?id=88155
8850
8851         Reviewed by Gavin Barraclough.
8852
8853         * dfg/DFGAbstractState.cpp:
8854         (JSC::DFG::AbstractState::execute):
8855
8856 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8857
8858         DFG CFA should mark basic blocks as having constants if local accesses yield constants
8859         https://bugs.webkit.org/show_bug.cgi?id=88153
8860
8861         Reviewed by Gavin Barraclough.
8862
8863         * dfg/DFGAbstractState.cpp:
8864         (JSC::DFG::AbstractState::execute):
8865
8866 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8867
8868         DFG arguments simplification phase uses a node.codeOrigin after appending a node
8869         https://bugs.webkit.org/show_bug.cgi?id=88151
8870
8871         Reviewed by Geoffrey Garen.
8872
8873         The right thing to do is to save the CodeOrigin before appending to the graph.
8874
8875         * dfg/DFGArgumentsSimplificationPhase.cpp:
8876         (JSC::DFG::ArgumentsSimplificationPhase::run):
8877
8878 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8879
8880         DFG should not emit unnecessary speculation checks when performing an int32 to double conversion on
8881         a value that is proved to be a number, predicted to be an int32, but not proved to be an int32
8882         https://bugs.webkit.org/show_bug.cgi?id=88146
8883
8884         Reviewed by Gavin Barraclough.
8885
8886         * dfg/DFGSpeculativeJIT.cpp:
8887         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
8888
8889 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8890
8891         DFG constant folding search for the last local access skips the immediately previous local access
8892         https://bugs.webkit.org/show_bug.cgi?id=88141
8893
8894         Reviewed by Michael Saboff.
8895
8896         If you use a loop in the style of:
8897
8898         for (i = start; i--;)
8899
8900         then you need to remember that the first value of 'i' that the loop body will see is 'start - 1'.
8901         Hence the following is probably wrong:
8902
8903         for (i = start - 1; i--;)
8904
8905         * dfg/DFGConstantFoldingPhase.cpp:
8906         (JSC::DFG::ConstantFoldingPhase::run):
8907
8908 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8909
8910         DFG constant folding should be OK with GetLocal of captured variables having a constant
8911         https://bugs.webkit.org/show_bug.cgi?id=88137
8912
8913         Reviewed by Gavin Barraclough.
8914
8915         * dfg/DFGConstantFoldingPhase.cpp:
8916         (JSC::DFG::ConstantFoldingPhase::run):
8917
8918 2012-05-31  Mark Hahnenberg  <mhahnenberg@apple.com>
8919
8920         JSGlobalObject does not mark m_privateNameStructure
8921         https://bugs.webkit.org/show_bug.cgi?id=88023
8922
8923         Rubber stamped by Gavin Barraclough.
8924
8925         * runtime/JSGlobalObject.cpp:
8926         (JSC::JSGlobalObject::visitChildren): We need to mark this so it doesn't get
8927         inadvertently garbage collected.
8928
8929 2012-05-31  Erik Arvidsson  <arv@chromium.org>
8930
8931         Make DOM Exceptions Errors
8932         https://bugs.webkit.org/show_bug.cgi?id=85078
8933
8934         Reviewed by Oliver Hunt.
8935
8936         WebIDL mandates that exceptions should have Error.prototype on its prototype chain.
8937
8938         For JSC we have access to the Error.prototype from the binding code.
8939
8940         For V8 we set a field in the WrapperTypeInfo and when the constructor function is created we
8941         set the prototype as needed.
8942
8943         Updated test: fast/dom/DOMException/prototype-object.html
8944
8945         * JavaScriptCore.xcodeproj/project.pbxproj:
8946         * runtime/JSGlobalObject.cpp:
8947         (JSC::JSGlobalObject::reset):
8948         * runtime/JSGlobalObject.h:
8949         (JSC):
8950         (JSGlobalObject):
8951         (JSC::JSGlobalObject::errorPrototype):
8952
8953 2012-05-31  Andy Wingo  <wingo@igalia.com>
8954
8955         Fix reference to unset variable in debug mode
8956         https://bugs.webkit.org/show_bug.cgi?id=87981
8957
8958         Reviewed by Geoffrey Garen.
8959
8960         * runtime/JSONObject.cpp (Stringifier::Holder::Holder):
8961         Initialize m_size in debug mode, as we check it later in an assert.
8962
8963 2012-05-30  Mark Hahnenberg  <mhahnenberg@apple.com>
8964
8965         Heap should sweep incrementally
8966         https://bugs.webkit.org/show_bug.cgi?id=85429
8967
8968         We shouldn't have to wait for the opportunistic GC timer to fire in order
8969         to call object destructors. Instead, we should incrementally sweep some
8970         subset of the blocks requiring sweeping periodically. We tie this sweeping
8971         to a timer rather than to collections because we want to reclaim this memory
8972         even if we stop allocating. This way, our memory usage scales smoothly with
8973         actual use, regardless of whether we've recently done an opportunistic GC or not.
8974
8975         Reviewed by Geoffrey Garen.
8976
8977         * CMakeLists.txt:
8978         * GNUmakefile.list.am:
8979         * JavaScriptCore.gypi:
8980         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
8981         * JavaScriptCore.xcodeproj/project.pbxproj:
8982         * Target.pri:
8983         * heap/Heap.cpp:
8984         (JSC::Heap::Heap):
8985         (JSC::Heap::collect): We no longer sweep during a full sweep. We only shrink now,
8986         which we will switch over to being done during incremental sweeping too as soon as
8987         all finalizers can be run lazily (and, by extension, incrementally).
8988         (JSC::Heap::sweeper):
8989         (JSC):
8990         * heap/Heap.h:
8991         (JSC):
8992         (Heap):
8993         * heap/IncrementalSweeper.cpp: Added.
8994         (JSC):
8995         (JSC::IncrementalSweeper::timerDidFire): The IncrementalSweeper works very similarly to
8996         GCActivityCallback. It is tied to a run-loop based timer that fires periodically based
8997         on how long the previous sweep increment took to run. The IncrementalSweeper doesn't do
8998         anything if the platform doesn't support CoreFoundation.
8999         (JSC::IncrementalSweeper::IncrementalSweeper):
9000         (JSC::IncrementalSweeper::~IncrementalSweeper):
9001         (JSC::IncrementalSweeper::create):
9002         (JSC::IncrementalSweeper::scheduleTimer):
9003         (JSC::IncrementalSweeper::cancelTimer):
9004         (JSC::IncrementalSweeper::doSweep): Iterates over the snapshot of the MarkedSpace taken
9005         during the last collection, checking to see which blocks need sweeping. If it successfully
9006         gets to the end of the blocks that need sweeping then it cancels the timer.
9007         (JSC::IncrementalSweeper::startSweeping): We take a snapshot of the Heap and store it in
9008         a Vector that the incremental sweep will iterate over. We also reset our index into this Vector.
9009         * heap/IncrementalSweeper.h: Added.
9010         (JSC):
9011         (IncrementalSweeper):
9012         * heap/MarkedBlock.h:
9013         (JSC::MarkedBlock::needsSweeping): If a block is in the Marked state it needs sweeping
9014         to be usable and to run any destructors that need to be run.
9015
9016 2012-05-30  Patrick Gansterer  <paroga@webkit.org>
9017
9018         [WINCE] Fix JSString after r115516.
9019         https://bugs.webkit.org/show_bug.cgi?id=87892
9020
9021         Reviewed by Geoffrey Garen.
9022
9023         r115516 splitted JSString into two classes, with addition nested classes.
9024         Add a workaround for the WinCE compiler since it can't resolve the friend class
9025         declerations corretly and denies the access to protected members of JSString.
9026
9027         * runtime/JSString.h:
9028         (JSC::JSRopeString::RopeBuilder::append):
9029         (JSC::JSRopeString::append):
9030         (JSRopeString):
9031
9032 2012-05-30  Oliver Hunt  <oliver@apple.com>
9033
9034         Really provide error information with the inspector disabled
9035         https://bugs.webkit.org/show_bug.cgi?id=87910
9036
9037         Reviewed by Filip Pizlo.
9038
9039         Don't bother checking for anything other than pre-existing error info.
9040         In the absence of complete line number information you'll only get the
9041         line a function starts on, but at least it's something.
9042
9043         * interpreter/Interpreter.cpp:
9044         (JSC::Interpreter::throwException):
9045
9046 2012-05-30  Filip Pizlo  <fpizlo@apple.com>
9047
9048         LLInt broken on x86-32 with JIT turned off
9049         https://bugs.webkit.org/show_bug.cgi?id=87906
9050
9051         Reviewed by Geoffrey Garen.
9052
9053         Fixed the code to not clobber registers that contain important things, like the call frame.
9054
9055         * llint/LowLevelInterpreter32_64.asm:
9056
9057 2012-05-30  Filip Pizlo  <fpizlo@apple.com>
9058
9059         ScriptDebugServer wants sourceIDs that are non-zero because that's what HashMaps want, so JSC should placate it
9060         https://bugs.webkit.org/show_bug.cgi?id=87887
9061
9062         Reviewed by Darin Adler.
9063
9064         Better fix - we now never call SourceProvider::asID() if SourceProvider* is 0.
9065
9066         * parser/Nodes.h:
9067         (JSC::ScopeNode::sourceID):
9068         * parser/SourceCode.h:
9069         (JSC::SourceCode::providerID):
9070         (SourceCode):
9071         * parser/SourceProvider.h:
9072         (SourceProvider):
9073         (JSC::SourceProvider::asID):
9074         * runtime/Executable.h:
9075         (JSC::ScriptExecutable::sourceID):
9076
9077 2012-05-30  Filip Pizlo  <fpizlo@apple.com>
9078
9079         ScriptDebugServer wants sourceIDs that are non-zero because that's what HashMaps want, so JSC should placate it
9080         https://bugs.webkit.org/show_bug.cgi?id=87887
9081
9082         Reviewed by Geoffrey Garen.
9083
9084         * parser/SourceProvider.h:
9085         (JSC::SourceProvider::asID):
9086
9087 2012-05-30  Oliver Hunt  <oliver@apple.com>
9088
9089         DFG does not correctly handle exceptions caught in the LLInt
9090         https://bugs.webkit.org/show_bug.cgi?id=87885
9091
9092         Reviewed by Filip Pizlo.
9093
9094         Make the DFG use genericThrow, rather than reimplementing a small portion of it.
9095         Also make the LLInt slow paths validate that their PC is correct.
9096
9097         * dfg/DFGOperations.cpp:
9098         * llint/LLIntSlowPaths.cpp:
9099         (LLInt):
9100
9101 2012-05-29  Filip Pizlo  <fpizlo@apple.com>
9102
9103         DFG CFA should infer types and values of captured variables
9104         https://bugs.webkit.org/show_bug.cgi?id=87813
9105
9106         Reviewed by Gavin Barraclough.
9107
9108         Slight speed-up in V8/earley-boyer (~1%).
9109
9110         * bytecode/CodeBlock.h:
9111         (JSC::CodeBlock::argumentsAreCaptured):
9112         (JSC::CodeBlock::argumentIsCaptured):
9113         (CodeBlock):
9114         * dfg/DFGAbstractState.cpp:
9115         (DFG):
9116         (JSC::DFG::AbstractState::beginBasicBlock):
9117         (JSC::DFG::AbstractState::initialize):
9118         (JSC::DFG::AbstractState::endBasicBlock):
9119         (JSC::DFG::AbstractState::execute):
9120         (JSC::DFG::AbstractState::clobberWorld):
9121         (JSC::DFG::AbstractState::clobberStructures):
9122         (JSC::DFG::AbstractState::mergeStateAtTail):
9123         (JSC::DFG::AbstractState::merge):
9124         (JSC::DFG::AbstractState::mergeToSuccessors):
9125         * dfg/DFGAbstractState.h:
9126         (JSC::DFG::AbstractState::variables):
9127         (AbstractState):
9128         * dfg/DFGSpeculativeJIT32_64.cpp:
9129         (JSC::DFG::SpeculativeJIT::compile):
9130         * dfg/DFGSpeculativeJIT64.cpp:
9131         (JSC::DFG::SpeculativeJIT::compile):
9132
9133 2012-05-30  Patrick Gansterer  <paroga@webkit.org>
9134
9135         Unreviewed. Build fix for !ENABLE(JIT) after r117823.
9136
9137         * bytecode/CodeBlock.cpp:
9138         (JSC::CodeBlock::dump):
9139
9140 2012-05-30  Sheriff Bot  <webkit.review.bot@gmail.com>
9141
9142         Unreviewed, rolling out r118868.
9143         http://trac.webkit.org/changeset/118868
9144         https://bugs.webkit.org/show_bug.cgi?id=87828
9145
9146         introduced ~20 crashes on Mac and Qt bots (Requested by pizlo_
9147         on #webkit).
