Source/JavaScriptCore/ChangeLog

   1 2012-09-11  Mark Hahnenberg  <mhahnenberg@apple.com>
   2
   3         IncrementalSweeper should not sweep/free Zapped blocks
   4         https://bugs.webkit.org/show_bug.cgi?id=96464
   5
   6         Reviewed by Filip Pizlo.
   7
   8         This is not beneficial in terms of performance because there isn't any way a block can emerge
   9         in the Zapped state from a call to Heap::collect() unless we run an eager sweep on it, in which
  10         case we've already run all the destructors we possibly can. This also causes bugs since we don't
  11         take zapped-ness into account when determining whether or not a block is empty to free it. The
  12         incremental sweeper can then accidentally free blocks that it thinks are empty but are in fact
  13         zapped with still-live objects in them.
  14
  15         * heap/MarkedBlock.h:
  16         (JSC::MarkedBlock::needsSweeping): It is only valid to sweep a block if it is in the Marked state.
  17
  18 2013-03-11  Oliver Hunt  <oliver@apple.com>
  19
  20         Make SegmentedVector Noncopyable
  21         https://bugs.webkit.org/show_bug.cgi?id=112059
  22
  23         Reviewed by Geoffrey Garen.
  24
  25         Copying a SegmentedVector is very expensive, and really shouldn't
  26         be necessary.  So I've taken the one place where we currently copy
  27         and replaced it with a regular Vector, and replaced the address
  28         dependent logic with a indexing ref instead.
  29
  30         * bytecompiler/BytecodeGenerator.cpp:
  31         (JSC::BytecodeGenerator::newLabelScope):
  32         (JSC::BytecodeGenerator::emitComplexJumpScopes):
  33         * bytecompiler/BytecodeGenerator.h:
  34         (BytecodeGenerator):
  35         * bytecompiler/LabelScope.h:
  36         (JSC):
  37         (JSC::LabelScopePtr::LabelScopePtr):
  38         (LabelScopePtr):
  39         (JSC::LabelScopePtr::operator=):
  40         (JSC::LabelScopePtr::~LabelScopePtr):
  41         (JSC::LabelScopePtr::operator*):
  42         (JSC::LabelScopePtr::operator->):
  43         * bytecompiler/NodesCodegen.cpp:
  44         (JSC::DoWhileNode::emitBytecode):
  45         (JSC::WhileNode::emitBytecode):
  46         (JSC::ForNode::emitBytecode):
  47         (JSC::ForInNode::emitBytecode):
  48         (JSC::SwitchNode::emitBytecode):
  49         (JSC::LabelNode::emitBytecode):
  50
  51 2012-11-20  Yong Li  <yoli@rim.com>
  52
  53         [ARMv7] Neither linkCall() nor linkPointer() should flush code.
  54         https://bugs.webkit.org/show_bug.cgi?id=99213
  55
  56         Reviewed by George Staikos.
  57
  58         LinkBuffer doesn't need to flush code during linking. It will
  59         eventually flush the whole executable. Fixing this gives >%5
  60         sunspider boost (on QNX).
  61
  62         Also make replaceWithLoad() and replaceWithAddressComputation() flush
  63         only when necessary.
  64
  65         * assembler/ARMv7Assembler.h:
  66         (JSC::ARMv7Assembler::linkCall):
  67         (JSC::ARMv7Assembler::linkPointer):
  68         (JSC::ARMv7Assembler::relinkCall):
  69         (JSC::ARMv7Assembler::repatchInt32):
  70         (JSC::ARMv7Assembler::repatchPointer):
  71         (JSC::ARMv7Assembler::replaceWithLoad): Flush only after it did write.
  72         (JSC::ARMv7Assembler::replaceWithAddressComputation): Flush only after it did write.
  73         (JSC::ARMv7Assembler::setInt32):
  74         (JSC::ARMv7Assembler::setPointer):
  75
  76 2012-08-30  Byungwoo Lee  <bw80.lee@samsung.com>
  77
  78         Build warning : -Wsign-compare on DFGByteCodeParser.cpp.
  79         https://bugs.webkit.org/show_bug.cgi?id=95418
  80
  81         Reviewed by Filip Pizlo.
  82
  83         There is a build warning '-Wsign-compare' on
  84         findArgumentPositionForLocal() in DFGByteCodeParser.cpp.
  85
  86         For removing this warning, casting statement is added explicitly.
  87
  88         * dfg/DFGByteCodeParser.cpp:
  89         (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
  90         (JSC::DFG::ByteCodeParser::findArgumentPosition):
  91
  92 2012-11-13  Cosmin Truta  <ctruta@rim.com>
  93
  94         Uninitialized fields in class JSLock
  95         https://bugs.webkit.org/show_bug.cgi?id=101695
  96
  97         Reviewed by Mark Hahnenberg.
  98
  99         Initialize JSLock::m_ownerThread and JSLock::m_lockDropDepth.
 100
 101         * runtime/JSLock.cpp:
 102         (JSC::JSLock::JSLock):
 103
 104 2012-09-17  Filip Pizlo  <fpizlo@apple.com>
 105
 106         Unreviewed, fix a broken assertion in offlineasm.
 107
 108         * offlineasm/armv7.rb:
 109         * offlineasm/backends.rb:
 110
 111 2012-09-10  Thiago Marcos P. Santos  <thiago.santos@intel.com>
 112
 113         [CMake][EFL] Enable the LLInt
 114         https://bugs.webkit.org/show_bug.cgi?id=92682
 115
 116         Reviewed by Csaba Osztrogonác.
 117
 118         Generate the headers needed by LLint when LLint is enabled.
 119
 120         * CMakeLists.txt:
 121
 122 2012-09-09  Mark Lam  <mark.lam@apple.com>
 123
 124         Fixed a few llint C++ interpreter bugs.
 125         https://bugs.webkit.org/show_bug.cgi?id=96127.
 126
 127         Reviewed by Geoffrey Garen.
 128
 129         * llint/LLIntCLoop.h:
 130             CLoop::execute()'s bootstrapOpcodeId does not need a default
 131             value. There is no case when this function is called without
 132             that parameter being specified.
 133         * llint/LowLevelInterpreter.asm:
 134             Moved the dispatchAfterCall() call to where it is needed.
 135             For the C_LOOP back-end, it generates unreachable code.
 136         * llint/LowLevelInterpreter.cpp:
 137             #include <wtf/Assertions.h> because LLIntAssembly.h needs it.
 138         (JSC):
 139             Fixed bug in SIGN_BIT32() macro.
 140             Placate a MSVC warning for t0, and t1 being uninitialized.
 141         (JSC::CLoop::execute):
 142             The bootstrapOpcodeId arg should always be specified.
 143             MSVC doesn't like UNUSED_PARAM() for labels. Switch to using
 144                 the new UNUSED_LABEL() macro.
 145         * offlineasm/cloop.rb:
 146         * offlineasm/generate_offset_extractor.rb:
 147             Resolved a compiler warning found via MSVC.
 148
 149 2012-09-07  Sheriff Bot  <webkit.review.bot@gmail.com>
 150
 151         Unreviewed, rolling out r127938.
 152         http://trac.webkit.org/changeset/127938
 153         https://bugs.webkit.org/show_bug.cgi?id=96166
 154
 155         It broke the build (Requested by smfr on #webkit).
 156
 157         * llint/LowLevelInterpreter.cpp:
 158         (JSC):
 159         (JSC::CLoop::execute):
 160         * offlineasm/cloop.rb:
 161
 162 2012-09-07  Mark Lam  <mark.lam@apple.com>
 163
 164         Fix a llint C++ interpreter bugs.
 165         https://bugs.webkit.org/show_bug.cgi?id=96127.
 166
 167         Reviewed by Filip Pizlo.
 168
 169         * llint/LowLevelInterpreter.cpp:
 170         (JSC):
 171         (JSC::CLoop::execute):
 172         * offlineasm/cloop.rb:
 173
 174 2012-09-01  Mark Lam  <mark.lam@apple.com>
 175
 176         LLInt C loop backend.
 177         https://bugs.webkit.org/show_bug.cgi?id=91052.
 178
 179         Reviewed by Filip Pizlo.
 180
 181         * JavaScriptCore.xcodeproj/project.pbxproj:
 182         * bytecode/CodeBlock.cpp:
 183         (JSC::CodeBlock::dump):
 184         (JSC::CodeBlock::bytecodeOffset):
 185         * interpreter/Interpreter.cpp:
 186         (JSC::Interpreter::execute):
 187         (JSC::Interpreter::executeCall):
 188         (JSC::Interpreter::executeConstruct):
 189         (JSC):
 190         * interpreter/Interpreter.h:
 191         * jit/JITStubs.h:
 192         (JITStackFrame):
 193         (JSC):
 194         * llint/LLIntCLoop.cpp: Added.
 195         (JSC):
 196         (LLInt):
 197         (JSC::LLInt::CLoop::initialize):
 198         (JSC::LLInt::CLoop::catchRoutineFor):
 199         (JSC::LLInt::CLoop::hostCodeEntryFor):
 200         (JSC::LLInt::CLoop::jsCodeEntryWithArityCheckFor):
 201         (JSC::LLInt::CLoop::jsCodeEntryFor):
 202         * llint/LLIntCLoop.h: Added.
 203         (JSC):
 204         (LLInt):
 205         (CLoop):
 206         * llint/LLIntData.cpp:
 207         (JSC::LLInt::initialize):
 208         * llint/LLIntData.h:
 209         (JSC):
 210         * llint/LLIntOfflineAsmConfig.h:
 211         * llint/LLIntOpcode.h:
 212         * llint/LLIntThunks.cpp:
 213         (LLInt):
 214         * llint/LowLevelInterpreter.asm:
 215         * llint/LowLevelInterpreter.cpp:
 216         (LLInt):
 217         (JSC::LLInt::Ints2Double):
 218         (JSC):
 219         (JSC::CLoop::execute):
 220         * llint/LowLevelInterpreter.h:
 221         (JSC):
 222         * llint/LowLevelInterpreter32_64.asm:
 223         * llint/LowLevelInterpreter64.asm:
 224         * offlineasm/asm.rb:
 225         * offlineasm/backends.rb:
 226         * offlineasm/cloop.rb: Added.
 227         * offlineasm/instructions.rb:
 228         * runtime/Executable.h:
 229         (ExecutableBase):
 230         (JSC::ExecutableBase::hostCodeEntryFor):
 231         (JSC::ExecutableBase::jsCodeEntryFor):
 232         (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor):
 233         (JSC::ExecutableBase::catchRoutineFor):
 234         (NativeExecutable):
 235         * runtime/JSValue.h:
 236         (JSC):
 237         (LLInt):
 238         (JSValue):
 239         * runtime/JSValueInlineMethods.h:
 240         (JSC):
 241         (JSC::JSValue::JSValue):
 242         * runtime/Options.cpp:
 243         (JSC::Options::initialize):
 244
 245 2012-08-31  Mark Lam  <mark.lam@apple.com>
 246
 247         Refactor LLInt and supporting code in preparation for the C Loop backend.
 248         https://bugs.webkit.org/show_bug.cgi?id=95531.
 249
 250         Reviewed by Filip Pizlo.
 251
 252         * bytecode/GetByIdStatus.cpp:
 253         (JSC::GetByIdStatus::computeFromLLInt):
 254         * bytecode/PutByIdStatus.cpp:
 255         (JSC::PutByIdStatus::computeFromLLInt):
 256         * jit/JITExceptions.cpp:
 257         (JSC::genericThrow): Use ExecutableBase::catchRoutineFor() to fetch
 258             fetch the catch routine for a thrown exception.  This will allow
 259             us to redefine that for the C loop later, and still keep this
 260             code readable.
