Source/JavaScriptCore/ChangeLog

   1 2013-03-11  Oliver Hunt  <oliver@apple.com>
   2
   3         Make SegmentedVector Noncopyable
   4         https://bugs.webkit.org/show_bug.cgi?id=112059
   5
   6         Reviewed by Geoffrey Garen.
   7
   8         Copying a SegmentedVector is very expensive, and really shouldn't
   9         be necessary.  So I've taken the one place where we currently copy
  10         and replaced it with a regular Vector, and replaced the address
  11         dependent logic with a indexing ref instead.
  12
  13         * bytecompiler/BytecodeGenerator.cpp:
  14         (JSC::BytecodeGenerator::newLabelScope):
  15         (JSC::BytecodeGenerator::emitComplexJumpScopes):
  16         * bytecompiler/BytecodeGenerator.h:
  17         (BytecodeGenerator):
  18         * bytecompiler/LabelScope.h:
  19         (JSC):
  20         (JSC::LabelScopePtr::LabelScopePtr):
  21         (LabelScopePtr):
  22         (JSC::LabelScopePtr::operator=):
  23         (JSC::LabelScopePtr::~LabelScopePtr):
  24         (JSC::LabelScopePtr::operator*):
  25         (JSC::LabelScopePtr::operator->):
  26         * bytecompiler/NodesCodegen.cpp:
  27         (JSC::DoWhileNode::emitBytecode):
  28         (JSC::WhileNode::emitBytecode):
  29         (JSC::ForNode::emitBytecode):
  30         (JSC::ForInNode::emitBytecode):
  31         (JSC::SwitchNode::emitBytecode):
  32         (JSC::LabelNode::emitBytecode):
  33
  34 2012-11-20  Yong Li  <yoli@rim.com>
  35
  36         [ARMv7] Neither linkCall() nor linkPointer() should flush code.
  37         https://bugs.webkit.org/show_bug.cgi?id=99213
  38
  39         Reviewed by George Staikos.
  40
  41         LinkBuffer doesn't need to flush code during linking. It will
  42         eventually flush the whole executable. Fixing this gives >%5
  43         sunspider boost (on QNX).
  44
  45         Also make replaceWithLoad() and replaceWithAddressComputation() flush
  46         only when necessary.
  47
  48         * assembler/ARMv7Assembler.h:
  49         (JSC::ARMv7Assembler::linkCall):
  50         (JSC::ARMv7Assembler::linkPointer):
  51         (JSC::ARMv7Assembler::relinkCall):
  52         (JSC::ARMv7Assembler::repatchInt32):
  53         (JSC::ARMv7Assembler::repatchPointer):
  54         (JSC::ARMv7Assembler::replaceWithLoad): Flush only after it did write.
  55         (JSC::ARMv7Assembler::replaceWithAddressComputation): Flush only after it did write.
  56         (JSC::ARMv7Assembler::setInt32):
  57         (JSC::ARMv7Assembler::setPointer):
  58
  59 2012-08-30  Byungwoo Lee  <bw80.lee@samsung.com>
  60
  61         Build warning : -Wsign-compare on DFGByteCodeParser.cpp.
  62         https://bugs.webkit.org/show_bug.cgi?id=95418
  63
  64         Reviewed by Filip Pizlo.
  65
  66         There is a build warning '-Wsign-compare' on
  67         findArgumentPositionForLocal() in DFGByteCodeParser.cpp.
  68
  69         For removing this warning, casting statement is added explicitly.
  70
  71         * dfg/DFGByteCodeParser.cpp:
  72         (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
  73         (JSC::DFG::ByteCodeParser::findArgumentPosition):
  74
  75 2012-11-13  Cosmin Truta  <ctruta@rim.com>
  76
  77         Uninitialized fields in class JSLock
  78         https://bugs.webkit.org/show_bug.cgi?id=101695
  79
  80         Reviewed by Mark Hahnenberg.
  81
  82         Initialize JSLock::m_ownerThread and JSLock::m_lockDropDepth.
  83
  84         * runtime/JSLock.cpp:
  85         (JSC::JSLock::JSLock):
  86
  87 2012-09-17  Filip Pizlo  <fpizlo@apple.com>
  88
  89         Unreviewed, fix a broken assertion in offlineasm.
  90
  91         * offlineasm/armv7.rb:
  92         * offlineasm/backends.rb:
  93
  94 2012-09-10  Thiago Marcos P. Santos  <thiago.santos@intel.com>
  95
  96         [CMake][EFL] Enable the LLInt
  97         https://bugs.webkit.org/show_bug.cgi?id=92682
  98
  99         Reviewed by Csaba Osztrogonác.
 100
 101         Generate the headers needed by LLint when LLint is enabled.
 102
 103         * CMakeLists.txt:
 104
 105 2012-09-09  Mark Lam  <mark.lam@apple.com>
 106
 107         Fixed a few llint C++ interpreter bugs.
 108         https://bugs.webkit.org/show_bug.cgi?id=96127.
 109
 110         Reviewed by Geoffrey Garen.
 111
 112         * llint/LLIntCLoop.h:
 113             CLoop::execute()'s bootstrapOpcodeId does not need a default
 114             value. There is no case when this function is called without
 115             that parameter being specified.
 116         * llint/LowLevelInterpreter.asm:
 117             Moved the dispatchAfterCall() call to where it is needed.
 118             For the C_LOOP back-end, it generates unreachable code.
 119         * llint/LowLevelInterpreter.cpp:
 120             #include <wtf/Assertions.h> because LLIntAssembly.h needs it.
 121         (JSC):
 122             Fixed bug in SIGN_BIT32() macro.
 123             Placate a MSVC warning for t0, and t1 being uninitialized.
 124         (JSC::CLoop::execute):
 125             The bootstrapOpcodeId arg should always be specified.
 126             MSVC doesn't like UNUSED_PARAM() for labels. Switch to using
 127                 the new UNUSED_LABEL() macro.
 128         * offlineasm/cloop.rb:
 129         * offlineasm/generate_offset_extractor.rb:
 130             Resolved a compiler warning found via MSVC.
 131
 132 2012-09-07  Sheriff Bot  <webkit.review.bot@gmail.com>
 133
 134         Unreviewed, rolling out r127938.
 135         http://trac.webkit.org/changeset/127938
 136         https://bugs.webkit.org/show_bug.cgi?id=96166
 137
 138         It broke the build (Requested by smfr on #webkit).
 139
 140         * llint/LowLevelInterpreter.cpp:
 141         (JSC):
 142         (JSC::CLoop::execute):
 143         * offlineasm/cloop.rb:
 144
 145 2012-09-07  Mark Lam  <mark.lam@apple.com>
 146
 147         Fix a llint C++ interpreter bugs.
 148         https://bugs.webkit.org/show_bug.cgi?id=96127.
 149
 150         Reviewed by Filip Pizlo.
 151
 152         * llint/LowLevelInterpreter.cpp:
 153         (JSC):
 154         (JSC::CLoop::execute):
 155         * offlineasm/cloop.rb:
 156
 157 2012-09-01  Mark Lam  <mark.lam@apple.com>
 158
 159         LLInt C loop backend.
 160         https://bugs.webkit.org/show_bug.cgi?id=91052.
 161
 162         Reviewed by Filip Pizlo.
 163
 164         * JavaScriptCore.xcodeproj/project.pbxproj:
 165         * bytecode/CodeBlock.cpp:
 166         (JSC::CodeBlock::dump):
 167         (JSC::CodeBlock::bytecodeOffset):
 168         * interpreter/Interpreter.cpp:
 169         (JSC::Interpreter::execute):
 170         (JSC::Interpreter::executeCall):
 171         (JSC::Interpreter::executeConstruct):
 172         (JSC):
 173         * interpreter/Interpreter.h:
 174         * jit/JITStubs.h:
 175         (JITStackFrame):
 176         (JSC):
 177         * llint/LLIntCLoop.cpp: Added.
 178         (JSC):
 179         (LLInt):
 180         (JSC::LLInt::CLoop::initialize):
 181         (JSC::LLInt::CLoop::catchRoutineFor):
 182         (JSC::LLInt::CLoop::hostCodeEntryFor):
 183         (JSC::LLInt::CLoop::jsCodeEntryWithArityCheckFor):
 184         (JSC::LLInt::CLoop::jsCodeEntryFor):
 185         * llint/LLIntCLoop.h: Added.
 186         (JSC):
 187         (LLInt):
 188         (CLoop):
 189         * llint/LLIntData.cpp:
 190         (JSC::LLInt::initialize):
 191         * llint/LLIntData.h:
 192         (JSC):
 193         * llint/LLIntOfflineAsmConfig.h:
 194         * llint/LLIntOpcode.h:
 195         * llint/LLIntThunks.cpp:
 196         (LLInt):
 197         * llint/LowLevelInterpreter.asm:
 198         * llint/LowLevelInterpreter.cpp:
 199         (LLInt):
 200         (JSC::LLInt::Ints2Double):
 201         (JSC):
 202         (JSC::CLoop::execute):
 203         * llint/LowLevelInterpreter.h:
 204         (JSC):
 205         * llint/LowLevelInterpreter32_64.asm:
 206         * llint/LowLevelInterpreter64.asm:
 207         * offlineasm/asm.rb:
 208         * offlineasm/backends.rb:
 209         * offlineasm/cloop.rb: Added.
 210         * offlineasm/instructions.rb:
 211         * runtime/Executable.h:
 212         (ExecutableBase):
 213         (JSC::ExecutableBase::hostCodeEntryFor):
 214         (JSC::ExecutableBase::jsCodeEntryFor):
 215         (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor):
 216         (JSC::ExecutableBase::catchRoutineFor):
 217         (NativeExecutable):
 218         * runtime/JSValue.h:
 219         (JSC):
 220         (LLInt):
 221         (JSValue):
 222         * runtime/JSValueInlineMethods.h:
 223         (JSC):
 224         (JSC::JSValue::JSValue):
 225         * runtime/Options.cpp:
 226         (JSC::Options::initialize):
 227
 228 2012-08-31  Mark Lam  <mark.lam@apple.com>
 229
 230         Refactor LLInt and supporting code in preparation for the C Loop backend.
 231         https://bugs.webkit.org/show_bug.cgi?id=95531.
 232
 233         Reviewed by Filip Pizlo.
 234
 235         * bytecode/GetByIdStatus.cpp:
 236         (JSC::GetByIdStatus::computeFromLLInt):
 237         * bytecode/PutByIdStatus.cpp:
 238         (JSC::PutByIdStatus::computeFromLLInt):
 239         * jit/JITExceptions.cpp:
 240         (JSC::genericThrow): Use ExecutableBase::catchRoutineFor() to fetch
 241             fetch the catch routine for a thrown exception.  This will allow
 242             us to redefine that for the C loop later, and still keep this
 243             code readable.
 244         * llint/LLIntOfflineAsmConfig.h: Moved ASM macros to
 245             LowLevelInterpreter.cpp which is the only place they are used. This
 246             will make it more convenient to redefine them for the C loop later.
 247         * llint/LLIntSlowPaths.cpp:
 248         (JSC::LLInt::setUpCall): Use ExecutableBase's hostCodeEntry()
 249             jsCodeEntryFor(), and jsCodeWithArityCheckEntryFor() for computing
 250             the entry points to functions being called.
 251         * llint/LLIntSlowPaths.h:
 252         (SlowPathReturnType):
 253         (JSC::LLInt::encodeResult):
 254         (LLInt):
 255         (JSC::LLInt::decodeResult): Added.  Needed by LLInt C Loop later.
 256         * llint/LowLevelInterpreter.asm:
 257         * llint/LowLevelInterpreter.cpp:
 258         * llint/LowLevelInterpreter32_64.asm:
 259         * llint/LowLevelInterpreter64.asm:
 260         * offlineasm/asm.rb: Disambiguate between opcodes and other labels.
 261         * offlineasm/config.rb:
 262         * runtime/Executable.h:
 263         (JSC::ExecutableBase::hostCodeEntryFor): Added.
 264         (ExecutableBase):
 265         (JSC::ExecutableBase::jsCodeEntryFor): Added.
 266         (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor): Added.
 267         (JSC::ExecutableBase::catchRoutineFor): Added.
 268         * runtime/JSValueInlineMethods.h:
 269         (JSC):
 270
 271 2012-08-30  Mark Lam  <mark.lam@apple.com>
 272
 273         Render unto #ifdef's that which belong to them.
 274         https://bugs.webkit.org/show_bug.cgi?id=95482.
 275
 276         Reviewed by Filip Pizlo.
 277
 278         Refining / disambiguating between #ifdefs and adding some. For
 279         example, ENABLE(JIT) is conflated with ENABLE(LLINT) in some places.
 280         Also, we need to add ENABLE(COMPUTED_GOTO_OPCODES) to indicate that we
 281         want interpreted opcodes to use COMPUTED GOTOs apart from ENABLE(LLINT)
 282         and ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER). Also cleaned up #ifdefs
 283         in certain places which were previously incorrect.
 284
 285         * bytecode/CodeBlock.cpp:
 286         (JSC):
 287         (JSC::CodeBlock::bytecodeOffset):
 288         * bytecode/CodeBlock.h:
 289         (CodeBlock):
 290         * bytecode/Opcode.h:
 291         (JSC::padOpcodeName):
 292         * config.h:
 293         * dfg/DFGOperations.cpp:
 294         * interpreter/AbstractPC.cpp:
 295         (JSC::AbstractPC::AbstractPC):
 296         * interpreter/CallFrame.h:
 297         (ExecState):
 298         * interpreter/Interpreter.cpp:
 299         (JSC::Interpreter::~Interpreter):
 300         (JSC::Interpreter::initialize):
 301         (JSC::Interpreter::isOpcode):
 302         (JSC::Interpreter::unwindCallFrame):
 303         (JSC::getLineNumberForCallFrame):
 304         (JSC::getCallerInfo):
 305         (JSC::Interpreter::execute):
 306         (JSC::Interpreter::executeCall):
 307         (JSC::Interpreter::executeConstruct):
 308         (JSC::Interpreter::privateExecute):
 309         * interpreter/Interpreter.h:
 310         (JSC::Interpreter::getOpcode):
 311         (JSC::Interpreter::getOpcodeID):
 312         (Interpreter):
 313         * jit/HostCallReturnValue.h:
 314         * jit/JITCode.h:
 315         (JITCode):
 316         * jit/JITExceptions.cpp:
 317         * jit/JITExceptions.h:
 318         * jit/JSInterfaceJIT.h:
 319         * llint/LLIntData.h:
 320         (JSC::LLInt::getOpcode):
 321         * llint/LLIntEntrypoints.cpp:
 322         (JSC::LLInt::getFunctionEntrypoint):
 323         (JSC::LLInt::getEvalEntrypoint):
 324         (JSC::LLInt::getProgramEntrypoint):
 325         * llint/LLIntOffsetsExtractor.cpp:
 326         (JSC::LLIntOffsetsExtractor::dummy):
 327         * llint/LLIntSlowPaths.cpp:
 328         (LLInt):
 329         * runtime/JSGlobalData.cpp:
 330         (JSC):
 331
 332 2012-08-23  Christophe Dumez  <christophe.dumez@intel.com>
 333
 334         Serialization of JavaScript values does not appear to respect new HTML5 Structured Clone semantics
 335         https://bugs.webkit.org/show_bug.cgi?id=65292
 336
 337         Reviewed by Oliver Hunt.
 338
 339         Add function to construct a StringObject from a JSValue.
 340         Similar functions already exist for NumberObject and
 341         BooleanObject for example.
 342
 343         Export several symbols so address linking errors in
 344         WebCore.
 345
 346         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 347         * runtime/BooleanObject.h:
 348         (BooleanObject):
 349         * runtime/NumberObject.h:
 350         (NumberObject):
 351         (JSC):
 352         * runtime/StringObject.cpp:
 353         (JSC::constructString):
 354         (JSC):
 355         * runtime/StringObject.h:
 356         (JSC):
 357
 358 2012-08-30  Mark Lam  <mark.lam@apple.com>
 359
 360         Fix broken classic intrpreter build.
 361         https://bugs.webkit.org/show_bug.cgi?id=95484.
 362
 363         Reviewed by Filip Pizlo.
 364
 365         * interpreter/Interpreter.cpp:
 366         (JSC::Interpreter::privateExecute):
 367
 368 2012-08-29  Mark Lam  <mark.lam@apple.com>
 369
 370         Refactoring LLInt::Data.
 371         https://bugs.webkit.org/show_bug.cgi?id=95316.
 372
 373         Reviewed by Geoff Garen.
 374
 375         This change allows its opcodeMap to be easily queried from any function
 376         without needing to go through a GlobalData object.  It also introduces
 377         the LLInt::getCodePtr() methods that will be used by the LLInt C loop
 378         later to redefine how llint symbols (opcodes and trampoline glue
 379         labels) get resolved.
 380
 381         * assembler/MacroAssemblerCodeRef.h:
 382         (MacroAssemblerCodePtr):
 383         (JSC::MacroAssemblerCodePtr::createLLIntCodePtr):
 384         (MacroAssemblerCodeRef):
 385         (JSC::MacroAssemblerCodeRef::createLLIntCodeRef):
 386         * bytecode/CodeBlock.cpp:
 387         (JSC::CodeBlock::adjustPCIfAtCallSite):
 388         (JSC::CodeBlock::bytecodeOffset):
 389         * bytecode/Opcode.h:
 390             Remove the 'const' to simplify things and avoid having to do
 391             additional casts and #ifdefs in many places.
 392         * bytecode/ResolveGlobalStatus.cpp:
 393         (JSC::computeForLLInt):
 394         * bytecompiler/BytecodeGenerator.cpp:
 395         (JSC::BytecodeGenerator::generate):
 396         * interpreter/Interpreter.cpp:
 397         (JSC::Interpreter::initialize):
 398         * interpreter/Interpreter.h:
 399         (Interpreter):
 400         * jit/JITExceptions.cpp:
 401         (JSC::genericThrow):
 402         * llint/LLIntData.cpp:
 403         (LLInt):
 404         (JSC::LLInt::initialize):
 405         * llint/LLIntData.h:
 406         (JSC):
 407         (LLInt):
 408         (Data):
 409         (JSC::LLInt::exceptionInstructions):
 410         (JSC::LLInt::opcodeMap):
 411         (JSC::LLInt::getOpcode):
 412         (JSC::LLInt::getCodePtr):
 413         (JSC::LLInt::Data::performAssertions):
 414         * llint/LLIntExceptions.cpp:
 415         (JSC::LLInt::returnToThrowForThrownException):
 416         (JSC::LLInt::returnToThrow):
 417         (JSC::LLInt::callToThrow):
 418         * llint/LLIntSlowPaths.cpp:
 419         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
 420         (JSC::LLInt::handleHostCall):
 421         * runtime/InitializeThreading.cpp:
 422         (JSC::initializeThreadingOnce): Initialize the singleton LLInt data.
 423         * runtime/JSGlobalData.cpp:
 424         (JSC::JSGlobalData::JSGlobalData):
 425         * runtime/JSGlobalData.h:
 426         (JSGlobalData): Removed the now unneeded LLInt::Data instance in
 427             JSGlobalData.
 428         * runtime/JSValue.h:
 429         (JSValue):
 430
 431 2012-08-24  Filip Pizlo  <fpizlo@apple.com>
 432
 433         Finally inlining should correctly track the catch context
 434         https://bugs.webkit.org/show_bug.cgi?id=94986
 435         <rdar://problem/11753784>
 436
 437         Reviewed by Sam Weinig.
 438
 439         This fixes two behaviors:
 440
 441         1) Throwing from a finally block. Previously, we would seem to reenter the finally
 442            block - though only once.
 443
 444         2) Executing a finally block from some nested context, for example due to a
 445            'continue', 'break', or 'return' in the try. This would execute the finally
 446            block in the context of of the try block, which could lead to either scope depth
 447            mismatches or reexecutions of the finally block on throw, similarly to (1) but
 448            for different reasons.
 449
 450         * bytecompiler/BytecodeGenerator.cpp:
 451         (JSC):
 452         (JSC::BytecodeGenerator::pushFinallyContext):
 453         (JSC::BytecodeGenerator::emitComplexJumpScopes):
 454         (JSC::BytecodeGenerator::pushTry):
 455         (JSC::BytecodeGenerator::popTryAndEmitCatch):
 456         * bytecompiler/BytecodeGenerator.h:
 457         (FinallyContext):
 458         (TryData):
 459         (JSC):
 460         (TryContext):
 461         (TryRange):
 462         (BytecodeGenerator):
 463         * bytecompiler/NodesCodegen.cpp:
 464         (JSC::TryNode::emitBytecode):
 465
 466 2012-08-28  Mark Lam  <mark.lam@apple.com>
 467
 468         Adding support for adding LLInt opcode extensions.  This will be needed
 469         by the LLInt C loop interpreter later.
 470         https://bugs.webkit.org/show_bug.cgi?id=95277.
 471
 472         Reviewed by Geoffrey Garen.
 473
 474         * JavaScriptCore.xcodeproj/project.pbxproj:
 475         * bytecode/Opcode.h:
 476         * llint/LLIntOpcode.h: Added.
 477         * llint/LowLevelInterpreter.h:
 478
 479 2012-08-28  Filip Pizlo  <fpizlo@apple.com>
 480
 481         LLInt should not rely on ordering of global labels
 482         https://bugs.webkit.org/show_bug.cgi?id=95221
 483
 484         Reviewed by Oliver Hunt.
 485
 486         * llint/LowLevelInterpreter.asm:
 487         * llint/LowLevelInterpreter32_64.asm:
 488         * llint/LowLevelInterpreter64.asm:
 489
 490 2012-08-20  Mark Lam  <mark.lam@apple.com>
 491
 492         Fix broken non-JIT build.
 493         https://bugs.webkit.org/show_bug.cgi?id=94564.
 494
 495         Reviewed by Filip Pizlo.
 496
 497         Added some UNUSED_PARAM() macros to make the compiler happy.
 498
 499         * runtime/Executable.cpp:
 500         (JSC::EvalExecutable::compileInternal):
 501         (JSC::ProgramExecutable::compileInternal):
 502         (JSC::FunctionExecutable::compileForCallInternal):
 503         (JSC::FunctionExecutable::compileForConstructInternal):
 504
 505 2012-08-20  Mark Lam  <mark.lam@apple.com>
 506
 507         Fixed erroneous line number for LLint frame when throwing exceptions.
 508         https://bugs.webkit.org/show_bug.cgi?id=94051.
 509
 510         Reviewed by Filip Pizlo.
 511
 512         For LLInt frames, before throwing an exception, adjust the PC from the
 513         return PC back to the call PC if we are indeed at a call site.
 514
 515         * bytecode/CodeBlock.cpp:
 516         (JSC::CodeBlock::adjustPCIfAtCallSite):
 517         (JSC):
 518         (JSC::CodeBlock::bytecodeOffset):
 519         * bytecode/CodeBlock.h:
 520         (CodeBlock):
 521         * llint/LLIntExceptions.cpp:
 522         (JSC::LLInt::fixupPCforExceptionIfNeeded):
 523         (LLInt):
 524         (JSC::LLInt::interpreterThrowInCaller):
 525         (JSC::LLInt::returnToThrow):
 526         (JSC::LLInt::callToThrow):
 527
 528 2012-08-03  Filip Pizlo  <fpizlo@apple.com>
 529
 530         Crashes in dfgBuildPutByIdList when clicking on just about anything on Google Maps
 531         https://bugs.webkit.org/show_bug.cgi?id=92691
 532
 533         Reviewed by Mark Hahnenberg.
 534
 535         The state of the stubs was changing after we determined the type (by virtue of the slow path
 536         function that was called), since the get or put (in this case put) could cause arbitrary
 537         side effects. Perhaps a full-blown fix would be to eliminate our reliance of the slow path
 538         function to determine what to do, but an easier fix for now is to have the slow path give up
 539         if its assumptions were invalidated by a side effect.
 540
 541         * dfg/DFGOperations.cpp:
 542         * jit/JITStubs.cpp:
 543         (JSC::DEFINE_STUB_FUNCTION):
 544
 545 2012-08-03  Filip Pizlo  <fpizlo@apple.com>
 546
 547         DFG handling of get_by_id should always inject a ForceOSRExit node if there is no prediction
 548         https://bugs.webkit.org/show_bug.cgi?id=93162
 549
 550         Reviewed by Mark Hahnenberg.
 551
 552         This simplifies the DFG IR by ensuring that all nodes that use value profiles will be preceded
 553         by a ForceOSRExit if the value profile had no data.
 554
 555         * dfg/DFGByteCodeParser.cpp:
 556         (JSC::DFG::ByteCodeParser::parseBlock):
 557
 558 2012-08-03  Filip Pizlo  <fpizlo@apple.com>
 559
 560         DFG::StructureCheckHoistingPhase keeps a Node& around for too long
 561         https://bugs.webkit.org/show_bug.cgi?id=93157
 562
 563         Reviewed by Mark Hahnenberg.
 564
 565         * dfg/DFGStructureCheckHoistingPhase.cpp:
 566         (JSC::DFG::StructureCheckHoistingPhase::run):
 567
 568 2012-08-02  Filip Pizlo  <fpizlo@apple.com>
 569
 570         ASSERTION FAILED: at(m_compileIndex).canExit() || m_isCheckingArgumentTypes
 571         https://bugs.webkit.org/show_bug.cgi?id=91074
 572
 573         Reviewed by Mark Hahnenberg.
 574
 575         Fixes a bug where the speculative JIT was performing an unnecessary speculation that the
 576         CFA had proven shouldn't be performed, leading to asserts that a node should not have
 577         exit sites. This is a debug-only assert with no release symptom - we were just emitting
 578         a check that was not reachable.
 579
 580         Also found, and fixed, a bug where structure check hoisting was slightly confusing the
 581         CFA by inserting GetLocal's into the graph. CSE would clean the GetLocal's up, which
 582         would make the backend happy - but the CFA would produce subtly wrong results.
 583
 584         * bytecode/SpeculatedType.h:
 585         (JSC::isOtherOrEmptySpeculation):
 586         (JSC):
 587         * dfg/DFGDriver.cpp:
 588         (JSC::DFG::compile):
 589         * dfg/DFGGraph.cpp:
 590         (JSC::DFG::Graph::dump):
 591         * dfg/DFGSpeculativeJIT64.cpp:
 592         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
 593         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
 594
 595 2012-08-02  Filip Pizlo  <fpizlo@apple.com>
 596
 597         Unreviewed, build fix for DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE).
 598
 599         * dfg/DFGStructureCheckHoistingPhase.cpp:
 600         (JSC::DFG::StructureCheckHoistingPhase::run):
 601
 602 2012-08-01  Mark Hahnenberg  <mhahnenberg@apple.com>
 603
 604         Remove all uses of ClassInfo for JSStrings in JIT code
 605         https://bugs.webkit.org/show_bug.cgi?id=92935
 606
 607         Reviewed by Geoffrey Garen.
 608
 609         This is the first step in removing our dependence on in-object ClassInfo pointers
 610         in JIT code. Most of the changes are to check the Structure, which is unique for
 611         JSString primitives.
 612
 613         * bytecode/SpeculatedType.cpp:
 614         (JSC::speculationFromClassInfo):
 615         (JSC::speculationFromStructure): Changed to check the TypeInfo in the Structure
 616         since there wasn't a JSGlobalData immediately available to grab the JSString
 617         Structure out of.
 618         * dfg/DFGSpeculativeJIT.cpp:
 619         (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
 620         * dfg/DFGSpeculativeJIT32_64.cpp:
 621         (JSC::DFG::SpeculativeJIT::compile):
 622         * dfg/DFGSpeculativeJIT64.cpp:
 623         (JSC::DFG::SpeculativeJIT::compile):
 624         * jit/JITInlineMethods.h:
 625         (JSC::JIT::emitLoadCharacterString):
 626         * jit/JITOpcodes.cpp:
 627         (JSC::JIT::privateCompileCTIMachineTrampolines):
 628         (JSC::JIT::emit_op_to_primitive):
 629         (JSC::JIT::emit_op_convert_this):
 630         * jit/JITOpcodes32_64.cpp:
 631         (JSC::JIT::privateCompileCTIMachineTrampolines):
 632         (JSC::JIT::emit_op_to_primitive):
 633         (JSC::JIT::emitSlow_op_eq):
 634         (JSC::JIT::emitSlow_op_neq):
 635         (JSC::JIT::compileOpStrictEq):
 636         (JSC::JIT::emit_op_convert_this):
 637         * jit/JITPropertyAccess.cpp:
 638         (JSC::JIT::stringGetByValStubGenerator):
 639         (JSC::JIT::emitSlow_op_get_by_val):
 640         * jit/JITPropertyAccess32_64.cpp:
 641         (JSC::JIT::stringGetByValStubGenerator):
 642         (JSC::JIT::emitSlow_op_get_by_val):
 643         * jit/SpecializedThunkJIT.h:
 644         (JSC::SpecializedThunkJIT::loadJSStringArgument):
 645         * jit/ThunkGenerators.cpp:
 646         (JSC::stringCharLoad):
 647         (JSC::charCodeAtThunkGenerator):
 648         (JSC::charAtThunkGenerator):
 649
 650 2012-08-02  Filip Pizlo  <fpizlo@apple.com>
 651
 652         Unreviewed, missed a style goof in the previous patch: "NodeIndex nodeIndex"
 653         in a method signature is painfully redundant.
 654
 655         * dfg/DFGSpeculativeJIT.h:
 656         (SpeculativeJIT):
 657
 658 2012-08-02  Filip Pizlo  <fpizlo@apple.com>
 659
 660         DFGSpeculativeJIT.h has too many inline method bodies
 661         https://bugs.webkit.org/show_bug.cgi?id=92957
 662
 663         Reviewed by Antti Koivisto.
 664
 665         * dfg/DFGSpeculativeJIT.cpp:
 666         (JSC::DFG::SpeculativeJIT::speculationCheck):
 667         (DFG):
 668         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
 669         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
 670         (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection):
 671         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
 672         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
 673         * dfg/DFGSpeculativeJIT.h:
 674         (SpeculativeJIT):
 675
 676 2012-08-01  Filip Pizlo  <fpizlo@apple.com>
 677
 678         DFG should hoist structure checks
 679         https://bugs.webkit.org/show_bug.cgi?id=92696
 680
 681         Reviewed by Gavin Barraclough.
 682
 683         This hoists structure checks in the same way that we would hoist array checks, but with added
 684         complexity to cope with the fact that the structure of an object may change. This is handled
 685         by performing a side effects analysis over the region in which the respective variable is
 686         live. If a structure clobbering side effect may happen then we either hoist the structure
 687         checks and fall back on structure transition watchpoints (if the watchpoint set is still
 688         valid), or we avoid hoisting altogether.
 689
 690         Doing this required teaching the CFA that we may have an expectation that an object has a
 691         particular structure even after structure clobbering happens, in the sense that structure
 692         proofs that were cobbered can be revived using watchpoints. CFA must know about this so that
 693         OSR entry may know about it, since we cannot allow entry to happen if the variable has a
 694         clobbered structure proof, will have a watchpoint to revive the proof, and the variable in
 695         the baseline JIT has a completely unrelated structure.
 696
 697         This is mostly performance neutral.
 698
 699         * CMakeLists.txt:
 700         * GNUmakefile.list.am:
 701         * JavaScriptCore.xcodeproj/project.pbxproj:
 702         * Target.pri:
 703         * bytecode/ValueRecovery.h:
 704         (JSC::ValueRecovery::isSet):
 705         (JSC::ValueRecovery::operator!):
 706         (ValueRecovery):
 707         * dfg/DFGAbstractState.cpp:
 708         (JSC::DFG::AbstractState::execute):
 709         (JSC::DFG::AbstractState::clobberWorld):
 710         (DFG):
 711         (JSC::DFG::AbstractState::clobberCapturedVars):
 712         * dfg/DFGAbstractState.h:
 713         (AbstractState):
 714         * dfg/DFGAbstractValue.h:
 715         (JSC::DFG::AbstractValue::clear):
 716         (JSC::DFG::AbstractValue::isClear):
 717         (JSC::DFG::AbstractValue::makeTop):
 718         (JSC::DFG::AbstractValue::isTop):
 719         (JSC::DFG::AbstractValue::set):
 720         (JSC::DFG::AbstractValue::operator==):
 721         (JSC::DFG::AbstractValue::merge):
 722         (JSC::DFG::AbstractValue::filter):
 723         (JSC::DFG::AbstractValue::validate):
 724         (JSC::DFG::AbstractValue::validateForEntry):
 725         (AbstractValue):
 726         (JSC::DFG::AbstractValue::checkConsistency):
 727         (JSC::DFG::AbstractValue::dump):
 728         * dfg/DFGByteCodeParser.cpp:
 729         (JSC::DFG::ByteCodeParser::setLocal):
 730         (JSC::DFG::ByteCodeParser::getArgument):
 731         (JSC::DFG::ByteCodeParser::setArgument):
 732         (JSC::DFG::ByteCodeParser::parseBlock):
 733         (JSC::DFG::ByteCodeParser::fixVariableAccessSpeculations):
 734         * dfg/DFGCSEPhase.cpp:
 735         (JSC::DFG::CSEPhase::checkStructureLoadElimination):
 736         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
 737         (JSC::DFG::CSEPhase::putStructureStoreElimination):
 738         (JSC::DFG::CSEPhase::getLocalLoadElimination):
 739         (JSC::DFG::CSEPhase::performNodeCSE):
 740         * dfg/DFGDriver.cpp:
 741         (JSC::DFG::compile):
 742         * dfg/DFGGraph.cpp:
 743         (JSC::DFG::Graph::dump):
 744         * dfg/DFGGraph.h:
 745         (JSC::DFG::Graph::vote):
 746         (Graph):
 747         * dfg/DFGNode.h:
 748         (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
 749         (Node):
 750         (JSC::DFG::Node::hasStructureSet):
 751         * dfg/DFGNodeType.h:
 752         (DFG):
 753         * dfg/DFGOSREntry.cpp:
 754         (JSC::DFG::prepareOSREntry):
 755         * dfg/DFGPredictionPropagationPhase.cpp:
 756         (JSC::DFG::PredictionPropagationPhase::propagate):
 757         (PredictionPropagationPhase):
 758         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
 759         * dfg/DFGSpeculativeJIT.h:
 760         (SpeculativeJIT):
 761         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
 762         (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection):
 763         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
 764         (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
 765         (JSC::DFG::SpeculateCellOperand::gpr):
 766         (SpeculateCellOperand):
 767         * dfg/DFGSpeculativeJIT32_64.cpp:
 768         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
 769         (JSC::DFG::SpeculativeJIT::compile):
 770         * dfg/DFGSpeculativeJIT64.cpp:
 771         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
 772         (JSC::DFG::SpeculativeJIT::compile):
 773         * dfg/DFGStructureCheckHoistingPhase.cpp: Added.
 774         (DFG):
 775         (StructureCheckHoistingPhase):
 776         (JSC::DFG::StructureCheckHoistingPhase::StructureCheckHoistingPhase):
 777         (JSC::DFG::StructureCheckHoistingPhase::run):
 778         (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
 779         (JSC::DFG::StructureCheckHoistingPhase::noticeClobber):
 780         (JSC::DFG::StructureCheckHoistingPhase::clobber):
 781         (CheckData):
 782         (JSC::DFG::StructureCheckHoistingPhase::CheckData::CheckData):
 783         (JSC::DFG::performStructureCheckHoisting):
 784         * dfg/DFGStructureCheckHoistingPhase.h: Added.
 785         (DFG):
 786         * dfg/DFGVariableAccessData.h:
 787         (VariableAccessData):
 788         (JSC::DFG::VariableAccessData::VariableAccessData):
 789         (JSC::DFG::VariableAccessData::mergeStructureCheckHoistingFailed):
 790         (JSC::DFG::VariableAccessData::structureCheckHoistingFailed):
 791         (JSC::DFG::VariableAccessData::clearVotes):
 792         (JSC::DFG::VariableAccessData::vote):
 793         (JSC::DFG::VariableAccessData::voteRatio):
 794         (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
 795         * runtime/Options.h:
 796         (JSC):
 797
 798 2012-08-01  Filip Pizlo  <fpizlo@apple.com>
 799
 800         DFG should distinguish between PutByVal's that clobber the world and ones that don't
 801         https://bugs.webkit.org/show_bug.cgi?id=92923
 802
 803         Reviewed by Mark Hahnenberg.
 804
 805         This is performance-neutral. I also confirmed that it's neutral if we make the
 806         clobbering variant (PutByValSafe) clobber all knowledge of what is an array,
 807         which should feed nicely into work on removing uses of ClassInfo.
 808
 809         * bytecode/DFGExitProfile.h:
 810         * dfg/DFGAbstractState.cpp:
 811         (JSC::DFG::AbstractState::execute):
 812         * dfg/DFGByteCodeParser.cpp:
 813         (JSC::DFG::ByteCodeParser::parseBlock):
 814         * dfg/DFGCSEPhase.cpp:
 815         (JSC::DFG::CSEPhase::getByValLoadElimination):
 816         (JSC::DFG::CSEPhase::checkStructureLoadElimination):
 817         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
 818         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
 819         (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
 820         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
 821         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
 822         (JSC::DFG::CSEPhase::performNodeCSE):
 823         * dfg/DFGFixupPhase.cpp:
 824         (JSC::DFG::FixupPhase::fixupNode):
 825         * dfg/DFGGraph.h:
 826         (JSC::DFG::Graph::byValIsPure):
 827         (JSC::DFG::Graph::clobbersWorld):
 828         * dfg/DFGNodeType.h:
 829         (DFG):
 830         * dfg/DFGPredictionPropagationPhase.cpp:
 831         (JSC::DFG::PredictionPropagationPhase::propagate):
 832         * dfg/DFGSpeculativeJIT32_64.cpp:
 833         (JSC::DFG::SpeculativeJIT::compile):
 834         * dfg/DFGSpeculativeJIT64.cpp:
 835         (JSC::DFG::SpeculativeJIT::compile):
 836
 837 2012-08-01  Mark Hahnenberg  <mhahnenberg@apple.com>
 838
 839         C++ code should get ClassInfo from the Structure
 840         https://bugs.webkit.org/show_bug.cgi?id=92892
 841
 842         Reviewed by Geoffrey Garen.
 843
 844         In our march to remove ClassInfo from our JSCell object headers, we can switch
 845         C++ code over to grabbing the ClassInfo from the Structure since it is finally
 846         safe to do so now that Structure access is safe during finalization/destruction.
 847         The remaining JIT code changes can be done in a separate patch.
 848
 849         * heap/MarkedBlock.cpp:
 850         (JSC::MarkedBlock::callDestructor): We don't want to clear the Structure any more
 851         since the Structure should still be valid at this point.
 852         * heap/WeakSetInlines.h:
 853         (JSC::WeakBlock::finalize): Ditto.
 854         * runtime/JSCell.h:
 855         (JSC):
 856         * runtime/Structure.h:
 857         (JSC::JSCell::classInfo): Move JSCell's classInfo() to Structure.h so it can be
 858         inline. Use a different method of getting the JSCell's Structure based on
 859         whether we're in GC_VALIDATION mode or not, since always using get() will cause
 860         infinite recursion in GC_VALIDATION mode.
 861         (JSC):
 862
 863 2012-07-31  Mark Hahnenberg  <mhahnenberg@apple.com>
 864
 865         MarkedBlock::sweep() should sweep another block if it can't sweep a Structure block
 866         https://bugs.webkit.org/show_bug.cgi?id=92819
 867
 868         Reviewed by Geoffrey Garen.
 869
 870         If we are forced to allocate a new block for Structures because we are unable to safely
 871         sweep our pre-existing Structure blocks, we should sweep another random block so that we
 872         can start sweeping Structure blocks sooner.
 873
 874         * heap/IncrementalSweeper.cpp:
 875         (JSC::IncrementalSweeper::doSweep): Change to use sweepNextBlock.
 876         (JSC):
 877         (JSC::IncrementalSweeper::sweepNextBlock):
 878         * heap/IncrementalSweeper.h:
 879         (IncrementalSweeper):
 880         * heap/MarkedAllocator.cpp:
 881         (JSC::MarkedAllocator::tryAllocateHelper): When we can't safely sweep
 882         our Structure blocks, call sweepNextBlock instead.
 883
 884 2012-07-31  Sam Weinig  <sam@webkit.org>
 885
 886         Fix the Windows build.
 887
 888         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 889
 890 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 891
 892         Maybe fix the GCC build.
 893
 894         * heap/HeapBlock.h:
 895         (HeapBlock): Accommodate incorrect parsing in GCC.
 896
 897 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 898
 899         Maybe break the Windows build.
 900
 901         Reviewed by Anders Carlsson.
 902
 903         Formally objected to by Sam Weinig.
 904
 905         * heap/HeapBlock.h:
 906         (HeapBlock): Try to slightly improve this because we don't want Windows to control our lives.
 907
 908 2012-07-30  Mark Hahnenberg  <mhahnenberg@apple.com>
 909
 910         Structures should be swept after all other objects
 911         https://bugs.webkit.org/show_bug.cgi?id=92679
 912
 913         Reviewed by Filip Pizlo.
 914
 915         In order to get rid of ClassInfo from our objects, we need to be able to safely get the
 916         ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the
 917         Structure, but currently it is not safe to do so because the order of destruction of objects
 918         is not guaranteed to sweep objects before their corresponding Structure. We can fix this by
 919         sweeping Structures after everything else.
 920
 921         * heap/Heap.cpp:
 922         (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures.
 923         If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is
 924         safe to sweep structures since we'll always do Structures last anyways due to the ordering of
 925         MarkedSpace::forEachBlock.
 926         (JSC):
 927         (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now
 928         calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out
 929         these pointers after it has invalidated them to prevent accidental use-after-free in the sweep()
 930         calls during lastChanceToFinalize().
 931         * heap/Heap.h:
 932         (Heap):
 933         * heap/HeapTimer.h:
 934         (HeapTimer):
 935         * heap/IncrementalSweeper.cpp:
 936         (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures.
 937         This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping
 938         the first time.
 939         (JSC):
 940         (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we
 941         make our first pass. We now null out the slots as we sweep them so that we can quickly find the
 942         Structures during the second pass.
 943         (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index.
 944         (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify
 945         the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can
 946         assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock
 947         iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds.
 948         (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index.
 949         * heap/IncrementalSweeper.h: Add declarations for new stuff.
 950         (IncrementalSweeper):
 951         * heap/MarkedAllocator.cpp:
 952         (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and
 953         if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing
 954         the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that
 955         will sweep some number of other blocks in place of the current block to mitigate the cost of the floating
 956         Structure garbage.
 957         (JSC::MarkedAllocator::addBlock):
 958         * heap/MarkedAllocator.h:
 959         (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no
 960         longer valid to allocate from, so we set the current block to null.
 961         * heap/MarkedBlock.cpp:
 962         (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures
 963         at an unsafe time.
 964         * heap/MarkedSpace.cpp:
 965         (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping.
 966         (JSC):
 967         * heap/MarkedSpace.h:
 968         (JSC):
 969         * runtime/JSGlobalData.cpp:
 970         (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown.
 971
 972 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 973
 974         Fix all the other builds I just broke. Maybe fix the Windows build.
 975
 976         * heap/HeapBlock.h:
 977         (HeapBlock): WTF?
 978
 979 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 980
 981         Maybe fix the Windows build.
 982
 983         * heap/HeapBlock.h:
 984         (HeapBlock): WTF?
 985
 986 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 987
 988         Maybe fix the Windows build.
 989
 990         * heap/HeapBlock.h:
 991         (HeapBlock): WTF?
 992
 993 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 994
 995         Removed some public data and casting from the Heap
 996         https://bugs.webkit.org/show_bug.cgi?id=92777
 997
 998         Reviewed by Oliver Hunt.
 999
1000         * heap/BlockAllocator.cpp:
1001         (JSC::BlockAllocator::releaseFreeBlocks):
1002         (JSC::BlockAllocator::blockFreeingThreadMain): Use the DeadBlock class
1003         since HeapBlock is a template, and not a class, now. Call destroy()
1004         instead of monkeying around with DeadBlock's internal data because
1005         encapsulation is good.
1006
1007         * heap/BlockAllocator.h:
1008         (DeadBlock): Added a class to represent a dead block, since HeapBlock is
1009         a template now, and can't be instantiated directly.
1010
1011         (JSC::DeadBlock::DeadBlock):
1012         (JSC::DeadBlock::create):
1013         (BlockAllocator):
1014         (JSC::BlockAllocator::allocate):
1015         (JSC::BlockAllocator::deallocate): Use the DeadBlock class because
1016         encapsulation is good.
1017
1018         * heap/CopiedBlock.h:
1019         (CopiedBlock::destroy): No need for a destroy() function, since we
1020         inherit one now.
1021
1022         (JSC::CopiedBlock::CopiedBlock):
1023         (JSC::CopiedBlock::payloadEnd):
1024         (JSC::CopiedBlock::capacity): Updated for some encapsulation inside
1025         HeapBlock.
1026
1027         * heap/CopiedSpace.cpp:
1028         (JSC::CopiedSpace::~CopiedSpace):
1029         (JSC::CopiedSpace::doneCopying):
1030         (JSC::CopiedSpace::size):
1031         (JSC::CopiedSpace::capacity):
1032         (JSC::isBlockListPagedOut): Removed a bunch of casting. This is no longer
1033         necessary, now that our list and its nodes have the right type.
1034
1035         * heap/CopiedSpace.h: Use the right type in our data structures because
1036         it improves clarity.
1037
1038         * heap/CopiedSpaceInlineMethods.h:
1039         (JSC::CopiedSpace::startedCopying): Use swap to avoid duplicating it.
1040
1041         * heap/HeapBlock.h:
1042         (HeapBlock): Made this a class template so we can return the right type
1043         in linked list operations. Made our data private because encapsulation
1044         is good.
1045
1046         (JSC::HeapBlock::destroy): Since we know our type, we can also eliminate
1047         duplicate destroy() functions in our subclasses.
1048
1049         (JSC::HeapBlock::allocation): Added an accessor so we can hide our data.
1050         By using const, this accessor prevents clients from accidentally deleting
1051         our allocation.
1052
1053         * heap/MarkedAllocator.cpp:
1054         (JSC::MarkedAllocator::isPagedOut):
1055         (JSC::MarkedAllocator::tryAllocateHelper):
1056         (JSC::MarkedAllocator::removeBlock): Removed a bunch of casting. This is
1057         no longer necessary, now that our list and its nodes have the right type.
1058
1059         * heap/MarkedAllocator.h:
1060         (MarkedAllocator):
1061         (JSC::MarkedAllocator::reset):
1062         (JSC::MarkedAllocator::forEachBlock): Use the right type, do less casting.
1063
1064         * heap/MarkedBlock.cpp:
1065         (JSC::MarkedBlock::destroy): Removed this function because our parent
1066         class provides it for us now.
1067
1068         (JSC::MarkedBlock::MarkedBlock):
1069         * heap/MarkedBlock.h:
1070         (MarkedBlock):
1071         (JSC::MarkedBlock::capacity): Updated for encapsulation.
1072
1073 2012-07-31  Filip Pizlo  <fpizlo@apple.com>
1074
1075         DFG OSR exit profiling has unusual oversights
1076         https://bugs.webkit.org/show_bug.cgi?id=92728
1077
1078         Reviewed by Geoffrey Garen.
1079
1080         * dfg/DFGOSRExit.cpp:
1081         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
1082         * dfg/DFGSpeculativeJIT.h:
1083         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
1084         * dfg/DFGSpeculativeJIT32_64.cpp:
1085         (JSC::DFG::SpeculativeJIT::compile):
1086         * dfg/DFGSpeculativeJIT64.cpp:
1087         (JSC::DFG::SpeculativeJIT::compile):
1088
1089 2012-07-31  Chao-ying Fu  <fu@mips.com>
1090
1091         Add MIPS add32 function
1092         https://bugs.webkit.org/show_bug.cgi?id=91522
1093
1094         Reviewed by Oliver Hunt.
1095
1096         Add isCompactPtrAlignedAddressOffset.
1097         Add a new version of add32 that accepts AbsoluteAddress as inputs.
1098
1099         * assembler/MacroAssemblerMIPS.h:
1100         (JSC::MacroAssemblerMIPS::isCompactPtrAlignedAddressOffset): New.
1101         (MacroAssemblerMIPS):
1102         (JSC::MacroAssemblerMIPS::add32): Support AbsoluteAddress as inputs.
1103
1104 2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
1105
1106         Unreviewed, rolling out r124123.
1107         http://trac.webkit.org/changeset/124123
1108         https://bugs.webkit.org/show_bug.cgi?id=92700
1109
1110         ASSERT crashes terminate webkit Layout tests (Requested by
1111         msaboff on #webkit).
1112
1113         * heap/Heap.cpp:
1114         * heap/Heap.h:
1115         (Heap):
1116         * heap/IncrementalSweeper.cpp:
1117         (JSC::IncrementalSweeper::doSweep):
1118         (JSC::IncrementalSweeper::startSweeping):
1119         (JSC::IncrementalSweeper::IncrementalSweeper):
1120         (JSC):
1121         * heap/IncrementalSweeper.h:
1122         (IncrementalSweeper):
1123         * heap/MarkedAllocator.cpp:
1124         (JSC::MarkedAllocator::tryAllocateHelper):
1125         (JSC::MarkedAllocator::addBlock):
1126         * heap/MarkedAllocator.h:
1127         (JSC::MarkedAllocator::zapFreeList):
1128         * heap/MarkedBlock.cpp:
1129         (JSC::MarkedBlock::sweepHelper):
1130         * heap/MarkedSpace.cpp:
1131         * heap/MarkedSpace.h:
1132         (JSC::MarkedSpace::sweep):
1133         (JSC):
1134         * runtime/JSGlobalData.cpp:
1135         (JSC::JSGlobalData::~JSGlobalData):
1136
1137 2012-07-30  Mark Hahnenberg  <mhahnenberg@apple.com>
1138
1139         Structures should be swept after all other objects
1140         https://bugs.webkit.org/show_bug.cgi?id=92679
1141
1142         Reviewed by Filip Pizlo.
1143
1144         In order to get rid of ClassInfo from our objects, we need to be able to safely get the
1145         ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the
1146         Structure, but currently it is not safe to do so because the order of destruction of objects
1147         is not guaranteed to sweep objects before their corresponding Structure. We can fix this by
1148         sweeping Structures after everything else.
1149
1150         * heap/Heap.cpp:
1151         (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures.
1152         If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is
1153         safe to sweep structures since we'll always do Structures last anyways due to the ordering of
1154         MarkedSpace::forEachBlock.
1155         (JSC):
1156         (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now
1157         calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out
1158         these pointers after it has invalidated them to prevent accidental use-after-free in the sweep()
1159         calls during lastChanceToFinalize().
1160         * heap/Heap.h:
1161         (Heap):
1162         * heap/HeapTimer.h:
1163         (HeapTimer):
1164         * heap/IncrementalSweeper.cpp:
1165         (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures.
1166         This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping
1167         the first time.
1168         (JSC):
1169         (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we
1170         make our first pass. We now null out the slots as we sweep them so that we can quickly find the
1171         Structures during the second pass.
1172         (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index.
1173         (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify
1174         the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can
1175         assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock
1176         iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds.
1177         (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index.
1178         * heap/IncrementalSweeper.h: Add declarations for new stuff.
1179         (IncrementalSweeper):
1180         * heap/MarkedAllocator.cpp:
1181         (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and
1182         if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing
1183         the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that
1184         will sweep some number of other blocks in place of the current block to mitigate the cost of the floating
1185         Structure garbage.
1186         (JSC::MarkedAllocator::addBlock):
1187         * heap/MarkedAllocator.h:
1188         (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no
1189         longer valid to allocate from, so we set the current block to null.
1190         * heap/MarkedBlock.cpp:
1191         (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures
1192         at an unsafe time.
1193         * heap/MarkedSpace.cpp:
1194         (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping.
1195         (JSC):
1196         * heap/MarkedSpace.h:
1197         (JSC):
1198         * runtime/JSGlobalData.cpp:
1199         (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown.
1200
1201 2012-07-29  Filip Pizlo  <fpizlo@apple.com>
1202
1203         PropertyNameArray::m_shouldCache is only assigned and never used
1204         https://bugs.webkit.org/show_bug.cgi?id=92598
1205
1206         Reviewed by Dan Bernstein.
1207
1208         * runtime/PropertyNameArray.h:
1209         (JSC::PropertyNameArray::PropertyNameArray):
1210         (PropertyNameArray):
1211
1212 2012-07-29  Rik Cabanier  <cabanier@adobe.com>
1213
1214         Add ENABLE_CSS_COMPOSITING flag
1215         https://bugs.webkit.org/show_bug.cgi?id=92553
1216
1217         Reviewed by Dirk Schulze.
1218
1219         Adds compiler flag CSS_COMPOSITING to build systems to enable CSS blending and compositing. See spec https://dvcs.w3.org/hg/FXTF/rawfile/tip/compositing/index.html
1220
1221         * Configurations/FeatureDefines.xcconfig:
1222
1223 2012-07-27  Mark Hahnenberg  <mhahnenberg@apple.com>
1224
1225         Split functionality of MarkedAllocator::m_currentBlock
1226         https://bugs.webkit.org/show_bug.cgi?id=92550
1227
1228         Reviewed by Filip Pizlo.
1229
1230         MarkedAllocator::m_currentBlock serves two purposes right now; it indicates the block that is currently
1231         being used for allocation and the beginning of the list of blocks that need to be swept. We should split
1232         these two functionalities into two separate fields.
1233
1234         * heap/MarkedAllocator.cpp:
1235         (JSC::MarkedAllocator::tryAllocateHelper): Use m_blocksToSweep instead of m_currentBlock as the
1236         initializer/reference of the loop. Only change m_currentBlock when we know what the result will be.
1237         (JSC::MarkedAllocator::addBlock): When we add a new block we know that both m_blocksToSweep and
1238         m_currentBlock are null. In order to preserve the invariant that m_currentBlock <= m_blocksToSweep,
1239         we assign both of them to point to the new block.
1240         (JSC::MarkedAllocator::removeBlock): We need a separate check to see if the block we're removing is
1241         m_blocksToSweep and if so, advance it to the next block in the list.
1242         * heap/MarkedAllocator.h:
1243         (MarkedAllocator): Initialize m_blocksToSweep.
1244         (JSC::MarkedAllocator::MarkedAllocator):
1245         (JSC::MarkedAllocator::reset): We set m_blocksToSweep to be the head of our list. This function is called
1246         at the end of a collection, so all of the blocks in our allocator need to be swept. We need to sweep a
1247         block before we can start allocating, so m_currentBlock is set to null. We also set the freeList to
1248         the empty FreeList to emphasize the fact that we can't start allocating until we do some sweeping.
1249
1250 2012-07-27  Mark Hahnenberg  <mhahnenberg@apple.com>
1251
1252         Increase inline storage for JSFinalObjects by one
1253         https://bugs.webkit.org/show_bug.cgi?id=92526
1254
1255         Reviewed by Geoffrey Garen.
1256
1257         Now that we've removed the inheritorID from objects, we can increase our inline storage for JSFinalObjects on
1258         64-bit platforms by 1.
1259
1260         * llint/LowLevelInterpreter.asm: Change the constant.
1261         * runtime/PropertyOffset.h: Change the constant.
1262         (JSC):
1263
1264 2012-07-27  Jer Noble  <jer.noble@apple.com>
1265
1266         Support a rational time class for use by media elements.
1267         https://bugs.webkit.org/show_bug.cgi?id=88787
1268
1269         Re-export WTF::MediaTime from JavaScriptCore.
1270
1271         Reviewed by Eric Carlson.
1272
1273         * JavaScriptCore.order:
1274         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1275
1276 2012-07-26  Filip Pizlo  <fpizlo@apple.com>
1277
1278         JSObject::reallocateStorageIfNecessary is neither used nor defined
1279         https://bugs.webkit.org/show_bug.cgi?id=92417
1280
1281         Reviewed by Mark Rowe.
1282
1283         * runtime/JSObject.h:
1284         (JSObject):
1285
1286 2012-07-26  Mark Hahnenberg  <mhahnenberg@apple.com>
1287
1288         Allocate Structures in a separate part of the Heap
1289         https://bugs.webkit.org/show_bug.cgi?id=92420
1290
1291         Reviewed by Filip Pizlo.
1292
1293         To fix our issue with destruction/finalization of Structures before their objects, we can move Structures to a separate
1294         part of the Heap that will be swept after all other objects. This first patch will just be separating Structures
1295         out into their own separate MarkedAllocator. Everything else will behave identically.
1296
1297         * heap/Heap.h: New function to allocate Structures in the Heap.
1298         (Heap):
1299         (JSC):
1300         (JSC::Heap::allocateStructure):
1301         * heap/MarkedAllocator.cpp: Pass whether or not we're allocated Structures to the MarkedBlock.
1302         (JSC::MarkedAllocator::allocateBlock):
1303         * heap/MarkedAllocator.h: Add tracking for whether or not we're allocating only Structures.
1304         (JSC::MarkedAllocator::onlyContainsStructures):
1305         (MarkedAllocator):
1306         (JSC::MarkedAllocator::MarkedAllocator):
1307         (JSC::MarkedAllocator::init):
1308         * heap/MarkedBlock.cpp: Add tracking for whether or not we're allocating only Structures. We need this to be able to
1309         distinguish the various MarkedBlock types in MarkedSpace::allocatorFor(MarkedBlock*).
1310         (JSC::MarkedBlock::create):
1311         (JSC::MarkedBlock::MarkedBlock):
1312         * heap/MarkedBlock.h:
1313         (MarkedBlock):
1314         (JSC::MarkedBlock::onlyContainsStructures):
1315         (JSC):
1316         * heap/MarkedSpace.cpp: Include the new Structure allocator in all the places that all the other allocators are used/modified.
1317         (JSC::MarkedSpace::MarkedSpace):
1318         (JSC::MarkedSpace::resetAllocators):
1319         (JSC::MarkedSpace::canonicalizeCellLivenessData):
1320         (JSC::MarkedSpace::isPagedOut):
1321         * heap/MarkedSpace.h: Add new MarkedAllocator just for Structures.
1322         (MarkedSpace):
1323         (JSC::MarkedSpace::allocatorFor):
1324         (JSC::MarkedSpace::allocateStructure):
1325         (JSC):
1326         (JSC::MarkedSpace::forEachBlock):
1327         * runtime/Structure.h: Move all of the functions that call allocateCell<Structure> down below the explicit template specialization
1328         for allocateCell<Structure>. The new inline specialization for allocateCell directly calls the allocateStructure() function in the
1329         Heap.
1330         (Structure):
1331         (JSC::Structure):
1332         (JSC):
1333         (JSC::Structure::create):
1334         (JSC::Structure::createStructure):
1335
1336 2012-07-26  Filip Pizlo  <fpizlo@apple.com>
1337
1338         JSArray has methods that are neither used nor defined
1339         https://bugs.webkit.org/show_bug.cgi?id=92416
1340
1341         Reviewed by Simon Fraser.
1342
1343         * runtime/JSArray.h:
1344         (JSArray):
1345
1346 2012-07-26  Zoltan Herczeg  <zherczeg@webkit.org>
1347
1348         [Qt][ARM]ARMAssembler needs buildfix afert r123417
1349         https://bugs.webkit.org/show_bug.cgi?id=92086
1350
1351         Reviewed by Csaba Osztrogonác.
1352
1353         The ARM implementation of this should be optimized code path
1354         is covered by a non-optimized code path. This patch fixes this,
1355         and adds a new function which returns with the offset range.
1356
1357         * assembler/ARMAssembler.h:
1358         (JSC::ARMAssembler::readPointer):
1359         (ARMAssembler):
1360         (JSC::ARMAssembler::repatchInt32):
1361         (JSC::ARMAssembler::repatchCompact):
1362         * assembler/MacroAssemblerARM.h:
1363         (MacroAssemblerARM):
1364         (JSC::MacroAssemblerARM::isCompactPtrAlignedAddressOffset):
1365         (JSC::MacroAssemblerARM::load32WithCompactAddressOffsetPatch):
1366
1367 2012-07-25  Mark Hahnenberg  <mhahnenberg@apple.com>
1368
1369         Build fix for 32-bit after r123682
1370
1371         * runtime/JSObject.h: Need to pad out JSObjects on 32-bit so that they're the correct size since
1372         we only removed one 4-byte word and we need to be 8-byte aligned.
1373         (JSObject):
1374
1375 2012-07-25  Filip Pizlo  <fpizlo@apple.com>
1376
1377         JSC GC object copying APIs should allow for greater flexibility
1378         https://bugs.webkit.org/show_bug.cgi?id=92316
1379
1380         Reviewed by Mark Hahnenberg.
1381
1382         It's now the case that visitChildren() methods can directly pin and allocate in new space during copying.
1383         They can also do the copying and marking themselves. This new API is only used for JSObjects for now.
1384
1385         * JavaScriptCore.xcodeproj/project.pbxproj:
1386         * heap/MarkStack.cpp:
1387         (JSC::SlotVisitor::allocateNewSpaceSlow):
1388         (JSC::SlotVisitor::allocateNewSpaceOrPin):
1389         (JSC):
1390         (JSC::SlotVisitor::copyAndAppend):
1391         * heap/MarkStack.h:
1392         (MarkStack):
1393         (JSC::MarkStack::appendUnbarrieredValue):
1394         (JSC):
1395         * heap/SlotVisitor.h:
1396         * heap/SlotVisitorInlineMethods.h: Added.
1397         (JSC):
1398         (JSC::SlotVisitor::checkIfShouldCopyAndPinOtherwise):
1399         (JSC::SlotVisitor::allocateNewSpace):
1400         * runtime/JSObject.cpp:
1401         (JSC::JSObject::visitOutOfLineStorage):
1402         (JSC):
1403         (JSC::JSObject::visitChildren):
1404         (JSC::JSFinalObject::visitChildren):
1405         * runtime/JSObject.h:
1406         (JSObject):
1407
1408 2012-07-25  Mark Hahnenberg  <mhahnenberg@apple.com>
1409
1410         Remove JSObject::m_inheritorID
1411         https://bugs.webkit.org/show_bug.cgi?id=88378
1412
1413         Reviewed by Filip Pizlo.
1414
1415         This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
1416         and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
1417         Instead use a private named value in the object's property storage.
1418
1419         * dfg/DFGSpeculativeJIT.h:
1420         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): No need m_inheritorID to initialize!
1421         * jit/JITInlineMethods.h:
1422         (JSC::JIT::emitAllocateBasicJSObject): No need m_inheritorID to initialize!
1423         * llint/LowLevelInterpreter.asm: No need m_inheritorID to initialize!