9148
9149         * heap/Heap.cpp:
9150         (JSC::Heap::collect):
9151         * heap/MarkedBlock.cpp:
9152         (JSC::MarkedBlock::sweep):
9153         * heap/MarkedBlock.h:
9154         (JSC::MarkedBlock::sweepWeakSet):
9155         (JSC):
9156         * heap/MarkedSpace.cpp:
9157         (JSC::SweepWeakSet::operator()):
9158         (JSC):
9159         (JSC::MarkedSpace::sweepWeakSets):
9160         * heap/MarkedSpace.h:
9161         (MarkedSpace):
9162
9163 2012-05-29  Geoffrey Garen  <ggaren@apple.com>
9164
9165         Rolled back in r118646, now that
9166         https://bugs.webkit.org/show_bug.cgi?id=87784 is fixed.
9167
9168         http://trac.webkit.org/changeset/118646
9169         https://bugs.webkit.org/show_bug.cgi?id=87599
9170
9171         * heap/Heap.cpp:
9172         (JSC::Heap::collect):
9173         * heap/MarkedBlock.cpp:
9174         (JSC::MarkedBlock::sweep):
9175         * heap/MarkedBlock.h:
9176         (JSC):
9177         * heap/MarkedSpace.cpp:
9178         (JSC):
9179         * heap/MarkedSpace.h:
9180         (MarkedSpace):
9181
9182 2012-05-29  Filip Pizlo  <fpizlo@apple.com>
9183
9184         DFG should keep captured variables alive until the (inline) return.
9185         https://bugs.webkit.org/show_bug.cgi?id=87205
9186
9187         Reviewed by Gavin Barraclough.
9188
9189         Changes the way we do flushing for captured variables and arguments. Instead of flushing
9190         each SetLocal immediately, we flush at kill points. So a SetLocal will cause a Flush of
9191         whatever was live in the variable previously, and a return will cause a Flush of all
9192         captured variables and all arguments.
9193
9194         * dfg/DFGByteCodeParser.cpp:
9195         (JSC::DFG::ByteCodeParser::setDirect):
9196         (JSC::DFG::ByteCodeParser::set):
9197         (JSC::DFG::ByteCodeParser::setLocal):
9198         (JSC::DFG::ByteCodeParser::getArgument):
9199         (JSC::DFG::ByteCodeParser::setArgument):
9200         (JSC::DFG::ByteCodeParser::findArgumentPositionForArgument):
9201         (ByteCodeParser):
9202         (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
9203         (JSC::DFG::ByteCodeParser::findArgumentPosition):
9204         (JSC::DFG::ByteCodeParser::flush):
9205         (JSC::DFG::ByteCodeParser::flushDirect):
9206         (JSC::DFG::ByteCodeParser::flushArgumentsAndCapturedVariables):
9207         (JSC::DFG::ByteCodeParser::handleInlining):
9208         (JSC::DFG::ByteCodeParser::parseBlock):
9209         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
9210         * dfg/DFGCSEPhase.cpp:
9211         (JSC::DFG::CSEPhase::setLocalStoreElimination):
9212         (JSC::DFG::CSEPhase::performNodeCSE):
9213         * dfg/DFGSpeculativeJIT.cpp:
9214         (JSC::DFG::SpeculativeJIT::compile):
9215         * dfg/DFGSpeculativeJIT.h:
9216         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
9217
9218 2012-05-29  Geoffrey Garen  <ggaren@apple.com>
9219
9220         WeakGCMap should be lazy-finalization-safe
9221         https://bugs.webkit.org/show_bug.cgi?id=87784
9222
9223         Reviewed by Darin Adler.
9224
9225         * runtime/WeakGCMap.h:
9226         (JSC::WeakGCMap::get): Since this is a map of raw WeakImpl pointers, and
9227         not Weak<T>, we need to verify manually that the WeakImpl is live before
9228         we return its payload.
9229
9230 2012-05-29  Mark Hahnenberg  <mhahnenberg@apple.com>
9231
9232         CopiedSpace::doneCopying could start another collection
9233         https://bugs.webkit.org/show_bug.cgi?id=86538
9234
9235         Reviewed by Geoffrey Garen.
9236
9237         It's possible that if we don't have anything at the head of to-space
9238         after a collection and the BlockAllocator doesn't have any fresh blocks
9239         to give us right now we could start another collection while still in
9240         the middle of the first collection when we call CopiedSpace::addNewBlock().
9241
9242         One way to resolve this would be to have Heap::shouldCollect() check that
9243         m_operationInProgress is NoOperation. This would prevent the path in
9244         getFreshBlock() that starts the collection if we're already in the middle of one.
9245
9246         I could not come up with a test case to reproduce this crash on ToT.
9247
9248         * heap/Heap.h:
9249         (JSC::Heap::shouldCollect): We shouldn't collect if we're already in the middle
9250         of a collection, i.e. the current operation should be NoOperation.
9251
9252 2012-05-29  David Barr  <davidbarr@chromium.org>
9253
9254         Introduce ENABLE_CSS_IMAGE_RESOLUTION compile flag
9255         https://bugs.webkit.org/show_bug.cgi?id=87685
9256
9257         Reviewed by Eric Seidel.
9258
9259         Add a configuration option for CSS image-resolution support, disabling it by default.
9260
9261         * Configurations/FeatureDefines.xcconfig:
9262
9263 2012-05-28  Sheriff Bot  <webkit.review.bot@gmail.com>
9264
9265         Unreviewed, rolling out r118646.
9266         http://trac.webkit.org/changeset/118646
9267         https://bugs.webkit.org/show_bug.cgi?id=87691
9268
9269         broke V8 raytrace benchmark (Requested by pizlo_ on #webkit).
9270
9271         * heap/Heap.cpp:
9272         (JSC::Heap::collect):
9273         * heap/MarkedBlock.cpp:
9274         (JSC::MarkedBlock::sweep):
9275         * heap/MarkedBlock.h:
9276         (JSC::MarkedBlock::sweepWeakSet):
9277         (JSC):
9278         * heap/MarkedSpace.cpp:
9279         (JSC::SweepWeakSet::operator()):
9280         (JSC):
9281         (JSC::MarkedSpace::sweepWeakSets):
9282         * heap/MarkedSpace.h:
9283         (MarkedSpace):
9284
9285 2012-05-28  Filip Pizlo  <fpizlo@apple.com>
9286
9287         DFG should not generate code for code that the CFA proves to be unreachable
9288         https://bugs.webkit.org/show_bug.cgi?id=87682
9289
9290         Reviewed by Sam Weinig.
9291
9292         This also fixes a small performance bug where CFA was not marking blocks
9293         as having constants (and hence not triggering constant folding) if the only
9294         constants were on GetLocals.
9295
9296         And fixing that bug revealed another bug: constant folding was assuming that
9297         a GetLocal must be the first access to a local in a basic block. This isn't
9298         true. The first access may be a Flush. This patch fixes that issue using the
9299         safest approach possible, since we don't need to be clever for something that
9300         only happens in one of our benchmarks.
9301
9302         * dfg/DFGAbstractState.cpp:
9303         (JSC::DFG::AbstractState::execute):
9304         * dfg/DFGConstantFoldingPhase.cpp:
9305         (JSC::DFG::ConstantFoldingPhase::run):
9306         * dfg/DFGJITCompiler.h:
9307         (JSC::DFG::JITCompiler::noticeOSREntry):
9308         * dfg/DFGSpeculativeJIT.cpp:
9309         (JSC::DFG::SpeculativeJIT::compile):
9310
9311 2012-05-28  Carlos Garcia Campos  <cgarcia@igalia.com>
9312
9313         Unreviewed. Fix make distcheck.
9314
9315         * GNUmakefile.list.am: Add missing header file.
9316
9317 2012-05-27  Geoffrey Garen  <ggaren@apple.com>
9318
9319         Weak pointer finalization should be lazy
9320         https://bugs.webkit.org/show_bug.cgi?id=87599
9321
9322         Reviewed by Darin Adler.
9323
9324         * heap/Heap.cpp:
9325         (JSC::Heap::collect): Don't force immediate finalization -- it will
9326         happen lazily.
9327
9328         * heap/MarkedBlock.cpp:
9329         (JSC::MarkedBlock::sweep): Sweep a block's weak set when sweeping the
9330         block. The weak set may not have been swept yet, and this is our last
9331         chance to run weak finalizers before we recycle the memory they reference.
9332
9333         * heap/MarkedBlock.h:
9334         * heap/MarkedSpace.cpp:
9335         (JSC::MarkedBlock::sweepWeakSets):
9336         * heap/MarkedSpace.h:
9337         (JSC::MarkedSpace::sweepWeakSets): Nixed sweepWeakSets because it's unused
9338         now.
9339
9340 2012-05-26  Geoffrey Garen  <ggaren@apple.com>
9341
9342         WebKit should be lazy-finalization-safe (esp. the DOM) v2
9343         https://bugs.webkit.org/show_bug.cgi?id=87581
9344
9345         Reviewed by Oliver Hunt.
9346
9347         * heap/MarkedBlock.cpp:
9348         (JSC::MarkedBlock::callDestructor):
9349         * heap/WeakBlock.h:
9350         * heap/WeakSetInlines.h:
9351         (JSC::WeakBlock::finalize): Since we don't guarantee destruction order,
9352         it's not valid to access GC pointers like the Structure pointer during
9353         finalization. We NULL out the structure pointer in debug builds to try
9354         to make this programming mistake more obvious.