 261         * llint/LLIntOfflineAsmConfig.h: Moved ASM macros to
 262             LowLevelInterpreter.cpp which is the only place they are used. This
 263             will make it more convenient to redefine them for the C loop later.
 264         * llint/LLIntSlowPaths.cpp:
 265         (JSC::LLInt::setUpCall): Use ExecutableBase's hostCodeEntry()
 266             jsCodeEntryFor(), and jsCodeWithArityCheckEntryFor() for computing
 267             the entry points to functions being called.
 268         * llint/LLIntSlowPaths.h:
 269         (SlowPathReturnType):
 270         (JSC::LLInt::encodeResult):
 271         (LLInt):
 272         (JSC::LLInt::decodeResult): Added.  Needed by LLInt C Loop later.
 273         * llint/LowLevelInterpreter.asm:
 274         * llint/LowLevelInterpreter.cpp:
 275         * llint/LowLevelInterpreter32_64.asm:
 276         * llint/LowLevelInterpreter64.asm:
 277         * offlineasm/asm.rb: Disambiguate between opcodes and other labels.
 278         * offlineasm/config.rb:
 279         * runtime/Executable.h:
 280         (JSC::ExecutableBase::hostCodeEntryFor): Added.
 281         (ExecutableBase):
 282         (JSC::ExecutableBase::jsCodeEntryFor): Added.
 283         (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor): Added.
 284         (JSC::ExecutableBase::catchRoutineFor): Added.
 285         * runtime/JSValueInlineMethods.h:
 286         (JSC):
 287
 288 2012-08-30  Mark Lam  <mark.lam@apple.com>
 289
 290         Render unto #ifdef's that which belong to them.
 291         https://bugs.webkit.org/show_bug.cgi?id=95482.
 292
 293         Reviewed by Filip Pizlo.
 294
 295         Refining / disambiguating between #ifdefs and adding some. For
 296         example, ENABLE(JIT) is conflated with ENABLE(LLINT) in some places.
 297         Also, we need to add ENABLE(COMPUTED_GOTO_OPCODES) to indicate that we
 298         want interpreted opcodes to use COMPUTED GOTOs apart from ENABLE(LLINT)
 299         and ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER). Also cleaned up #ifdefs
 300         in certain places which were previously incorrect.
 301
 302         * bytecode/CodeBlock.cpp:
 303         (JSC):
 304         (JSC::CodeBlock::bytecodeOffset):
 305         * bytecode/CodeBlock.h:
 306         (CodeBlock):
 307         * bytecode/Opcode.h:
 308         (JSC::padOpcodeName):
 309         * config.h:
 310         * dfg/DFGOperations.cpp:
 311         * interpreter/AbstractPC.cpp:
 312         (JSC::AbstractPC::AbstractPC):
 313         * interpreter/CallFrame.h:
 314         (ExecState):
 315         * interpreter/Interpreter.cpp:
 316         (JSC::Interpreter::~Interpreter):
 317         (JSC::Interpreter::initialize):
 318         (JSC::Interpreter::isOpcode):
 319         (JSC::Interpreter::unwindCallFrame):
 320         (JSC::getLineNumberForCallFrame):
 321         (JSC::getCallerInfo):
 322         (JSC::Interpreter::execute):
 323         (JSC::Interpreter::executeCall):
 324         (JSC::Interpreter::executeConstruct):
 325         (JSC::Interpreter::privateExecute):
 326         * interpreter/Interpreter.h:
 327         (JSC::Interpreter::getOpcode):
 328         (JSC::Interpreter::getOpcodeID):
 329         (Interpreter):
 330         * jit/HostCallReturnValue.h:
 331         * jit/JITCode.h:
 332         (JITCode):
 333         * jit/JITExceptions.cpp:
 334         * jit/JITExceptions.h:
 335         * jit/JSInterfaceJIT.h:
 336         * llint/LLIntData.h:
 337         (JSC::LLInt::getOpcode):
 338         * llint/LLIntEntrypoints.cpp:
 339         (JSC::LLInt::getFunctionEntrypoint):
 340         (JSC::LLInt::getEvalEntrypoint):
 341         (JSC::LLInt::getProgramEntrypoint):
 342         * llint/LLIntOffsetsExtractor.cpp:
 343         (JSC::LLIntOffsetsExtractor::dummy):
 344         * llint/LLIntSlowPaths.cpp:
 345         (LLInt):
 346         * runtime/JSGlobalData.cpp:
 347         (JSC):
 348
 349 2012-08-23  Christophe Dumez  <christophe.dumez@intel.com>
 350
 351         Serialization of JavaScript values does not appear to respect new HTML5 Structured Clone semantics
 352         https://bugs.webkit.org/show_bug.cgi?id=65292
 353
 354         Reviewed by Oliver Hunt.
 355
 356         Add function to construct a StringObject from a JSValue.
 357         Similar functions already exist for NumberObject and
 358         BooleanObject for example.
 359
 360         Export several symbols so address linking errors in
 361         WebCore.
 362
 363         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 364         * runtime/BooleanObject.h:
 365         (BooleanObject):
 366         * runtime/NumberObject.h:
 367         (NumberObject):
 368         (JSC):
 369         * runtime/StringObject.cpp:
 370         (JSC::constructString):
 371         (JSC):
 372         * runtime/StringObject.h:
 373         (JSC):
 374
 375 2012-08-30  Mark Lam  <mark.lam@apple.com>
 376
 377         Fix broken classic intrpreter build.
 378         https://bugs.webkit.org/show_bug.cgi?id=95484.
 379
 380         Reviewed by Filip Pizlo.
 381
 382         * interpreter/Interpreter.cpp:
 383         (JSC::Interpreter::privateExecute):
 384
 385 2012-08-29  Mark Lam  <mark.lam@apple.com>
 386
 387         Refactoring LLInt::Data.
 388         https://bugs.webkit.org/show_bug.cgi?id=95316.
 389
 390         Reviewed by Geoff Garen.
 391
 392         This change allows its opcodeMap to be easily queried from any function
 393         without needing to go through a GlobalData object.  It also introduces
 394         the LLInt::getCodePtr() methods that will be used by the LLInt C loop
 395         later to redefine how llint symbols (opcodes and trampoline glue
 396         labels) get resolved.
 397
 398         * assembler/MacroAssemblerCodeRef.h:
 399         (MacroAssemblerCodePtr):
 400         (JSC::MacroAssemblerCodePtr::createLLIntCodePtr):
 401         (MacroAssemblerCodeRef):
 402         (JSC::MacroAssemblerCodeRef::createLLIntCodeRef):
 403         * bytecode/CodeBlock.cpp:
 404         (JSC::CodeBlock::adjustPCIfAtCallSite):
 405         (JSC::CodeBlock::bytecodeOffset):
 406         * bytecode/Opcode.h:
 407             Remove the 'const' to simplify things and avoid having to do
 408             additional casts and #ifdefs in many places.
 409         * bytecode/ResolveGlobalStatus.cpp:
 410         (JSC::computeForLLInt):
 411         * bytecompiler/BytecodeGenerator.cpp:
 412         (JSC::BytecodeGenerator::generate):
 413         * interpreter/Interpreter.cpp:
 414         (JSC::Interpreter::initialize):
 415         * interpreter/Interpreter.h:
 416         (Interpreter):
 417         * jit/JITExceptions.cpp:
 418         (JSC::genericThrow):
 419         * llint/LLIntData.cpp:
 420         (LLInt):
 421         (JSC::LLInt::initialize):
 422         * llint/LLIntData.h:
 423         (JSC):
 424         (LLInt):
 425         (Data):
 426         (JSC::LLInt::exceptionInstructions):
 427         (JSC::LLInt::opcodeMap):
 428         (JSC::LLInt::getOpcode):
 429         (JSC::LLInt::getCodePtr):
 430         (JSC::LLInt::Data::performAssertions):
 431         * llint/LLIntExceptions.cpp:
 432         (JSC::LLInt::returnToThrowForThrownException):
 433         (JSC::LLInt::returnToThrow):
 434         (JSC::LLInt::callToThrow):
 435         * llint/LLIntSlowPaths.cpp:
 436         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
 437         (JSC::LLInt::handleHostCall):
 438         * runtime/InitializeThreading.cpp:
 439         (JSC::initializeThreadingOnce): Initialize the singleton LLInt data.
 440         * runtime/JSGlobalData.cpp:
 441         (JSC::JSGlobalData::JSGlobalData):
 442         * runtime/JSGlobalData.h:
 443         (JSGlobalData): Removed the now unneeded LLInt::Data instance in
 444             JSGlobalData.
 445         * runtime/JSValue.h:
 446         (JSValue):
 447
 448 2012-08-24  Filip Pizlo  <fpizlo@apple.com>
 449
 450         Finally inlining should correctly track the catch context
 451         https://bugs.webkit.org/show_bug.cgi?id=94986
 452         <rdar://problem/11753784>
 453
 454         Reviewed by Sam Weinig.
 455
 456         This fixes two behaviors:
 457
 458         1) Throwing from a finally block. Previously, we would seem to reenter the finally
 459            block - though only once.
 460
 461         2) Executing a finally block from some nested context, for example due to a
 462            'continue', 'break', or 'return' in the try. This would execute the finally
 463            block in the context of of the try block, which could lead to either scope depth
 464            mismatches or reexecutions of the finally block on throw, similarly to (1) but
 465            for different reasons.
 466
 467         * bytecompiler/BytecodeGenerator.cpp:
 468         (JSC):
 469         (JSC::BytecodeGenerator::pushFinallyContext):
 470         (JSC::BytecodeGenerator::emitComplexJumpScopes):
 471         (JSC::BytecodeGenerator::pushTry):
 472         (JSC::BytecodeGenerator::popTryAndEmitCatch):
 473         * bytecompiler/BytecodeGenerator.h:
 474         (FinallyContext):
 475         (TryData):
 476         (JSC):
 477         (TryContext):
 478         (TryRange):
 479         (BytecodeGenerator):
 480         * bytecompiler/NodesCodegen.cpp:
 481         (JSC::TryNode::emitBytecode):
 482
 483 2012-08-28  Mark Lam  <mark.lam@apple.com>
 484
 485         Adding support for adding LLInt opcode extensions.  This will be needed
 486         by the LLInt C loop interpreter later.
 487         https://bugs.webkit.org/show_bug.cgi?id=95277.
 488
 489         Reviewed by Geoffrey Garen.
 490
 491         * JavaScriptCore.xcodeproj/project.pbxproj:
 492         * bytecode/Opcode.h:
 493         * llint/LLIntOpcode.h: Added.
 494         * llint/LowLevelInterpreter.h:
 495
 496 2012-08-28  Filip Pizlo  <fpizlo@apple.com>
 497
 498         LLInt should not rely on ordering of global labels
 499         https://bugs.webkit.org/show_bug.cgi?id=95221
 500
 501         Reviewed by Oliver Hunt.
 502
 503         * llint/LowLevelInterpreter.asm:
 504         * llint/LowLevelInterpreter32_64.asm:
 505         * llint/LowLevelInterpreter64.asm:
 506
 507 2012-08-20  Mark Lam  <mark.lam@apple.com>
 508
 509         Fix broken non-JIT build.
 510         https://bugs.webkit.org/show_bug.cgi?id=94564.
 511
 512         Reviewed by Filip Pizlo.
 513
 514         Added some UNUSED_PARAM() macros to make the compiler happy.
 515
 516         * runtime/Executable.cpp:
 517         (JSC::EvalExecutable::compileInternal):
 518         (JSC::ProgramExecutable::compileInternal):
 519         (JSC::FunctionExecutable::compileForCallInternal):
 520         (JSC::FunctionExecutable::compileForConstructInternal):
 521
 522 2012-08-20  Mark Lam  <mark.lam@apple.com>
 523
 524         Fixed erroneous line number for LLint frame when throwing exceptions.
 525         https://bugs.webkit.org/show_bug.cgi?id=94051.