1424         * runtime/JSGlobalData.h:
1425         (JSGlobalData): Added private name 'm_inheritorIDKey'.
1426         * runtime/JSGlobalThis.cpp:
1427         (JSC::JSGlobalThis::setUnwrappedObject): resetInheritorID is now passed a JSGlobalData&.
1428         * runtime/JSObject.cpp:
1429         (JSC::JSObject::visitChildren): No m_inheritorID to be marked.
1430         (JSC::JSFinalObject::visitChildren): No m_inheritorID to be marked.
1431         (JSC::JSObject::createInheritorID): Store the newly created inheritorID in the property map. Make sure
1432         it's got the DontEnum attribute!!
1433         * runtime/JSObject.h:
1434         (JSObject):
1435         (JSC::JSObject::resetInheritorID): Remove the inheritorID from property storage.
1436         (JSC):
1437         (JSC::JSObject::inheritorID): Read the inheritorID from property storage.
1438
1439 2012-07-25  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
1440
1441         Create a specialized pair for use in HashMap iterators
1442         https://bugs.webkit.org/show_bug.cgi?id=92137
1443
1444         Reviewed by Ryosuke Niwa.
1445
1446         Update a couple of sites that relied on the fact that "contents" of iterators were
1447         std::pairs.
1448
1449         * profiler/Profile.cpp:
1450         (JSC): This code kept a vector of the pairs that were the "contents" of the iterators. This
1451         is changed to use a KeyValuePair. We make use HashCount's ValueType (which represents only
1452         the key) to get the proper key parameter for KeyValuePair.
1453         * tools/ProfileTreeNode.h:
1454         (ProfileTreeNode): Use HashMap::ValueType to declare the type of the contents of the hash
1455         instead of declaring it manually. This will make use of the new KeyValuePair.
1456
1457 2012-07-25  Patrick Gansterer  <paroga@webkit.org>
1458
1459         REGRESSION(r123505): Date.getYear() returns the same as Date.getFullYear()
1460         https://bugs.webkit.org/show_bug.cgi?id=92218
1461
1462         Reviewed by Csaba Osztrogonác.
1463
1464         * runtime/DatePrototype.cpp:
1465         (JSC::dateProtoFuncGetYear): Added the missing offset of 1900 to the return value.
1466
1467 2012-07-24  Filip Pizlo  <fpizlo@apple.com>
1468
1469         REGRESSION(r123417): It made tests assert/crash on 32 bit
1470         https://bugs.webkit.org/show_bug.cgi?id=92088
1471
1472         Reviewed by Mark Hahnenberg.
1473
1474         The pointer arithmetic was wrong, because negative numbers are hard to think about.
1475
1476         * dfg/DFGRepatch.cpp:
1477         (JSC::DFG::emitPutTransitionStub):
1478         * dfg/DFGSpeculativeJIT.cpp:
1479         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
1480
1481 2012-07-24  Patrick Gansterer  <paroga@webkit.org>
1482
1483         Store the full year in GregorianDateTime
1484         https://bugs.webkit.org/show_bug.cgi?id=92067
1485
1486         Reviewed by Geoffrey Garen.
1487
1488         Use the full year instead of the offset from year 1900
1489         for the year member variable of GregorianDateTime.
1490
1491         * runtime/DateConstructor.cpp:
1492         (JSC::constructDate):
1493         (JSC::dateUTC):
1494         * runtime/DateConversion.cpp:
1495         (JSC::formatDate):
1496         (JSC::formatDateUTCVariant):
1497         * runtime/DatePrototype.cpp:
1498         (JSC::formatLocaleDate):
1499         (JSC::fillStructuresUsingDateArgs):
1500         (JSC::dateProtoFuncToISOString):
1501         (JSC::dateProtoFuncGetFullYear):
1502         (JSC::dateProtoFuncGetUTCFullYear):
1503         (JSC::dateProtoFuncSetYear):
1504         * runtime/JSDateMath.cpp:
1505         (JSC::gregorianDateTimeToMS):
1506         (JSC::msToGregorianDateTime):
1507
1508 2012-07-24  Patrick Gansterer  <paroga@webkit.org>
1509
1510         [WIN] Build fix after r123417.
1511
1512         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1513
1514 2012-07-23  Patrick Gansterer  <paroga@webkit.org>
1515
1516         Move GregorianDateTime from JSC to WTF namespace
1517         https://bugs.webkit.org/show_bug.cgi?id=91948
1518
1519         Reviewed by Geoffrey Garen.
1520
1521         Moving GregorianDateTime into the WTF namespace allows us to us to
1522         use it in WebCore too. The new class has the same behaviour as the
1523         old struct. Only the unused timeZone member has been removed.
1524
1525         * runtime/DateConstructor.cpp:
1526         * runtime/DateConversion.cpp:
1527         * runtime/DateConversion.h:
1528         * runtime/DateInstance.h:
1529         * runtime/DatePrototype.cpp:
1530         * runtime/JSDateMath.cpp:
1531         * runtime/JSDateMath.h:
1532
1533 2012-07-23  Filip Pizlo  <fpizlo@apple.com>
1534
1535         Property storage should grow in reverse address direction, to support butterflies
1536         https://bugs.webkit.org/show_bug.cgi?id=91788
1537
1538         Reviewed by Geoffrey Garen.
1539
1540         Changes property storage to grow to the left, and changes the property storage pointer to point
1541         one 8-byte word (i.e. JSValue) to the right of the first value in the storage.
1542
1543         Also improved debug support somewhat, by adding a describe() function to the jsc command-line,
1544         and a slow mode of object access in LLInt.
1545
1546         * assembler/ARMv7Assembler.h:
1547         (JSC::ARMv7Assembler::repatchCompact):
1548         * assembler/MacroAssemblerARMv7.h:
1549         (MacroAssemblerARMv7):
1550         (JSC::MacroAssemblerARMv7::isCompactPtrAlignedAddressOffset):
1551         (JSC::MacroAssemblerARMv7::load32WithCompactAddressOffsetPatch):
1552         * assembler/MacroAssemblerX86Common.h:
1553         (JSC::MacroAssemblerX86Common::isCompactPtrAlignedAddressOffset):
1554         (JSC::MacroAssemblerX86Common::repatchCompact):
1555         * assembler/X86Assembler.h:
1556         (JSC::X86Assembler::repatchCompact):
1557         * bytecode/CodeBlock.cpp:
1558         (JSC::dumpStructure):
1559         * bytecode/GetByIdStatus.h:
1560         (JSC::GetByIdStatus::GetByIdStatus):
1561         * dfg/DFGOperations.cpp:
1562         * dfg/DFGOperations.h:
1563         * dfg/DFGRepatch.cpp:
1564         (JSC::DFG::tryCacheGetByID):
1565         (JSC::DFG::emitPutTransitionStub):
1566         * dfg/DFGSpeculativeJIT.cpp:
1567         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
1568         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
1569         * dfg/DFGSpeculativeJIT.h:
1570         (JSC::DFG::SpeculativeJIT::callOperation):
1571         * dfg/DFGSpeculativeJIT32_64.cpp:
1572         (JSC::DFG::SpeculativeJIT::compile):
1573         * dfg/DFGSpeculativeJIT64.cpp:
1574         (JSC::DFG::SpeculativeJIT::compile):
1575         * heap/ConservativeRoots.cpp:
1576         (JSC::ConservativeRoots::genericAddPointer):
1577         * heap/CopiedSpace.h:
1578         (CopiedSpace):
1579         * heap/CopiedSpaceInlineMethods.h:
1580         (JSC::CopiedSpace::pinIfNecessary):
1581         (JSC):
1582         * jit/JITPropertyAccess.cpp:
1583         (JSC::JIT::compileGetDirectOffset):
1584         * jit/JITPropertyAccess32_64.cpp:
1585         (JSC::JIT::compileGetDirectOffset):
1586         * jit/JITStubs.cpp:
1587         (JSC::JITThunks::tryCacheGetByID):
1588         * jsc.cpp:
1589         (GlobalObject::finishCreation):
1590         (functionDescribe):
1591         * llint/LLIntCommon.h:
1592         * llint/LLIntSlowPaths.cpp:
1593         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1594         * llint/LowLevelInterpreter32_64.asm:
1595         * llint/LowLevelInterpreter64.asm:
1596         * runtime/JSObject.cpp:
1597         (JSC::JSObject::visitChildren):
1598         (JSC::JSFinalObject::visitChildren):
1599         (JSC::JSObject::growOutOfLineStorage):
1600         * runtime/JSObject.h:
1601         (JSC::JSObject::getDirectLocation):
1602         (JSC::JSObject::offsetForLocation):
1603         * runtime/JSValue.h:
1604         (JSValue):
1605         * runtime/PropertyOffset.h:
1606         (JSC::offsetInOutOfLineStorage):
1607
1608 2012-07-23  Filip Pizlo  <fpizlo@apple.com>
1609
1610         DFG is too aggressive in performing the specific value optimization on loads
1611         https://bugs.webkit.org/show_bug.cgi?id=92034
1612
1613         Reviewed by Mark Hahnenberg.
1614
1615         This ensures that we don't do optimizations based on a structure having a specific
1616         value, if there is no way to detect that the value is despecified. This is the
1617         case for dictionaries, since despecifying a value in a dictionary does not lead to
1618         a transition and so cannot be caught by either structure checks or structure
1619         transition watchpoints.
1620
1621         * bytecode/GetByIdStatus.cpp:
1622         (JSC::GetByIdStatus::computeFromLLInt):
1623         (JSC::GetByIdStatus::computeForChain):
1624         (JSC::GetByIdStatus::computeFor):
1625         * bytecode/ResolveGlobalStatus.cpp:
1626         (JSC::computeForStructure):
1627
1628 2012-07-23  Filip Pizlo  <fpizlo@apple.com>
1629
1630         REGRESSION(r123169): It made fast/js/dfg-inline-arguments-use-from-uninlined-code.html fail on 32 bit platforms
1631         https://bugs.webkit.org/show_bug.cgi?id=92002
1632
1633         Reviewed by Mark Hahnenberg.
1634
1635         In the process of changing the nature of local variable typing, I forgot to modify one of the places where
1636         we glue the DFG's notion of variable prediction to the runtime's notion of variable tagging.
1637
1638         * dfg/DFGSpeculativeJIT.cpp:
1639         (JSC::DFG::SpeculativeJIT::compile):
1640
1641 2012-07-23  Simon Fraser  <simon.fraser@apple.com>
1642
1643         Part 2 of: Implement sticky positioning
1644         https://bugs.webkit.org/show_bug.cgi?id=90046
1645
1646         Reviewed by Ojan Vafai.
1647
1648         Turn on ENABLE_CSS_STICKY_POSITION.
1649
1650         * Configurations/FeatureDefines.xcconfig:
1651
1652 2012-07-23  Patrick Gansterer  <paroga@webkit.org>
1653
1654         Move JSC::parseDate() from DateConversion to JSDateMath
1655         https://bugs.webkit.org/show_bug.cgi?id=91982
1656
1657         Reviewed by Geoffrey Garen.
1658
1659         Moveing this function into the other files removes the dependency
1660         on JSC spcific classes in DateConversion.{cpp|h}.
1661
1662         * runtime/DateConversion.cpp:
1663         * runtime/DateConversion.h:
1664         (JSC):
1665         * runtime/JSDateMath.cpp:
1666         (JSC::parseDate):
1667         (JSC):
1668         * runtime/JSDateMath.h:
1669         (JSC):
1670
1671 2012-07-23  Simon Fraser  <simon.fraser@apple.com>
1672
1673         Part 1 of: Implement sticky positioning
1674         https://bugs.webkit.org/show_bug.cgi?id=90046
1675
1676         Reviewed by Ojan Vafai.
1677
1678         Add ENABLE_CSS_STICKY_POSITION, defaulting to off initially.
1679
1680         Sort the ENABLE_CSS lines in the file. Make sure all the flags
1681         are in FEATURE_DEFINES.
1682
1683         * Configurations/FeatureDefines.xcconfig:
1684
1685 2012-07-23  Yong Li  <yoli@rim.com>
1686
1687         [BlackBerry] Implement GCActivityCallback with platform timer
1688         https://bugs.webkit.org/show_bug.cgi?id=90175
1689
1690         Reviewed by Rob Buis.
1691
1692         Use JSLock when performing GC to avoid assertions.
1693
1694         * runtime/GCActivityCallbackBlackBerry.cpp:
1695         (JSC::DefaultGCActivityCallback::doWork):
1696
1697 2012-07-23  Kent Tamura  <tkent@chromium.org>
1698
1699         Rename ENABLE_METER_TAG and ENABLE_PROGRESS_TAG to ENABLE_METER_ELEMENT and ENABLE_PROGRESS_ELEMENT respectively
1700         https://bugs.webkit.org/show_bug.cgi?id=91941
1701
1702         Reviewed by Kentaro Hara.
1703
1704         A flag name for an elmement should be ENABLE_*_ELEMENT.
1705
1706         * Configurations/FeatureDefines.xcconfig:
1707
1708 2012-07-22  Kent Tamura  <tkent@chromium.org>
1709
1710         Rename ENABLE_DETAILS to ENABLE_DETAILS_ELEMENT
1711         https://bugs.webkit.org/show_bug.cgi?id=91928
1712
1713         Reviewed by Kentaro Hara.
1714
1715         A flag name for an elmement should be ENABLE_*_ELEMENT.
1716
1717         * Configurations/FeatureDefines.xcconfig:
1718
1719 2012-07-21  Patrick Gansterer  <paroga@webkit.org>
1720
1721         [WIN] Use GetDateFormat and GetTimeFormat instead of strftime
1722         https://bugs.webkit.org/show_bug.cgi?id=83436
1723
1724         Reviewed by Brent Fulgham.
1725
1726         The MS CRT implementation of strftime calls the same two functions.
1727         Using them directly avoids the overhead of parsing the format string and removes
1728         the dependency on strftime() for WinCE where this function does not exist.
1729
1730         * runtime/DatePrototype.cpp:
1731         (JSC::formatLocaleDate):
1732
1733 2012-07-20  Kent Tamura  <tkent@chromium.org>
1734
1735         Rename ENABLE_DATALIST to ENABLE_DATALIST_ELEMENT
1736         https://bugs.webkit.org/show_bug.cgi?id=91846
1737
1738         Reviewed by Kentaro Hara.
1739
1740         A flag name for an elmement should be ENABLE_*_ELEMENT.
1741
1742         * Configurations/FeatureDefines.xcconfig:
1743
1744 2012-07-20  Han Shen  <shenhan@google.com>
1745
1746         [Chromium] Compilation fails under gcc 4.7
1747         https://bugs.webkit.org/show_bug.cgi?id=90227
1748
1749         Reviewed by Tony Chang.
1750
1751         Disable warnings about c++0x compatibility in gcc newer than 4.6.
1752
1753         * JavaScriptCore.gyp/JavaScriptCore.gyp:
1754
1755 2012-07-18  Filip Pizlo  <fpizlo@apple.com>
1756
1757         DFG cell checks should be hoisted
1758         https://bugs.webkit.org/show_bug.cgi?id=91717
1759
1760         Reviewed by Geoffrey Garen.
1761
1762         The DFG has always had the policy of hoisting array and integer checks to
1763         the point of variable assignment. Eventually, we added doubles and booleans
1764         to the mix. But cells should really be part of this as well, particularly
1765         for 32-bit where accessing a known-type variable is dramatically cheaper
1766         than accessing a variable whose types is only predicted but otherwise
1767         unproven.
1768
1769         This appears to be a definite speed-up for V8 on 32-bit, a possible speed-up
1770         for Kraken, and a possible slow-down for V8 on 64-bit (around 0.2% if at
1771         all). Any slow-downs can, and should, be addressed by making the hoisting
1772         logic cognizant of variables that are never used in a manner that requires
1773         type checks, and by sinking argument checks to the point(s) of first use.
1774
1775         To make this work I had to change some OSR machinery, and special-case the
1776         type predictions of the 'this' argument for constructors. OSR exit normally
1777         assumes that arguments are boxed, which happens to be true because the
1778         type prediction used for check hoisting is LUB'd with the type of the
1779         argument that was passed in - so either the arguments are always stored to
1780         with the full tag+payload, or if only the payload is stored then the tag
1781         matches whatever the caller would have set. But not so with the 'this'
1782         argument for constructors, which is not initialized by the caller. We
1783         could make this more precise by having argument types for OSR be inferred
1784         using similar machinery to other locals, but I figured that for this patch
1785         I should use the surgical fix.
1786
1787         * assembler/MacroAssemblerX86_64.h:
1788         (JSC::MacroAssemblerX86_64::branchTestPtr):
1789         (MacroAssemblerX86_64):
1790         * assembler/X86Assembler.h:
1791         (JSC::X86Assembler::testq_rm):
1792         (X86Assembler):
1793         * dfg/DFGAbstractState.cpp:
1794         (JSC::DFG::AbstractState::initialize):
1795         (JSC::DFG::AbstractState::execute):
1796         * dfg/DFGDriver.cpp:
1797         (JSC::DFG::compile):
1798         * dfg/DFGGraph.h:
1799         (JSC::DFG::Graph::isCreatedThisArgument):
1800         (Graph):
1801         * dfg/DFGSpeculativeJIT.cpp:
1802         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
1803         * dfg/DFGSpeculativeJIT32_64.cpp:
1804         (JSC::DFG::SpeculativeJIT::compile):
1805         * dfg/DFGSpeculativeJIT64.cpp:
1806         (JSC::DFG::SpeculativeJIT::compile):
1807         * dfg/DFGValueSource.h:
1808         (JSC::DFG::ValueSource::forSpeculation):
1809
1810 2012-07-19  Filip Pizlo  <fpizlo@apple.com>
1811
1812         Fast path of storage resize should be removed from property storage reallocation, since it is only useful for arrays
1813         https://bugs.webkit.org/show_bug.cgi?id=91796
1814
1815         Reviewed by Geoffrey Garen.
1816
1817         * dfg/DFGRepatch.cpp:
1818         (JSC::DFG::emitPutTransitionStub):
1819         * dfg/DFGSpeculativeJIT.cpp:
1820         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
1821         * runtime/JSObject.cpp:
1822         (JSC::JSObject::growOutOfLineStorage):
1823
1824 2012-07-19  Mark Lam  <mark.lam@apple.com>
1825
1826         Bug fixes and enhancements for OfflineASM annotation system.
1827         https://bugs.webkit.org/show_bug.cgi?id=91690
1828
1829         Reviewed by Filip Pizlo.
1830
1831         * offlineasm/armv7.rb: added default handling of Instruction lower().
1832         * offlineasm/asm.rb: added more support for annotations and more pretty printing.
1833         * offlineasm/ast.rb: added more support for annotations.
1834         * offlineasm/config.rb: added $preferredCommentStartColumn, simplified $enableInstrAnnotations.
1835         * offlineasm/parser.rb: added more support for annotations.
1836         * offlineasm/transform.rb: added more support for annotations.
1837         * offlineasm/x86.rb: added default handling of Instruction lower().
1838
1839 2012-07-19  Patrick Gansterer  <paroga@webkit.org>
1840
1841         [WIN] Fix compilation of JSGlobalData.h with ENABLE(DFG_JIT)
1842         https://bugs.webkit.org/show_bug.cgi?id=91243
1843
1844         Reviewed by Geoffrey Garen.
1845
1846         Disable MSVC warning 4200 "zero-sized array in struct/union" for JSC::ScratchBuffer.
1847
1848         * runtime/JSGlobalData.h:
1849         (JSC):
1850
1851 2012-07-19  Mark Lam  <mark.lam@apple.com>
1852
1853         Fixed broken ENABLE_JIT=0 build.
1854         https://bugs.webkit.org/show_bug.cgi?id=91725
1855
1856         Reviewed by Oliver Hunt.
1857
1858         * bytecode/Watchpoint.cpp:
1859         * heap/JITStubRoutineSet.h:
1860         (JSC):
1861         (JITStubRoutineSet):
1862         (JSC::JITStubRoutineSet::JITStubRoutineSet):
1863         (JSC::JITStubRoutineSet::~JITStubRoutineSet):
1864         (JSC::JITStubRoutineSet::add):
1865         (JSC::JITStubRoutineSet::clearMarks):
1866         (JSC::JITStubRoutineSet::mark):
1867         (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
1868         (JSC::JITStubRoutineSet::traceMarkedStubRoutines):
1869
1870 2012-07-19  Kristóf Kosztyó  <kkristof@inf.u-szeged.hu>
1871
1872         [Qt] Unreviewed buildfix after r123042.
1873
1874         * interpreter/Interpreter.cpp:
1875         (JSC::Interpreter::dumpRegisters):
1876
1877 2012-07-18  Filip Pizlo  <fpizlo@apple.com>
1878
1879         DFG should emit inline code for property storage (re)allocation
1880         https://bugs.webkit.org/show_bug.cgi?id=91597
1881
1882         Reviewed by Oliver Hunt.
1883
1884         This adds two new ops to the DFG IR: AllocatePropertyStorage and
1885         ReallocatePropertyStorage. It enables these to interact properly with
1886         CSE so that a GetPropertyStorage on something for which we have
1887         obviously done a (Re)AllocatePropertyStorage will result in the
1888         GetPropertyStorage being eliminated. Other than that, the code
1889         emitted for these ops is identical to the code we were emitting in
1890         the corresponding PutById stub.
1891
1892         * dfg/DFGAbstractState.cpp:
1893         (JSC::DFG::AbstractState::execute):
1894         * dfg/DFGByteCodeParser.cpp:
1895         (JSC::DFG::ByteCodeParser::parseBlock):
1896         * dfg/DFGCSEPhase.cpp:
1897         (JSC::DFG::CSEPhase::putStructureStoreElimination):
1898         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
1899         * dfg/DFGNode.h:
1900         (JSC::DFG::Node::hasStructureTransitionData):
1901         * dfg/DFGNodeType.h:
1902         (DFG):
1903         * dfg/DFGOperations.cpp:
1904         * dfg/DFGOperations.h:
1905         * dfg/DFGPredictionPropagationPhase.cpp:
1906         (JSC::DFG::PredictionPropagationPhase::propagate):
1907         * dfg/DFGSpeculativeJIT.cpp:
1908         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
1909         (DFG):
1910         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
1911         * dfg/DFGSpeculativeJIT.h:
1912         (JSC::DFG::SpeculativeJIT::callOperation):
1913         (SpeculativeJIT):
1914         * dfg/DFGSpeculativeJIT32_64.cpp:
1915         (JSC::DFG::SpeculativeJIT::compile):
1916         * dfg/DFGSpeculativeJIT64.cpp:
1917         (JSC::DFG::SpeculativeJIT::compile):
1918         * runtime/Structure.cpp:
1919         (JSC::nextOutOfLineStorageCapacity):
1920         * runtime/Structure.h:
1921         (JSC):
1922
1923 2012-07-16  Oliver Hunt  <oliver@apple.com>
1924
1925         dumpCallFrame is broken in ToT
1926         https://bugs.webkit.org/show_bug.cgi?id=91444
1927
1928         Reviewed by Gavin Barraclough.
1929
1930         Various changes have been made to the SF calling convention, but
1931         dumpCallFrame has not been updated to reflect these changes.
1932         That resulted in both bogus information, as well as numerous
1933         assertions of sadness.
1934
1935         This patch makes dumpCallFrame actually work again and adds the
1936         wonderful feature of telling you the name of the variable that a
1937         register reflects, or what value it contains.
1938
1939         * bytecode/CodeBlock.cpp:
1940         (JSC::CodeBlock::nameForRegister):
1941             A really innefficient mechanism for finding the name of a local register.
1942             This should only ever be used by debug code so this should be okay.
1943         * bytecode/CodeBlock.h:
1944         (CodeBlock):
1945         * bytecompiler/BytecodeGenerator.cpp:
1946         (JSC::BytecodeGenerator::generate):
1947             Debug builds no longer throw away a functions symbol table, this allows
1948             us to actually perform a register# to name mapping
1949         * dfg/DFGJITCompiler.cpp:
1950         (JSC::DFG::JITCompiler::link):
1951             We weren't propogating the bytecode offset here leading to assertions
1952             in debug builds when dumping bytecode of DFG compiled code.
1953         * interpreter/Interpreter.cpp:
1954         (JSC):
1955         (JSC::Interpreter::dumpRegisters):
1956              Rework to actually be correct.
1957         (JSC::getCallerInfo):
1958              Return the byteocde offset as well now, given we have to determine it
1959              anyway.
1960         (JSC::Interpreter::getStackTrace):
1961         (JSC::Interpreter::retrieveCallerFromVMCode):
1962         * interpreter/Interpreter.h:
1963         (Interpreter):
1964         * jsc.cpp:
1965         (GlobalObject::finishCreation):
1966         (functionDumpCallFrame):
1967              Give debug builds of JSC a method for calling dumpCallFrame so we can
1968              inspect a callframe without requiring us to break in a debugger.
1969
1970 2012-07-18  Filip Pizlo  <fpizlo@apple.com>
1971
1972         DFG 32-bit PutById transition stub storage reallocation case copies the first pointer of each JSValue instead of the whole JSValue
1973         https://bugs.webkit.org/show_bug.cgi?id=91599
1974
1975         Reviewed by Geoffrey Garen.
1976
1977         * dfg/DFGRepatch.cpp:
1978         (JSC::DFG::emitPutTransitionStub):
1979
1980 2012-07-17  Filip Pizlo  <fpizlo@apple.com>
1981
1982         DFG 32-bit PutById transition stub passes the payload/tag arguments to a DFG operation in the wrong order
1983         https://bugs.webkit.org/show_bug.cgi?id=91576
1984
1985         Reviewed by Gavin Barraclough.
1986
1987         * dfg/DFGRepatch.cpp:
1988         (JSC::DFG::emitPutTransitionStub):
1989
1990 2012-07-17  Filip Pizlo  <fpizlo@apple.com>
1991
1992         [Qt] REGRESSION(r122768, r122771): They broke jquery/data.html and inspector/elements/edit-dom-actions.html
1993         https://bugs.webkit.org/show_bug.cgi?id=91476
1994
1995         Reviewed by Mark Hahnenberg.
1996
1997         The 32-bit repatching code was not correctly adapted to the new world where there may not always
1998         be an available scratch register. Fixed it by ensuring that the scratch register we select does
1999         not overlap with the value tag.
2000
2001         * dfg/DFGRepatch.cpp:
2002         (JSC::DFG::generateProtoChainAccessStub):
2003         (JSC::DFG::tryCacheGetByID):
2004         (JSC::DFG::tryBuildGetByIDList):
2005         (JSC::DFG::emitPutReplaceStub):
2006
2007 2012-07-17  Gabor Rapcsanyi  <rgabor@webkit.org>
2008
2009         Unreviewed buildfix from Zoltan Herczeg after 122768.
2010
2011         * dfg/DFGCCallHelpers.h:
2012         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
2013         (CCallHelpers):
2014
2015 2012-07-17  David Barr  <davidbarr@chromium.org>
2016
2017         Introduce ENABLE_CSS_IMAGE_ORIENTATION compile flag
2018         https://bugs.webkit.org/show_bug.cgi?id=89055
2019
2020         Reviewed by Kent Tamura.
2021
2022         The css3-images module is at candidate recommendation.
2023         http://www.w3.org/TR/2012/CR-css3-images-20120417/#the-image-orientation
2024
2025         Add a configuration option for CSS image-orientation support, disabling it by default.
2026
2027         * Configurations/FeatureDefines.xcconfig:
2028
2029 2012-07-16  Filip Pizlo  <fpizlo@apple.com>
2030
2031         Unreviewed, roll out 122790 because it broke the Windows build. I'm not
2032         sure what to do with exported symbols that are predicated on NDEBUG.
2033
2034         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2035         * bytecode/CodeBlock.cpp:
2036         (JSC):
2037         * bytecode/CodeBlock.h:
2038         (CodeBlock):
2039         * bytecompiler/BytecodeGenerator.cpp:
2040         (JSC::BytecodeGenerator::generate):
2041         * dfg/DFGJITCompiler.cpp:
2042         (JSC::DFG::JITCompiler::link):
2043         * interpreter/Interpreter.cpp:
2044         (JSC):
2045         (JSC::Interpreter::dumpRegisters):
2046         (JSC::getCallerInfo):
2047         (JSC::Interpreter::getStackTrace):
2048         (JSC::Interpreter::retrieveCallerFromVMCode):
2049         * interpreter/Interpreter.h:
2050         (Interpreter):
2051         * jsc.cpp:
2052         (GlobalObject::finishCreation):
2053
2054 2012-07-16  Oliver Hunt  <oliver@apple.com>
2055
2056         dumpCallFrame is broken in ToT
2057         https://bugs.webkit.org/show_bug.cgi?id=91444
2058
2059         Reviewed by Gavin Barraclough.
2060
2061         Various changes have been made to the SF calling convention, but
2062         dumpCallFrame has not been updated to reflect these changes.
2063         That resulted in both bogus information, as well as numerous
2064         assertions of sadness.
2065
2066         This patch makes dumpCallFrame actually work again and adds the
2067         wonderful feature of telling you the name of the variable that a
2068         register reflects, or what value it contains.
2069
2070         * bytecode/CodeBlock.cpp:
2071         (JSC::CodeBlock::nameForRegister):
2072             A really innefficient mechanism for finding the name of a local register.
2073             This should only ever be used by debug code so this should be okay.
2074         * bytecode/CodeBlock.h:
2075         (CodeBlock):
2076         * bytecompiler/BytecodeGenerator.cpp:
2077         (JSC::BytecodeGenerator::generate):
2078             Debug builds no longer throw away a functions symbol table, this allows
2079             us to actually perform a register# to name mapping
2080         * dfg/DFGJITCompiler.cpp:
2081         (JSC::DFG::JITCompiler::link):
2082             We weren't propogating the bytecode offset here leading to assertions
2083             in debug builds when dumping bytecode of DFG compiled code.
2084         * interpreter/Interpreter.cpp:
2085         (JSC):
2086         (JSC::Interpreter::dumpRegisters):
2087              Rework to actually be correct.
2088         (JSC::getCallerInfo):
2089              Return the byteocde offset as well now, given we have to determine it
2090              anyway.
2091         (JSC::Interpreter::getStackTrace):
2092         (JSC::Interpreter::retrieveCallerFromVMCode):
2093         * interpreter/Interpreter.h:
2094         (Interpreter):
2095         * jsc.cpp:
2096         (GlobalObject::finishCreation):
2097         (functionDumpCallFrame):
2098              Give debug builds of JSC a method for calling dumpCallFrame so we can
2099              inspect a callframe without requiring us to break in a debugger.
2100
2101 2012-07-16  Filip Pizlo  <fpizlo@apple.com>
2102
2103         Unreviewed, adding forgotten files.
2104
2105         * dfg/DFGRegisterSet.h: Added.
2106         (DFG):
2107         (RegisterSet):
2108         (JSC::DFG::RegisterSet::RegisterSet):
2109         (JSC::DFG::RegisterSet::asPOD):
2110         (JSC::DFG::RegisterSet::copyInfo):
2111         (JSC::DFG::RegisterSet::set):
2112         (JSC::DFG::RegisterSet::setGPRByIndex):
2113         (JSC::DFG::RegisterSet::clear):
2114         (JSC::DFG::RegisterSet::get):
2115         (JSC::DFG::RegisterSet::getGPRByIndex):
2116         (JSC::DFG::RegisterSet::getFreeGPR):
2117         (JSC::DFG::RegisterSet::setFPRByIndex):
2118         (JSC::DFG::RegisterSet::getFPRByIndex):
2119         (JSC::DFG::RegisterSet::setByIndex):
2120         (JSC::DFG::RegisterSet::getByIndex):
2121         (JSC::DFG::RegisterSet::numberOfSetGPRs):
2122         (JSC::DFG::RegisterSet::numberOfSetFPRs):
2123         (JSC::DFG::RegisterSet::numberOfSetRegisters):
2124         (JSC::DFG::RegisterSet::setBit):
2125         (JSC::DFG::RegisterSet::clearBit):
2126         (JSC::DFG::RegisterSet::getBit):
2127         * dfg/DFGScratchRegisterAllocator.h: Added.
2128         (DFG):
2129         (ScratchRegisterAllocator):
2130         (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator):
2131         (JSC::DFG::ScratchRegisterAllocator::lock):
2132         (JSC::DFG::ScratchRegisterAllocator::allocateScratch):
2133         (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR):
2134         (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR):
2135         (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters):
2136         (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
2137         (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
2138         (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize):
2139         (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
2140         (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
2141
2142 2012-07-15  Filip Pizlo  <fpizlo@apple.com>
2143
2144         DFG PutById transition should handle storage allocation, and inline it
2145         https://bugs.webkit.org/show_bug.cgi?id=91337
2146
2147         Reviewed by Oliver Hunt.
2148
2149         This enables the patching of DFG PutById to handle the out-of-line storage
2150         allocation case. Furthermore, it inlines out-of-line storage allocation (and
2151         reallocation) into the generated stubs.
2152
2153         To do this, this patch adds the ability to store the relevant register
2154         allocation state (i.e. the set of in-use registers) in the structure stub
2155         info so that the stub generation code can more flexibly select scratch
2156         registers: sometimes it needs none, sometimes one - or sometimes up to
2157         three. Moreover, to make the stub generation register allocation simple and
2158         maintainable, this patch introduces a reusable scratch register allocator
2159         class. This register allocator understands that some registers are in use by
2160         the main path code and so must be spilled as necessary, other registers are
2161         locked for use in the stub itself and so cannot even be spilled, while still
2162         others may be allocated for scratch purposes. A scratch register that is
2163         used must be spilled. If a register is locked, it cannot be used as a
2164         scratch register. If a register is used, it can be used as a scratch
2165         register so long as it is spilled.
2166
2167         This is a sub-1% speed-up on V8 and neutral elsewhere.
2168
2169         * GNUmakefile.list.am:
2170         * JavaScriptCore.xcodeproj/project.pbxproj:
2171         * assembler/MacroAssemblerCodeRef.h:
2172         (FunctionPtr):
2173         (JSC::FunctionPtr::FunctionPtr):
2174         * bytecode/StructureStubInfo.h:
2175         * dfg/DFGCCallHelpers.h:
2176         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
2177         (CCallHelpers):
2178         * dfg/DFGGPRInfo.h:
2179         * dfg/DFGJITCompiler.cpp:
2180         (JSC::DFG::JITCompiler::link):
2181         * dfg/DFGJITCompiler.h:
2182         (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
2183         (PropertyAccessRecord):
2184         * dfg/DFGOperations.cpp:
2185         * dfg/DFGOperations.h:
2186         * dfg/DFGRegisterBank.h:
2187         (JSC::DFG::RegisterBank::isInUse):
2188         (RegisterBank):
2189         * dfg/DFGRegisterSet.h: Added.
2190         (DFG):
2191         (RegisterSet):
2192         (JSC::DFG::RegisterSet::RegisterSet):
2193         (JSC::DFG::RegisterSet::asPOD):
2194         (JSC::DFG::RegisterSet::copyInfo):
2195         (JSC::DFG::RegisterSet::set):
2196         (JSC::DFG::RegisterSet::setGPRByIndex):
2197         (JSC::DFG::RegisterSet::clear):
2198         (JSC::DFG::RegisterSet::get):
2199         (JSC::DFG::RegisterSet::getGPRByIndex):
2200         (JSC::DFG::RegisterSet::getFreeGPR):
2201         (JSC::DFG::RegisterSet::setFPRByIndex):
2202         (JSC::DFG::RegisterSet::getFPRByIndex):
2203         (JSC::DFG::RegisterSet::setByIndex):
2204         (JSC::DFG::RegisterSet::getByIndex):
2205         (JSC::DFG::RegisterSet::numberOfSetGPRs):
2206         (JSC::DFG::RegisterSet::numberOfSetFPRs):
2207         (JSC::DFG::RegisterSet::numberOfSetRegisters):
2208         (JSC::DFG::RegisterSet::setBit):
2209         (JSC::DFG::RegisterSet::clearBit):
2210         (JSC::DFG::RegisterSet::getBit):
2211         * dfg/DFGRepatch.cpp:
2212         (JSC::DFG::generateProtoChainAccessStub):
2213         (JSC::DFG::tryCacheGetByID):
2214         (JSC::DFG::tryBuildGetByIDList):
2215         (JSC::DFG::emitPutReplaceStub):
2216         (JSC::DFG::emitPutTransitionStub):
2217         (JSC::DFG::tryCachePutByID):
2218         (JSC::DFG::tryBuildPutByIdList):
2219         * dfg/DFGScratchRegisterAllocator.h: Added.
2220         (DFG):
2221         (ScratchRegisterAllocator):
2222         (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator):
2223         (JSC::DFG::ScratchRegisterAllocator::lock):
2224         (JSC::DFG::ScratchRegisterAllocator::allocateScratch):
2225         (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR):
2226         (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR):
2227         (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters):
2228         (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
2229         (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
2230         (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize):
2231         (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
2232         (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
2233         * dfg/DFGSpeculativeJIT.h:
2234         (SpeculativeJIT):
2235         (JSC::DFG::SpeculativeJIT::usedRegisters):
2236         * dfg/DFGSpeculativeJIT32_64.cpp:
2237         (JSC::DFG::SpeculativeJIT::cachedGetById):
2238         (JSC::DFG::SpeculativeJIT::cachedPutById):
2239         (JSC::DFG::SpeculativeJIT::compile):
2240         * dfg/DFGSpeculativeJIT64.cpp:
2241         (JSC::DFG::SpeculativeJIT::cachedGetById):
2242         (JSC::DFG::SpeculativeJIT::cachedPutById):
2243         (JSC::DFG::SpeculativeJIT::compile):
2244         * heap/CopiedAllocator.h:
2245         (CopiedAllocator):
2246         (JSC::CopiedAllocator::fastPathShouldSucceed):
2247         (JSC):
2248
2249 2012-07-16  Patrick Gansterer  <paroga@webkit.org>
2250
2251         Add dfg switch to create_jit_stubs script
2252         https://bugs.webkit.org/show_bug.cgi?id=91256
2253
2254         Reviewed by Geoffrey Garen.
2255
2256         * create_jit_stubs: Add a switch to enable or disable the generation of
2257                             stub functions in #if ENABLE(DFG_JIT) conditions.
2258
2259 2012-07-16  Gabor Rapcsanyi  <rgabor@webkit.org>
2260
2261         Unreviewed buildfix after r122729. Typo fix.
2262
2263         * assembler/MacroAssemblerARM.h:
2264         (JSC::MacroAssemblerARM::add32):
2265
2266 2012-07-16  Gabor Rapcsanyi  <rgabor@webkit.org>
2267
2268         Unreviewed buildfix from Zoltan Herczeg after r122677.
2269         Implement missing add32 function to MacroAssemblerARM.
2270
2271         * assembler/MacroAssemblerARM.h:
2272         (JSC::MacroAssemblerARM::add32):
2273         (MacroAssemblerARM):
2274
2275 2012-07-14  Filip Pizlo  <fpizlo@apple.com>
2276
2277         DFG PutByVal opcodes should accept more than 3 operands
2278         https://bugs.webkit.org/show_bug.cgi?id=91332
2279
2280         Reviewed by Oliver Hunt.
2281
2282         Turned PutByVal/PutByValAlias into var-arg nodes, so that we can give them
2283         4 or more operands in the future.
2284
2285         * dfg/DFGAbstractState.cpp:
2286         (JSC::DFG::AbstractState::execute):
2287         * dfg/DFGByteCodeParser.cpp:
2288         (JSC::DFG::ByteCodeParser::parseBlock):
2289         * dfg/DFGCSEPhase.cpp:
2290         (JSC::DFG::CSEPhase::getByValLoadElimination):
2291         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
2292         (JSC::DFG::CSEPhase::performNodeCSE):
2293         * dfg/DFGFixupPhase.cpp:
2294         (JSC::DFG::FixupPhase::fixupNode):
2295         (JSC::DFG::FixupPhase::fixDoubleEdge):
2296         * dfg/DFGGraph.h:
2297         (JSC::DFG::Graph::byValIsPure):
2298         (JSC::DFG::Graph::varArgNumChildren):
2299         (Graph):
2300         (JSC::DFG::Graph::numChildren):
2301         (JSC::DFG::Graph::varArgChild):
2302         (JSC::DFG::Graph::child):
2303         * dfg/DFGNodeType.h:
2304         (DFG):
2305         * dfg/DFGPredictionPropagationPhase.cpp:
2306         (JSC::DFG::PredictionPropagationPhase::propagate):
2307         * dfg/DFGSpeculativeJIT.cpp:
2308         (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
2309         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
2310         * dfg/DFGSpeculativeJIT32_64.cpp:
2311         (JSC::DFG::SpeculativeJIT::compile):
2312         * dfg/DFGSpeculativeJIT64.cpp:
2313         (JSC::DFG::SpeculativeJIT::compile):
2314
2315 2012-07-14  Filip Pizlo  <fpizlo@apple.com>
2316
2317         Rationalize and optimize storage allocation
2318         https://bugs.webkit.org/show_bug.cgi?id=91303
2319
2320         Reviewed by Oliver Hunt.
2321
2322         This implements a backwards bump allocator for copied space storage
2323         allocation, shown in pseudo-code below:
2324
2325             pointer bump(size) {
2326                 pointer tmp = allocator->remaining;
2327                 tmp -= size;
2328                 if (tmp < 0)
2329                     fail;
2330                 allocator->remaining = tmp;
2331                 return allocator->payloadEnd - tmp - size;
2332             }
2333
2334         The advantage of this allocator is that it:
2335
2336         - Only requires one comparison in the common case where size is known to
2337           not be huge, and this comparison can be done by checking the sign bit
2338           of the subtraction.
2339
2340         - Can be implemented even when only one register is available. This
2341           register is reused for both temporary storage during allocation and
2342           for the result.
2343
2344         - Preserves the behavior that memory in a block is filled in from lowest
2345           address to highest address, which allows for a cheap reallocation fast
2346           path.
2347
2348         - Is resilient against the block used for allocation being the last one
2349           in virtual memory, thereby otherwise leading to the risk of overflow
2350           in the bump pointer, despite only doing one branch.
2351
2352         In order to implement this allocator using the smallest possible chunk
2353         of code, I refactored the copied space code so that all of the allocation
2354         logic is in CopiedAllocator, and all of the state is in either
2355         CopiedBlock or CopiedAllocator. This should make changing the allocation
2356         fast path easier in the future.
2357
2358         In order to do this, I needed to add some new assembler support,
2359         particularly for various forms of add(address, register) and negPtr().
2360
2361         This is performance neutral. The purpose of this change is to facilitate
2362         further inlining of storage allocation without having to reserve
2363         additional registers or emit too much code.
2364
2365         * assembler/MacroAssembler.h:
2366         (JSC::MacroAssembler::addPtr):
2367         (MacroAssembler):
2368         (JSC::MacroAssembler::negPtr):
2369         * assembler/MacroAssemblerARMv7.h:
2370         (MacroAssemblerARMv7):
2371         (JSC::MacroAssemblerARMv7::add32):
2372         * assembler/MacroAssemblerX86.h:
2373         (JSC::MacroAssemblerX86::add32):
2374         (MacroAssemblerX86):
2375         * assembler/MacroAssemblerX86_64.h:
2376         (MacroAssemblerX86_64):
2377         (JSC::MacroAssemblerX86_64::addPtr):
2378         (JSC::MacroAssemblerX86_64::negPtr):
2379         * assembler/X86Assembler.h:
2380         (X86Assembler):
2381         (JSC::X86Assembler::addl_mr):
2382         (JSC::X86Assembler::addq_mr):
2383         (JSC::X86Assembler::negq_r):
2384         * heap/CopiedAllocator.h:
2385         (CopiedAllocator):
2386         (JSC::CopiedAllocator::isValid):
2387         (JSC::CopiedAllocator::CopiedAllocator):
2388         (JSC::CopiedAllocator::tryAllocate):
2389         (JSC):
2390         (JSC::CopiedAllocator::tryReallocate):
2391         (JSC::CopiedAllocator::forceAllocate):
2392         (JSC::CopiedAllocator::resetCurrentBlock):
2393         (JSC::CopiedAllocator::setCurrentBlock):
2394         (JSC::CopiedAllocator::currentCapacity):
2395         * heap/CopiedBlock.h:
2396         (CopiedBlock):
2397         (JSC::CopiedBlock::create):
2398         (JSC::CopiedBlock::zeroFillWilderness):
2399         (JSC::CopiedBlock::CopiedBlock):
2400         (JSC::CopiedBlock::payloadEnd):
2401         (JSC):
2402         (JSC::CopiedBlock::payloadCapacity):
2403         (JSC::CopiedBlock::data):
2404         (JSC::CopiedBlock::dataEnd):
2405         (JSC::CopiedBlock::dataSize):
2406         (JSC::CopiedBlock::wilderness):
2407         (JSC::CopiedBlock::wildernessEnd):
2408         (JSC::CopiedBlock::wildernessSize):
2409         (JSC::CopiedBlock::size):
2410         * heap/CopiedSpace.cpp:
2411         (JSC::CopiedSpace::tryAllocateSlowCase):
2412         (JSC::CopiedSpace::tryAllocateOversize):
2413         (JSC::CopiedSpace::tryReallocate):
2414         (JSC::CopiedSpace::doneFillingBlock):
2415         (JSC::CopiedSpace::doneCopying):
2416         * heap/CopiedSpace.h:
2417         (CopiedSpace):
2418         * heap/CopiedSpaceInlineMethods.h:
2419         (JSC::CopiedSpace::startedCopying):
2420         (JSC::CopiedSpace::allocateBlockForCopyingPhase):
2421         (JSC::CopiedSpace::allocateBlock):
2422         (JSC::CopiedSpace::tryAllocate):
2423         (JSC):
2424         * heap/MarkStack.cpp:
2425         (JSC::SlotVisitor::startCopying):
2426         (JSC::SlotVisitor::allocateNewSpace):
2427         (JSC::SlotVisitor::doneCopying):
2428         * heap/SlotVisitor.h:
2429         (JSC::SlotVisitor::SlotVisitor):
2430         * jit/JIT.h:
2431         * jit/JITInlineMethods.h:
2432         (JSC::JIT::emitAllocateBasicStorage):
2433         (JSC::JIT::emitAllocateJSArray):
2434
2435 2012-07-13  Mark Lam  <mark.lam@apple.com>
2436
2437         OfflineASM Pretty printing and commenting enhancements.
2438         https://bugs.webkit.org/show_bug.cgi?id=91281
2439
2440         Reviewed by Filip Pizlo.
2441
2442         Added some minor pretty printing in the OfflineASM.
2443         Also added infrastruture for adding multiple types of comments and
2444         annotations with the ability to enable/disable them in the generated
2445         output as desired.
2446
2447         * GNUmakefile.list.am: add new file config.rb.
2448         * llint/LLIntOfflineAsmConfig.h:
2449           Added OFFLINE_ASM_BEGIN, OFFLINE_ASM_END, and OFFLINE_ASM_LOCAL_LABEL macros.
2450           This will allow us to redefine these for other backends later.
2451         * llint/LowLevelInterpreter32_64.asm:
2452           Add a small example of instruction annotations for now.
2453         * llint/LowLevelInterpreter64.asm:
2454           Add a small example of instruction annotations for now.
2455         * offlineasm/armv7.rb: Added handling of annotations.
2456         * offlineasm/asm.rb:
2457           Added machinery to dump the new comments and annotations.
2458           Also added some indentations to make the output a little prettier.
2459         * offlineasm/ast.rb: Added annotation field in class Instruction.
2460         * offlineasm/backends.rb:
2461         * offlineasm/config.rb: Added.
2462           Currently only contains commenting options.  This file is meant to be
2463           a centralized place for build config values much like config.h for
2464           JavaScriptCore.
2465         * offlineasm/generate_offset_extractor.rb:
2466         * offlineasm/instructions.rb:
2467         * offlineasm/offsets.rb:
2468         * offlineasm/opt.rb:
2469         * offlineasm/parser.rb: Parse and record annotations.
2470         * offlineasm/registers.rb:
2471         * offlineasm/self_hash.rb:
2472         * offlineasm/settings.rb:
2473         * offlineasm/transform.rb:
2474         * offlineasm/x86.rb: Added handling of annotations.
2475
2476 2012-07-13  Filip Pizlo  <fpizlo@apple.com>
2477
2478         ASSERTION FAILED: use.useKind() != DoubleUse
2479         https://bugs.webkit.org/show_bug.cgi?id=91082
2480
2481         Reviewed by Geoffrey Garen.
2482
2483         The implementation of Branch() was unwisely relying on register allocation state
2484         to decide what speculations to perform. That's never correct.
2485
2486         * dfg/DFGSpeculativeJIT32_64.cpp:
2487         (JSC::DFG::SpeculativeJIT::compile):
2488         * dfg/DFGSpeculativeJIT64.cpp:
2489         (JSC::DFG::SpeculativeJIT::compile):
2490
2491 2012-07-13  Sheriff Bot  <webkit.review.bot@gmail.com>
2492
2493         Unreviewed, rolling out r122640.
2494         http://trac.webkit.org/changeset/122640
2495         https://bugs.webkit.org/show_bug.cgi?id=91298
2496
2497         LLInt apparently does not expect to mark these (Requested by
2498         olliej on #webkit).
2499
2500         * bytecode/CodeBlock.cpp:
2501         (JSC::CodeBlock::visitStructures):
2502         (JSC::CodeBlock::stronglyVisitStrongReferences):
2503
2504 2012-07-13  Oliver Hunt  <oliver@apple.com>
2505
2506         LLInt fails to mark structures stored in the bytecode
2507         https://bugs.webkit.org/show_bug.cgi?id=91296
2508
2509         Reviewed by Geoffrey Garen.
2510
2511         LLInt stores structures in the bytecode, so we need to visit the appropriate
2512         instructions as we would if we were running in the classic interpreter.
2513         This requires adding additional checks for the LLInt specific opcodes, and
2514         the lint specific variants of operand ordering.
2515
2516         * bytecode/CodeBlock.cpp:
2517         (JSC::CodeBlock::visitStructures):
2518         (JSC::CodeBlock::stronglyVisitStrongReferences):
2519
2520 2012-07-13  Yong Li  <yoli@rim.com>
2521
2522         [BlackBerry] Implement GCActivityCallback with platform timer
2523         https://bugs.webkit.org/show_bug.cgi?id=90175
2524
2525         Reviewed by Rob Buis.
2526
2527         Implement GCActivityCallback and HeapTimer for BlackBerry port.
2528
2529         * heap/HeapTimer.cpp:
2530         (JSC):
2531         (JSC::HeapTimer::HeapTimer):
2532         (JSC::HeapTimer::~HeapTimer):
2533         (JSC::HeapTimer::timerDidFire):
2534         (JSC::HeapTimer::synchronize):
2535         (JSC::HeapTimer::invalidate):
2536         (JSC::HeapTimer::didStartVMShutdown):
2537         * heap/HeapTimer.h:
2538         (HeapTimer):
2539         * runtime/GCActivityCallbackBlackBerry.cpp:
2540         (JSC):
2541         (JSC::DefaultGCActivityCallback::doWork):
2542         (JSC::DefaultGCActivityCallback::didAllocate):
2543         (JSC::DefaultGCActivityCallback::willCollect):
2544         (JSC::DefaultGCActivityCallback::cancel):
2545
2546 2012-07-13  Patrick Gansterer  <paroga@webkit.org>
2547
2548         [WIN] Fix compilation of DFGRepatch.cpp
2549         https://bugs.webkit.org/show_bug.cgi?id=91241
2550
2551         Reviewed by Geoffrey Garen.
2552
2553         Use intptr_t instead of uintptr_t when calling CodeLocationCommon::dataLabelPtrAtOffset(int)
2554         to fix MSVC "unary minus operator applied to unsigned type, result still unsigned" warning.
2555
2556         * dfg/DFGRepatch.cpp:
2557         (JSC::DFG::dfgResetGetByID):
2558         (JSC::DFG::dfgResetPutByID):
2559
2560 2012-07-13  Patrick Gansterer  <paroga@webkit.org>
2561
2562         Fix ARM_TRADITIONAL JIT for COMPILER(MSVC) and COMPILER(RVCT) after r121885
2563         https://bugs.webkit.org/show_bug.cgi?id=91238
2564
2565         Reviewed by Zoltan Herczeg.
2566
2567         r121885 changed the assembler instruction only for COMPILER(GCC).
2568         Use the same instructions for the other compilers too.
2569
2570         * jit/JITStubs.cpp:
2571         (JSC::ctiTrampoline):
2572         (JSC::ctiTrampolineEnd):
2573         (JSC::ctiVMThrowTrampoline):
2574
2575 2012-07-12  Filip Pizlo  <fpizlo@apple.com>
2576
2577         DFG property access stubs should use structure transition watchpoints
2578         https://bugs.webkit.org/show_bug.cgi?id=91135
2579
2580         Reviewed by Geoffrey Garen.
2581
2582         This adds a Watchpoint subclass that will clear a structure stub (i.e.
2583         a property access stub) when fired. The DFG stub generation code now
2584         uses this optimization.
2585
2586         * CMakeLists.txt:
2587         * GNUmakefile.list.am:
2588         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2589         * JavaScriptCore.xcodeproj/project.pbxproj:
2590         * Target.pri:
2591         * bytecode/CodeBlock.cpp:
2592         (JSC):
2593         (JSC::CodeBlock::finalizeUnconditionally):
2594         (JSC::CodeBlock::resetStub):
2595         (JSC::CodeBlock::resetStubInternal):
2596         * bytecode/CodeBlock.h:
2597         (JSC):
2598         (CodeBlock):
2599         * bytecode/StructureStubClearingWatchpoint.cpp: Added.
2600         (JSC):
2601         (JSC::StructureStubClearingWatchpoint::~StructureStubClearingWatchpoint):
2602         (JSC::StructureStubClearingWatchpoint::push):
2603         (JSC::StructureStubClearingWatchpoint::fireInternal):
2604         (JSC::WatchpointsOnStructureStubInfo::~WatchpointsOnStructureStubInfo):
2605         (JSC::WatchpointsOnStructureStubInfo::addWatchpoint):
2606         (JSC::WatchpointsOnStructureStubInfo::ensureReferenceAndAddWatchpoint):
2607         * bytecode/StructureStubClearingWatchpoint.h: Added.
2608         (JSC):
2609         (StructureStubClearingWatchpoint):
2610         (JSC::StructureStubClearingWatchpoint::StructureStubClearingWatchpoint):
2611         (WatchpointsOnStructureStubInfo):
2612         (JSC::WatchpointsOnStructureStubInfo::WatchpointsOnStructureStubInfo):
2613         (JSC::WatchpointsOnStructureStubInfo::codeBlock):
2614         (JSC::WatchpointsOnStructureStubInfo::stubInfo):
2615         * bytecode/StructureStubInfo.h:
2616         (JSC::StructureStubInfo::reset):
2617         (JSC::StructureStubInfo::addWatchpoint):
2618         (StructureStubInfo):
2619         * dfg/DFGRepatch.cpp:
2620         (JSC::DFG::addStructureTransitionCheck):
2621         (DFG):
2622         (JSC::DFG::generateProtoChainAccessStub):
2623         (JSC::DFG::emitPutTransitionStub):
2624         * jit/JumpReplacementWatchpoint.h:
2625
2626 2012-07-12  Filip Pizlo  <fpizlo@apple.com>
2627
2628         DFG CFA may get overzealous in loops that have code that must exit
2629         https://bugs.webkit.org/show_bug.cgi?id=91188
2630
2631         Reviewed by Gavin Barraclough.
2632
2633         Ensure that if the CFA assumes that an operation must exit, then it will always exit
2634         no matter what happens after. That's necessary to preserve soundness.
2635
2636         Remove a broken fixup done by the DFG simplifier, where it was trying to say that the
2637         variable-at-head was the first access in the second block in the merge, if the first
2638         block did not read the variable. That's totally wrong, if the first block was in fact
2639         doing a phantom read. I removed that fixup and instead hardened the rest of the
2640         compiler.
2641
2642         * dfg/DFGAbstractState.cpp:
2643         (JSC::DFG::AbstractState::endBasicBlock):
2644         * dfg/DFGBasicBlock.h:
2645         (JSC::DFG::BasicBlock::BasicBlock):
2646         (BasicBlock):
2647         * dfg/DFGCFAPhase.cpp:
2648         (JSC::DFG::CFAPhase::performBlockCFA):
2649         * dfg/DFGCFGSimplificationPhase.cpp:
2650         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
2651         * dfg/DFGConstantFoldingPhase.cpp:
2652         (JSC::DFG::ConstantFoldingPhase::ConstantFoldingPhase):
2653         (JSC::DFG::ConstantFoldingPhase::run):
2654         (ConstantFoldingPhase):
2655         (JSC::DFG::ConstantFoldingPhase::foldConstants):
2656         (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
2657         * dfg/DFGVariableEventStream.cpp:
2658         (JSC::DFG::VariableEventStream::reconstruct):
2659
2660 2012-07-12  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
2661
2662         [Qt] Implement MemoryUsageSupport
2663         https://bugs.webkit.org/show_bug.cgi?id=91094
2664
2665         Reviewed by Adam Barth.
2666
2667         Compile in MemoryStatistics so we can make use of the interface.
2668
2669         * Target.pri:
2670
2671 2012-07-12  Csaba Osztrogonác  <ossy@webkit.org>
2672
2673         Remove dead code after r122392.
2674         https://bugs.webkit.org/show_bug.cgi?id=91049
2675
2676         Reviewed by Filip Pizlo.
2677
2678         * dfg/DFGSpeculativeJIT64.cpp:
2679         (JSC::DFG::SpeculativeJIT::emitCall):
2680
2681 2012-07-11  Adenilson Cavalcanti  <cavalcantii@gmail.com>
2682
2683         Build fix + remove dead code
2684         https://bugs.webkit.org/show_bug.cgi?id=91039
2685
2686         Reviewed by Filip Pizlo.
2687
2688         An unused variable was breaking compilation (thanks to warnings being treated as errors).
2689
2690         * dfg/DFGSpeculativeJIT32_64.cpp:
2691         (JSC::DFG::SpeculativeJIT::emitCall):
2692
2693 2012-07-11  Mark Rowe  <mrowe@apple.com>
2694
2695         <http://webkit.org/b/91024> Build against the latest SDK when targeting older OS X versions.
2696
2697         Reviewed by Dan Bernstein.
2698
2699         The deployment target is already set to the version that we're targeting, and it's that setting
2700         which determines which functionality from the SDK is available to us.
2701
2702         * Configurations/Base.xcconfig:
2703
2704 2012-07-11  Filip Pizlo  <fpizlo@apple.com>
2705
2706         DFG should have fast virtual calls
2707         https://bugs.webkit.org/show_bug.cgi?id=90924
2708
2709         Reviewed by Gavin Barraclough.
2710
2711         Implements virtual call support in the style of the old JIT, with the
2712         caveat that we still use the same slow path for both InternalFunction
2713         calls and JSFunction calls. Also rationalized the way that our
2714         CodeOrigin indices tie into exception checks (previously it was a
2715         strange one-to-one mapping with fairly limited assertions; now it's a
2716         one-to-many mapping for CodeOrigins to exception checks, respectively).
2717         I also took the opportunity to clean up
2718         CallLinkInfo::callReturnLocation, which previously was either a Call or
2719         a NearCall. Now it's just a NearCall. As well, exceptions during slow
2720         path call resolution are now handled by returning an exception throwing
2721         thunk rather than returning null. And finally, I made a few things
2722         public that were previously private-with-lots-of-friends, because I
2723         truly despise the thought of listing each thunk generating function as
2724         a friend of JSValue and friends.
2725
2726         * bytecode/CallLinkInfo.cpp:
2727         (JSC::CallLinkInfo::unlink):
2728         * bytecode/CallLinkInfo.h:
2729         (CallLinkInfo):
2730         * bytecode/CodeOrigin.h:
2731         (JSC::CodeOrigin::CodeOrigin):
2732         (JSC::CodeOrigin::isSet):
2733         * dfg/DFGAssemblyHelpers.h:
2734         (JSC::DFG::AssemblyHelpers::AssemblyHelpers):
2735         * dfg/DFGCCallHelpers.h:
2736         (JSC::DFG::CCallHelpers::CCallHelpers):
2737         * dfg/DFGGPRInfo.h:
2738         (GPRInfo):
2739         * dfg/DFGJITCompiler.cpp:
2740         (JSC::DFG::JITCompiler::link):
2741         (JSC::DFG::JITCompiler::compileFunction):
2742         * dfg/DFGJITCompiler.h:
2743         (JSC::DFG::CallBeginToken::CallBeginToken):
2744         (JSC::DFG::CallBeginToken::~CallBeginToken):
2745         (CallBeginToken):
2746         (JSC::DFG::CallBeginToken::set):
2747         (JSC::DFG::CallBeginToken::registerWithExceptionCheck):
2748         (JSC::DFG::CallBeginToken::codeOrigin):
2749         (JSC::DFG::CallExceptionRecord::CallExceptionRecord):
2750         (CallExceptionRecord):
2751         (JSC::DFG::JITCompiler::currentCodeOriginIndex):
2752         (JITCompiler):
2753         (JSC::DFG::JITCompiler::beginCall):
2754         (JSC::DFG::JITCompiler::notifyCall):
2755         (JSC::DFG::JITCompiler::prepareForExceptionCheck):
2756         (JSC::DFG::JITCompiler::addExceptionCheck):
2757         (JSC::DFG::JITCompiler::addFastExceptionCheck):
2758         * dfg/DFGOperations.cpp:
2759         * dfg/DFGRepatch.cpp:
2760         (JSC::DFG::dfgLinkFor):
2761         * dfg/DFGSpeculativeJIT.h:
2762         (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
2763         * dfg/DFGSpeculativeJIT32_64.cpp:
2764         (JSC::DFG::SpeculativeJIT::emitCall):
2765         * dfg/DFGSpeculativeJIT64.cpp:
2766         (JSC::DFG::SpeculativeJIT::emitCall):
2767         * dfg/DFGThunks.cpp:
2768         (JSC::DFG::emitPointerValidation):
2769         (DFG):
2770         (JSC::DFG::throwExceptionFromCallSlowPathGenerator):
2771         (JSC::DFG::slowPathFor):
2772         (JSC::DFG::linkForThunkGenerator):
2773         (JSC::DFG::linkCallThunkGenerator):
2774         (JSC::DFG::linkConstructThunkGenerator):
2775         (JSC::DFG::virtualForThunkGenerator):
2776         (JSC::DFG::virtualCallThunkGenerator):
2777         (JSC::DFG::virtualConstructThunkGenerator):
2778         * dfg/DFGThunks.h:
2779         (DFG):
2780         * jit/JIT.cpp:
2781         (JSC::JIT::privateCompile):
2782         (JSC::JIT::linkFor):
2783         * runtime/Executable.h:
2784         (ExecutableBase):
2785         (JSC::ExecutableBase::offsetOfJITCodeFor):
2786         (JSC::ExecutableBase::offsetOfNumParametersFor):
2787         * runtime/JSValue.h:
2788         (JSValue):
2789
2790 2012-07-11  Filip Pizlo  <fpizlo@apple.com>
2791
2792         Accidentally used the wrong license (3-clause instead of 2-clause) in some
2793         files I just committed.