9355
9356         * API/JSCallbackConstructor.cpp:
9357         (JSC::JSCallbackConstructor::destroy):
9358         * API/JSCallbackObject.cpp:
9359         (JSC::::destroy):
9360         (JSC::JSCallbackObjectData::finalize):
9361         * runtime/Arguments.cpp:
9362         (JSC::Arguments::destroy):
9363         * runtime/DateInstance.cpp:
9364         (JSC::DateInstance::destroy):
9365         * runtime/Error.cpp:
9366         (JSC::StrictModeTypeErrorFunction::destroy):
9367         * runtime/Executable.cpp:
9368         (JSC::ExecutableBase::destroy):
9369         (JSC::NativeExecutable::destroy):
9370         (JSC::ScriptExecutable::destroy):
9371         (JSC::EvalExecutable::destroy):
9372         (JSC::ProgramExecutable::destroy):
9373         (JSC::FunctionExecutable::destroy):
9374         * runtime/JSGlobalObject.cpp:
9375         (JSC::JSGlobalObject::destroy):
9376         * runtime/JSPropertyNameIterator.cpp:
9377         (JSC::JSPropertyNameIterator::destroy):
9378         * runtime/JSStaticScopeObject.cpp:
9379         (JSC::JSStaticScopeObject::destroy):
9380         * runtime/JSString.cpp:
9381         (JSC::JSString::destroy):
9382         * runtime/JSVariableObject.cpp:
9383         (JSC::JSVariableObject::destroy):
9384         * runtime/NameInstance.cpp:
9385         (JSC::NameInstance::destroy):
9386         * runtime/RegExp.cpp:
9387         (JSC::RegExp::destroy):
9388         * runtime/RegExpConstructor.cpp:
9389         (JSC::RegExpConstructor::destroy):
9390         * runtime/Structure.cpp:
9391         (JSC::Structure::destroy):
9392         * runtime/StructureChain.cpp:
9393         (JSC::StructureChain::destroy): Use static_cast instead of jsCast because
9394         jsCast does Structure-based validation, and our Structure is not guaranteed
9395         to be alive when we get finalized.
9396
9397 2012-05-22  Filip Pizlo  <fpizlo@apple.com>
9398
9399         DFG CSE should eliminate redundant WeakJSConstants
9400         https://bugs.webkit.org/show_bug.cgi?id=87179
9401
9402         Reviewed by Gavin Barraclough.
9403
9404         Merged r118141 from dfgopt.
9405
9406         * dfg/DFGCSEPhase.cpp:
9407         (JSC::DFG::CSEPhase::weakConstantCSE):
9408         (CSEPhase):
9409         (JSC::DFG::CSEPhase::performNodeCSE):
9410         * dfg/DFGNode.h:
9411         (JSC::DFG::Node::weakConstant):
9412
9413 2012-05-22  Filip Pizlo  <fpizlo@apple.com>
9414
9415         DFG CSE should do redundant store elimination
9416         https://bugs.webkit.org/show_bug.cgi?id=87161
9417
9418         Reviewed by Oliver Hunt.
9419
9420         Merge r118138 from dfgopt.
9421
9422         This patch adds redundant store elimination. For example, consider this
9423         code:
9424
9425         o.x = 42;
9426         o.x = 84;
9427
9428         If o.x is speculated to be a well-behaved field, the first assignment is
9429         unnecessary, since the second just overwrites it. We would like to
9430         eliminate the first assignment in these cases. The need for this
9431         optimization arises mostly from stores that our runtime requires. For
9432         example:
9433
9434         o = {f:1, g:2, h:3};
9435
9436         This will have four assignments to the structure for the newly created
9437         object - one assignment for the empty structure, one for {f}, one for
9438         {f, g}, and one for {f, g, h}. We would like to only have the last of
9439         those assigments in this case.
9440
9441         Intriguingly, doing so for captured variables breaks the way arguments
9442         simplification used to work. Consider that prior to either arguments
9443         simplification or store elimination we will have IR that looks like:
9444
9445         a: SetLocal(r0, Empty)
9446         b: SetLocal(r1, Empty)
9447         c: GetLocal(r0)
9448         d: CreateArguments(@c)
9449         e: SetLocal(r0, @d)
9450         f: SetLocal(r1, @d)
9451
9452         Then redundant store elimination will eliminate the stores that
9453         initialize the arguments registers to Empty, but then arguments
9454         simplification eliminates the stores that initialize the arguments to
9455         the newly created arguments - and at this point we no longer have any
9456         stores to the arguments register, leading to hilarious crashes. This
9457         patch therefore changes arguments simplification to replace
9458         CreateArguments with JSConstant(Empty) rather than eliminating the
9459         SetLocals. But this revealed bugs where arguments simplification was
9460         being overzealous, so I fixed those bugs.
9461
9462         This is a minor speed-up on V8/early and a handful of other tests.
9463
9464         * bytecode/CodeBlock.h:
9465         (JSC::CodeBlock::uncheckedActivationRegister):
9466         * dfg/DFGAbstractState.cpp:
9467         (JSC::DFG::AbstractState::execute):
9468         * dfg/DFGArgumentsSimplificationPhase.cpp:
9469         (JSC::DFG::ArgumentsSimplificationPhase::run):
9470         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
9471         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
9472         (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
9473         * dfg/DFGCSEPhase.cpp:
9474         (JSC::DFG::CSEPhase::globalVarStoreElimination):
9475         (CSEPhase):
9476         (JSC::DFG::CSEPhase::putStructureStoreElimination):
9477         (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
9478         (JSC::DFG::CSEPhase::setLocalStoreElimination):
9479         (JSC::DFG::CSEPhase::setReplacement):
9480         (JSC::DFG::CSEPhase::eliminate):
9481         (JSC::DFG::CSEPhase::performNodeCSE):
9482         * dfg/DFGGraph.h:
9483         (JSC::DFG::Graph::uncheckedActivationRegisterFor):
9484         (Graph):
9485         * dfg/DFGNode.h:
9486         (JSC::DFG::Node::isPhantomArguments):
9487         (Node):
9488         (JSC::DFG::Node::hasConstant):
9489         (JSC::DFG::Node::valueOfJSConstant):
9490         (JSC::DFG::Node::hasStructureTransitionData):
9491         * dfg/DFGNodeType.h:
9492         (DFG):
9493         * dfg/DFGPredictionPropagationPhase.cpp:
9494         (JSC::DFG::PredictionPropagationPhase::propagate):
9495         * dfg/DFGSpeculativeJIT.cpp:
9496         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
9497         * dfg/DFGSpeculativeJIT32_64.cpp:
9498         (JSC::DFG::SpeculativeJIT::compile):
9499         * dfg/DFGSpeculativeJIT64.cpp:
9500         (JSC::DFG::SpeculativeJIT::compile):
9501
9502 2012-05-21  Filip Pizlo  <fpizlo@apple.com>
9503
9504         DFG ConvertThis should just be a CheckStructure if the structure is known
9505         https://bugs.webkit.org/show_bug.cgi?id=87057
9506
9507         Reviewed by Gavin Barraclough.
9508
9509         Merged r118021 from dfgopt.
9510
9511         This gives ValueProfile the ability to track singleton values - i.e. profiling
9512         sites that always see the same value.
9513
9514         That is then used to profile the structure in op_convert_this.
9515
9516         This is then used to optimize op_convert_this into a CheckStructure if the
9517         structure is always the same.
9518
9519         That then results in better CSE in inlined code that uses 'this', since
9520         previously we couldn't CSE accesses on 'this' from different inline call frames.
9521
9522         Also fixed a bug where we were unnecessarily flushing 'this'.
9523
9524         * bytecode/CodeBlock.cpp:
9525         (JSC::CodeBlock::dump):
9526         (JSC::CodeBlock::stronglyVisitStrongReferences):
9527         * bytecode/LazyOperandValueProfile.cpp:
9528         (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions):
9529         * bytecode/LazyOperandValueProfile.h:
9530         (CompressedLazyOperandValueProfileHolder):
9531         * bytecode/Opcode.h:
9532         (JSC):
9533         (JSC::padOpcodeName):
9534         * bytecode/ValueProfile.h:
9535         (JSC::ValueProfileBase::ValueProfileBase):
9536         (JSC::ValueProfileBase::dump):
9537         (JSC::ValueProfileBase::computeUpdatedPrediction):
9538         (ValueProfileBase):
9539         * bytecompiler/BytecodeGenerator.cpp:
9540         (JSC::BytecodeGenerator::BytecodeGenerator):
9541         * dfg/DFGByteCodeParser.cpp:
9542         (JSC::DFG::ByteCodeParser::setArgument):
9543         (JSC::DFG::ByteCodeParser::parseBlock):
9544         * jit/JITOpcodes.cpp:
9545         (JSC::JIT::emit_op_convert_this):
9546         (JSC::JIT::emitSlow_op_convert_this):
9547         * jit/JITOpcodes32_64.cpp:
9548         (JSC::JIT::emit_op_convert_this):
9549         (JSC::JIT::emitSlow_op_convert_this):
9550         * llint/LLIntSlowPaths.cpp:
9551         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
9552         * llint/LowLevelInterpreter32_64.asm:
9553         * llint/LowLevelInterpreter64.asm:
9554         * runtime/JSValue.h:
9555         (JSValue):
9556         * runtime/Structure.h:
9557         (JSC::JSValue::structureOrUndefined):
9558         (JSC):
9559
9560 2012-05-24  Tim Horton  <timothy_horton@apple.com>
9561
9562         Add feature defines for web-facing parts of CSS Regions and Exclusions
9563         https://bugs.webkit.org/show_bug.cgi?id=87442
9564         <rdar://problem/10887709>
9565
9566         Reviewed by Dan Bernstein.
9567
9568         * Configurations/FeatureDefines.xcconfig:
9569
9570 2012-05-24  Geoffrey Garen  <ggaren@apple.com>
9571
9572         WebKit should be lazy-finalization-safe (esp. the DOM)
9573         https://bugs.webkit.org/show_bug.cgi?id=87456
9574
9575         Reviewed by Filip Pizlo.
9576
9577         Lazy finalization adds one twist to weak pointer use:
9578
9579                 A HashMap of weak pointers may contain logically null entries.
9580                 (Weak pointers behave as-if null once their payloads die.)
9581                 Insertion must not assume that a pre-existing entry is
9582                 necessarily valid, and iteration must not assume that all
9583                 entries can be dereferenced.
9584
9585         (Previously, I thought that it also added a second twist:
9586
9587                 A demand-allocated weak pointer may replace a dead payload
9588                 before the payload's finalizer runs. In that case, when the
9589                 payload's finalizer runs, the payload has already been
9590                 overwritten, and the finalizer should not clear the payload,
9591                 which now points to something new.
9592
9593         But that's not the case here, since we cancel the old payload's
9594         finalizer when we over-write it. I've added ASSERTs to verify this
9595         assumption, in case it ever changes.)
9596
9597         * API/JSClassRef.cpp:
9598         (OpaqueJSClass::prototype): No need to specify null; that's the default.
9599
9600         * API/JSWeakObjectMapRefPrivate.cpp: Use remove, since take() is gone.
9601
9602         * heap/PassWeak.h:
9603         (WeakImplAccessor::was): This is no longer a debug-only function, since
9604         it's required to reason about lazily finalized pointers.
9605
9606         * heap/Weak.h:
9607         (JSC::weakAdd):
9608         (JSC::weakRemove):
9609         (JSC::weakClear): Added these helper functions for the common idioms of
9610         what clients want to do in their weak pointer finalizers.