 526
 527         Reviewed by Filip Pizlo.
 528
 529         For LLInt frames, before throwing an exception, adjust the PC from the
 530         return PC back to the call PC if we are indeed at a call site.
 531
 532         * bytecode/CodeBlock.cpp:
 533         (JSC::CodeBlock::adjustPCIfAtCallSite):
 534         (JSC):
 535         (JSC::CodeBlock::bytecodeOffset):
 536         * bytecode/CodeBlock.h:
 537         (CodeBlock):
 538         * llint/LLIntExceptions.cpp:
 539         (JSC::LLInt::fixupPCforExceptionIfNeeded):
 540         (LLInt):
 541         (JSC::LLInt::interpreterThrowInCaller):
 542         (JSC::LLInt::returnToThrow):
 543         (JSC::LLInt::callToThrow):
 544
 545 2012-08-03  Filip Pizlo  <fpizlo@apple.com>
 546
 547         Crashes in dfgBuildPutByIdList when clicking on just about anything on Google Maps
 548         https://bugs.webkit.org/show_bug.cgi?id=92691
 549
 550         Reviewed by Mark Hahnenberg.
 551
 552         The state of the stubs was changing after we determined the type (by virtue of the slow path
 553         function that was called), since the get or put (in this case put) could cause arbitrary
 554         side effects. Perhaps a full-blown fix would be to eliminate our reliance of the slow path
 555         function to determine what to do, but an easier fix for now is to have the slow path give up
 556         if its assumptions were invalidated by a side effect.
 557
 558         * dfg/DFGOperations.cpp:
 559         * jit/JITStubs.cpp:
 560         (JSC::DEFINE_STUB_FUNCTION):
 561
 562 2012-08-03  Filip Pizlo  <fpizlo@apple.com>
 563
 564         DFG handling of get_by_id should always inject a ForceOSRExit node if there is no prediction
 565         https://bugs.webkit.org/show_bug.cgi?id=93162
 566
 567         Reviewed by Mark Hahnenberg.
 568
 569         This simplifies the DFG IR by ensuring that all nodes that use value profiles will be preceded
 570         by a ForceOSRExit if the value profile had no data.
 571
 572         * dfg/DFGByteCodeParser.cpp:
 573         (JSC::DFG::ByteCodeParser::parseBlock):
 574
 575 2012-08-03  Filip Pizlo  <fpizlo@apple.com>
 576
 577         DFG::StructureCheckHoistingPhase keeps a Node& around for too long
 578         https://bugs.webkit.org/show_bug.cgi?id=93157
 579
 580         Reviewed by Mark Hahnenberg.
 581
 582         * dfg/DFGStructureCheckHoistingPhase.cpp:
 583         (JSC::DFG::StructureCheckHoistingPhase::run):
 584
 585 2012-08-02  Filip Pizlo  <fpizlo@apple.com>
 586
 587         ASSERTION FAILED: at(m_compileIndex).canExit() || m_isCheckingArgumentTypes
 588         https://bugs.webkit.org/show_bug.cgi?id=91074
 589
 590         Reviewed by Mark Hahnenberg.
 591
 592         Fixes a bug where the speculative JIT was performing an unnecessary speculation that the
 593         CFA had proven shouldn't be performed, leading to asserts that a node should not have
 594         exit sites. This is a debug-only assert with no release symptom - we were just emitting
 595         a check that was not reachable.
 596
 597         Also found, and fixed, a bug where structure check hoisting was slightly confusing the
 598         CFA by inserting GetLocal's into the graph. CSE would clean the GetLocal's up, which
 599         would make the backend happy - but the CFA would produce subtly wrong results.
 600
 601         * bytecode/SpeculatedType.h:
 602         (JSC::isOtherOrEmptySpeculation):
 603         (JSC):
 604         * dfg/DFGDriver.cpp:
 605         (JSC::DFG::compile):
 606         * dfg/DFGGraph.cpp:
 607         (JSC::DFG::Graph::dump):
 608         * dfg/DFGSpeculativeJIT64.cpp:
 609         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
 610         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
 611
 612 2012-08-02  Filip Pizlo  <fpizlo@apple.com>
 613
 614         Unreviewed, build fix for DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE).
 615
 616         * dfg/DFGStructureCheckHoistingPhase.cpp:
 617         (JSC::DFG::StructureCheckHoistingPhase::run):
 618
 619 2012-08-01  Mark Hahnenberg  <mhahnenberg@apple.com>
 620
 621         Remove all uses of ClassInfo for JSStrings in JIT code
 622         https://bugs.webkit.org/show_bug.cgi?id=92935
 623
 624         Reviewed by Geoffrey Garen.
 625
 626         This is the first step in removing our dependence on in-object ClassInfo pointers
 627         in JIT code. Most of the changes are to check the Structure, which is unique for
 628         JSString primitives.
 629
 630         * bytecode/SpeculatedType.cpp:
 631         (JSC::speculationFromClassInfo):
 632         (JSC::speculationFromStructure): Changed to check the TypeInfo in the Structure
 633         since there wasn't a JSGlobalData immediately available to grab the JSString
 634         Structure out of.
 635         * dfg/DFGSpeculativeJIT.cpp:
 636         (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
 637         * dfg/DFGSpeculativeJIT32_64.cpp:
 638         (JSC::DFG::SpeculativeJIT::compile):
 639         * dfg/DFGSpeculativeJIT64.cpp:
 640         (JSC::DFG::SpeculativeJIT::compile):
 641         * jit/JITInlineMethods.h:
 642         (JSC::JIT::emitLoadCharacterString):
 643         * jit/JITOpcodes.cpp:
 644         (JSC::JIT::privateCompileCTIMachineTrampolines):
 645         (JSC::JIT::emit_op_to_primitive):
 646         (JSC::JIT::emit_op_convert_this):
 647         * jit/JITOpcodes32_64.cpp:
 648         (JSC::JIT::privateCompileCTIMachineTrampolines):
 649         (JSC::JIT::emit_op_to_primitive):
 650         (JSC::JIT::emitSlow_op_eq):
 651         (JSC::JIT::emitSlow_op_neq):
 652         (JSC::JIT::compileOpStrictEq):
 653         (JSC::JIT::emit_op_convert_this):
 654         * jit/JITPropertyAccess.cpp:
 655         (JSC::JIT::stringGetByValStubGenerator):
 656         (JSC::JIT::emitSlow_op_get_by_val):
 657         * jit/JITPropertyAccess32_64.cpp:
 658         (JSC::JIT::stringGetByValStubGenerator):
 659         (JSC::JIT::emitSlow_op_get_by_val):
 660         * jit/SpecializedThunkJIT.h:
 661         (JSC::SpecializedThunkJIT::loadJSStringArgument):
 662         * jit/ThunkGenerators.cpp:
 663         (JSC::stringCharLoad):
 664         (JSC::charCodeAtThunkGenerator):
 665         (JSC::charAtThunkGenerator):
 666
 667 2012-08-02  Filip Pizlo  <fpizlo@apple.com>
 668
 669         Unreviewed, missed a style goof in the previous patch: "NodeIndex nodeIndex"
 670         in a method signature is painfully redundant.
 671
 672         * dfg/DFGSpeculativeJIT.h:
 673         (SpeculativeJIT):
 674
 675 2012-08-02  Filip Pizlo  <fpizlo@apple.com>
 676
 677         DFGSpeculativeJIT.h has too many inline method bodies
 678         https://bugs.webkit.org/show_bug.cgi?id=92957
 679
 680         Reviewed by Antti Koivisto.
 681
 682         * dfg/DFGSpeculativeJIT.cpp:
 683         (JSC::DFG::SpeculativeJIT::speculationCheck):
 684         (DFG):
 685         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
 686         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
 687         (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection):
 688         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
 689         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
 690         * dfg/DFGSpeculativeJIT.h:
 691         (SpeculativeJIT):
 692
 693 2012-08-01  Filip Pizlo  <fpizlo@apple.com>
 694
 695         DFG should hoist structure checks
 696         https://bugs.webkit.org/show_bug.cgi?id=92696
 697
 698         Reviewed by Gavin Barraclough.
 699
 700         This hoists structure checks in the same way that we would hoist array checks, but with added
 701         complexity to cope with the fact that the structure of an object may change. This is handled
 702         by performing a side effects analysis over the region in which the respective variable is
 703         live. If a structure clobbering side effect may happen then we either hoist the structure
 704         checks and fall back on structure transition watchpoints (if the watchpoint set is still
 705         valid), or we avoid hoisting altogether.
 706
 707         Doing this required teaching the CFA that we may have an expectation that an object has a
 708         particular structure even after structure clobbering happens, in the sense that structure
 709         proofs that were cobbered can be revived using watchpoints. CFA must know about this so that
 710         OSR entry may know about it, since we cannot allow entry to happen if the variable has a
 711         clobbered structure proof, will have a watchpoint to revive the proof, and the variable in
 712         the baseline JIT has a completely unrelated structure.
 713
 714         This is mostly performance neutral.
 715
 716         * CMakeLists.txt:
 717         * GNUmakefile.list.am:
 718         * JavaScriptCore.xcodeproj/project.pbxproj:
 719         * Target.pri:
 720         * bytecode/ValueRecovery.h:
 721         (JSC::ValueRecovery::isSet):
 722         (JSC::ValueRecovery::operator!):
 723         (ValueRecovery):
 724         * dfg/DFGAbstractState.cpp:
 725         (JSC::DFG::AbstractState::execute):
 726         (JSC::DFG::AbstractState::clobberWorld):
 727         (DFG):
 728         (JSC::DFG::AbstractState::clobberCapturedVars):
 729         * dfg/DFGAbstractState.h:
 730         (AbstractState):
 731         * dfg/DFGAbstractValue.h:
 732         (JSC::DFG::AbstractValue::clear):
 733         (JSC::DFG::AbstractValue::isClear):
 734         (JSC::DFG::AbstractValue::makeTop):
 735         (JSC::DFG::AbstractValue::isTop):
 736         (JSC::DFG::AbstractValue::set):
 737         (JSC::DFG::AbstractValue::operator==):
 738         (JSC::DFG::AbstractValue::merge):
 739         (JSC::DFG::AbstractValue::filter):
 740         (JSC::DFG::AbstractValue::validate):
 741         (JSC::DFG::AbstractValue::validateForEntry):
 742         (AbstractValue):
 743         (JSC::DFG::AbstractValue::checkConsistency):
 744         (JSC::DFG::AbstractValue::dump):
 745         * dfg/DFGByteCodeParser.cpp:
 746         (JSC::DFG::ByteCodeParser::setLocal):
 747         (JSC::DFG::ByteCodeParser::getArgument):
 748         (JSC::DFG::ByteCodeParser::setArgument):
 749         (JSC::DFG::ByteCodeParser::parseBlock):
 750         (JSC::DFG::ByteCodeParser::fixVariableAccessSpeculations):
 751         * dfg/DFGCSEPhase.cpp:
 752         (JSC::DFG::CSEPhase::checkStructureLoadElimination):
 753         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
 754         (JSC::DFG::CSEPhase::putStructureStoreElimination):
 755         (JSC::DFG::CSEPhase::getLocalLoadElimination):
 756         (JSC::DFG::CSEPhase::performNodeCSE):
 757         * dfg/DFGDriver.cpp:
 758         (JSC::DFG::compile):
 759         * dfg/DFGGraph.cpp:
 760         (JSC::DFG::Graph::dump):
 761         * dfg/DFGGraph.h:
 762         (JSC::DFG::Graph::vote):
 763         (Graph):
 764         * dfg/DFGNode.h:
 765         (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
 766         (Node):
 767         (JSC::DFG::Node::hasStructureSet):
 768         * dfg/DFGNodeType.h:
 769         (DFG):
 770         * dfg/DFGOSREntry.cpp:
 771         (JSC::DFG::prepareOSREntry):
 772         * dfg/DFGPredictionPropagationPhase.cpp:
 773         (JSC::DFG::PredictionPropagationPhase::propagate):
 774         (PredictionPropagationPhase):
 775         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
 776         * dfg/DFGSpeculativeJIT.h:
 777         (SpeculativeJIT):
 778         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
 779         (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection):
 780         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection):
 781         (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand):
 782         (JSC::DFG::SpeculateCellOperand::gpr):
 783         (SpeculateCellOperand):
 784         * dfg/DFGSpeculativeJIT32_64.cpp:
 785         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
 786         (JSC::DFG::SpeculativeJIT::compile):
 787         * dfg/DFGSpeculativeJIT64.cpp:
 788         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
 789         (JSC::DFG::SpeculativeJIT::compile):
 790         * dfg/DFGStructureCheckHoistingPhase.cpp: Added.