2794
2795         Rubber stamped by Oliver Hunt.
2796
2797         * bytecode/Watchpoint.cpp:
2798         * bytecode/Watchpoint.h:
2799         * jit/JumpReplacementWatchpoint.cpp:
2800         * jit/JumpReplacementWatchpoint.h:
2801
2802 2012-07-11  Filip Pizlo  <fpizlo@apple.com>
2803
2804         Watchpoints and jump replacement should be decoupled
2805         https://bugs.webkit.org/show_bug.cgi?id=91016
2806
2807         Reviewed by Oliver Hunt.
2808
2809         * CMakeLists.txt:
2810         * GNUmakefile.list.am:
2811         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2812         * JavaScriptCore.xcodeproj/project.pbxproj:
2813         * Target.pri:
2814         * assembler/AbstractMacroAssembler.h:
2815         (JSC):
2816         (Label):
2817         * bytecode/CodeBlock.h:
2818         (JSC::CodeBlock::appendWatchpoint):
2819         (JSC::CodeBlock::watchpoint):
2820         (DFGData):
2821         * bytecode/Watchpoint.cpp:
2822         (JSC):
2823         * bytecode/Watchpoint.h:
2824         (JSC::Watchpoint::Watchpoint):
2825         (Watchpoint):
2826         (JSC::Watchpoint::fire):
2827         * dfg/DFGSpeculativeJIT.h:
2828         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
2829         * jit/JumpReplacementWatchpoint.cpp: Added.
2830         (JSC):
2831         (JSC::JumpReplacementWatchpoint::correctLabels):
2832         (JSC::JumpReplacementWatchpoint::fireInternal):
2833         * jit/JumpReplacementWatchpoint.h: Added.
2834         (JSC):
2835         (JumpReplacementWatchpoint):
2836         (JSC::JumpReplacementWatchpoint::JumpReplacementWatchpoint):
2837         (JSC::JumpReplacementWatchpoint::setDestination):
2838
2839 2012-07-11  Kevin Ollivier  <kevino@theolliviers.com>
2840
2841         [wx] Unreviewed build fix. Don't try to build udis86_itab.c since it's included by
2842         another file.
2843
2844         * wscript:
2845
2846 2012-07-11  Chao-ying Fu  <fu@mips.com>
2847
2848         Add MIPS convertibleLoadPtr and other functions
2849         https://bugs.webkit.org/show_bug.cgi?id=90714
2850
2851         Reviewed by Oliver Hunt.
2852
2853         * assembler/MIPSAssembler.h:
2854         (JSC::MIPSAssembler::labelIgnoringWatchpoints):
2855         (MIPSAssembler):
2856         (JSC::MIPSAssembler::replaceWithLoad):
2857         (JSC::MIPSAssembler::replaceWithAddressComputation):
2858         * assembler/MacroAssemblerMIPS.h:
2859         (JSC::MacroAssemblerMIPS::convertibleLoadPtr):
2860         (MacroAssemblerMIPS):
2861
2862 2012-07-11  Anders Carlsson  <andersca@apple.com>
2863
2864         Add -Wtautological-compare and -Wsign-compare warning flags
2865         https://bugs.webkit.org/show_bug.cgi?id=90994
2866
2867         Reviewed by Mark Rowe.
2868
2869         * Configurations/Base.xcconfig:
2870
2871 2012-07-11  Benjamin Poulain  <bpoulain@apple.com>
2872
2873         Simplify the copying of JSC ARMv7's LinkRecord
2874         https://bugs.webkit.org/show_bug.cgi?id=90930
2875
2876         Reviewed by Filip Pizlo.
2877
2878         The class LinkRecord is used by value everywhere in ARMv7Assembler. The compiler uses
2879         memmove() to move the objects.
2880
2881         The problem is memmove() is overkill for this object, moving the value can be done with
2882         3 load-store. This patch adds an operator= to the class doing more efficient copying.
2883         This reduces the link time by 19%.
2884
2885         * assembler/ARMv7Assembler.h:
2886         (JSC::ARMv7Assembler::LinkRecord::LinkRecord):
2887         (JSC::ARMv7Assembler::LinkRecord::operator=):
2888         (JSC::ARMv7Assembler::LinkRecord::from):
2889         (JSC::ARMv7Assembler::LinkRecord::setFrom):
2890         (JSC::ARMv7Assembler::LinkRecord::to):
2891         (JSC::ARMv7Assembler::LinkRecord::type):
2892         (JSC::ARMv7Assembler::LinkRecord::linkType):
2893         (JSC::ARMv7Assembler::LinkRecord::setLinkType):
2894         (JSC::ARMv7Assembler::LinkRecord::condition):
2895
2896 2012-07-11  Andy Wingo  <wingo@igalia.com>
2897
2898         jsc: Parse options before creating global data
2899         https://bugs.webkit.org/show_bug.cgi?id=90975
2900
2901         Reviewed by Filip Pizlo.
2902
2903         This patch moves the options parsing in "jsc" before the creation
2904         of the JSGlobalData, so that --useJIT=no has a chance to take
2905         effect.
2906
2907         * jsc.cpp:
2908         (CommandLine::parseArguments): Refactor to be a class, and take
2909         argc and argv as constructor arguments.
2910         (jscmain): Move arg parsing before JSGlobalData creation.
2911
2912 2012-07-10  Filip Pizlo  <fpizlo@apple.com>
2913
2914         REGRESSION(r122166): It made 170 tests crash on 32 bit platforms
2915         https://bugs.webkit.org/show_bug.cgi?id=90852
2916
2917         Reviewed by Zoltan Herczeg.
2918
2919         If we can't use the range filter, we should still make sure that the
2920         address is remotely sane, otherwise the hashtables will assert.
2921
2922         * jit/JITStubRoutine.h:
2923         (JSC::JITStubRoutine::passesFilter):
2924
2925 2012-07-10  Filip Pizlo  <fpizlo@apple.com>
2926
2927         DFG recompilation heuristics should be based on count, not rate
2928         https://bugs.webkit.org/show_bug.cgi?id=90146
2929
2930         Reviewed by Oliver Hunt.
2931
2932         Rolling r121511 back in after fixing the DFG's interpretation of op_div
2933         profiling, with Gavin's rubber stamp.
2934
2935         This removes a bunch of code that was previously trying to prevent spurious
2936         reoptimizations if a large enough majority of executions of a code block did
2937         not result in OSR exit. It turns out that this code was purely harmful. This
2938         patch removes all of that logic and replaces it with a dead-simple
2939         heuristic: if you exit more than N times (where N is an exponential function
2940         of the number of times the code block has already been recompiled) then we
2941         will recompile.
2942
2943         This appears to be a broad ~1% win on many benchmarks large and small.
2944
2945         * bytecode/CodeBlock.cpp:
2946         (JSC::CodeBlock::CodeBlock):
2947         * bytecode/CodeBlock.h:
2948         (JSC::CodeBlock::couldTakeSpecialFastCase):
2949         (CodeBlock):
2950         (JSC::CodeBlock::osrExitCounter):
2951         (JSC::CodeBlock::countOSRExit):
2952         (JSC::CodeBlock::addressOfOSRExitCounter):
2953         (JSC::CodeBlock::offsetOfOSRExitCounter):
2954         (JSC::CodeBlock::adjustedExitCountThreshold):
2955         (JSC::CodeBlock::exitCountThresholdForReoptimization):
2956         (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
2957         (JSC::CodeBlock::shouldReoptimizeNow):
2958         (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
2959         * bytecode/ExecutionCounter.cpp:
2960         (JSC::ExecutionCounter::setThreshold):
2961         * bytecode/ExecutionCounter.h:
2962         (ExecutionCounter):
2963         (JSC::ExecutionCounter::clippedThreshold):
2964         * dfg/DFGByteCodeParser.cpp:
2965         (JSC::DFG::ByteCodeParser::makeDivSafe):
2966         * dfg/DFGJITCompiler.cpp:
2967         (JSC::DFG::JITCompiler::compileBody):
2968         * dfg/DFGOSRExit.cpp:
2969         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
2970         * dfg/DFGOSRExitCompiler.cpp:
2971         (JSC::DFG::OSRExitCompiler::handleExitCounts):
2972         * dfg/DFGOperations.cpp:
2973         * jit/JITStubs.cpp:
2974         (JSC::DEFINE_STUB_FUNCTION):
2975         * runtime/Options.h:
2976         (JSC):
2977
2978 2012-07-09  Matt Falkenhagen  <falken@chromium.org>
2979
2980         Add ENABLE_DIALOG_ELEMENT and skeleton files
2981         https://bugs.webkit.org/show_bug.cgi?id=90521
2982
2983         Reviewed by Kent Tamura.
2984
2985         * Configurations/FeatureDefines.xcconfig:
2986
2987 2012-07-09  Filip Pizlo  <fpizlo@apple.com>
2988
2989         Unreviewed, roll out http://trac.webkit.org/changeset/121511
2990         It made in-browser V8v7 10% slower.
2991
2992         * bytecode/CodeBlock.cpp:
2993         (JSC::CodeBlock::CodeBlock):
2994         * bytecode/CodeBlock.h:
2995         (CodeBlock):
2996         (JSC::CodeBlock::countSpeculationSuccess):
2997         (JSC::CodeBlock::countSpeculationFailure):
2998         (JSC::CodeBlock::speculativeSuccessCounter):
2999         (JSC::CodeBlock::speculativeFailCounter):
3000         (JSC::CodeBlock::forcedOSRExitCounter):
3001         (JSC::CodeBlock::addressOfSpeculativeSuccessCounter):
3002         (JSC::CodeBlock::addressOfSpeculativeFailCounter):
3003         (JSC::CodeBlock::addressOfForcedOSRExitCounter):
3004         (JSC::CodeBlock::offsetOfSpeculativeSuccessCounter):
3005         (JSC::CodeBlock::offsetOfSpeculativeFailCounter):
3006         (JSC::CodeBlock::offsetOfForcedOSRExitCounter):
3007         (JSC::CodeBlock::largeFailCountThreshold):
3008         (JSC::CodeBlock::largeFailCountThresholdForLoop):
3009         (JSC::CodeBlock::shouldReoptimizeNow):
3010         (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
3011         * bytecode/ExecutionCounter.cpp:
3012         (JSC::ExecutionCounter::setThreshold):
3013         * bytecode/ExecutionCounter.h:
3014         (ExecutionCounter):
3015         * dfg/DFGJITCompiler.cpp:
3016         (JSC::DFG::JITCompiler::compileBody):
3017         * dfg/DFGOSRExit.cpp:
3018         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
3019         * dfg/DFGOSRExitCompiler.cpp:
3020         (JSC::DFG::OSRExitCompiler::handleExitCounts):
3021         * dfg/DFGOperations.cpp:
3022         * jit/JITStubs.cpp:
3023         (JSC::DEFINE_STUB_FUNCTION):
3024         * runtime/Options.h:
3025         (JSC):
3026
3027 2012-07-09  Filip Pizlo  <fpizlo@apple.com>
3028
3029         DFG may get stuck in an infinite fix point if it constant folds a mispredicted node
3030         https://bugs.webkit.org/show_bug.cgi?id=90829
3031         <rdar://problem/11823843>
3032
3033         Reviewed by Oliver Hunt.
3034
3035         If a node is shown to have been mispredicted during CFA, then don't allow constant
3036         folding to make the graph even more degenerate. Instead, pull back on constant folding
3037         and allow the normal OSR machinery to fix our profiling so that a future recompilation
3038         doesn't see the same mistake.
3039
3040         * dfg/DFGAbstractState.cpp:
3041         (JSC::DFG::AbstractState::execute):
3042         * dfg/DFGAbstractState.h:
3043         (JSC::DFG::AbstractState::trySetConstant):
3044         (AbstractState):
3045         * dfg/DFGPhase.h:
3046         (JSC::DFG::Phase::name):
3047         (Phase):
3048         (JSC::DFG::runAndLog):
3049         (DFG):
3050         (JSC::DFG::runPhase):
3051
3052 2012-07-09  Filip Pizlo  <fpizlo@apple.com>
3053
3054         It should be possible to jettison JIT stub routines even if they are currently running
3055         https://bugs.webkit.org/show_bug.cgi?id=90731
3056
3057         Reviewed by Gavin Barraclough.
3058
3059         This gives the GC awareness of all JIT-generated stubs for inline caches. That
3060         means that if you want to delete a JIT-generated stub, you don't have to worry
3061         about whether or not it is currently running: if there is a chance that it might
3062         be, the GC will kindly defer deletion until non-running-ness is proved.
3063
3064         * CMakeLists.txt:
3065         * GNUmakefile.list.am:
3066         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3067         * JavaScriptCore.xcodeproj/project.pbxproj:
3068         * Target.pri:
3069         * bytecode/Instruction.h:
3070         (JSC):
3071         (PolymorphicStubInfo):
3072         (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
3073         (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
3074         * bytecode/PolymorphicPutByIdList.cpp:
3075         (JSC::PutByIdAccess::fromStructureStubInfo):
3076         * bytecode/PolymorphicPutByIdList.h:
3077         (JSC::PutByIdAccess::transition):
3078         (JSC::PutByIdAccess::replace):
3079         (JSC::PutByIdAccess::stubRoutine):
3080         (PutByIdAccess):
3081         (JSC::PolymorphicPutByIdList::currentSlowPathTarget):
3082         * bytecode/StructureStubInfo.h:
3083         (JSC::StructureStubInfo::reset):
3084         * dfg/DFGRepatch.cpp:
3085         (JSC::DFG::generateProtoChainAccessStub):
3086         (JSC::DFG::tryCacheGetByID):
3087         (JSC::DFG::tryBuildGetByIDList):
3088         (JSC::DFG::tryBuildGetByIDProtoList):
3089         (JSC::DFG::emitPutReplaceStub):
3090         (JSC::DFG::emitPutTransitionStub):
3091         (JSC::DFG::tryCachePutByID):
3092         (JSC::DFG::tryBuildPutByIdList):
3093         * heap/ConservativeRoots.cpp:
3094         (JSC):
3095         (DummyMarkHook):
3096         (JSC::DummyMarkHook::mark):
3097         (JSC::ConservativeRoots::add):
3098         (CompositeMarkHook):
3099         (JSC::CompositeMarkHook::CompositeMarkHook):
3100         (JSC::CompositeMarkHook::mark):
3101         * heap/ConservativeRoots.h:
3102         (JSC):
3103         (ConservativeRoots):
3104         * heap/Heap.cpp:
3105         (JSC::Heap::markRoots):
3106         (JSC::Heap::deleteUnmarkedCompiledCode):
3107         * heap/Heap.h:
3108         (JSC):
3109         (Heap):
3110         * heap/JITStubRoutineSet.cpp: Added.
3111         (JSC):
3112         (JSC::JITStubRoutineSet::JITStubRoutineSet):
3113         (JSC::JITStubRoutineSet::~JITStubRoutineSet):
3114         (JSC::JITStubRoutineSet::add):
3115         (JSC::JITStubRoutineSet::clearMarks):
3116         (JSC::JITStubRoutineSet::markSlow):
3117         (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
3118         (JSC::JITStubRoutineSet::traceMarkedStubRoutines):
3119         * heap/JITStubRoutineSet.h: Added.
3120         (JSC):
3121         (JITStubRoutineSet):
3122         (JSC::JITStubRoutineSet::mark):
3123         * heap/MachineStackMarker.h:
3124         (JSC):
3125         * interpreter/RegisterFile.cpp:
3126         (JSC::RegisterFile::gatherConservativeRoots):
3127         * interpreter/RegisterFile.h:
3128         (JSC):
3129         * jit/ExecutableAllocator.cpp:
3130         (JSC::DemandExecutableAllocator::DemandExecutableAllocator):
3131         * jit/ExecutableAllocator.h:
3132         (JSC):
3133         * jit/ExecutableAllocatorFixedVMPool.cpp:
3134         (JSC):
3135         (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
3136         * jit/GCAwareJITStubRoutine.cpp: Added.
3137         (JSC):
3138         (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
3139         (JSC::GCAwareJITStubRoutine::~GCAwareJITStubRoutine):
3140         (JSC::GCAwareJITStubRoutine::observeZeroRefCount):
3141         (JSC::GCAwareJITStubRoutine::deleteFromGC):
3142         (JSC::GCAwareJITStubRoutine::markRequiredObjectsInternal):
3143         (JSC::MarkingGCAwareJITStubRoutineWithOneObject::MarkingGCAwareJITStubRoutineWithOneObject):
3144         (JSC::MarkingGCAwareJITStubRoutineWithOneObject::~MarkingGCAwareJITStubRoutineWithOneObject):
3145         (JSC::MarkingGCAwareJITStubRoutineWithOneObject::markRequiredObjectsInternal):
3146         (JSC::createJITStubRoutine):
3147         * jit/GCAwareJITStubRoutine.h: Added.
3148         (JSC):
3149         (GCAwareJITStubRoutine):
3150         (JSC::GCAwareJITStubRoutine::markRequiredObjects):
3151         (MarkingGCAwareJITStubRoutineWithOneObject):
3152         * jit/JITPropertyAccess.cpp:
3153         (JSC::JIT::privateCompilePutByIdTransition):
3154         (JSC::JIT::privateCompilePatchGetArrayLength):
3155         (JSC::JIT::privateCompileGetByIdProto):
3156         (JSC::JIT::privateCompileGetByIdSelfList):
3157         (JSC::JIT::privateCompileGetByIdProtoList):
3158         (JSC::JIT::privateCompileGetByIdChainList):
3159         (JSC::JIT::privateCompileGetByIdChain):
3160         * jit/JITPropertyAccess32_64.cpp:
3161         (JSC::JIT::privateCompilePutByIdTransition):
3162         (JSC::JIT::privateCompilePatchGetArrayLength):
3163         (JSC::JIT::privateCompileGetByIdProto):
3164         (JSC::JIT::privateCompileGetByIdSelfList):
3165         (JSC::JIT::privateCompileGetByIdProtoList):
3166         (JSC::JIT::privateCompileGetByIdChainList):
3167         (JSC::JIT::privateCompileGetByIdChain):
3168         * jit/JITStubRoutine.cpp: Added.
3169         (JSC):
3170         (JSC::JITStubRoutine::~JITStubRoutine):
3171         (JSC::JITStubRoutine::observeZeroRefCount):
3172         * jit/JITStubRoutine.h: Added.
3173         (JSC):
3174         (JITStubRoutine):
3175         (JSC::JITStubRoutine::JITStubRoutine):
3176         (JSC::JITStubRoutine::createSelfManagedRoutine):
3177         (JSC::JITStubRoutine::code):
3178         (JSC::JITStubRoutine::asCodePtr):
3179         (JSC::JITStubRoutine::ref):
3180         (JSC::JITStubRoutine::deref):
3181         (JSC::JITStubRoutine::startAddress):
3182         (JSC::JITStubRoutine::endAddress):
3183         (JSC::JITStubRoutine::addressStep):
3184         (JSC::JITStubRoutine::canPerformRangeFilter):
3185         (JSC::JITStubRoutine::filteringStartAddress):
3186         (JSC::JITStubRoutine::filteringExtentSize):
3187         (JSC::JITStubRoutine::passesFilter):
3188         * jit/JITStubs.cpp:
3189         (JSC::DEFINE_STUB_FUNCTION):
3190         (JSC::getPolymorphicAccessStructureListSlot):
3191
3192 2012-07-09  Sheriff Bot  <webkit.review.bot@gmail.com>
3193
3194         Unreviewed, rolling out r122107.
3195         http://trac.webkit.org/changeset/122107
3196         https://bugs.webkit.org/show_bug.cgi?id=90794
3197
3198         Build failure on Mac debug bots (Requested by falken_ on
3199         #webkit).
3200
3201         * Configurations/FeatureDefines.xcconfig:
3202
3203 2012-07-09  Matt Falkenhagen  <falken@chromium.org>
3204
3205         Add ENABLE_DIALOG_ELEMENT and skeleton files
3206         https://bugs.webkit.org/show_bug.cgi?id=90521
3207
3208         Reviewed by Kent Tamura.
3209
3210         * Configurations/FeatureDefines.xcconfig:
3211
3212 2012-07-08  Ryosuke Niwa  <rniwa@webkit.org>
3213
3214         gcc build fix after r121925.
3215
3216         * runtime/JSObject.h:
3217         (JSC::JSFinalObject::finishCreation):
3218
3219 2012-07-08  Zoltan Herczeg  <zherczeg@webkit.org>
3220
3221         [Qt][ARM] Implementing missing macro assembler instructions after r121925
3222         https://bugs.webkit.org/show_bug.cgi?id=90657
3223
3224         Reviewed by Csaba Osztrogonác.
3225
3226         Implementing convertibleLoadPtr, replaceWithLoad and
3227         replaceWithAddressComputation.
3228
3229         * assembler/ARMAssembler.h:
3230         (JSC::ARMAssembler::replaceWithLoad):
3231         (ARMAssembler):
3232         (JSC::ARMAssembler::replaceWithAddressComputation):
3233         * assembler/MacroAssemblerARM.h:
3234         (JSC::MacroAssemblerARM::convertibleLoadPtr):
3235         (MacroAssemblerARM):
3236
3237 2012-07-06  Filip Pizlo  <fpizlo@apple.com>
3238
3239         WebKit Version 5.1.7 (6534.57.2, r121935): Double-click no longer works on OpenStreetMap
3240         https://bugs.webkit.org/show_bug.cgi?id=90703
3241
3242         Reviewed by Michael Saboff.
3243
3244         It turns out that in my object model refactoring, I managed to fix get_by_pname in all
3245         execution engines except 64-bit baseline JIT.
3246
3247         * jit/JITPropertyAccess.cpp:
3248         (JSC::JIT::emit_op_get_by_pname):
3249
3250 2012-07-06  Pravin D  <pravind.2k4@gmail.com>
3251
3252         Build Error on Qt Linux build
3253         https://bugs.webkit.org/show_bug.cgi?id=90699
3254
3255         Reviewed by Laszlo Gombos.
3256
3257         * parser/Parser.cpp:
3258         (JSC::::parseForStatement):
3259         Removed unused boolean variable as this was causing build error on Qt Linux.
3260
3261 2012-07-06  Nuno Lopes  <nlopes@apple.com>
3262
3263         Fix build with recent clang.
3264         https://bugs.webkit.org/show_bug.cgi?id=90634
3265
3266         Reviewed by Oliver Hunt.
3267
3268         * jit/SpecializedThunkJIT.h:
3269         (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
3270         (SpecializedThunkJIT):
3271         * jit/ThunkGenerators.cpp:
3272         (JSC::charCodeAtThunkGenerator):
3273         (JSC::charAtThunkGenerator):
3274         (JSC::fromCharCodeThunkGenerator):
3275         (JSC::sqrtThunkGenerator):
3276         (JSC::floorThunkGenerator):
3277         (JSC::ceilThunkGenerator):
3278         (JSC::roundThunkGenerator):
3279         (JSC::expThunkGenerator):
3280         (JSC::logThunkGenerator):
3281         (JSC::absThunkGenerator):
3282         (JSC::powThunkGenerator):
3283         * parser/ASTBuilder.h:
3284         (JSC::ASTBuilder::createAssignResolve):
3285         (JSC::ASTBuilder::createForLoop):
3286         (JSC::ASTBuilder::createForInLoop):
3287         (JSC::ASTBuilder::makeAssignNode):
3288         (JSC::ASTBuilder::makePrefixNode):
3289         (JSC::ASTBuilder::makePostfixNode):
3290         * parser/NodeConstructors.h:
3291         (JSC::PostfixErrorNode::PostfixErrorNode):
3292         (JSC::PrefixErrorNode::PrefixErrorNode):
3293         (JSC::AssignResolveNode::AssignResolveNode):
3294         (JSC::AssignErrorNode::AssignErrorNode):
3295         (JSC::ForNode::ForNode):
3296         (JSC::ForInNode::ForInNode):
3297         * parser/Nodes.h:
3298         (FunctionCallResolveNode):
3299         (PostfixErrorNode):
3300         (PrefixErrorNode):
3301         (ReadModifyResolveNode):
3302         (AssignResolveNode):
3303         (AssignErrorNode):
3304         (ForNode):
3305         (ForInNode):
3306         * parser/Parser.cpp:
3307         (JSC::::parseVarDeclarationList):
3308         (JSC::::parseForStatement):
3309         * parser/SyntaxChecker.h:
3310         (JSC::SyntaxChecker::createAssignResolve):
3311         (JSC::SyntaxChecker::createForLoop):
3312
3313 2012-07-06  Zoltan Herczeg  <zherczeg@webkit.org>
3314
3315         [Qt][ARM] REGRESSION(r121885): It broke 30 jsc tests, 500+ layout tests
3316         https://bugs.webkit.org/show_bug.cgi?id=90656
3317
3318         Reviewed by Csaba Osztrogonác.
3319
3320         Typo fixes.
3321
3322         * assembler/MacroAssemblerARM.cpp:
3323         (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
3324         Rename getOp2Byte() -> getOp2Half()
3325         * assembler/MacroAssemblerARMv7.h:
3326         (JSC::MacroAssemblerARMv7::convertibleLoadPtr):
3327         Add a necessary space.
3328         * jit/JITStubs.cpp:
3329         (JSC):
3330         Revert INLINE_ARM_FUNCTION macro.
3331
3332 2012-07-05  Filip Pizlo  <fpizlo@apple.com>
3333
3334         REGRESSION(r121925): It broke 5 sputnik tests on x86 platforms
3335         https://bugs.webkit.org/show_bug.cgi?id=90658
3336
3337         Reviewed by Zoltan Herczeg.
3338
3339         Under the new object model, out-of-line property accesses such as those
3340         in ResolveGlobal must account for the fact that the offset to the Kth
3341         property is represented by K + inlineStorageCapacity. Hence, the property
3342         loads in ResolveGlobal must have an additional -inlineStorageCapacity *
3343         sizeof(JSValue) offset.
3344
3345         * dfg/DFGSpeculativeJIT32_64.cpp:
3346         (JSC::DFG::SpeculativeJIT::compile):
3347
3348 2012-07-05  Csaba Osztrogonác  <ossy@webkit.org>
3349
3350         [Qt] Unreviewed 64 bit buildfix after r121925.
3351
3352         * bytecode/PutByIdStatus.cpp:
3353         (JSC::PutByIdStatus::computeFromLLInt):
3354
3355 2012-07-05  Michael Saboff  <msaboff@apple.com>
3356
3357         JSString::tryHashConstLock() fails to get exclusive lock
3358         https://bugs.webkit.org/show_bug.cgi?id=90639
3359
3360         Reviewed by Oliver Hunt.
3361
3362         Added check that the string is already locked even before compare and swap.
3363
3364         * heap/MarkStack.cpp:
3365         (JSC::JSString::tryHashConstLock):
3366
3367 2012-07-04  Filip Pizlo  <fpizlo@apple.com>
3368
3369         Inline property storage should not be wasted when it is exhausted
3370         https://bugs.webkit.org/show_bug.cgi?id=90347
3371
3372         Reviewed by Gavin Barraclough.
3373
3374         Previously, if we switched an object from using inline storage to out-of-line
3375         storage, we would abandon the inline storage. This would have two main implications:
3376         (i) all accesses to the object, even for properties that were previously in inline
3377         storage, must now take an extra indirection; and (ii) we waste a non-trivial amount
3378         of space since we must allocate additional out-of-line storage to hold properties
3379         that would have fit in the inline storage. There's also the copying cost when
3380         switching to out-of-line storage - we must copy all inline properties into ouf-of-line
3381         storage.
3382
3383         This patch changes the way that object property storage works so that we can use both
3384         inline and out-of-line storage concurrently. This is accomplished by introducing a
3385         new notion of property offset. This PropertyOffset is a 32-bit signed integer and it
3386         behaves as follows:
3387
3388         offset == -1: invalid offset, indicating a property that does not exist.
3389
3390         0 <= offset <= inlineStorageCapacity: offset into inline storage.
3391
3392         inlineStorageCapacity < offset: offset into out-of-line storage.
3393
3394         Because non-final objects don't have inline storage, the only valid PropertyOffsets
3395         for those objects' properties are -1 or > inlineStorageCapacity.
3396
3397         This now means that the decision to use inline or out-of-line storage for an access is
3398         made based on the offset, rather than the structure. It also means that any access
3399         where the offset is a variable must have an extra branch, unless the type of the
3400         object is also known (if it's known to be a non-final object then we can just assert
3401         that the offset is >= inlineStorageCapacity).
3402
3403         This looks like a big Kraken speed-up and a slight V8 speed-up.
3404
3405         * GNUmakefile.list.am:
3406         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3407         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3408         * JavaScriptCore.xcodeproj/project.pbxproj:
3409         * assembler/ARMv7Assembler.h:
3410         (ARMv7Assembler):
3411         (JSC::ARMv7Assembler::ldrWide8BitImmediate):
3412         (JSC::ARMv7Assembler::replaceWithLoad):
3413         (JSC::ARMv7Assembler::replaceWithAddressComputation):
3414         * assembler/AbstractMacroAssembler.h:
3415         (AbstractMacroAssembler):
3416         (ConvertibleLoadLabel):
3417         (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::ConvertibleLoadLabel):
3418         (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::isSet):
3419         (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints):
3420         (JSC::AbstractMacroAssembler::replaceWithLoad):
3421         (JSC::AbstractMacroAssembler::replaceWithAddressComputation):
3422         * assembler/CodeLocation.h:
3423         (JSC):
3424         (CodeLocationCommon):
3425         (CodeLocationConvertibleLoad):
3426         (JSC::CodeLocationConvertibleLoad::CodeLocationConvertibleLoad):
3427         (JSC::CodeLocationCommon::convertibleLoadAtOffset):
3428         * assembler/LinkBuffer.cpp:
3429         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
3430         * assembler/LinkBuffer.h:
3431         (LinkBuffer):
3432         (JSC::LinkBuffer::locationOf):
3433         * assembler/MacroAssemblerARMv7.h:
3434         (MacroAssemblerARMv7):
3435         (JSC::MacroAssemblerARMv7::convertibleLoadPtr):
3436         * assembler/MacroAssemblerX86.h:
3437         (JSC::MacroAssemblerX86::convertibleLoadPtr):
3438         (MacroAssemblerX86):
3439         * assembler/MacroAssemblerX86_64.h:
3440         (JSC::MacroAssemblerX86_64::convertibleLoadPtr):
3441         (MacroAssemblerX86_64):
3442         * assembler/RepatchBuffer.h:
3443         (RepatchBuffer):
3444         (JSC::RepatchBuffer::replaceWithLoad):
3445         (JSC::RepatchBuffer::replaceWithAddressComputation):
3446         (JSC::RepatchBuffer::setLoadInstructionIsActive):
3447         * assembler/X86Assembler.h:
3448         (JSC::X86Assembler::replaceWithLoad):
3449         (X86Assembler):
3450         (JSC::X86Assembler::replaceWithAddressComputation):
3451         * bytecode/CodeBlock.cpp:
3452         (JSC::CodeBlock::printGetByIdOp):
3453         (JSC::CodeBlock::dump):
3454         (JSC::CodeBlock::finalizeUnconditionally):
3455         * bytecode/GetByIdStatus.cpp:
3456         (JSC::GetByIdStatus::computeFromLLInt):
3457         (JSC::GetByIdStatus::computeForChain):
3458         (JSC::GetByIdStatus::computeFor):
3459         * bytecode/GetByIdStatus.h:
3460         (JSC::GetByIdStatus::GetByIdStatus):
3461         (JSC::GetByIdStatus::offset):
3462         (GetByIdStatus):
3463         * bytecode/Opcode.h:
3464         (JSC):
3465         (JSC::padOpcodeName):
3466         * bytecode/PutByIdStatus.cpp:
3467         (JSC::PutByIdStatus::computeFromLLInt):
3468         (JSC::PutByIdStatus::computeFor):
3469         * bytecode/PutByIdStatus.h:
3470         (JSC::PutByIdStatus::PutByIdStatus):
3471         (JSC::PutByIdStatus::offset):
3472         (PutByIdStatus):
3473         * bytecode/ResolveGlobalStatus.cpp:
3474         (JSC):
3475         (JSC::computeForStructure):
3476         * bytecode/ResolveGlobalStatus.h:
3477         (JSC::ResolveGlobalStatus::ResolveGlobalStatus):
3478         (JSC::ResolveGlobalStatus::offset):
3479         (ResolveGlobalStatus):
3480         * bytecode/StructureSet.h:
3481         (StructureSet):
3482         * bytecode/StructureStubInfo.h:
3483         * dfg/DFGByteCodeParser.cpp:
3484         (ByteCodeParser):
3485         (JSC::DFG::ByteCodeParser::handleGetByOffset):
3486         (JSC::DFG::ByteCodeParser::handleGetById):
3487         (JSC::DFG::ByteCodeParser::parseBlock):
3488         * dfg/DFGCapabilities.h:
3489         (JSC::DFG::canCompileOpcode):
3490         * dfg/DFGJITCompiler.cpp:
3491         (JSC::DFG::JITCompiler::link):
3492         * dfg/DFGJITCompiler.h:
3493         (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
3494         (PropertyAccessRecord):
3495         * dfg/DFGRepatch.cpp:
3496         (JSC::DFG::dfgRepatchByIdSelfAccess):
3497         (JSC::DFG::generateProtoChainAccessStub):
3498         (JSC::DFG::tryCacheGetByID):
3499         (JSC::DFG::tryBuildGetByIDList):
3500         (JSC::DFG::tryBuildGetByIDProtoList):
3501         (JSC::DFG::emitPutReplaceStub):
3502         (JSC::DFG::emitPutTransitionStub):
3503         (JSC::DFG::tryCachePutByID):
3504         (JSC::DFG::tryBuildPutByIdList):
3505         * dfg/DFGSpeculativeJIT.h:
3506         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
3507         * dfg/DFGSpeculativeJIT32_64.cpp:
3508         (JSC::DFG::SpeculativeJIT::cachedGetById):
3509         (JSC::DFG::SpeculativeJIT::cachedPutById):
3510         (JSC::DFG::SpeculativeJIT::compile):
3511         * dfg/DFGSpeculativeJIT64.cpp:
3512         (JSC::DFG::SpeculativeJIT::cachedGetById):
3513         (JSC::DFG::SpeculativeJIT::cachedPutById):
3514         (JSC::DFG::SpeculativeJIT::compile):
3515         * heap/MarkStack.cpp:
3516         (JSC::visitChildren):
3517         * interpreter/Interpreter.cpp:
3518         (JSC::Interpreter::tryCacheGetByID):
3519         (JSC::Interpreter::privateExecute):
3520         * jit/JIT.cpp:
3521         (JSC::JIT::privateCompileMainPass):
3522         (JSC::JIT::privateCompileSlowCases):
3523         (JSC::PropertyStubCompilationInfo::copyToStubInfo):
3524         * jit/JIT.h:
3525         (JSC::PropertyStubCompilationInfo::PropertyStubCompilationInfo):
3526         (JSC::JIT::compileGetByIdProto):
3527         (JSC::JIT::compileGetByIdSelfList):
3528         (JSC::JIT::compileGetByIdProtoList):
3529         (JSC::JIT::compileGetByIdChainList):
3530         (JSC::JIT::compileGetByIdChain):
3531         (JSC::JIT::compilePutByIdTransition):
3532         (JIT):
3533         * jit/JITInlineMethods.h:
3534         (JSC::JIT::emitAllocateBasicJSObject):
3535         * jit/JITOpcodes.cpp:
3536         (JSC::JIT::emit_op_resolve_global):
3537         * jit/JITOpcodes32_64.cpp:
3538         (JSC::JIT::emit_op_resolve_global):
3539         * jit/JITPropertyAccess.cpp:
3540         (JSC::JIT::compileGetDirectOffset):
3541         (JSC::JIT::emit_op_method_check):
3542         (JSC::JIT::compileGetByIdHotPath):
3543         (JSC::JIT::emit_op_put_by_id):
3544         (JSC::JIT::compilePutDirectOffset):
3545         (JSC::JIT::privateCompilePutByIdTransition):
3546         (JSC::JIT::patchGetByIdSelf):
3547         (JSC::JIT::patchPutByIdReplace):
3548         (JSC::JIT::privateCompileGetByIdProto):
3549         (JSC::JIT::privateCompileGetByIdSelfList):
3550         (JSC::JIT::privateCompileGetByIdProtoList):
3551         (JSC::JIT::privateCompileGetByIdChainList):
3552         (JSC::JIT::privateCompileGetByIdChain):
3553         * jit/JITPropertyAccess32_64.cpp:
3554         (JSC::JIT::emit_op_method_check):
3555         (JSC::JIT::compileGetByIdHotPath):
3556         (JSC::JIT::emit_op_put_by_id):
3557         (JSC::JIT::compilePutDirectOffset):
3558         (JSC::JIT::compileGetDirectOffset):
3559         (JSC::JIT::privateCompilePutByIdTransition):
3560         (JSC::JIT::patchGetByIdSelf):
3561         (JSC::JIT::patchPutByIdReplace):
3562         (JSC::JIT::privateCompileGetByIdProto):
3563         (JSC::JIT::privateCompileGetByIdSelfList):
3564         (JSC::JIT::privateCompileGetByIdProtoList):
3565         (JSC::JIT::privateCompileGetByIdChainList):
3566         (JSC::JIT::privateCompileGetByIdChain):
3567         (JSC::JIT::emit_op_get_by_pname):
3568         * jit/JITStubs.cpp:
3569         (JSC::JITThunks::tryCacheGetByID):
3570         (JSC::DEFINE_STUB_FUNCTION):
3571         * llint/LLIntSlowPaths.cpp:
3572         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3573         * llint/LowLevelInterpreter.asm:
3574         * llint/LowLevelInterpreter32_64.asm:
3575         * llint/LowLevelInterpreter64.asm:
3576         * offlineasm/x86.rb:
3577         * runtime/JSGlobalObject.h:
3578         (JSGlobalObject):
3579         (JSC::JSGlobalObject::functionNameOffset):
3580         * runtime/JSObject.cpp:
3581         (JSC::JSObject::visitChildren):
3582         (JSC):
3583         (JSC::JSFinalObject::visitChildren):
3584         (JSC::JSObject::put):
3585         (JSC::JSObject::deleteProperty):
3586         (JSC::JSObject::getPropertySpecificValue):
3587         (JSC::JSObject::removeDirect):
3588         (JSC::JSObject::growOutOfLineStorage):
3589         (JSC::JSObject::getOwnPropertyDescriptor):
3590         * runtime/JSObject.h:
3591         (JSObject):
3592         (JSC::JSObject::getDirect):
3593         (JSC::JSObject::getDirectLocation):
3594         (JSC::JSObject::hasInlineStorage):
3595         (JSC::JSObject::inlineStorageUnsafe):
3596         (JSC::JSObject::inlineStorage):
3597         (JSC::JSObject::outOfLineStorage):
3598         (JSC::JSObject::locationForOffset):
3599         (JSC::JSObject::offsetForLocation):
3600         (JSC::JSObject::getDirectOffset):
3601         (JSC::JSObject::putDirectOffset):
3602         (JSC::JSObject::putUndefinedAtDirectOffset):
3603         (JSC::JSObject::addressOfOutOfLineStorage):
3604         (JSC::JSObject::finishCreation):
3605         (JSC::JSNonFinalObject::JSNonFinalObject):
3606         (JSC::JSNonFinalObject::finishCreation):
3607         (JSFinalObject):
3608         (JSC::JSFinalObject::finishCreation):
3609         (JSC::JSFinalObject::JSFinalObject):
3610         (JSC::JSObject::offsetOfOutOfLineStorage):
3611         (JSC::JSObject::setOutOfLineStorage):
3612         (JSC::JSObject::JSObject):
3613         (JSC):
3614         (JSC::JSCell::fastGetOwnProperty):
3615         (JSC::JSObject::putDirectInternal):
3616         (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
3617         (JSC::JSObject::putDirectWithoutTransition):
3618         (JSC::offsetRelativeToPatchedStorage):
3619         (JSC::indexRelativeToBase):
3620         (JSC::offsetRelativeToBase):
3621         * runtime/JSPropertyNameIterator.cpp:
3622         (JSC::JSPropertyNameIterator::create):
3623         * runtime/JSPropertyNameIterator.h:
3624         (JSPropertyNameIterator):
3625         (JSC::JSPropertyNameIterator::getOffset):
3626         (JSC::JSPropertyNameIterator::finishCreation):
3627         * runtime/JSValue.cpp:
3628         (JSC::JSValue::putToPrimitive):
3629         * runtime/Operations.h:
3630         (JSC::normalizePrototypeChain):
3631         * runtime/Options.cpp:
3632         (JSC):
3633         (JSC::Options::initialize):
3634         * runtime/PropertyMapHashTable.h:
3635         (PropertyMapEntry):
3636         (JSC::PropertyMapEntry::PropertyMapEntry):
3637         (PropertyTable):
3638         (JSC::PropertyTable::PropertyTable):
3639         (JSC::PropertyTable::getDeletedOffset):
3640         (JSC::PropertyTable::addDeletedOffset):
3641         (JSC::PropertyTable::nextOffset):
3642         (JSC):
3643         (JSC::PropertyTable::sizeInMemory):
3644         * runtime/PropertyOffset.h: Added.
3645         (JSC):
3646         (JSC::checkOffset):
3647         (JSC::validateOffset):
3648         (JSC::isValidOffset):
3649         (JSC::isInlineOffset):
3650         (JSC::isOutOfLineOffset):
3651         (JSC::offsetInInlineStorage):
3652         (JSC::offsetInOutOfLineStorage):
3653         (JSC::offsetInRespectiveStorage):
3654         (JSC::numberOfOutOfLineSlotsForLastOffset):
3655         (JSC::numberOfSlotsForLastOffset):
3656         (JSC::nextPropertyOffsetFor):
3657         (JSC::firstPropertyOffsetFor):
3658         * runtime/PropertySlot.h:
3659         (JSC::PropertySlot::cachedOffset):
3660         (JSC::PropertySlot::setValue):
3661         (JSC::PropertySlot::setCacheableGetterSlot):
3662         (JSC::PropertySlot::clearOffset):
3663         * runtime/PutPropertySlot.h:
3664         (JSC::PutPropertySlot::setExistingProperty):
3665         (JSC::PutPropertySlot::setNewProperty):
3666         (JSC::PutPropertySlot::cachedOffset):
3667         (PutPropertySlot):
3668         * runtime/Structure.cpp:
3669         (JSC::Structure::Structure):
3670         (JSC::Structure::materializePropertyMap):
3671         (JSC::nextOutOfLineStorageCapacity):
3672         (JSC::Structure::growOutOfLineCapacity):
3673         (JSC::Structure::suggestedNewOutOfLineStorageCapacity):
3674         (JSC::Structure::addPropertyTransitionToExistingStructure):
3675         (JSC::Structure::addPropertyTransition):
3676         (JSC::Structure::removePropertyTransition):
3677         (JSC::Structure::flattenDictionaryStructure):
3678         (JSC::Structure::addPropertyWithoutTransition):
3679         (JSC::Structure::removePropertyWithoutTransition):
3680         (JSC::Structure::copyPropertyTableForPinning):
3681         (JSC::Structure::get):
3682         (JSC::Structure::putSpecificValue):
3683         (JSC::Structure::remove):
3684         * runtime/Structure.h:
3685         (Structure):
3686         (JSC::Structure::putWillGrowOutOfLineStorage):
3687         (JSC::Structure::previousID):
3688         (JSC::Structure::outOfLineCapacity):
3689         (JSC::Structure::outOfLineSizeForKnownFinalObject):
3690         (JSC::Structure::outOfLineSizeForKnownNonFinalObject):
3691         (JSC::Structure::outOfLineSize):
3692         (JSC::Structure::hasInlineStorage):
3693         (JSC::Structure::inlineCapacity):
3694         (JSC::Structure::inlineSizeForKnownFinalObject):
3695         (JSC::Structure::inlineSize):
3696         (JSC::Structure::totalStorageSize):
3697         (JSC::Structure::totalStorageCapacity):
3698         (JSC::Structure::firstValidOffset):
3699         (JSC::Structure::lastValidOffset):
3700         (JSC::Structure::isValidOffset):
3701         (JSC::Structure::isEmpty):
3702         (JSC::Structure::transitionCount):
3703         (JSC::Structure::get):
3704
3705 2012-07-05  Oliver Hunt  <oliver@apple.com>
3706
3707         JSObjectCallAsFunction should thisConvert the provided thisObject
3708         https://bugs.webkit.org/show_bug.cgi?id=90628
3709
3710         Reviewed by Gavin Barraclough.
3711
3712         Perform this conversion on the provided this object.
3713
3714         * API/JSObjectRef.cpp:
3715         (JSObjectCallAsFunction):
3716
3717 2012-07-05  Zoltan Herczeg  <zherczeg@webkit.org>
3718
3719         [Qt] Unreviewed buildfix after r121886. Typo fix.
3720
3721         * assembler/MacroAssemblerARM.cpp:
3722         (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
3723
3724 2012-07-05  Zoltan Herczeg  <zherczeg@webkit.org>
3725
3726         Port DFG JIT to traditional ARM
3727         https://bugs.webkit.org/show_bug.cgi?id=90198
3728
3729         Reviewed by Filip Pizlo.
3730
3731         This patch contains the macro assembler part of the
3732         DFG JIT support on ARM systems with fixed 32 bit instruction
3733         width. A large amount of old code was refactored, and the ARMv4
3734         or lower support is removed from the macro assembler.
3735
3736         Sunspider is improved by 8%, and V8 is 92%.
3737
3738         * assembler/ARMAssembler.cpp:
3739         (JSC::ARMAssembler::dataTransfer32):
3740         (JSC::ARMAssembler::baseIndexTransfer32):
3741         (JSC):
3742         (JSC::ARMAssembler::dataTransfer16):
3743         (JSC::ARMAssembler::baseIndexTransfer16):
3744         (JSC::ARMAssembler::dataTransferFloat):
3745         (JSC::ARMAssembler::baseIndexTransferFloat):
3746         (JSC::ARMAssembler::executableCopy):
3747         * assembler/ARMAssembler.h:
3748         (JSC::ARMAssembler::ARMAssembler):
3749         (JSC::ARMAssembler::emitInst):
3750         (JSC::ARMAssembler::vmov_f64_r):
3751         (ARMAssembler):
3752         (JSC::ARMAssembler::vabs_f64_r):
3753         (JSC::ARMAssembler::vneg_f64_r):
3754         (JSC::ARMAssembler::ldr_imm):
3755         (JSC::ARMAssembler::ldr_un_imm):
3756         (JSC::ARMAssembler::dtr_u):
3757         (JSC::ARMAssembler::dtr_ur):
3758         (JSC::ARMAssembler::dtr_d):
3759         (JSC::ARMAssembler::dtr_dr):
3760         (JSC::ARMAssembler::dtrh_u):
3761         (JSC::ARMAssembler::dtrh_ur):
3762         (JSC::ARMAssembler::dtrh_d):
3763         (JSC::ARMAssembler::dtrh_dr):
3764         (JSC::ARMAssembler::fdtr_u):
3765         (JSC::ARMAssembler::fdtr_d):
3766         (JSC::ARMAssembler::push_r):
3767         (JSC::ARMAssembler::pop_r):
3768         (JSC::ARMAssembler::poke_r):
3769         (JSC::ARMAssembler::peek_r):
3770         (JSC::ARMAssembler::vmov_vfp64_r):
3771         (JSC::ARMAssembler::vmov_arm64_r):
3772         (JSC::ARMAssembler::vmov_vfp32_r):
3773         (JSC::ARMAssembler::vmov_arm32_r):
3774         (JSC::ARMAssembler::vcvt_u32_f64_r):
3775         (JSC::ARMAssembler::vcvt_f64_f32_r):
3776         (JSC::ARMAssembler::vcvt_f32_f64_r):
3777         (JSC::ARMAssembler::clz_r):
3778         (JSC::ARMAssembler::bkpt):
3779         (JSC::ARMAssembler::bx):
3780         (JSC::ARMAssembler::blx):
3781         (JSC::ARMAssembler::labelIgnoringWatchpoints):
3782         (JSC::ARMAssembler::labelForWatchpoint):
3783         (JSC::ARMAssembler::label):
3784         (JSC::ARMAssembler::getLdrImmAddress):
3785         (JSC::ARMAssembler::replaceWithJump):
3786         (JSC::ARMAssembler::maxJumpReplacementSize):
3787         (JSC::ARMAssembler::getOp2Byte):
3788         (JSC::ARMAssembler::getOp2Half):
3789         (JSC::ARMAssembler::RM):
3790         (JSC::ARMAssembler::RS):
3791         (JSC::ARMAssembler::RD):
3792         (JSC::ARMAssembler::RN):
3793         * assembler/AssemblerBufferWithConstantPool.h:
3794         (JSC::AssemblerBufferWithConstantPool::ensureSpaceForAnyInstruction):
3795         * assembler/MacroAssemblerARM.cpp:
3796         (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
3797         * assembler/MacroAssemblerARM.h:
3798         (JSC::MacroAssemblerARM::add32):
3799         (MacroAssemblerARM):
3800         (JSC::MacroAssemblerARM::and32):
3801         (JSC::MacroAssemblerARM::lshift32):
3802         (JSC::MacroAssemblerARM::mul32):
3803         (JSC::MacroAssemblerARM::neg32):
3804         (JSC::MacroAssemblerARM::rshift32):
3805         (JSC::MacroAssemblerARM::urshift32):
3806         (JSC::MacroAssemblerARM::xor32):
3807         (JSC::MacroAssemblerARM::load8):
3808         (JSC::MacroAssemblerARM::load8Signed):
3809         (JSC::MacroAssemblerARM::load16):
3810         (JSC::MacroAssemblerARM::load16Signed):
3811         (JSC::MacroAssemblerARM::load32):
3812         (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch):
3813         (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch):
3814         (JSC::MacroAssemblerARM::store8):
3815         (JSC::MacroAssemblerARM::store16):
3816         (JSC::MacroAssemblerARM::store32):
3817         (JSC::MacroAssemblerARM::move):
3818         (JSC::MacroAssemblerARM::jump):
3819         (JSC::MacroAssemblerARM::branchAdd32):
3820         (JSC::MacroAssemblerARM::mull32):
3821         (JSC::MacroAssemblerARM::branchMul32):
3822         (JSC::MacroAssemblerARM::nearCall):
3823         (JSC::MacroAssemblerARM::compare32):
3824         (JSC::MacroAssemblerARM::test32):
3825         (JSC::MacroAssemblerARM::sub32):
3826         (JSC::MacroAssemblerARM::call):
3827         (JSC::MacroAssemblerARM::loadFloat):
3828         (JSC::MacroAssemblerARM::loadDouble):
3829         (JSC::MacroAssemblerARM::storeFloat):
3830         (JSC::MacroAssemblerARM::storeDouble):
3831         (JSC::MacroAssemblerARM::moveDouble):
3832         (JSC::MacroAssemblerARM::addDouble):
3833         (JSC::MacroAssemblerARM::divDouble):
3834         (JSC::MacroAssemblerARM::subDouble):
3835         (JSC::MacroAssemblerARM::mulDouble):
3836         (JSC::MacroAssemblerARM::absDouble):
3837         (JSC::MacroAssemblerARM::negateDouble):
3838         (JSC::MacroAssemblerARM::convertInt32ToDouble):
3839         (JSC::MacroAssemblerARM::convertFloatToDouble):
3840         (JSC::MacroAssemblerARM::convertDoubleToFloat):
3841         (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
3842         (JSC::MacroAssemblerARM::branchTruncateDoubleToUint32):
3843         (JSC::MacroAssemblerARM::truncateDoubleToInt32):
3844         (JSC::MacroAssemblerARM::truncateDoubleToUint32):
3845         (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
3846         (JSC::MacroAssemblerARM::branchDoubleNonZero):
3847         (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN):
3848         (JSC::MacroAssemblerARM::invert):
3849         (JSC::MacroAssemblerARM::replaceWithJump):
3850         (JSC::MacroAssemblerARM::maxJumpReplacementSize):
3851         (JSC::MacroAssemblerARM::call32):
3852         * assembler/SH4Assembler.h:
3853         (JSC::SH4Assembler::label):
3854         * dfg/DFGAssemblyHelpers.h:
3855         (JSC::DFG::AssemblyHelpers::debugCall):
3856         (JSC::DFG::AssemblyHelpers::boxDouble):
3857         (JSC::DFG::AssemblyHelpers::unboxDouble):
3858         * dfg/DFGCCallHelpers.h:
3859         (CCallHelpers):
3860         (JSC::DFG::CCallHelpers::setupArguments):
3861         * dfg/DFGFPRInfo.h:
3862         (DFG):
3863         * dfg/DFGGPRInfo.h:
3864         (DFG):
3865         (GPRInfo):
3866         * dfg/DFGOperations.cpp:
3867         (JSC):
3868         * dfg/DFGSpeculativeJIT.h:
3869         (SpeculativeJIT):
3870         (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult):
3871         (JSC::DFG::SpeculativeJIT::appendCallSetResult):
3872         * jit/JITStubs.cpp:
3873         (JSC):
3874         * jit/JITStubs.h:
3875         (JITStackFrame):
3876         * jit/JSInterfaceJIT.h:
3877         (JSInterfaceJIT):
3878
3879 2012-07-04  Anthony Scian  <ascian@rim.com>
3880
3881         Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
3882         https://bugs.webkit.org/show_bug.cgi?id=40118
3883
3884         Reviewed by Yong Li.
3885
3886         Added member functions to expose function name, urlString, and line #.
3887         Refactored toString to make use of these member functions to reduce
3888         duplicated code for future maintenance.
3889
3890         Manually tested refactoring of toString by tracing thrown exceptions.
3891
3892         * interpreter/Interpreter.h:
3893         (JSC::StackFrame::toString):
3894         (JSC::StackFrame::friendlySourceURL):
3895         (JSC::StackFrame::friendlyFunctionName):
3896         (JSC::StackFrame::friendlyLineNumber):
3897
3898 2012-07-04  Andy Wingo  <wingo@igalia.com>
3899
3900         [GTK] Enable parallel GC
3901         https://bugs.webkit.org/show_bug.cgi?id=90568
3902
3903         Reviewed by Martin Robinson.
3904
3905         * runtime/Options.cpp: Include <algorithm.h> for std::min.
3906
3907 2012-07-04  John Mellor  <johnme@chromium.org>
3908
3909         Text Autosizing: Add compile flag and runtime setting
3910         https://bugs.webkit.org/show_bug.cgi?id=87394
3911
3912         This patch renames Font Boosting to Text Autosizing.
3913
3914         Reviewed by Adam Barth.
3915
3916         * Configurations/FeatureDefines.xcconfig:
3917
3918 2012-07-03  Michael Saboff  <msaboff@apple.com>
3919
3920         Enh: Hash Const JSString in Backing Stores to Save Memory
3921         https://bugs.webkit.org/show_bug.cgi?id=86024
3922
3923         Reviewed by Oliver Hunt.
3924
3925         During garbage collection, each marking thread keeps a HashMap of
3926         strings.  While visiting via MarkStack::copyAndAppend(), we check to
3927         see if the string we are visiting is already in the HashMap.  If not
3928         we add it. If so, we change the reference to the current string we're
3929         visiting to the prior string.
3930
3931         To reduce the performance impact of this change, two throttles have
3932         ben added.  1) We only try hash consting if a significant number of new
3933         strings have been created since the last hash const.  Currently this is
3934         set at 100 strings.  2) If a string is unique at the end of a marking
3935         it will not be checked during further GC phases. In some cases this
3936         won't catch all duplicates, but we are trying to catch the growth of
3937         duplicate strings.
3938
3939         * heap/Heap.cpp:
3940         (JSC::Heap::markRoots):
3941         * heap/MarkStack.cpp:
3942         (JSC::MarkStackThreadSharedData::resetChildren):
3943         (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
3944         (JSC::MarkStackThreadSharedData::reset):
3945         (JSC::MarkStack::setup): Check to see if enough strings have been created
3946         to hash const.
3947         (JSC::MarkStack::reset): Added call to clear m_uniqueStrings.
3948         (JSC::JSString::tryHashConstLock): New method to lock JSString for
3949         hash consting.
3950         (JSC::JSString::releaseHashConstLock): New unlock method.
3951         (JSC::JSString::shouldTryHashConst): Set of checks to see if we should
3952         try to hash const the string.
3953         (JSC::MarkStack::internalAppend): New method that performs the hash consting.
3954         (JSC::SlotVisitor::copyAndAppend): Changed to call the new hash
3955         consting internalAppend().
3956         * heap/MarkStack.h:
3957         (MarkStackThreadSharedData):
3958         (MarkStack):
3959         * runtime/JSGlobalData.cpp:
3960         (JSC::JSGlobalData::JSGlobalData):
3961         * runtime/JSGlobalData.h:
3962         (JSGlobalData):
3963         (JSC::JSGlobalData::haveEnoughNewStringsToHashConst):
3964         (JSC::JSGlobalData::resetNewStringsSinceLastHashConst):
3965         * runtime/JSString.h:
3966         (JSString): Changed from using bool flags to using an unsigned
3967         m_flags field.  This works better with the weakCompareAndSwap in
3968         JSString::tryHashConstLock(). Changed the 8bitness setting and
3969         checking to use new accessors.
3970         (JSC::JSString::JSString):
3971         (JSC::JSString::finishCreation):
3972         (JSC::JSString::is8Bit): Updated for new m_flags.
3973         (JSC::JSString::setIs8Bit): New setter.
3974         New hash const flags accessors:
3975         (JSC::JSString::isHashConstSingleton):
3976         (JSC::JSString::clearHashConstSingleton):
3977         (JSC::JSString::setHashConstSingleton):
3978         (JSC::JSRopeString::finishCreation):
3979         (JSC::JSRopeString::append):
3980
3981 2012-07-03  Tony Chang  <tony@chromium.org>
3982
3983         [chromium] Unreviewed, update .gitignore to handle VS2010 files.
3984
3985         * JavaScriptCore.gyp/.gitignore:
3986
3987 2012-07-03  Mark Lam  <mark.lam@apple.com>
3988
3989         Add ability to symbolically set and dump JSC VM options.
3990         See comments in runtime/Options.h for details on how the options work.
3991         https://bugs.webkit.org/show_bug.cgi?id=90420
3992
3993         Reviewed by Filip Pizlo.
3994
3995         * assembler/LinkBuffer.cpp:
3996         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
3997         * assembler/LinkBuffer.h:
3998         (JSC):
3999         * bytecode/CodeBlock.cpp:
4000         (JSC::CodeBlock::shouldOptimizeNow):
4001         * bytecode/CodeBlock.h:
4002         (JSC::CodeBlock::likelyToTakeSlowCase):
4003         (JSC::CodeBlock::couldTakeSlowCase):
4004         (JSC::CodeBlock::likelyToTakeSpecialFastCase):
4005         (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
4006         (JSC::CodeBlock::likelyToTakeAnySlowCase):
4007         (JSC::CodeBlock::jitAfterWarmUp):
4008         (JSC::CodeBlock::jitSoon):
4009         (JSC::CodeBlock::reoptimizationRetryCounter):
4010         (JSC::CodeBlock::countReoptimization):
4011         (JSC::CodeBlock::counterValueForOptimizeAfterWarmUp):
4012         (JSC::CodeBlock::counterValueForOptimizeAfterLongWarmUp):
4013         (JSC::CodeBlock::optimizeSoon):
4014         (JSC::CodeBlock::exitCountThresholdForReoptimization):
4015         (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
4016         * bytecode/ExecutionCounter.h:
4017         (JSC::ExecutionCounter::clippedThreshold):
4018         * dfg/DFGByteCodeParser.cpp:
4019         (JSC::DFG::ByteCodeParser::handleInlining):
4020         * dfg/DFGCapabilities.h:
4021         (JSC::DFG::mightCompileEval):
4022         (JSC::DFG::mightCompileProgram):
4023         (JSC::DFG::mightCompileFunctionForCall):
4024         (JSC::DFG::mightCompileFunctionForConstruct):
4025         (JSC::DFG::mightInlineFunctionForCall):
4026         (JSC::DFG::mightInlineFunctionForConstruct):
4027         * dfg/DFGCommon.h:
4028         (JSC::DFG::shouldShowDisassembly):
4029         * dfg/DFGDriver.cpp:
4030         (JSC::DFG::compile):
4031         * dfg/DFGOSRExit.cpp:
4032         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
4033         * dfg/DFGVariableAccessData.h:
4034         (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
4035         * heap/MarkStack.cpp:
4036         (JSC::MarkStackSegmentAllocator::allocate):
4037         (JSC::MarkStackSegmentAllocator::shrinkReserve):
4038         (JSC::MarkStackArray::MarkStackArray):
4039         (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
4040         (JSC::SlotVisitor::donateKnownParallel):
4041         (JSC::SlotVisitor::drain):
4042         (JSC::SlotVisitor::drainFromShared):
4043         * heap/MarkStack.h:
4044         (JSC::MarkStack::mergeOpaqueRootsIfProfitable):
4045         (JSC::MarkStack::addOpaqueRoot):
4046         * heap/SlotVisitor.h:
4047         (JSC::SlotVisitor::donate):
4048         * jit/JIT.cpp:
4049         (JSC::JIT::emitOptimizationCheck):
4050         * jsc.cpp:
4051         (printUsageStatement):
4052         (parseArguments):
4053         * runtime/InitializeThreading.cpp:
4054         (JSC::initializeThreadingOnce):
4055         * runtime/JSGlobalData.cpp:
4056         (JSC::enableAssembler):
4057         * runtime/JSGlobalObject.cpp:
4058         (JSC::JSGlobalObject::JSGlobalObject):
4059         * runtime/Options.cpp:
4060         (JSC):
4061         (JSC::overrideOptionWithHeuristic):
4062         (JSC::Options::initialize):
4063         (JSC::Options::setOption):
4064         (JSC::Options::dumpAllOptions):
4065         (JSC::Options::dumpOption):
4066         * runtime/Options.h:
4067         (JSC):
4068         (Options):
4069         (EntryInfo):
4070
4071 2012-07-03  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>  Joel Dillon <joel.dillon@codethink.co.uk>
4072
4073         [Qt][Win] Fix broken QtWebKit5.lib linking
4074         https://bugs.webkit.org/show_bug.cgi?id=88321
4075
4076         Reviewed by Kenneth Rohde Christiansen.
4077
4078         The goal is to have different ports build systems define STATICALLY_LINKED_WITH_WTF
4079         when building JavaScriptCore, if both are packaged in the same DLL, instead
4080         of relying on the code to handle this.