9611
9612         * jit/JITStubs.cpp:
9613         (JSC::JITThunks::hostFunctionStub): Use the new idioms. Otherwise, we
9614         would return NULL for a "zombie" executable weak pointer that was waiting
9615         for finalization (item (2)), and finalizing a dead executable weak pointer
9616         would potentially destroy a new, live one (item (1)).
9617
9618         * runtime/RegExpCache.cpp:
9619         (JSC::RegExpCache::lookupOrCreate):
9620         (JSC::RegExpCache::finalize): Ditto.
9621
9622         (JSC::RegExpCache::invalidateCode): Check for null while iterating. (See
9623         item (2).)
9624
9625         * runtime/Structure.cpp:
9626         (JSC::StructureTransitionTable::contains):
9627         (JSC::StructureTransitionTable::add): Use get and set instead of add and
9628         contains, since add and contains are not compatible with lazy finalization.
9629
9630         * runtime/WeakGCMap.h:
9631         (WeakGCMap):
9632         (JSC::WeakGCMap::clear):
9633         (JSC::WeakGCMap::remove): Removed a bunch of code that was incompatible with
9634         lazy finalization because I didn't feel like making it compatible, and I had
9635         no way to test it.
9636
9637 2012-05-24  Filip Pizlo  <fpizlo@apple.com>
9638
9639         REGRESSION (r118013-r118031): Loops/Reloads under www.yahoo.com, quits after three tries with error
9640         https://bugs.webkit.org/show_bug.cgi?id=87327
9641
9642         Reviewed by Geoffrey Garen.
9643
9644         If you use AbstractValue::filter(StructureSet) to test subset relationships between TOP and a
9645         set containing >=2 elements, you're going to have a bad time.
9646
9647         That's because AbstractValue considers a set with >=2 elements to be equivalent to TOP, in order
9648         to save space and speed up convergence. So filtering has no effect in this case, which made
9649         the code think that the abstract value was proving that the structure check was unnecessary.
9650         The correct thing to do is to use isSubsetOf() on the StructureAbstractValue, which does the
9651         right thingies for TOP and >=2 elements.
9652
9653         * dfg/DFGAbstractState.cpp:
9654         (JSC::DFG::AbstractState::execute):
9655         * dfg/DFGSpeculativeJIT32_64.cpp:
9656         (JSC::DFG::SpeculativeJIT::compile):
9657         * dfg/DFGSpeculativeJIT64.cpp:
9658         (JSC::DFG::SpeculativeJIT::compile):
9659
9660 2012-05-24  Filip Pizlo  <fpizlo@apple.com>
9661
9662         new test fast/js/dfg-arguments-mixed-alias.html fails on JSVALUE32_64
9663         https://bugs.webkit.org/show_bug.cgi?id=87378
9664
9665         Reviewed by Gavin Barraclough.
9666
9667         - Captured variable tracking forgot did not consistently handle arguments, leading to OSR
9668           badness.
9669
9670         - Nodes capable of exiting were tracked in a non-monotonic way, leading to compiler errors.
9671
9672         * dfg/DFGByteCodeParser.cpp:
9673         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
9674         * dfg/DFGCSEPhase.cpp:
9675         (JSC::DFG::CSEPhase::CSEPhase):
9676         (CSEPhase):
9677         (JSC::DFG::performCSE):
9678         * dfg/DFGCSEPhase.h:
9679         (DFG):
9680         * dfg/DFGCommon.h:
9681         * dfg/DFGDriver.cpp:
9682         (JSC::DFG::compile):
9683         * dfg/DFGGraph.cpp:
9684         (JSC::DFG::Graph::resetExitStates):
9685         (DFG):
9686         * dfg/DFGGraph.h:
9687         (Graph):
9688         * dfg/DFGPhase.h:
9689         (DFG):
9690         (JSC::DFG::runPhase):
9691
9692 2012-05-24  Geoffrey Garen  <ggaren@apple.com>
9693
9694         Made WeakSet per-block instead of per-heap
9695         https://bugs.webkit.org/show_bug.cgi?id=87401
9696
9697         Reviewed by Oliver Hunt.
9698
9699         This allows us fast access to the set of all weak pointers for a block,
9700         which is a step toward lazy finalization.
9701
9702         No performance change.
9703
9704         * heap/Heap.cpp:
9705         (JSC::Heap::Heap):
9706         (JSC::Heap::lastChanceToFinalize): Removed the per-heap weak set, since
9707         it's per-block now.
9708
9709         (JSC::Heap::markRoots): Delegate weak set visiting to the marked space,
9710         since it knows how to iterate all blocks.
9711
9712         (JSC::Heap::collect): Moved the reaping outside of markRoots, since it
9713         doesn't mark anything.
9714
9715         Make sure to reset allocators after shrinking, since shrinking may
9716         deallocate the current allocator.
9717
9718         * heap/Heap.h:
9719         (Heap): No more per-heap weak set, since it's per-block now.
9720
9721         * heap/MarkedBlock.cpp:
9722         (JSC::MarkedBlock::MarkedBlock):
9723         * heap/MarkedBlock.h:
9724         (MarkedBlock):
9725         (JSC::MarkedBlock::lastChanceToFinalize): Migrated finalization logic
9726         here from the heap, so the heap doesn't need to know about our internal
9727         data structures like our weak set.
9728
9729         (JSC::MarkedBlock::heap):
9730         (JSC::MarkedBlock::weakSet):
9731         (JSC::MarkedBlock::shrink):
9732         (JSC::MarkedBlock::resetAllocator):
9733         (JSC::MarkedBlock::visitWeakSet):
9734         (JSC::MarkedBlock::reapWeakSet):
9735         (JSC::MarkedBlock::sweepWeakSet):
9736         * heap/MarkedSpace.cpp:
9737         (JSC::VisitWeakSet::VisitWeakSet):
9738         (JSC::VisitWeakSet::operator()):
9739         (VisitWeakSet):
9740         (JSC):
9741         (JSC::ReapWeakSet::operator()):
9742         (JSC::SweepWeakSet::operator()):
9743         (JSC::LastChanceToFinalize::operator()):
9744         (JSC::MarkedSpace::lastChanceToFinalize):
9745         (JSC::ResetAllocator::operator()):
9746         (JSC::MarkedSpace::resetAllocators):
9747         (JSC::MarkedSpace::visitWeakSets):
9748         (JSC::MarkedSpace::reapWeakSets):
9749         (JSC::MarkedSpace::sweepWeakSets):
9750         (JSC::Shrink::operator()):
9751         (JSC::MarkedSpace::shrink):
9752         * heap/MarkedSpace.h:
9753         (MarkedSpace): Make sure to account for our weak sets when sweeping,
9754         shrinking, etc.
9755
9756         * heap/WeakSet.cpp:
9757         (JSC):
9758         * heap/WeakSet.h:
9759         (WeakSet):
9760         (JSC::WeakSet::heap):
9761         (JSC):
9762         (JSC::WeakSet::lastChanceToFinalize):
9763         (JSC::WeakSet::visit):
9764         (JSC::WeakSet::reap):
9765         (JSC::WeakSet::shrink):
9766         (JSC::WeakSet::resetAllocator): Inlined some things since they're called
9767         once per block now instead of once per heap.
9768
9769         * heap/WeakSetInlines.h:
9770         (JSC::WeakSet::allocate): Use the per-block weak set since there is no
9771         per-heap weak set anymore.
9772
9773 2012-05-24  Gavin Barraclough  <barraclough@apple.com>
9774
9775         Fix arm build
9776
9777         Rubber stamped by Geoff Garen
9778
9779         * dfg/DFGGPRInfo.h:
9780         (GPRInfo):
9781
9782 2012-05-24  Gavin Barraclough  <barraclough@apple.com>
9783
9784         Move cacheFlush from ExecutableAllocator to Assembler classes
9785         https://bugs.webkit.org/show_bug.cgi?id=87420
9786
9787         Reviewed by Oliver Hunt.
9788
9789         Makes more sense there, & remove a pile of #ifdefs.
9790
9791         * assembler/ARMAssembler.cpp:
9792         (JSC):
9793         (JSC::ARMAssembler::cacheFlush):
9794         * assembler/ARMAssembler.h:
9795         (ARMAssembler):
9796         (JSC::ARMAssembler::cacheFlush):
9797         * assembler/ARMv7Assembler.h:
9798         (JSC::ARMv7Assembler::relinkJump):
9799         (JSC::ARMv7Assembler::cacheFlush):
9800         (ARMv7Assembler):
9801         (JSC::ARMv7Assembler::setInt32):
9802         (JSC::ARMv7Assembler::setUInt7ForLoad):
9803         * assembler/AbstractMacroAssembler.h:
9804         (JSC::AbstractMacroAssembler::cacheFlush):
9805         * assembler/LinkBuffer.h:
9806         (JSC::LinkBuffer::performFinalization):
9807         * assembler/MIPSAssembler.h:
9808         (JSC::MIPSAssembler::relinkJump):
9809         (JSC::MIPSAssembler::relinkCall):
9810         (JSC::MIPSAssembler::repatchInt32):
9811         (JSC::MIPSAssembler::cacheFlush):
9812         (MIPSAssembler):
9813         * assembler/SH4Assembler.h:
9814         (JSC::SH4Assembler::repatchCompact):
9815         (JSC::SH4Assembler::cacheFlush):
9816         (SH4Assembler):
9817         * assembler/X86Assembler.h:
9818         (X86Assembler):
9819         (JSC::X86Assembler::cacheFlush):
9820         * jit/ExecutableAllocator.cpp:
9821         (JSC):
9822         * jit/ExecutableAllocator.h:
9823         (ExecutableAllocator):
9824
9825 2012-05-24  John Mellor  <johnme@chromium.org>
9826
9827         Font Boosting: Add compile flag and runtime setting
9828         https://bugs.webkit.org/show_bug.cgi?id=87394
9829
9830         Reviewed by Adam Barth.
9831
9832         Add ENABLE_FONT_BOOSTING.
9833
9834         * Configurations/FeatureDefines.xcconfig:
9835
9836 2012-05-24  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
9837
9838         cti_vm_throw gets kicked out by gcc 4.6 -flto
9839         https://bugs.webkit.org/show_bug.cgi?id=56088
9840
9841         Reviewed by Darin Adler.
9842
9843         Add REFERENCED_FROM_ASM to functions only referenced from assembler.
9844
9845         * dfg/DFGOperations.cpp:
9846         * jit/HostCallReturnValue.h:
9847         * jit/JITStubs.h:
9848         * jit/ThunkGenerators.cpp:
9849
9850 2012-05-24  Filip Pizlo  <fpizlo@apple.com>
9851
9852         Incorrect merge of r117542 from dfg opt branch in r118323 is leading to fast/js/dfg-arguments-osr-exit.html failing
9853         https://bugs.webkit.org/show_bug.cgi?id=87350
9854
9855         Reviewed by Maciej Stachowiak.
9856
9857         The dfgopt branch introduced the notion of a local variable being killed because it was aliased
9858         to the Arguments object as in cases like:
9859
9860         var a = arguments;
9861         return a.length;
9862
9863         This required changes to OSR exit handling - if the variable is dead but aliased to arguments, then
9864         OSR exit should reify the arguments. But meanwhile, in tip of tree we introduced special handling for
9865         dead variables on OSR exit. When the two were merged in r118323, the structure of the if/else branches
9866         ended up being such that we would treat dead arguments variables as totally dead as opposed to treating
9867         them as variables that need arguments reification.