 791         (DFG):
 792         (StructureCheckHoistingPhase):
 793         (JSC::DFG::StructureCheckHoistingPhase::StructureCheckHoistingPhase):
 794         (JSC::DFG::StructureCheckHoistingPhase::run):
 795         (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck):
 796         (JSC::DFG::StructureCheckHoistingPhase::noticeClobber):
 797         (JSC::DFG::StructureCheckHoistingPhase::clobber):
 798         (CheckData):
 799         (JSC::DFG::StructureCheckHoistingPhase::CheckData::CheckData):
 800         (JSC::DFG::performStructureCheckHoisting):
 801         * dfg/DFGStructureCheckHoistingPhase.h: Added.
 802         (DFG):
 803         * dfg/DFGVariableAccessData.h:
 804         (VariableAccessData):
 805         (JSC::DFG::VariableAccessData::VariableAccessData):
 806         (JSC::DFG::VariableAccessData::mergeStructureCheckHoistingFailed):
 807         (JSC::DFG::VariableAccessData::structureCheckHoistingFailed):
 808         (JSC::DFG::VariableAccessData::clearVotes):
 809         (JSC::DFG::VariableAccessData::vote):
 810         (JSC::DFG::VariableAccessData::voteRatio):
 811         (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
 812         * runtime/Options.h:
 813         (JSC):
 814
 815 2012-08-01  Filip Pizlo  <fpizlo@apple.com>
 816
 817         DFG should distinguish between PutByVal's that clobber the world and ones that don't
 818         https://bugs.webkit.org/show_bug.cgi?id=92923
 819
 820         Reviewed by Mark Hahnenberg.
 821
 822         This is performance-neutral. I also confirmed that it's neutral if we make the
 823         clobbering variant (PutByValSafe) clobber all knowledge of what is an array,
 824         which should feed nicely into work on removing uses of ClassInfo.
 825
 826         * bytecode/DFGExitProfile.h:
 827         * dfg/DFGAbstractState.cpp:
 828         (JSC::DFG::AbstractState::execute):
 829         * dfg/DFGByteCodeParser.cpp:
 830         (JSC::DFG::ByteCodeParser::parseBlock):
 831         * dfg/DFGCSEPhase.cpp:
 832         (JSC::DFG::CSEPhase::getByValLoadElimination):
 833         (JSC::DFG::CSEPhase::checkStructureLoadElimination):
 834         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
 835         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
 836         (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
 837         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
 838         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
 839         (JSC::DFG::CSEPhase::performNodeCSE):
 840         * dfg/DFGFixupPhase.cpp:
 841         (JSC::DFG::FixupPhase::fixupNode):
 842         * dfg/DFGGraph.h:
 843         (JSC::DFG::Graph::byValIsPure):
 844         (JSC::DFG::Graph::clobbersWorld):
 845         * dfg/DFGNodeType.h:
 846         (DFG):
 847         * dfg/DFGPredictionPropagationPhase.cpp:
 848         (JSC::DFG::PredictionPropagationPhase::propagate):
 849         * dfg/DFGSpeculativeJIT32_64.cpp:
 850         (JSC::DFG::SpeculativeJIT::compile):
 851         * dfg/DFGSpeculativeJIT64.cpp:
 852         (JSC::DFG::SpeculativeJIT::compile):
 853
 854 2012-08-01  Mark Hahnenberg  <mhahnenberg@apple.com>
 855
 856         C++ code should get ClassInfo from the Structure
 857         https://bugs.webkit.org/show_bug.cgi?id=92892
 858
 859         Reviewed by Geoffrey Garen.
 860
 861         In our march to remove ClassInfo from our JSCell object headers, we can switch
 862         C++ code over to grabbing the ClassInfo from the Structure since it is finally
 863         safe to do so now that Structure access is safe during finalization/destruction.
 864         The remaining JIT code changes can be done in a separate patch.
 865
 866         * heap/MarkedBlock.cpp:
 867         (JSC::MarkedBlock::callDestructor): We don't want to clear the Structure any more
 868         since the Structure should still be valid at this point.
 869         * heap/WeakSetInlines.h:
 870         (JSC::WeakBlock::finalize): Ditto.
 871         * runtime/JSCell.h:
 872         (JSC):
 873         * runtime/Structure.h:
 874         (JSC::JSCell::classInfo): Move JSCell's classInfo() to Structure.h so it can be
 875         inline. Use a different method of getting the JSCell's Structure based on
 876         whether we're in GC_VALIDATION mode or not, since always using get() will cause
 877         infinite recursion in GC_VALIDATION mode.
 878         (JSC):
 879
 880 2012-07-31  Mark Hahnenberg  <mhahnenberg@apple.com>
 881
 882         MarkedBlock::sweep() should sweep another block if it can't sweep a Structure block
 883         https://bugs.webkit.org/show_bug.cgi?id=92819
 884
 885         Reviewed by Geoffrey Garen.
 886
 887         If we are forced to allocate a new block for Structures because we are unable to safely
 888         sweep our pre-existing Structure blocks, we should sweep another random block so that we
 889         can start sweeping Structure blocks sooner.
 890
 891         * heap/IncrementalSweeper.cpp:
 892         (JSC::IncrementalSweeper::doSweep): Change to use sweepNextBlock.
 893         (JSC):
 894         (JSC::IncrementalSweeper::sweepNextBlock):
 895         * heap/IncrementalSweeper.h:
 896         (IncrementalSweeper):
 897         * heap/MarkedAllocator.cpp:
 898         (JSC::MarkedAllocator::tryAllocateHelper): When we can't safely sweep
 899         our Structure blocks, call sweepNextBlock instead.
 900
 901 2012-07-31  Sam Weinig  <sam@webkit.org>
 902
 903         Fix the Windows build.
 904
 905         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
 906
 907 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 908
 909         Maybe fix the GCC build.
 910
 911         * heap/HeapBlock.h:
 912         (HeapBlock): Accommodate incorrect parsing in GCC.
 913
 914 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 915
 916         Maybe break the Windows build.
 917
 918         Reviewed by Anders Carlsson.
 919
 920         Formally objected to by Sam Weinig.
 921
 922         * heap/HeapBlock.h:
 923         (HeapBlock): Try to slightly improve this because we don't want Windows to control our lives.
 924
 925 2012-07-30  Mark Hahnenberg  <mhahnenberg@apple.com>
 926
 927         Structures should be swept after all other objects
 928         https://bugs.webkit.org/show_bug.cgi?id=92679
 929
 930         Reviewed by Filip Pizlo.
 931
 932         In order to get rid of ClassInfo from our objects, we need to be able to safely get the
 933         ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the
 934         Structure, but currently it is not safe to do so because the order of destruction of objects
 935         is not guaranteed to sweep objects before their corresponding Structure. We can fix this by
 936         sweeping Structures after everything else.
 937
 938         * heap/Heap.cpp:
 939         (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures.
 940         If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is
 941         safe to sweep structures since we'll always do Structures last anyways due to the ordering of
 942         MarkedSpace::forEachBlock.
 943         (JSC):
 944         (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now
 945         calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out
 946         these pointers after it has invalidated them to prevent accidental use-after-free in the sweep()
 947         calls during lastChanceToFinalize().
 948         * heap/Heap.h:
 949         (Heap):
 950         * heap/HeapTimer.h:
 951         (HeapTimer):
 952         * heap/IncrementalSweeper.cpp:
 953         (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures.
 954         This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping
 955         the first time.
 956         (JSC):
 957         (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we
 958         make our first pass. We now null out the slots as we sweep them so that we can quickly find the
 959         Structures during the second pass.
 960         (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index.
 961         (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify
 962         the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can
 963         assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock
 964         iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds.
 965         (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index.
 966         * heap/IncrementalSweeper.h: Add declarations for new stuff.
 967         (IncrementalSweeper):
 968         * heap/MarkedAllocator.cpp:
 969         (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and
 970         if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing
 971         the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that
 972         will sweep some number of other blocks in place of the current block to mitigate the cost of the floating
 973         Structure garbage.
 974         (JSC::MarkedAllocator::addBlock):
 975         * heap/MarkedAllocator.h:
 976         (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no
 977         longer valid to allocate from, so we set the current block to null.
 978         * heap/MarkedBlock.cpp:
 979         (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures
 980         at an unsafe time.
 981         * heap/MarkedSpace.cpp:
 982         (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping.
 983         (JSC):
 984         * heap/MarkedSpace.h:
 985         (JSC):
 986         * runtime/JSGlobalData.cpp:
 987         (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown.
 988
 989 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 990
 991         Fix all the other builds I just broke. Maybe fix the Windows build.
 992
 993         * heap/HeapBlock.h:
 994         (HeapBlock): WTF?
 995
 996 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
 997
 998         Maybe fix the Windows build.
 999
1000         * heap/HeapBlock.h:
1001         (HeapBlock): WTF?
1002
1003 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
1004
1005         Maybe fix the Windows build.
1006
1007         * heap/HeapBlock.h:
1008         (HeapBlock): WTF?
1009
1010 2012-07-31  Geoffrey Garen  <ggaren@apple.com>
1011
1012         Removed some public data and casting from the Heap
1013         https://bugs.webkit.org/show_bug.cgi?id=92777
1014
1015         Reviewed by Oliver Hunt.
1016
1017         * heap/BlockAllocator.cpp:
1018         (JSC::BlockAllocator::releaseFreeBlocks):
1019         (JSC::BlockAllocator::blockFreeingThreadMain): Use the DeadBlock class
1020         since HeapBlock is a template, and not a class, now. Call destroy()
1021         instead of monkeying around with DeadBlock's internal data because
1022         encapsulation is good.
1023
1024         * heap/BlockAllocator.h:
1025         (DeadBlock): Added a class to represent a dead block, since HeapBlock is
1026         a template now, and can't be instantiated directly.
1027
1028         (JSC::DeadBlock::DeadBlock):
1029         (JSC::DeadBlock::create):
1030         (BlockAllocator):
1031         (JSC::BlockAllocator::allocate):
1032         (JSC::BlockAllocator::deallocate): Use the DeadBlock class because
1033         encapsulation is good.
1034
1035         * heap/CopiedBlock.h:
1036         (CopiedBlock::destroy): No need for a destroy() function, since we
1037         inherit one now.