4081         The effects of BUILDING_* and STATICALLY_LINKED_WITH_* are currently the same
4082         except for a check in Source/JavaScriptCore/config.h.
4083
4084         Keeping the old way for the WX port as requested by the port's contributors.
4085         For non-Windows ports there is no difference between IMPORT and EXPORT, no
4086         change is needed.
4087
4088         * API/JSBase.h:
4089           JS symbols shouldn't be included by WTF objects anymore. Remove the export when BUILDING_WTF.
4090         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
4091           Make sure that JavaScriptCore uses import symbols of WTF for the Win port.
4092         * runtime/JSExportMacros.h:
4093
4094 2012-07-02  Filip Pizlo  <fpizlo@apple.com>
4095
4096         DFG OSR exit value recoveries should be computed lazily
4097         https://bugs.webkit.org/show_bug.cgi?id=82155
4098
4099         Reviewed by Gavin Barraclough.
4100
4101         This change aims to reduce one aspect of DFG compile times: the fact
4102         that we currently compute the value recoveries for each local and
4103         argument on every speculation check. We compile many speculation checks,
4104         so this can add up quick. The strategy that this change takes is to
4105         have the DFG save just enough information about how the compiler is
4106         choosing to represent state, that the DFG::OSRExitCompiler can reify
4107         the value recoveries lazily.
4108
4109         This appears to be an 0.3% SunSpider speed-up and is neutral elsewhere.
4110
4111         I also took the opportunity to fix the sampling regions profiler (it
4112         was missing an export macro) and to put in more sampling regions in
4113         the DFG (which are disabled so long as ENABLE(SAMPLING_REGIONS) is
4114         false).
4115
4116         * CMakeLists.txt:
4117         * GNUmakefile.list.am:
4118         * JavaScriptCore.xcodeproj/project.pbxproj:
4119         * Target.pri:
4120         * bytecode/CodeBlock.cpp:
4121         (JSC):
4122         (JSC::CodeBlock::shrinkDFGDataToFit):
4123         * bytecode/CodeBlock.h:
4124         (CodeBlock):
4125         (JSC::CodeBlock::minifiedDFG):
4126         (JSC::CodeBlock::variableEventStream):
4127         (DFGData):
4128         * bytecode/Operands.h:
4129         (JSC::Operands::hasOperand):
4130         (Operands):
4131         (JSC::Operands::size):
4132         (JSC::Operands::at):
4133         (JSC::Operands::operator[]):
4134         (JSC::Operands::isArgument):
4135         (JSC::Operands::isVariable):
4136         (JSC::Operands::argumentForIndex):
4137         (JSC::Operands::variableForIndex):
4138         (JSC::Operands::operandForIndex):
4139         (JSC):
4140         (JSC::dumpOperands):
4141         * bytecode/SamplingTool.h:
4142         (SamplingRegion):
4143         * dfg/DFGByteCodeParser.cpp:
4144         (JSC::DFG::parse):
4145         * dfg/DFGCFAPhase.cpp:
4146         (JSC::DFG::performCFA):
4147         * dfg/DFGCSEPhase.cpp:
4148         (JSC::DFG::performCSE):
4149         * dfg/DFGFixupPhase.cpp:
4150         (JSC::DFG::performFixup):
4151         * dfg/DFGGenerationInfo.h:
4152         (JSC::DFG::GenerationInfo::GenerationInfo):
4153         (JSC::DFG::GenerationInfo::initConstant):
4154         (JSC::DFG::GenerationInfo::initInteger):
4155         (JSC::DFG::GenerationInfo::initJSValue):
4156         (JSC::DFG::GenerationInfo::initCell):
4157         (JSC::DFG::GenerationInfo::initBoolean):
4158         (JSC::DFG::GenerationInfo::initDouble):
4159         (JSC::DFG::GenerationInfo::initStorage):
4160         (GenerationInfo):
4161         (JSC::DFG::GenerationInfo::noticeOSRBirth):
4162         (JSC::DFG::GenerationInfo::use):
4163         (JSC::DFG::GenerationInfo::spill):
4164         (JSC::DFG::GenerationInfo::setSpilled):
4165         (JSC::DFG::GenerationInfo::fillJSValue):
4166         (JSC::DFG::GenerationInfo::fillCell):
4167         (JSC::DFG::GenerationInfo::fillInteger):
4168         (JSC::DFG::GenerationInfo::fillBoolean):
4169         (JSC::DFG::GenerationInfo::fillDouble):
4170         (JSC::DFG::GenerationInfo::fillStorage):
4171         (JSC::DFG::GenerationInfo::appendFill):
4172         (JSC::DFG::GenerationInfo::appendSpill):
4173         * dfg/DFGJITCompiler.cpp:
4174         (JSC::DFG::JITCompiler::link):
4175         (JSC::DFG::JITCompiler::compile):
4176         (JSC::DFG::JITCompiler::compileFunction):
4177         * dfg/DFGMinifiedGraph.h: Added.
4178         (DFG):
4179         (MinifiedGraph):
4180         (JSC::DFG::MinifiedGraph::MinifiedGraph):
4181         (JSC::DFG::MinifiedGraph::at):
4182         (JSC::DFG::MinifiedGraph::append):
4183         (JSC::DFG::MinifiedGraph::prepareAndShrink):
4184         (JSC::DFG::MinifiedGraph::setOriginalGraphSize):
4185         (JSC::DFG::MinifiedGraph::originalGraphSize):
4186         * dfg/DFGMinifiedNode.cpp: Added.
4187         (DFG):
4188         (JSC::DFG::MinifiedNode::fromNode):
4189         * dfg/DFGMinifiedNode.h: Added.
4190         (DFG):
4191         (JSC::DFG::belongsInMinifiedGraph):
4192         (MinifiedNode):
4193         (JSC::DFG::MinifiedNode::MinifiedNode):
4194         (JSC::DFG::MinifiedNode::index):
4195         (JSC::DFG::MinifiedNode::op):
4196         (JSC::DFG::MinifiedNode::hasChild1):
4197         (JSC::DFG::MinifiedNode::child1):
4198         (JSC::DFG::MinifiedNode::hasConstant):
4199         (JSC::DFG::MinifiedNode::hasConstantNumber):
4200         (JSC::DFG::MinifiedNode::constantNumber):
4201         (JSC::DFG::MinifiedNode::hasWeakConstant):
4202         (JSC::DFG::MinifiedNode::weakConstant):
4203         (JSC::DFG::MinifiedNode::getIndex):
4204         (JSC::DFG::MinifiedNode::compareByNodeIndex):
4205         (JSC::DFG::MinifiedNode::hasChild):
4206         * dfg/DFGNode.h:
4207         (Node):
4208         * dfg/DFGOSRExit.cpp:
4209         (JSC::DFG::OSRExit::OSRExit):
4210         * dfg/DFGOSRExit.h:
4211         (OSRExit):
4212         * dfg/DFGOSRExitCompiler.cpp:
4213         * dfg/DFGOSRExitCompiler.h:
4214         (OSRExitCompiler):
4215         * dfg/DFGOSRExitCompiler32_64.cpp:
4216         (JSC::DFG::OSRExitCompiler::compileExit):
4217         * dfg/DFGOSRExitCompiler64.cpp:
4218         (JSC::DFG::OSRExitCompiler::compileExit):
4219         * dfg/DFGPredictionPropagationPhase.cpp:
4220         (JSC::DFG::performPredictionPropagation):
4221         * dfg/DFGRedundantPhiEliminationPhase.cpp:
4222         (JSC::DFG::performRedundantPhiElimination):
4223         * dfg/DFGSpeculativeJIT.cpp:
4224         (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
4225         (DFG):
4226         (JSC::DFG::SpeculativeJIT::fillStorage):
4227         (JSC::DFG::SpeculativeJIT::noticeOSRBirth):
4228         (JSC::DFG::SpeculativeJIT::compileMovHint):
4229         (JSC::DFG::SpeculativeJIT::compile):
4230         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
4231         * dfg/DFGSpeculativeJIT.h:
4232         (DFG):
4233         (JSC::DFG::SpeculativeJIT::use):
4234         (SpeculativeJIT):
4235         (JSC::DFG::SpeculativeJIT::spill):
4236         (JSC::DFG::SpeculativeJIT::speculationCheck):
4237         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
4238         (JSC::DFG::SpeculativeJIT::recordSetLocal):
4239         * dfg/DFGSpeculativeJIT32_64.cpp:
4240         (JSC::DFG::SpeculativeJIT::fillInteger):
4241         (JSC::DFG::SpeculativeJIT::fillDouble):
4242         (JSC::DFG::SpeculativeJIT::fillJSValue):
4243         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
4244         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
4245         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
4246         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
4247         (JSC::DFG::SpeculativeJIT::compile):
4248         * dfg/DFGSpeculativeJIT64.cpp:
4249         (JSC::DFG::SpeculativeJIT::fillInteger):
4250         (JSC::DFG::SpeculativeJIT::fillDouble):
4251         (JSC::DFG::SpeculativeJIT::fillJSValue):
4252         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
4253         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
4254         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
4255         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
4256         (JSC::DFG::SpeculativeJIT::compile):
4257         * dfg/DFGValueRecoveryOverride.h: Added.
4258         (DFG):
4259         (ValueRecoveryOverride):
4260         (JSC::DFG::ValueRecoveryOverride::ValueRecoveryOverride):
4261         * dfg/DFGValueSource.cpp: Added.
4262         (DFG):
4263         (JSC::DFG::ValueSource::dump):
4264         * dfg/DFGValueSource.h: Added.
4265         (DFG):
4266         (JSC::DFG::dataFormatToValueSourceKind):
4267         (JSC::DFG::valueSourceKindToDataFormat):
4268         (JSC::DFG::isInRegisterFile):
4269         (ValueSource):
4270         (JSC::DFG::ValueSource::ValueSource):
4271         (JSC::DFG::ValueSource::forPrediction):
4272         (JSC::DFG::ValueSource::forDataFormat):
4273         (JSC::DFG::ValueSource::isSet):
4274         (JSC::DFG::ValueSource::kind):
4275         (JSC::DFG::ValueSource::isInRegisterFile):
4276         (JSC::DFG::ValueSource::dataFormat):
4277         (JSC::DFG::ValueSource::valueRecovery):
4278         (JSC::DFG::ValueSource::nodeIndex):
4279         (JSC::DFG::ValueSource::nodeIndexFromKind):
4280         (JSC::DFG::ValueSource::kindFromNodeIndex):
4281         * dfg/DFGVariableEvent.cpp: Added.
4282         (DFG):
4283         (JSC::DFG::VariableEvent::dump):
4284         (JSC::DFG::VariableEvent::dumpFillInfo):
4285         (JSC::DFG::VariableEvent::dumpSpillInfo):
4286         * dfg/DFGVariableEvent.h: Added.
4287         (DFG):
4288         (VariableEvent):
4289         (JSC::DFG::VariableEvent::VariableEvent):
4290         (JSC::DFG::VariableEvent::reset):
4291         (JSC::DFG::VariableEvent::fillGPR):
4292         (JSC::DFG::VariableEvent::fillPair):
4293         (JSC::DFG::VariableEvent::fillFPR):
4294         (JSC::DFG::VariableEvent::spill):
4295         (JSC::DFG::VariableEvent::death):
4296         (JSC::DFG::VariableEvent::setLocal):
4297         (JSC::DFG::VariableEvent::movHint):
4298         (JSC::DFG::VariableEvent::kind):
4299         (JSC::DFG::VariableEvent::nodeIndex):
4300         (JSC::DFG::VariableEvent::dataFormat):
4301         (JSC::DFG::VariableEvent::gpr):
4302         (JSC::DFG::VariableEvent::tagGPR):
4303         (JSC::DFG::VariableEvent::payloadGPR):
4304         (JSC::DFG::VariableEvent::fpr):
4305         (JSC::DFG::VariableEvent::virtualRegister):
4306         (JSC::DFG::VariableEvent::operand):
4307         (JSC::DFG::VariableEvent::variableRepresentation):
4308         * dfg/DFGVariableEventStream.cpp: Added.
4309         (DFG):
4310         (JSC::DFG::VariableEventStream::logEvent):
4311         (MinifiedGenerationInfo):
4312         (JSC::DFG::MinifiedGenerationInfo::MinifiedGenerationInfo):
4313         (JSC::DFG::MinifiedGenerationInfo::update):
4314         (JSC::DFG::VariableEventStream::reconstruct):
4315         * dfg/DFGVariableEventStream.h: Added.
4316         (DFG):
4317         (VariableEventStream):
4318         (JSC::DFG::VariableEventStream::appendAndLog):
4319         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
4320         (JSC::DFG::performVirtualRegisterAllocation):
4321
4322 2012-07-02  Filip Pizlo  <fpizlo@apple.com>
4323
4324         DFG::ArgumentsSimplificationPhase should assert that the PhantomArguments nodes it creates are not shouldGenerate()
4325         https://bugs.webkit.org/show_bug.cgi?id=90407
4326
4327         Reviewed by Mark Hahnenberg.
4328
4329         * dfg/DFGArgumentsSimplificationPhase.cpp:
4330         (JSC::DFG::ArgumentsSimplificationPhase::run):
4331
4332 2012-07-02  Gavin Barraclough  <barraclough@apple.com>
4333
4334         Array.prototype.pop should throw if property is not configurable
4335         https://bugs.webkit.org/show_bug.cgi?id=75788
4336
4337         Rubber Stamped by Oliver Hunt.
4338
4339         No real bug here any more, but the error we throw sometimes has a misleading message.
4340
4341         * runtime/JSArray.cpp:
4342         (JSC::JSArray::pop):
4343
4344 2012-06-29  Filip Pizlo  <fpizlo@apple.com>
4345
4346         JSObject wastes too much memory on unused property slots
4347         https://bugs.webkit.org/show_bug.cgi?id=90255
4348
4349         Reviewed by Mark Hahnenberg.
4350
4351         Rolling back in after applying a simple fix: it appears that
4352         JSObject::setStructureAndReallocateStorageIfNecessary() was allocating more
4353         property storage than necessary. Fixing this appears to resolve the crash.
4354
4355         This does a few things:
4356
4357         - JSNonFinalObject no longer has inline property storage.
4358
4359         - Initial out-of-line property storage size is 4 slots for JSNonFinalObject,
4360           or 2x the inline storage for JSFinalObject.
4361
4362         - Property storage is only reallocated if it needs to be. Previously, we
4363           would reallocate the property storage on any transition where the original
4364           structure said shouldGrowProperyStorage(), but this led to spurious
4365           reallocations when doing transitionless property adds and there are
4366           deleted property slots available. That in turn led to crashes, because we
4367           would switch to out-of-line storage even if the capacity matched the
4368           criteria for inline storage.
4369
4370         - Inline JSFunction allocation is killed off because we don't have a good
4371           way of inlining property storage allocation. This didn't hurt performance.
4372           Killing off code is better than fixing it if that code wasn't doing any
4373           good.
4374
4375         This looks like a 1% progression on V8.
4376
4377         * interpreter/Interpreter.cpp:
4378         (JSC::Interpreter::privateExecute):
4379         * jit/JIT.cpp:
4380         (JSC::JIT::privateCompileSlowCases):
4381         * jit/JIT.h:
4382         * jit/JITInlineMethods.h:
4383         (JSC::JIT::emitAllocateBasicJSObject):
4384         (JSC):
4385         * jit/JITOpcodes.cpp:
4386         (JSC::JIT::emit_op_new_func):
4387         (JSC):
4388         (JSC::JIT::emit_op_new_func_exp):
4389         * runtime/JSFunction.cpp:
4390         (JSC::JSFunction::finishCreation):
4391         * runtime/JSObject.h:
4392         (JSC::JSObject::isUsingInlineStorage):
4393         (JSObject):
4394         (JSC::JSObject::finishCreation):
4395         (JSC):
4396         (JSC::JSNonFinalObject::hasInlineStorage):
4397         (JSNonFinalObject):
4398         (JSC::JSNonFinalObject::JSNonFinalObject):
4399         (JSC::JSNonFinalObject::finishCreation):
4400         (JSC::JSFinalObject::hasInlineStorage):
4401         (JSC::JSFinalObject::finishCreation):
4402         (JSC::JSObject::offsetOfInlineStorage):
4403         (JSC::JSObject::setPropertyStorage):
4404         (JSC::Structure::inlineStorageCapacity):
4405         (JSC::Structure::isUsingInlineStorage):
4406         (JSC::JSObject::putDirectInternal):
4407         (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
4408         (JSC::JSObject::putDirectWithoutTransition):
4409         * runtime/Structure.cpp:
4410         (JSC::Structure::Structure):
4411         (JSC::nextPropertyStorageCapacity):
4412         (JSC):
4413         (JSC::Structure::growPropertyStorageCapacity):
4414         (JSC::Structure::suggestedNewPropertyStorageSize):
4415         * runtime/Structure.h:
4416         (JSC::Structure::putWillGrowPropertyStorage):
4417         (Structure):
4418
4419 2012-06-29  Filip Pizlo  <fpizlo@apple.com>
4420
4421         Webkit crashes in DFG on Google Docs when creating a new document
4422         https://bugs.webkit.org/show_bug.cgi?id=90209
4423
4424         Reviewed by Gavin Barraclough.
4425
4426         Don't attempt to short-circuit Phantom(GetLocal) if the GetLocal is for a
4427         captured variable.
4428
4429         * dfg/DFGCFGSimplificationPhase.cpp:
4430         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
4431
4432 2012-06-30  Zan Dobersek  <zandobersek@gmail.com>
4433
4434         Unreviewed, rolling out r121605.
4435         http://trac.webkit.org/changeset/121605
4436         https://bugs.webkit.org/show_bug.cgi?id=90336
4437
4438         Changes caused flaky crashes in sputnik/Unicode tests on Apple
4439         WK1 and GTK Linux builders
4440
4441         * interpreter/Interpreter.cpp:
4442         (JSC::Interpreter::privateExecute):
4443         * jit/JIT.cpp:
4444         (JSC::JIT::privateCompileSlowCases):
4445         * jit/JIT.h:
4446         * jit/JITInlineMethods.h:
4447         (JSC::JIT::emitAllocateBasicJSObject):
4448         (JSC::JIT::emitAllocateJSFinalObject):
4449         (JSC):
4450         (JSC::JIT::emitAllocateJSFunction):
4451         * jit/JITOpcodes.cpp:
4452         (JSC::JIT::emit_op_new_func):
4453         (JSC::JIT::emitSlow_op_new_func):
4454         (JSC):
4455         (JSC::JIT::emit_op_new_func_exp):
4456         (JSC::JIT::emitSlow_op_new_func_exp):
4457         * runtime/JSFunction.cpp:
4458         (JSC::JSFunction::finishCreation):
4459         * runtime/JSObject.h:
4460         (JSC::JSObject::isUsingInlineStorage):
4461         (JSObject):
4462         (JSC::JSObject::finishCreation):
4463         (JSC):
4464         (JSNonFinalObject):
4465         (JSC::JSNonFinalObject::JSNonFinalObject):
4466         (JSC::JSNonFinalObject::finishCreation):
4467         (JSFinalObject):
4468         (JSC::JSFinalObject::finishCreation):
4469         (JSC::JSObject::offsetOfInlineStorage):
4470         (JSC::JSObject::setPropertyStorage):
4471         (JSC::Structure::isUsingInlineStorage):
4472         (JSC::JSObject::putDirectInternal):
4473         (JSC::JSObject::putDirectWithoutTransition):
4474         (JSC::JSObject::transitionTo):
4475         * runtime/Structure.cpp:
4476         (JSC::Structure::Structure):
4477         (JSC):
4478         (JSC::Structure::growPropertyStorageCapacity):
4479         (JSC::Structure::suggestedNewPropertyStorageSize):
4480         * runtime/Structure.h:
4481         (JSC::Structure::shouldGrowPropertyStorage):
4482         (JSC::Structure::propertyStorageSize):
4483
4484 2012-06-29  Mark Hahnenberg  <mhahnenberg@apple.com>
4485
4486         Remove warning about protected values when the Heap is being destroyed
4487         https://bugs.webkit.org/show_bug.cgi?id=90302
4488
4489         Reviewed by Geoffrey Garen.
4490
4491         Having to do book-keeping about whether values allocated from a certain
4492         VM are or are not protected makes the JSC API much more difficult to use
4493         correctly. Clients should be able to throw an entire VM away and not have
4494         to worry about unprotecting all of the values that they protected earlier.
4495
4496         * heap/Heap.cpp:
4497         (JSC::Heap::lastChanceToFinalize):
4498
4499 2012-06-29  Filip Pizlo  <fpizlo@apple.com>
4500
4501         JSObject wastes too much memory on unused property slots
4502         https://bugs.webkit.org/show_bug.cgi?id=90255
4503
4504         Reviewed by Mark Hahnenberg.
4505
4506         This does a few things:
4507
4508         - JSNonFinalObject no longer has inline property storage.
4509
4510         - Initial out-of-line property storage size is 4 slots for JSNonFinalObject,
4511           or 2x the inline storage for JSFinalObject.
4512
4513         - Property storage is only reallocated if it needs to be. Previously, we
4514           would reallocate the property storage on any transition where the original
4515           structure said shouldGrowProperyStorage(), but this led to spurious
4516           reallocations when doing transitionless property adds and there are
4517           deleted property slots available. That in turn led to crashes, because we
4518           would switch to out-of-line storage even if the capacity matched the
4519           criteria for inline storage.
4520
4521         - Inline JSFunction allocation is killed off because we don't have a good
4522           way of inlining property storage allocation. This didn't hurt performance.
4523           Killing off code is better than fixing it if that code wasn't doing any
4524           good.
4525
4526         This looks like a 1% progression on V8.
4527
4528         * interpreter/Interpreter.cpp:
4529         (JSC::Interpreter::privateExecute):
4530         * jit/JIT.cpp:
4531         (JSC::JIT::privateCompileSlowCases):
4532         * jit/JIT.h:
4533         * jit/JITInlineMethods.h:
4534         (JSC::JIT::emitAllocateBasicJSObject):
4535         (JSC):
4536         * jit/JITOpcodes.cpp:
4537         (JSC::JIT::emit_op_new_func):
4538         (JSC):
4539         (JSC::JIT::emit_op_new_func_exp):
4540         * runtime/JSFunction.cpp:
4541         (JSC::JSFunction::finishCreation):
4542         * runtime/JSObject.h:
4543         (JSC::JSObject::isUsingInlineStorage):
4544         (JSObject):
4545         (JSC::JSObject::finishCreation):
4546         (JSC):
4547         (JSC::JSNonFinalObject::hasInlineStorage):
4548         (JSNonFinalObject):
4549         (JSC::JSNonFinalObject::JSNonFinalObject):
4550         (JSC::JSNonFinalObject::finishCreation):
4551         (JSC::JSFinalObject::hasInlineStorage):
4552         (JSC::JSFinalObject::finishCreation):
4553         (JSC::JSObject::offsetOfInlineStorage):
4554         (JSC::JSObject::setPropertyStorage):
4555         (JSC::Structure::inlineStorageCapacity):
4556         (JSC::Structure::isUsingInlineStorage):
4557         (JSC::JSObject::putDirectInternal):
4558         (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
4559         (JSC::JSObject::putDirectWithoutTransition):
4560         * runtime/Structure.cpp:
4561         (JSC::Structure::Structure):
4562         (JSC::nextPropertyStorageCapacity):
4563         (JSC):
4564         (JSC::Structure::growPropertyStorageCapacity):
4565         (JSC::Structure::suggestedNewPropertyStorageSize):
4566         * runtime/Structure.h:
4567         (JSC::Structure::putWillGrowPropertyStorage):
4568         (Structure):
4569
4570 2012-06-28  Filip Pizlo  <fpizlo@apple.com>
4571
4572         DFG recompilation heuristics should be based on count, not rate
4573         https://bugs.webkit.org/show_bug.cgi?id=90146
4574
4575         Reviewed by Oliver Hunt.
4576
4577         This removes a bunch of code that was previously trying to prevent spurious
4578         reoptimizations if a large enough majority of executions of a code block did
4579         not result in OSR exit. It turns out that this code was purely harmful. This
4580         patch removes all of that logic and replaces it with a dead-simple
4581         heuristic: if you exit more than N times (where N is an exponential function
4582         of the number of times the code block has already been recompiled) then we
4583         will recompile.
4584
4585         This appears to be a broad ~1% win on many benchmarks large and small.
4586
4587         * bytecode/CodeBlock.cpp:
4588         (JSC::CodeBlock::CodeBlock):
4589         * bytecode/CodeBlock.h:
4590         (JSC::CodeBlock::osrExitCounter):
4591         (JSC::CodeBlock::countOSRExit):
4592         (CodeBlock):
4593         (JSC::CodeBlock::addressOfOSRExitCounter):
4594         (JSC::CodeBlock::offsetOfOSRExitCounter):
4595         (JSC::CodeBlock::adjustedExitCountThreshold):
4596         (JSC::CodeBlock::exitCountThresholdForReoptimization):
4597         (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
4598         (JSC::CodeBlock::shouldReoptimizeNow):
4599         (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
4600         * bytecode/ExecutionCounter.cpp:
4601         (JSC::ExecutionCounter::setThreshold):
4602         * bytecode/ExecutionCounter.h:
4603         (ExecutionCounter):
4604         (JSC::ExecutionCounter::clippedThreshold):
4605         * dfg/DFGJITCompiler.cpp:
4606         (JSC::DFG::JITCompiler::compileBody):
4607         * dfg/DFGOSRExit.cpp:
4608         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
4609         * dfg/DFGOSRExitCompiler.cpp:
4610         (JSC::DFG::OSRExitCompiler::handleExitCounts):
4611         * dfg/DFGOperations.cpp:
4612         * jit/JITStubs.cpp:
4613         (JSC::DEFINE_STUB_FUNCTION):
4614         * runtime/Options.cpp:
4615         (Options):
4616         (JSC::Options::initializeOptions):
4617         * runtime/Options.h:
4618         (Options):
4619
4620 2012-06-28  Mark Lam  <mark.lam@apple.com>
4621
4622         Adding a commenting utility to record BytecodeGenerator comments
4623         with opcodes that are emitted.  Presently, the comments can only
4624         be constant strings.  Adding comments for opcodes is optional.
4625         If a comment is added, the comment will be printed following the
4626         opcode when CodeBlock::dump() is called.
4627
4628         This utility is disabled by default, and is only meant for VM
4629         development purposes.  It should not be enabled for product builds.
4630
4631         To enable this utility, set ENABLE_BYTECODE_COMMENTS in CodeBlock.h
4632         to 1.
4633
4634         https://bugs.webkit.org/show_bug.cgi?id=90095
4635
4636         Reviewed by Geoffrey Garen.
4637
4638         * GNUmakefile.list.am:
4639         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
4640         * JavaScriptCore.xcodeproj/project.pbxproj:
4641         * bytecode/CodeBlock.cpp:
4642         (JSC::CodeBlock::dumpBytecodeCommentAndNewLine): Dumps the comment.
4643         (JSC):
4644         (JSC::CodeBlock::printUnaryOp): Add comment dumps.
4645         (JSC::CodeBlock::printBinaryOp): Add comment dumps.
4646         (JSC::CodeBlock::printConditionalJump): Add comment dumps.
4647         (JSC::CodeBlock::printCallOp): Add comment dumps.
4648         (JSC::CodeBlock::printPutByIdOp): Add comment dumps.
4649         (JSC::CodeBlock::dump): Add comment dumps.
4650         (JSC::CodeBlock::CodeBlock):
4651         (JSC::CodeBlock::commentForBytecodeOffset):
4652             Finds the comment for an opcode if available.
4653         (JSC::CodeBlock::dumpBytecodeComments):
4654             For debugging whether comments are collected.
4655             It is not being called anywhere.
4656         * bytecode/CodeBlock.h:
4657         (CodeBlock):
4658         (JSC::CodeBlock::bytecodeComments):
4659         * bytecode/Comment.h: Added.
4660         (JSC):
4661         (Comment):
4662         * bytecompiler/BytecodeGenerator.cpp:
4663         (JSC::BytecodeGenerator::BytecodeGenerator):
4664         (JSC::BytecodeGenerator::emitOpcode): Calls emitComment().
4665         (JSC):
4666         (JSC::BytecodeGenerator::emitComment): Adds comment to CodeBlock.
4667         (JSC::BytecodeGenerator::prependComment):
4668             Registers a comment for emitComemnt() to use later.
4669         * bytecompiler/BytecodeGenerator.h:
4670         (BytecodeGenerator):
4671         (JSC::BytecodeGenerator::emitComment):
4672         (JSC::BytecodeGenerator::prependComment):
4673             These are inlined versions of these functions that nullify them
4674             when ENABLE_BYTECODE_COMMENTS is 0.
4675         (JSC::BytecodeGenerator::comments):
4676
4677 2012-06-28  Oliver Hunt  <oliver@apple.com>
4678
4679         32bit DFG incorrectly claims an fpr is fillable even if it has not been proven double
4680         https://bugs.webkit.org/show_bug.cgi?id=90127
4681
4682         Reviewed by Filip Pizlo.
4683
4684         The 32-bit version of fillSpeculateDouble doesn't handle Number->fpr loads
4685         correctly.  This patch fixes this by killing the fill info in the GenerationInfo
4686         when the spillFormat doesn't guarantee the value is a double.
4687
4688         * dfg/DFGSpeculativeJIT32_64.cpp:
4689         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
4690
4691 2012-06-28  Kent Tamura  <tkent@chromium.org>
4692
4693         Classify form control states by their owner forms
4694         https://bugs.webkit.org/show_bug.cgi?id=89950
4695
4696         Reviewed by Hajime Morita.
4697
4698         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
4699         Expose WTF::StringBuilder::canShrink()
4700
4701 2012-06-27  Michael Saboff  <msaboff@apple.com>
4702
4703         [Win] jscore-tests flakey
4704         https://bugs.webkit.org/show_bug.cgi?id=88118
4705
4706         Reviewed by Jessie Berlin.
4707
4708         jsDriver.pl on windows intermittently doesn't get the returned value from jsc,
4709         instead it gets 126.  Added a new option to jsc (-x) which prints the exit
4710         code before exiting.  jsDriver.pl uses this option on Windows and parses the
4711         exit code output for the exit code, removing it before comparing the actual
4712         and expected outputs.  Filed a follow on "FIXME" defect:
4713         [WIN] Intermittent failure for jsc return value to propagate through jsDriver.pl
4714         https://bugs.webkit.org/show_bug.cgi?id=90119
4715
4716         * jsc.cpp:
4717         (CommandLine::CommandLine):
4718         (CommandLine):
4719         (printUsageStatement):
4720         (parseArguments):
4721         (jscmain):
4722         * tests/mozilla/jsDriver.pl:
4723         (execute_tests):
4724
4725 2012-06-27  Sheriff Bot  <webkit.review.bot@gmail.com>
4726
4727         Unreviewed, rolling out r121359.
4728         http://trac.webkit.org/changeset/121359
4729         https://bugs.webkit.org/show_bug.cgi?id=90115
4730
4731         Broke many inspector tests (Requested by jpfau on #webkit).
4732
4733         * interpreter/Interpreter.h:
4734         (JSC::StackFrame::toString):
4735
4736 2012-06-27  Filip Pizlo  <fpizlo@apple.com>
4737
4738         Javascript SHA-512 gives wrong hash on second and subsequent runs unless Web Inspector Javascript Debugging is on
4739         https://bugs.webkit.org/show_bug.cgi?id=90053
4740         <rdar://problem/11764613>
4741
4742         Reviewed by Mark Hahnenberg.
4743
4744         The problem is that the code was assuming that the recovery should be Undefined if the source of
4745         the SetLocal was !shouldGenerate(). But that's wrong, since the DFG optimizer may skip around a
4746         UInt32ToNumber node (hence making it !shouldGenerate()) and keep the source of that node alive.
4747         In that case we should base the recovery on the source of the UInt32ToNumber. The logic for this
4748         was already in place but the fast check for !shouldGenerate() broke it.
4749
4750         * dfg/DFGSpeculativeJIT.cpp:
4751         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
4752
4753 2012-06-27  Filip Pizlo  <fpizlo@apple.com>
4754
4755         DFG disassembly should be easier to read
4756         https://bugs.webkit.org/show_bug.cgi?id=90106
4757
4758         Reviewed by Mark Hahnenberg.
4759
4760         Did a few things:
4761
4762         - Options::showDFGDisassembly now shows OSR exit disassembly as well.
4763
4764         - Phi node dumping doesn't attempt to do line wrapping since it just made the dump harder
4765           to read.
4766
4767         - DFG graph disassembly view shows a few additional node types that turn out to be
4768           essential for understanding OSR exits.
4769
4770         Put together, these changes reinforce the philosophy that anything needed for computing
4771         OSR exit is just as important as the machine code itself. Of course, we still don't take
4772         that philosophy to its full extreme - for example Phantom nodes are not dumped. We may
4773         revisit that in the future.
4774
4775         * assembler/LinkBuffer.cpp:
4776         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
4777         * assembler/LinkBuffer.h:
4778         (JSC):
4779         * dfg/DFGDisassembler.cpp:
4780         (JSC::DFG::Disassembler::dump):
4781         * dfg/DFGGraph.cpp:
4782         (JSC::DFG::Graph::dumpBlockHeader):
4783         * dfg/DFGNode.h:
4784         (JSC::DFG::Node::willHaveCodeGenOrOSR):
4785         * dfg/DFGOSRExitCompiler.cpp:
4786         * jit/JIT.cpp:
4787         (JSC::JIT::privateCompile):
4788
4789 2012-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
4790
4791         JSLock should be per-JSGlobalData
4792         https://bugs.webkit.org/show_bug.cgi?id=89123
4793
4794         Reviewed by Geoffrey Garen.
4795
4796         * API/APIShims.h:
4797         (APIEntryShimWithoutLock):
4798         (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to
4799         determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the
4800         HeapTimer class because timerDidFire could run after somebody has started to tear down that particular
4801         JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after
4802         its destruction has begun.
4803         (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
4804         (JSC::APIEntryShim::APIEntryShim):
4805         (APIEntryShim):
4806         (JSC::APIEntryShim::~APIEntryShim):
4807         (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors.
4808         Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock
4809         and before we've released it, which can only done in APIEntryShim.
4810         (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here.
4811         * API/JSContextRef.cpp:
4812         (JSGlobalContextCreate):
4813         (JSGlobalContextCreateInGroup):
4814         (JSGlobalContextRelease):
4815         (JSContextCreateBacktrace):
4816         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
4817         * heap/CopiedSpace.cpp:
4818         (JSC::CopiedSpace::tryAllocateSlowCase):
4819         * heap/Heap.cpp:
4820         (JSC::Heap::protect):
4821         (JSC::Heap::unprotect):
4822         (JSC::Heap::collect):
4823         (JSC::Heap::setActivityCallback):
4824         (JSC::Heap::activityCallback):
4825         (JSC::Heap::sweeper):
4826         * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they
4827         are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback
4828         and the IncrementalSweeper to make sure they're the last things that get initialized during construction to
4829         prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about.
4830         (Heap):
4831         * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown.
4832         (JSC::HeapTimer::~HeapTimer):
4833         (JSC::HeapTimer::invalidate):
4834         (JSC):
4835         (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread
4836         that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the
4837         HeapTimer and schedule it to fire immediately so that it can notice and kill itself.
4838         (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed
4839         out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim,
4840         but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case
4841         we were interrupted between releasing our mutex and trying to grab the APILock.
4842         * heap/HeapTimer.h:
4843         (HeapTimer):
4844         * heap/IncrementalSweeper.cpp:
4845         (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles
4846         all of that for us.
4847         (JSC::IncrementalSweeper::create):
4848         * heap/IncrementalSweeper.h:
4849         (IncrementalSweeper):
4850         * heap/MarkedAllocator.cpp:
4851         (JSC::MarkedAllocator::allocateSlowCase):
4852         * heap/WeakBlock.cpp:
4853         (JSC::WeakBlock::reap):
4854         * jsc.cpp:
4855         (functionGC):
4856         (functionReleaseExecutableMemory):
4857         (jscmain):
4858         * runtime/Completion.cpp:
4859         (JSC::checkSyntax):
4860         (JSC::evaluate):
4861         * runtime/GCActivityCallback.h:
4862         (DefaultGCActivityCallback):
4863         (JSC::DefaultGCActivityCallback::create):
4864         * runtime/JSGlobalData.cpp:
4865         (JSC::JSGlobalData::JSGlobalData):
4866         (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper)
4867         that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity
4868         it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the
4869         APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes.
4870         (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock.
4871         (JSC::JSGlobalData::sharedInstanceInternal):
4872         * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and
4873         de-refing JSGlobalDatas on separate threads since we don't do it that often anyways.
4874         (JSGlobalData):
4875         (JSC::JSGlobalData::apiLock):
4876         * runtime/JSGlobalObject.cpp:
4877         (JSC::JSGlobalObject::~JSGlobalObject):
4878         (JSC::JSGlobalObject::init):
4879         * runtime/JSLock.cpp:
4880         (JSC):
4881         (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance.
4882         (JSC::GlobalJSLock::~GlobalJSLock):
4883         (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that
4884         it can successfully unlock it later without it disappearing from underneath it.
4885         (JSC::JSLockHolder::~JSLockHolder):
4886         (JSC::JSLock::JSLock):
4887         (JSC::JSLock::~JSLock):
4888         (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for
4889         actually waiting for long periods.
4890         (JSC::JSLock::unlock):
4891         (JSC::JSLock::currentThreadIsHoldingLock):
4892         (JSC::JSLock::dropAllLocks):
4893         (JSC::JSLock::dropAllLocksUnconditionally):
4894         (JSC::JSLock::grabAllLocks):
4895         (JSC::JSLock::DropAllLocks::DropAllLocks):
4896         (JSC::JSLock::DropAllLocks::~DropAllLocks):
4897         * runtime/JSLock.h:
4898         (JSC):
4899         (GlobalJSLock):
4900         (JSLockHolder):
4901         (JSLock):
4902         (DropAllLocks):
4903         * runtime/WeakGCMap.h:
4904         (JSC::WeakGCMap::set):
4905         * testRegExp.cpp:
4906         (realMain):
4907
4908 2012-06-27  Filip Pizlo  <fpizlo@apple.com>
4909
4910         x86 disassembler confuses immediates with addresses
4911         https://bugs.webkit.org/show_bug.cgi?id=90099
4912
4913         Reviewed by Mark Hahnenberg.
4914
4915         Prepend "$" to immediates to disambiguate between immediates and addresses. This is in
4916         accordance with the gas and AT&T syntax.
4917
4918         * disassembler/udis86/udis86_syn-att.c:
4919         (gen_operand):
4920
4921 2012-06-27  Filip Pizlo  <fpizlo@apple.com>
4922
4923         Add a comment clarifying Options::showDisassembly versus Options::showDFGDisassembly.
4924
4925         Rubber stamped by Mark Hahnenberg.
4926
4927         * runtime/Options.cpp:
4928         (JSC::Options::initializeOptions):
4929
4930 2012-06-27  Anthony Scian  <ascian@rim.com>
4931
4932         Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
4933         https://bugs.webkit.org/show_bug.cgi?id=40118
4934
4935         Reviewed by Yong Li.
4936
4937         Added member functions to expose function name, urlString, and line #.
4938         Refactored toString to make use of these member functions to reduce
4939         duplicated code for future maintenance.
4940
4941         Manually tested refactoring of toString by tracing thrown exceptions.
4942
4943         * interpreter/Interpreter.h:
4944         (StackFrame):
4945         (JSC::StackFrame::toString):
4946         (JSC::StackFrame::friendlySourceURL):
4947         (JSC::StackFrame::friendlyFunctionName):
4948         (JSC::StackFrame::friendlyLineNumber):
4949
4950 2012-06-27  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
4951
4952         [Qt] Remove redundant c++11 warning suppression code
4953
4954         This is already handled in default_post.
4955
4956         Reviewed by Tor Arne Vestbø.
4957
4958         * Target.pri:
4959
4960 2012-06-26  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
4961
4962         [Qt] Add missing heades to HEADERS
4963
4964         For JavaScriptCore there aren't any Qt specific files, so we include all
4965         headers for easy editing in Qt Creator.
4966
4967         Reviewed by Simon Hausmann.
4968
4969         * Target.pri:
4970
4971 2012-06-26  Dominic Cooney  <dominicc@chromium.org>
4972
4973         [Chromium] Remove unused build scripts and empty folders for JavaScriptCore w/ gyp
4974         https://bugs.webkit.org/show_bug.cgi?id=90029
4975
4976         Reviewed by Adam Barth.
4977
4978         * gyp: Removed.
4979         * gyp/generate-derived-sources.sh: Removed.
4980         * gyp/generate-dtrace-header.sh: Removed.
4981         * gyp/run-if-exists.sh: Removed.
4982         * gyp/update-info-plist.sh: Removed.
4983
4984 2012-06-26  Geoffrey Garen  <ggaren@apple.com>
4985
4986         Reduced (but did not eliminate) use of "berzerker GC"
4987         https://bugs.webkit.org/show_bug.cgi?id=89237
4988
4989         Reviewed by Gavin Barraclough.
4990
4991         (PART 2)
4992
4993         This part turns off "berzerker GC" and turns on incremental shrinking.
4994
4995         * heap/IncrementalSweeper.cpp:
4996         (JSC::IncrementalSweeper::doSweep): Free or shrink after sweeping to
4997         maintain the behavior we used to get from the occasional berzerker GC,
4998         which would run all finalizers and then free or shrink all blocks
4999         synchronously.
5000
5001         * heap/MarkedBlock.h:
5002         (JSC::MarkedBlock::needsSweeping): Sweep zapped blocks, too. It's always
5003         safe to sweep a zapped block (that's the point of zapping), and it's
5004         sometimes profitable. For example, consider this case: Block A does some
5005         allocation (transitioning Block A from Marked to FreeListed), then GC
5006         happens (transitioning Block A to Zapped), then all objects in Block A
5007         are free, then the incremental sweeper visits Block A. If we skipped
5008         Zapped blocks, we'd skip Block A, even though it would be profitable to
5009         run its destructors and free its memory.
5010
5011         * runtime/GCActivityCallback.cpp:
5012         (JSC::DefaultGCActivityCallback::doWork): Don't sweep eagerly; we'll do
5013         this incrementally.
5014
5015 2012-06-26  Filip Pizlo  <fpizlo@apple.com>
5016
5017         DFG PutByValAlias is too aggressive
5018         https://bugs.webkit.org/show_bug.cgi?id=90026
5019         <rdar://problem/11751830>
5020
5021         Reviewed by Gavin Barraclough.
5022
5023         For CSE on normal arrays, we now treat PutByVal as impure. This does not appear to affect
5024         performance by much.
5025
5026         For CSE on typed arrays, we fix PutByValAlias by making GetByVal speculate that the access
5027         is within bounds. This also has the effect of making our out-of-bounds handling consistent
5028         with WebCore.
5029
5030         * dfg/DFGCSEPhase.cpp:
5031         (JSC::DFG::CSEPhase::performNodeCSE):
5032         * dfg/DFGGraph.h:
5033         (JSC::DFG::Graph::byValIsPure):
5034         (JSC::DFG::Graph::clobbersWorld):
5035         * dfg/DFGNodeType.h:
5036         (DFG):
5037         * dfg/DFGSpeculativeJIT.cpp:
5038         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
5039         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
5040
5041 2012-06-26  Yong Li  <yoli@rim.com>
5042
5043         [BlackBerry] Add JSC statistics into about:memory
5044         https://bugs.webkit.org/show_bug.cgi?id=89779
5045
5046         Reviewed by Rob Buis.
5047
5048         Fix non-JIT build on BlackBerry broken by r121196.
5049
5050         * runtime/MemoryStatistics.cpp:
5051         (JSC::globalMemoryStatistics):
5052
5053 2012-06-25  Filip Pizlo  <fpizlo@apple.com>
5054
5055         DFG::operationNewArray is unnecessarily slow, and may use the wrong array
5056         prototype when inlined
5057         https://bugs.webkit.org/show_bug.cgi?id=89821
5058
5059         Reviewed by Geoffrey Garen.
5060
5061         Fixes all array allocations to use the right structure, and hence the right prototype. Adds
5062         inlining of new Array(...) with a non-zero number of arguments. Optimizes allocations of
5063         empty arrays.
5064
5065         * dfg/DFGAbstractState.cpp:
5066         (JSC::DFG::AbstractState::execute):
5067         * dfg/DFGByteCodeParser.cpp:
5068         (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
5069         * dfg/DFGCCallHelpers.h:
5070         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
5071         (CCallHelpers):
5072         * dfg/DFGNodeType.h:
5073         (DFG):
5074         * dfg/DFGOperations.cpp:
5075         * dfg/DFGOperations.h:
5076         * dfg/DFGPredictionPropagationPhase.cpp:
5077         (JSC::DFG::PredictionPropagationPhase::propagate):
5078         * dfg/DFGSpeculativeJIT.h:
5079         (JSC::DFG::SpeculativeJIT::callOperation):
5080         * dfg/DFGSpeculativeJIT32_64.cpp:
5081         (JSC::DFG::SpeculativeJIT::compile):
5082         * dfg/DFGSpeculativeJIT64.cpp:
5083         (JSC::DFG::SpeculativeJIT::compile):
5084         * runtime/JSArray.h:
5085         (JSC):
5086         (JSC::constructArray):
5087         * runtime/JSGlobalObject.h:
5088         (JSC):
5089         (JSC::constructArray):
5090
5091 2012-06-26  Filip Pizlo  <fpizlo@apple.com>
5092
5093         New fast/js/dfg-store-unexpected-value-into-argument-and-osr-exit.html fails on 32 bit
5094         https://bugs.webkit.org/show_bug.cgi?id=89953
5095
5096         Reviewed by Zoltan Herczeg.
5097
5098         DFG 32-bit JIT was confused about the difference between a predicted type and a
5099         proven type. This is easy to get confused about, since a local that is predicted int32
5100         almost always means that the local must be an int32 since speculations are hoisted to
5101         stores to locals. But that is less likely to be the case for arguments, where there is
5102         an additional least-upper-bounding step: any store to an argument with a weird type
5103         may force the argument to be any type.
5104
5105         This patch basically duplicates the functionality in DFGSpeculativeJIT64.cpp for
5106         GetLocal: the decision of whether to load a local as an int32 (or as an array, or as
5107         a boolean) is made based on the AbstractValue::m_type, which is a type proof, rather
5108         than the VariableAccessData::prediction(), which is a predicted type.
5109
5110         * dfg/DFGSpeculativeJIT32_64.cpp:
5111         (JSC::DFG::SpeculativeJIT::compile):
5112
5113 2012-06-25  Filip Pizlo  <fpizlo@apple.com>
5114
5115         JSC should try to make profiling deterministic because otherwise reproducing failures is
5116         nearly impossible
5117         https://bugs.webkit.org/show_bug.cgi?id=89940
5118
5119         Rubber stamped by Gavin Barraclough.
5120
5121         This rolls out the part of http://trac.webkit.org/changeset/121215 that introduced randomness
5122         into the system. Now, instead of randomizing the tier-up threshold, we always set it to an
5123         artificially low (and statically predetermined!) value. This gives most of the benefit of
5124         threshold randomization without actually making the system behave completely differently on
5125         each invocation.
5126
5127         * bytecode/ExecutionCounter.cpp:
5128         (JSC::ExecutionCounter::setThreshold):
5129         * runtime/Options.cpp:
5130         (Options):
5131         (JSC::Options::initializeOptions):
5132         * runtime/Options.h:
5133         (Options):
5134
5135 2012-06-22  Filip Pizlo  <fpizlo@apple.com>
5136
5137         Value profiling should use tier-up threshold randomization to get more coverage
5138         https://bugs.webkit.org/show_bug.cgi?id=89802
5139
5140         Reviewed by Gavin Barraclough.
5141
5142         This patch causes both LLInt and Baseline JIT code to take the OSR slow path several
5143         times before actually doing OSR. If we take the OSR slow path before the execution
5144         count threshold is reached, then we just call CodeBlock::updateAllPredictions() to
5145         compute the current latest least-upper-bound SpecType of all values seen in each
5146         ValueProfile.
5147
5148         * bytecode/CodeBlock.cpp:
5149         (JSC::CodeBlock::stronglyVisitStrongReferences):
5150         (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
5151         (JSC):
5152         (JSC::CodeBlock::updateAllPredictions):
5153         (JSC::CodeBlock::shouldOptimizeNow):
5154         * bytecode/CodeBlock.h:
5155         (JSC::CodeBlock::llintExecuteCounter):
5156         (JSC::CodeBlock::jitExecuteCounter):
5157         (CodeBlock):
5158         (JSC::CodeBlock::updateAllPredictions):
5159         * bytecode/ExecutionCounter.cpp:
5160         (JSC::ExecutionCounter::setThreshold):
5161         (JSC::ExecutionCounter::status):
5162         (JSC):
5163         * bytecode/ExecutionCounter.h:
5164         (JSC::ExecutionCounter::count):
5165         (ExecutionCounter):
5166         * dfg/DFGAbstractState.cpp:
5167         (JSC::DFG::AbstractState::execute):
5168         * dfg/DFGOperations.cpp:
5169         * dfg/DFGSpeculativeJIT.cpp:
5170         (JSC::DFG::SpeculativeJIT::compile):
5171         * jit/JITStubs.cpp:
5172         (JSC::DEFINE_STUB_FUNCTION):
5173         * llint/LLIntSlowPaths.cpp:
5174         (JSC::LLInt::jitCompileAndSetHeuristics):
5175         (JSC::LLInt::entryOSR):
5176         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
5177         * runtime/JSGlobalObject.cpp:
5178         (JSC::JSGlobalObject::JSGlobalObject):
5179         (JSC):
5180         * runtime/JSGlobalObject.h:
5181         (JSGlobalObject):
5182         (JSC::JSGlobalObject::weakRandomInteger):
5183         * runtime/Options.cpp:
5184         (Options):
5185         (JSC::Options::initializeOptions):
5186         * runtime/Options.h:
5187         (Options):
5188         * runtime/WeakRandom.h:
5189         (WeakRandom):
5190         (JSC::WeakRandom::seedUnsafe):
5191
5192 2012-06-25  Yong Li  <yoli@rim.com>
5193
5194         [BlackBerry] Add JSC statistics into about:memory
5195         https://bugs.webkit.org/show_bug.cgi?id=89779
5196
5197         Reviewed by Rob Buis.
5198
5199         Add MemoryStatistics.cpp into build, and fill JITBytes for BlackBerry port.
5200
5201         * PlatformBlackBerry.cmake:
5202         * runtime/MemoryStatistics.cpp:
5203         (JSC::globalMemoryStatistics):
5204
5205 2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
5206
5207         Unreviewed, rolling out r121058.
5208         http://trac.webkit.org/changeset/121058
5209         https://bugs.webkit.org/show_bug.cgi?id=89809
5210
5211         Patch causes plugins tests to crash in GTK debug builds
5212         (Requested by zdobersek on #webkit).
5213
5214         * API/APIShims.h:
5215         (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
5216         (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
5217         (APIEntryShimWithoutLock):
5218         (JSC::APIEntryShim::APIEntryShim):
5219         (APIEntryShim):
5220         (JSC::APICallbackShim::~APICallbackShim):
5221         * API/JSContextRef.cpp:
5222         (JSGlobalContextCreate):
5223         (JSGlobalContextCreateInGroup):
5224         (JSGlobalContextRelease):
5225         (JSContextCreateBacktrace):
5226         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
5227         * heap/CopiedSpace.cpp:
5228         (JSC::CopiedSpace::tryAllocateSlowCase):
5229         * heap/Heap.cpp:
5230         (JSC::Heap::protect):
5231         (JSC::Heap::unprotect):
5232         (JSC::Heap::collect):
5233         (JSC::Heap::setActivityCallback):
5234         (JSC::Heap::activityCallback):
5235         (JSC::Heap::sweeper):
5236         * heap/Heap.h:
5237         (Heap):
5238         * heap/HeapTimer.cpp:
5239         (JSC::HeapTimer::~HeapTimer):
5240         (JSC::HeapTimer::invalidate):
5241         (JSC::HeapTimer::timerDidFire):
5242         (JSC):
5243         * heap/HeapTimer.h:
5244         (HeapTimer):
5245         * heap/IncrementalSweeper.cpp:
5246         (JSC::IncrementalSweeper::doWork):
5247         (JSC::IncrementalSweeper::create):
5248         * heap/IncrementalSweeper.h:
5249         (IncrementalSweeper):
5250         * heap/MarkedAllocator.cpp:
5251         (JSC::MarkedAllocator::allocateSlowCase):
5252         * heap/WeakBlock.cpp:
5253         (JSC::WeakBlock::reap):
5254         * jsc.cpp:
5255         (functionGC):
5256         (functionReleaseExecutableMemory):
5257         (jscmain):
5258         * runtime/Completion.cpp:
5259         (JSC::checkSyntax):
5260         (JSC::evaluate):
5261         * runtime/GCActivityCallback.h:
5262         (DefaultGCActivityCallback):
5263         (JSC::DefaultGCActivityCallback::create):
5264         * runtime/JSGlobalData.cpp:
5265         (JSC::JSGlobalData::JSGlobalData):
5266         (JSC::JSGlobalData::~JSGlobalData):
5267         (JSC::JSGlobalData::sharedInstance):
5268         (JSC::JSGlobalData::sharedInstanceInternal):
5269         * runtime/JSGlobalData.h:
5270         (JSGlobalData):
5271         * runtime/JSGlobalObject.cpp:
5272         (JSC::JSGlobalObject::~JSGlobalObject):
5273         (JSC::JSGlobalObject::init):
5274         * runtime/JSLock.cpp:
5275         (JSC):
5276         (JSC::createJSLockCount):
5277         (JSC::JSLock::lockCount):
5278         (JSC::setLockCount):
5279         (JSC::JSLock::JSLock):
5280         (JSC::JSLock::lock):
5281         (JSC::JSLock::unlock):
5282         (JSC::JSLock::currentThreadIsHoldingLock):
5283         (JSC::JSLock::DropAllLocks::DropAllLocks):
5284         (JSC::JSLock::DropAllLocks::~DropAllLocks):
5285         * runtime/JSLock.h:
5286         (JSC):
5287         (JSLock):
5288         (JSC::JSLock::JSLock):
5289         (JSC::JSLock::~JSLock):
5290         (DropAllLocks):
5291         * runtime/WeakGCMap.h:
5292         (JSC::WeakGCMap::set):
5293         * testRegExp.cpp:
5294         (realMain):
5295
5296 2012-06-22  Alexandru Chiculita  <achicu@adobe.com>
5297
5298         [CSS Shaders] Re-enable the CSS Shaders compile time flag on Safari Mac
5299         https://bugs.webkit.org/show_bug.cgi?id=89781
5300
5301         Reviewed by Dean Jackson.
5302
5303         Added ENABLE_CSS_SHADERS flag as enabled by default on Safari for Mac.
5304
5305         * Configurations/FeatureDefines.xcconfig:
5306
5307 2012-06-22  Filip Pizlo  <fpizlo@apple.com>
5308
5309         DFG tier-up should happen in prologues, not epilogues
5310         https://bugs.webkit.org/show_bug.cgi?id=89752
5311
5312         Reviewed by Geoffrey Garen.
5313
5314         This change has two outcomes:
5315
5316         1) Slightly reduces the likelihood that a function will be optimized both
5317         standalone and via inlining.  Previously, if you had a call sequence like foo()
5318         calls bar() exactly once, and nobody else calls bar(), then bar() would get
5319         optimized first (because it returns first) and then foo() gets optimized.  If foo()
5320         can inline bar() then that means that bar() gets optimized twice.  But now, if we
5321         optimize in prologues, then foo() will be optimized first.  If it inlines bar(),
5322         that means that there will no longer be any calls to bar().
5323
5324         2) It lets us kill some code in JITStubs.  Epilogue tier-up was very different from
5325         loop tier-up, since epilogue tier-up should not attempt OSR.  But prologue tier-up
5326         requires OSR (albeit really easy OSR since it's the top of the compilation unit),
5327         so it becomes just like loop tier-up.  As a result, we now have one optimization
5328         hook (cti_optimize) instead of two (cti_optimize_from_loop and
5329         cti_optimize_from_ret).
5330
5331         As a consequence of not having an optimization check in epilogues, the OSR exit
5332         code must now trigger reoptimization itself instead of just signaling the epilogue
5333         check to fire.
5334
5335         This also adds the ability to count the number of DFG compilations, which was
5336         useful for debugging this patch and might be useful for other things in the future.
5337
5338         * bytecode/CodeBlock.cpp:
5339         (JSC::CodeBlock::reoptimize):
5340         (JSC):
5341         * bytecode/CodeBlock.h:
5342         (CodeBlock):
5343         * dfg/DFGByteCodeParser.cpp:
5344         (JSC::DFG::ByteCodeParser::parseCodeBlock):
5345         * dfg/DFGDriver.cpp:
5346         (DFG):
5347         (JSC::DFG::getNumCompilations):
5348         (JSC::DFG::compile):
5349         * dfg/DFGDriver.h:
5350         (DFG):
5351         * dfg/DFGOSRExitCompiler.cpp:
5352         (JSC::DFG::OSRExitCompiler::handleExitCounts):
5353         * dfg/DFGOperations.cpp:
5354         * dfg/DFGOperations.h:
5355         * jit/JIT.cpp:
5356         (JSC::JIT::emitOptimizationCheck):
5357         * jit/JIT.h:
5358         * jit/JITCall32_64.cpp:
5359         (JSC::JIT::emit_op_ret):
5360         (JSC::JIT::emit_op_ret_object_or_this):
5361         * jit/JITOpcodes.cpp:
5362         (JSC::JIT::emit_op_ret):
5363         (JSC::JIT::emit_op_ret_object_or_this):
5364         (JSC::JIT::emit_op_enter):
5365         * jit/JITOpcodes32_64.cpp:
5366         (JSC::JIT::emit_op_enter):
5367         * jit/JITStubs.cpp:
5368         (JSC::DEFINE_STUB_FUNCTION):
5369         * jit/JITStubs.h:
5370
5371 2012-06-20  Mark Hahnenberg  <mhahnenberg@apple.com>
5372
5373         JSLock should be per-JSGlobalData
5374         https://bugs.webkit.org/show_bug.cgi?id=89123
5375
5376         Reviewed by Gavin Barraclough.
5377
5378         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
5379         * API/APIShims.h:
5380         (APIEntryShimWithoutLock):
5381         (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to
5382         determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the
5383         HeapTimer class because timerDidFire could run after somebody has started to tear down that particular
5384         JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after
5385         its destruction has begun.
5386         (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock): Now derefs if it also refed.
5387         (JSC::APIEntryShim::APIEntryShim):
5388         (APIEntryShim):
5389         (JSC::APIEntryShim::~APIEntryShim):
5390         (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors.
5391         Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock
5392         and before we've released it, which can only done in APIEntryShim.
5393         (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here.
5394         * API/JSContextRef.cpp:
5395         (JSGlobalContextCreate):
5396         (JSGlobalContextCreateInGroup):
5397         (JSGlobalContextRelease):
5398         (JSContextCreateBacktrace):
5399         * heap/CopiedSpace.cpp:
5400         (JSC::CopiedSpace::tryAllocateSlowCase):
5401         * heap/Heap.cpp:
5402         (JSC::Heap::protect):
5403         (JSC::Heap::unprotect):
5404         (JSC::Heap::collect):
5405         (JSC::Heap::setActivityCallback):
5406         (JSC::Heap::activityCallback):
5407         (JSC::Heap::sweeper):
5408         * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they
5409         are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback
5410         and the IncrementalSweeper to make sure they're the last things that get initialized during construction to
5411         prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about.
5412         (Heap):
5413         * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown.
5414         (JSC::HeapTimer::~HeapTimer):
5415         (JSC::HeapTimer::invalidate):
5416         (JSC):
5417         (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread
5418         that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the
5419         HeapTimer and schedule it to fire immediately so that it can notice and kill itself.
5420         (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed
5421         out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim,
5422         but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case
5423         we were interrupted between releasing our mutex and trying to grab the APILock.
5424         * heap/HeapTimer.h:
5425         (HeapTimer):
5426         * heap/IncrementalSweeper.cpp:
5427         (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles
5428         all of that for us.
5429         (JSC::IncrementalSweeper::create):
5430         * heap/IncrementalSweeper.h:
5431         (IncrementalSweeper):
5432         * heap/MarkedAllocator.cpp:
5433         (JSC::MarkedAllocator::allocateSlowCase):
5434         * heap/WeakBlock.cpp:
5435         (JSC::WeakBlock::reap):
5436         * jsc.cpp:
5437         (functionGC):
5438         (functionReleaseExecutableMemory):
5439         (jscmain):
5440         * runtime/Completion.cpp:
5441         (JSC::checkSyntax):
5442         (JSC::evaluate):
5443         * runtime/GCActivityCallback.h:
5444         (DefaultGCActivityCallback):
5445         (JSC::DefaultGCActivityCallback::create):
5446         * runtime/JSGlobalData.cpp:
5447         (JSC::JSGlobalData::JSGlobalData):
5448         (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper)
5449         that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity
5450         it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the
5451         APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes.
5452         (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock.
5453         (JSC::JSGlobalData::sharedInstanceInternal):
5454         * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and
5455         de-refing JSGlobalDatas on separate threads since we don't do it that often anyways.
5456         (JSGlobalData):
5457         (JSC::JSGlobalData::apiLock):
5458         * runtime/JSGlobalObject.cpp:
5459         (JSC::JSGlobalObject::~JSGlobalObject):
5460         (JSC::JSGlobalObject::init):
5461         * runtime/JSLock.cpp:
5462         (JSC):
5463         (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance.
5464         (JSC::GlobalJSLock::~GlobalJSLock):
5465         (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that
5466         it can successfully unlock it later without it disappearing from underneath it.
5467         (JSC::JSLockHolder::~JSLockHolder):
5468         (JSC::JSLock::JSLock):
5469         (JSC::JSLock::~JSLock):
5470         (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for
5471         actually waiting for long periods.