9868
9869         This fixes the structure of the relevant if/else block so that variables that are dead-but-arguments
9870         end up being treated as reified arguments objects, while variables that are dead but not aliased to
9871         arguments are treated as tip of tree would have treated them (initialize to Undefined).
9872
9873         * dfg/DFGSpeculativeJIT.cpp:
9874         (JSC::DFG::SpeculativeJIT::compile):
9875
9876 2012-05-24  Csaba Osztrogonác  <ossy@webkit.org>
9877
9878         Unreviewed 32 bit buildfix after r118325.
9879
9880         * dfg/DFGSpeculativeJIT32_64.cpp:
9881         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): Use ASSERT_UNUSED instead ASSERT.
9882
9883 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
9884
9885         DFG operationTearOffActivation should return after handling the null activation case
9886         https://bugs.webkit.org/show_bug.cgi?id=87348
9887         <rdar://problem/11522295>
9888
9889         Reviewed by Oliver Hunt.
9890
9891         * dfg/DFGOperations.cpp:
9892
9893 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
9894
9895         Unreviewed, merge the arguments fix in r118138 to get bots green.
9896
9897         * dfg/DFGArgumentsSimplificationPhase.cpp:
9898         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
9899
9900 2012-05-20  Filip Pizlo  <fpizlo@apple.com>
9901
9902         DFG CFA should record if a node can OSR exit
9903         https://bugs.webkit.org/show_bug.cgi?id=86905
9904
9905         Reviewed by Oliver Hunt.
9906
9907         Merged r117931 from dfgopt.
9908
9909         Adds a NodeFlag that denotes nodes that are known to not have OSR exits.
9910         This ought to aid any backwards analyses that need to know when a
9911         backward flow merge might happen due to a side exit.
9912
9913         Also added assertions into speculationCheck() that ensure that we did not
9914         mark a node as non-exiting and then promptly compile in an exit. This
9915         helped catch some minor bugs where we were doing unnecessary speculation
9916         checks.
9917
9918         This is a perf-neutral change. The speculation checks that this removes
9919         were not on hot paths of major benchmarks.
9920
9921         * bytecode/PredictedType.h:
9922         (JSC):
9923         (JSC::isAnyPrediction):
9924         * dfg/DFGAbstractState.cpp:
9925         (JSC::DFG::AbstractState::execute):
9926         * dfg/DFGAbstractState.h:
9927         (JSC::DFG::AbstractState::speculateInt32Unary):
9928         (AbstractState):
9929         (JSC::DFG::AbstractState::speculateNumberUnary):
9930         (JSC::DFG::AbstractState::speculateBooleanUnary):
9931         (JSC::DFG::AbstractState::speculateInt32Binary):
9932         (JSC::DFG::AbstractState::speculateNumberBinary):
9933         * dfg/DFGNode.h:
9934         (JSC::DFG::Node::mergeFlags):
9935         (JSC::DFG::Node::filterFlags):
9936         (Node):
9937         (JSC::DFG::Node::setCanExit):
9938         (JSC::DFG::Node::canExit):
9939         * dfg/DFGNodeFlags.cpp:
9940         (JSC::DFG::nodeFlagsAsString):
9941         * dfg/DFGNodeFlags.h:
9942         (DFG):
9943         * dfg/DFGSpeculativeJIT.cpp:
9944         (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
9945         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
9946         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
9947         * dfg/DFGSpeculativeJIT.h:
9948         (JSC::DFG::SpeculativeJIT::speculationCheck):
9949         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
9950         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
9951         (SpeculativeJIT):
9952         * dfg/DFGSpeculativeJIT32_64.cpp:
9953         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
9954         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
9955         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
9956         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
9957         (JSC::DFG::SpeculativeJIT::compile):
9958         * dfg/DFGSpeculativeJIT64.cpp:
9959         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
9960         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
9961         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
9962         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
9963         (JSC::DFG::SpeculativeJIT::compile):
9964
9965 2012-05-20  Filip Pizlo  <fpizlo@apple.com>
9966
9967         DFG should not do unnecessary indirections when storing to objects
9968         https://bugs.webkit.org/show_bug.cgi?id=86959
9969
9970         Reviewed by Oliver Hunt.
9971
9972         Merged r117819 from dfgopt.
9973
9974         * dfg/DFGByteCodeParser.cpp:
9975         (JSC::DFG::ByteCodeParser::parseBlock):
9976         * dfg/DFGCSEPhase.cpp:
9977         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
9978         * dfg/DFGSpeculativeJIT32_64.cpp:
9979         (JSC::DFG::SpeculativeJIT::compile):
9980         * dfg/DFGSpeculativeJIT64.cpp:
9981         (JSC::DFG::SpeculativeJIT::compile):
9982
9983 2012-05-17  Filip Pizlo  <fpizlo@apple.com>
9984
9985         DFG should optimize aliased uses of the Arguments object of the current call frame
9986         https://bugs.webkit.org/show_bug.cgi?id=86552
9987
9988         Reviewed by Geoff Garen.
9989
9990         Merged r117542 and r117543 from dfgopt.
9991
9992         Performs must-alias and escape analysis on uses of CreateArguments, and if
9993         a variable is must-aliased to CreateArguments and does not escape, then we
9994         turn all uses of that variable into direct arguments accesses.
9995
9996         36% speed-up on V8/earley leading to a 2.3% speed-up overall in V8.
9997
9998         * bytecode/CodeBlock.h:
9999         (JSC::CodeBlock::uncheckedArgumentsRegister):
10000         * bytecode/ValueRecovery.h:
10001         (JSC::ValueRecovery::argumentsThatWereNotCreated):
10002         (ValueRecovery):
10003         (JSC::ValueRecovery::dump):
10004         * dfg/DFGAbstractState.cpp:
10005         (JSC::DFG::AbstractState::execute):
10006         * dfg/DFGAdjacencyList.h:
10007         (AdjacencyList):
10008         (JSC::DFG::AdjacencyList::removeEdgeFromBag):
10009         * dfg/DFGArgumentsSimplificationPhase.cpp:
10010         (JSC::DFG::ArgumentsSimplificationPhase::run):
10011         (ArgumentsSimplificationPhase):
10012         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
10013         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
10014         (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
10015         (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
10016         (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
10017         * dfg/DFGAssemblyHelpers.h:
10018         (JSC::DFG::AssemblyHelpers::argumentsRegisterFor):
10019         (AssemblyHelpers):
10020         * dfg/DFGByteCodeParser.cpp:
10021         (JSC::DFG::ByteCodeParser::parseBlock):
10022         * dfg/DFGCFGSimplificationPhase.cpp:
10023         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
10024         * dfg/DFGGPRInfo.h:
10025         (GPRInfo):
10026         * dfg/DFGGraph.cpp:
10027         (JSC::DFG::Graph::collectGarbage):
10028         (DFG):
10029         * dfg/DFGGraph.h:
10030         (Graph):
10031         (JSC::DFG::Graph::executableFor):
10032         (JSC::DFG::Graph::argumentsRegisterFor):
10033         (JSC::DFG::Graph::uncheckedArgumentsRegisterFor):
10034         (JSC::DFG::Graph::clobbersWorld):
10035         * dfg/DFGNode.h:
10036         (JSC::DFG::Node::hasHeapPrediction):
10037         * dfg/DFGNodeType.h:
10038         (DFG):
10039         * dfg/DFGOSRExitCompiler.cpp:
10040         * dfg/DFGOSRExitCompiler.h:
10041         (JSC::DFG::OSRExitCompiler::OSRExitCompiler):
10042         (OSRExitCompiler):
10043         * dfg/DFGOSRExitCompiler32_64.cpp:
10044         (JSC::DFG::OSRExitCompiler::compileExit):
10045         * dfg/DFGOSRExitCompiler64.cpp:
10046         (JSC::DFG::OSRExitCompiler::compileExit):
10047         * dfg/DFGOperations.cpp:
10048         * dfg/DFGPredictionPropagationPhase.cpp:
10049         (JSC::DFG::PredictionPropagationPhase::propagate):
10050         * dfg/DFGSpeculativeJIT.cpp:
10051         (JSC::DFG::ValueSource::dump):
10052         (JSC::DFG::SpeculativeJIT::compile):
10053         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
10054         * dfg/DFGSpeculativeJIT.h:
10055         * dfg/DFGSpeculativeJIT32_64.cpp:
10056         (JSC::DFG::SpeculativeJIT::compile):
10057         * dfg/DFGSpeculativeJIT64.cpp:
10058         (JSC::DFG::SpeculativeJIT::compile):
10059         * dfg/DFGVariableAccessData.h:
10060         (JSC::DFG::VariableAccessData::VariableAccessData):
10061         (JSC::DFG::VariableAccessData::mergeIsArgumentsAlias):
10062         (VariableAccessData):
10063         (JSC::DFG::VariableAccessData::isArgumentsAlias):
10064         * jit/JITOpcodes.cpp:
10065         (JSC::JIT::emitSlow_op_get_argument_by_val):
10066
10067 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10068
10069         DFGCapabilities should not try to get an arguments register from code blocks that don't have one
10070         https://bugs.webkit.org/show_bug.cgi?id=87332
10071
10072         Reviewed by Andy Estes.
10073
10074         * dfg/DFGCapabilities.h:
10075         (JSC::DFG::canInlineOpcode):
10076
10077 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10078
10079         DFG should have sparse conditional constant propagation
10080         https://bugs.webkit.org/show_bug.cgi?id=86580
10081
10082         Reviewed by Oliver Hunt.
10083
10084         Merged r117370 from dfgopt.
10085
10086         This enhances CFA so that if it suspects at any point during the fixpoint that a
10087         branch will only go one way, then it only propagates in that one way.
10088
10089         This vastly increases the opportunities for CFG simplification. For example, it
10090         enables us to evaporate this loop:
10091
10092         for (var i = 0; i < 1; ++i) doThings(i);
10093
10094         As a result, it uncovered loads of bugs in the CFG simplifier. In particular:
10095
10096         - Phi fixup was assuming that all Phis worth fixing up are shouldGenerate().
10097           That's not true; we also fixup Phis that are dead.
10098
10099         - GetLocal fixup was assuming that it's only necessary to rewire links to a
10100           GetLocal, and that the GetLocal's own links don't need to be rewired. Untrue,
10101           because the GetLocal may not be rewirable (first block has no GetLocal for r42
10102           but second block does have a GetLocal), in which case it will refer to a Phi
10103           in the second block. We need it to refer to a Phi from the first block to
10104           ensure that subsequent transformations work.
10105
10106         - Tail operand fixup was ignoring the fact that Phis in successors may contain
10107           references to the children of our tail variables. Hence, successor Phi child
10108           substitution needs to use the original second block variable table as its
10109           prior, rather than trying to reconstruct the prior later (since by that point
10110           the children of the second block's tail variables will have been fixed up, so
10111           we will not know what the prior would have been).