1038
1039         (JSC::CopiedBlock::CopiedBlock):
1040         (JSC::CopiedBlock::payloadEnd):
1041         (JSC::CopiedBlock::capacity): Updated for some encapsulation inside
1042         HeapBlock.
1043
1044         * heap/CopiedSpace.cpp:
1045         (JSC::CopiedSpace::~CopiedSpace):
1046         (JSC::CopiedSpace::doneCopying):
1047         (JSC::CopiedSpace::size):
1048         (JSC::CopiedSpace::capacity):
1049         (JSC::isBlockListPagedOut): Removed a bunch of casting. This is no longer
1050         necessary, now that our list and its nodes have the right type.
1051
1052         * heap/CopiedSpace.h: Use the right type in our data structures because
1053         it improves clarity.
1054
1055         * heap/CopiedSpaceInlineMethods.h:
1056         (JSC::CopiedSpace::startedCopying): Use swap to avoid duplicating it.
1057
1058         * heap/HeapBlock.h:
1059         (HeapBlock): Made this a class template so we can return the right type
1060         in linked list operations. Made our data private because encapsulation
1061         is good.
1062
1063         (JSC::HeapBlock::destroy): Since we know our type, we can also eliminate
1064         duplicate destroy() functions in our subclasses.
1065
1066         (JSC::HeapBlock::allocation): Added an accessor so we can hide our data.
1067         By using const, this accessor prevents clients from accidentally deleting
1068         our allocation.
1069
1070         * heap/MarkedAllocator.cpp:
1071         (JSC::MarkedAllocator::isPagedOut):
1072         (JSC::MarkedAllocator::tryAllocateHelper):
1073         (JSC::MarkedAllocator::removeBlock): Removed a bunch of casting. This is
1074         no longer necessary, now that our list and its nodes have the right type.
1075
1076         * heap/MarkedAllocator.h:
1077         (MarkedAllocator):
1078         (JSC::MarkedAllocator::reset):
1079         (JSC::MarkedAllocator::forEachBlock): Use the right type, do less casting.
1080
1081         * heap/MarkedBlock.cpp:
1082         (JSC::MarkedBlock::destroy): Removed this function because our parent
1083         class provides it for us now.
1084
1085         (JSC::MarkedBlock::MarkedBlock):
1086         * heap/MarkedBlock.h:
1087         (MarkedBlock):
1088         (JSC::MarkedBlock::capacity): Updated for encapsulation.
1089
1090 2012-07-31  Filip Pizlo  <fpizlo@apple.com>
1091
1092         DFG OSR exit profiling has unusual oversights
1093         https://bugs.webkit.org/show_bug.cgi?id=92728
1094
1095         Reviewed by Geoffrey Garen.
1096
1097         * dfg/DFGOSRExit.cpp:
1098         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
1099         * dfg/DFGSpeculativeJIT.h:
1100         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
1101         * dfg/DFGSpeculativeJIT32_64.cpp:
1102         (JSC::DFG::SpeculativeJIT::compile):
1103         * dfg/DFGSpeculativeJIT64.cpp:
1104         (JSC::DFG::SpeculativeJIT::compile):
1105
1106 2012-07-31  Chao-ying Fu  <fu@mips.com>
1107
1108         Add MIPS add32 function
1109         https://bugs.webkit.org/show_bug.cgi?id=91522
1110
1111         Reviewed by Oliver Hunt.
1112
1113         Add isCompactPtrAlignedAddressOffset.
1114         Add a new version of add32 that accepts AbsoluteAddress as inputs.
1115
1116         * assembler/MacroAssemblerMIPS.h:
1117         (JSC::MacroAssemblerMIPS::isCompactPtrAlignedAddressOffset): New.
1118         (MacroAssemblerMIPS):
1119         (JSC::MacroAssemblerMIPS::add32): Support AbsoluteAddress as inputs.
1120
1121 2012-07-30  Sheriff Bot  <webkit.review.bot@gmail.com>
1122
1123         Unreviewed, rolling out r124123.
1124         http://trac.webkit.org/changeset/124123
1125         https://bugs.webkit.org/show_bug.cgi?id=92700
1126
1127         ASSERT crashes terminate webkit Layout tests (Requested by
1128         msaboff on #webkit).
1129
1130         * heap/Heap.cpp:
1131         * heap/Heap.h:
1132         (Heap):
1133         * heap/IncrementalSweeper.cpp:
1134         (JSC::IncrementalSweeper::doSweep):
1135         (JSC::IncrementalSweeper::startSweeping):
1136         (JSC::IncrementalSweeper::IncrementalSweeper):
1137         (JSC):
1138         * heap/IncrementalSweeper.h:
1139         (IncrementalSweeper):
1140         * heap/MarkedAllocator.cpp:
1141         (JSC::MarkedAllocator::tryAllocateHelper):
1142         (JSC::MarkedAllocator::addBlock):
1143         * heap/MarkedAllocator.h:
1144         (JSC::MarkedAllocator::zapFreeList):
1145         * heap/MarkedBlock.cpp:
1146         (JSC::MarkedBlock::sweepHelper):
1147         * heap/MarkedSpace.cpp:
1148         * heap/MarkedSpace.h:
1149         (JSC::MarkedSpace::sweep):
1150         (JSC):
1151         * runtime/JSGlobalData.cpp:
1152         (JSC::JSGlobalData::~JSGlobalData):
1153
1154 2012-07-30  Mark Hahnenberg  <mhahnenberg@apple.com>
1155
1156         Structures should be swept after all other objects
1157         https://bugs.webkit.org/show_bug.cgi?id=92679
1158
1159         Reviewed by Filip Pizlo.
1160
1161         In order to get rid of ClassInfo from our objects, we need to be able to safely get the
1162         ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the
1163         Structure, but currently it is not safe to do so because the order of destruction of objects
1164         is not guaranteed to sweep objects before their corresponding Structure. We can fix this by
1165         sweeping Structures after everything else.
1166
1167         * heap/Heap.cpp:
1168         (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures.
1169         If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is
1170         safe to sweep structures since we'll always do Structures last anyways due to the ordering of
1171         MarkedSpace::forEachBlock.
1172         (JSC):
1173         (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now
1174         calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out
1175         these pointers after it has invalidated them to prevent accidental use-after-free in the sweep()
1176         calls during lastChanceToFinalize().
1177         * heap/Heap.h:
1178         (Heap):
1179         * heap/HeapTimer.h:
1180         (HeapTimer):
1181         * heap/IncrementalSweeper.cpp:
1182         (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures.
1183         This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping
1184         the first time.
1185         (JSC):
1186         (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we
1187         make our first pass. We now null out the slots as we sweep them so that we can quickly find the
1188         Structures during the second pass.
1189         (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index.
1190         (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify
1191         the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can
1192         assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock
1193         iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds.
1194         (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index.
1195         * heap/IncrementalSweeper.h: Add declarations for new stuff.
1196         (IncrementalSweeper):
1197         * heap/MarkedAllocator.cpp:
1198         (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and
1199         if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing
1200         the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that
1201         will sweep some number of other blocks in place of the current block to mitigate the cost of the floating
1202         Structure garbage.
1203         (JSC::MarkedAllocator::addBlock):
1204         * heap/MarkedAllocator.h:
1205         (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no
1206         longer valid to allocate from, so we set the current block to null.
1207         * heap/MarkedBlock.cpp:
1208         (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures
1209         at an unsafe time.
1210         * heap/MarkedSpace.cpp:
1211         (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping.
1212         (JSC):
1213         * heap/MarkedSpace.h:
1214         (JSC):
1215         * runtime/JSGlobalData.cpp:
1216         (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown.
1217
1218 2012-07-29  Filip Pizlo  <fpizlo@apple.com>
1219
1220         PropertyNameArray::m_shouldCache is only assigned and never used
1221         https://bugs.webkit.org/show_bug.cgi?id=92598
1222
1223         Reviewed by Dan Bernstein.
1224
1225         * runtime/PropertyNameArray.h:
1226         (JSC::PropertyNameArray::PropertyNameArray):
1227         (PropertyNameArray):
1228
1229 2012-07-29  Rik Cabanier  <cabanier@adobe.com>
1230
1231         Add ENABLE_CSS_COMPOSITING flag
1232         https://bugs.webkit.org/show_bug.cgi?id=92553
1233
1234         Reviewed by Dirk Schulze.
1235
1236         Adds compiler flag CSS_COMPOSITING to build systems to enable CSS blending and compositing. See spec https://dvcs.w3.org/hg/FXTF/rawfile/tip/compositing/index.html
1237
1238         * Configurations/FeatureDefines.xcconfig:
1239
1240 2012-07-27  Mark Hahnenberg  <mhahnenberg@apple.com>
1241
1242         Split functionality of MarkedAllocator::m_currentBlock
1243         https://bugs.webkit.org/show_bug.cgi?id=92550
1244
1245         Reviewed by Filip Pizlo.
1246
1247         MarkedAllocator::m_currentBlock serves two purposes right now; it indicates the block that is currently
1248         being used for allocation and the beginning of the list of blocks that need to be swept. We should split
1249         these two functionalities into two separate fields.
1250
1251         * heap/MarkedAllocator.cpp:
1252         (JSC::MarkedAllocator::tryAllocateHelper): Use m_blocksToSweep instead of m_currentBlock as the
1253         initializer/reference of the loop. Only change m_currentBlock when we know what the result will be.
1254         (JSC::MarkedAllocator::addBlock): When we add a new block we know that both m_blocksToSweep and
1255         m_currentBlock are null. In order to preserve the invariant that m_currentBlock <= m_blocksToSweep,
1256         we assign both of them to point to the new block.
1257         (JSC::MarkedAllocator::removeBlock): We need a separate check to see if the block we're removing is
1258         m_blocksToSweep and if so, advance it to the next block in the list.
1259         * heap/MarkedAllocator.h:
1260         (MarkedAllocator): Initialize m_blocksToSweep.
1261         (JSC::MarkedAllocator::MarkedAllocator):
1262         (JSC::MarkedAllocator::reset): We set m_blocksToSweep to be the head of our list. This function is called
1263         at the end of a collection, so all of the blocks in our allocator need to be swept. We need to sweep a
1264         block before we can start allocating, so m_currentBlock is set to null. We also set the freeList to
1265         the empty FreeList to emphasize the fact that we can't start allocating until we do some sweeping.
1266
1267 2012-07-27  Mark Hahnenberg  <mhahnenberg@apple.com>
1268
1269         Increase inline storage for JSFinalObjects by one
1270         https://bugs.webkit.org/show_bug.cgi?id=92526
1271
1272         Reviewed by Geoffrey Garen.
1273
1274         Now that we've removed the inheritorID from objects, we can increase our inline storage for JSFinalObjects on
1275         64-bit platforms by 1.
1276
1277         * llint/LowLevelInterpreter.asm: Change the constant.
1278         * runtime/PropertyOffset.h: Change the constant.
1279         (JSC):
1280
1281 2012-07-27  Jer Noble  <jer.noble@apple.com>
1282
1283         Support a rational time class for use by media elements.
1284         https://bugs.webkit.org/show_bug.cgi?id=88787
1285
1286         Re-export WTF::MediaTime from JavaScriptCore.
1287
1288         Reviewed by Eric Carlson.
1289
1290         * JavaScriptCore.order:
1291         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1292
1293 2012-07-26  Filip Pizlo  <fpizlo@apple.com>
1294
1295         JSObject::reallocateStorageIfNecessary is neither used nor defined
1296         https://bugs.webkit.org/show_bug.cgi?id=92417
1297
1298         Reviewed by Mark Rowe.
1299
1300         * runtime/JSObject.h:
1301         (JSObject):
1302
1303 2012-07-26  Mark Hahnenberg  <mhahnenberg@apple.com>
1304
1305         Allocate Structures in a separate part of the Heap
1306         https://bugs.webkit.org/show_bug.cgi?id=92420
1307
1308         Reviewed by Filip Pizlo.
1309
1310         To fix our issue with destruction/finalization of Structures before their objects, we can move Structures to a separate
1311         part of the Heap that will be swept after all other objects. This first patch will just be separating Structures
1312         out into their own separate MarkedAllocator. Everything else will behave identically.