5472         (JSC::JSLock::unlock):
5473         (JSC::JSLock::currentThreadIsHoldingLock):
5474         (JSC::JSLock::dropAllLocks):
5475         (JSC::JSLock::dropAllLocksUnconditionally):
5476         (JSC::JSLock::grabAllLocks):
5477         (JSC::JSLock::DropAllLocks::DropAllLocks):
5478         (JSC::JSLock::DropAllLocks::~DropAllLocks):
5479         * runtime/JSLock.h:
5480         (JSC):
5481         (GlobalJSLock):
5482         (JSLockHolder):
5483         (JSLock):
5484         (DropAllLocks):
5485         * runtime/WeakGCMap.h:
5486         (JSC::WeakGCMap::set):
5487         * testRegExp.cpp:
5488         (realMain):
5489
5490 2012-06-22  Peter Beverloo  <peter@chromium.org>
5491
5492         [Chromium] Disable c++0x compatibility warnings in JavaScriptCore.gyp when building for Android
5493         https://bugs.webkit.org/show_bug.cgi?id=88853
5494
5495         Reviewed by Steve Block.
5496
5497         The Android exclusions were necessary to fix a gyp generation error, as
5498         the gcc_version variable wasn't being defined for Android. Remove these
5499         exceptions when Chromium is able to define the gcc_version variable.
5500
5501         * JavaScriptCore.gyp/JavaScriptCore.gyp:
5502
5503 2012-06-21  Filip Pizlo  <fpizlo@apple.com>
5504
5505         op_resolve_global should not prevent DFG inlining
5506         https://bugs.webkit.org/show_bug.cgi?id=89726
5507
5508         Reviewed by Gavin Barraclough.
5509
5510         * bytecode/CodeBlock.cpp:
5511         (JSC::CodeBlock::CodeBlock):
5512         (JSC::CodeBlock::shrinkToFit):
5513         * bytecode/GlobalResolveInfo.h:
5514         (JSC::GlobalResolveInfo::GlobalResolveInfo):
5515         (GlobalResolveInfo):
5516         * dfg/DFGByteCodeParser.cpp:
5517         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
5518         * dfg/DFGCapabilities.h:
5519         (JSC::DFG::canInlineOpcode):
5520         * dfg/DFGOperations.cpp:
5521         * dfg/DFGOperations.h:
5522         * dfg/DFGSpeculativeJIT.h:
5523         (JSC::DFG::SpeculativeJIT::callOperation):
5524         * dfg/DFGSpeculativeJIT32_64.cpp:
5525         (JSC::DFG::SpeculativeJIT::compile):
5526         * dfg/DFGSpeculativeJIT64.cpp:
5527         (JSC::DFG::SpeculativeJIT::compile):
5528
5529 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5530
5531         DFG should inline 'new Array()'
5532         https://bugs.webkit.org/show_bug.cgi?id=89632
5533
5534         Reviewed by Geoffrey Garen.
5535
5536         This adds support for treating InternalFunction like intrinsics. The code
5537         to do so is actually quite clean, so I don't feel bad about perpetuating
5538         the InternalFunction vs. JSFunction-with-NativeExecutable dichotomy.
5539
5540         Currently this newfound power is only used to inline 'new Array()'.
5541
5542         * dfg/DFGByteCodeParser.cpp:
5543         (ByteCodeParser):
5544         (JSC::DFG::ByteCodeParser::handleCall):
5545         (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
5546         (DFG):
5547         * dfg/DFGGraph.h:
5548         (JSC::DFG::Graph::isInternalFunctionConstant):
5549         (JSC::DFG::Graph::valueOfInternalFunctionConstant):
5550
5551 2012-06-21  Mark Hahnenberg  <mhahnenberg@apple.com>
5552
5553         Adding copyrights to new files.
5554
5555         * heap/HeapTimer.cpp:
5556         * heap/HeapTimer.h:
5557         * heap/IncrementalSweeper.cpp:
5558         * heap/IncrementalSweeper.h:
5559
5560 2012-06-21  Arnaud Renevier  <arno@renevier.net>
5561
5562         make sure headers are included only once per file
5563         https://bugs.webkit.org/show_bug.cgi?id=88922
5564
5565         Reviewed by Alexey Proskuryakov.
5566
5567         * bytecode/CodeBlock.h:
5568         * heap/MachineStackMarker.cpp:
5569         * runtime/JSVariableObject.h:
5570
5571 2012-06-21  Ryuan Choi  <ryuan.choi@gmail.com>
5572
5573         [EFL][WK2] Make WebKit2/Efl headers and resources installable.
5574         https://bugs.webkit.org/show_bug.cgi?id=88207
5575
5576         Reviewed by Chang Shu.
5577
5578         * shell/CMakeLists.txt: Use ${EXEC_INSTALL_DIR} instead of hardcoding "bin"
5579
5580 2012-06-20  Geoffrey Garen  <ggaren@apple.com>
5581
5582         Reduced (but did not eliminate) use of "berzerker GC"
5583         https://bugs.webkit.org/show_bug.cgi?id=89237
5584
5585         Reviewed by Gavin Barraclough.
5586
5587         (PART 1)
5588
5589         This patch turned out to be crashy, so I'm landing the non-crashy bits
5590         first.
5591
5592         This part is pre-requisite refactoring. I didn't actually turn off
5593         "berzerker GC" or turn on incremental shrinking.
5594
5595         * heap/MarkedAllocator.cpp:
5596         (JSC::MarkedAllocator::removeBlock): Make sure to clear the free list when
5597         we throw away the block we're currently allocating out of. Otherwise, we'll
5598         allocate out of a stale free list.
5599
5600         * heap/MarkedSpace.cpp:
5601         (JSC::Free::Free):
5602         (JSC::Free::operator()):
5603         (JSC::Free::returnValue): Refactored this functor to use a shared helper
5604         function, so we can share our implementation with the incremental sweeper.
5605
5606         Also changed to freeing individual blocks immediately instead of linking
5607         them into a list for later freeing. This makes the programming interface
5608         simpler, and it's slightly more efficient to boot.
5609
5610         (JSC::MarkedSpace::~MarkedSpace): Updated for rename.
5611
5612         (JSC::MarkedSpace::freeBlock):
5613         (JSC::MarkedSpace::freeOrShrinkBlock): New helper functions to share behavior
5614         with the incremental sweeper.
5615
5616         (JSC::MarkedSpace::shrink): Updated for new functor behavior.
5617
5618         * heap/MarkedSpace.h: Statically typed languages are awesome.
5619
5620 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5621
5622         DFG should optimize ResolveGlobal
5623         https://bugs.webkit.org/show_bug.cgi?id=89617
5624
5625         Reviewed by Oliver Hunt.
5626
5627         This adds inlining of ResolveGlobal accesses that are known monomorphic. It also
5628         adds the specific function optimization to ResolveGlobal, when it is inlined. And,
5629         it makes internal functions act like specific functions, since that will be the
5630         most common use-case of this optimization.
5631
5632         This is only a slighy speed-up (sub 1%), since we don't yet do the obvious thing
5633         with this optimization, which is to completely inline common "globally resolved"
5634         function and constructor calls, like "new Array()".
5635
5636         * CMakeLists.txt:
5637         * GNUmakefile.list.am:
5638         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
5639         * JavaScriptCore.xcodeproj/project.pbxproj:
5640         * Target.pri:
5641         * bytecode/CodeBlock.cpp:
5642         (JSC::CodeBlock::globalResolveInfoForBytecodeOffset):
5643         * bytecode/CodeBlock.h:
5644         (CodeBlock):
5645         (JSC::CodeBlock::numberOfGlobalResolveInfos):
5646         * bytecode/GlobalResolveInfo.h:
5647         (JSC::getGlobalResolveInfoBytecodeOffset):
5648         (JSC):
5649         * bytecode/ResolveGlobalStatus.cpp: Added.
5650         (JSC):
5651         (JSC::computeForStructure):
5652         (JSC::computeForLLInt):
5653         (JSC::ResolveGlobalStatus::computeFor):
5654         * bytecode/ResolveGlobalStatus.h: Added.
5655         (JSC):
5656         (ResolveGlobalStatus):
5657         (JSC::ResolveGlobalStatus::ResolveGlobalStatus):
5658         (JSC::ResolveGlobalStatus::state):
5659         (JSC::ResolveGlobalStatus::isSet):
5660         (JSC::ResolveGlobalStatus::operator!):
5661         (JSC::ResolveGlobalStatus::isSimple):
5662         (JSC::ResolveGlobalStatus::takesSlowPath):
5663         (JSC::ResolveGlobalStatus::structure):
5664         (JSC::ResolveGlobalStatus::offset):
5665         (JSC::ResolveGlobalStatus::specificValue):
5666         * dfg/DFGByteCodeParser.cpp:
5667         (ByteCodeParser):
5668         (JSC::DFG::ByteCodeParser::handleGetByOffset):
5669         (DFG):
5670         (JSC::DFG::ByteCodeParser::handleGetById):
5671         (JSC::DFG::ByteCodeParser::parseBlock):
5672         * runtime/JSObject.cpp:
5673         (JSC::getCallableObjectSlow):
5674         (JSC):
5675         (JSC::JSObject::put):
5676         (JSC::JSObject::putDirectVirtual):
5677         (JSC::JSObject::putDirectAccessor):
5678         * runtime/JSObject.h:
5679         (JSC):
5680         (JSC::getCallableObject):
5681         (JSC::JSObject::putOwnDataProperty):
5682         (JSC::JSObject::putDirect):
5683         (JSC::JSObject::putDirectWithoutTransition):
5684
5685 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5686
5687         Functions on global objects should be specializable
5688         https://bugs.webkit.org/show_bug.cgi?id=89615
5689
5690         Reviewed by Oliver Hunt.
5691
5692         I tested to see if this brought back the bug in https://bugs.webkit.org/show_bug.cgi?id=33343,
5693         and it didn't. Bug 33343 was the reason why we disabled global object function specialization
5694         to begin with. So I'm guessing this is safe.
5695
5696         * runtime/JSGlobalObject.cpp:
5697         (JSC::JSGlobalObject::init):
5698
5699 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5700
5701         build-webkit failure due to illegal 32-bit integer constants in code
5702         generated by offlineasm
5703         https://bugs.webkit.org/show_bug.cgi?id=89347
5704
5705         Reviewed by Geoffrey Garen.
5706
5707         The offending constants are the magic numbers used by offlineasm to find
5708         offsets in the generated machine code. Added code to turn them into what
5709         the C++ compiler will believe to be valid 32-bit values.
5710
5711         * offlineasm/offsets.rb:
5712
5713 2012-06-19  Geoffrey Garen  <ggaren@apple.com>
5714
5715         Made the incremental sweeper more aggressive
5716         https://bugs.webkit.org/show_bug.cgi?id=89527
5717
5718         Reviewed by Oliver Hunt.
5719
5720         This is a pre-requisite to getting rid of "berzerker GC" because we need
5721         the sweeper to reclaim memory in a timely fashion, or we'll see a memory
5722         footprint regression.
5723
5724         * heap/IncrementalSweeper.h:
5725         * heap/IncrementalSweeper.cpp:
5726         (JSC::IncrementalSweeper::scheduleTimer): Since the time slice is predictable,
5727         no need to use a data member to record it.
5728
5729         (JSC::IncrementalSweeper::doSweep): Sweep as many blocks as we can in a
5730         small time slice. This is better than sweeping only one block per timer
5731         fire because that strategy has a heavy timer overhead, and artificially
5732         delays memory reclamation.
5733
5734 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5735
5736         DFG should be able to print disassembly interleaved with the IR
5737         https://bugs.webkit.org/show_bug.cgi?id=89551
5738
5739         Reviewed by Geoffrey Garen.
5740
5741         This change also removes running Dominators unconditionally on every DFG
5742         compile. Dominators are designed to be computed on-demand, and currently
5743         the only demand is graph dumps.
5744
5745         * CMakeLists.txt:
5746         * GNUmakefile.list.am:
5747         * JavaScriptCore.xcodeproj/project.pbxproj:
5748         * Target.pri:
5749         * assembler/ARMv7Assembler.h:
5750         (JSC::ARMv7Assembler::labelIgnoringWatchpoints):
5751         (ARMv7Assembler):
5752         * assembler/AbstractMacroAssembler.h:
5753         (AbstractMacroAssembler):
5754         (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints):
5755         * assembler/X86Assembler.h:
5756         (X86Assembler):
5757         (JSC::X86Assembler::labelIgnoringWatchpoints):
5758         * dfg/DFGCommon.h:
5759         (JSC::DFG::shouldShowDisassembly):
5760         (DFG):
5761         * dfg/DFGDisassembler.cpp: Added.
5762         (DFG):
5763         (JSC::DFG::Disassembler::Disassembler):
5764         (JSC::DFG::Disassembler::dump):
5765         (JSC::DFG::Disassembler::dumpDisassembly):
5766         * dfg/DFGDisassembler.h: Added.
5767         (DFG):
5768         (Disassembler):
5769         (JSC::DFG::Disassembler::setStartOfCode):
5770         (JSC::DFG::Disassembler::setForBlock):
5771         (JSC::DFG::Disassembler::setForNode):
5772         (JSC::DFG::Disassembler::setEndOfMainPath):
5773         (JSC::DFG::Disassembler::setEndOfCode):
5774         * dfg/DFGDriver.cpp:
5775         (JSC::DFG::compile):
5776         * dfg/DFGGraph.cpp:
5777         (JSC::DFG::Graph::dumpCodeOrigin):
5778         (JSC::DFG::Graph::amountOfNodeWhiteSpace):
5779         (DFG):
5780         (JSC::DFG::Graph::printNodeWhiteSpace):
5781         (JSC::DFG::Graph::dump):
5782         (JSC::DFG::Graph::dumpBlockHeader):
5783         * dfg/DFGGraph.h:
5784         * dfg/DFGJITCompiler.cpp:
5785         (JSC::DFG::JITCompiler::JITCompiler):
5786         (DFG):
5787         (JSC::DFG::JITCompiler::compile):
5788         (JSC::DFG::JITCompiler::compileFunction):
5789         * dfg/DFGJITCompiler.h:
5790         (JITCompiler):
5791         (JSC::DFG::JITCompiler::setStartOfCode):
5792         (JSC::DFG::JITCompiler::setForBlock):
5793         (JSC::DFG::JITCompiler::setForNode):
5794         (JSC::DFG::JITCompiler::setEndOfMainPath):
5795         (JSC::DFG::JITCompiler::setEndOfCode):
5796         * dfg/DFGNode.h:
5797         (Node):
5798         (JSC::DFG::Node::willHaveCodeGen):
5799         * dfg/DFGNodeFlags.cpp:
5800         (JSC::DFG::nodeFlagsAsString):
5801         * dfg/DFGSpeculativeJIT.cpp:
5802         (JSC::DFG::SpeculativeJIT::compile):
5803         * dfg/DFGSpeculativeJIT.h:
5804         (SpeculativeJIT):
5805         * runtime/Options.cpp:
5806         (Options):
5807         (JSC::Options::initializeOptions):
5808         * runtime/Options.h:
5809         (Options):
5810
5811 2012-06-19  Filip Pizlo  <fpizlo@apple.com>
5812
5813         JSC should be able to show disassembly for all generated JIT code
5814         https://bugs.webkit.org/show_bug.cgi?id=89536
5815
5816         Reviewed by Gavin Barraclough.
5817
5818         Now instead of doing linkBuffer.finalizeCode(), you do
5819         FINALIZE_CODE(linkBuffer, (... explanation ...)). FINALIZE_CODE() then
5820         prints your explanation and the disassembled code, if
5821         Options::showDisassembly is set to true.
5822
5823         * CMakeLists.txt:
5824         * GNUmakefile.list.am:
5825         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
5826         * JavaScriptCore.xcodeproj/project.pbxproj:
5827         * Target.pri:
5828         * assembler/LinkBuffer.cpp: Added.
5829         (JSC):
5830         (JSC::LinkBuffer::finalizeCodeWithoutDisassembly):
5831         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
5832         (JSC::LinkBuffer::linkCode):
5833         (JSC::LinkBuffer::performFinalization):
5834         (JSC::LinkBuffer::dumpLinkStatistics):
5835         (JSC::LinkBuffer::dumpCode):
5836         * assembler/LinkBuffer.h:
5837         (LinkBuffer):
5838         (JSC):
5839         * assembler/MacroAssemblerCodeRef.h:
5840         (JSC::MacroAssemblerCodeRef::tryToDisassemble):
5841         (MacroAssemblerCodeRef):
5842         * dfg/DFGJITCompiler.cpp:
5843         (JSC::DFG::JITCompiler::compile):
5844         (JSC::DFG::JITCompiler::compileFunction):
5845         * dfg/DFGOSRExitCompiler.cpp:
5846         * dfg/DFGRepatch.cpp:
5847         (JSC::DFG::generateProtoChainAccessStub):
5848         (JSC::DFG::tryCacheGetByID):
5849         (JSC::DFG::tryBuildGetByIDList):
5850         (JSC::DFG::emitPutReplaceStub):
5851         (JSC::DFG::emitPutTransitionStub):
5852         * dfg/DFGThunks.cpp:
5853         (JSC::DFG::osrExitGenerationThunkGenerator):
5854         * disassembler/Disassembler.h:
5855         (JSC):
5856         (JSC::tryToDisassemble):
5857         * disassembler/UDis86Disassembler.cpp:
5858         (JSC::tryToDisassemble):
5859         * jit/JIT.cpp:
5860         (JSC::JIT::privateCompile):
5861         * jit/JITCode.h:
5862         (JSC::JITCode::tryToDisassemble):
5863         * jit/JITOpcodes.cpp:
5864         (JSC::JIT::privateCompileCTIMachineTrampolines):
5865         * jit/JITOpcodes32_64.cpp:
5866         (JSC::JIT::privateCompileCTIMachineTrampolines):
5867         (JSC::JIT::privateCompileCTINativeCall):
5868         * jit/JITPropertyAccess.cpp:
5869         (JSC::JIT::stringGetByValStubGenerator):
5870         (JSC::JIT::privateCompilePutByIdTransition):
5871         (JSC::JIT::privateCompilePatchGetArrayLength):
5872         (JSC::JIT::privateCompileGetByIdProto):
5873         (JSC::JIT::privateCompileGetByIdSelfList):
5874         (JSC::JIT::privateCompileGetByIdProtoList):
5875         (JSC::JIT::privateCompileGetByIdChainList):
5876         (JSC::JIT::privateCompileGetByIdChain):
5877         * jit/JITPropertyAccess32_64.cpp:
5878         (JSC::JIT::stringGetByValStubGenerator):
5879         (JSC::JIT::privateCompilePutByIdTransition):
5880         (JSC::JIT::privateCompilePatchGetArrayLength):
5881         (JSC::JIT::privateCompileGetByIdProto):
5882         (JSC::JIT::privateCompileGetByIdSelfList):
5883         (JSC::JIT::privateCompileGetByIdProtoList):
5884         (JSC::JIT::privateCompileGetByIdChainList):
5885         (JSC::JIT::privateCompileGetByIdChain):
5886         * jit/SpecializedThunkJIT.h:
5887         (JSC::SpecializedThunkJIT::finalize):
5888         * jit/ThunkGenerators.cpp:
5889         (JSC::charCodeAtThunkGenerator):
5890         (JSC::charAtThunkGenerator):
5891         (JSC::fromCharCodeThunkGenerator):
5892         (JSC::sqrtThunkGenerator):
5893         (JSC::floorThunkGenerator):
5894         (JSC::ceilThunkGenerator):
5895         (JSC::roundThunkGenerator):
5896         (JSC::expThunkGenerator):
5897         (JSC::logThunkGenerator):
5898         (JSC::absThunkGenerator):
5899         (JSC::powThunkGenerator):
5900         * llint/LLIntThunks.cpp:
5901         (JSC::LLInt::generateThunkWithJumpTo):
5902         (JSC::LLInt::functionForCallEntryThunkGenerator):
5903         (JSC::LLInt::functionForConstructEntryThunkGenerator):
5904         (JSC::LLInt::functionForCallArityCheckThunkGenerator):
5905         (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
5906         (JSC::LLInt::evalEntryThunkGenerator):
5907         (JSC::LLInt::programEntryThunkGenerator):
5908         * runtime/Options.cpp:
5909         (Options):
5910         (JSC::Options::initializeOptions):
5911         * runtime/Options.h:
5912         (Options):
5913         * yarr/YarrJIT.cpp:
5914         (JSC::Yarr::YarrGenerator::compile):
5915
5916 2012-06-19  Mark Hahnenberg  <mhahnenberg@apple.com>
5917
5918         [Qt][Mac] REGRESSION(r120742): It broke the build
5919         https://bugs.webkit.org/show_bug.cgi?id=89516
5920
5921         Reviewed by Geoffrey Garen.
5922
5923         Removing GCActivityCallbackCF.cpp because it doesn't mesh well with cross-platform
5924         code on Darwin (e.g. Qt). We now use plain ol' vanilla ifdefs to handle platforms
5925         without CF support. These if-defs will probably disappear in the future when we
5926         use cross-platform timers in HeapTimer.
5927
5928         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
5929         * JavaScriptCore.xcodeproj/project.pbxproj:
5930         * runtime/GCActivityCallback.cpp:
5931         (JSC):
5932         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
5933         (JSC::DefaultGCActivityCallback::doWork):
5934         (JSC::DefaultGCActivityCallback::scheduleTimer):
5935         (JSC::DefaultGCActivityCallback::cancelTimer):
5936         (JSC::DefaultGCActivityCallback::didAllocate):
5937         (JSC::DefaultGCActivityCallback::willCollect):
5938         (JSC::DefaultGCActivityCallback::cancel):
5939         * runtime/GCActivityCallbackCF.cpp: Removed.
5940
5941 2012-06-19  Filip Pizlo  <fpizlo@apple.com>
5942
5943         DFG CFA forgets to notify subsequent phases of found constants if it proves LogicalNot to be a constant
5944         https://bugs.webkit.org/show_bug.cgi?id=89511
5945         <rdar://problem/11700089>
5946
5947         Reviewed by Geoffrey Garen.
5948
5949         * dfg/DFGAbstractState.cpp:
5950         (JSC::DFG::AbstractState::execute):
5951
5952 2012-06-19  Mark Lam  <mark.lam@apple.com>
5953
5954         CodeBlock::needsCallReturnIndices() is no longer needed.
5955         https://bugs.webkit.org/show_bug.cgi?id=89490
5956
5957         Reviewed by Geoffrey Garen.
5958
5959         * bytecode/CodeBlock.h:
5960         (JSC::CodeBlock::needsCallReturnIndices): removed.
5961         * dfg/DFGJITCompiler.cpp:
5962         (JSC::DFG::JITCompiler::link):
5963         * jit/JIT.cpp:
5964         (JSC::JIT::privateCompile):
5965
5966 2012-06-19  Filip Pizlo  <fpizlo@apple.com>
5967
5968         Unreviewed, try to fix Windows build.
5969
5970         * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
5971
5972 2012-06-17  Filip Pizlo  <fpizlo@apple.com>
5973
5974         It should be possible to look at disassembly
5975         https://bugs.webkit.org/show_bug.cgi?id=89319
5976
5977         Reviewed by Sam Weinig.
5978
5979         This imports the udis86 disassembler library. The library is placed
5980         behind an abstraction in disassembler/Disassembler.h, so that we can
5981         in the future use other disassemblers (for other platforms) whenever
5982         appropriate. As a first step, the disassembler is being invoked for
5983         DFG verbose dumps.
5984
5985         If we ever want to merge a new version of udis86 in the future, I've
5986         made notes about changes I made to the library in
5987         disassembler/udis86/differences.txt.
5988
5989         * CMakeLists.txt:
5990         * DerivedSources.make:
5991         * GNUmakefile.list.am:
5992         * JavaScriptCore.pri:
5993         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
5994         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
5995         * JavaScriptCore.xcodeproj/project.pbxproj:
5996         * dfg/DFGJITCompiler.cpp:
5997         (JSC::DFG::JITCompiler::compile):
5998         (JSC::DFG::JITCompiler::compileFunction):
5999         * disassembler: Added.
6000         * disassembler/Disassembler.h: Added.
6001         (JSC):
6002         (JSC::tryToDisassemble):
6003         * disassembler/UDis86Disassembler.cpp: Added.
6004         (JSC):
6005         (JSC::tryToDisassemble):
6006         * disassembler/udis86: Added.
6007         * disassembler/udis86/differences.txt: Added.
6008         * disassembler/udis86/itab.py: Added.
6009         (UdItabGenerator):
6010         (UdItabGenerator.__init__):
6011         (UdItabGenerator.toGroupId):
6012         (UdItabGenerator.genLookupTable):
6013         (UdItabGenerator.genLookupTableList):
6014         (UdItabGenerator.genInsnTable):
6015         (genItabH):
6016         (genItabH.UD_ITAB_H):
6017         (genItabC):
6018         (genItab):
6019         (main):
6020         * disassembler/udis86/optable.xml: Added.
6021         * disassembler/udis86/ud_opcode.py: Added.
6022         (UdOpcodeTables):
6023         (UdOpcodeTables.sizeOfTable):
6024         (UdOpcodeTables.nameOfTable):
6025         (UdOpcodeTables.updateTable):
6026         (UdOpcodeTables.Insn):
6027         (UdOpcodeTables.Insn.__init__):
6028         (UdOpcodeTables.Insn.__init__.opcode):
6029         (UdOpcodeTables.parse):
6030         (UdOpcodeTables.addInsnDef):
6031         (UdOpcodeTables.print_table):
6032         (UdOpcodeTables.print_tree):
6033         * disassembler/udis86/ud_optable.py: Added.
6034         (UdOptableXmlParser):
6035         (UdOptableXmlParser.parseDef):
6036         (UdOptableXmlParser.parse):
6037         (printFn):
6038         (parse):
6039         (main):
6040         * disassembler/udis86/udis86.c: Added.
6041         (ud_init):
6042         (ud_disassemble):
6043         (ud_set_mode):
6044         (ud_set_vendor):
6045         (ud_set_pc):
6046         (ud):
6047         (ud_insn_asm):
6048         (ud_insn_off):
6049         (ud_insn_hex):
6050         (ud_insn_ptr):
6051         (ud_insn_len):
6052         * disassembler/udis86/udis86.h: Added.
6053         * disassembler/udis86/udis86_decode.c: Added.
6054         (eff_adr_mode):
6055         (ud_lookup_mnemonic):
6056         (decode_prefixes):
6057         (modrm):
6058         (resolve_operand_size):
6059         (resolve_mnemonic):
6060         (decode_a):
6061         (decode_gpr):
6062         (resolve_gpr64):
6063         (resolve_gpr32):
6064         (resolve_reg):
6065         (decode_imm):
6066         (decode_modrm_reg):
6067         (decode_modrm_rm):
6068         (decode_o):
6069         (decode_operand):
6070         (decode_operands):
6071         (clear_insn):
6072         (resolve_mode):
6073         (gen_hex):
6074         (decode_insn):
6075         (decode_3dnow):
6076         (decode_ssepfx):
6077         (decode_ext):
6078         (decode_opcode):
6079         (ud_decode):
6080         * disassembler/udis86/udis86_decode.h: Added.
6081         (ud_itab_entry_operand):
6082         (ud_itab_entry):
6083         (ud_lookup_table_list_entry):
6084         (sse_pfx_idx):
6085         (mode_idx):
6086         (modrm_mod_idx):
6087         (vendor_idx):
6088         (is_group_ptr):
6089         (group_idx):
6090         * disassembler/udis86/udis86_extern.h: Added.
6091         * disassembler/udis86/udis86_input.c: Added.
6092         (inp_buff_hook):
6093         (inp_file_hook):
6094         (ud):
6095         (ud_set_user_opaque_data):
6096         (ud_get_user_opaque_data):
6097         (ud_set_input_buffer):
6098         (ud_set_input_file):
6099         (ud_input_skip):
6100         (ud_input_end):
6101         (ud_inp_next):
6102         (ud_inp_back):
6103         (ud_inp_peek):
6104         (ud_inp_move):
6105         (ud_inp_uint8):
6106         (ud_inp_uint16):
6107         (ud_inp_uint32):
6108         (ud_inp_uint64):
6109         * disassembler/udis86/udis86_input.h: Added.
6110         * disassembler/udis86/udis86_itab_holder.c: Added.
6111         * disassembler/udis86/udis86_syn-att.c: Added.
6112         (opr_cast):
6113         (gen_operand):
6114         (ud_translate_att):
6115         * disassembler/udis86/udis86_syn-intel.c: Added.
6116         (opr_cast):
6117         (gen_operand):
6118         (ud_translate_intel):
6119         * disassembler/udis86/udis86_syn.c: Added.
6120         * disassembler/udis86/udis86_syn.h: Added.
6121         (mkasm):
6122         * disassembler/udis86/udis86_types.h: Added.
6123         (ud_operand):
6124         (ud):
6125         * jit/JITCode.h:
6126         (JITCode):
6127         (JSC::JITCode::tryToDisassemble):
6128
6129 2012-06-19  Mark Hahnenberg  <mhahnenberg@apple.com>
6130
6131         GCActivityCallback and IncrementalSweeper should share code
6132         https://bugs.webkit.org/show_bug.cgi?id=89400
6133
6134         Reviewed by Geoffrey Garen.
6135
6136         A lot of functionality is duplicated between GCActivityCallback and IncrementalSweeper.
6137         We should extract the common functionality out into a separate class that both of them
6138         can inherit from. This refactoring will be an even greater boon when we add the ability
6139         to shut these two agents down in a thread-safe fashion
6140
6141         * CMakeLists.txt:
6142         * GNUmakefile.list.am:
6143         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6144         * JavaScriptCore.xcodeproj/project.pbxproj:
6145         * Target.pri:
6146         * heap/Heap.cpp:
6147         (JSC::Heap::Heap): Move initialization down so that the JSGlobalData has a valid Heap when
6148         we're initializing the GCActivityCallback and the IncrementalSweeper.
6149         * heap/Heap.h:
6150         (Heap):
6151         * heap/HeapTimer.cpp: Added.
6152         (JSC):
6153         (JSC::HeapTimer::HeapTimer): Initialize the various base class data that
6154         DefaultGCActivityCallback::commonConstructor() used to do.
6155         (JSC::HeapTimer::~HeapTimer): Call to invalidate().
6156         (JSC::HeapTimer::synchronize): Same functionality as the old DefaultGCActivityCallback::synchronize().
6157         Virtual so that non-CF subclasses can override.
6158         (JSC::HeapTimer::invalidate): Tears down the runloop timer to prevent any future firing.
6159         (JSC::HeapTimer::timerDidFire): Callback to pass to the timer function. Casts and calls the virtual doWork().
6160         * heap/HeapTimer.h: Added. This is the class that serves as the common base class for
6161         both GCActivityCallback and IncrementalSweeper. It handles setting up and tearing down run loops and synchronizing
6162         across threads for its subclasses.
6163         (JSC):
6164         (HeapTimer):
6165         * heap/IncrementalSweeper.cpp: Changes to accomodate the extraction of common functionality
6166         between IncrementalSweeper and GCActivityCallback into a common ancestor.
6167         (JSC):
6168         (JSC::IncrementalSweeper::doWork):
6169         (JSC::IncrementalSweeper::IncrementalSweeper):
6170         (JSC::IncrementalSweeper::cancelTimer):
6171         (JSC::IncrementalSweeper::create):
6172         * heap/IncrementalSweeper.h:
6173         (IncrementalSweeper):
6174         * runtime/GCActivityCallback.cpp:
6175         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
6176         (JSC::DefaultGCActivityCallback::doWork):
6177         * runtime/GCActivityCallback.h:
6178         (GCActivityCallback):
6179         (JSC::GCActivityCallback::willCollect):
6180         (JSC::GCActivityCallback::GCActivityCallback):
6181         (JSC):
6182         (DefaultGCActivityCallback): Remove the platform data struct. The platform data should be kept in
6183         the class itself so as to be accessible by doWork(). Most of the platform data for CF is kept in
6184         HeapTimer anyways, so we only need the m_delay field now.
6185         * runtime/GCActivityCallbackBlackBerry.cpp:
6186         (JSC):
6187         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
6188         (JSC::DefaultGCActivityCallback::doWork):
6189         (JSC::DefaultGCActivityCallback::didAllocate):
6190         * runtime/GCActivityCallbackCF.cpp:
6191         (JSC):
6192         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
6193         (JSC::DefaultGCActivityCallback::doWork):
6194         (JSC::DefaultGCActivityCallback::scheduleTimer):
6195         (JSC::DefaultGCActivityCallback::cancelTimer):
6196         (JSC::DefaultGCActivityCallback::didAllocate):
6197         (JSC::DefaultGCActivityCallback::willCollect):
6198         (JSC::DefaultGCActivityCallback::cancel):
6199
6200
6201 2012-06-19  Mike West  <mkwst@chromium.org>
6202
6203         Introduce ENABLE_CSP_NEXT configuration flag.
6204         https://bugs.webkit.org/show_bug.cgi?id=89300
6205
6206         Reviewed by Adam Barth.
6207
6208         The 1.0 draft of the Content Security Policy spec is just about to
6209         move to Last Call. We'll hide work on the upcoming 1.1 spec behind
6210         this ENABLE flag, disabled by default.
6211
6212         Spec: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html
6213
6214         * Configurations/FeatureDefines.xcconfig:
6215
6216 2012-06-18  Mark Lam  <mark.lam@apple.com>
6217
6218         Changed JSC to always record line number information so that error.stack
6219         and window.onerror() can report proper line numbers.
6220         https://bugs.webkit.org/show_bug.cgi?id=89410
6221
6222         Reviewed by Geoffrey Garen.
6223
6224         * bytecode/CodeBlock.cpp:
6225         (JSC::CodeBlock::CodeBlock):
6226         (JSC::CodeBlock::lineNumberForBytecodeOffset):
6227         (JSC::CodeBlock::shrinkToFit): m_lineInfo is now available unconditionally.
6228
6229         * bytecode/CodeBlock.h:
6230         (JSC::CodeBlock::addLineInfo):
6231         (JSC::CodeBlock::hasLineInfo): Unused.  Now removed.
6232         (JSC::CodeBlock::needsCallReturnIndices):
6233         (CodeBlock):
6234         (RareData):  Hoisted m_lineInfo out of m_rareData.  m_lineInfo is now
6235         filled in unconditionally.
6236
6237         * bytecompiler/BytecodeGenerator.h:
6238         (JSC::BytecodeGenerator::addLineInfo):
6239
6240 2012-06-18  Andy Estes  <aestes@apple.com>
6241
6242         Fix r120663, which didn't land the change that was reviewed.
6243
6244 2012-06-18  Andy Estes  <aestes@apple.com>
6245
6246         [JSC] In JSGlobalData.cpp, enableAssembler() sometimes leaks two CF objects
6247         https://bugs.webkit.org/show_bug.cgi?id=89415
6248
6249         Reviewed by Sam Weinig.
6250
6251         In the case where canUseJIT was a non-NULL CFBooleanRef,
6252         enableAssembler() would leak both canUseJITKey and canUseJIT by
6253         returning before calling CFRelease. Fix this by using RetainPtr.
6254
6255         * runtime/JSGlobalData.cpp:
6256         (JSC::enableAssembler):
6257
6258 2012-06-17  Geoffrey Garen  <ggaren@apple.com>
6259
6260         GC copy phase spends needless cycles zero-filling blocks
6261         https://bugs.webkit.org/show_bug.cgi?id=89128
6262
6263         Reviewed by Gavin Barraclough.
6264
6265         We only need to zero-fill when we're allocating memory that might not
6266         get fully initialized before GC.
6267
6268         * heap/CopiedBlock.h:
6269         (JSC::CopiedBlock::createNoZeroFill):
6270         (JSC::CopiedBlock::create): Added a way to create without zero-filling.
6271         This is our optimization.
6272
6273         (JSC::CopiedBlock::zeroFillToEnd):
6274         (JSC::CopiedBlock::CopiedBlock): Split zero-filling out from creation,
6275         so we can sometimes create without zero-filling.
6276
6277         * heap/CopiedSpace.cpp:
6278         (JSC::CopiedSpace::init):
6279         (JSC::CopiedSpace::tryAllocateSlowCase):
6280         (JSC::CopiedSpace::doneCopying): Renamed addNewBlock to allocateBlock()
6281         to clarify that the new block is always newly-allocated.
6282
6283         (JSC::CopiedSpace::doneFillingBlock): Make sure to zero-fill to the end
6284         of a block that might be used in the future for allocation. (Most of the
6285         time, this is a no-op, since we've already filled the block completely.)
6286
6287         (JSC::CopiedSpace::getFreshBlock): Removed this function because the
6288         abstraction of "allocation must succeed" is no longer useful.
6289
6290         * heap/CopiedSpace.h: Updated declarations to match.
6291
6292         * heap/CopiedSpaceInlineMethods.h:
6293         (JSC::CopiedSpace::allocateBlockForCopyingPhase): New function, which
6294         knows that it can skip zero-filling.
6295
6296         Added tighter scoping to our lock, to improve parallelism.
6297
6298         (JSC::CopiedSpace::allocateBlock): Folded getFreshBlock functionality
6299         into this function, for simplicity.
6300
6301         * heap/MarkStack.cpp:
6302         (JSC::SlotVisitor::startCopying):
6303         (JSC::SlotVisitor::allocateNewSpace): Use our new zero-fill-free helper
6304         function for great good.
6305
6306 2012-06-17  Filip Pizlo  <fpizlo@apple.com>
6307
6308         DFG should attempt to use structure watchpoints for all inlined get_by_id's and put_by_id's
6309         https://bugs.webkit.org/show_bug.cgi?id=89316
6310
6311         Reviewed by Oliver Hunt.
6312
6313         * dfg/DFGByteCodeParser.cpp:
6314         (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
6315         (ByteCodeParser):
6316         (JSC::DFG::ByteCodeParser::handleGetById):
6317         (JSC::DFG::ByteCodeParser::parseBlock):
6318
6319 2012-06-15  Yong Li  <yoli@rim.com>
6320
6321         [BlackBerry] Put platform-specific GC policy in GCActivityCallback
6322         https://bugs.webkit.org/show_bug.cgi?id=89236
6323
6324         Reviewed by Rob Buis.
6325
6326         Add GCActivityCallbackBlackBerry.cpp and implement platform-specific
6327         low memory GC policy there.
6328
6329         * PlatformBlackBerry.cmake:
6330         * heap/Heap.h:
6331         (JSC::Heap::isSafeToCollect): Added.
6332         * runtime/GCActivityCallbackBlackBerry.cpp: Added.
6333         (JSC):
6334         (JSC::DefaultGCActivityCallbackPlatformData::DefaultGCActivityCallbackPlatformData):
6335         (DefaultGCActivityCallbackPlatformData):
6336         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
6337         (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
6338         (JSC::DefaultGCActivityCallback::didAllocate):
6339         (JSC::DefaultGCActivityCallback::willCollect):
6340         (JSC::DefaultGCActivityCallback::synchronize):
6341         (JSC::DefaultGCActivityCallback::cancel):
6342
6343 2012-06-15  Filip Pizlo  <fpizlo@apple.com>
6344
6345         DFG should be able to set watchpoints on structure transitions in the
6346         method check prototype chain
6347         https://bugs.webkit.org/show_bug.cgi?id=89058
6348
6349         Adding the same assertion to 32-bit that I added to 64-bit. This change
6350         does not affect correctness but it's a good thing for assertion coverage.
6351
6352         * dfg/DFGSpeculativeJIT32_64.cpp:
6353         (JSC::DFG::SpeculativeJIT::compile):
6354
6355 2012-06-13  Filip Pizlo  <fpizlo@apple.com>
6356
6357         DFG should be able to set watchpoints on structure transitions in the
6358         method check prototype chain
6359         https://bugs.webkit.org/show_bug.cgi?id=89058
6360
6361         Reviewed by Gavin Barraclough.
6362
6363         This adds the ability to set watchpoints on Structures, and then does
6364         the most modest thing we can do with this ability: the DFG now sets
6365         watchpoints on structure transitions in the prototype chain of method
6366         checks.
6367
6368         This appears to be a >1% speed-up on V8.
6369
6370         * bytecode/PutByIdStatus.cpp:
6371         (JSC::PutByIdStatus::computeFromLLInt):
6372         (JSC::PutByIdStatus::computeFor):
6373         * bytecode/StructureSet.h:
6374         (JSC::StructureSet::containsOnly):
6375         (StructureSet):
6376         * bytecode/Watchpoint.cpp:
6377         (JSC::WatchpointSet::WatchpointSet):
6378         (JSC::InlineWatchpointSet::add):
6379         (JSC):
6380         (JSC::InlineWatchpointSet::inflateSlow):
6381         (JSC::InlineWatchpointSet::freeFat):
6382         * bytecode/Watchpoint.h:
6383         (WatchpointSet):
6384         (JSC):
6385         (InlineWatchpointSet):
6386         (JSC::InlineWatchpointSet::InlineWatchpointSet):
6387         (JSC::InlineWatchpointSet::~InlineWatchpointSet):
6388         (JSC::InlineWatchpointSet::hasBeenInvalidated):
6389         (JSC::InlineWatchpointSet::isStillValid):
6390         (JSC::InlineWatchpointSet::startWatching):
6391         (JSC::InlineWatchpointSet::notifyWrite):
6392         (JSC::InlineWatchpointSet::isFat):
6393         (JSC::InlineWatchpointSet::fat):
6394         (JSC::InlineWatchpointSet::inflate):
6395         * dfg/DFGAbstractState.cpp:
6396         (JSC::DFG::AbstractState::execute):
6397         * dfg/DFGByteCodeParser.cpp:
6398         (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
6399         (ByteCodeParser):
6400         (JSC::DFG::ByteCodeParser::parseBlock):
6401         * dfg/DFGCSEPhase.cpp:
6402         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
6403         (CSEPhase):
6404         (JSC::DFG::CSEPhase::performNodeCSE):
6405         * dfg/DFGCommon.h:
6406         * dfg/DFGGraph.cpp:
6407         (JSC::DFG::Graph::dump):
6408         * dfg/DFGGraph.h:
6409         (JSC::DFG::Graph::isCellConstant):
6410         * dfg/DFGJITCompiler.h:
6411         (JSC::DFG::JITCompiler::addWeakReferences):
6412         (JITCompiler):
6413         * dfg/DFGNode.h:
6414         (JSC::DFG::Node::hasStructure):
6415         (Node):
6416         (JSC::DFG::Node::structure):
6417         * dfg/DFGNodeType.h:
6418         (DFG):
6419         * dfg/DFGPredictionPropagationPhase.cpp:
6420         (JSC::DFG::PredictionPropagationPhase::propagate):
6421         * dfg/DFGRepatch.cpp:
6422         (JSC::DFG::emitPutTransitionStub):
6423         * dfg/DFGSpeculativeJIT64.cpp:
6424         (JSC::DFG::SpeculativeJIT::compile):
6425         * jit/JITStubs.cpp:
6426         (JSC::JITThunks::tryCachePutByID):
6427         * llint/LLIntSlowPaths.cpp:
6428         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
6429         * runtime/Structure.cpp:
6430         (JSC::Structure::Structure):
6431         * runtime/Structure.h:
6432         (JSC::Structure::transitionWatchpointSetHasBeenInvalidated):
6433         (Structure):
6434         (JSC::Structure::transitionWatchpointSetIsStillValid):
6435         (JSC::Structure::addTransitionWatchpoint):
6436         (JSC::Structure::notifyTransitionFromThisStructure):
6437         (JSC::JSCell::setStructure):
6438         * runtime/SymbolTable.cpp:
6439         (JSC::SymbolTableEntry::attemptToWatch):
6440
6441 2012-06-13  Filip Pizlo  <fpizlo@apple.com>
6442
6443         DFG should be able to set watchpoints on global variables
6444         https://bugs.webkit.org/show_bug.cgi?id=88692
6445
6446         Reviewed by Geoffrey Garen.
6447
6448         Rolling back in after fixing Windows build issues, and implementing
6449         branchTest8 for the Qt port's strange assemblers.
6450
6451         This implements global variable constant folding by allowing the optimizing
6452         compiler to set a "watchpoint" on globals that it wishes to constant fold.
6453         If the watchpoint fires, then an OSR exit is forced by overwriting the
6454         machine code that the optimizing compiler generated with a jump.
6455
6456         As such, this patch is adding quite a bit of stuff:
6457
6458         - Jump replacement on those hardware targets supported by the optimizing
6459           JIT. It is now possible to patch in a jump instruction over any recorded
6460           watchpoint label. The jump must be "local" in the sense that it must be
6461           within the range of the largest jump distance supported by a one
6462           instruction jump.
6463
6464         - WatchpointSets and Watchpoints. A Watchpoint is a doubly-linked list node
6465           that records the location where a jump must be inserted and the
6466           destination to which it should jump. Watchpoints can be added to a
6467           WatchpointSet. The WatchpointSet can be fired all at once, which plants
6468           all jumps. WatchpointSet also remembers if it had ever been invalidated,
6469           which allows for monotonicity: we typically don't want to optimize using
6470           watchpoints on something for which watchpoints had previously fired. The
6471           act of notifying a WatchpointSet has a trivial fast path in case no
6472           Watchpoints are registered (one-byte load+branch).
6473
6474         - SpeculativeJIT::speculationWatchpoint(). It's like speculationCheck(),
6475           except that you don't have to emit branches. But, you need to know what
6476           WatchpointSet to add the resulting Watchpoint to. Not everything that
6477           you could write a speculationCheck() for will have a WatchpointSet that
6478           would get notified if the condition you were speculating against became
6479           invalid.
6480
6481         - SymbolTableEntry now has the ability to refer to a WatchpointSet. It can
6482           do so without incurring any space overhead for those entries that don't
6483           have WatchpointSets.
6484
6485         - The bytecode generator infers all global function variables to be
6486           watchable, and makes all stores perform the WatchpointSet's write check,
6487           and marks all loads as being potentially watchable (i.e. you can compile
6488           them to a watchpoint and a constant).
6489
6490         Put together, this allows for fully sleazy inlining of calls to globally
6491         declared functions. The inline prologue will no longer contain the load of
6492         the function, or any checks of the function you're calling. I.e. it's
6493         pretty much like the kind of inlining you would see in Java or C++.
6494         Furthermore, the watchpointing functionality is built to be fairly general,
6495         and should allow setting watchpoints on all sorts of interesting things
6496         in the future.
6497
6498         The sleazy inlining means that we will now sometimes inline in code paths
6499         that have never executed. Previously, to inline we would have either had
6500         to have executed the call (to read the call's inline cache) or have
6501         executed the method check (to read the method check's inline cache). Now,
6502         we might inline when the callee is a watched global variable. This
6503         revealed some humorous bugs. First, constant folding disagreed with CFA
6504         over what kinds of operations can clobber (example: code path A is dead
6505         but stores a String into variable X, all other code paths store 0 into
6506         X, and then you do CompareEq(X, 0) - CFA will say that this is a non-
6507         clobbering constant, but constant folding thought it was clobbering
6508         because it saw the String prediction). Second, inlining would crash if
6509         the inline callee had not been compiled. This patch fixes both bugs,
6510         since otherwise run-javascriptcore-tests would report regressions.
6511
6512         * CMakeLists.txt:
6513         * GNUmakefile.list.am:
6514         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
6515         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6516         * JavaScriptCore.xcodeproj/project.pbxproj:
6517         * Target.pri:
6518         * assembler/ARMv7Assembler.h:
6519         (ARMv7Assembler):
6520         (JSC::ARMv7Assembler::ARMv7Assembler):
6521         (JSC::ARMv7Assembler::labelForWatchpoint):
6522         (JSC::ARMv7Assembler::label):
6523         (JSC::ARMv7Assembler::replaceWithJump):
6524         (JSC::ARMv7Assembler::maxJumpReplacementSize):
6525         * assembler/AbstractMacroAssembler.h:
6526         (JSC):
6527         (AbstractMacroAssembler):
6528         (Label):
6529         (JSC::AbstractMacroAssembler::watchpointLabel):
6530         (JSC::AbstractMacroAssembler::readPointer):
6531         * assembler/AssemblerBuffer.h:
6532         * assembler/MacroAssemblerARM.h:
6533         (JSC::MacroAssemblerARM::branchTest8):
6534         (MacroAssemblerARM):
6535         (JSC::MacroAssemblerARM::replaceWithJump):
6536         (JSC::MacroAssemblerARM::maxJumpReplacementSize):
6537         * assembler/MacroAssemblerARMv7.h:
6538         (JSC::MacroAssemblerARMv7::load8Signed):
6539         (JSC::MacroAssemblerARMv7::load16Signed):
6540         (MacroAssemblerARMv7):
6541         (JSC::MacroAssemblerARMv7::replaceWithJump):
6542         (JSC::MacroAssemblerARMv7::maxJumpReplacementSize):
6543         (JSC::MacroAssemblerARMv7::branchTest8):
6544         (JSC::MacroAssemblerARMv7::jump):
6545         (JSC::MacroAssemblerARMv7::makeBranch):
6546         * assembler/MacroAssemblerMIPS.h:
6547         (JSC::MacroAssemblerMIPS::branchTest8):
6548         (MacroAssemblerMIPS):
6549         (JSC::MacroAssemblerMIPS::replaceWithJump):
6550         (JSC::MacroAssemblerMIPS::maxJumpReplacementSize):
6551         * assembler/MacroAssemblerSH4.h:
6552         (JSC::MacroAssemblerSH4::branchTest8):
6553         (MacroAssemblerSH4):
6554         (JSC::MacroAssemblerSH4::replaceWithJump):
6555         (JSC::MacroAssemblerSH4::maxJumpReplacementSize):
6556         * assembler/MacroAssemblerX86.h:
6557         (MacroAssemblerX86):
6558         (JSC::MacroAssemblerX86::branchTest8):
6559         * assembler/MacroAssemblerX86Common.h:
6560         (JSC::MacroAssemblerX86Common::replaceWithJump):
6561         (MacroAssemblerX86Common):
6562         (JSC::MacroAssemblerX86Common::maxJumpReplacementSize):
6563         * assembler/MacroAssemblerX86_64.h:
6564         (MacroAssemblerX86_64):
6565         (JSC::MacroAssemblerX86_64::branchTest8):
6566         * assembler/X86Assembler.h:
6567         (JSC::X86Assembler::X86Assembler):
6568         (X86Assembler):
6569         (JSC::X86Assembler::cmpb_im):
6570         (JSC::X86Assembler::testb_im):
6571         (JSC::X86Assembler::labelForWatchpoint):
6572         (JSC::X86Assembler::label):
6573         (JSC::X86Assembler::replaceWithJump):
6574         (JSC::X86Assembler::maxJumpReplacementSize):
6575         (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
6576         * bytecode/CodeBlock.cpp:
6577         (JSC):
6578         (JSC::CodeBlock::printGetByIdCacheStatus):
6579         (JSC::CodeBlock::dump):
6580         * bytecode/CodeBlock.h:
6581         (JSC::CodeBlock::appendOSRExit):
6582         (JSC::CodeBlock::appendSpeculationRecovery):
6583         (CodeBlock):
6584         (JSC::CodeBlock::appendWatchpoint):
6585         (JSC::CodeBlock::numberOfWatchpoints):
6586         (JSC::CodeBlock::watchpoint):
6587         (DFGData):
6588         * bytecode/DFGExitProfile.h:
6589         (JSC::DFG::exitKindToString):
6590         (JSC::DFG::exitKindIsCountable):
6591         * bytecode/GetByIdStatus.cpp:
6592         (JSC::GetByIdStatus::computeForChain):
6593         * bytecode/Instruction.h:
6594         (Instruction):
6595         (JSC::Instruction::Instruction):
6596         * bytecode/Opcode.h:
6597         (JSC):
6598         (JSC::padOpcodeName):
6599         * bytecode/Watchpoint.cpp: Added.
6600         (JSC):
6601         (JSC::Watchpoint::~Watchpoint):
6602         (JSC::Watchpoint::correctLabels):
6603         (JSC::Watchpoint::fire):
6604         (JSC::WatchpointSet::WatchpointSet):
6605         (JSC::WatchpointSet::~WatchpointSet):
6606         (JSC::WatchpointSet::add):
6607         (JSC::WatchpointSet::notifyWriteSlow):
6608         (JSC::WatchpointSet::fireAllWatchpoints):
6609         * bytecode/Watchpoint.h: Added.
6610         (JSC):
6611         (Watchpoint):
6612         (JSC::Watchpoint::Watchpoint):
6613         (JSC::Watchpoint::setDestination):
6614         (WatchpointSet):
6615         (JSC::WatchpointSet::isStillValid):
6616         (JSC::WatchpointSet::hasBeenInvalidated):
6617         (JSC::WatchpointSet::startWatching):
6618         (JSC::WatchpointSet::notifyWrite):
6619         (JSC::WatchpointSet::addressOfIsWatched):
6620         * bytecompiler/BytecodeGenerator.cpp:
6621         (JSC::ResolveResult::checkValidity):
6622         (JSC::BytecodeGenerator::addGlobalVar):
6623         (JSC::BytecodeGenerator::BytecodeGenerator):
6624         (JSC::BytecodeGenerator::resolve):
6625         (JSC::BytecodeGenerator::emitResolve):
6626         (JSC::BytecodeGenerator::emitResolveWithBase):
6627         (JSC::BytecodeGenerator::emitResolveWithThis):
6628         (JSC::BytecodeGenerator::emitGetStaticVar):
6629         (JSC::BytecodeGenerator::emitPutStaticVar):
6630         * bytecompiler/BytecodeGenerator.h:
6631         (BytecodeGenerator):
6632         * bytecompiler/NodesCodegen.cpp:
6633         (JSC::FunctionCallResolveNode::emitBytecode):
6634         (JSC::PostfixResolveNode::emitBytecode):
6635         (JSC::PrefixResolveNode::emitBytecode):
6636         (JSC::ReadModifyResolveNode::emitBytecode):
6637         (JSC::AssignResolveNode::emitBytecode):
6638         (JSC::ConstDeclNode::emitCodeSingle):
6639         * dfg/DFGAbstractState.cpp:
6640         (JSC::DFG::AbstractState::execute):
6641         (JSC::DFG::AbstractState::clobberStructures):
6642         * dfg/DFGAbstractState.h:
6643         (AbstractState):
6644         (JSC::DFG::AbstractState::didClobber):
6645         * dfg/DFGByteCodeParser.cpp:
6646         (JSC::DFG::ByteCodeParser::handleInlining):
6647         (JSC::DFG::ByteCodeParser::parseBlock):
6648         * dfg/DFGCCallHelpers.h:
6649         (CCallHelpers):
6650         (JSC::DFG::CCallHelpers::setupArguments):
6651         * dfg/DFGCSEPhase.cpp:
6652         (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
6653         (CSEPhase):
6654         (JSC::DFG::CSEPhase::globalVarStoreElimination):
6655         (JSC::DFG::CSEPhase::performNodeCSE):
6656         * dfg/DFGCapabilities.h:
6657         (JSC::DFG::canCompileOpcode):
6658         * dfg/DFGConstantFoldingPhase.cpp:
6659         (JSC::DFG::ConstantFoldingPhase::run):
6660         * dfg/DFGCorrectableJumpPoint.h:
6661         (JSC::DFG::CorrectableJumpPoint::isSet):
6662         (CorrectableJumpPoint):
6663         * dfg/DFGJITCompiler.cpp:
6664         (JSC::DFG::JITCompiler::linkOSRExits):
6665         (JSC::DFG::JITCompiler::link):
6666         * dfg/DFGNode.h:
6667         (JSC::DFG::Node::hasIdentifierNumberForCheck):
6668         (Node):
6669         (JSC::DFG::Node::identifierNumberForCheck):
6670         (JSC::DFG::Node::hasRegisterPointer):
6671         * dfg/DFGNodeType.h:
6672         (DFG):
6673         * dfg/DFGOSRExit.cpp:
6674         (JSC::DFG::OSRExit::OSRExit):
6675         * dfg/DFGOSRExit.h:
6676         (OSRExit):
6677         * dfg/DFGOperations.cpp:
6678         * dfg/DFGOperations.h:
6679         * dfg/DFGPredictionPropagationPhase.cpp:
6680         (JSC::DFG::PredictionPropagationPhase::propagate):
6681         * dfg/DFGSpeculativeJIT.h:
6682         (JSC::DFG::SpeculativeJIT::callOperation):
6683         (JSC::DFG::SpeculativeJIT::appendCall):
6684         (SpeculativeJIT):
6685         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
6686         * dfg/DFGSpeculativeJIT32_64.cpp:
6687         (JSC::DFG::SpeculativeJIT::compile):
6688         * dfg/DFGSpeculativeJIT64.cpp:
6689         (JSC::DFG::SpeculativeJIT::compile):
6690         * interpreter/Interpreter.cpp:
6691         (JSC::Interpreter::privateExecute):
6692         * jit/JIT.cpp:
6693         (JSC::JIT::privateCompileMainPass):
6694         (JSC::JIT::privateCompileSlowCases):
6695         * jit/JIT.h:
6696         * jit/JITPropertyAccess.cpp:
6697         (JSC::JIT::emit_op_put_global_var_check):
6698         (JSC):
6699         (JSC::JIT::emitSlow_op_put_global_var_check):
6700         * jit/JITPropertyAccess32_64.cpp:
6701         (JSC::JIT::emit_op_put_global_var_check):
6702         (JSC):
6703         (JSC::JIT::emitSlow_op_put_global_var_check):
6704         * jit/JITStubs.cpp:
6705         (JSC::DEFINE_STUB_FUNCTION):
6706         (JSC):
6707         * jit/JITStubs.h:
6708         * llint/LLIntSlowPaths.cpp:
6709         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
6710         (LLInt):
6711         * llint/LLIntSlowPaths.h:
6712         (LLInt):
6713         * llint/LowLevelInterpreter32_64.asm:
6714         * llint/LowLevelInterpreter64.asm:
6715         * runtime/JSObject.cpp:
6716         (JSC::JSObject::removeDirect):
6717         * runtime/JSObject.h:
6718         (JSObject):
6719         * runtime/JSSymbolTableObject.h:
6720         (JSC::symbolTableGet):
6721         (JSC::symbolTablePut):
6722         (JSC::symbolTablePutWithAttributes):
6723         * runtime/SymbolTable.cpp: Added.
6724         (JSC):
6725         (JSC::SymbolTableEntry::copySlow):
6726         (JSC::SymbolTableEntry::freeFatEntrySlow):
6727         (JSC::SymbolTableEntry::couldBeWatched):
6728         (JSC::SymbolTableEntry::attemptToWatch):
6729         (JSC::SymbolTableEntry::addressOfIsWatched):
6730         (JSC::SymbolTableEntry::addWatchpoint):
6731         (JSC::SymbolTableEntry::notifyWriteSlow):
6732         (JSC::SymbolTableEntry::inflateSlow):
6733         * runtime/SymbolTable.h:
6734         (JSC):
6735         (SymbolTableEntry):
6736         (Fast):
6737         (JSC::SymbolTableEntry::Fast::Fast):
6738         (JSC::SymbolTableEntry::Fast::isNull):
6739         (JSC::SymbolTableEntry::Fast::getIndex):
6740         (JSC::SymbolTableEntry::Fast::isReadOnly):
6741         (JSC::SymbolTableEntry::Fast::getAttributes):
6742         (JSC::SymbolTableEntry::Fast::isFat):
6743         (JSC::SymbolTableEntry::SymbolTableEntry):
6744         (JSC::SymbolTableEntry::~SymbolTableEntry):
6745         (JSC::SymbolTableEntry::operator=):
6746         (JSC::SymbolTableEntry::isNull):
6747         (JSC::SymbolTableEntry::getIndex):
6748         (JSC::SymbolTableEntry::getFast):
6749         (JSC::SymbolTableEntry::getAttributes):
6750         (JSC::SymbolTableEntry::isReadOnly):
6751         (JSC::SymbolTableEntry::watchpointSet):
6752         (JSC::SymbolTableEntry::notifyWrite):
6753         (FatEntry):
6754         (JSC::SymbolTableEntry::FatEntry::FatEntry):
6755         (JSC::SymbolTableEntry::isFat):
6756         (JSC::SymbolTableEntry::fatEntry):
6757         (JSC::SymbolTableEntry::inflate):
6758         (JSC::SymbolTableEntry::bits):
6759         (JSC::SymbolTableEntry::freeFatEntry):
6760         (JSC::SymbolTableEntry::pack):
6761         (JSC::SymbolTableEntry::isValidIndex):
6762
6763 2012-06-13  Sheriff Bot  <webkit.review.bot@gmail.com>
6764
6765         Unreviewed, rolling out r120172.
6766         http://trac.webkit.org/changeset/120172
6767         https://bugs.webkit.org/show_bug.cgi?id=88976
6768
6769         The patch causes compilation failures on Gtk, Qt and Apple Win
6770         bots (Requested by zdobersek on #webkit).
6771
6772         * CMakeLists.txt:
6773         * GNUmakefile.list.am:
6774         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
6775         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6776         * JavaScriptCore.xcodeproj/project.pbxproj:
6777         * Target.pri:
6778         * assembler/ARMv7Assembler.h:
6779         (JSC::ARMv7Assembler::nop):
6780         (JSC::ARMv7Assembler::label):
6781         (JSC::ARMv7Assembler::readPointer):
6782         (ARMv7Assembler):
6783         * assembler/AbstractMacroAssembler.h:
6784         (JSC):
6785         (AbstractMacroAssembler):
6786         (Label):
6787         * assembler/AssemblerBuffer.h:
6788         * assembler/MacroAssemblerARM.h:
6789         * assembler/MacroAssemblerARMv7.h:
6790         (JSC::MacroAssemblerARMv7::nop):
6791         (JSC::MacroAssemblerARMv7::jump):
6792         (JSC::MacroAssemblerARMv7::makeBranch):
6793         * assembler/MacroAssemblerMIPS.h:
6794         * assembler/MacroAssemblerSH4.h:
6795         * assembler/MacroAssemblerX86.h:
6796         (MacroAssemblerX86):
6797         (JSC::MacroAssemblerX86::moveWithPatch):
6798         * assembler/MacroAssemblerX86Common.h:
6799         * assembler/MacroAssemblerX86_64.h:
6800         (JSC::MacroAssemblerX86_64::branchTest8):
6801         * assembler/X86Assembler.h:
6802         (JSC::X86Assembler::cmpb_im):
6803         (JSC::X86Assembler::codeSize):
6804         (JSC::X86Assembler::label):
6805         (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
6806         * bytecode/CodeBlock.cpp:
6807         (JSC::CodeBlock::dump):
6808         * bytecode/CodeBlock.h:
6809         (JSC::CodeBlock::appendOSRExit):
6810         (JSC::CodeBlock::appendSpeculationRecovery):
6811         (DFGData):
6812         * bytecode/DFGExitProfile.h:
6813         (JSC::DFG::exitKindToString):
6814         (JSC::DFG::exitKindIsCountable):
6815         * bytecode/Instruction.h:
6816         * bytecode/Opcode.h:
6817         (JSC):
6818         (JSC::padOpcodeName):
6819         * bytecode/Watchpoint.cpp: Removed.