10112
10113         * dfg/DFGAbstractState.cpp:
10114         (JSC::DFG::AbstractState::beginBasicBlock):
10115         (JSC::DFG::AbstractState::endBasicBlock):
10116         (JSC::DFG::AbstractState::reset):
10117         (JSC::DFG::AbstractState::execute):
10118         (JSC::DFG::AbstractState::mergeToSuccessors):
10119         * dfg/DFGAbstractState.h:
10120         (JSC::DFG::AbstractState::branchDirectionToString):
10121         (AbstractState):
10122         * dfg/DFGCFGSimplificationPhase.cpp:
10123         (JSC::DFG::CFGSimplificationPhase::run):
10124         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
10125         (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::OperandSubstitution):
10126         (OperandSubstitution):
10127         (JSC::DFG::CFGSimplificationPhase::skipGetLocal):
10128         (JSC::DFG::CFGSimplificationPhase::recordPossibleIncomingReference):
10129         (CFGSimplificationPhase):
10130         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
10131         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
10132         * dfg/DFGGraph.h:
10133         (JSC::DFG::Graph::changeEdge):
10134
10135 2012-05-23  Ojan Vafai  <ojan@chromium.org>
10136
10137         add back the ability to disable flexbox
10138         https://bugs.webkit.org/show_bug.cgi?id=87147
10139
10140         Reviewed by Tony Chang.
10141
10142         * Configurations/FeatureDefines.xcconfig:
10143
10144 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10145
10146         Unreviewed, fix Windows build.
10147
10148         * bytecode/CodeBlock.h:
10149         * dfg/DFGCapabilities.h:
10150         (JSC::DFG::canCompileOpcode):
10151         (JSC::DFG::canCompileOpcodes):
10152         * dfg/DFGCommon.h:
10153         (DFG):
10154
10155 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10156
10157         DFG should optimize inlined uses of arguments.length and arguments[i]
10158         https://bugs.webkit.org/show_bug.cgi?id=86327
10159
10160         Reviewed by Gavin Barraclough.
10161
10162         Merged r117017 from dfgopt.
10163
10164         Turns inlined uses of arguments.length into a constant.
10165
10166         Turns inlined uses of arguments[constant] into a direct reference to the
10167         argument.
10168
10169         Big win on micro-benchmarks. Not yet a win on V8 because the hot uses of
10170         arguments.length and arguments[i] are aliased. I'll leave the aliasing
10171         optimizations to a later patch.
10172
10173         * CMakeLists.txt:
10174         * GNUmakefile.list.am:
10175         * JavaScriptCore.xcodeproj/project.pbxproj:
10176         * Target.pri:
10177         * bytecode/DFGExitProfile.h:
10178         (FrequentExitSite):
10179         (JSC::DFG::FrequentExitSite::FrequentExitSite):
10180         (JSC::DFG::QueryableExitProfile::hasExitSite):
10181         (QueryableExitProfile):
10182         * dfg/DFGAbstractState.cpp:
10183         (JSC::DFG::AbstractState::execute):
10184         * dfg/DFGArgumentsSimplificationPhase.cpp: Added.
10185         (DFG):
10186         (ArgumentsSimplificationPhase):
10187         (JSC::DFG::ArgumentsSimplificationPhase::ArgumentsSimplificationPhase):
10188         (JSC::DFG::ArgumentsSimplificationPhase::run):
10189         (JSC::DFG::performArgumentsSimplification):
10190         * dfg/DFGArgumentsSimplificationPhase.h: Added.
10191         (DFG):
10192         * dfg/DFGAssemblyHelpers.cpp:
10193         (JSC::DFG::AssemblyHelpers::executableFor):
10194         (DFG):
10195         * dfg/DFGAssemblyHelpers.h:
10196         (AssemblyHelpers):
10197         * dfg/DFGByteCodeParser.cpp:
10198         (JSC::DFG::ByteCodeParser::parseBlock):
10199         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
10200         * dfg/DFGCSEPhase.cpp:
10201         (JSC::DFG::CSEPhase::getLocalLoadElimination):
10202         (JSC::DFG::CSEPhase::performNodeCSE):
10203         * dfg/DFGDriver.cpp:
10204         (JSC::DFG::compile):
10205         * dfg/DFGGraph.h:
10206         (JSC::DFG::Graph::Graph):
10207         (JSC::DFG::Graph::executableFor):
10208         (Graph):
10209         (JSC::DFG::Graph::clobbersWorld):
10210         * dfg/DFGNode.h:
10211         (JSC::DFG::Node::convertToConstant):
10212         (JSC::DFG::Node::convertToGetLocalUnlinked):
10213         (Node):
10214         (JSC::DFG::Node::unlinkedLocal):
10215         * dfg/DFGNodeType.h:
10216         (DFG):
10217         * dfg/DFGOSRExit.cpp:
10218         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
10219         * dfg/DFGPredictionPropagationPhase.cpp:
10220         (JSC::DFG::PredictionPropagationPhase::propagate):
10221         * dfg/DFGSpeculativeJIT32_64.cpp:
10222         (JSC::DFG::SpeculativeJIT::compile):
10223         * dfg/DFGSpeculativeJIT64.cpp:
10224         (JSC::DFG::SpeculativeJIT::compile):
10225
10226 2012-05-13  Filip Pizlo  <fpizlo@apple.com>
10227
10228         DFG should be able to optimize foo.apply(bar, arguments)
10229         https://bugs.webkit.org/show_bug.cgi?id=86306
10230
10231         Reviewed by Gavin Barraclough.
10232
10233         Merge r116912 from dfgopt.
10234
10235         Enables compilation of op_jneq_ptr and some forms of op_call_varargs.
10236
10237         Also includes a bunch of bug fixes that were made necessary by the increased
10238         pressure on the CFG simplifier.
10239
10240         This is a 1-2% win on V8.
10241
10242         * bytecode/CodeBlock.cpp:
10243         (JSC::CodeBlock::printCallOp):
10244         (JSC::CodeBlock::CodeBlock):
10245         (JSC::ProgramCodeBlock::canCompileWithDFGInternal):
10246         (JSC::EvalCodeBlock::canCompileWithDFGInternal):
10247         (JSC::FunctionCodeBlock::canCompileWithDFGInternal):
10248         * bytecode/CodeBlock.h:
10249         (CodeBlock):
10250         (JSC::CodeBlock::canCompileWithDFG):
10251         (JSC::CodeBlock::canCompileWithDFGState):
10252         (ProgramCodeBlock):
10253         (EvalCodeBlock):
10254         (FunctionCodeBlock):
10255         * dfg/DFGAbstractState.cpp:
10256         (JSC::DFG::AbstractState::execute):
10257         * dfg/DFGByteCodeParser.cpp:
10258         (JSC::DFG::ByteCodeParser::parseBlock):
10259         (JSC::DFG::ByteCodeParser::processPhiStack):
10260         (JSC::DFG::ByteCodeParser::parse):
10261         * dfg/DFGCFGSimplificationPhase.cpp:
10262         (JSC::DFG::CFGSimplificationPhase::run):
10263         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
10264         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
10265         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
10266         * dfg/DFGCSEPhase.cpp:
10267         (JSC::DFG::CSEPhase::getLocalLoadElimination):
10268         (CSEPhase):
10269         (JSC::DFG::CSEPhase::setReplacement):
10270         (JSC::DFG::CSEPhase::performNodeCSE):
10271         * dfg/DFGCapabilities.cpp:
10272         (JSC::DFG::debugFail):
10273         (DFG):
10274         (JSC::DFG::canHandleOpcodes):
10275         (JSC::DFG::canCompileOpcodes):
10276         (JSC::DFG::canInlineOpcodes):
10277         * dfg/DFGCapabilities.h:
10278         (JSC::DFG::canCompileOpcode):
10279         (JSC::DFG::canInlineOpcode):
10280         (DFG):
10281         (JSC::DFG::canCompileOpcodes):
10282         (JSC::DFG::canCompileEval):
10283         (JSC::DFG::canCompileProgram):
10284         (JSC::DFG::canCompileFunctionForCall):
10285         (JSC::DFG::canCompileFunctionForConstruct):
10286         * dfg/DFGCommon.h:
10287         * dfg/DFGGraph.cpp:
10288         (JSC::DFG::Graph::dump):
10289         * dfg/DFGNodeType.h:
10290         (DFG):
10291         * dfg/DFGPredictionPropagationPhase.cpp:
10292         (JSC::DFG::PredictionPropagationPhase::propagate):
10293         * dfg/DFGSpeculativeJIT32_64.cpp:
10294         (JSC::DFG::SpeculativeJIT::compile):
10295         * dfg/DFGSpeculativeJIT64.cpp:
10296         (JSC::DFG::SpeculativeJIT::emitCall):
10297         (JSC::DFG::SpeculativeJIT::compile):
10298         * dfg/DFGValidate.cpp:
10299         (Validate):
10300         (JSC::DFG::Validate::validate):
10301         (JSC::DFG::Validate::checkOperand):
10302         (JSC::DFG::Validate::reportValidationContext):
10303         * jit/JIT.cpp:
10304         (JSC::JIT::emitOptimizationCheck):
10305         (JSC::JIT::privateCompileSlowCases):
10306         (JSC::JIT::privateCompile):
10307         * jit/JIT.h:
10308         * jit/JITArithmetic.cpp:
10309         (JSC::JIT::compileBinaryArithOp):
10310         * jit/JITPropertyAccess.cpp:
10311         (JSC::JIT::privateCompilePutByIdTransition):
10312         * jit/JITPropertyAccess32_64.cpp:
10313         (JSC::JIT::privateCompilePutByIdTransition):
10314         * tools/CodeProfile.cpp:
10315         (JSC::CodeProfile::sample):
10316
10317 2012-05-23  Geoffrey Garen  <ggaren@apple.com>
10318
10319         Refactored WeakBlock to use malloc, clarify behavior
10320         https://bugs.webkit.org/show_bug.cgi?id=87318
10321
10322         Reviewed by Filip Pizlo.
10323
10324         We want to use malloc so we can make these smaller than 4KB,
10325         since an individual MarkedBlock will usually have fewer than
10326         4KB worth of weak pointers.
10327
10328         * heap/Heap.cpp:
10329         (JSC::Heap::markRoots): Renamed visitLiveWeakImpls to visit, since
10330         we no longer need to distinguish from "visitDeadWeakImpls".
10331
10332         Renamed "visitDeadWeakImpls" to "reap" because we're not actually
10333         doing any visiting -- we're just tagging things as dead.
10334
10335         * heap/WeakBlock.cpp:
10336         (JSC::WeakBlock::create):
10337         (JSC::WeakBlock::destroy):
10338         (JSC::WeakBlock::WeakBlock): Malloc!
10339
10340         (JSC::WeakBlock::visit):
10341         (JSC::WeakBlock::reap): Renamed as above.
10342
10343         * heap/WeakBlock.h:
10344         (WeakBlock): Reduced to 3KB, as explained above.
10345
10346         * heap/WeakSet.cpp:
10347         (JSC::WeakSet::visit):
10348         (JSC::WeakSet::reap):
10349         * heap/WeakSet.h:
10350         (WeakSet): Updated for renames, and to match WebKit style.