1313
1314         * heap/Heap.h: New function to allocate Structures in the Heap.
1315         (Heap):
1316         (JSC):
1317         (JSC::Heap::allocateStructure):
1318         * heap/MarkedAllocator.cpp: Pass whether or not we're allocated Structures to the MarkedBlock.
1319         (JSC::MarkedAllocator::allocateBlock):
1320         * heap/MarkedAllocator.h: Add tracking for whether or not we're allocating only Structures.
1321         (JSC::MarkedAllocator::onlyContainsStructures):
1322         (MarkedAllocator):
1323         (JSC::MarkedAllocator::MarkedAllocator):
1324         (JSC::MarkedAllocator::init):
1325         * heap/MarkedBlock.cpp: Add tracking for whether or not we're allocating only Structures. We need this to be able to
1326         distinguish the various MarkedBlock types in MarkedSpace::allocatorFor(MarkedBlock*).
1327         (JSC::MarkedBlock::create):
1328         (JSC::MarkedBlock::MarkedBlock):
1329         * heap/MarkedBlock.h:
1330         (MarkedBlock):
1331         (JSC::MarkedBlock::onlyContainsStructures):
1332         (JSC):
1333         * heap/MarkedSpace.cpp: Include the new Structure allocator in all the places that all the other allocators are used/modified.
1334         (JSC::MarkedSpace::MarkedSpace):
1335         (JSC::MarkedSpace::resetAllocators):
1336         (JSC::MarkedSpace::canonicalizeCellLivenessData):
1337         (JSC::MarkedSpace::isPagedOut):
1338         * heap/MarkedSpace.h: Add new MarkedAllocator just for Structures.
1339         (MarkedSpace):
1340         (JSC::MarkedSpace::allocatorFor):
1341         (JSC::MarkedSpace::allocateStructure):
1342         (JSC):
1343         (JSC::MarkedSpace::forEachBlock):
1344         * runtime/Structure.h: Move all of the functions that call allocateCell<Structure> down below the explicit template specialization
1345         for allocateCell<Structure>. The new inline specialization for allocateCell directly calls the allocateStructure() function in the
1346         Heap.
1347         (Structure):
1348         (JSC::Structure):
1349         (JSC):
1350         (JSC::Structure::create):
1351         (JSC::Structure::createStructure):
1352
1353 2012-07-26  Filip Pizlo  <fpizlo@apple.com>
1354
1355         JSArray has methods that are neither used nor defined
1356         https://bugs.webkit.org/show_bug.cgi?id=92416
1357
1358         Reviewed by Simon Fraser.
1359
1360         * runtime/JSArray.h:
1361         (JSArray):
1362
1363 2012-07-26  Zoltan Herczeg  <zherczeg@webkit.org>
1364
1365         [Qt][ARM]ARMAssembler needs buildfix afert r123417
1366         https://bugs.webkit.org/show_bug.cgi?id=92086
1367
1368         Reviewed by Csaba Osztrogonác.
1369
1370         The ARM implementation of this should be optimized code path
1371         is covered by a non-optimized code path. This patch fixes this,
1372         and adds a new function which returns with the offset range.
1373
1374         * assembler/ARMAssembler.h:
1375         (JSC::ARMAssembler::readPointer):
1376         (ARMAssembler):
1377         (JSC::ARMAssembler::repatchInt32):
1378         (JSC::ARMAssembler::repatchCompact):
1379         * assembler/MacroAssemblerARM.h:
1380         (MacroAssemblerARM):
1381         (JSC::MacroAssemblerARM::isCompactPtrAlignedAddressOffset):
1382         (JSC::MacroAssemblerARM::load32WithCompactAddressOffsetPatch):
1383
1384 2012-07-25  Mark Hahnenberg  <mhahnenberg@apple.com>
1385
1386         Build fix for 32-bit after r123682
1387
1388         * runtime/JSObject.h: Need to pad out JSObjects on 32-bit so that they're the correct size since
1389         we only removed one 4-byte word and we need to be 8-byte aligned.
1390         (JSObject):
1391
1392 2012-07-25  Filip Pizlo  <fpizlo@apple.com>
1393
1394         JSC GC object copying APIs should allow for greater flexibility
1395         https://bugs.webkit.org/show_bug.cgi?id=92316
1396
1397         Reviewed by Mark Hahnenberg.
1398
1399         It's now the case that visitChildren() methods can directly pin and allocate in new space during copying.
1400         They can also do the copying and marking themselves. This new API is only used for JSObjects for now.
1401
1402         * JavaScriptCore.xcodeproj/project.pbxproj:
1403         * heap/MarkStack.cpp:
1404         (JSC::SlotVisitor::allocateNewSpaceSlow):
1405         (JSC::SlotVisitor::allocateNewSpaceOrPin):
1406         (JSC):
1407         (JSC::SlotVisitor::copyAndAppend):
1408         * heap/MarkStack.h:
1409         (MarkStack):
1410         (JSC::MarkStack::appendUnbarrieredValue):
1411         (JSC):
1412         * heap/SlotVisitor.h:
1413         * heap/SlotVisitorInlineMethods.h: Added.
1414         (JSC):
1415         (JSC::SlotVisitor::checkIfShouldCopyAndPinOtherwise):
1416         (JSC::SlotVisitor::allocateNewSpace):
1417         * runtime/JSObject.cpp:
1418         (JSC::JSObject::visitOutOfLineStorage):
1419         (JSC):
1420         (JSC::JSObject::visitChildren):
1421         (JSC::JSFinalObject::visitChildren):
1422         * runtime/JSObject.h:
1423         (JSObject):
1424
1425 2012-07-25  Mark Hahnenberg  <mhahnenberg@apple.com>
1426
1427         Remove JSObject::m_inheritorID
1428         https://bugs.webkit.org/show_bug.cgi?id=88378
1429
1430         Reviewed by Filip Pizlo.
1431
1432         This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
1433         and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
1434         Instead use a private named value in the object's property storage.
1435
1436         * dfg/DFGSpeculativeJIT.h:
1437         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): No need m_inheritorID to initialize!
1438         * jit/JITInlineMethods.h:
1439         (JSC::JIT::emitAllocateBasicJSObject): No need m_inheritorID to initialize!
1440         * llint/LowLevelInterpreter.asm: No need m_inheritorID to initialize!
1441         * runtime/JSGlobalData.h:
1442         (JSGlobalData): Added private name 'm_inheritorIDKey'.
1443         * runtime/JSGlobalThis.cpp:
1444         (JSC::JSGlobalThis::setUnwrappedObject): resetInheritorID is now passed a JSGlobalData&.
1445         * runtime/JSObject.cpp:
1446         (JSC::JSObject::visitChildren): No m_inheritorID to be marked.
1447         (JSC::JSFinalObject::visitChildren): No m_inheritorID to be marked.
1448         (JSC::JSObject::createInheritorID): Store the newly created inheritorID in the property map. Make sure
1449         it's got the DontEnum attribute!!
1450         * runtime/JSObject.h:
1451         (JSObject):
1452         (JSC::JSObject::resetInheritorID): Remove the inheritorID from property storage.
1453         (JSC):
1454         (JSC::JSObject::inheritorID): Read the inheritorID from property storage.
1455
1456 2012-07-25  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
1457
1458         Create a specialized pair for use in HashMap iterators
1459         https://bugs.webkit.org/show_bug.cgi?id=92137
1460
1461         Reviewed by Ryosuke Niwa.
1462
1463         Update a couple of sites that relied on the fact that "contents" of iterators were
1464         std::pairs.
1465
1466         * profiler/Profile.cpp:
1467         (JSC): This code kept a vector of the pairs that were the "contents" of the iterators. This
1468         is changed to use a KeyValuePair. We make use HashCount's ValueType (which represents only
1469         the key) to get the proper key parameter for KeyValuePair.
1470         * tools/ProfileTreeNode.h:
1471         (ProfileTreeNode): Use HashMap::ValueType to declare the type of the contents of the hash
1472         instead of declaring it manually. This will make use of the new KeyValuePair.
1473
1474 2012-07-25  Patrick Gansterer  <paroga@webkit.org>
1475
1476         REGRESSION(r123505): Date.getYear() returns the same as Date.getFullYear()
1477         https://bugs.webkit.org/show_bug.cgi?id=92218
1478
1479         Reviewed by Csaba Osztrogonác.
1480
1481         * runtime/DatePrototype.cpp:
1482         (JSC::dateProtoFuncGetYear): Added the missing offset of 1900 to the return value.
1483
1484 2012-07-24  Filip Pizlo  <fpizlo@apple.com>
1485
1486         REGRESSION(r123417): It made tests assert/crash on 32 bit
1487         https://bugs.webkit.org/show_bug.cgi?id=92088
1488
1489         Reviewed by Mark Hahnenberg.
1490
1491         The pointer arithmetic was wrong, because negative numbers are hard to think about.
1492
1493         * dfg/DFGRepatch.cpp:
1494         (JSC::DFG::emitPutTransitionStub):
1495         * dfg/DFGSpeculativeJIT.cpp:
1496         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
1497
1498 2012-07-24  Patrick Gansterer  <paroga@webkit.org>
1499
1500         Store the full year in GregorianDateTime
1501         https://bugs.webkit.org/show_bug.cgi?id=92067
1502
1503         Reviewed by Geoffrey Garen.
1504
1505         Use the full year instead of the offset from year 1900
1506         for the year member variable of GregorianDateTime.
1507
1508         * runtime/DateConstructor.cpp:
1509         (JSC::constructDate):
1510         (JSC::dateUTC):
1511         * runtime/DateConversion.cpp:
1512         (JSC::formatDate):
1513         (JSC::formatDateUTCVariant):
1514         * runtime/DatePrototype.cpp:
1515         (JSC::formatLocaleDate):
1516         (JSC::fillStructuresUsingDateArgs):
1517         (JSC::dateProtoFuncToISOString):
1518         (JSC::dateProtoFuncGetFullYear):
1519         (JSC::dateProtoFuncGetUTCFullYear):
1520         (JSC::dateProtoFuncSetYear):
1521         * runtime/JSDateMath.cpp:
1522         (JSC::gregorianDateTimeToMS):
1523         (JSC::msToGregorianDateTime):
1524
1525 2012-07-24  Patrick Gansterer  <paroga@webkit.org>
1526
1527         [WIN] Build fix after r123417.
1528
1529         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
1530
1531 2012-07-23  Patrick Gansterer  <paroga@webkit.org>
1532
1533         Move GregorianDateTime from JSC to WTF namespace
1534         https://bugs.webkit.org/show_bug.cgi?id=91948
1535
1536         Reviewed by Geoffrey Garen.
1537
1538         Moving GregorianDateTime into the WTF namespace allows us to us to
1539         use it in WebCore too. The new class has the same behaviour as the
1540         old struct. Only the unused timeZone member has been removed.
1541
1542         * runtime/DateConstructor.cpp:
1543         * runtime/DateConversion.cpp:
1544         * runtime/DateConversion.h:
1545         * runtime/DateInstance.h:
1546         * runtime/DatePrototype.cpp:
1547         * runtime/JSDateMath.cpp:
1548         * runtime/JSDateMath.h:
1549
1550 2012-07-23  Filip Pizlo  <fpizlo@apple.com>
1551
1552         Property storage should grow in reverse address direction, to support butterflies
1553         https://bugs.webkit.org/show_bug.cgi?id=91788
1554
1555         Reviewed by Geoffrey Garen.
1556
1557         Changes property storage to grow to the left, and changes the property storage pointer to point
1558         one 8-byte word (i.e. JSValue) to the right of the first value in the storage.