6820         * bytecode/Watchpoint.h: Removed.
6821         * bytecompiler/BytecodeGenerator.cpp:
6822         (JSC::ResolveResult::checkValidity):
6823         (JSC::BytecodeGenerator::addGlobalVar):
6824         (JSC::BytecodeGenerator::BytecodeGenerator):
6825         (JSC::BytecodeGenerator::resolve):
6826         (JSC::BytecodeGenerator::emitResolve):
6827         (JSC::BytecodeGenerator::emitResolveWithBase):
6828         (JSC::BytecodeGenerator::emitResolveWithThis):
6829         (JSC::BytecodeGenerator::emitGetStaticVar):
6830         (JSC::BytecodeGenerator::emitPutStaticVar):
6831         * bytecompiler/BytecodeGenerator.h:
6832         (BytecodeGenerator):
6833         * bytecompiler/NodesCodegen.cpp:
6834         (JSC::FunctionCallResolveNode::emitBytecode):
6835         (JSC::PostfixResolveNode::emitBytecode):
6836         (JSC::PrefixResolveNode::emitBytecode):
6837         (JSC::ReadModifyResolveNode::emitBytecode):
6838         (JSC::AssignResolveNode::emitBytecode):
6839         (JSC::ConstDeclNode::emitCodeSingle):
6840         * dfg/DFGAbstractState.cpp:
6841         (JSC::DFG::AbstractState::execute):
6842         (JSC::DFG::AbstractState::clobberStructures):
6843         * dfg/DFGAbstractState.h:
6844         (AbstractState):
6845         * dfg/DFGByteCodeParser.cpp:
6846         (JSC::DFG::ByteCodeParser::handleInlining):
6847         (JSC::DFG::ByteCodeParser::parseBlock):
6848         * dfg/DFGCCallHelpers.h:
6849         (JSC::DFG::CCallHelpers::setupArguments):
6850         * dfg/DFGCSEPhase.cpp:
6851         (JSC::DFG::CSEPhase::globalVarStoreElimination):
6852         (JSC::DFG::CSEPhase::performNodeCSE):
6853         * dfg/DFGCapabilities.h:
6854         (JSC::DFG::canCompileOpcode):
6855         * dfg/DFGConstantFoldingPhase.cpp:
6856         (JSC::DFG::ConstantFoldingPhase::run):
6857         * dfg/DFGCorrectableJumpPoint.h:
6858         * dfg/DFGJITCompiler.cpp:
6859         (JSC::DFG::JITCompiler::linkOSRExits):
6860         (JSC::DFG::JITCompiler::link):
6861         * dfg/DFGNode.h:
6862         (JSC::DFG::Node::hasRegisterPointer):
6863         * dfg/DFGNodeType.h:
6864         (DFG):
6865         * dfg/DFGOSRExit.cpp:
6866         (JSC::DFG::OSRExit::OSRExit):
6867         * dfg/DFGOSRExit.h:
6868         (OSRExit):
6869         * dfg/DFGOperations.cpp:
6870         * dfg/DFGOperations.h:
6871         * dfg/DFGPredictionPropagationPhase.cpp:
6872         (JSC::DFG::PredictionPropagationPhase::propagate):
6873         * dfg/DFGSpeculativeJIT.h:
6874         (JSC::DFG::SpeculativeJIT::callOperation):
6875         (JSC::DFG::SpeculativeJIT::appendCallSetResult):
6876         (JSC::DFG::SpeculativeJIT::speculationCheck):
6877         * dfg/DFGSpeculativeJIT32_64.cpp:
6878         (JSC::DFG::SpeculativeJIT::compile):
6879         * dfg/DFGSpeculativeJIT64.cpp:
6880         (JSC::DFG::SpeculativeJIT::compile):
6881         * jit/JIT.cpp:
6882         (JSC::JIT::privateCompileMainPass):
6883         (JSC::JIT::privateCompileSlowCases):
6884         * jit/JIT.h:
6885         * jit/JITPropertyAccess.cpp:
6886         * jit/JITPropertyAccess32_64.cpp:
6887         * jit/JITStubs.cpp:
6888         * jit/JITStubs.h:
6889         * llint/LLIntSlowPaths.cpp:
6890         * llint/LLIntSlowPaths.h:
6891         (LLInt):
6892         * llint/LowLevelInterpreter32_64.asm:
6893         * llint/LowLevelInterpreter64.asm:
6894         * runtime/JSObject.cpp:
6895         (JSC::JSObject::removeDirect):
6896         * runtime/JSObject.h:
6897         (JSObject):
6898         * runtime/JSSymbolTableObject.h:
6899         (JSC::symbolTableGet):
6900         (JSC::symbolTablePut):
6901         (JSC::symbolTablePutWithAttributes):
6902         * runtime/SymbolTable.cpp: Removed.
6903         * runtime/SymbolTable.h:
6904         (JSC):
6905         (JSC::SymbolTableEntry::isNull):
6906         (JSC::SymbolTableEntry::getIndex):
6907         (SymbolTableEntry):
6908         (JSC::SymbolTableEntry::getAttributes):
6909         (JSC::SymbolTableEntry::isReadOnly):
6910         (JSC::SymbolTableEntry::pack):
6911         (JSC::SymbolTableEntry::isValidIndex):
6912
6913 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
6914
6915         DFG should be able to set watchpoints on global variables
6916         https://bugs.webkit.org/show_bug.cgi?id=88692
6917
6918         Reviewed by Geoffrey Garen.
6919
6920         This implements global variable constant folding by allowing the optimizing
6921         compiler to set a "watchpoint" on globals that it wishes to constant fold.
6922         If the watchpoint fires, then an OSR exit is forced by overwriting the
6923         machine code that the optimizing compiler generated with a jump.
6924
6925         As such, this patch is adding quite a bit of stuff:
6926
6927         - Jump replacement on those hardware targets supported by the optimizing
6928           JIT. It is now possible to patch in a jump instruction over any recorded
6929           watchpoint label. The jump must be "local" in the sense that it must be
6930           within the range of the largest jump distance supported by a one
6931           instruction jump.
6932
6933         - WatchpointSets and Watchpoints. A Watchpoint is a doubly-linked list node
6934           that records the location where a jump must be inserted and the
6935           destination to which it should jump. Watchpoints can be added to a
6936           WatchpointSet. The WatchpointSet can be fired all at once, which plants
6937           all jumps. WatchpointSet also remembers if it had ever been invalidated,
6938           which allows for monotonicity: we typically don't want to optimize using
6939           watchpoints on something for which watchpoints had previously fired. The
6940           act of notifying a WatchpointSet has a trivial fast path in case no
6941           Watchpoints are registered (one-byte load+branch).
6942
6943         - SpeculativeJIT::speculationWatchpoint(). It's like speculationCheck(),
6944           except that you don't have to emit branches. But, you need to know what
6945           WatchpointSet to add the resulting Watchpoint to. Not everything that
6946           you could write a speculationCheck() for will have a WatchpointSet that
6947           would get notified if the condition you were speculating against became
6948           invalid.
6949
6950         - SymbolTableEntry now has the ability to refer to a WatchpointSet. It can
6951           do so without incurring any space overhead for those entries that don't
6952           have WatchpointSets.
6953
6954         - The bytecode generator infers all global function variables to be
6955           watchable, and makes all stores perform the WatchpointSet's write check,
6956           and marks all loads as being potentially watchable (i.e. you can compile
6957           them to a watchpoint and a constant).
6958
6959         Put together, this allows for fully sleazy inlining of calls to globally
6960         declared functions. The inline prologue will no longer contain the load of
6961         the function, or any checks of the function you're calling. I.e. it's
6962         pretty much like the kind of inlining you would see in Java or C++.
6963         Furthermore, the watchpointing functionality is built to be fairly general,
6964         and should allow setting watchpoints on all sorts of interesting things
6965         in the future.
6966
6967         The sleazy inlining means that we will now sometimes inline in code paths
6968         that have never executed. Previously, to inline we would have either had
6969         to have executed the call (to read the call's inline cache) or have
6970         executed the method check (to read the method check's inline cache). Now,
6971         we might inline when the callee is a watched global variable. This
6972         revealed some humorous bugs. First, constant folding disagreed with CFA
6973         over what kinds of operations can clobber (example: code path A is dead
6974         but stores a String into variable X, all other code paths store 0 into
6975         X, and then you do CompareEq(X, 0) - CFA will say that this is a non-
6976         clobbering constant, but constant folding thought it was clobbering
6977         because it saw the String prediction). Second, inlining would crash if
6978         the inline callee had not been compiled. This patch fixes both bugs,
6979         since otherwise run-javascriptcore-tests would report regressions.
6980
6981         * CMakeLists.txt:
6982         * GNUmakefile.list.am:
6983         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6984         * JavaScriptCore.xcodeproj/project.pbxproj:
6985         * Target.pri:
6986         * assembler/ARMv7Assembler.h:
6987         (ARMv7Assembler):
6988         (JSC::ARMv7Assembler::ARMv7Assembler):
6989         (JSC::ARMv7Assembler::labelForWatchpoint):
6990         (JSC::ARMv7Assembler::label):
6991         (JSC::ARMv7Assembler::replaceWithJump):
6992         (JSC::ARMv7Assembler::maxJumpReplacementSize):
6993         * assembler/AbstractMacroAssembler.h:
6994         (JSC):
6995         (AbstractMacroAssembler):
6996         (Label):
6997         (JSC::AbstractMacroAssembler::watchpointLabel):
6998         * assembler/AssemblerBuffer.h:
6999         * assembler/MacroAssemblerARM.h:
7000         (JSC::MacroAssemblerARM::replaceWithJump):
7001         (MacroAssemblerARM):
7002         (JSC::MacroAssemblerARM::maxJumpReplacementSize):
7003         * assembler/MacroAssemblerARMv7.h:
7004         (MacroAssemblerARMv7):
7005         (JSC::MacroAssemblerARMv7::replaceWithJump):
7006         (JSC::MacroAssemblerARMv7::maxJumpReplacementSize):
7007         (JSC::MacroAssemblerARMv7::branchTest8):
7008         (JSC::MacroAssemblerARMv7::jump):
7009         (JSC::MacroAssemblerARMv7::makeBranch):
7010         * assembler/MacroAssemblerMIPS.h:
7011         (JSC::MacroAssemblerMIPS::replaceWithJump):
7012         (MacroAssemblerMIPS):
7013         (JSC::MacroAssemblerMIPS::maxJumpReplacementSize):
7014         * assembler/MacroAssemblerSH4.h:
7015         (JSC::MacroAssemblerSH4::replaceWithJump):
7016         (MacroAssemblerSH4):
7017         (JSC::MacroAssemblerSH4::maxJumpReplacementSize):
7018         * assembler/MacroAssemblerX86.h:
7019         (MacroAssemblerX86):
7020         (JSC::MacroAssemblerX86::branchTest8):
7021         * assembler/MacroAssemblerX86Common.h:
7022         (JSC::MacroAssemblerX86Common::replaceWithJump):
7023         (MacroAssemblerX86Common):
7024         (JSC::MacroAssemblerX86Common::maxJumpReplacementSize):
7025         * assembler/MacroAssemblerX86_64.h:
7026         (MacroAssemblerX86_64):
7027         (JSC::MacroAssemblerX86_64::branchTest8):
7028         * assembler/X86Assembler.h:
7029         (JSC::X86Assembler::X86Assembler):
7030         (X86Assembler):
7031         (JSC::X86Assembler::cmpb_im):
7032         (JSC::X86Assembler::testb_im):
7033         (JSC::X86Assembler::labelForWatchpoint):
7034         (JSC::X86Assembler::label):
7035         (JSC::X86Assembler::replaceWithJump):
7036         (JSC::X86Assembler::maxJumpReplacementSize):
7037         (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
7038         * bytecode/CodeBlock.cpp:
7039         (JSC::CodeBlock::dump):
7040         * bytecode/CodeBlock.h:
7041         (JSC::CodeBlock::appendOSRExit):
7042         (JSC::CodeBlock::appendSpeculationRecovery):
7043         (CodeBlock):
7044         (JSC::CodeBlock::appendWatchpoint):
7045         (JSC::CodeBlock::numberOfWatchpoints):
7046         (JSC::CodeBlock::watchpoint):
7047         (DFGData):
7048         * bytecode/DFGExitProfile.h:
7049         (JSC::DFG::exitKindToString):
7050         (JSC::DFG::exitKindIsCountable):
7051         * bytecode/Instruction.h:
7052         (Instruction):
7053         (JSC::Instruction::Instruction):
7054         * bytecode/Opcode.h:
7055         (JSC):
7056         (JSC::padOpcodeName):
7057         * bytecode/Watchpoint.cpp: Added.
7058         (JSC):
7059         (JSC::Watchpoint::~Watchpoint):
7060         (JSC::Watchpoint::correctLabels):
7061         (JSC::Watchpoint::fire):
7062         (JSC::WatchpointSet::WatchpointSet):
7063         (JSC::WatchpointSet::~WatchpointSet):
7064         (JSC::WatchpointSet::add):
7065         (JSC::WatchpointSet::notifyWriteSlow):
7066         (JSC::WatchpointSet::fireAllWatchpoints):
7067         * bytecode/Watchpoint.h: Added.
7068         (JSC):
7069         (Watchpoint):
7070         (JSC::Watchpoint::Watchpoint):
7071         (JSC::Watchpoint::setDestination):
7072         (WatchpointSet):
7073         (JSC::WatchpointSet::isStillValid):
7074         (JSC::WatchpointSet::hasBeenInvalidated):
7075         (JSC::WatchpointSet::startWatching):
7076         (JSC::WatchpointSet::notifyWrite):
7077         (JSC::WatchpointSet::addressOfIsWatched):
7078         * bytecompiler/BytecodeGenerator.cpp:
7079         (JSC::ResolveResult::checkValidity):
7080         (JSC::BytecodeGenerator::addGlobalVar):
7081         (JSC::BytecodeGenerator::BytecodeGenerator):
7082         (JSC::BytecodeGenerator::resolve):
7083         (JSC::BytecodeGenerator::emitResolve):
7084         (JSC::BytecodeGenerator::emitResolveWithBase):
7085         (JSC::BytecodeGenerator::emitResolveWithThis):
7086         (JSC::BytecodeGenerator::emitGetStaticVar):
7087         (JSC::BytecodeGenerator::emitPutStaticVar):
7088         * bytecompiler/BytecodeGenerator.h:
7089         (BytecodeGenerator):
7090         * bytecompiler/NodesCodegen.cpp:
7091         (JSC::FunctionCallResolveNode::emitBytecode):
7092         (JSC::PostfixResolveNode::emitBytecode):
7093         (JSC::PrefixResolveNode::emitBytecode):
7094         (JSC::ReadModifyResolveNode::emitBytecode):
7095         (JSC::AssignResolveNode::emitBytecode):
7096         (JSC::ConstDeclNode::emitCodeSingle):
7097         * dfg/DFGAbstractState.cpp:
7098         (JSC::DFG::AbstractState::execute):
7099         (JSC::DFG::AbstractState::clobberStructures):
7100         * dfg/DFGAbstractState.h:
7101         (AbstractState):
7102         (JSC::DFG::AbstractState::didClobber):
7103         * dfg/DFGByteCodeParser.cpp:
7104         (JSC::DFG::ByteCodeParser::handleInlining):
7105         (JSC::DFG::ByteCodeParser::parseBlock):
7106         * dfg/DFGCCallHelpers.h:
7107         (CCallHelpers):
7108         (JSC::DFG::CCallHelpers::setupArguments):
7109         * dfg/DFGCSEPhase.cpp:
7110         (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
7111         (CSEPhase):
7112         (JSC::DFG::CSEPhase::globalVarStoreElimination):
7113         (JSC::DFG::CSEPhase::performNodeCSE):
7114         * dfg/DFGCapabilities.h:
7115         (JSC::DFG::canCompileOpcode):
7116         * dfg/DFGConstantFoldingPhase.cpp:
7117         (JSC::DFG::ConstantFoldingPhase::run):
7118         * dfg/DFGCorrectableJumpPoint.h:
7119         (JSC::DFG::CorrectableJumpPoint::isSet):
7120         (CorrectableJumpPoint):
7121         * dfg/DFGJITCompiler.cpp:
7122         (JSC::DFG::JITCompiler::linkOSRExits):
7123         (JSC::DFG::JITCompiler::link):
7124         * dfg/DFGNode.h:
7125         (JSC::DFG::Node::hasIdentifierNumberForCheck):
7126         (Node):
7127         (JSC::DFG::Node::identifierNumberForCheck):
7128         (JSC::DFG::Node::hasRegisterPointer):
7129         * dfg/DFGNodeType.h:
7130         (DFG):
7131         * dfg/DFGOSRExit.cpp:
7132         (JSC::DFG::OSRExit::OSRExit):
7133         * dfg/DFGOSRExit.h:
7134         (OSRExit):
7135         * dfg/DFGOperations.cpp:
7136         * dfg/DFGOperations.h:
7137         * dfg/DFGPredictionPropagationPhase.cpp:
7138         (JSC::DFG::PredictionPropagationPhase::propagate):
7139         * dfg/DFGSpeculativeJIT.h:
7140         (JSC::DFG::SpeculativeJIT::callOperation):
7141         (JSC::DFG::SpeculativeJIT::appendCall):
7142         (SpeculativeJIT):
7143         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
7144         * dfg/DFGSpeculativeJIT32_64.cpp:
7145         (JSC::DFG::SpeculativeJIT::compile):
7146         * dfg/DFGSpeculativeJIT64.cpp:
7147         (JSC::DFG::SpeculativeJIT::compile):
7148         * jit/JIT.cpp:
7149         (JSC::JIT::privateCompileMainPass):
7150         (JSC::JIT::privateCompileSlowCases):
7151         * jit/JIT.h:
7152         * jit/JITPropertyAccess.cpp:
7153         (JSC::JIT::emit_op_put_global_var_check):
7154         (JSC):
7155         (JSC::JIT::emitSlow_op_put_global_var_check):
7156         * jit/JITPropertyAccess32_64.cpp:
7157         (JSC::JIT::emit_op_put_global_var_check):
7158         (JSC):
7159         (JSC::JIT::emitSlow_op_put_global_var_check):
7160         * jit/JITStubs.cpp:
7161         (JSC::JITThunks::JITThunks):
7162         (JSC::DEFINE_STUB_FUNCTION):
7163         (JSC):
7164         * jit/JITStubs.h:
7165         * llint/LLIntSlowPaths.cpp:
7166         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
7167         (LLInt):
7168         * llint/LLIntSlowPaths.h:
7169         (LLInt):
7170         * llint/LowLevelInterpreter32_64.asm:
7171         * llint/LowLevelInterpreter64.asm:
7172         * runtime/JSObject.cpp:
7173         (JSC::JSObject::removeDirect):
7174         * runtime/JSObject.h:
7175         (JSObject):
7176         * runtime/JSSymbolTableObject.h:
7177         (JSC::symbolTableGet):
7178         (JSC::symbolTablePut):
7179         (JSC::symbolTablePutWithAttributes):
7180         * runtime/SymbolTable.cpp: Added.
7181         (JSC):
7182         (JSC::SymbolTableEntry::copySlow):
7183         (JSC::SymbolTableEntry::freeFatEntrySlow):
7184         (JSC::SymbolTableEntry::couldBeWatched):
7185         (JSC::SymbolTableEntry::attemptToWatch):
7186         (JSC::SymbolTableEntry::addressOfIsWatched):
7187         (JSC::SymbolTableEntry::addWatchpoint):
7188         (JSC::SymbolTableEntry::notifyWriteSlow):
7189         (JSC::SymbolTableEntry::inflateSlow):
7190         * runtime/SymbolTable.h:
7191         (JSC):
7192         (SymbolTableEntry):
7193         (Fast):
7194         (JSC::SymbolTableEntry::Fast::Fast):
7195         (JSC::SymbolTableEntry::Fast::isNull):
7196         (JSC::SymbolTableEntry::Fast::getIndex):
7197         (JSC::SymbolTableEntry::Fast::isReadOnly):
7198         (JSC::SymbolTableEntry::Fast::getAttributes):
7199         (JSC::SymbolTableEntry::Fast::isFat):
7200         (JSC::SymbolTableEntry::SymbolTableEntry):
7201         (JSC::SymbolTableEntry::~SymbolTableEntry):
7202         (JSC::SymbolTableEntry::operator=):
7203         (JSC::SymbolTableEntry::isNull):
7204         (JSC::SymbolTableEntry::getIndex):
7205         (JSC::SymbolTableEntry::getFast):
7206         (JSC::SymbolTableEntry::getAttributes):
7207         (JSC::SymbolTableEntry::isReadOnly):
7208         (JSC::SymbolTableEntry::watchpointSet):
7209         (JSC::SymbolTableEntry::notifyWrite):
7210         (FatEntry):
7211         (JSC::SymbolTableEntry::FatEntry::FatEntry):
7212         (JSC::SymbolTableEntry::isFat):
7213         (JSC::SymbolTableEntry::fatEntry):
7214         (JSC::SymbolTableEntry::inflate):
7215         (JSC::SymbolTableEntry::bits):
7216         (JSC::SymbolTableEntry::freeFatEntry):
7217         (JSC::SymbolTableEntry::pack):
7218         (JSC::SymbolTableEntry::isValidIndex):
7219
7220 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
7221
7222         Unreviewed build fix for ARMv7 debug builds.
7223
7224         * jit/JITStubs.cpp:
7225         (JSC::JITThunks::JITThunks):
7226
7227 2012-06-12  Geoffrey Garen  <ggaren@apple.com>
7228
7229         Build fix for case-sensitive file systems: use the right case.
7230
7231         * heap/ListableHandler.h:
7232
7233 2012-06-11  Geoffrey Garen  <ggaren@apple.com>
7234
7235         GC should be 1.7X faster
7236         https://bugs.webkit.org/show_bug.cgi?id=88840
7237
7238         Reviewed by Oliver Hunt.
7239
7240         I profiled, and removed anything that showed up as a concurrency
7241         bottleneck. Then, I added 3 threads to our max thread count, since we
7242         can scale up to more threads now.
7243
7244         * heap/BlockAllocator.cpp:
7245         (JSC::BlockAllocator::BlockAllocator):
7246         (JSC::BlockAllocator::~BlockAllocator):
7247         (JSC::BlockAllocator::releaseFreeBlocks):
7248         (JSC::BlockAllocator::waitForRelativeTimeWhileHoldingLock):
7249         (JSC::BlockAllocator::waitForRelativeTime):
7250         (JSC::BlockAllocator::blockFreeingThreadMain):
7251         * heap/BlockAllocator.h:
7252         (BlockAllocator):
7253         (JSC::BlockAllocator::allocate):
7254         (JSC::BlockAllocator::deallocate): Use a spin lock for the common case
7255         where we're just popping a linked list. (A pthread mutex would sleep our
7256         thread even if the lock were only contended for a microsecond.)
7257
7258         Scope the lock to avoid holding it while allocating VM, since that's a
7259         slow activity and it doesn't modify any of our data structures.
7260
7261         We still use a pthread mutex to handle our condition variable since we
7262         have to, and it's not a hot path.
7263
7264         * heap/CopiedSpace.cpp:
7265         (JSC::CopiedSpace::CopiedSpace):
7266         (JSC::CopiedSpace::doneFillingBlock):
7267         * heap/CopiedSpace.h:
7268         (JSC::CopiedSpace::CopiedSpace): Use a spin lock for the to space lock,
7269         since it just guards linked list and hash table manipulation.
7270
7271         * heap/MarkStack.cpp:
7272         (JSC::MarkStackSegmentAllocator::MarkStackSegmentAllocator):
7273         (JSC::MarkStackSegmentAllocator::allocate):
7274         (JSC::MarkStackSegmentAllocator::release):
7275         (JSC::MarkStackSegmentAllocator::shrinkReserve): Use a spin lock, since
7276         we're just managing a linked list.
7277
7278         (JSC::MarkStackArray::donateSomeCellsTo): Changed donation to be proportional
7279         to our current stack size. This fixes cases where we used to donate too
7280         much. Interestingly, donating too much was starving the donor (when it
7281         ran out of work later) *and* the recipient (since it had to wait on a
7282         long donation operation to complete before it could acquire the lock).
7283
7284         In the worst case, we're still guaranteed to donate N cells in roughly log N time.
7285
7286         This change also fixes cases where we used to donate too little, since
7287         we would always keep a fixed minimum number of cells. In the worst case,
7288         with N marking threads, would could have N large object graph roots in
7289         our stack for the duration of GC, and scale to only 1 thread.
7290
7291         It's an interesting observation that a single object in the mark stack
7292         might represent an arbitrarily large object graph -- and only the act
7293         of marking can find out.
7294
7295         (JSC::MarkStackArray::stealSomeCellsFrom): Steal in proportion to idle
7296         threads. Once again, this fixes cases where constants could cause us
7297         to steal too much or too little.
7298
7299         (JSC::SlotVisitor::donateKnownParallel): Always wake up other threads
7300         if they're idle. We can afford to do this because we're conservative
7301         about when we donate.
7302
7303         (JSC::SlotVisitor::drainFromShared):
7304         * heap/MarkStack.h:
7305         (MarkStackSegmentAllocator):
7306         (MarkStackArray):
7307         (JSC):
7308         * heap/SlotVisitor.h: Merged the "should I donate?" decision into a
7309         single function, for simplicity.
7310
7311         * runtime/Options.cpp:
7312         (minimumNumberOfScansBetweenRebalance): Reduced the delay before donation
7313         a lot. We can afford to do this because, in the common case, donation is
7314         a single branch that decides not to donate.
7315
7316         (cpusToUse): Use more CPUs now, since we scale better now.
7317
7318         * runtime/Options.h:
7319         (Options): Removed now-unused variables.
7320
7321 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
7322
7323         REGRESSION(120121): inspector tests crash in DFG
7324         https://bugs.webkit.org/show_bug.cgi?id=88941
7325
7326         Reviewed by Geoffrey Garen.
7327
7328         The CFG simplifier has two different ways of fixing up GetLocal, Phantom, and Flush. If we've
7329         already fixed up the node one way, we shouldn't try the other way. The reason why we shouldn't
7330         is that the second way depends on the node referring to other nodes in the to-be-jettisoned
7331         block. After fixup they potentially will refer to nodes in the block being merged to.
7332
7333         * dfg/DFGCFGSimplificationPhase.cpp:
7334         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
7335         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
7336
7337 2012-06-12  Leo Yang  <leo.yang@torchmobile.com.cn>
7338
7339         Dynamic hash table in DOMObjectHashTableMap is wrong in multiple threads
7340         https://bugs.webkit.org/show_bug.cgi?id=87334
7341
7342         Reviewed by Geoffrey Garen.
7343
7344         Add a copy member function to JSC::HasTable. This function will copy all data
7345         members except for *table* which contains thread specific data that prevents
7346         up copying it. When you want to copy a JSC::HashTable that was constructed
7347         on another thread you should call JSC::HashTable::copy().
7348
7349         * runtime/Lookup.h:
7350         (JSC::HashTable::copy):
7351         (HashTable):
7352
7353 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
7354
7355         DFG should not ASSERT if you have a double use of a variable that is not revealed to be a double
7356         until after CFG simplification
7357         https://bugs.webkit.org/show_bug.cgi?id=88927
7358         <rdar://problem/11513971>
7359
7360         Reviewed by Geoffrey Garen.
7361
7362         Speculation fixup needs to run if simplification did things, because simplification can change
7363         predictions - particularly if you had a control flow path that stored weird things into a
7364         variable, but that path got axed by the simplifier.
7365
7366         Running fixup in the fixpoint requires making it idempotent, which it previously wasn't. Only
7367         one place needed to be changed, namely the un-MustGenerate-ion of ValueToInt32.
7368
7369         * dfg/DFGDriver.cpp:
7370         (JSC::DFG::compile):
7371         * dfg/DFGFixupPhase.cpp:
7372         (JSC::DFG::FixupPhase::fixupNode):
7373
7374 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
7375
7376         REGRESSION (r119779): Javascript TypeError: 'undefined' is not an object
7377         https://bugs.webkit.org/show_bug.cgi?id=88783
7378         <rdar://problem/11640299>
7379
7380         Reviewed by Geoffrey Garen.
7381
7382         If you don't keep alive the base of an object access over the various checks
7383         you do for the prototype chain, you're going to have a bad time.
7384
7385         * dfg/DFGByteCodeParser.cpp:
7386         (JSC::DFG::ByteCodeParser::handleGetById):
7387
7388 2012-06-12  Hojong Han  <hojong.han@samsung.com>
7389
7390         Property names of the built-in object cannot be retrieved
7391         after trying to delete one of its properties
7392         https://bugs.webkit.org/show_bug.cgi?id=86461
7393
7394         Reviewed by Gavin Barraclough.
7395
7396         * runtime/JSObject.cpp:
7397         (JSC::getClassPropertyNames):
7398         (JSC::JSObject::getOwnPropertyNames):
7399
7400 2012-06-11  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
7401
7402         [CMAKE][EFL] Remove duplicated executable output path
7403         https://bugs.webkit.org/show_bug.cgi?id=88765
7404
7405         Reviewed by Daniel Bates.
7406
7407         CMake files for EFL port have redefined executable output path. However, EFL port doesn't
7408         need to define again because it is already defined in top-level CMake file.
7409
7410         * shell/CMakeLists.txt:
7411
7412 2012-06-11  Carlos Garcia Campos  <cgarcia@igalia.com>
7413
7414         Unreviewed. Fix make distcheck issues.
7415
7416         * GNUmakefile.list.am: Remove non existent header file.
7417
7418 2012-06-10  Patrick Gansterer  <paroga@webkit.org>
7419
7420         Unreviewed. Build fix for !ENABLE(JIT) after r119844 and r119925.
7421
7422         * runtime/Executable.h:
7423         (ExecutableBase):
7424         (JSC::ExecutableBase::clearCodeVirtual):
7425
7426 2012-06-10  Patrick Gansterer  <paroga@webkit.org>
7427
7428         Unreviewed. Build fix for !ENABLE(JIT) after r119844.
7429
7430         * runtime/Executable.h:
7431         (ExecutableBase):
7432         (JSC):
7433
7434 2012-06-09  Dominic Cooney  <dominicc@chromium.org>
7435
7436         [Chromium] Remove JavaScriptCore dependencies from gyp
7437         https://bugs.webkit.org/show_bug.cgi?id=88510
7438
7439         Reviewed by Adam Barth.
7440
7441         Chromium doesn't support JSC any more and there doesn't seem to be
7442         a strong interest in using GYP as the common build system in other
7443         ports.
7444
7445         * JavaScriptCore.gyp/JavaScriptCore.gyp: WebCore still depends on YARR interpreter.
7446         * JavaScriptCore.gypi: Only include YARR source.
7447         * gyp/JavaScriptCore.gyp: Removed.
7448         * gyp/gtk.gyp: Removed.
7449
7450 2012-06-09  Geoffrey Garen  <ggaren@apple.com>
7451
7452         Unreviewed, rolling back in part2 of r118646.
7453
7454         This patch removes eager finalization.
7455
7456         Weak pointer finalization should be lazy
7457         https://bugs.webkit.org/show_bug.cgi?id=87599
7458
7459         Reviewed by Sam Weinig.
7460
7461         * heap/Heap.cpp:
7462         (JSC::Heap::collect): Don't finalize eagerly -- we'll do it lazily.
7463
7464         * heap/MarkedBlock.cpp:
7465         (JSC::MarkedBlock::sweep): Do sweep weak sets when sweeping a block,
7466         since we won't get another chance.
7467
7468         * heap/MarkedBlock.h:
7469         (JSC::MarkedBlock::sweepWeakSet):
7470         * heap/MarkedSpace.cpp:
7471         (MarkedSpace::WeakSetSweep):
7472         * heap/MarkedSpace.h:
7473         (JSC::MarkedSpace::sweepWeakSets): Removed now-unused code.
7474
7475 2012-06-09  Sukolsak Sakshuwong  <sukolsak@google.com>
7476
7477         Add UNDO_MANAGER flag
7478         https://bugs.webkit.org/show_bug.cgi?id=87908
7479
7480         Reviewed by Tony Chang.
7481
7482         * Configurations/FeatureDefines.xcconfig:
7483
7484 2012-06-08  Geoffrey Garen  <ggaren@apple.com>
7485
7486         Unreviewed, rolling back in part1 of r118646.
7487
7488         This patch includes everything necessary for lazy finalization, but
7489         keeps eager finalization enabled for the time being.
7490
7491         Weak pointer finalization should be lazy
7492         https://bugs.webkit.org/show_bug.cgi?id=87599
7493
7494         Reviewed by Sam Weinig.
7495
7496         * heap/MarkedBlock.cpp:
7497         * heap/MarkedBlock.h:
7498         (JSC::MarkedBlock::resetAllocator):
7499         * heap/MarkedSpace.cpp:
7500         (JSC::MarkedSpace::resetAllocators):
7501         * heap/MarkedSpace.h:
7502         (JSC::MarkedSpace::resetAllocators): Don't force allocator reset anymore.
7503         It will happen automatically when a weak set is swept. It's simpler to
7504         have only one canonical way for this to happen, and it wasn't buying
7505         us anything to do it eagerly.
7506         * heap/WeakBlock.cpp:
7507         (JSC::WeakBlock::sweep): Don't short-circuit a sweep unless we know
7508         the sweep would be a no-op. If even one finalizer is pending, we need to
7509         run it, since we won't get another chance.
7510         * heap/WeakSet.cpp:
7511         (JSC::WeakSet::sweep): This loop can be simpler now that
7512         WeakBlock::sweep() does what we mean.
7513         Reset our allocator after a sweep because this is the optimal time to
7514         start trying to recycle old weak pointers.
7515         (JSC::WeakSet::tryFindAllocator): Don't sweep when searching for an
7516         allocator because we've swept already, and forcing a new sweep would be
7517         wasteful.
7518         * heap/WeakSet.h:
7519         (JSC::WeakSet::shrink): Be sure to reset our allocator after a shrink
7520         because the shrink may have removed the block the allocator was going to
7521         allocate out of.
7522
7523 2012-06-08  Gavin Barraclough  <barraclough@apple.com>
7524
7525         Unreviewed roll out r119795.
7526
7527         This broke jquery/core.html
7528
7529         * dfg/DFGSpeculativeJIT.h:
7530         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
7531         * jit/JITInlineMethods.h:
7532         (JSC::JIT::emitAllocateBasicJSObject):
7533         * llint/LowLevelInterpreter.asm:
7534         * runtime/JSGlobalData.h:
7535         (JSGlobalData):
7536         * runtime/JSGlobalThis.cpp:
7537         (JSC::JSGlobalThis::setUnwrappedObject):
7538         * runtime/JSObject.cpp:
7539         (JSC::JSObject::visitChildren):
7540         (JSC::JSObject::createInheritorID):
7541         * runtime/JSObject.h:
7542         (JSObject):
7543         (JSC::JSObject::resetInheritorID):
7544         (JSC):
7545         (JSC::JSObject::offsetOfInheritorID):
7546         (JSC::JSObject::inheritorID):
7547
7548 2012-06-08  Filip Pizlo  <fpizlo@apple.com>
7549
7550         PredictedType should be called SpeculatedType
7551         https://bugs.webkit.org/show_bug.cgi?id=88477
7552
7553         Unreviewed, fix a renaming goof from http://trac.webkit.org/changeset/119660.
7554         I accidentally renamed ByteCodeParser::getPrediction to
7555         ByteCodeParser::getSpeculation.  That was not the intent. This changes it
7556         back.
7557
7558         * dfg/DFGByteCodeParser.cpp:
7559         (JSC::DFG::ByteCodeParser::addCall):
7560         (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
7561         (JSC::DFG::ByteCodeParser::getPrediction):
7562         (JSC::DFG::ByteCodeParser::handleCall):
7563         (JSC::DFG::ByteCodeParser::parseBlock):
7564
7565 2012-06-08  Andy Wingo  <wingo@igalia.com>
7566
7567         Explictly mark stubs called by JIT as being internal
7568         https://bugs.webkit.org/show_bug.cgi?id=88552
7569
7570         Reviewed by Filip Pizlo.
7571
7572         * dfg/DFGOSRExitCompiler.h:
7573         * dfg/DFGOperations.cpp:
7574         * dfg/DFGOperations.h:
7575         * jit/HostCallReturnValue.h:
7576         * jit/JITStubs.cpp:
7577         * jit/JITStubs.h:
7578         * jit/ThunkGenerators.cpp:
7579         * llint/LLIntSlowPaths.h: Mark a bunch of stubs as being
7580         WTF_INTERNAL.  Change most calls to SYMBOL_STRING_RELOCATION to
7581         LOCAL_REFERENCE, or GLOBAL_REFERENCE in the case of the wrappers
7582         to truly global symbols.
7583         * offlineasm/asm.rb: Generate LOCAL_REFERENCE instead of
7584         SYMBOL_STRING_RELOCATION.
7585
7586 2012-06-08  Geoffrey Garen  <ggaren@apple.com>
7587
7588         Don't rely on weak pointers for eager CodeBlock finalization
7589         https://bugs.webkit.org/show_bug.cgi?id=88465
7590
7591         Reviewed by Gavin Barraclough.
7592
7593         This is incompatible with lazy weak pointer finalization.
7594
7595         I considered just making CodeBlock finalization lazy-friendly, but it
7596         turns out that the heap is already way up in CodeBlock's business when
7597         it comes to finalization, so I decided to finish the job and move full
7598         responsibility for CodeBlock finalization into the heap.
7599
7600         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Maybe this
7601         will build.
7602
7603         * debugger/Debugger.cpp: Updated for rename.
7604
7605         * heap/Heap.cpp:
7606         (JSC::Heap::deleteAllCompiledCode): Renamed for consistency. Fixed a bug
7607         where we would not delete code for a code block that had been previously
7608         jettisoned. I don't know if this happens in practice -- I mostly did
7609         this to improve consistency with deleteUnmarkedCompiledCode.
7610
7611         (JSC::Heap::deleteUnmarkedCompiledCode): New function, responsible for
7612         eager finalization of unmarked code blocks.
7613
7614         (JSC::Heap::collect): Updated for rename. Updated to call
7615         deleteUnmarkedCompiledCode(), which takes care of jettisoned DFG code
7616         blocks too.
7617
7618         (JSC::Heap::addCompiledCode): Renamed, since this points to all code
7619         now, not just functions.
7620
7621         * heap/Heap.h:
7622         (Heap): Keep track of all user code, not just functions. This is a
7623         negligible additional overhead, since most code is function code.
7624
7625         * runtime/Executable.cpp:
7626         (JSC::*::finalize): Removed these functions, since we don't rely on
7627         weak pointer finalization anymore.
7628
7629         (JSC::FunctionExecutable::FunctionExecutable): Moved linked-list stuff
7630         into base class so all executables can be in the list.
7631
7632         (JSC::EvalExecutable::clearCode):
7633         (JSC::ProgramExecutable::clearCode):
7634         (JSC::FunctionExecutable::clearCode): All we need to do is delete our
7635         CodeBlock -- that will delete all of its internal data structures.
7636
7637         (JSC::FunctionExecutable::clearCodeIfNotCompiling): Factored out a helper
7638         function to improve clarity.
7639
7640         * runtime/Executable.h:
7641         (JSC::ExecutableBase): Moved linked-list stuff
7642         into base class so all executables can be in the list.
7643
7644         (JSC::NativeExecutable::create):
7645         (NativeExecutable):
7646         (ScriptExecutable):
7647         (JSC::ScriptExecutable::finishCreation):
7648         (JSC::EvalExecutable::create):
7649         (EvalExecutable):
7650         (JSC::ProgramExecutable::create):
7651         (ProgramExecutable):
7652         (FunctionExecutable):
7653         (JSC::FunctionExecutable::create): Don't use a finalizer -- the heap
7654         will call us back to destroy our code block.
7655
7656         (JSC::FunctionExecutable::discardCode): Renamed to clearCodeIfNotCompiling()
7657         for clarity.
7658
7659         (JSC::FunctionExecutable::isCompiling): New helper function, for clarity.
7660
7661         (JSC::ScriptExecutable::clearCodeVirtual): New helper function, since
7662         the heap needs to make polymorphic calls to clear code.
7663
7664         * runtime/JSGlobalData.cpp:
7665         (JSC::StackPreservingRecompiler::operator()):
7666         * runtime/JSGlobalObject.cpp:
7667         (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Updated for
7668         renames.
7669
7670 2012-06-07  Filip Pizlo  <fpizlo@apple.com>
7671
7672         DFG should inline prototype chain accesses, and do the right things if the
7673         specific function optimization is available
7674         https://bugs.webkit.org/show_bug.cgi?id=88594
7675
7676         Reviewed by Gavin Barraclough.
7677
7678         Looks like a 3% win on V8.
7679
7680         * bytecode/CodeBlock.h:
7681         (JSC::Structure::prototypeForLookup):
7682         (JSC):
7683         * bytecode/GetByIdStatus.cpp:
7684         (JSC::GetByIdStatus::computeFromLLInt):
7685         (JSC):
7686         (JSC::GetByIdStatus::computeForChain):
7687         (JSC::GetByIdStatus::computeFor):
7688         * bytecode/GetByIdStatus.h:
7689         (JSC::GetByIdStatus::GetByIdStatus):
7690         (JSC::GetByIdStatus::isSimple):
7691         (JSC::GetByIdStatus::chain):
7692         (JSC::GetByIdStatus::specificValue):
7693         (GetByIdStatus):
7694         * bytecode/StructureSet.h:
7695         (StructureSet):
7696         (JSC::StructureSet::singletonStructure):
7697         * bytecode/StructureStubInfo.h:
7698         (JSC::StructureStubInfo::initGetByIdProto):
7699         (JSC::StructureStubInfo::initGetByIdChain):
7700         * dfg/DFGByteCodeParser.cpp:
7701         (JSC::DFG::ByteCodeParser::handleGetById):
7702         * dfg/DFGRepatch.cpp:
7703         (JSC::DFG::tryCacheGetByID):
7704         * jit/JITStubs.cpp:
7705         (JSC::JITThunks::tryCacheGetByID):
7706         * runtime/JSGlobalObject.h:
7707         (JSC::Structure::prototypeForLookup):
7708         (JSC):
7709         * runtime/Structure.h:
7710         (Structure):
7711
7712 2012-06-07  Gavin Barraclough  <barraclough@apple.com>
7713
7714         Remove JSObject::m_inheritorID
7715         https://bugs.webkit.org/show_bug.cgi?id=88378
7716
7717         Reviewed by Geoff Garen.
7718
7719         This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
7720         and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
7721         Instead use a private named value in the object's property storage.
7722
7723         * dfg/DFGSpeculativeJIT.h:
7724         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
7725             - No need m_inheritorID to initialize!
7726         * jit/JITInlineMethods.h:
7727         (JSC::JIT::emitAllocateBasicJSObject):
7728             - No need m_inheritorID to initialize!
7729         * llint/LowLevelInterpreter.asm:
7730             - No need m_inheritorID to initialize!
7731         * runtime/JSGlobalData.h:
7732         (JSGlobalData):
7733             - Added private name 'm_inheritorIDKey'.
7734         * runtime/JSGlobalThis.cpp:
7735         (JSC::JSGlobalThis::setUnwrappedObject):
7736             - resetInheritorID is now passed a JSGlobalData&.
7737         * runtime/JSObject.cpp:
7738         (JSC::JSObject::visitChildren):
7739             - No m_inheritorID to be marked.
7740         (JSC::JSObject::createInheritorID):
7741             - Store the newly created inheritorID in the property map.
7742         * runtime/JSObject.h:
7743         (JSC::JSObject::resetInheritorID):
7744             - Remove the inheritorID from property storage.
7745         (JSC::JSObject::inheritorID):
7746             - Read the inheritorID from property storage.
7747
7748 2012-06-07  Gavin Barraclough  <barraclough@apple.com>
7749
7750         Math.pow on iOS does not support denormal numbers.
7751         https://bugs.webkit.org/show_bug.cgi?id=88592
7752
7753         Reviewed by Filip Pizlo.
7754
7755         Import an implementation from fdlibm, detect cases where it is safe to use the system
7756         implementation & where we should fall back to fdlibm.
7757
7758         * runtime/MathObject.cpp:
7759         (JSC::isDenormal):
7760         (JSC::isEdgeCase):
7761         (JSC::mathPow):
7762             - On iOS, detect cases where denormal support may be required & use fdlibm in these cases.
7763         (JSC::mathProtoFuncPow):
7764             - Changed to use mathPow.
7765         (JSC::fdlibmScalbn):
7766         (JSC::fdlibmPow):
7767             - These functions imported from fdlibm; original style retained to ease future merging.
7768
7769 2012-06-07  Patrick Gansterer  <paroga@webkit.org>
7770
7771         Unreviewed. Build fix for !ENABLE(JIT) after r119441.
7772
7773         * interpreter/Interpreter.cpp:
7774         (JSC::Interpreter::privateExecute):
7775
7776 2012-06-07  Andy Wingo  <wingo@igalia.com>
7777
7778         Unreviewed build fix after r119593.
7779
7780         * llint/LLIntOfflineAsmConfig.h (OFFLINE_ASM_GLOBAL_LABEL): Fix
7781         uses of "name" to be "label", the macro's parameter.  Otherwise we
7782         serialize mentions of the literal symbol "name" into the objcode.
7783         Causes a build error using GNU ld (not gold).
7784
7785 2012-06-06  Ryosuke Niwa  <rniwa@webkit.org>
7786
7787         Chromium build fix attempt. Why do we need to list these files in gyp!?
7788
7789         * JavaScriptCore.gypi:
7790
7791 2012-06-06  Filip Pizlo  <fpizlo@apple.com>
7792
7793         PredictedType should be called SpeculatedType
7794         https://bugs.webkit.org/show_bug.cgi?id=88477
7795
7796         Rubber stamped by Gavin Barraclough.
7797
7798         * CMakeLists.txt:
7799         * GNUmakefile.list.am:
7800         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
7801         * JavaScriptCore.xcodeproj/project.pbxproj:
7802         * Target.pri:
7803         * bytecode/CodeBlock.cpp:
7804         (JSC::CodeBlock::shouldOptimizeNow):
7805         (JSC::CodeBlock::dumpValueProfiles):
7806         * bytecode/CodeBlock.h:
7807         (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
7808         * bytecode/LazyOperandValueProfile.cpp:
7809         (JSC::LazyOperandValueProfileParser::prediction):
7810         * bytecode/LazyOperandValueProfile.h:
7811         (LazyOperandValueProfileParser):
7812         * bytecode/PredictedType.cpp: Removed.
7813         * bytecode/PredictedType.h: Removed.
7814         * bytecode/SpeculatedType.cpp: Copied from Source/JavaScriptCore/bytecode/PredictedType.cpp.
7815         (JSC::speculationToString):
7816         (JSC::speculationToAbbreviatedString):
7817         (JSC::speculationFromClassInfo):
7818         (JSC::speculationFromStructure):
7819         (JSC::speculationFromCell):
7820         (JSC::speculationFromValue):
7821         * bytecode/SpeculatedType.h: Copied from Source/JavaScriptCore/bytecode/PredictedType.h.
7822         (JSC):
7823         (JSC::isAnySpeculation):
7824         (JSC::isCellSpeculation):
7825         (JSC::isObjectSpeculation):
7826         (JSC::isFinalObjectSpeculation):
7827         (JSC::isFinalObjectOrOtherSpeculation):
7828         (JSC::isFixedIndexedStorageObjectSpeculation):
7829         (JSC::isStringSpeculation):
7830         (JSC::isArraySpeculation):
7831         (JSC::isFunctionSpeculation):
7832         (JSC::isInt8ArraySpeculation):
7833         (JSC::isInt16ArraySpeculation):
7834         (JSC::isInt32ArraySpeculation):
7835         (JSC::isUint8ArraySpeculation):
7836         (JSC::isUint8ClampedArraySpeculation):
7837         (JSC::isUint16ArraySpeculation):
7838         (JSC::isUint32ArraySpeculation):
7839         (JSC::isFloat32ArraySpeculation):
7840         (JSC::isFloat64ArraySpeculation):
7841         (JSC::isArgumentsSpeculation):
7842         (JSC::isActionableIntMutableArraySpeculation):
7843         (JSC::isActionableFloatMutableArraySpeculation):
7844         (JSC::isActionableTypedMutableArraySpeculation):
7845         (JSC::isActionableMutableArraySpeculation):
7846         (JSC::isActionableArraySpeculation):
7847         (JSC::isArrayOrOtherSpeculation):
7848         (JSC::isMyArgumentsSpeculation):
7849         (JSC::isInt32Speculation):
7850         (JSC::isDoubleRealSpeculation):
7851         (JSC::isDoubleSpeculation):
7852         (JSC::isNumberSpeculation):
7853         (JSC::isBooleanSpeculation):
7854         (JSC::isOtherSpeculation):
7855         (JSC::isEmptySpeculation):
7856         (JSC::mergeSpeculations):
7857         (JSC::mergeSpeculation):
7858         * bytecode/StructureSet.h:
7859         (JSC::StructureSet::speculationFromStructures):
7860         * bytecode/ValueProfile.h:
7861         (JSC::ValueProfileBase::ValueProfileBase):
7862         (JSC::ValueProfileBase::dump):
7863         (JSC::ValueProfileBase::computeUpdatedPrediction):
7864         (ValueProfileBase):
7865         * dfg/DFGAbstractState.cpp:
7866         (JSC::DFG::AbstractState::initialize):
7867         (JSC::DFG::AbstractState::execute):
7868         (JSC::DFG::AbstractState::mergeStateAtTail):
7869         * dfg/DFGAbstractState.h:
7870         (JSC::DFG::AbstractState::speculateInt32Unary):
7871         (JSC::DFG::AbstractState::speculateNumberUnary):
7872         (JSC::DFG::AbstractState::speculateBooleanUnary):
7873         (JSC::DFG::AbstractState::speculateInt32Binary):
7874         (JSC::DFG::AbstractState::speculateNumberBinary):
7875         * dfg/DFGAbstractValue.h:
7876         (JSC::DFG::StructureAbstractValue::filter):
7877         (JSC::DFG::StructureAbstractValue::speculationFromStructures):
7878         (JSC::DFG::AbstractValue::AbstractValue):
7879         (JSC::DFG::AbstractValue::clear):
7880         (JSC::DFG::AbstractValue::isClear):
7881         (JSC::DFG::AbstractValue::makeTop):
7882         (JSC::DFG::AbstractValue::clobberStructures):
7883         (JSC::DFG::AbstractValue::isTop):
7884         (JSC::DFG::AbstractValue::set):
7885         (JSC::DFG::AbstractValue::merge):
7886         (JSC::DFG::AbstractValue::filter):
7887         (JSC::DFG::AbstractValue::validateIgnoringValue):
7888         (JSC::DFG::AbstractValue::validate):
7889         (JSC::DFG::AbstractValue::checkConsistency):
7890         (JSC::DFG::AbstractValue::dump):
7891         (AbstractValue):
7892         * dfg/DFGArgumentPosition.h:
7893         (JSC::DFG::ArgumentPosition::ArgumentPosition):
7894         (JSC::DFG::ArgumentPosition::mergeArgumentAwareness):
7895         (JSC::DFG::ArgumentPosition::prediction):
7896         (ArgumentPosition):
7897         * dfg/DFGArgumentsSimplificationPhase.cpp:
7898         (JSC::DFG::ArgumentsSimplificationPhase::run):
7899         * dfg/DFGByteCodeParser.cpp:
7900         (ByteCodeParser):
7901         (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
7902         (JSC::DFG::ByteCodeParser::getLocal):
7903         (JSC::DFG::ByteCodeParser::getArgument):
7904         (JSC::DFG::ByteCodeParser::addCall):
7905         (JSC::DFG::ByteCodeParser::getSpeculationWithoutOSRExit):
7906         (JSC::DFG::ByteCodeParser::getSpeculation):
7907         (InlineStackEntry):
7908         (JSC::DFG::ByteCodeParser::handleCall):
7909         (JSC::DFG::ByteCodeParser::handleIntrinsic):
7910         (JSC::DFG::ByteCodeParser::handleGetById):
7911         (JSC::DFG::ByteCodeParser::parseBlock):
7912         (JSC::DFG::ByteCodeParser::fixVariableAccessSpeculations):
7913         (JSC::DFG::ByteCodeParser::parse):
7914         * dfg/DFGCSEPhase.cpp:
7915         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
7916         (JSC::DFG::CSEPhase::performNodeCSE):
7917         * dfg/DFGConstantFoldingPhase.cpp:
7918         (JSC::DFG::ConstantFoldingPhase::run):
7919         * dfg/DFGFixupPhase.cpp:
7920         (JSC::DFG::FixupPhase::fixupNode):
7921         (JSC::DFG::FixupPhase::fixDoubleEdge):
7922         * dfg/DFGGraph.cpp:
7923         (JSC::DFG::Graph::nameOfVariableAccessData):
7924         (JSC::DFG::Graph::dump):
7925         (JSC::DFG::Graph::predictArgumentTypes):
7926         * dfg/DFGGraph.h:
7927         (JSC::DFG::Graph::getJSConstantSpeculation):
7928         (JSC::DFG::Graph::isPredictedNumerical):
7929         (JSC::DFG::Graph::byValIsPure):
7930         * dfg/DFGJITCompiler.h:
7931         (JSC::DFG::JITCompiler::getSpeculation):
7932         * dfg/DFGNode.h:
7933         (JSC::DFG::Node::Node):
7934         (JSC::DFG::Node::getHeapPrediction):
7935         (JSC::DFG::Node::predictHeap):
7936         (JSC::DFG::Node::prediction):
7937         (JSC::DFG::Node::predict):
7938         (JSC::DFG::Node::shouldSpeculateInteger):
7939         (JSC::DFG::Node::shouldSpeculateDouble):
7940         (JSC::DFG::Node::shouldSpeculateNumber):
7941         (JSC::DFG::Node::shouldSpeculateBoolean):
7942         (JSC::DFG::Node::shouldSpeculateFinalObject):
7943         (JSC::DFG::Node::shouldSpeculateFinalObjectOrOther):
7944         (JSC::DFG::Node::shouldSpeculateArray):
7945         (JSC::DFG::Node::shouldSpeculateArguments):
7946         (JSC::DFG::Node::shouldSpeculateInt8Array):
7947         (JSC::DFG::Node::shouldSpeculateInt16Array):
7948         (JSC::DFG::Node::shouldSpeculateInt32Array):
7949         (JSC::DFG::Node::shouldSpeculateUint8Array):
7950         (JSC::DFG::Node::shouldSpeculateUint8ClampedArray):
7951         (JSC::DFG::Node::shouldSpeculateUint16Array):
7952         (JSC::DFG::Node::shouldSpeculateUint32Array):
7953         (JSC::DFG::Node::shouldSpeculateFloat32Array):
7954         (JSC::DFG::Node::shouldSpeculateFloat64Array):
7955         (JSC::DFG::Node::shouldSpeculateArrayOrOther):
7956         (JSC::DFG::Node::shouldSpeculateObject):
7957         (JSC::DFG::Node::shouldSpeculateCell):
7958         (Node):
7959         * dfg/DFGPredictionPropagationPhase.cpp:
7960         (JSC::DFG::PredictionPropagationPhase::setPrediction):
7961         (JSC::DFG::PredictionPropagationPhase::mergePrediction):
7962         (JSC::DFG::PredictionPropagationPhase::propagate):
7963         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
7964         * dfg/DFGSpeculativeJIT.cpp:
7965         (JSC::DFG::SpeculativeJIT::fillStorage):
7966         (JSC::DFG::SpeculativeJIT::writeBarrier):
7967         (JSC::DFG::GPRTemporary::GPRTemporary):
7968         (JSC::DFG::FPRTemporary::FPRTemporary):
7969         (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
7970         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
7971         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
7972         (JSC::DFG::SpeculativeJIT::compile):
7973         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
7974         (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
7975         (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
7976         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
7977         (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
7978         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
7979         (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLength):
7980         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
7981         (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
7982         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
7983         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
7984         (JSC::DFG::SpeculativeJIT::compileInstanceOf):
7985         (JSC::DFG::SpeculativeJIT::compileAdd):
7986         (JSC::DFG::SpeculativeJIT::compileArithSub):
7987         (JSC::DFG::SpeculativeJIT::compileArithNegate):
7988         (JSC::DFG::SpeculativeJIT::compileArithMul):
7989         (JSC::DFG::SpeculativeJIT::compileArithMod):
7990         (JSC::DFG::SpeculativeJIT::compare):
7991         (JSC::DFG::SpeculativeJIT::compileStrictEq):
7992         (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
7993         (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
7994         (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
7995         (JSC::DFG::SpeculativeJIT::compileRegExpExec):
7996         * dfg/DFGSpeculativeJIT.h:
7997         (DFG):
7998         (JSC::DFG::ValueSource::forSpeculation):
7999         (SpeculativeJIT):
8000         (GPRTemporary):
8001         (FPRTemporary):
8002         (JSC::DFG::SpecDoubleOperand::SpecDoubleOperand):
8003         (JSC::DFG::SpecDoubleOperand::~SpecDoubleOperand):
8004         (JSC::DFG::SpecDoubleOperand::fpr):
8005         (JSC::DFG::SpecCellOperand::SpecCellOperand):
8006         (JSC::DFG::SpecCellOperand::~SpecCellOperand):
8007         (JSC::DFG::SpecCellOperand::gpr):
8008         (JSC::DFG::SpecBooleanOperand::SpecBooleanOperand):
8009         (JSC::DFG::SpecBooleanOperand::~SpecBooleanOperand):
8010         (JSC::DFG::SpecBooleanOperand::gpr):
8011         * dfg/DFGSpeculativeJIT32_64.cpp:
8012         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
8013         (JSC::DFG::SpeculativeJIT::fillSpecDouble):
8014         (JSC::DFG::SpeculativeJIT::fillSpecCell):
8015         (JSC::DFG::SpeculativeJIT::fillSpecBoolean):
8016         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
8017         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
8018         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
8019         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
8020         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
8021         (JSC::DFG::SpeculativeJIT::emitBranch):
8022         (JSC::DFG::SpeculativeJIT::compile):
8023         * dfg/DFGSpeculativeJIT64.cpp:
8024         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
8025         (JSC::DFG::SpeculativeJIT::fillSpecDouble):
8026         (JSC::DFG::SpeculativeJIT::fillSpecCell):
8027         (JSC::DFG::SpeculativeJIT::fillSpecBoolean):
8028         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
8029         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
8030         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
8031         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
8032         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
8033         (JSC::DFG::SpeculativeJIT::emitBranch):
8034         (JSC::DFG::SpeculativeJIT::compile):
8035         * dfg/DFGVariableAccessData.h:
8036         (JSC::DFG::VariableAccessData::VariableAccessData):
8037         (JSC::DFG::VariableAccessData::predict):
8038         (JSC::DFG::VariableAccessData::nonUnifiedPrediction):
8039         (JSC::DFG::VariableAccessData::prediction):
8040         (JSC::DFG::VariableAccessData::argumentAwarePrediction):
8041         (JSC::DFG::VariableAccessData::mergeArgumentAwarePrediction):
8042         (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
8043         (JSC::DFG::VariableAccessData::makePredictionForDoubleFormat):
8044         (VariableAccessData):
8045
8046 2012-06-06  Filip Pizlo  <fpizlo@apple.com>
8047
8048         Global object variable accesses should not require an extra load
8049         https://bugs.webkit.org/show_bug.cgi?id=88385
8050
8051         Reviewed by Gavin Barraclough and Geoffrey Garen.
8052
8053         Previously, if you wanted to access a global variable, you'd first have
8054         to load the register array from the appropriate global object and then
8055         either load or store at an offset to the register array. This is because
8056         JSGlobalObject inherited from JSVariableObject, and JSVariableObject is
8057         designed with the pessimistic assumption that its register array may
8058         point into the call stack. This is never the case for global objects.
8059         Hence, even though the global object may add more registers at any time,
8060         it does not need to store them in a contiguous array. It can use a
8061         SegmentedVector or similar.
8062
8063         This patch refactors global objects and variable objects as follows:
8064
8065         - The functionality to track variables in an indexable array using a
8066           SymbolTable to map names to indices is moved into JSSymbolTableObject,
8067           which is now a supertype of JSVariableObject. JSVariableObject is now
8068           just a holder for a registers array and implements the registerAt()
8069           method that is left abstract in JSSymbolTableObject. Because all users
8070           of JSVariableObject know whether they are a JSStaticScopeObject,
8071           JSActivation, or JSGlobalObject, this "abstract" method is not virtual;
8072           instead the utility methods that would call registerAt() are now
8073           template functions that require you to know statically what subtype of
8074           JSSymbolTableObject you're using (JSVariableObject or something else),
8075           so that registerAt() can be statically bound.
8076
8077         - A new class is added called JSSegmentedVariableObject, which only
8078           differs from JSVariableObject in how it allocates registers. It uses a
8079           SegmentedVector instead of manually managing a pointer to a contiguous
8080           slab of registers. This changes the interface somewhat; for example
8081           with JSVariableObject if you wanted to add a register you had to do
8082           it yourself since the JSVariableObject didn't know how the registers
8083           array ought to be allocated. With JSSegmentedVariableObject you can
8084           just call addRegisters(). JSSegmentedVariableObject preserves the
8085           invariant that once you get a pointer into a register, that pointer
8086           will continue to be valid so long as the JSSegmentedVariableObject is
8087           alive. This allows the JITs and interpreters to skip the extra load.
8088
8089         - JSGlobalObject now inherits from JSSegmentedVariableObject. For now
8090           (and possibly forever) it is the only subtype of this new class.
8091
8092         - The bytecode format is changed so that get_global_var and
8093           put_global_var have a pointer to the register directly rather than
8094           having an index. A convenience method is provided in
8095           JSSegmentedVariableObject to get the index given a a pointer, which is
8096           used for assertions and debug dumps.