10351
10352 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10353
10354         Use after free in JSC::DFG::ByteCodeParser::processPhiStack
10355         https://bugs.webkit.org/show_bug.cgi?id=87312
10356         <rdar://problem/11518848>
10357
10358         Reviewed by Oliver Hunt.
10359
10360         * dfg/DFGByteCodeParser.cpp:
10361         (JSC::DFG::ByteCodeParser::processPhiStack):
10362         (JSC::DFG::ByteCodeParser::parse):
10363
10364 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10365
10366         It should be possible to make C function calls from DFG code on ARM in debug mode
10367         https://bugs.webkit.org/show_bug.cgi?id=87313
10368
10369         Reviewed by Gavin Barraclough.
10370
10371         * dfg/DFGSpeculativeJIT.h:
10372         (SpeculativeJIT):
10373
10374 2012-05-11  Filip Pizlo  <fpizlo@apple.com>
10375
10376         DFG should be able to inline functions that use arguments reflectively
10377         https://bugs.webkit.org/show_bug.cgi?id=86132
10378
10379         Reviewed by Oliver Hunt.
10380
10381         Merged r116838 from dfgopt.
10382
10383         This turns on inlining of functions that use arguments reflectively, but it
10384         does not do any of the obvious optimizations that this exposes. I'll save that
10385         for another patch - the important thing for now is that this contains all of
10386         the plumbing necessary to make this kind of inlining sound even in bizarro
10387         cases like an inline callee escaping the arguments object to parts of the
10388         inline caller where the arguments are otherwise dead. Or even more fun cases
10389         like where you've inlined to an inline stack that is three-deep, and the
10390         function on top of the inline stack reflectively accesses the arguments of a
10391         function that is in the middle of the inline stack. Any subsequent
10392         optimizations that we do for the obvious cases of arguments usage in inline
10393         functions will have to take care not to break the baseline functionality that
10394         this patch plumbs together.
10395
10396         * bytecode/CodeBlock.cpp:
10397         (JSC::CodeBlock::printCallOp):
10398         (JSC::CodeBlock::dump):
10399         * bytecode/CodeBlock.h:
10400         * dfg/DFGAssemblyHelpers.h:
10401         (JSC::DFG::AssemblyHelpers::argumentsRegisterFor):
10402         (AssemblyHelpers):
10403         * dfg/DFGByteCodeParser.cpp:
10404         (InlineStackEntry):
10405         (JSC::DFG::ByteCodeParser::handleCall):
10406         (JSC::DFG::ByteCodeParser::handleInlining):
10407         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
10408         (JSC::DFG::ByteCodeParser::parse):
10409         * dfg/DFGCCallHelpers.h:
10410         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
10411         (CCallHelpers):
10412         * dfg/DFGCapabilities.h:
10413         (JSC::DFG::canInlineOpcode):
10414         * dfg/DFGDriver.cpp:
10415         (JSC::DFG::compile):
10416         * dfg/DFGFixupPhase.cpp:
10417         (JSC::DFG::FixupPhase::fixupNode):
10418         * dfg/DFGOperations.cpp:
10419         * dfg/DFGOperations.h:
10420         * dfg/DFGSpeculativeJIT.h:
10421         (JSC::DFG::SpeculativeJIT::callOperation):
10422         * dfg/DFGSpeculativeJIT32_64.cpp:
10423         (JSC::DFG::SpeculativeJIT::compile):
10424         * dfg/DFGSpeculativeJIT64.cpp:
10425         (JSC::DFG::SpeculativeJIT::compile):
10426         * interpreter/CallFrame.cpp:
10427         (JSC):
10428         (JSC::CallFrame::someCodeBlockForPossiblyInlinedCode):
10429         * interpreter/CallFrame.h:
10430         (ExecState):
10431         (JSC::ExecState::someCodeBlockForPossiblyInlinedCode):
10432         * interpreter/Interpreter.cpp:
10433         (JSC::Interpreter::retrieveArgumentsFromVMCode):
10434         * runtime/Arguments.cpp:
10435         (JSC::Arguments::tearOff):
10436         (JSC):
10437         (JSC::Arguments::tearOffForInlineCallFrame):
10438         * runtime/Arguments.h:
10439         (Arguments):
10440         (JSC::Arguments::create):
10441         (JSC::Arguments::finishCreation):
10442         (JSC):
10443
10444 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10445
10446         Every OSR exit on ARM results in a crash
10447         https://bugs.webkit.org/show_bug.cgi?id=87307
10448
10449         Reviewed by Geoffrey Garen.
10450
10451         * dfg/DFGThunks.cpp:
10452         (JSC::DFG::osrExitGenerationThunkGenerator):
10453
10454 2012-05-23  Geoffrey Garen  <ggaren@apple.com>
10455
10456         Refactored heap tear-down to use normal value semantics (i.e., destructors)
10457         https://bugs.webkit.org/show_bug.cgi?id=87302
10458
10459         Reviewed by Oliver Hunt.
10460
10461         This is a step toward incremental DOM finalization.
10462
10463         * heap/CopiedSpace.cpp:
10464         (JSC::CopiedSpace::~CopiedSpace):
10465         * heap/CopiedSpace.h:
10466         (CopiedSpace): Just use our destructor, instead of relying on the heap
10467         to send us a special message at a special time.
10468
10469         * heap/Heap.cpp:
10470         (JSC::Heap::Heap): Use OwnPtr for m_markListSet because this is not Sparta.
10471
10472         (JSC::Heap::~Heap): No need for delete or freeAllBlocks because normal
10473         destructors do this work automatically now.
10474
10475         (JSC::Heap::lastChanceToFinalize): Just call lastChanceToFinalize on our
10476         sub-objects, and assume it does the right thing. This improves encapsulation,
10477         so we can add items requiring finalization to our sub-objects.
10478
10479         * heap/Heap.h: Moved m_blockAllocator to get the right destruction order.
10480
10481         * heap/MarkedSpace.cpp:
10482         (Take):
10483         (JSC):
10484         (JSC::Take::Take):
10485         (JSC::Take::operator()):
10486         (JSC::Take::returnValue): Moved to the top of the file so it can be used
10487         in another function.
10488
10489         (JSC::MarkedSpace::~MarkedSpace): Delete all outstanding memory, like a good
10490         destructor should.
10491
10492         (JSC::MarkedSpace::lastChanceToFinalize): Moved some code here from the heap,
10493         since it pertains to our internal implementation details.
10494
10495         * heap/MarkedSpace.h:
10496         (MarkedSpace):
10497         * heap/WeakBlock.cpp:
10498         (JSC::WeakBlock::lastChanceToFinalize):
10499         * heap/WeakBlock.h:
10500         (WeakBlock):
10501         * heap/WeakSet.cpp:
10502         (JSC::WeakSet::lastChanceToFinalize):
10503         * heap/WeakSet.h:
10504         (WeakSet): Stop using a special freeAllBlocks() callback and just implement
10505         lastChanceToFinalize.
10506
10507 2011-05-22  Geoffrey Garen  <ggaren@apple.com>
10508
10509         Encapsulated some calculations for whether portions of the heap are empty
10510         https://bugs.webkit.org/show_bug.cgi?id=87210
10511
10512         Reviewed by Gavin Barraclough.
10513
10514         This is a step toward incremental DOM finalization.
10515
10516         * heap/Heap.cpp:
10517         (JSC::Heap::~Heap): Explicitly call freeAllBlocks() instead of relying
10518         implicitly on all blocks thinking they're empty. In future, we may
10519         choose to tear down the heap without first setting all data structures
10520         to "empty".
10521
10522         * heap/MarkedBlock.h:
10523         (JSC::MarkedBlock::isEmpty):
10524         (JSC::MarkedBlock::gatherDirtyCells): Renamed markCountIsZero to isEmpty,
10525         in preparation for making it check for outstanding finalizers in addition
10526         to marked cells.
10527
10528         * heap/MarkedSpace.cpp:
10529         (Take):
10530         (JSC::Take::Take):
10531         (JSC::Take::operator()):
10532         (JSC::Take::returnValue):
10533         (JSC::MarkedSpace::shrink):
10534         (JSC::MarkedSpace::freeAllBlocks): Refactored the "Take" functor to support
10535         a conditional isEmpty check, so it dould be shared by shrink() and freeAllBlocks().
10536
10537         * heap/WeakBlock.cpp:
10538         (JSC::WeakBlock::WeakBlock):
10539         (JSC::WeakBlock::visitLiveWeakImpls):
10540         (JSC::WeakBlock::visitDeadWeakImpls):
10541         * heap/WeakBlock.h:
10542         (WeakBlock):
10543         (JSC::WeakBlock::isEmpty):
10544         * heap/WeakSet.cpp:
10545         (JSC::WeakSet::sweep):
10546         (JSC::WeakSet::shrink): Use isEmpty(), in preparation for changes in
10547         its implementation.
10548
10549 2012-05-23  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
10550
10551         [Qt] Remove references to $$QT_SOURCE_TREE
10552
10553         With a modularized Qt, it's ambigious. What we really want is qtbase,
10554         which qtcore is a proxy for (we assume it will always live in qtbase).
10555
10556         Reviewed by Tor Arne Vestbø.
10557
10558         * JavaScriptCore.pri:
10559         * Target.pri:
10560
10561 2012-05-09  Filip Pizlo  <fpizlo@apple.com>
10562
10563         DFG should allow inlining in case of certain arity mismatches
10564         https://bugs.webkit.org/show_bug.cgi?id=86059
10565
10566         Reviewed by Geoff Garen.
10567
10568         Merge r116620 from dfgopt.
10569
10570         * dfg/DFGByteCodeParser.cpp:
10571         (JSC::DFG::ByteCodeParser::handleInlining):
10572
10573 2012-05-08  Filip Pizlo  <fpizlo@apple.com>
10574
10575         DFG variable capture analysis should work even if the variables arose through inlining
10576         https://bugs.webkit.org/show_bug.cgi?id=85945
10577
10578         Reviewed by Oliver Hunt.
10579
10580         Merged r116555 from dfgopt.
10581
10582         This just changes how the DFG queries whether a variable is captured. It does not
10583         change any user-visible behavior.
10584
10585         As part of this change, I further solidified the policy that the CFA behaves in an
10586         undefined way for captured locals and queries about their values will not yield
10587         reliable results. This will likely be changed in the future, but for now it makes
10588         sense.
10589
10590         One fun part about this change is that it recognizes that the same variable may
10591         be both captured and not, at the same time, because their live interval spans
10592         inlining boundaries. This only happens in the case of arguments to functions that
10593         capture their arguments, and this change treats them with just the right touch of
10594         conservatism: they will be treated as if captured by the caller as well as the
10595         callee.
10596
10597         Finally, this also adds captured variable reasoning to the InlineCallFrame, which
10598         I thought might be useful for later tooling.
10599
10600         This is perf-neutral, since it does it does not make the DFG take advantage of this
10601         new functionality in any way. In particular, it is still the case that the DFG will
10602         not inline functions that use arguments reflectively or that create activations.