1559
1560         Also improved debug support somewhat, by adding a describe() function to the jsc command-line,
1561         and a slow mode of object access in LLInt.
1562
1563         * assembler/ARMv7Assembler.h:
1564         (JSC::ARMv7Assembler::repatchCompact):
1565         * assembler/MacroAssemblerARMv7.h:
1566         (MacroAssemblerARMv7):
1567         (JSC::MacroAssemblerARMv7::isCompactPtrAlignedAddressOffset):
1568         (JSC::MacroAssemblerARMv7::load32WithCompactAddressOffsetPatch):
1569         * assembler/MacroAssemblerX86Common.h:
1570         (JSC::MacroAssemblerX86Common::isCompactPtrAlignedAddressOffset):
1571         (JSC::MacroAssemblerX86Common::repatchCompact):
1572         * assembler/X86Assembler.h:
1573         (JSC::X86Assembler::repatchCompact):
1574         * bytecode/CodeBlock.cpp:
1575         (JSC::dumpStructure):
1576         * bytecode/GetByIdStatus.h:
1577         (JSC::GetByIdStatus::GetByIdStatus):
1578         * dfg/DFGOperations.cpp:
1579         * dfg/DFGOperations.h:
1580         * dfg/DFGRepatch.cpp:
1581         (JSC::DFG::tryCacheGetByID):
1582         (JSC::DFG::emitPutTransitionStub):
1583         * dfg/DFGSpeculativeJIT.cpp:
1584         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
1585         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
1586         * dfg/DFGSpeculativeJIT.h:
1587         (JSC::DFG::SpeculativeJIT::callOperation):
1588         * dfg/DFGSpeculativeJIT32_64.cpp:
1589         (JSC::DFG::SpeculativeJIT::compile):
1590         * dfg/DFGSpeculativeJIT64.cpp:
1591         (JSC::DFG::SpeculativeJIT::compile):
1592         * heap/ConservativeRoots.cpp:
1593         (JSC::ConservativeRoots::genericAddPointer):
1594         * heap/CopiedSpace.h:
1595         (CopiedSpace):
1596         * heap/CopiedSpaceInlineMethods.h:
1597         (JSC::CopiedSpace::pinIfNecessary):
1598         (JSC):
1599         * jit/JITPropertyAccess.cpp:
1600         (JSC::JIT::compileGetDirectOffset):
1601         * jit/JITPropertyAccess32_64.cpp:
1602         (JSC::JIT::compileGetDirectOffset):
1603         * jit/JITStubs.cpp:
1604         (JSC::JITThunks::tryCacheGetByID):
1605         * jsc.cpp:
1606         (GlobalObject::finishCreation):
1607         (functionDescribe):
1608         * llint/LLIntCommon.h:
1609         * llint/LLIntSlowPaths.cpp:
1610         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
1611         * llint/LowLevelInterpreter32_64.asm:
1612         * llint/LowLevelInterpreter64.asm:
1613         * runtime/JSObject.cpp:
1614         (JSC::JSObject::visitChildren):
1615         (JSC::JSFinalObject::visitChildren):
1616         (JSC::JSObject::growOutOfLineStorage):
1617         * runtime/JSObject.h:
1618         (JSC::JSObject::getDirectLocation):
1619         (JSC::JSObject::offsetForLocation):
1620         * runtime/JSValue.h:
1621         (JSValue):
1622         * runtime/PropertyOffset.h:
1623         (JSC::offsetInOutOfLineStorage):
1624
1625 2012-07-23  Filip Pizlo  <fpizlo@apple.com>
1626
1627         DFG is too aggressive in performing the specific value optimization on loads
1628         https://bugs.webkit.org/show_bug.cgi?id=92034
1629
1630         Reviewed by Mark Hahnenberg.
1631
1632         This ensures that we don't do optimizations based on a structure having a specific
1633         value, if there is no way to detect that the value is despecified. This is the
1634         case for dictionaries, since despecifying a value in a dictionary does not lead to
1635         a transition and so cannot be caught by either structure checks or structure
1636         transition watchpoints.
1637
1638         * bytecode/GetByIdStatus.cpp:
1639         (JSC::GetByIdStatus::computeFromLLInt):
1640         (JSC::GetByIdStatus::computeForChain):
1641         (JSC::GetByIdStatus::computeFor):
1642         * bytecode/ResolveGlobalStatus.cpp:
1643         (JSC::computeForStructure):
1644
1645 2012-07-23  Filip Pizlo  <fpizlo@apple.com>
1646
1647         REGRESSION(r123169): It made fast/js/dfg-inline-arguments-use-from-uninlined-code.html fail on 32 bit platforms
1648         https://bugs.webkit.org/show_bug.cgi?id=92002
1649
1650         Reviewed by Mark Hahnenberg.
1651
1652         In the process of changing the nature of local variable typing, I forgot to modify one of the places where
1653         we glue the DFG's notion of variable prediction to the runtime's notion of variable tagging.
1654
1655         * dfg/DFGSpeculativeJIT.cpp:
1656         (JSC::DFG::SpeculativeJIT::compile):
1657
1658 2012-07-23  Simon Fraser  <simon.fraser@apple.com>
1659
1660         Part 2 of: Implement sticky positioning
1661         https://bugs.webkit.org/show_bug.cgi?id=90046
1662
1663         Reviewed by Ojan Vafai.
1664
1665         Turn on ENABLE_CSS_STICKY_POSITION.
1666
1667         * Configurations/FeatureDefines.xcconfig:
1668
1669 2012-07-23  Patrick Gansterer  <paroga@webkit.org>
1670
1671         Move JSC::parseDate() from DateConversion to JSDateMath
1672         https://bugs.webkit.org/show_bug.cgi?id=91982
1673
1674         Reviewed by Geoffrey Garen.
1675
1676         Moveing this function into the other files removes the dependency
1677         on JSC spcific classes in DateConversion.{cpp|h}.
1678
1679         * runtime/DateConversion.cpp:
1680         * runtime/DateConversion.h:
1681         (JSC):
1682         * runtime/JSDateMath.cpp:
1683         (JSC::parseDate):
1684         (JSC):
1685         * runtime/JSDateMath.h:
1686         (JSC):
1687
1688 2012-07-23  Simon Fraser  <simon.fraser@apple.com>
1689
1690         Part 1 of: Implement sticky positioning
1691         https://bugs.webkit.org/show_bug.cgi?id=90046
1692
1693         Reviewed by Ojan Vafai.
1694
1695         Add ENABLE_CSS_STICKY_POSITION, defaulting to off initially.
1696
1697         Sort the ENABLE_CSS lines in the file. Make sure all the flags
1698         are in FEATURE_DEFINES.
1699
1700         * Configurations/FeatureDefines.xcconfig:
1701
1702 2012-07-23  Yong Li  <yoli@rim.com>
1703
1704         [BlackBerry] Implement GCActivityCallback with platform timer
1705         https://bugs.webkit.org/show_bug.cgi?id=90175
1706
1707         Reviewed by Rob Buis.
1708
1709         Use JSLock when performing GC to avoid assertions.
1710
1711         * runtime/GCActivityCallbackBlackBerry.cpp:
1712         (JSC::DefaultGCActivityCallback::doWork):
1713
1714 2012-07-23  Kent Tamura  <tkent@chromium.org>
1715
1716         Rename ENABLE_METER_TAG and ENABLE_PROGRESS_TAG to ENABLE_METER_ELEMENT and ENABLE_PROGRESS_ELEMENT respectively
1717         https://bugs.webkit.org/show_bug.cgi?id=91941
1718
1719         Reviewed by Kentaro Hara.
1720
1721         A flag name for an elmement should be ENABLE_*_ELEMENT.
1722
1723         * Configurations/FeatureDefines.xcconfig:
1724
1725 2012-07-22  Kent Tamura  <tkent@chromium.org>
1726
1727         Rename ENABLE_DETAILS to ENABLE_DETAILS_ELEMENT
1728         https://bugs.webkit.org/show_bug.cgi?id=91928
1729
1730         Reviewed by Kentaro Hara.
1731
1732         A flag name for an elmement should be ENABLE_*_ELEMENT.
1733
1734         * Configurations/FeatureDefines.xcconfig:
1735
1736 2012-07-21  Patrick Gansterer  <paroga@webkit.org>
1737
1738         [WIN] Use GetDateFormat and GetTimeFormat instead of strftime
1739         https://bugs.webkit.org/show_bug.cgi?id=83436
1740
1741         Reviewed by Brent Fulgham.
1742
1743         The MS CRT implementation of strftime calls the same two functions.
1744         Using them directly avoids the overhead of parsing the format string and removes
1745         the dependency on strftime() for WinCE where this function does not exist.
1746
1747         * runtime/DatePrototype.cpp:
1748         (JSC::formatLocaleDate):
1749
1750 2012-07-20  Kent Tamura  <tkent@chromium.org>
1751
1752         Rename ENABLE_DATALIST to ENABLE_DATALIST_ELEMENT
1753         https://bugs.webkit.org/show_bug.cgi?id=91846
1754
1755         Reviewed by Kentaro Hara.
1756
1757         A flag name for an elmement should be ENABLE_*_ELEMENT.
1758
1759         * Configurations/FeatureDefines.xcconfig:
1760
1761 2012-07-20  Han Shen  <shenhan@google.com>
1762
1763         [Chromium] Compilation fails under gcc 4.7
1764         https://bugs.webkit.org/show_bug.cgi?id=90227
1765
1766         Reviewed by Tony Chang.
1767
1768         Disable warnings about c++0x compatibility in gcc newer than 4.6.
1769
1770         * JavaScriptCore.gyp/JavaScriptCore.gyp:
1771
1772 2012-07-18  Filip Pizlo  <fpizlo@apple.com>
1773
1774         DFG cell checks should be hoisted
1775         https://bugs.webkit.org/show_bug.cgi?id=91717
1776
1777         Reviewed by Geoffrey Garen.
1778
1779         The DFG has always had the policy of hoisting array and integer checks to
1780         the point of variable assignment. Eventually, we added doubles and booleans
1781         to the mix. But cells should really be part of this as well, particularly
1782         for 32-bit where accessing a known-type variable is dramatically cheaper
1783         than accessing a variable whose types is only predicted but otherwise
1784         unproven.
1785
1786         This appears to be a definite speed-up for V8 on 32-bit, a possible speed-up
1787         for Kraken, and a possible slow-down for V8 on 64-bit (around 0.2% if at
1788         all). Any slow-downs can, and should, be addressed by making the hoisting
1789         logic cognizant of variables that are never used in a manner that requires
1790         type checks, and by sinking argument checks to the point(s) of first use.