8097
8098         This appears to be a 1% across the board win.
8099
8100         * CMakeLists.txt:
8101         * GNUmakefile.list.am:
8102         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
8103         * JavaScriptCore.xcodeproj/project.pbxproj:
8104         * Target.pri:
8105         * bytecode/CodeBlock.cpp:
8106         (JSC::CodeBlock::dump):
8107         * bytecode/Instruction.h:
8108         (Instruction):
8109         (JSC::Instruction::Instruction):
8110         * bytecompiler/BytecodeGenerator.cpp:
8111         (JSC::ResolveResult::registerPointer):
8112         (JSC):
8113         (JSC::BytecodeGenerator::BytecodeGenerator):
8114         (JSC::BytecodeGenerator::retrieveLastUnaryOp):
8115         (JSC::BytecodeGenerator::resolve):
8116         (JSC::BytecodeGenerator::resolveConstDecl):
8117         (JSC::BytecodeGenerator::emitGetStaticVar):
8118         (JSC::BytecodeGenerator::emitPutStaticVar):
8119         * bytecompiler/BytecodeGenerator.h:
8120         (ResolveResult):
8121         (BytecodeGenerator):
8122         * dfg/DFGAssemblyHelpers.h:
8123         (AssemblyHelpers):
8124         * dfg/DFGByteCodeParser.cpp:
8125         (JSC::DFG::ByteCodeParser::parseBlock):
8126         * dfg/DFGCSEPhase.cpp:
8127         (JSC::DFG::CSEPhase::globalVarLoadElimination):
8128         (JSC::DFG::CSEPhase::globalVarStoreElimination):
8129         (JSC::DFG::CSEPhase::performNodeCSE):
8130         * dfg/DFGGraph.cpp:
8131         (JSC::DFG::Graph::dump):
8132         * dfg/DFGGraph.h:
8133         (JSC::DFG::Graph::globalObjectFor):
8134         (Graph):
8135         * dfg/DFGNode.h:
8136         (JSC::DFG::Node::hasVarNumber):
8137         (Node):
8138         (JSC::DFG::Node::hasRegisterPointer):
8139         (JSC::DFG::Node::registerPointer):
8140         * dfg/DFGSpeculativeJIT32_64.cpp:
8141         (JSC::DFG::SpeculativeJIT::compile):
8142         * dfg/DFGSpeculativeJIT64.cpp:
8143         (JSC::DFG::SpeculativeJIT::compile):
8144         * heap/Heap.h:
8145         (Heap):
8146         (JSC::Heap::isWriteBarrierEnabled):
8147         (JSC):
8148         * interpreter/Interpreter.cpp:
8149         (JSC::Interpreter::execute):
8150         (JSC::Interpreter::privateExecute):
8151         * jit/JITPropertyAccess.cpp:
8152         (JSC::JIT::emit_op_get_global_var):
8153         (JSC::JIT::emit_op_put_global_var):
8154         * jit/JITPropertyAccess32_64.cpp:
8155         (JSC::JIT::emit_op_get_global_var):
8156         (JSC::JIT::emit_op_put_global_var):
8157         * llint/LowLevelInterpreter32_64.asm:
8158         * llint/LowLevelInterpreter64.asm:
8159         * runtime/JSGlobalObject.cpp:
8160         (JSC):
8161         (JSC::JSGlobalObject::put):
8162         (JSC::JSGlobalObject::putDirectVirtual):
8163         (JSC::JSGlobalObject::defineOwnProperty):
8164         (JSC::JSGlobalObject::visitChildren):
8165         (JSC::JSGlobalObject::addStaticGlobals):
8166         (JSC::JSGlobalObject::getOwnPropertySlot):
8167         (JSC::JSGlobalObject::getOwnPropertyDescriptor):
8168         * runtime/JSGlobalObject.h:
8169         (JSGlobalObject):
8170         (JSC::JSGlobalObject::JSGlobalObject):
8171         (JSC):
8172         (JSC::JSGlobalObject::hasOwnPropertyForWrite):
8173         * runtime/JSSegmentedVariableObject.cpp: Added.
8174         (JSC):
8175         (JSC::JSSegmentedVariableObject::findRegisterIndex):
8176         (JSC::JSSegmentedVariableObject::addRegisters):
8177         (JSC::JSSegmentedVariableObject::visitChildren):
8178         * runtime/JSSegmentedVariableObject.h: Added.
8179         (JSC):
8180         (JSSegmentedVariableObject):
8181         (JSC::JSSegmentedVariableObject::registerAt):
8182         (JSC::JSSegmentedVariableObject::assertRegisterIsInThisObject):
8183         (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
8184         (JSC::JSSegmentedVariableObject::finishCreation):
8185         * runtime/JSStaticScopeObject.cpp:
8186         (JSC::JSStaticScopeObject::put):
8187         (JSC::JSStaticScopeObject::putDirectVirtual):
8188         (JSC::JSStaticScopeObject::getOwnPropertySlot):
8189         * runtime/JSSymbolTableObject.cpp: Added.
8190         (JSC):
8191         (JSC::JSSymbolTableObject::destroy):
8192         (JSC::JSSymbolTableObject::deleteProperty):
8193         (JSC::JSSymbolTableObject::getOwnPropertyNames):
8194         (JSC::JSSymbolTableObject::putDirectVirtual):
8195         (JSC::JSSymbolTableObject::isDynamicScope):
8196         * runtime/JSSymbolTableObject.h: Added.
8197         (JSC):
8198         (JSSymbolTableObject):
8199         (JSC::JSSymbolTableObject::symbolTable):
8200         (JSC::JSSymbolTableObject::JSSymbolTableObject):
8201         (JSC::JSSymbolTableObject::finishCreation):
8202         (JSC::symbolTableGet):
8203         (JSC::symbolTablePut):
8204         (JSC::symbolTablePutWithAttributes):
8205         * runtime/JSVariableObject.cpp:
8206         (JSC):
8207         * runtime/JSVariableObject.h:
8208         (JSVariableObject):
8209         (JSC::JSVariableObject::JSVariableObject):
8210         (JSC::JSVariableObject::finishCreation):
8211         (JSC):
8212         * runtime/WriteBarrier.h:
8213
8214 2012-06-06  Filip Pizlo  <fpizlo@apple.com>
8215
8216         DFG arguments access slow path should not crash if the arguments haven't been created
8217         https://bugs.webkit.org/show_bug.cgi?id=88471
8218
8219         Reviewed by Gavin Barraclough.
8220
8221         * dfg/DFGCCallHelpers.h:
8222         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
8223         (CCallHelpers):
8224         * dfg/DFGOperations.cpp:
8225         * dfg/DFGOperations.h:
8226         * dfg/DFGSpeculativeJIT.h:
8227         (JSC::DFG::SpeculativeJIT::callOperation):
8228         * dfg/DFGSpeculativeJIT32_64.cpp:
8229         (JSC::DFG::SpeculativeJIT::compile):
8230         * dfg/DFGSpeculativeJIT64.cpp:
8231         (JSC::DFG::SpeculativeJIT::compile):
8232
8233 2012-06-06  Michael Saboff  <msaboff@apple.com>
8234
8235         ENH: Add Logging to GC Marking Phase
8236         https://bugs.webkit.org/show_bug.cgi?id=88364
8237
8238         Reviewed by Filip Pizlo.
8239
8240         Log GC marking to stderr or a file.  The logging in controlled
8241         with the define ENABLE_OBJECT_MARK_LOGGING in wtf/Platform.h.
8242         If DATA_LOG_TO_FILE in wtf/DataLog.cpp is set to 1, output is
8243         logged to a file otherwise it is logged to stderr.
8244
8245         When logging is enabled, the GC is built single threaded since the
8246         log output from the various threads isn't buffered and output in a
8247         thread safe manner.
8248
8249         * heap/Heap.cpp:
8250         (JSC::Heap::markRoots):
8251         * heap/MarkStack.cpp:
8252         (JSC::MarkStackThreadSharedData::resetChildren):
8253         (JSC::MarkStackThreadSharedData::childVisitCount):
8254         (JSC::MarkStackThreadSharedData::markingThreadMain):
8255         (JSC::MarkStackThreadSharedData::markingThreadStartFunc):
8256         (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
8257         (JSC::MarkStackThreadSharedData::reset):
8258         * heap/MarkStack.h:
8259         (MarkStackThreadSharedData):
8260         (MarkStack):
8261         (JSC::MarkStack::sharedData):
8262         (JSC::MarkStack::resetChildCount):
8263         (JSC::MarkStack::childCount):
8264         (JSC::MarkStack::incrementChildCount):
8265         * runtime/JSArray.cpp:
8266         (JSC::JSArray::visitChildren):
8267         * runtime/JSCell.cpp:
8268         (JSC::JSCell::className):
8269         * runtime/JSCell.h:
8270         (JSCell):
8271         (JSC::JSCell::visitChildren):
8272         * runtime/JSString.cpp:
8273         (JSC::JSString::visitChildren):
8274         * runtime/JSString.h:
8275         (JSString):
8276         * runtime/Structure.h:
8277         (JSC::MarkStack::internalAppend):
8278
8279 2012-06-06  Gavin Barraclough  <barraclough@apple.com>
8280
8281         Assigning to a static property should not change iteration order
8282         https://bugs.webkit.org/show_bug.cgi?id=88401
8283
8284         Reviewed by Geoff Garen.
8285
8286         A specific iteration order is not defined by the spec, but test-262 somewhat tenuously
8287         requires that it is at least stable, e.g. ch10/10.4/10.4.2/S10.4.2_A1.1_T1.js
8288
8289         Whilst it is not clear that this behavior really arises from the specification, it
8290         would seem like common sense to conform to this.
8291
8292         The problem here is that we allow properties in the structure to shadow those in the
8293         static table, and we iterate the properties in the structure first - which means that
8294         as values of existing properties are modified, their iteration order changes too.
8295
8296         The easy fix is to iterate the properties from the static table first. This has a
8297         further benefit, since it will mean that user added properties will come after those
8298         present in the static table (respected the expected insertion-order).
8299
8300         * runtime/JSObject.cpp:
8301         (JSC::JSObject::getOwnPropertyNames):
8302             - Iterate static properties first.
8303
8304 2012-06-06  Andy Wingo  <wingo@igalia.com>
8305
8306         Ensure consistent order of evaluation in LLInt slow paths
8307         https://bugs.webkit.org/show_bug.cgi?id=88409
8308
8309         Reviewed by Geoffrey Garen.
8310
8311         * llint/LLIntSlowPaths.cpp:
8312         (slow_path_mul)
8313         (slow_path_sub)
8314         (slow_path_div)
8315         (slow_path_mod)
8316         (slow_path_lshift)
8317         (slow_path_rshift)
8318         (slow_path_urshift)
8319         (slow_path_bitand)
8320         (slow_path_bitor)
8321         (slow_path_bitxor): Avoid calling toNumber, toInt32, or toUInt32
8322         multiple times without intervening sequence points.  Fixes
8323         fast/js/exception-sequencing-binops.html with GCC 4.7 on x86-64
8324         Linux, which reordered evaluation of the arguments to fmod.
8325
8326 2012-06-06  Andy Wingo  <wingo@igalia.com>
8327
8328         [GTK] Enable the LLInt
8329         https://bugs.webkit.org/show_bug.cgi?id=88315
8330
8331         Reviewed by Filip Pizlo.
8332
8333         * GNUmakefile.am: Add rules to generate LLIntDesiredOffsets.h and
8334         LLIntAssembly.h.
8335         * GNUmakefile.list.am: Add offlineasm and llint files to the
8336         dist.  Add LLInt source files to the build.
8337         * llint/LowLevelInterpreter.asm (crash): Generate a store of
8338         0xbbadbeef to a register, not to a constant.  Otherwise, gas was
8339         failing to assemble result.
8340         * offlineasm/asm.rb (labelReference): Generate a
8341         SYMBOL_STRING_RELOCATION instead of a SYMBOL_STRING, so that we go
8342         through the PLT on ELF systems.
8343
8344 2012-06-06  Andy Wingo  <wingo@igalia.com>
8345
8346         REGRESSION (r106478): None of the Paper.js JavaScript examples work
8347         https://bugs.webkit.org/show_bug.cgi?id=87158
8348
8349         Reviewed by Michael Saboff.
8350
8351         * bytecompiler/BytecodeGenerator.cpp:
8352         (JSC::BytecodeGenerator::resolve): If we have to bail out to
8353         dynamicResolve(), only skip static scopes from the head of the
8354         scope chain.  Before, we were also skipping activations with
8355         direct eval as well, which was incorrect.
8356
8357 2012-06-06  Dan Bernstein  <mitz@apple.com>
8358
8359         Reverted r119567, the fix for <http://webkit.org/b/88378>, because it broke the 32-bit build.
8360
8361         * dfg/DFGSpeculativeJIT.h:
8362         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
8363         * jit/JITInlineMethods.h:
8364         (JSC::JIT::emitAllocateBasicJSObject):
8365         * llint/LowLevelInterpreter.asm:
8366         * runtime/JSGlobalData.h:
8367         (JSGlobalData):
8368         * runtime/JSGlobalThis.cpp:
8369         (JSC::JSGlobalThis::setUnwrappedObject):
8370         * runtime/JSObject.cpp:
8371         (JSC::JSObject::visitChildren):
8372         (JSC::JSObject::createInheritorID):
8373         * runtime/JSObject.h:
8374         (JSObject):
8375         (JSC::JSObject::resetInheritorID):
8376         (JSC):
8377         (JSC::JSObject::offsetOfInheritorID):
8378         (JSC::JSObject::inheritorID):
8379
8380 2012-06-05  Yuqiang Xian  <yuqiang.xian@intel.com>
8381
8382         Improve Math.round and Math.floor intrinsic
8383         https://bugs.webkit.org/show_bug.cgi?id=88314
8384
8385         Reviewed by Filip Pizlo.
8386
8387         Currently we call a native function from the JIT code to complete the
8388         "round" and "floor" operations. We could inline some fast paths
8389         especially for those positive values on the platforms where floating
8390         point truncation is supported.
8391         This brings 3% gain on Kraken, especially 32% on audio-oscillator,
8392         and slight win on SunSpider, measured on IA32.
8393
8394         * jit/ThunkGenerators.cpp:
8395         (JSC::floorThunkGenerator):
8396         (JSC):
8397         (JSC::roundThunkGenerator):
8398
8399 2012-06-05  Gavin Barraclough  <barraclough@apple.com>
8400
8401         Remove JSObject::m_inheritorID
8402         https://bugs.webkit.org/show_bug.cgi?id=88378
8403
8404         Reviewed by Geoff Garen.
8405
8406         This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
8407         and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
8408         Instead use a private named value in the object's property storage.
8409
8410         * dfg/DFGSpeculativeJIT.h:
8411         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
8412             - No need m_inheritorID to initialize!
8413         * jit/JITInlineMethods.h:
8414         (JSC::JIT::emitAllocateBasicJSObject):
8415             - No need m_inheritorID to initialize!
8416         * llint/LowLevelInterpreter.asm:
8417             - No need m_inheritorID to initialize!
8418         * runtime/JSGlobalData.h:
8419         (JSGlobalData):
8420             - Added private name 'm_inheritorIDKey'.
8421         * runtime/JSGlobalThis.cpp:
8422         (JSC::JSGlobalThis::setUnwrappedObject):
8423             - resetInheritorID is now passed a JSGlobalData&.
8424         * runtime/JSObject.cpp:
8425         (JSC::JSObject::visitChildren):
8426             - No m_inheritorID to be marked.
8427         (JSC::JSObject::createInheritorID):
8428             - Store the newly created inheritorID in the property map.
8429         * runtime/JSObject.h:
8430         (JSC::JSObject::resetInheritorID):
8431             - Remove the inheritorID from property storage.
8432         (JSC::JSObject::inheritorID):
8433             - Read the inheritorID from property storage.
8434
8435 2012-06-05  Filip Pizlo  <fpizlo@apple.com>
8436
8437         DFG CFG simplification should not attempt to deref nodes inside of an unreachable subgraph
8438         https://bugs.webkit.org/show_bug.cgi?id=88362
8439
8440         Reviewed by Gavin Barraclough.
8441
8442         * dfg/DFGCFGSimplificationPhase.cpp:
8443         (JSC::DFG::CFGSimplificationPhase::fixPhis):
8444         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
8445
8446 2012-06-05  Mark Hahnenberg  <mhahnenberg@apple.com>
8447
8448         Entry into JSC should CRASH() if the Heap is busy
8449         https://bugs.webkit.org/show_bug.cgi?id=88355
8450
8451         Reviewed by Geoffrey Garen.
8452
8453         Interpreter::execute() returns jsNull() right now if we try to enter it while
8454         the Heap is busy (e.g. with a collection), which is okay, but some code paths
8455         that call Interpreter::execute() allocate objects before checking if the Heap
8456         is busy. Attempting to execute JS code while the Heap is busy should not be
8457         allowed and should be enforced by a release-mode CRASH() to prevent vague,
8458         unhelpful backtraces later on if somebody makes a mistake. Normally, recursively
8459         executing JS code is okay, e.g. for evals, but it should not occur during a
8460         Heap allocation or collection because the Heap is not guaranteed to be in a
8461         consistent state (especially during collections). We are protected from
8462         executing JS on the same Heap concurrently on two separate threads because
8463         they must each take a JSLock first. However, we are not protected from reentrant
8464         execution of JS on the same thread because JSLock allows reentrancy. Therefore,
8465         we should fail early if we detect an entrance into JS code while the Heap is busy.
8466
8467         * heap/Heap.cpp: Changed Heap::collect so that it sets the m_operationInProgress field
8468         at the beginning of collection and then unsets it at the end so that it is set at all
8469         times throughout the duration of a collection rather than sporadically during various
8470         phases. There is no reason to unset during a collection because our collector does
8471         not currently support running additional JS between the phases of a collection.
8472         (JSC::Heap::getConservativeRegisterRoots):
8473         (JSC::Heap::markRoots):
8474         (JSC::Heap::collect):
8475         * interpreter/Interpreter.cpp:
8476         (JSC::Interpreter::execute): Crash if the Heap is busy.
8477         * runtime/Completion.cpp: Crash if the Heap is busy. We do it here before we call
8478         Interpreter::execute() because we do some allocation prior to calling execute() which
8479         could cause Heap corruption if, for example, that allocation caused a collection.
8480         (JSC::evaluate):
8481
8482 2012-06-05  Dongwoo Im  <dw.im@samsung.com>
8483
8484         Add 'isProtocolHandlerRegistered' and 'unregisterProtocolHandler'.
8485         https://bugs.webkit.org/show_bug.cgi?id=73176
8486
8487         Reviewed by Adam Barth.
8488
8489         Two more APIs are added in Custom Scheme Handler specification.
8490         http://dev.w3.org/html5/spec/Overview.html#custom-handlers
8491         One is 'isProtocolHandlerRegistered' to query whether the specific URL
8492         is registered or not.
8493         The other is 'unregisterProtocolHandler' to remove the registered URL.
8494
8495         * Configurations/FeatureDefines.xcconfig: Add a macro 'ENABLE_CUSTOM_SCHEME_HANDLER'.
8496
8497 2012-06-04  Filip Pizlo  <fpizlo@apple.com>
8498
8499         DFG CFG simplification should correct the variables at the head of the predecessor block
8500         https://bugs.webkit.org/show_bug.cgi?id=88284
8501
8502         Reviewed by Geoffrey Garen.
8503
8504         * dfg/DFGCFGSimplificationPhase.cpp:
8505         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
8506
8507 2012-06-04  Geoffrey Garen  <ggaren@apple.com>
8508
8509         Unreviewed.
8510
8511         Rolled out r119364 because it's still causing crashes (when running
8512         v8-earley in release builds of DRT)
8513
8514         This time for sure!
8515
8516         * heap/Heap.cpp:
8517         (JSC::Heap::collect):
8518         * heap/MarkedBlock.cpp:
8519         (JSC::MarkedBlock::sweep):
8520         * heap/MarkedBlock.h:
8521         (JSC::MarkedBlock::resetAllocator):
8522         (JSC):
8523         * heap/MarkedSpace.cpp:
8524         (JSC::ResetAllocator::operator()):
8525         (JSC):
8526         (JSC::MarkedSpace::resetAllocators):
8527         (JSC::MarkedSpace::sweepWeakSets):
8528         * heap/MarkedSpace.h:
8529         (MarkedSpace):
8530         * heap/WeakBlock.cpp:
8531         (JSC::WeakBlock::sweep):
8532         * heap/WeakSet.cpp:
8533         (JSC::WeakSet::sweep):
8534         (JSC::WeakSet::tryFindAllocator):
8535         * heap/WeakSet.h:
8536         (JSC::WeakSet::shrink):
8537
8538 2012-06-04  Filip Pizlo  <fpizlo@apple.com>
8539
8540         DFG arguments simplification should have rationalized handling of TearOffArguments
8541         https://bugs.webkit.org/show_bug.cgi?id=88206
8542
8543         Reviewed by Geoffrey Garen.
8544
8545         - Accesses to the unmodified arguments register ought to have the same effect on
8546           alias/escape analysis of arguments as accesses to the mutable arguments register.
8547
8548         - The existence of TearOffArguments should not get in the way of arguments aliasing.
8549
8550         - TearOffArguments should be eliminated if CreateArguments is eliminated.
8551
8552         * dfg/DFGArgumentsSimplificationPhase.cpp:
8553         (JSC::DFG::ArgumentsSimplificationPhase::run):
8554         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
8555
8556 2012-06-04  Gavin Barraclough  <barraclough@apple.com>
8557
8558         Remove enabledProfilerReference
8559         https://bugs.webkit.org/show_bug.cgi?id=88258
8560
8561         Reviewed by Michael Saboff.
8562
8563         Make the enabled profiler a member of JSGlobalData, and switch code that accesses it to do so directly
8564         via the JSGlobalData, rather than holding a Profiler** reference to it. Do not pass the Profiler**
8565         reference to JIT code. This patch does not change the stack layout on entry into JIT code (passing an
8566         unused void* instead), since this is an intrusive change better handled in a separate patch.
8567
8568         * interpreter/Interpreter.cpp:
8569         (JSC::Interpreter::throwException):
8570         (JSC::Interpreter::execute):
8571         (JSC::Interpreter::executeCall):
8572         (JSC::Interpreter::executeConstruct):
8573         (JSC::Interpreter::privateExecute):
8574         * jit/JITCode.h:
8575         (JSC::JITCode::execute):
8576             - Don't pass Profiler** to JIT code.
8577         * jit/JITOpcodes.cpp:
8578         (JSC::JIT::emit_op_profile_will_call):
8579         (JSC::JIT::emit_op_profile_did_call):
8580         * jit/JITOpcodes32_64.cpp:
8581         (JSC::JIT::emit_op_profile_will_call):
8582         (JSC::JIT::emit_op_profile_did_call):
8583         * jit/JITStubs.cpp:
8584         (JSC):
8585         (JSC::ctiTrampoline):
8586         (JSC::ctiVMThrowTrampoline):
8587         (JSC::ctiOpThrowNotCaught):
8588         (JSC::JITThunks::JITThunks):
8589         (JSC::DEFINE_STUB_FUNCTION):
8590             - For ARM_THUMB2, rename ENABLE_PROFILER_REFERENCE_OFFSET to FIRST_STACK_ARGUMENT (which is how it is being used).
8591             - For MIPS, remove ENABLE_PROFILER_REFERENCE_OFFSET.
8592         * jit/JITStubs.h:
8593         (JITStackFrame):
8594         (JSC):
8595             - Renamed enabledProfilerReference to unusedX.
8596         * llint/LLIntSlowPaths.cpp:
8597         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
8598         * llint/LowLevelInterpreter.asm:
8599         * profiler/Profiler.cpp:
8600         (JSC):
8601         (JSC::Profiler::startProfiling):
8602         (JSC::Profiler::stopProfiling):
8603         * profiler/Profiler.h:
8604         (Profiler):
8605             - Removed s_sharedEnabledProfilerReference, enabledProfilerReference().
8606         * runtime/JSGlobalData.cpp:
8607         (JSC::JSGlobalData::JSGlobalData):
8608         * runtime/JSGlobalData.h:
8609         (JSC):
8610         (JSC::JSGlobalData::enabledProfiler):
8611         (JSGlobalData):
8612             - Added m_enabledProfiler, enabledProfiler().
8613         * runtime/JSGlobalObject.cpp:
8614         (JSC::JSGlobalObject::~JSGlobalObject):
8615
8616 2012-06-04  Filip Pizlo  <fpizlo@apple.com>
8617
8618         get_argument_by_val should be profiled everywhere
8619         https://bugs.webkit.org/show_bug.cgi?id=88205
8620
8621         Reviewed by Geoffrey Garen.
8622
8623         * jit/JITOpcodes32_64.cpp:
8624         (JSC::JIT::emitSlow_op_get_argument_by_val):
8625         * llint/LLIntSlowPaths.cpp:
8626         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
8627
8628 2012-06-04  Filip Pizlo  <fpizlo@apple.com>
8629
8630         DFG arguments simplification takes unkindly to direct accesses to the arguments register
8631         https://bugs.webkit.org/show_bug.cgi?id=88261
8632
8633         Reviewed by Geoffrey Garen.
8634
8635         Fixed arguments simplification for direct accesses to the arguments register, which may
8636         arise if CSE had not run. Fixed CSE so that it does run prior to arguments simplification,
8637         by making it a full-fledged member of the fixpoint. Fixed other issues in arguments
8638         simplification, like realizing that it needs to bail if there is a direct assignment to
8639         the arguments register, and failing to turn CreateArguments into PhantomArguments. Also
8640         fixed CSE's handling of store elimination of captured locals in the presence of a
8641         GetMyArgumentByVal (or one of its friends), and fixed CSE to correctly fixup variables at
8642         tail if the Flush it removes is the last operation on a local in a basic block.
8643
8644         * bytecode/CodeBlock.cpp:
8645         (JSC::CodeBlock::dump):
8646         * dfg/DFGArgumentsSimplificationPhase.cpp:
8647         (JSC::DFG::ArgumentsSimplificationPhase::run):
8648         (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
8649         * dfg/DFGCSEPhase.cpp:
8650         (JSC::DFG::CSEPhase::run):
8651         (JSC::DFG::CSEPhase::setLocalStoreElimination):
8652         (JSC::DFG::CSEPhase::performNodeCSE):
8653         (CSEPhase):
8654         * dfg/DFGDriver.cpp:
8655         (JSC::DFG::compile):
8656
8657 2012-06-04  Anders Carlsson  <andersca@apple.com>
8658
8659         Fix a struct/class mismatch.
8660
8661         * heap/Handle.h:
8662         (Handle):
8663
8664 2012-06-04  David Kilzer  <ddkilzer@apple.com>
8665
8666         BUILD FIX: FeatureDefines.xcconfig should match across projects
8667
8668         * Configurations/FeatureDefines.xcconfig:
8669         - Add missing ENABLE_LEGACY_CSS_VENDOR_PREFIXES.
8670
8671 2012-06-02  Geoffrey Garen  <ggaren@apple.com>
8672
8673         Weak pointer finalization should be lazy
8674         https://bugs.webkit.org/show_bug.cgi?id=87599
8675
8676         Reviewed by Sam Weinig.
8677
8678         This time for sure!
8679
8680         * heap/Heap.cpp:
8681         (JSC::Heap::collect): Don't sweep eagerly -- we'll sweep lazily instead.
8682
8683         * heap/MarkedBlock.cpp:
8684         (JSC::MarkedBlock::sweep): Sweep our weak set before we sweep our other
8685         destructors -- this is our last chance to run weak set finalizers before
8686         we recycle our memory.
8687
8688         * heap/MarkedBlock.h:
8689         (JSC::MarkedBlock::resetAllocator):
8690         * heap/MarkedSpace.cpp:
8691         (JSC::MarkedSpace::resetAllocators):
8692         * heap/MarkedSpace.h:
8693         (JSC::MarkedSpace::resetAllocators): Don't force allocator reset anymore.
8694         It will happen automatically when a weak set is swept. It's simpler to
8695         have only one canonical way for this to happen, and it wasn't buying
8696         us anything to do it eagerly.
8697
8698         * heap/WeakBlock.cpp:
8699         (JSC::WeakBlock::sweep): Don't short-circuit a sweep unless we know
8700         the sweep would be a no-op. If even one finalizer is pending, we need to
8701         run it, since we won't get another chance.
8702
8703         * heap/WeakSet.cpp:
8704         (JSC::WeakSet::sweep): This loop can be simpler now that
8705         WeakBlock::sweep() does what we mean.
8706
8707         Reset our allocator after a sweep because this is the optimal time to
8708         start trying to recycle old weak pointers.
8709
8710         (JSC::WeakSet::tryFindAllocator): Don't sweep when searching for an
8711         allocator because we've swept already, and forcing a new sweep would be
8712         wasteful.
8713
8714         * heap/WeakSet.h:
8715         (JSC::WeakSet::shrink): Be sure to reset our allocator after a shrink
8716         because the shrink may have removed the block the allocator was going to
8717         allocate out of.
8718
8719 2012-06-02  Filip Pizlo  <fpizlo@apple.com>
8720
8721         If the DFG bytecode parser detects that op_method_check has gone polymorphic, it
8722         shouldn't revert all the way to GetById/GetByIdFlush
8723         https://bugs.webkit.org/show_bug.cgi?id=88176
8724
8725         Reviewed by Geoffrey Garen.
8726
8727         Refactored the code so that the op_method_check case of the parser gracefully falls
8728         through to all of the goodness of the normal op_get_by_id case.
8729
8730         * dfg/DFGByteCodeParser.cpp:
8731         (ByteCodeParser):
8732         (JSC::DFG::ByteCodeParser::handleGetById):
8733         (DFG):
8734         (JSC::DFG::ByteCodeParser::parseBlock):
8735
8736 2012-06-02  Filip Pizlo  <fpizlo@apple.com>
8737
8738         DFG CSE should be able to eliminate unnecessary flushes of arguments and captured variables
8739         https://bugs.webkit.org/show_bug.cgi?id=87929
8740
8741         Reviewed by Geoffrey Garen.
8742
8743         Slight speed-up on V8. Big win (up to 50%) on programs that inline very small functions.
8744
8745         This required a bunch of changes:
8746
8747         - The obvious change is making CSE essentially ignore whether or not the set of
8748           operations between the Flush and the SetLocal can exit, and instead focus on whether or
8749           not that set of operations can clobber the world or access local variables. This code
8750           is now refactored to return a set of flags indicating any of these events, and the CSE
8751           decides what to do based on those flags. If the set of operations is non-clobbering
8752           and non-accessing, then the Flush is turned into a Phantom on the child of the
8753           SetLocal. This expands the liveness of the relevant variable but virtually guarantees
8754           that it will be register allocated and not flushed to the stack. So, yeah, this patch
8755           is a lot of work to save a few stores to the stack.
8756
8757         - Previously, CheckArgumentsNotCreated was optimized "lazily" in that you only knew if
8758           it was a no-op if you were holding onto a CFA abstract state. But this would make the
8759           CSE act pessimistically, since it doesn't use the CFA. Hence, this patch changes the
8760           constant folding phase into something more broad; it now fixes up
8761           CheckArgumentsNotCreated nodes by turning them into phantoms if it knows that they are
8762           no-ops.
8763
8764         - Arguments simplification was previously relying on this very strange PhantomArguments
8765           node, which had two different meanings: for normal execution it meant the empty value
8766           but for OSR exit it meant that the arguments should be reified. This produces problems
8767           when set SetLocals to the captured arguments registers are CSE'd away, since we'd be
8768           triggering reification of arguments without having initialized the arguments registers
8769           to empty. The cleanest solution was to fix PhantomArguments to have one meaning:
8770           namely, arguments reification on OSR exit. Hence, this patch changes arguments
8771           simplification to change SetLocal of CreateArguments on the arguments registers to be
8772           a SetLocal of Empty.
8773
8774         - Argument value recoveries were previously derived from the value source of the
8775           arguments at the InlineStart. But that relies on all SetLocals to arguments having
8776           been flushed. It's possible that we could have elided the SetLocal to the arguments
8777           at the callsite because there were subsequent SetLocals to the arguments inside of the
8778           callee, in which case the InlineStart would get the wrong information. Hence, this
8779           patch changes argument value recovery computation to operate over the ArgumentPositions
8780           directly.
8781
8782         - But that doesn't actually work, because previously, there was no way to link an
8783           InlineStart back to the corresponding ArgumentPositions, at least not without some
8784           ugliness. So this patch instates the rule that the m_argumentPositions vector consists
8785           of disjoint subsequences such that each subsequence corresponds to an inline callsite
8786           and can be identified by its first index, and within each subsequence are the
8787           ArgumentPositions of all of the arguments ordered by argument index. This required
8788           flipping the order in which ArgumentPositions are added to the vector, and giving
8789           InlineStart an operand that indicates the start of that inline callsite's
8790           ArgumentPosition subsequence.
8791
8792         - This patch also revealed a nasty bug in the reification of arguments in inline call
8793           frames on OSR exit. Since the reification was happening after the values of virtual
8794           registers were recovered, the value recoveries of the inline arguments were wrong.
8795           Hence using operationCreateInlinedArguments is wrong. For example a value recovery
8796           might say that you have to box a double, but if we had already boxed it then boxing
8797           it a second time will result in garbage. The specific case of this bug was this patch
8798           uncovered was that now it is possible for an inline call frame to not have any valid
8799           value recoveries for any inline arguments, if the optimization elides all argument
8800           flushes, while at the same time optimizing away arguments creation. Then OSR exit
8801           would try to recover the arguments using the inline call frame, which had bogus
8802           information, and humorous crashes would ensue. This patch fixes this issue by moving
8803           arguments reification to after call frame reification, so that arguments reification
8804           can always use operationCreateArguments instead of operationCreateInlinedArguments.
8805
8806         - This patch may turn a Flush into a Phantom. That's kind of the whole point. But that
8807           broke forward speculation checks, which knew to look for a Flush prior to a SetLocal
8808           but didn't know that there could alternatively be a Phantom in place of the Flush.
8809           This patch fixes that by augmenting the forward speculation check logic.
8810
8811         - Finally, in the process of having fun with all of the above, I realized that my DFG
8812           validation was not actually running on every phase like I had originally designed it
8813           to. In fact it was only running just after bytecode parsing. I initially tried to
8814           make it run in every phase but found that this causes some tests to timeout
8815           (specifically the evil fuzzing ones), so I decided on a compromise where: (i) in
8816           release mode validation never runs, (ii) in debug mode validation will run just
8817           after parsing and just before the backend, and (iii) it's possible with a simple
8818           switch to enable validation to run on every phase.
8819
8820         Luckily all of the above issues were already covered by the 77 or so DFG-specific
8821         layout tests. Hence, this patch does not introduce any new tests despite being so
8822         meaty.
8823
8824         * dfg/DFGAbstractState.cpp:
8825         (JSC::DFG::AbstractState::execute):
8826         * dfg/DFGArgumentPosition.h:
8827         (JSC::DFG::ArgumentPosition::prediction):
8828         (JSC::DFG::ArgumentPosition::doubleFormatState):
8829         (JSC::DFG::ArgumentPosition::shouldUseDoubleFormat):
8830         (ArgumentPosition):
8831         * dfg/DFGArgumentsSimplificationPhase.cpp:
8832         (JSC::DFG::ArgumentsSimplificationPhase::run):
8833         * dfg/DFGByteCodeParser.cpp:
8834         (JSC::DFG::ByteCodeParser::handleInlining):
8835         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
8836         * dfg/DFGCSEPhase.cpp:
8837         (JSC::DFG::CSEPhase::SetLocalStoreEliminationResult::SetLocalStoreEliminationResult):
8838         (SetLocalStoreEliminationResult):
8839         (JSC::DFG::CSEPhase::setLocalStoreElimination):
8840         (JSC::DFG::CSEPhase::performNodeCSE):
8841         * dfg/DFGCommon.h:
8842         * dfg/DFGConstantFoldingPhase.cpp:
8843         (JSC::DFG::ConstantFoldingPhase::run):
8844         * dfg/DFGDriver.cpp:
8845         (JSC::DFG::compile):
8846         * dfg/DFGNode.h:
8847         (Node):
8848         (JSC::DFG::Node::hasArgumentPositionStart):
8849         (JSC::DFG::Node::argumentPositionStart):
8850         * dfg/DFGOSRExitCompiler32_64.cpp:
8851         (JSC::DFG::OSRExitCompiler::compileExit):
8852         * dfg/DFGOSRExitCompiler64.cpp:
8853         (JSC::DFG::OSRExitCompiler::compileExit):
8854         * dfg/DFGPhase.cpp:
8855         (DFG):
8856         * dfg/DFGPhase.h:
8857         (Phase):
8858         * dfg/DFGSpeculativeJIT.cpp:
8859         (JSC::DFG::SpeculativeJIT::compile):
8860         * dfg/DFGSpeculativeJIT.h:
8861         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
8862         * dfg/DFGSpeculativeJIT32_64.cpp:
8863         (JSC::DFG::SpeculativeJIT::compile):
8864         * dfg/DFGSpeculativeJIT64.cpp:
8865         (JSC::DFG::SpeculativeJIT::compile):
8866
8867 2012-06-02  Geoffrey Garen  <ggaren@apple.com>
8868
8869         DOM string cache should hash pointers, not characters
8870         https://bugs.webkit.org/show_bug.cgi?id=88175
8871
8872         Reviewed by Phil Pizlo and Sam Weinig.
8873
8874         * heap/Weak.h:
8875         (JSC::weakAdd):
8876         (JSC::weakRemove): Made these function templates slightly more generic
8877         to accommodate new client types.
8878
8879 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8880
8881         DFG CFA should know that PutByVal can clobber the world
8882         https://bugs.webkit.org/show_bug.cgi?id=88155
8883
8884         Reviewed by Gavin Barraclough.
8885
8886         * dfg/DFGAbstractState.cpp:
8887         (JSC::DFG::AbstractState::execute):
8888
8889 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8890
8891         DFG CFA should mark basic blocks as having constants if local accesses yield constants
8892         https://bugs.webkit.org/show_bug.cgi?id=88153
8893
8894         Reviewed by Gavin Barraclough.
8895
8896         * dfg/DFGAbstractState.cpp:
8897         (JSC::DFG::AbstractState::execute):
8898
8899 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8900
8901         DFG arguments simplification phase uses a node.codeOrigin after appending a node
8902         https://bugs.webkit.org/show_bug.cgi?id=88151
8903
8904         Reviewed by Geoffrey Garen.
8905
8906         The right thing to do is to save the CodeOrigin before appending to the graph.
8907
8908         * dfg/DFGArgumentsSimplificationPhase.cpp:
8909         (JSC::DFG::ArgumentsSimplificationPhase::run):
8910
8911 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8912
8913         DFG should not emit unnecessary speculation checks when performing an int32 to double conversion on
8914         a value that is proved to be a number, predicted to be an int32, but not proved to be an int32
8915         https://bugs.webkit.org/show_bug.cgi?id=88146
8916
8917         Reviewed by Gavin Barraclough.
8918
8919         * dfg/DFGSpeculativeJIT.cpp:
8920         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
8921
8922 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8923
8924         DFG constant folding search for the last local access skips the immediately previous local access
8925         https://bugs.webkit.org/show_bug.cgi?id=88141
8926
8927         Reviewed by Michael Saboff.
8928
8929         If you use a loop in the style of:
8930
8931         for (i = start; i--;)
8932
8933         then you need to remember that the first value of 'i' that the loop body will see is 'start - 1'.
8934         Hence the following is probably wrong:
8935
8936         for (i = start - 1; i--;)
8937
8938         * dfg/DFGConstantFoldingPhase.cpp:
8939         (JSC::DFG::ConstantFoldingPhase::run):
8940
8941 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8942
8943         DFG constant folding should be OK with GetLocal of captured variables having a constant
8944         https://bugs.webkit.org/show_bug.cgi?id=88137
8945
8946         Reviewed by Gavin Barraclough.
8947
8948         * dfg/DFGConstantFoldingPhase.cpp:
8949         (JSC::DFG::ConstantFoldingPhase::run):
8950
8951 2012-05-31  Mark Hahnenberg  <mhahnenberg@apple.com>
8952
8953         JSGlobalObject does not mark m_privateNameStructure
8954         https://bugs.webkit.org/show_bug.cgi?id=88023
8955
8956         Rubber stamped by Gavin Barraclough.
8957
8958         * runtime/JSGlobalObject.cpp:
8959         (JSC::JSGlobalObject::visitChildren): We need to mark this so it doesn't get
8960         inadvertently garbage collected.
8961
8962 2012-05-31  Erik Arvidsson  <arv@chromium.org>
8963
8964         Make DOM Exceptions Errors
8965         https://bugs.webkit.org/show_bug.cgi?id=85078
8966
8967         Reviewed by Oliver Hunt.
8968
8969         WebIDL mandates that exceptions should have Error.prototype on its prototype chain.
8970
8971         For JSC we have access to the Error.prototype from the binding code.
8972
8973         For V8 we set a field in the WrapperTypeInfo and when the constructor function is created we
8974         set the prototype as needed.
8975
8976         Updated test: fast/dom/DOMException/prototype-object.html
8977
8978         * JavaScriptCore.xcodeproj/project.pbxproj:
8979         * runtime/JSGlobalObject.cpp:
8980         (JSC::JSGlobalObject::reset):
8981         * runtime/JSGlobalObject.h:
8982         (JSC):
8983         (JSGlobalObject):
8984         (JSC::JSGlobalObject::errorPrototype):
8985
8986 2012-05-31  Andy Wingo  <wingo@igalia.com>
8987
8988         Fix reference to unset variable in debug mode
8989         https://bugs.webkit.org/show_bug.cgi?id=87981
8990
8991         Reviewed by Geoffrey Garen.
8992
8993         * runtime/JSONObject.cpp (Stringifier::Holder::Holder):
8994         Initialize m_size in debug mode, as we check it later in an assert.
8995
8996 2012-05-30  Mark Hahnenberg  <mhahnenberg@apple.com>
8997
8998         Heap should sweep incrementally
8999         https://bugs.webkit.org/show_bug.cgi?id=85429
9000
9001         We shouldn't have to wait for the opportunistic GC timer to fire in order
9002         to call object destructors. Instead, we should incrementally sweep some
9003         subset of the blocks requiring sweeping periodically. We tie this sweeping
9004         to a timer rather than to collections because we want to reclaim this memory
9005         even if we stop allocating. This way, our memory usage scales smoothly with
9006         actual use, regardless of whether we've recently done an opportunistic GC or not.
9007
9008         Reviewed by Geoffrey Garen.
9009
9010         * CMakeLists.txt:
9011         * GNUmakefile.list.am:
9012         * JavaScriptCore.gypi:
9013         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
9014         * JavaScriptCore.xcodeproj/project.pbxproj:
9015         * Target.pri:
9016         * heap/Heap.cpp:
9017         (JSC::Heap::Heap):
9018         (JSC::Heap::collect): We no longer sweep during a full sweep. We only shrink now,
9019         which we will switch over to being done during incremental sweeping too as soon as
9020         all finalizers can be run lazily (and, by extension, incrementally).
9021         (JSC::Heap::sweeper):
9022         (JSC):
9023         * heap/Heap.h:
9024         (JSC):
9025         (Heap):
9026         * heap/IncrementalSweeper.cpp: Added.
9027         (JSC):
9028         (JSC::IncrementalSweeper::timerDidFire): The IncrementalSweeper works very similarly to
9029         GCActivityCallback. It is tied to a run-loop based timer that fires periodically based
9030         on how long the previous sweep increment took to run. The IncrementalSweeper doesn't do
9031         anything if the platform doesn't support CoreFoundation.
9032         (JSC::IncrementalSweeper::IncrementalSweeper):
9033         (JSC::IncrementalSweeper::~IncrementalSweeper):
9034         (JSC::IncrementalSweeper::create):
9035         (JSC::IncrementalSweeper::scheduleTimer):
9036         (JSC::IncrementalSweeper::cancelTimer):
9037         (JSC::IncrementalSweeper::doSweep): Iterates over the snapshot of the MarkedSpace taken
9038         during the last collection, checking to see which blocks need sweeping. If it successfully
9039         gets to the end of the blocks that need sweeping then it cancels the timer.
9040         (JSC::IncrementalSweeper::startSweeping): We take a snapshot of the Heap and store it in
9041         a Vector that the incremental sweep will iterate over. We also reset our index into this Vector.
9042         * heap/IncrementalSweeper.h: Added.
9043         (JSC):
9044         (IncrementalSweeper):
9045         * heap/MarkedBlock.h:
9046         (JSC::MarkedBlock::needsSweeping): If a block is in the Marked state it needs sweeping
9047         to be usable and to run any destructors that need to be run.
9048
9049 2012-05-30  Patrick Gansterer  <paroga@webkit.org>
9050
9051         [WINCE] Fix JSString after r115516.
9052         https://bugs.webkit.org/show_bug.cgi?id=87892
9053
9054         Reviewed by Geoffrey Garen.
9055
9056         r115516 splitted JSString into two classes, with addition nested classes.
9057         Add a workaround for the WinCE compiler since it can't resolve the friend class
9058         declerations corretly and denies the access to protected members of JSString.
9059
9060         * runtime/JSString.h:
9061         (JSC::JSRopeString::RopeBuilder::append):
9062         (JSC::JSRopeString::append):
9063         (JSRopeString):
9064
9065 2012-05-30  Oliver Hunt  <oliver@apple.com>
9066
9067         Really provide error information with the inspector disabled
9068         https://bugs.webkit.org/show_bug.cgi?id=87910
9069
9070         Reviewed by Filip Pizlo.
9071
9072         Don't bother checking for anything other than pre-existing error info.
9073         In the absence of complete line number information you'll only get the
9074         line a function starts on, but at least it's something.
9075
9076         * interpreter/Interpreter.cpp:
9077         (JSC::Interpreter::throwException):
9078
9079 2012-05-30  Filip Pizlo  <fpizlo@apple.com>
9080
9081         LLInt broken on x86-32 with JIT turned off
9082         https://bugs.webkit.org/show_bug.cgi?id=87906
9083
9084         Reviewed by Geoffrey Garen.
9085
9086         Fixed the code to not clobber registers that contain important things, like the call frame.
9087
9088         * llint/LowLevelInterpreter32_64.asm:
9089
9090 2012-05-30  Filip Pizlo  <fpizlo@apple.com>
9091
9092         ScriptDebugServer wants sourceIDs that are non-zero because that's what HashMaps want, so JSC should placate it
9093         https://bugs.webkit.org/show_bug.cgi?id=87887
9094
9095         Reviewed by Darin Adler.
9096
9097         Better fix - we now never call SourceProvider::asID() if SourceProvider* is 0.
9098
9099         * parser/Nodes.h:
9100         (JSC::ScopeNode::sourceID):
9101         * parser/SourceCode.h:
9102         (JSC::SourceCode::providerID):
9103         (SourceCode):
9104         * parser/SourceProvider.h:
9105         (SourceProvider):
9106         (JSC::SourceProvider::asID):
9107         * runtime/Executable.h:
9108         (JSC::ScriptExecutable::sourceID):
9109
9110 2012-05-30  Filip Pizlo  <fpizlo@apple.com>
9111
9112         ScriptDebugServer wants sourceIDs that are non-zero because that's what HashMaps want, so JSC should placate it
9113         https://bugs.webkit.org/show_bug.cgi?id=87887
9114
9115         Reviewed by Geoffrey Garen.
9116
9117         * parser/SourceProvider.h:
9118         (JSC::SourceProvider::asID):
9119
9120 2012-05-30  Oliver Hunt  <oliver@apple.com>
9121
9122         DFG does not correctly handle exceptions caught in the LLInt
9123         https://bugs.webkit.org/show_bug.cgi?id=87885
9124
9125         Reviewed by Filip Pizlo.
9126
9127         Make the DFG use genericThrow, rather than reimplementing a small portion of it.
9128         Also make the LLInt slow paths validate that their PC is correct.
9129
9130         * dfg/DFGOperations.cpp:
9131         * llint/LLIntSlowPaths.cpp:
9132         (LLInt):
9133
9134 2012-05-29  Filip Pizlo  <fpizlo@apple.com>
9135
9136         DFG CFA should infer types and values of captured variables
9137         https://bugs.webkit.org/show_bug.cgi?id=87813
9138
9139         Reviewed by Gavin Barraclough.
9140
9141         Slight speed-up in V8/earley-boyer (~1%).
9142
9143         * bytecode/CodeBlock.h:
9144         (JSC::CodeBlock::argumentsAreCaptured):
9145         (JSC::CodeBlock::argumentIsCaptured):
9146         (CodeBlock):
9147         * dfg/DFGAbstractState.cpp:
9148         (DFG):
9149         (JSC::DFG::AbstractState::beginBasicBlock):
9150         (JSC::DFG::AbstractState::initialize):
9151         (JSC::DFG::AbstractState::endBasicBlock):
9152         (JSC::DFG::AbstractState::execute):
9153         (JSC::DFG::AbstractState::clobberWorld):
9154         (JSC::DFG::AbstractState::clobberStructures):
9155         (JSC::DFG::AbstractState::mergeStateAtTail):
9156         (JSC::DFG::AbstractState::merge):
9157         (JSC::DFG::AbstractState::mergeToSuccessors):
9158         * dfg/DFGAbstractState.h:
9159         (JSC::DFG::AbstractState::variables):
9160         (AbstractState):
9161         * dfg/DFGSpeculativeJIT32_64.cpp:
9162         (JSC::DFG::SpeculativeJIT::compile):
9163         * dfg/DFGSpeculativeJIT64.cpp:
9164         (JSC::DFG::SpeculativeJIT::compile):
9165
9166 2012-05-30  Patrick Gansterer  <paroga@webkit.org>
9167
9168         Unreviewed. Build fix for !ENABLE(JIT) after r117823.
9169
9170         * bytecode/CodeBlock.cpp:
9171         (JSC::CodeBlock::dump):
9172
9173 2012-05-30  Sheriff Bot  <webkit.review.bot@gmail.com>
9174
9175         Unreviewed, rolling out r118868.
9176         http://trac.webkit.org/changeset/118868
9177         https://bugs.webkit.org/show_bug.cgi?id=87828
9178
9179         introduced ~20 crashes on Mac and Qt bots (Requested by pizlo_
9180         on #webkit).
9181
9182         * heap/Heap.cpp:
9183         (JSC::Heap::collect):
9184         * heap/MarkedBlock.cpp:
9185         (JSC::MarkedBlock::sweep):
9186         * heap/MarkedBlock.h:
9187         (JSC::MarkedBlock::sweepWeakSet):
9188         (JSC):
9189         * heap/MarkedSpace.cpp:
9190         (JSC::SweepWeakSet::operator()):
9191         (JSC):
9192         (JSC::MarkedSpace::sweepWeakSets):
9193         * heap/MarkedSpace.h:
9194         (MarkedSpace):
9195
9196 2012-05-29  Geoffrey Garen  <ggaren@apple.com>
9197
9198         Rolled back in r118646, now that
9199         https://bugs.webkit.org/show_bug.cgi?id=87784 is fixed.
9200
9201         http://trac.webkit.org/changeset/118646
9202         https://bugs.webkit.org/show_bug.cgi?id=87599
9203
9204         * heap/Heap.cpp:
9205         (JSC::Heap::collect):
9206         * heap/MarkedBlock.cpp:
9207         (JSC::MarkedBlock::sweep):
9208         * heap/MarkedBlock.h:
9209         (JSC):
9210         * heap/MarkedSpace.cpp:
9211         (JSC):
9212         * heap/MarkedSpace.h:
9213         (MarkedSpace):
9214
9215 2012-05-29  Filip Pizlo  <fpizlo@apple.com>
9216
9217         DFG should keep captured variables alive until the (inline) return.
9218         https://bugs.webkit.org/show_bug.cgi?id=87205
9219
9220         Reviewed by Gavin Barraclough.
9221
9222         Changes the way we do flushing for captured variables and arguments. Instead of flushing
9223         each SetLocal immediately, we flush at kill points. So a SetLocal will cause a Flush of
9224         whatever was live in the variable previously, and a return will cause a Flush of all
9225         captured variables and all arguments.
9226
9227         * dfg/DFGByteCodeParser.cpp:
9228         (JSC::DFG::ByteCodeParser::setDirect):
9229         (JSC::DFG::ByteCodeParser::set):
9230         (JSC::DFG::ByteCodeParser::setLocal):
9231         (JSC::DFG::ByteCodeParser::getArgument):
9232         (JSC::DFG::ByteCodeParser::setArgument):
9233         (JSC::DFG::ByteCodeParser::findArgumentPositionForArgument):
9234         (ByteCodeParser):
9235         (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
9236         (JSC::DFG::ByteCodeParser::findArgumentPosition):
9237         (JSC::DFG::ByteCodeParser::flush):
9238         (JSC::DFG::ByteCodeParser::flushDirect):
9239         (JSC::DFG::ByteCodeParser::flushArgumentsAndCapturedVariables):
9240         (JSC::DFG::ByteCodeParser::handleInlining):
9241         (JSC::DFG::ByteCodeParser::parseBlock):
9242         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
9243         * dfg/DFGCSEPhase.cpp:
9244         (JSC::DFG::CSEPhase::setLocalStoreElimination):
9245         (JSC::DFG::CSEPhase::performNodeCSE):
9246         * dfg/DFGSpeculativeJIT.cpp:
9247         (JSC::DFG::SpeculativeJIT::compile):
9248         * dfg/DFGSpeculativeJIT.h:
9249         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
9250
9251 2012-05-29  Geoffrey Garen  <ggaren@apple.com>
9252
9253         WeakGCMap should be lazy-finalization-safe
9254         https://bugs.webkit.org/show_bug.cgi?id=87784
9255
9256         Reviewed by Darin Adler.
9257
9258         * runtime/WeakGCMap.h:
9259         (JSC::WeakGCMap::get): Since this is a map of raw WeakImpl pointers, and
9260         not Weak<T>, we need to verify manually that the WeakImpl is live before
9261         we return its payload.
9262
9263 2012-05-29  Mark Hahnenberg  <mhahnenberg@apple.com>
9264
9265         CopiedSpace::doneCopying could start another collection
9266         https://bugs.webkit.org/show_bug.cgi?id=86538
9267
9268         Reviewed by Geoffrey Garen.
9269
9270         It's possible that if we don't have anything at the head of to-space
9271         after a collection and the BlockAllocator doesn't have any fresh blocks
9272         to give us right now we could start another collection while still in
9273         the middle of the first collection when we call CopiedSpace::addNewBlock().
9274
9275         One way to resolve this would be to have Heap::shouldCollect() check that
9276         m_operationInProgress is NoOperation. This would prevent the path in
9277         getFreshBlock() that starts the collection if we're already in the middle of one.
9278
9279         I could not come up with a test case to reproduce this crash on ToT.
9280
9281         * heap/Heap.h:
9282         (JSC::Heap::shouldCollect): We shouldn't collect if we're already in the middle
9283         of a collection, i.e. the current operation should be NoOperation.
9284
9285 2012-05-29  David Barr  <davidbarr@chromium.org>
9286
9287         Introduce ENABLE_CSS_IMAGE_RESOLUTION compile flag
9288         https://bugs.webkit.org/show_bug.cgi?id=87685
9289
9290         Reviewed by Eric Seidel.
9291
9292         Add a configuration option for CSS image-resolution support, disabling it by default.
9293
9294         * Configurations/FeatureDefines.xcconfig:
9295
9296 2012-05-28  Sheriff Bot  <webkit.review.bot@gmail.com>
9297
9298         Unreviewed, rolling out r118646.
9299         http://trac.webkit.org/changeset/118646
9300         https://bugs.webkit.org/show_bug.cgi?id=87691
9301
9302         broke V8 raytrace benchmark (Requested by pizlo_ on #webkit).
9303
9304         * heap/Heap.cpp:
9305         (JSC::Heap::collect):
9306         * heap/MarkedBlock.cpp:
9307         (JSC::MarkedBlock::sweep):
9308         * heap/MarkedBlock.h:
9309         (JSC::MarkedBlock::sweepWeakSet):
9310         (JSC):
9311         * heap/MarkedSpace.cpp:
9312         (JSC::SweepWeakSet::operator()):
9313         (JSC):
9314         (JSC::MarkedSpace::sweepWeakSets):
9315         * heap/MarkedSpace.h:
9316         (MarkedSpace):
9317
9318 2012-05-28  Filip Pizlo  <fpizlo@apple.com>
9319
9320         DFG should not generate code for code that the CFA proves to be unreachable
9321         https://bugs.webkit.org/show_bug.cgi?id=87682
9322
9323         Reviewed by Sam Weinig.
9324
9325         This also fixes a small performance bug where CFA was not marking blocks
9326         as having constants (and hence not triggering constant folding) if the only
9327         constants were on GetLocals.
9328
9329         And fixing that bug revealed another bug: constant folding was assuming that
9330         a GetLocal must be the first access to a local in a basic block. This isn't
9331         true. The first access may be a Flush. This patch fixes that issue using the
9332         safest approach possible, since we don't need to be clever for something that
9333         only happens in one of our benchmarks.
9334
9335         * dfg/DFGAbstractState.cpp:
9336         (JSC::DFG::AbstractState::execute):
9337         * dfg/DFGConstantFoldingPhase.cpp:
9338         (JSC::DFG::ConstantFoldingPhase::run):
9339         * dfg/DFGJITCompiler.h:
9340         (JSC::DFG::JITCompiler::noticeOSREntry):
9341         * dfg/DFGSpeculativeJIT.cpp:
9342         (JSC::DFG::SpeculativeJIT::compile):
9343
9344 2012-05-28  Carlos Garcia Campos  <cgarcia@igalia.com>
9345
9346         Unreviewed. Fix make distcheck.
9347
9348         * GNUmakefile.list.am: Add missing header file.
9349
9350 2012-05-27  Geoffrey Garen  <ggaren@apple.com>
9351
9352         Weak pointer finalization should be lazy
9353         https://bugs.webkit.org/show_bug.cgi?id=87599
9354
9355         Reviewed by Darin Adler.
9356
9357         * heap/Heap.cpp:
9358         (JSC::Heap::collect): Don't force immediate finalization -- it will
9359         happen lazily.
9360
9361         * heap/MarkedBlock.cpp:
9362         (JSC::MarkedBlock::sweep): Sweep a block's weak set when sweeping the
9363         block. The weak set may not have been swept yet, and this is our last
9364         chance to run weak finalizers before we recycle the memory they reference.
9365
9366         * heap/MarkedBlock.h:
9367         * heap/MarkedSpace.cpp:
9368         (JSC::MarkedBlock::sweepWeakSets):
9369         * heap/MarkedSpace.h:
9370         (JSC::MarkedSpace::sweepWeakSets): Nixed sweepWeakSets because it's unused
9371         now.
9372
9373 2012-05-26  Geoffrey Garen  <ggaren@apple.com>
9374
9375         WebKit should be lazy-finalization-safe (esp. the DOM) v2
9376         https://bugs.webkit.org/show_bug.cgi?id=87581
9377
9378         Reviewed by Oliver Hunt.
9379
9380         * heap/MarkedBlock.cpp:
9381         (JSC::MarkedBlock::callDestructor):
9382         * heap/WeakBlock.h:
9383         * heap/WeakSetInlines.h:
9384         (JSC::WeakBlock::finalize): Since we don't guarantee destruction order,
9385         it's not valid to access GC pointers like the Structure pointer during
9386         finalization. We NULL out the structure pointer in debug builds to try
9387         to make this programming mistake more obvious.
9388
9389         * API/JSCallbackConstructor.cpp:
9390         (JSC::JSCallbackConstructor::destroy):
9391         * API/JSCallbackObject.cpp:
9392         (JSC::::destroy):
9393         (JSC::JSCallbackObjectData::finalize):
9394         * runtime/Arguments.cpp:
9395         (JSC::Arguments::destroy):
9396         * runtime/DateInstance.cpp:
9397         (JSC::DateInstance::destroy):
9398         * runtime/Error.cpp:
9399         (JSC::StrictModeTypeErrorFunction::destroy):
9400         * runtime/Executable.cpp:
9401         (JSC::ExecutableBase::destroy):
9402         (JSC::NativeExecutable::destroy):
9403         (JSC::ScriptExecutable::destroy):
9404         (JSC::EvalExecutable::destroy):
9405         (JSC::ProgramExecutable::destroy):
9406         (JSC::FunctionExecutable::destroy):
9407         * runtime/JSGlobalObject.cpp:
9408         (JSC::JSGlobalObject::destroy):
9409         * runtime/JSPropertyNameIterator.cpp:
9410         (JSC::JSPropertyNameIterator::destroy):
9411         * runtime/JSStaticScopeObject.cpp:
9412         (JSC::JSStaticScopeObject::destroy):
9413         * runtime/JSString.cpp:
9414         (JSC::JSString::destroy):
9415         * runtime/JSVariableObject.cpp:
9416         (JSC::JSVariableObject::destroy):
9417         * runtime/NameInstance.cpp:
9418         (JSC::NameInstance::destroy):
9419         * runtime/RegExp.cpp:
9420         (JSC::RegExp::destroy):
9421         * runtime/RegExpConstructor.cpp:
9422         (JSC::RegExpConstructor::destroy):
9423         * runtime/Structure.cpp:
9424         (JSC::Structure::destroy):
9425         * runtime/StructureChain.cpp:
9426         (JSC::StructureChain::destroy): Use static_cast instead of jsCast because
9427         jsCast does Structure-based validation, and our Structure is not guaranteed
9428         to be alive when we get finalized.
9429
9430 2012-05-22  Filip Pizlo  <fpizlo@apple.com>
9431
9432         DFG CSE should eliminate redundant WeakJSConstants
9433         https://bugs.webkit.org/show_bug.cgi?id=87179
9434
9435         Reviewed by Gavin Barraclough.
9436
9437         Merged r118141 from dfgopt.
9438
9439         * dfg/DFGCSEPhase.cpp:
9440         (JSC::DFG::CSEPhase::weakConstantCSE):
9441         (CSEPhase):
9442         (JSC::DFG::CSEPhase::performNodeCSE):
9443         * dfg/DFGNode.h:
9444         (JSC::DFG::Node::weakConstant):
9445
9446 2012-05-22  Filip Pizlo  <fpizlo@apple.com>
9447
9448         DFG CSE should do redundant store elimination
9449         https://bugs.webkit.org/show_bug.cgi?id=87161
9450
9451         Reviewed by Oliver Hunt.
9452
9453         Merge r118138 from dfgopt.
9454
9455         This patch adds redundant store elimination. For example, consider this
9456         code:
9457
9458         o.x = 42;
9459         o.x = 84;
9460
9461         If o.x is speculated to be a well-behaved field, the first assignment is
9462         unnecessary, since the second just overwrites it. We would like to
9463         eliminate the first assignment in these cases. The need for this
9464         optimization arises mostly from stores that our runtime requires. For
9465         example:
9466
9467         o = {f:1, g:2, h:3};
9468
9469         This will have four assignments to the structure for the newly created
9470         object - one assignment for the empty structure, one for {f}, one for
9471         {f, g}, and one for {f, g, h}. We would like to only have the last of
9472         those assigments in this case.