10603
10604         * bytecode/CodeBlock.h:
10605         (CodeBlock):
10606         (JSC::CodeBlock::needsActivation):
10607         (JSC::CodeBlock::argumentIsCaptured):
10608         (JSC::CodeBlock::localIsCaptured):
10609         (JSC::CodeBlock::isCaptured):
10610         * bytecode/CodeOrigin.h:
10611         (InlineCallFrame):
10612         * dfg/DFGAbstractState.cpp:
10613         (JSC::DFG::AbstractState::initialize):
10614         (JSC::DFG::AbstractState::endBasicBlock):
10615         (JSC::DFG::AbstractState::execute):
10616         (JSC::DFG::AbstractState::merge):
10617         * dfg/DFGByteCodeParser.cpp:
10618         (JSC::DFG::ByteCodeParser::newVariableAccessData):
10619         (JSC::DFG::ByteCodeParser::getLocal):
10620         (JSC::DFG::ByteCodeParser::setLocal):
10621         (JSC::DFG::ByteCodeParser::getArgument):
10622         (JSC::DFG::ByteCodeParser::setArgument):
10623         (JSC::DFG::ByteCodeParser::flushArgument):
10624         (JSC::DFG::ByteCodeParser::parseBlock):
10625         (JSC::DFG::ByteCodeParser::processPhiStack):
10626         (JSC::DFG::ByteCodeParser::fixVariableAccessPredictions):
10627         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
10628         * dfg/DFGCFGSimplificationPhase.cpp:
10629         (CFGSimplificationPhase):
10630         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
10631         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
10632         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
10633         * dfg/DFGCommon.h:
10634         * dfg/DFGFixupPhase.cpp:
10635         (JSC::DFG::FixupPhase::fixupNode):
10636         * dfg/DFGGraph.cpp:
10637         (JSC::DFG::Graph::nameOfVariableAccessData):
10638         * dfg/DFGGraph.h:
10639         (JSC::DFG::Graph::needsActivation):
10640         (JSC::DFG::Graph::usesArguments):
10641         * dfg/DFGPredictionPropagationPhase.cpp:
10642         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
10643         * dfg/DFGSpeculativeJIT.cpp:
10644         (JSC::DFG::SpeculativeJIT::compile):
10645         * dfg/DFGSpeculativeJIT32_64.cpp:
10646         (JSC::DFG::SpeculativeJIT::compile):
10647         * dfg/DFGSpeculativeJIT64.cpp:
10648         (JSC::DFG::SpeculativeJIT::compile):
10649         * dfg/DFGVariableAccessData.h:
10650         (JSC::DFG::VariableAccessData::VariableAccessData):
10651         (JSC::DFG::VariableAccessData::mergeIsCaptured):
10652         (VariableAccessData):
10653         (JSC::DFG::VariableAccessData::isCaptured):
10654
10655 2012-05-08  Filip Pizlo  <fpizlo@apple.com>
10656
10657         DFG should support op_get_argument_by_val and op_get_arguments_length
10658         https://bugs.webkit.org/show_bug.cgi?id=85911
10659
10660         Reviewed by Oliver Hunt.
10661
10662         Merged r116467 from dfgopt.
10663
10664         This adds a simple and relatively conservative implementation of op_get_argument_by_val
10665         and op_get_arguments_length. We can optimize these later. For now it's great to have
10666         the additional coverage.
10667
10668         This patch appears to be perf-neutral.
10669
10670         * dfg/DFGAbstractState.cpp:
10671         (JSC::DFG::AbstractState::execute):
10672         * dfg/DFGAssemblyHelpers.h:
10673         (JSC::DFG::AssemblyHelpers::addressFor):
10674         (JSC::DFG::AssemblyHelpers::tagFor):
10675         (JSC::DFG::AssemblyHelpers::payloadFor):
10676         * dfg/DFGByteCodeParser.cpp:
10677         (JSC::DFG::ByteCodeParser::parseBlock):
10678         * dfg/DFGCapabilities.h:
10679         (JSC::DFG::canCompileOpcode):
10680         (JSC::DFG::canInlineOpcode):
10681         * dfg/DFGNode.h:
10682         (JSC::DFG::Node::hasHeapPrediction):
10683         * dfg/DFGNodeType.h:
10684         (DFG):
10685         * dfg/DFGOperations.cpp:
10686         * dfg/DFGOperations.h:
10687         * dfg/DFGPredictionPropagationPhase.cpp:
10688         (JSC::DFG::PredictionPropagationPhase::propagate):
10689         * dfg/DFGSpeculativeJIT.h:
10690         (JSC::DFG::SpeculativeJIT::callOperation):
10691         (SpeculativeJIT):
10692         * dfg/DFGSpeculativeJIT32_64.cpp:
10693         (JSC::DFG::SpeculativeJIT::compile):
10694         * dfg/DFGSpeculativeJIT64.cpp:
10695         (JSC::DFG::SpeculativeJIT::compile):
10696         * jit/JITOpcodes.cpp:
10697         (JSC::JIT::emit_op_get_argument_by_val):
10698         * jit/JITOpcodes32_64.cpp:
10699         (JSC::JIT::emit_op_get_argument_by_val):
10700         * llint/LowLevelInterpreter32_64.asm:
10701         * llint/LowLevelInterpreter64.asm:
10702
10703 2012-05-07  Filip Pizlo  <fpizlo@apple.com>
10704
10705         DFG should support op_tear_off_arguments
10706         https://bugs.webkit.org/show_bug.cgi?id=85847
10707
10708         Reviewed by Michael Saboff.
10709
10710         Merged r116378 from dfgopt.
10711
10712         * dfg/DFGAbstractState.cpp:
10713         (JSC::DFG::AbstractState::execute):
10714         * dfg/DFGByteCodeParser.cpp:
10715         (JSC::DFG::ByteCodeParser::parseBlock):
10716         * dfg/DFGCapabilities.h:
10717         (JSC::DFG::canCompileOpcode):
10718         (JSC::DFG::canInlineOpcode):
10719         * dfg/DFGNodeType.h:
10720         (DFG):
10721         * dfg/DFGOperations.cpp:
10722         * dfg/DFGOperations.h:
10723         * dfg/DFGPredictionPropagationPhase.cpp:
10724         (JSC::DFG::PredictionPropagationPhase::propagate):
10725         * dfg/DFGSpeculativeJIT.h:
10726         (SpeculativeJIT):
10727         (JSC::DFG::SpeculativeJIT::callOperation):
10728         * dfg/DFGSpeculativeJIT32_64.cpp:
10729         (JSC::DFG::SpeculativeJIT::compile):
10730         * dfg/DFGSpeculativeJIT64.cpp:
10731         (JSC::DFG::SpeculativeJIT::compile):
10732
10733 2012-05-22  Mark Hahnenberg  <mhahnenberg@apple.com>
10734
10735         CopiedSpace::contains doesn't check for oversize blocks
10736         https://bugs.webkit.org/show_bug.cgi?id=87180
10737
10738         Reviewed by Geoffrey Garen.
10739
10740         When doing a conservative scan we use CopiedSpace::contains to determine if a particular
10741         address points into the CopiedSpace. Currently contains() only checks if the address
10742         points to a block in to-space, which means that pointers to oversize blocks may not get scanned.
10743
10744         * heap/CopiedSpace.cpp:
10745         (JSC::CopiedSpace::tryAllocateOversize):
10746         (JSC::CopiedSpace::tryReallocateOversize):
10747         (JSC::CopiedSpace::doneFillingBlock):
10748         (JSC::CopiedSpace::doneCopying):
10749         * heap/CopiedSpace.h: Refactored CopiedSpace so that all blocks (oversize and to-space) are
10750         in a single hash set and bloom filter for membership testing.
10751         (CopiedSpace):
10752         * heap/CopiedSpaceInlineMethods.h:
10753         (JSC::CopiedSpace::contains): We check for the normal block first. Since the oversize blocks are
10754         only page aligned, rather than block aligned, we have to re-mask the ptr to check if it's in
10755         CopiedSpace. Also added a helper function of the same name that takes a CopiedBlock* and checks
10756         if it's in CopiedSpace so that check isn't typed out twice.
10757         (JSC):
10758         (JSC::CopiedSpace::startedCopying):
10759         (JSC::CopiedSpace::addNewBlock):
10760
10761 2012-05-22  Geoffrey Garen  <ggaren@apple.com>
10762
10763         CopiedBlock and MarkedBlock should have proper value semantics (i.e., destructors)
10764         https://bugs.webkit.org/show_bug.cgi?id=87172
10765
10766         Reviewed by Oliver Hunt and Phil Pizlo.
10767
10768         This enables MarkedBlock to own non-trivial sub-objects that require
10769         destruction. It also fixes a FIXME about casting a CopiedBlock to a
10770         MarkedBlock at destroy time.
10771
10772         CopiedBlock and MarkedBlock now accept an allocation chunk at create
10773         time and return it at destroy time. Their client is expected to
10774         allocate, recycle, and destroy these chunks.
10775
10776         * heap/BlockAllocator.cpp:
10777         (JSC::BlockAllocator::releaseFreeBlocks):
10778         (JSC::BlockAllocator::blockFreeingThreadMain): Don't call MarkedBlock::destroy
10779         because we expect that to be called before a block is put on our free
10780         list now. Do manually deallocate our allocation chunk because that's
10781         our job now.
10782
10783         * heap/BlockAllocator.h:
10784         (BlockAllocator):
10785         (JSC::BlockAllocator::allocate): Allocate never fails now. This is a
10786         cleaner abstraction because only one object does all the VM allocation
10787         and deallocation. Caching is an implementation detail.
10788
10789         (JSC::BlockAllocator::deallocate): We take an allocation chunk argument
10790         instead of a block because we now expect the block to have been destroyed
10791         before we recycle its memory. For convenience, we still use the HeapBlock
10792         class as our linked list node. This is OK because HeapBlock is a POD type.
10793
10794         * heap/CopiedBlock.h:
10795         (CopiedBlock):
10796         (JSC::CopiedBlock::create):
10797         (JSC::CopiedBlock::destroy):
10798         (JSC::CopiedBlock::CopiedBlock): Added proper create and destroy functions,
10799         to match MarkedBlock.
10800
10801         * heap/CopiedSpace.cpp:
10802         (JSC::CopiedSpace::tryAllocateOversize):
10803         (JSC::CopiedSpace::tryReallocateOversize):
10804         (JSC::CopiedSpace::doneCopying):
10805         (JSC::CopiedSpace::getFreshBlock):
10806         (JSC::CopiedSpace::freeAllBlocks):
10807         * heap/CopiedSpaceInlineMethods.h:
10808         (JSC::CopiedSpace::recycleBlock): Make sure to call destroy before
10809         returning a block to the BlockAllocator. Otherwise, our destructors
10810         won't run. (If we get this wrong now, we'll get a compile error.)
10811
10812         * heap/HeapBlock.h:
10813         (JSC::HeapBlock::HeapBlock): const!
10814
10815         * heap/MarkedAllocator.cpp:
10816         (JSC::MarkedAllocator::allocateBlock): No need to distinguish between
10817         create and recycle -- MarkedBlock always accepts memory allocated by
10818         its client now.
10819
10820         * heap/MarkedBlock.cpp:
10821         (JSC::MarkedBlock::create): Don't allocate memory -- we assume that we're
10822         passed already-allocated memory, to clarify the responsibility for VM
10823         recycling.
10824
10825         (JSC::MarkedBlock::destroy): Do run our destructor before giving back
10826         our VM -- that is the whole point of this patch.
10827
10828         (JSC::MarkedBlock::MarkedBlock):
10829         * heap/MarkedBlock.h:
10830         (MarkedBlock):
10831         * heap/MarkedSpace.cpp: const!
10832
10833         (JSC::MarkedSpace::freeBlocks): Make sure to call destroy before
10834         returning a block to the BlockAllocator. Otherwise, our destructors
10835         won't run. (If we get this wrong now, we'll get a compile error.)
10836
10837 == Rolled over to ChangeLog-2012-05-22 ==