9473
9474         Intriguingly, doing so for captured variables breaks the way arguments
9475         simplification used to work. Consider that prior to either arguments
9476         simplification or store elimination we will have IR that looks like:
9477
9478         a: SetLocal(r0, Empty)
9479         b: SetLocal(r1, Empty)
9480         c: GetLocal(r0)
9481         d: CreateArguments(@c)
9482         e: SetLocal(r0, @d)
9483         f: SetLocal(r1, @d)
9484
9485         Then redundant store elimination will eliminate the stores that
9486         initialize the arguments registers to Empty, but then arguments
9487         simplification eliminates the stores that initialize the arguments to
9488         the newly created arguments - and at this point we no longer have any
9489         stores to the arguments register, leading to hilarious crashes. This
9490         patch therefore changes arguments simplification to replace
9491         CreateArguments with JSConstant(Empty) rather than eliminating the
9492         SetLocals. But this revealed bugs where arguments simplification was
9493         being overzealous, so I fixed those bugs.
9494
9495         This is a minor speed-up on V8/early and a handful of other tests.
9496
9497         * bytecode/CodeBlock.h:
9498         (JSC::CodeBlock::uncheckedActivationRegister):
9499         * dfg/DFGAbstractState.cpp:
9500         (JSC::DFG::AbstractState::execute):
9501         * dfg/DFGArgumentsSimplificationPhase.cpp:
9502         (JSC::DFG::ArgumentsSimplificationPhase::run):
9503         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
9504         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
9505         (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
9506         * dfg/DFGCSEPhase.cpp:
9507         (JSC::DFG::CSEPhase::globalVarStoreElimination):
9508         (CSEPhase):
9509         (JSC::DFG::CSEPhase::putStructureStoreElimination):
9510         (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
9511         (JSC::DFG::CSEPhase::setLocalStoreElimination):
9512         (JSC::DFG::CSEPhase::setReplacement):
9513         (JSC::DFG::CSEPhase::eliminate):
9514         (JSC::DFG::CSEPhase::performNodeCSE):
9515         * dfg/DFGGraph.h:
9516         (JSC::DFG::Graph::uncheckedActivationRegisterFor):
9517         (Graph):
9518         * dfg/DFGNode.h:
9519         (JSC::DFG::Node::isPhantomArguments):
9520         (Node):
9521         (JSC::DFG::Node::hasConstant):
9522         (JSC::DFG::Node::valueOfJSConstant):
9523         (JSC::DFG::Node::hasStructureTransitionData):
9524         * dfg/DFGNodeType.h:
9525         (DFG):
9526         * dfg/DFGPredictionPropagationPhase.cpp:
9527         (JSC::DFG::PredictionPropagationPhase::propagate):
9528         * dfg/DFGSpeculativeJIT.cpp:
9529         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
9530         * dfg/DFGSpeculativeJIT32_64.cpp:
9531         (JSC::DFG::SpeculativeJIT::compile):
9532         * dfg/DFGSpeculativeJIT64.cpp:
9533         (JSC::DFG::SpeculativeJIT::compile):
9534
9535 2012-05-21  Filip Pizlo  <fpizlo@apple.com>
9536
9537         DFG ConvertThis should just be a CheckStructure if the structure is known
9538         https://bugs.webkit.org/show_bug.cgi?id=87057
9539
9540         Reviewed by Gavin Barraclough.
9541
9542         Merged r118021 from dfgopt.
9543
9544         This gives ValueProfile the ability to track singleton values - i.e. profiling
9545         sites that always see the same value.
9546
9547         That is then used to profile the structure in op_convert_this.
9548
9549         This is then used to optimize op_convert_this into a CheckStructure if the
9550         structure is always the same.
9551
9552         That then results in better CSE in inlined code that uses 'this', since
9553         previously we couldn't CSE accesses on 'this' from different inline call frames.
9554
9555         Also fixed a bug where we were unnecessarily flushing 'this'.
9556
9557         * bytecode/CodeBlock.cpp:
9558         (JSC::CodeBlock::dump):
9559         (JSC::CodeBlock::stronglyVisitStrongReferences):
9560         * bytecode/LazyOperandValueProfile.cpp:
9561         (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions):
9562         * bytecode/LazyOperandValueProfile.h:
9563         (CompressedLazyOperandValueProfileHolder):
9564         * bytecode/Opcode.h:
9565         (JSC):
9566         (JSC::padOpcodeName):
9567         * bytecode/ValueProfile.h:
9568         (JSC::ValueProfileBase::ValueProfileBase):
9569         (JSC::ValueProfileBase::dump):
9570         (JSC::ValueProfileBase::computeUpdatedPrediction):
9571         (ValueProfileBase):
9572         * bytecompiler/BytecodeGenerator.cpp:
9573         (JSC::BytecodeGenerator::BytecodeGenerator):
9574         * dfg/DFGByteCodeParser.cpp:
9575         (JSC::DFG::ByteCodeParser::setArgument):
9576         (JSC::DFG::ByteCodeParser::parseBlock):
9577         * jit/JITOpcodes.cpp:
9578         (JSC::JIT::emit_op_convert_this):
9579         (JSC::JIT::emitSlow_op_convert_this):
9580         * jit/JITOpcodes32_64.cpp:
9581         (JSC::JIT::emit_op_convert_this):
9582         (JSC::JIT::emitSlow_op_convert_this):
9583         * llint/LLIntSlowPaths.cpp:
9584         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
9585         * llint/LowLevelInterpreter32_64.asm:
9586         * llint/LowLevelInterpreter64.asm:
9587         * runtime/JSValue.h:
9588         (JSValue):
9589         * runtime/Structure.h:
9590         (JSC::JSValue::structureOrUndefined):
9591         (JSC):
9592
9593 2012-05-24  Tim Horton  <timothy_horton@apple.com>
9594
9595         Add feature defines for web-facing parts of CSS Regions and Exclusions
9596         https://bugs.webkit.org/show_bug.cgi?id=87442
9597         <rdar://problem/10887709>
9598
9599         Reviewed by Dan Bernstein.
9600
9601         * Configurations/FeatureDefines.xcconfig:
9602
9603 2012-05-24  Geoffrey Garen  <ggaren@apple.com>
9604
9605         WebKit should be lazy-finalization-safe (esp. the DOM)
9606         https://bugs.webkit.org/show_bug.cgi?id=87456
9607
9608         Reviewed by Filip Pizlo.
9609
9610         Lazy finalization adds one twist to weak pointer use:
9611
9612                 A HashMap of weak pointers may contain logically null entries.
9613                 (Weak pointers behave as-if null once their payloads die.)
9614                 Insertion must not assume that a pre-existing entry is
9615                 necessarily valid, and iteration must not assume that all
9616                 entries can be dereferenced.
9617
9618         (Previously, I thought that it also added a second twist:
9619
9620                 A demand-allocated weak pointer may replace a dead payload
9621                 before the payload's finalizer runs. In that case, when the
9622                 payload's finalizer runs, the payload has already been
9623                 overwritten, and the finalizer should not clear the payload,
9624                 which now points to something new.
9625
9626         But that's not the case here, since we cancel the old payload's
9627         finalizer when we over-write it. I've added ASSERTs to verify this
9628         assumption, in case it ever changes.)
9629
9630         * API/JSClassRef.cpp:
9631         (OpaqueJSClass::prototype): No need to specify null; that's the default.
9632
9633         * API/JSWeakObjectMapRefPrivate.cpp: Use remove, since take() is gone.
9634
9635         * heap/PassWeak.h:
9636         (WeakImplAccessor::was): This is no longer a debug-only function, since
9637         it's required to reason about lazily finalized pointers.
9638
9639         * heap/Weak.h:
9640         (JSC::weakAdd):
9641         (JSC::weakRemove):
9642         (JSC::weakClear): Added these helper functions for the common idioms of
9643         what clients want to do in their weak pointer finalizers.
9644
9645         * jit/JITStubs.cpp:
9646         (JSC::JITThunks::hostFunctionStub): Use the new idioms. Otherwise, we
9647         would return NULL for a "zombie" executable weak pointer that was waiting
9648         for finalization (item (2)), and finalizing a dead executable weak pointer
9649         would potentially destroy a new, live one (item (1)).
9650
9651         * runtime/RegExpCache.cpp:
9652         (JSC::RegExpCache::lookupOrCreate):
9653         (JSC::RegExpCache::finalize): Ditto.
9654
9655         (JSC::RegExpCache::invalidateCode): Check for null while iterating. (See
9656         item (2).)
9657
9658         * runtime/Structure.cpp:
9659         (JSC::StructureTransitionTable::contains):
9660         (JSC::StructureTransitionTable::add): Use get and set instead of add and
9661         contains, since add and contains are not compatible with lazy finalization.
9662
9663         * runtime/WeakGCMap.h:
9664         (WeakGCMap):
9665         (JSC::WeakGCMap::clear):
9666         (JSC::WeakGCMap::remove): Removed a bunch of code that was incompatible with
9667         lazy finalization because I didn't feel like making it compatible, and I had
9668         no way to test it.
9669
9670 2012-05-24  Filip Pizlo  <fpizlo@apple.com>
9671
9672         REGRESSION (r118013-r118031): Loops/Reloads under www.yahoo.com, quits after three tries with error
9673         https://bugs.webkit.org/show_bug.cgi?id=87327
9674
9675         Reviewed by Geoffrey Garen.
9676
9677         If you use AbstractValue::filter(StructureSet) to test subset relationships between TOP and a
9678         set containing >=2 elements, you're going to have a bad time.
9679
9680         That's because AbstractValue considers a set with >=2 elements to be equivalent to TOP, in order
9681         to save space and speed up convergence. So filtering has no effect in this case, which made
9682         the code think that the abstract value was proving that the structure check was unnecessary.
9683         The correct thing to do is to use isSubsetOf() on the StructureAbstractValue, which does the
9684         right thingies for TOP and >=2 elements.
9685
9686         * dfg/DFGAbstractState.cpp:
9687         (JSC::DFG::AbstractState::execute):
9688         * dfg/DFGSpeculativeJIT32_64.cpp:
9689         (JSC::DFG::SpeculativeJIT::compile):
9690         * dfg/DFGSpeculativeJIT64.cpp:
9691         (JSC::DFG::SpeculativeJIT::compile):
9692
9693 2012-05-24  Filip Pizlo  <fpizlo@apple.com>
9694
9695         new test fast/js/dfg-arguments-mixed-alias.html fails on JSVALUE32_64
9696         https://bugs.webkit.org/show_bug.cgi?id=87378
9697
9698         Reviewed by Gavin Barraclough.
9699
9700         - Captured variable tracking forgot did not consistently handle arguments, leading to OSR
9701           badness.
9702
9703         - Nodes capable of exiting were tracked in a non-monotonic way, leading to compiler errors.
9704
9705         * dfg/DFGByteCodeParser.cpp:
9706         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
9707         * dfg/DFGCSEPhase.cpp:
9708         (JSC::DFG::CSEPhase::CSEPhase):
9709         (CSEPhase):
9710         (JSC::DFG::performCSE):
9711         * dfg/DFGCSEPhase.h:
9712         (DFG):
9713         * dfg/DFGCommon.h:
9714         * dfg/DFGDriver.cpp:
9715         (JSC::DFG::compile):
9716         * dfg/DFGGraph.cpp:
9717         (JSC::DFG::Graph::resetExitStates):
9718         (DFG):
9719         * dfg/DFGGraph.h:
9720         (Graph):
9721         * dfg/DFGPhase.h:
9722         (DFG):
9723         (JSC::DFG::runPhase):
9724
9725 2012-05-24  Geoffrey Garen  <ggaren@apple.com>
9726
9727         Made WeakSet per-block instead of per-heap
9728         https://bugs.webkit.org/show_bug.cgi?id=87401
9729
9730         Reviewed by Oliver Hunt.
9731
9732         This allows us fast access to the set of all weak pointers for a block,
9733         which is a step toward lazy finalization.
9734
9735         No performance change.
9736
9737         * heap/Heap.cpp:
9738         (JSC::Heap::Heap):
9739         (JSC::Heap::lastChanceToFinalize): Removed the per-heap weak set, since
9740         it's per-block now.
9741
9742         (JSC::Heap::markRoots): Delegate weak set visiting to the marked space,
9743         since it knows how to iterate all blocks.
9744
9745         (JSC::Heap::collect): Moved the reaping outside of markRoots, since it
9746         doesn't mark anything.
9747
9748         Make sure to reset allocators after shrinking, since shrinking may
9749         deallocate the current allocator.
9750
9751         * heap/Heap.h:
9752         (Heap): No more per-heap weak set, since it's per-block now.
9753
9754         * heap/MarkedBlock.cpp:
9755         (JSC::MarkedBlock::MarkedBlock):
9756         * heap/MarkedBlock.h:
9757         (MarkedBlock):
9758         (JSC::MarkedBlock::lastChanceToFinalize): Migrated finalization logic
9759         here from the heap, so the heap doesn't need to know about our internal
9760         data structures like our weak set.
9761
9762         (JSC::MarkedBlock::heap):
9763         (JSC::MarkedBlock::weakSet):
9764         (JSC::MarkedBlock::shrink):
9765         (JSC::MarkedBlock::resetAllocator):
9766         (JSC::MarkedBlock::visitWeakSet):
9767         (JSC::MarkedBlock::reapWeakSet):
9768         (JSC::MarkedBlock::sweepWeakSet):
9769         * heap/MarkedSpace.cpp:
9770         (JSC::VisitWeakSet::VisitWeakSet):
9771         (JSC::VisitWeakSet::operator()):
9772         (VisitWeakSet):
9773         (JSC):
9774         (JSC::ReapWeakSet::operator()):
9775         (JSC::SweepWeakSet::operator()):
9776         (JSC::LastChanceToFinalize::operator()):
9777         (JSC::MarkedSpace::lastChanceToFinalize):
9778         (JSC::ResetAllocator::operator()):
9779         (JSC::MarkedSpace::resetAllocators):
9780         (JSC::MarkedSpace::visitWeakSets):
9781         (JSC::MarkedSpace::reapWeakSets):
9782         (JSC::MarkedSpace::sweepWeakSets):
9783         (JSC::Shrink::operator()):
9784         (JSC::MarkedSpace::shrink):
9785         * heap/MarkedSpace.h:
9786         (MarkedSpace): Make sure to account for our weak sets when sweeping,
9787         shrinking, etc.
9788
9789         * heap/WeakSet.cpp:
9790         (JSC):
9791         * heap/WeakSet.h:
9792         (WeakSet):
9793         (JSC::WeakSet::heap):
9794         (JSC):
9795         (JSC::WeakSet::lastChanceToFinalize):
9796         (JSC::WeakSet::visit):
9797         (JSC::WeakSet::reap):
9798         (JSC::WeakSet::shrink):
9799         (JSC::WeakSet::resetAllocator): Inlined some things since they're called
9800         once per block now instead of once per heap.
9801
9802         * heap/WeakSetInlines.h:
9803         (JSC::WeakSet::allocate): Use the per-block weak set since there is no
9804         per-heap weak set anymore.
9805
9806 2012-05-24  Gavin Barraclough  <barraclough@apple.com>
9807
9808         Fix arm build
9809
9810         Rubber stamped by Geoff Garen
9811
9812         * dfg/DFGGPRInfo.h:
9813         (GPRInfo):
9814
9815 2012-05-24  Gavin Barraclough  <barraclough@apple.com>
9816
9817         Move cacheFlush from ExecutableAllocator to Assembler classes
9818         https://bugs.webkit.org/show_bug.cgi?id=87420
9819
9820         Reviewed by Oliver Hunt.
9821
9822         Makes more sense there, & remove a pile of #ifdefs.
9823
9824         * assembler/ARMAssembler.cpp:
9825         (JSC):
9826         (JSC::ARMAssembler::cacheFlush):
9827         * assembler/ARMAssembler.h:
9828         (ARMAssembler):
9829         (JSC::ARMAssembler::cacheFlush):
9830         * assembler/ARMv7Assembler.h:
9831         (JSC::ARMv7Assembler::relinkJump):
9832         (JSC::ARMv7Assembler::cacheFlush):
9833         (ARMv7Assembler):
9834         (JSC::ARMv7Assembler::setInt32):
9835         (JSC::ARMv7Assembler::setUInt7ForLoad):
9836         * assembler/AbstractMacroAssembler.h:
9837         (JSC::AbstractMacroAssembler::cacheFlush):
9838         * assembler/LinkBuffer.h:
9839         (JSC::LinkBuffer::performFinalization):
9840         * assembler/MIPSAssembler.h:
9841         (JSC::MIPSAssembler::relinkJump):
9842         (JSC::MIPSAssembler::relinkCall):
9843         (JSC::MIPSAssembler::repatchInt32):
9844         (JSC::MIPSAssembler::cacheFlush):
9845         (MIPSAssembler):
9846         * assembler/SH4Assembler.h:
9847         (JSC::SH4Assembler::repatchCompact):
9848         (JSC::SH4Assembler::cacheFlush):
9849         (SH4Assembler):
9850         * assembler/X86Assembler.h:
9851         (X86Assembler):
9852         (JSC::X86Assembler::cacheFlush):
9853         * jit/ExecutableAllocator.cpp:
9854         (JSC):
9855         * jit/ExecutableAllocator.h:
9856         (ExecutableAllocator):
9857
9858 2012-05-24  John Mellor  <johnme@chromium.org>
9859
9860         Font Boosting: Add compile flag and runtime setting
9861         https://bugs.webkit.org/show_bug.cgi?id=87394
9862
9863         Reviewed by Adam Barth.
9864
9865         Add ENABLE_FONT_BOOSTING.
9866
9867         * Configurations/FeatureDefines.xcconfig:
9868
9869 2012-05-24  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
9870
9871         cti_vm_throw gets kicked out by gcc 4.6 -flto
9872         https://bugs.webkit.org/show_bug.cgi?id=56088
9873
9874         Reviewed by Darin Adler.
9875
9876         Add REFERENCED_FROM_ASM to functions only referenced from assembler.
9877
9878         * dfg/DFGOperations.cpp:
9879         * jit/HostCallReturnValue.h:
9880         * jit/JITStubs.h:
9881         * jit/ThunkGenerators.cpp:
9882
9883 2012-05-24  Filip Pizlo  <fpizlo@apple.com>
9884
9885         Incorrect merge of r117542 from dfg opt branch in r118323 is leading to fast/js/dfg-arguments-osr-exit.html failing
9886         https://bugs.webkit.org/show_bug.cgi?id=87350
9887
9888         Reviewed by Maciej Stachowiak.
9889
9890         The dfgopt branch introduced the notion of a local variable being killed because it was aliased
9891         to the Arguments object as in cases like:
9892
9893         var a = arguments;
9894         return a.length;
9895
9896         This required changes to OSR exit handling - if the variable is dead but aliased to arguments, then
9897         OSR exit should reify the arguments. But meanwhile, in tip of tree we introduced special handling for
9898         dead variables on OSR exit. When the two were merged in r118323, the structure of the if/else branches
9899         ended up being such that we would treat dead arguments variables as totally dead as opposed to treating
9900         them as variables that need arguments reification.
9901
9902         This fixes the structure of the relevant if/else block so that variables that are dead-but-arguments
9903         end up being treated as reified arguments objects, while variables that are dead but not aliased to
9904         arguments are treated as tip of tree would have treated them (initialize to Undefined).
9905
9906         * dfg/DFGSpeculativeJIT.cpp:
9907         (JSC::DFG::SpeculativeJIT::compile):
9908
9909 2012-05-24  Csaba Osztrogonác  <ossy@webkit.org>
9910
9911         Unreviewed 32 bit buildfix after r118325.
9912
9913         * dfg/DFGSpeculativeJIT32_64.cpp:
9914         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): Use ASSERT_UNUSED instead ASSERT.
9915
9916 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
9917
9918         DFG operationTearOffActivation should return after handling the null activation case
9919         https://bugs.webkit.org/show_bug.cgi?id=87348
9920         <rdar://problem/11522295>
9921
9922         Reviewed by Oliver Hunt.
9923
9924         * dfg/DFGOperations.cpp:
9925
9926 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
9927
9928         Unreviewed, merge the arguments fix in r118138 to get bots green.
9929
9930         * dfg/DFGArgumentsSimplificationPhase.cpp:
9931         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
9932
9933 2012-05-20  Filip Pizlo  <fpizlo@apple.com>
9934
9935         DFG CFA should record if a node can OSR exit
9936         https://bugs.webkit.org/show_bug.cgi?id=86905
9937
9938         Reviewed by Oliver Hunt.
9939
9940         Merged r117931 from dfgopt.
9941
9942         Adds a NodeFlag that denotes nodes that are known to not have OSR exits.
9943         This ought to aid any backwards analyses that need to know when a
9944         backward flow merge might happen due to a side exit.
9945
9946         Also added assertions into speculationCheck() that ensure that we did not
9947         mark a node as non-exiting and then promptly compile in an exit. This
9948         helped catch some minor bugs where we were doing unnecessary speculation
9949         checks.
9950
9951         This is a perf-neutral change. The speculation checks that this removes
9952         were not on hot paths of major benchmarks.
9953
9954         * bytecode/PredictedType.h:
9955         (JSC):
9956         (JSC::isAnyPrediction):
9957         * dfg/DFGAbstractState.cpp:
9958         (JSC::DFG::AbstractState::execute):
9959         * dfg/DFGAbstractState.h:
9960         (JSC::DFG::AbstractState::speculateInt32Unary):
9961         (AbstractState):
9962         (JSC::DFG::AbstractState::speculateNumberUnary):
9963         (JSC::DFG::AbstractState::speculateBooleanUnary):
9964         (JSC::DFG::AbstractState::speculateInt32Binary):
9965         (JSC::DFG::AbstractState::speculateNumberBinary):
9966         * dfg/DFGNode.h:
9967         (JSC::DFG::Node::mergeFlags):
9968         (JSC::DFG::Node::filterFlags):
9969         (Node):
9970         (JSC::DFG::Node::setCanExit):
9971         (JSC::DFG::Node::canExit):
9972         * dfg/DFGNodeFlags.cpp:
9973         (JSC::DFG::nodeFlagsAsString):
9974         * dfg/DFGNodeFlags.h:
9975         (DFG):
9976         * dfg/DFGSpeculativeJIT.cpp:
9977         (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
9978         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
9979         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
9980         * dfg/DFGSpeculativeJIT.h:
9981         (JSC::DFG::SpeculativeJIT::speculationCheck):
9982         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
9983         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
9984         (SpeculativeJIT):
9985         * dfg/DFGSpeculativeJIT32_64.cpp:
9986         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
9987         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
9988         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
9989         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
9990         (JSC::DFG::SpeculativeJIT::compile):
9991         * dfg/DFGSpeculativeJIT64.cpp:
9992         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
9993         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
9994         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
9995         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
9996         (JSC::DFG::SpeculativeJIT::compile):
9997
9998 2012-05-20  Filip Pizlo  <fpizlo@apple.com>
9999
10000         DFG should not do unnecessary indirections when storing to objects
10001         https://bugs.webkit.org/show_bug.cgi?id=86959
10002
10003         Reviewed by Oliver Hunt.
10004
10005         Merged r117819 from dfgopt.
10006
10007         * dfg/DFGByteCodeParser.cpp:
10008         (JSC::DFG::ByteCodeParser::parseBlock):
10009         * dfg/DFGCSEPhase.cpp:
10010         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
10011         * dfg/DFGSpeculativeJIT32_64.cpp:
10012         (JSC::DFG::SpeculativeJIT::compile):
10013         * dfg/DFGSpeculativeJIT64.cpp:
10014         (JSC::DFG::SpeculativeJIT::compile):
10015
10016 2012-05-17  Filip Pizlo  <fpizlo@apple.com>
10017
10018         DFG should optimize aliased uses of the Arguments object of the current call frame
10019         https://bugs.webkit.org/show_bug.cgi?id=86552
10020
10021         Reviewed by Geoff Garen.
10022
10023         Merged r117542 and r117543 from dfgopt.
10024
10025         Performs must-alias and escape analysis on uses of CreateArguments, and if
10026         a variable is must-aliased to CreateArguments and does not escape, then we
10027         turn all uses of that variable into direct arguments accesses.
10028
10029         36% speed-up on V8/earley leading to a 2.3% speed-up overall in V8.
10030
10031         * bytecode/CodeBlock.h:
10032         (JSC::CodeBlock::uncheckedArgumentsRegister):
10033         * bytecode/ValueRecovery.h:
10034         (JSC::ValueRecovery::argumentsThatWereNotCreated):
10035         (ValueRecovery):
10036         (JSC::ValueRecovery::dump):
10037         * dfg/DFGAbstractState.cpp:
10038         (JSC::DFG::AbstractState::execute):
10039         * dfg/DFGAdjacencyList.h:
10040         (AdjacencyList):
10041         (JSC::DFG::AdjacencyList::removeEdgeFromBag):
10042         * dfg/DFGArgumentsSimplificationPhase.cpp:
10043         (JSC::DFG::ArgumentsSimplificationPhase::run):
10044         (ArgumentsSimplificationPhase):
10045         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
10046         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
10047         (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
10048         (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
10049         (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
10050         * dfg/DFGAssemblyHelpers.h:
10051         (JSC::DFG::AssemblyHelpers::argumentsRegisterFor):
10052         (AssemblyHelpers):
10053         * dfg/DFGByteCodeParser.cpp:
10054         (JSC::DFG::ByteCodeParser::parseBlock):
10055         * dfg/DFGCFGSimplificationPhase.cpp:
10056         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
10057         * dfg/DFGGPRInfo.h:
10058         (GPRInfo):
10059         * dfg/DFGGraph.cpp:
10060         (JSC::DFG::Graph::collectGarbage):
10061         (DFG):
10062         * dfg/DFGGraph.h:
10063         (Graph):
10064         (JSC::DFG::Graph::executableFor):
10065         (JSC::DFG::Graph::argumentsRegisterFor):
10066         (JSC::DFG::Graph::uncheckedArgumentsRegisterFor):
10067         (JSC::DFG::Graph::clobbersWorld):
10068         * dfg/DFGNode.h:
10069         (JSC::DFG::Node::hasHeapPrediction):
10070         * dfg/DFGNodeType.h:
10071         (DFG):
10072         * dfg/DFGOSRExitCompiler.cpp:
10073         * dfg/DFGOSRExitCompiler.h:
10074         (JSC::DFG::OSRExitCompiler::OSRExitCompiler):
10075         (OSRExitCompiler):
10076         * dfg/DFGOSRExitCompiler32_64.cpp:
10077         (JSC::DFG::OSRExitCompiler::compileExit):
10078         * dfg/DFGOSRExitCompiler64.cpp:
10079         (JSC::DFG::OSRExitCompiler::compileExit):
10080         * dfg/DFGOperations.cpp:
10081         * dfg/DFGPredictionPropagationPhase.cpp:
10082         (JSC::DFG::PredictionPropagationPhase::propagate):
10083         * dfg/DFGSpeculativeJIT.cpp:
10084         (JSC::DFG::ValueSource::dump):
10085         (JSC::DFG::SpeculativeJIT::compile):
10086         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
10087         * dfg/DFGSpeculativeJIT.h:
10088         * dfg/DFGSpeculativeJIT32_64.cpp:
10089         (JSC::DFG::SpeculativeJIT::compile):
10090         * dfg/DFGSpeculativeJIT64.cpp:
10091         (JSC::DFG::SpeculativeJIT::compile):
10092         * dfg/DFGVariableAccessData.h:
10093         (JSC::DFG::VariableAccessData::VariableAccessData):
10094         (JSC::DFG::VariableAccessData::mergeIsArgumentsAlias):
10095         (VariableAccessData):
10096         (JSC::DFG::VariableAccessData::isArgumentsAlias):
10097         * jit/JITOpcodes.cpp:
10098         (JSC::JIT::emitSlow_op_get_argument_by_val):
10099
10100 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10101
10102         DFGCapabilities should not try to get an arguments register from code blocks that don't have one
10103         https://bugs.webkit.org/show_bug.cgi?id=87332
10104
10105         Reviewed by Andy Estes.
10106
10107         * dfg/DFGCapabilities.h:
10108         (JSC::DFG::canInlineOpcode):
10109
10110 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10111
10112         DFG should have sparse conditional constant propagation
10113         https://bugs.webkit.org/show_bug.cgi?id=86580
10114
10115         Reviewed by Oliver Hunt.
10116
10117         Merged r117370 from dfgopt.
10118
10119         This enhances CFA so that if it suspects at any point during the fixpoint that a
10120         branch will only go one way, then it only propagates in that one way.
10121
10122         This vastly increases the opportunities for CFG simplification. For example, it
10123         enables us to evaporate this loop:
10124
10125         for (var i = 0; i < 1; ++i) doThings(i);
10126
10127         As a result, it uncovered loads of bugs in the CFG simplifier. In particular:
10128
10129         - Phi fixup was assuming that all Phis worth fixing up are shouldGenerate().
10130           That's not true; we also fixup Phis that are dead.
10131
10132         - GetLocal fixup was assuming that it's only necessary to rewire links to a
10133           GetLocal, and that the GetLocal's own links don't need to be rewired. Untrue,
10134           because the GetLocal may not be rewirable (first block has no GetLocal for r42
10135           but second block does have a GetLocal), in which case it will refer to a Phi
10136           in the second block. We need it to refer to a Phi from the first block to
10137           ensure that subsequent transformations work.
10138
10139         - Tail operand fixup was ignoring the fact that Phis in successors may contain
10140           references to the children of our tail variables. Hence, successor Phi child
10141           substitution needs to use the original second block variable table as its
10142           prior, rather than trying to reconstruct the prior later (since by that point
10143           the children of the second block's tail variables will have been fixed up, so
10144           we will not know what the prior would have been).
10145
10146         * dfg/DFGAbstractState.cpp:
10147         (JSC::DFG::AbstractState::beginBasicBlock):
10148         (JSC::DFG::AbstractState::endBasicBlock):
10149         (JSC::DFG::AbstractState::reset):
10150         (JSC::DFG::AbstractState::execute):
10151         (JSC::DFG::AbstractState::mergeToSuccessors):
10152         * dfg/DFGAbstractState.h:
10153         (JSC::DFG::AbstractState::branchDirectionToString):
10154         (AbstractState):
10155         * dfg/DFGCFGSimplificationPhase.cpp:
10156         (JSC::DFG::CFGSimplificationPhase::run):
10157         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
10158         (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::OperandSubstitution):
10159         (OperandSubstitution):
10160         (JSC::DFG::CFGSimplificationPhase::skipGetLocal):
10161         (JSC::DFG::CFGSimplificationPhase::recordPossibleIncomingReference):
10162         (CFGSimplificationPhase):
10163         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
10164         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
10165         * dfg/DFGGraph.h:
10166         (JSC::DFG::Graph::changeEdge):
10167
10168 2012-05-23  Ojan Vafai  <ojan@chromium.org>
10169
10170         add back the ability to disable flexbox
10171         https://bugs.webkit.org/show_bug.cgi?id=87147
10172
10173         Reviewed by Tony Chang.
10174
10175         * Configurations/FeatureDefines.xcconfig:
10176
10177 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10178
10179         Unreviewed, fix Windows build.
10180
10181         * bytecode/CodeBlock.h:
10182         * dfg/DFGCapabilities.h:
10183         (JSC::DFG::canCompileOpcode):
10184         (JSC::DFG::canCompileOpcodes):
10185         * dfg/DFGCommon.h:
10186         (DFG):
10187
10188 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10189
10190         DFG should optimize inlined uses of arguments.length and arguments[i]
10191         https://bugs.webkit.org/show_bug.cgi?id=86327
10192
10193         Reviewed by Gavin Barraclough.
10194
10195         Merged r117017 from dfgopt.
10196
10197         Turns inlined uses of arguments.length into a constant.
10198
10199         Turns inlined uses of arguments[constant] into a direct reference to the
10200         argument.
10201
10202         Big win on micro-benchmarks. Not yet a win on V8 because the hot uses of
10203         arguments.length and arguments[i] are aliased. I'll leave the aliasing
10204         optimizations to a later patch.
10205
10206         * CMakeLists.txt:
10207         * GNUmakefile.list.am:
10208         * JavaScriptCore.xcodeproj/project.pbxproj:
10209         * Target.pri:
10210         * bytecode/DFGExitProfile.h:
10211         (FrequentExitSite):
10212         (JSC::DFG::FrequentExitSite::FrequentExitSite):
10213         (JSC::DFG::QueryableExitProfile::hasExitSite):
10214         (QueryableExitProfile):
10215         * dfg/DFGAbstractState.cpp:
10216         (JSC::DFG::AbstractState::execute):
10217         * dfg/DFGArgumentsSimplificationPhase.cpp: Added.
10218         (DFG):
10219         (ArgumentsSimplificationPhase):
10220         (JSC::DFG::ArgumentsSimplificationPhase::ArgumentsSimplificationPhase):
10221         (JSC::DFG::ArgumentsSimplificationPhase::run):
10222         (JSC::DFG::performArgumentsSimplification):
10223         * dfg/DFGArgumentsSimplificationPhase.h: Added.
10224         (DFG):
10225         * dfg/DFGAssemblyHelpers.cpp:
10226         (JSC::DFG::AssemblyHelpers::executableFor):
10227         (DFG):
10228         * dfg/DFGAssemblyHelpers.h:
10229         (AssemblyHelpers):
10230         * dfg/DFGByteCodeParser.cpp:
10231         (JSC::DFG::ByteCodeParser::parseBlock):
10232         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
10233         * dfg/DFGCSEPhase.cpp:
10234         (JSC::DFG::CSEPhase::getLocalLoadElimination):
10235         (JSC::DFG::CSEPhase::performNodeCSE):
10236         * dfg/DFGDriver.cpp:
10237         (JSC::DFG::compile):
10238         * dfg/DFGGraph.h:
10239         (JSC::DFG::Graph::Graph):
10240         (JSC::DFG::Graph::executableFor):
10241         (Graph):
10242         (JSC::DFG::Graph::clobbersWorld):
10243         * dfg/DFGNode.h:
10244         (JSC::DFG::Node::convertToConstant):
10245         (JSC::DFG::Node::convertToGetLocalUnlinked):
10246         (Node):
10247         (JSC::DFG::Node::unlinkedLocal):
10248         * dfg/DFGNodeType.h:
10249         (DFG):
10250         * dfg/DFGOSRExit.cpp:
10251         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
10252         * dfg/DFGPredictionPropagationPhase.cpp:
10253         (JSC::DFG::PredictionPropagationPhase::propagate):
10254         * dfg/DFGSpeculativeJIT32_64.cpp:
10255         (JSC::DFG::SpeculativeJIT::compile):
10256         * dfg/DFGSpeculativeJIT64.cpp:
10257         (JSC::DFG::SpeculativeJIT::compile):
10258
10259 2012-05-13  Filip Pizlo  <fpizlo@apple.com>
10260
10261         DFG should be able to optimize foo.apply(bar, arguments)
10262         https://bugs.webkit.org/show_bug.cgi?id=86306
10263
10264         Reviewed by Gavin Barraclough.
10265
10266         Merge r116912 from dfgopt.
10267
10268         Enables compilation of op_jneq_ptr and some forms of op_call_varargs.
10269
10270         Also includes a bunch of bug fixes that were made necessary by the increased
10271         pressure on the CFG simplifier.
10272
10273         This is a 1-2% win on V8.
10274
10275         * bytecode/CodeBlock.cpp:
10276         (JSC::CodeBlock::printCallOp):
10277         (JSC::CodeBlock::CodeBlock):
10278         (JSC::ProgramCodeBlock::canCompileWithDFGInternal):
10279         (JSC::EvalCodeBlock::canCompileWithDFGInternal):
10280         (JSC::FunctionCodeBlock::canCompileWithDFGInternal):
10281         * bytecode/CodeBlock.h:
10282         (CodeBlock):
10283         (JSC::CodeBlock::canCompileWithDFG):
10284         (JSC::CodeBlock::canCompileWithDFGState):
10285         (ProgramCodeBlock):
10286         (EvalCodeBlock):
10287         (FunctionCodeBlock):
10288         * dfg/DFGAbstractState.cpp:
10289         (JSC::DFG::AbstractState::execute):
10290         * dfg/DFGByteCodeParser.cpp:
10291         (JSC::DFG::ByteCodeParser::parseBlock):
10292         (JSC::DFG::ByteCodeParser::processPhiStack):
10293         (JSC::DFG::ByteCodeParser::parse):
10294         * dfg/DFGCFGSimplificationPhase.cpp:
10295         (JSC::DFG::CFGSimplificationPhase::run):
10296         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
10297         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
10298         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
10299         * dfg/DFGCSEPhase.cpp:
10300         (JSC::DFG::CSEPhase::getLocalLoadElimination):
10301         (CSEPhase):
10302         (JSC::DFG::CSEPhase::setReplacement):
10303         (JSC::DFG::CSEPhase::performNodeCSE):
10304         * dfg/DFGCapabilities.cpp:
10305         (JSC::DFG::debugFail):
10306         (DFG):
10307         (JSC::DFG::canHandleOpcodes):
10308         (JSC::DFG::canCompileOpcodes):
10309         (JSC::DFG::canInlineOpcodes):
10310         * dfg/DFGCapabilities.h:
10311         (JSC::DFG::canCompileOpcode):
10312         (JSC::DFG::canInlineOpcode):
10313         (DFG):
10314         (JSC::DFG::canCompileOpcodes):
10315         (JSC::DFG::canCompileEval):
10316         (JSC::DFG::canCompileProgram):
10317         (JSC::DFG::canCompileFunctionForCall):
10318         (JSC::DFG::canCompileFunctionForConstruct):
10319         * dfg/DFGCommon.h:
10320         * dfg/DFGGraph.cpp:
10321         (JSC::DFG::Graph::dump):
10322         * dfg/DFGNodeType.h:
10323         (DFG):
10324         * dfg/DFGPredictionPropagationPhase.cpp:
10325         (JSC::DFG::PredictionPropagationPhase::propagate):
10326         * dfg/DFGSpeculativeJIT32_64.cpp:
10327         (JSC::DFG::SpeculativeJIT::compile):
10328         * dfg/DFGSpeculativeJIT64.cpp:
10329         (JSC::DFG::SpeculativeJIT::emitCall):
10330         (JSC::DFG::SpeculativeJIT::compile):
10331         * dfg/DFGValidate.cpp:
10332         (Validate):
10333         (JSC::DFG::Validate::validate):
10334         (JSC::DFG::Validate::checkOperand):
10335         (JSC::DFG::Validate::reportValidationContext):
10336         * jit/JIT.cpp:
10337         (JSC::JIT::emitOptimizationCheck):
10338         (JSC::JIT::privateCompileSlowCases):
10339         (JSC::JIT::privateCompile):
10340         * jit/JIT.h:
10341         * jit/JITArithmetic.cpp:
10342         (JSC::JIT::compileBinaryArithOp):
10343         * jit/JITPropertyAccess.cpp:
10344         (JSC::JIT::privateCompilePutByIdTransition):
10345         * jit/JITPropertyAccess32_64.cpp:
10346         (JSC::JIT::privateCompilePutByIdTransition):
10347         * tools/CodeProfile.cpp:
10348         (JSC::CodeProfile::sample):
10349
10350 2012-05-23  Geoffrey Garen  <ggaren@apple.com>
10351
10352         Refactored WeakBlock to use malloc, clarify behavior
10353         https://bugs.webkit.org/show_bug.cgi?id=87318
10354
10355         Reviewed by Filip Pizlo.
10356
10357         We want to use malloc so we can make these smaller than 4KB,
10358         since an individual MarkedBlock will usually have fewer than
10359         4KB worth of weak pointers.
10360
10361         * heap/Heap.cpp:
10362         (JSC::Heap::markRoots): Renamed visitLiveWeakImpls to visit, since
10363         we no longer need to distinguish from "visitDeadWeakImpls".
10364
10365         Renamed "visitDeadWeakImpls" to "reap" because we're not actually
10366         doing any visiting -- we're just tagging things as dead.
10367
10368         * heap/WeakBlock.cpp:
10369         (JSC::WeakBlock::create):
10370         (JSC::WeakBlock::destroy):
10371         (JSC::WeakBlock::WeakBlock): Malloc!
10372
10373         (JSC::WeakBlock::visit):
10374         (JSC::WeakBlock::reap): Renamed as above.
10375
10376         * heap/WeakBlock.h:
10377         (WeakBlock): Reduced to 3KB, as explained above.
10378
10379         * heap/WeakSet.cpp:
10380         (JSC::WeakSet::visit):
10381         (JSC::WeakSet::reap):
10382         * heap/WeakSet.h:
10383         (WeakSet): Updated for renames, and to match WebKit style.
10384
10385 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10386
10387         Use after free in JSC::DFG::ByteCodeParser::processPhiStack
10388         https://bugs.webkit.org/show_bug.cgi?id=87312
10389         <rdar://problem/11518848>
10390
10391         Reviewed by Oliver Hunt.
10392
10393         * dfg/DFGByteCodeParser.cpp:
10394         (JSC::DFG::ByteCodeParser::processPhiStack):
10395         (JSC::DFG::ByteCodeParser::parse):
10396
10397 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10398
10399         It should be possible to make C function calls from DFG code on ARM in debug mode
10400         https://bugs.webkit.org/show_bug.cgi?id=87313
10401
10402         Reviewed by Gavin Barraclough.
10403
10404         * dfg/DFGSpeculativeJIT.h:
10405         (SpeculativeJIT):
10406
10407 2012-05-11  Filip Pizlo  <fpizlo@apple.com>
10408
10409         DFG should be able to inline functions that use arguments reflectively
10410         https://bugs.webkit.org/show_bug.cgi?id=86132
10411
10412         Reviewed by Oliver Hunt.
10413
10414         Merged r116838 from dfgopt.
10415
10416         This turns on inlining of functions that use arguments reflectively, but it
10417         does not do any of the obvious optimizations that this exposes. I'll save that
10418         for another patch - the important thing for now is that this contains all of
10419         the plumbing necessary to make this kind of inlining sound even in bizarro
10420         cases like an inline callee escaping the arguments object to parts of the
10421         inline caller where the arguments are otherwise dead. Or even more fun cases
10422         like where you've inlined to an inline stack that is three-deep, and the
10423         function on top of the inline stack reflectively accesses the arguments of a
10424         function that is in the middle of the inline stack. Any subsequent
10425         optimizations that we do for the obvious cases of arguments usage in inline
10426         functions will have to take care not to break the baseline functionality that
10427         this patch plumbs together.
10428
10429         * bytecode/CodeBlock.cpp:
10430         (JSC::CodeBlock::printCallOp):
10431         (JSC::CodeBlock::dump):
10432         * bytecode/CodeBlock.h:
10433         * dfg/DFGAssemblyHelpers.h:
10434         (JSC::DFG::AssemblyHelpers::argumentsRegisterFor):
10435         (AssemblyHelpers):
10436         * dfg/DFGByteCodeParser.cpp:
10437         (InlineStackEntry):
10438         (JSC::DFG::ByteCodeParser::handleCall):
10439         (JSC::DFG::ByteCodeParser::handleInlining):
10440         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
10441         (JSC::DFG::ByteCodeParser::parse):
10442         * dfg/DFGCCallHelpers.h:
10443         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
10444         (CCallHelpers):
10445         * dfg/DFGCapabilities.h:
10446         (JSC::DFG::canInlineOpcode):
10447         * dfg/DFGDriver.cpp:
10448         (JSC::DFG::compile):
10449         * dfg/DFGFixupPhase.cpp:
10450         (JSC::DFG::FixupPhase::fixupNode):
10451         * dfg/DFGOperations.cpp:
10452         * dfg/DFGOperations.h:
10453         * dfg/DFGSpeculativeJIT.h:
10454         (JSC::DFG::SpeculativeJIT::callOperation):
10455         * dfg/DFGSpeculativeJIT32_64.cpp:
10456         (JSC::DFG::SpeculativeJIT::compile):
10457         * dfg/DFGSpeculativeJIT64.cpp:
10458         (JSC::DFG::SpeculativeJIT::compile):
10459         * interpreter/CallFrame.cpp:
10460         (JSC):
10461         (JSC::CallFrame::someCodeBlockForPossiblyInlinedCode):
10462         * interpreter/CallFrame.h:
10463         (ExecState):
10464         (JSC::ExecState::someCodeBlockForPossiblyInlinedCode):
10465         * interpreter/Interpreter.cpp:
10466         (JSC::Interpreter::retrieveArgumentsFromVMCode):
10467         * runtime/Arguments.cpp:
10468         (JSC::Arguments::tearOff):
10469         (JSC):
10470         (JSC::Arguments::tearOffForInlineCallFrame):
10471         * runtime/Arguments.h:
10472         (Arguments):
10473         (JSC::Arguments::create):
10474         (JSC::Arguments::finishCreation):
10475         (JSC):
10476
10477 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10478
10479         Every OSR exit on ARM results in a crash
10480         https://bugs.webkit.org/show_bug.cgi?id=87307
10481
10482         Reviewed by Geoffrey Garen.
10483
10484         * dfg/DFGThunks.cpp:
10485         (JSC::DFG::osrExitGenerationThunkGenerator):
10486
10487 2012-05-23  Geoffrey Garen  <ggaren@apple.com>
10488
10489         Refactored heap tear-down to use normal value semantics (i.e., destructors)
10490         https://bugs.webkit.org/show_bug.cgi?id=87302
10491
10492         Reviewed by Oliver Hunt.
10493
10494         This is a step toward incremental DOM finalization.
10495
10496         * heap/CopiedSpace.cpp:
10497         (JSC::CopiedSpace::~CopiedSpace):
10498         * heap/CopiedSpace.h:
10499         (CopiedSpace): Just use our destructor, instead of relying on the heap
10500         to send us a special message at a special time.
10501
10502         * heap/Heap.cpp:
10503         (JSC::Heap::Heap): Use OwnPtr for m_markListSet because this is not Sparta.
10504
10505         (JSC::Heap::~Heap): No need for delete or freeAllBlocks because normal
10506         destructors do this work automatically now.
10507
10508         (JSC::Heap::lastChanceToFinalize): Just call lastChanceToFinalize on our
10509         sub-objects, and assume it does the right thing. This improves encapsulation,
10510         so we can add items requiring finalization to our sub-objects.
10511
10512         * heap/Heap.h: Moved m_blockAllocator to get the right destruction order.
10513
10514         * heap/MarkedSpace.cpp:
10515         (Take):
10516         (JSC):
10517         (JSC::Take::Take):
10518         (JSC::Take::operator()):
10519         (JSC::Take::returnValue): Moved to the top of the file so it can be used
10520         in another function.
10521
10522         (JSC::MarkedSpace::~MarkedSpace): Delete all outstanding memory, like a good
10523         destructor should.
10524
10525         (JSC::MarkedSpace::lastChanceToFinalize): Moved some code here from the heap,
10526         since it pertains to our internal implementation details.
10527
10528         * heap/MarkedSpace.h:
10529         (MarkedSpace):
10530         * heap/WeakBlock.cpp:
10531         (JSC::WeakBlock::lastChanceToFinalize):
10532         * heap/WeakBlock.h:
10533         (WeakBlock):
10534         * heap/WeakSet.cpp:
10535         (JSC::WeakSet::lastChanceToFinalize):
10536         * heap/WeakSet.h:
10537         (WeakSet): Stop using a special freeAllBlocks() callback and just implement
10538         lastChanceToFinalize.
10539
10540 2011-05-22  Geoffrey Garen  <ggaren@apple.com>
10541
10542         Encapsulated some calculations for whether portions of the heap are empty
10543         https://bugs.webkit.org/show_bug.cgi?id=87210
10544
10545         Reviewed by Gavin Barraclough.
10546
10547         This is a step toward incremental DOM finalization.
10548
10549         * heap/Heap.cpp:
10550         (JSC::Heap::~Heap): Explicitly call freeAllBlocks() instead of relying
10551         implicitly on all blocks thinking they're empty. In future, we may
10552         choose to tear down the heap without first setting all data structures
10553         to "empty".
10554
10555         * heap/MarkedBlock.h:
10556         (JSC::MarkedBlock::isEmpty):
10557         (JSC::MarkedBlock::gatherDirtyCells): Renamed markCountIsZero to isEmpty,
10558         in preparation for making it check for outstanding finalizers in addition
10559         to marked cells.
10560
10561         * heap/MarkedSpace.cpp:
10562         (Take):
10563         (JSC::Take::Take):
10564         (JSC::Take::operator()):
10565         (JSC::Take::returnValue):
10566         (JSC::MarkedSpace::shrink):
10567         (JSC::MarkedSpace::freeAllBlocks): Refactored the "Take" functor to support
10568         a conditional isEmpty check, so it dould be shared by shrink() and freeAllBlocks().
10569
10570         * heap/WeakBlock.cpp:
10571         (JSC::WeakBlock::WeakBlock):
10572         (JSC::WeakBlock::visitLiveWeakImpls):
10573         (JSC::WeakBlock::visitDeadWeakImpls):
10574         * heap/WeakBlock.h:
10575         (WeakBlock):
10576         (JSC::WeakBlock::isEmpty):
10577         * heap/WeakSet.cpp:
10578         (JSC::WeakSet::sweep):
10579         (JSC::WeakSet::shrink): Use isEmpty(), in preparation for changes in
10580         its implementation.
10581
10582 2012-05-23  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
10583
10584         [Qt] Remove references to $$QT_SOURCE_TREE
10585
10586         With a modularized Qt, it's ambigious. What we really want is qtbase,
10587         which qtcore is a proxy for (we assume it will always live in qtbase).
10588
10589         Reviewed by Tor Arne Vestbø.
10590
10591         * JavaScriptCore.pri:
10592         * Target.pri:
10593
10594 2012-05-09  Filip Pizlo  <fpizlo@apple.com>
10595
10596         DFG should allow inlining in case of certain arity mismatches
10597         https://bugs.webkit.org/show_bug.cgi?id=86059
10598
10599         Reviewed by Geoff Garen.
10600
10601         Merge r116620 from dfgopt.
10602
10603         * dfg/DFGByteCodeParser.cpp:
10604         (JSC::DFG::ByteCodeParser::handleInlining):
10605
10606 2012-05-08  Filip Pizlo  <fpizlo@apple.com>
10607
10608         DFG variable capture analysis should work even if the variables arose through inlining
10609         https://bugs.webkit.org/show_bug.cgi?id=85945
10610
10611         Reviewed by Oliver Hunt.
10612
10613         Merged r116555 from dfgopt.
10614
10615         This just changes how the DFG queries whether a variable is captured. It does not
10616         change any user-visible behavior.
10617
10618         As part of this change, I further solidified the policy that the CFA behaves in an
10619         undefined way for captured locals and queries about their values will not yield
10620         reliable results. This will likely be changed in the future, but for now it makes
10621         sense.
10622
10623         One fun part about this change is that it recognizes that the same variable may
10624         be both captured and not, at the same time, because their live interval spans
10625         inlining boundaries. This only happens in the case of arguments to functions that
10626         capture their arguments, and this change treats them with just the right touch of
10627         conservatism: they will be treated as if captured by the caller as well as the
10628         callee.
10629
10630         Finally, this also adds captured variable reasoning to the InlineCallFrame, which
10631         I thought might be useful for later tooling.
10632
10633         This is perf-neutral, since it does it does not make the DFG take advantage of this
10634         new functionality in any way. In particular, it is still the case that the DFG will
10635         not inline functions that use arguments reflectively or that create activations.
10636
10637         * bytecode/CodeBlock.h:
10638         (CodeBlock):
10639         (JSC::CodeBlock::needsActivation):
10640         (JSC::CodeBlock::argumentIsCaptured):
10641         (JSC::CodeBlock::localIsCaptured):
10642         (JSC::CodeBlock::isCaptured):
10643         * bytecode/CodeOrigin.h:
10644         (InlineCallFrame):
10645         * dfg/DFGAbstractState.cpp:
10646         (JSC::DFG::AbstractState::initialize):
10647         (JSC::DFG::AbstractState::endBasicBlock):
10648         (JSC::DFG::AbstractState::execute):
10649         (JSC::DFG::AbstractState::merge):
10650         * dfg/DFGByteCodeParser.cpp:
10651         (JSC::DFG::ByteCodeParser::newVariableAccessData):
10652         (JSC::DFG::ByteCodeParser::getLocal):
10653         (JSC::DFG::ByteCodeParser::setLocal):
10654         (JSC::DFG::ByteCodeParser::getArgument):
10655         (JSC::DFG::ByteCodeParser::setArgument):
10656         (JSC::DFG::ByteCodeParser::flushArgument):
10657         (JSC::DFG::ByteCodeParser::parseBlock):
10658         (JSC::DFG::ByteCodeParser::processPhiStack):
10659         (JSC::DFG::ByteCodeParser::fixVariableAccessPredictions):
10660         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
10661         * dfg/DFGCFGSimplificationPhase.cpp:
10662         (CFGSimplificationPhase):
10663         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
10664         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
10665         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
10666         * dfg/DFGCommon.h:
10667         * dfg/DFGFixupPhase.cpp:
10668         (JSC::DFG::FixupPhase::fixupNode):
10669         * dfg/DFGGraph.cpp:
10670         (JSC::DFG::Graph::nameOfVariableAccessData):
10671         * dfg/DFGGraph.h:
10672         (JSC::DFG::Graph::needsActivation):
10673         (JSC::DFG::Graph::usesArguments):
10674         * dfg/DFGPredictionPropagationPhase.cpp:
10675         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
10676         * dfg/DFGSpeculativeJIT.cpp:
10677         (JSC::DFG::SpeculativeJIT::compile):
10678         * dfg/DFGSpeculativeJIT32_64.cpp:
10679         (JSC::DFG::SpeculativeJIT::compile):
10680         * dfg/DFGSpeculativeJIT64.cpp:
10681         (JSC::DFG::SpeculativeJIT::compile):
10682         * dfg/DFGVariableAccessData.h:
10683         (JSC::DFG::VariableAccessData::VariableAccessData):
10684         (JSC::DFG::VariableAccessData::mergeIsCaptured):
10685         (VariableAccessData):
10686         (JSC::DFG::VariableAccessData::isCaptured):
10687
10688 2012-05-08  Filip Pizlo  <fpizlo@apple.com>
10689
10690         DFG should support op_get_argument_by_val and op_get_arguments_length
10691         https://bugs.webkit.org/show_bug.cgi?id=85911
10692
10693         Reviewed by Oliver Hunt.
10694
10695         Merged r116467 from dfgopt.
10696
10697         This adds a simple and relatively conservative implementation of op_get_argument_by_val
10698         and op_get_arguments_length. We can optimize these later. For now it's great to have
10699         the additional coverage.
10700
10701         This patch appears to be perf-neutral.
10702
10703         * dfg/DFGAbstractState.cpp:
10704         (JSC::DFG::AbstractState::execute):
10705         * dfg/DFGAssemblyHelpers.h:
10706         (JSC::DFG::AssemblyHelpers::addressFor):
10707         (JSC::DFG::AssemblyHelpers::tagFor):
10708         (JSC::DFG::AssemblyHelpers::payloadFor):
10709         * dfg/DFGByteCodeParser.cpp:
10710         (JSC::DFG::ByteCodeParser::parseBlock):
10711         * dfg/DFGCapabilities.h:
10712         (JSC::DFG::canCompileOpcode):
10713         (JSC::DFG::canInlineOpcode):
10714         * dfg/DFGNode.h:
10715         (JSC::DFG::Node::hasHeapPrediction):
10716         * dfg/DFGNodeType.h:
10717         (DFG):
10718         * dfg/DFGOperations.cpp:
10719         * dfg/DFGOperations.h:
10720         * dfg/DFGPredictionPropagationPhase.cpp:
10721         (JSC::DFG::PredictionPropagationPhase::propagate):
10722         * dfg/DFGSpeculativeJIT.h:
10723         (JSC::DFG::SpeculativeJIT::callOperation):
10724         (SpeculativeJIT):
10725         * dfg/DFGSpeculativeJIT32_64.cpp:
10726         (JSC::DFG::SpeculativeJIT::compile):
10727         * dfg/DFGSpeculativeJIT64.cpp:
10728         (JSC::DFG::SpeculativeJIT::compile):
10729         * jit/JITOpcodes.cpp:
10730         (JSC::JIT::emit_op_get_argument_by_val):
10731         * jit/JITOpcodes32_64.cpp:
10732         (JSC::JIT::emit_op_get_argument_by_val):
10733         * llint/LowLevelInterpreter32_64.asm:
10734         * llint/LowLevelInterpreter64.asm:
10735
10736 2012-05-07  Filip Pizlo  <fpizlo@apple.com>
10737
10738         DFG should support op_tear_off_arguments
10739         https://bugs.webkit.org/show_bug.cgi?id=85847
10740
10741         Reviewed by Michael Saboff.
10742
10743         Merged r116378 from dfgopt.
10744
10745         * dfg/DFGAbstractState.cpp:
10746         (JSC::DFG::AbstractState::execute):
10747         * dfg/DFGByteCodeParser.cpp:
10748         (JSC::DFG::ByteCodeParser::parseBlock):
10749         * dfg/DFGCapabilities.h:
10750         (JSC::DFG::canCompileOpcode):
10751         (JSC::DFG::canInlineOpcode):
10752         * dfg/DFGNodeType.h:
10753         (DFG):
10754         * dfg/DFGOperations.cpp:
10755         * dfg/DFGOperations.h:
10756         * dfg/DFGPredictionPropagationPhase.cpp:
10757         (JSC::DFG::PredictionPropagationPhase::propagate):
10758         * dfg/DFGSpeculativeJIT.h:
10759         (SpeculativeJIT):
10760         (JSC::DFG::SpeculativeJIT::callOperation):
10761         * dfg/DFGSpeculativeJIT32_64.cpp:
10762         (JSC::DFG::SpeculativeJIT::compile):
10763         * dfg/DFGSpeculativeJIT64.cpp:
10764         (JSC::DFG::SpeculativeJIT::compile):
10765
10766 2012-05-22  Mark Hahnenberg  <mhahnenberg@apple.com>
10767
10768         CopiedSpace::contains doesn't check for oversize blocks
10769         https://bugs.webkit.org/show_bug.cgi?id=87180
10770
10771         Reviewed by Geoffrey Garen.
10772
10773         When doing a conservative scan we use CopiedSpace::contains to determine if a particular
10774         address points into the CopiedSpace. Currently contains() only checks if the address
10775         points to a block in to-space, which means that pointers to oversize blocks may not get scanned.
10776
10777         * heap/CopiedSpace.cpp:
10778         (JSC::CopiedSpace::tryAllocateOversize):
10779         (JSC::CopiedSpace::tryReallocateOversize):
10780         (JSC::CopiedSpace::doneFillingBlock):
10781         (JSC::CopiedSpace::doneCopying):
10782         * heap/CopiedSpace.h: Refactored CopiedSpace so that all blocks (oversize and to-space) are
10783         in a single hash set and bloom filter for membership testing.
10784         (CopiedSpace):
10785         * heap/CopiedSpaceInlineMethods.h:
10786         (JSC::CopiedSpace::contains): We check for the normal block first. Since the oversize blocks are
10787         only page aligned, rather than block aligned, we have to re-mask the ptr to check if it's in
10788         CopiedSpace. Also added a helper function of the same name that takes a CopiedBlock* and checks
10789         if it's in CopiedSpace so that check isn't typed out twice.
10790         (JSC):
10791         (JSC::CopiedSpace::startedCopying):
10792         (JSC::CopiedSpace::addNewBlock):
10793
10794 2012-05-22  Geoffrey Garen  <ggaren@apple.com>
10795
10796         CopiedBlock and MarkedBlock should have proper value semantics (i.e., destructors)
10797         https://bugs.webkit.org/show_bug.cgi?id=87172
10798
10799         Reviewed by Oliver Hunt and Phil Pizlo.
10800
10801         This enables MarkedBlock to own non-trivial sub-objects that require
10802         destruction. It also fixes a FIXME about casting a CopiedBlock to a
10803         MarkedBlock at destroy time.
10804
10805         CopiedBlock and MarkedBlock now accept an allocation chunk at create
10806         time and return it at destroy time. Their client is expected to
10807         allocate, recycle, and destroy these chunks.
10808
10809         * heap/BlockAllocator.cpp:
10810         (JSC::BlockAllocator::releaseFreeBlocks):
10811         (JSC::BlockAllocator::blockFreeingThreadMain): Don't call MarkedBlock::destroy
10812         because we expect that to be called before a block is put on our free
10813         list now. Do manually deallocate our allocation chunk because that's
10814         our job now.
10815
10816         * heap/BlockAllocator.h:
10817         (BlockAllocator):
10818         (JSC::BlockAllocator::allocate): Allocate never fails now. This is a
10819         cleaner abstraction because only one object does all the VM allocation
10820         and deallocation. Caching is an implementation detail.
10821
10822         (JSC::BlockAllocator::deallocate): We take an allocation chunk argument
10823         instead of a block because we now expect the block to have been destroyed
10824         before we recycle its memory. For convenience, we still use the HeapBlock
10825         class as our linked list node. This is OK because HeapBlock is a POD type.
10826
10827         * heap/CopiedBlock.h:
10828         (CopiedBlock):
10829         (JSC::CopiedBlock::create):
10830         (JSC::CopiedBlock::destroy):
10831         (JSC::CopiedBlock::CopiedBlock): Added proper create and destroy functions,
10832         to match MarkedBlock.
10833
10834         * heap/CopiedSpace.cpp:
10835         (JSC::CopiedSpace::tryAllocateOversize):
10836         (JSC::CopiedSpace::tryReallocateOversize):
10837         (JSC::CopiedSpace::doneCopying):
10838         (JSC::CopiedSpace::getFreshBlock):
10839         (JSC::CopiedSpace::freeAllBlocks):
10840         * heap/CopiedSpaceInlineMethods.h:
10841         (JSC::CopiedSpace::recycleBlock): Make sure to call destroy before
10842         returning a block to the BlockAllocator. Otherwise, our destructors
10843         won't run. (If we get this wrong now, we'll get a compile error.)
10844
10845         * heap/HeapBlock.h:
10846         (JSC::HeapBlock::HeapBlock): const!
10847
10848         * heap/MarkedAllocator.cpp:
10849         (JSC::MarkedAllocator::allocateBlock): No need to distinguish between
10850         create and recycle -- MarkedBlock always accepts memory allocated by
10851         its client now.
10852
10853         * heap/MarkedBlock.cpp:
10854         (JSC::MarkedBlock::create): Don't allocate memory -- we assume that we're
10855         passed already-allocated memory, to clarify the responsibility for VM
10856         recycling.
10857
10858         (JSC::MarkedBlock::destroy): Do run our destructor before giving back
10859         our VM -- that is the whole point of this patch.
10860
10861         (JSC::MarkedBlock::MarkedBlock):
10862         * heap/MarkedBlock.h:
10863         (MarkedBlock):
10864         * heap/MarkedSpace.cpp: const!
10865
10866         (JSC::MarkedSpace::freeBlocks): Make sure to call destroy before
10867         returning a block to the BlockAllocator. Otherwise, our destructors
10868         won't run. (If we get this wrong now, we'll get a compile error.)
10869
10870 == Rolled over to ChangeLog-2012-05-22 ==