1791
1792         To make this work I had to change some OSR machinery, and special-case the
1793         type predictions of the 'this' argument for constructors. OSR exit normally
1794         assumes that arguments are boxed, which happens to be true because the
1795         type prediction used for check hoisting is LUB'd with the type of the
1796         argument that was passed in - so either the arguments are always stored to
1797         with the full tag+payload, or if only the payload is stored then the tag
1798         matches whatever the caller would have set. But not so with the 'this'
1799         argument for constructors, which is not initialized by the caller. We
1800         could make this more precise by having argument types for OSR be inferred
1801         using similar machinery to other locals, but I figured that for this patch
1802         I should use the surgical fix.
1803
1804         * assembler/MacroAssemblerX86_64.h:
1805         (JSC::MacroAssemblerX86_64::branchTestPtr):
1806         (MacroAssemblerX86_64):
1807         * assembler/X86Assembler.h:
1808         (JSC::X86Assembler::testq_rm):
1809         (X86Assembler):
1810         * dfg/DFGAbstractState.cpp:
1811         (JSC::DFG::AbstractState::initialize):
1812         (JSC::DFG::AbstractState::execute):
1813         * dfg/DFGDriver.cpp:
1814         (JSC::DFG::compile):
1815         * dfg/DFGGraph.h:
1816         (JSC::DFG::Graph::isCreatedThisArgument):
1817         (Graph):
1818         * dfg/DFGSpeculativeJIT.cpp:
1819         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
1820         * dfg/DFGSpeculativeJIT32_64.cpp:
1821         (JSC::DFG::SpeculativeJIT::compile):
1822         * dfg/DFGSpeculativeJIT64.cpp:
1823         (JSC::DFG::SpeculativeJIT::compile):
1824         * dfg/DFGValueSource.h:
1825         (JSC::DFG::ValueSource::forSpeculation):
1826
1827 2012-07-19  Filip Pizlo  <fpizlo@apple.com>
1828
1829         Fast path of storage resize should be removed from property storage reallocation, since it is only useful for arrays
1830         https://bugs.webkit.org/show_bug.cgi?id=91796
1831
1832         Reviewed by Geoffrey Garen.
1833
1834         * dfg/DFGRepatch.cpp:
1835         (JSC::DFG::emitPutTransitionStub):
1836         * dfg/DFGSpeculativeJIT.cpp:
1837         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
1838         * runtime/JSObject.cpp:
1839         (JSC::JSObject::growOutOfLineStorage):
1840
1841 2012-07-19  Mark Lam  <mark.lam@apple.com>
1842
1843         Bug fixes and enhancements for OfflineASM annotation system.
1844         https://bugs.webkit.org/show_bug.cgi?id=91690
1845
1846         Reviewed by Filip Pizlo.
1847
1848         * offlineasm/armv7.rb: added default handling of Instruction lower().
1849         * offlineasm/asm.rb: added more support for annotations and more pretty printing.
1850         * offlineasm/ast.rb: added more support for annotations.
1851         * offlineasm/config.rb: added $preferredCommentStartColumn, simplified $enableInstrAnnotations.
1852         * offlineasm/parser.rb: added more support for annotations.
1853         * offlineasm/transform.rb: added more support for annotations.
1854         * offlineasm/x86.rb: added default handling of Instruction lower().
1855
1856 2012-07-19  Patrick Gansterer  <paroga@webkit.org>
1857
1858         [WIN] Fix compilation of JSGlobalData.h with ENABLE(DFG_JIT)
1859         https://bugs.webkit.org/show_bug.cgi?id=91243
1860
1861         Reviewed by Geoffrey Garen.
1862
1863         Disable MSVC warning 4200 "zero-sized array in struct/union" for JSC::ScratchBuffer.
1864
1865         * runtime/JSGlobalData.h:
1866         (JSC):
1867
1868 2012-07-19  Mark Lam  <mark.lam@apple.com>
1869
1870         Fixed broken ENABLE_JIT=0 build.
1871         https://bugs.webkit.org/show_bug.cgi?id=91725
1872
1873         Reviewed by Oliver Hunt.
1874
1875         * bytecode/Watchpoint.cpp:
1876         * heap/JITStubRoutineSet.h:
1877         (JSC):
1878         (JITStubRoutineSet):
1879         (JSC::JITStubRoutineSet::JITStubRoutineSet):
1880         (JSC::JITStubRoutineSet::~JITStubRoutineSet):
1881         (JSC::JITStubRoutineSet::add):
1882         (JSC::JITStubRoutineSet::clearMarks):
1883         (JSC::JITStubRoutineSet::mark):
1884         (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
1885         (JSC::JITStubRoutineSet::traceMarkedStubRoutines):
1886
1887 2012-07-19  Kristóf Kosztyó  <kkristof@inf.u-szeged.hu>
1888
1889         [Qt] Unreviewed buildfix after r123042.
1890
1891         * interpreter/Interpreter.cpp:
1892         (JSC::Interpreter::dumpRegisters):
1893
1894 2012-07-18  Filip Pizlo  <fpizlo@apple.com>
1895
1896         DFG should emit inline code for property storage (re)allocation
1897         https://bugs.webkit.org/show_bug.cgi?id=91597
1898
1899         Reviewed by Oliver Hunt.
1900
1901         This adds two new ops to the DFG IR: AllocatePropertyStorage and
1902         ReallocatePropertyStorage. It enables these to interact properly with
1903         CSE so that a GetPropertyStorage on something for which we have
1904         obviously done a (Re)AllocatePropertyStorage will result in the
1905         GetPropertyStorage being eliminated. Other than that, the code
1906         emitted for these ops is identical to the code we were emitting in
1907         the corresponding PutById stub.
1908
1909         * dfg/DFGAbstractState.cpp:
1910         (JSC::DFG::AbstractState::execute):
1911         * dfg/DFGByteCodeParser.cpp:
1912         (JSC::DFG::ByteCodeParser::parseBlock):
1913         * dfg/DFGCSEPhase.cpp:
1914         (JSC::DFG::CSEPhase::putStructureStoreElimination):
1915         (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
1916         * dfg/DFGNode.h:
1917         (JSC::DFG::Node::hasStructureTransitionData):
1918         * dfg/DFGNodeType.h:
1919         (DFG):
1920         * dfg/DFGOperations.cpp:
1921         * dfg/DFGOperations.h:
1922         * dfg/DFGPredictionPropagationPhase.cpp:
1923         (JSC::DFG::PredictionPropagationPhase::propagate):
1924         * dfg/DFGSpeculativeJIT.cpp:
1925         (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
1926         (DFG):
1927         (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
1928         * dfg/DFGSpeculativeJIT.h:
1929         (JSC::DFG::SpeculativeJIT::callOperation):
1930         (SpeculativeJIT):
1931         * dfg/DFGSpeculativeJIT32_64.cpp:
1932         (JSC::DFG::SpeculativeJIT::compile):
1933         * dfg/DFGSpeculativeJIT64.cpp:
1934         (JSC::DFG::SpeculativeJIT::compile):
1935         * runtime/Structure.cpp:
1936         (JSC::nextOutOfLineStorageCapacity):
1937         * runtime/Structure.h:
1938         (JSC):
1939
1940 2012-07-16  Oliver Hunt  <oliver@apple.com>
1941
1942         dumpCallFrame is broken in ToT
1943         https://bugs.webkit.org/show_bug.cgi?id=91444
1944
1945         Reviewed by Gavin Barraclough.
1946
1947         Various changes have been made to the SF calling convention, but
1948         dumpCallFrame has not been updated to reflect these changes.
1949         That resulted in both bogus information, as well as numerous
1950         assertions of sadness.
1951
1952         This patch makes dumpCallFrame actually work again and adds the
1953         wonderful feature of telling you the name of the variable that a
1954         register reflects, or what value it contains.
1955
1956         * bytecode/CodeBlock.cpp:
1957         (JSC::CodeBlock::nameForRegister):
1958             A really innefficient mechanism for finding the name of a local register.
1959             This should only ever be used by debug code so this should be okay.
1960         * bytecode/CodeBlock.h:
1961         (CodeBlock):
1962         * bytecompiler/BytecodeGenerator.cpp:
1963         (JSC::BytecodeGenerator::generate):
1964             Debug builds no longer throw away a functions symbol table, this allows
1965             us to actually perform a register# to name mapping
1966         * dfg/DFGJITCompiler.cpp:
1967         (JSC::DFG::JITCompiler::link):
1968             We weren't propogating the bytecode offset here leading to assertions
1969             in debug builds when dumping bytecode of DFG compiled code.
1970         * interpreter/Interpreter.cpp:
1971         (JSC):
1972         (JSC::Interpreter::dumpRegisters):
1973              Rework to actually be correct.
1974         (JSC::getCallerInfo):
1975              Return the byteocde offset as well now, given we have to determine it
1976              anyway.
1977         (JSC::Interpreter::getStackTrace):
1978         (JSC::Interpreter::retrieveCallerFromVMCode):
1979         * interpreter/Interpreter.h:
1980         (Interpreter):
1981         * jsc.cpp:
1982         (GlobalObject::finishCreation):
1983         (functionDumpCallFrame):
1984              Give debug builds of JSC a method for calling dumpCallFrame so we can
1985              inspect a callframe without requiring us to break in a debugger.
1986
1987 2012-07-18  Filip Pizlo  <fpizlo@apple.com>
1988
1989         DFG 32-bit PutById transition stub storage reallocation case copies the first pointer of each JSValue instead of the whole JSValue
1990         https://bugs.webkit.org/show_bug.cgi?id=91599
1991
1992         Reviewed by Geoffrey Garen.
1993
1994         * dfg/DFGRepatch.cpp:
1995         (JSC::DFG::emitPutTransitionStub):
1996
1997 2012-07-17  Filip Pizlo  <fpizlo@apple.com>
1998
1999         DFG 32-bit PutById transition stub passes the payload/tag arguments to a DFG operation in the wrong order
2000         https://bugs.webkit.org/show_bug.cgi?id=91576
2001
2002         Reviewed by Gavin Barraclough.
2003
2004         * dfg/DFGRepatch.cpp:
2005         (JSC::DFG::emitPutTransitionStub):
2006
2007 2012-07-17  Filip Pizlo  <fpizlo@apple.com>
2008
2009         [Qt] REGRESSION(r122768, r122771): They broke jquery/data.html and inspector/elements/edit-dom-actions.html
2010         https://bugs.webkit.org/show_bug.cgi?id=91476
2011
2012         Reviewed by Mark Hahnenberg.
2013
2014         The 32-bit repatching code was not correctly adapted to the new world where there may not always
2015         be an available scratch register. Fixed it by ensuring that the scratch register we select does
2016         not overlap with the value tag.
2017
2018         * dfg/DFGRepatch.cpp:
2019         (JSC::DFG::generateProtoChainAccessStub):
2020         (JSC::DFG::tryCacheGetByID):
2021         (JSC::DFG::tryBuildGetByIDList):
2022         (JSC::DFG::emitPutReplaceStub):
2023
2024 2012-07-17  Gabor Rapcsanyi  <rgabor@webkit.org>
2025
2026         Unreviewed buildfix from Zoltan Herczeg after 122768.
2027
2028         * dfg/DFGCCallHelpers.h:
2029         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
2030         (CCallHelpers):
2031
2032 2012-07-17  David Barr  <davidbarr@chromium.org>
2033
2034         Introduce ENABLE_CSS_IMAGE_ORIENTATION compile flag
2035         https://bugs.webkit.org/show_bug.cgi?id=89055
2036
2037         Reviewed by Kent Tamura.
2038
2039         The css3-images module is at candidate recommendation.
2040         http://www.w3.org/TR/2012/CR-css3-images-20120417/#the-image-orientation
2041
2042         Add a configuration option for CSS image-orientation support, disabling it by default.
2043
2044         * Configurations/FeatureDefines.xcconfig:
2045
2046 2012-07-16  Filip Pizlo  <fpizlo@apple.com>
2047
2048         Unreviewed, roll out 122790 because it broke the Windows build. I'm not
2049         sure what to do with exported symbols that are predicated on NDEBUG.
2050
2051         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
2052         * bytecode/CodeBlock.cpp:
2053         (JSC):
2054         * bytecode/CodeBlock.h:
2055         (CodeBlock):
2056         * bytecompiler/BytecodeGenerator.cpp:
2057         (JSC::BytecodeGenerator::generate):
2058         * dfg/DFGJITCompiler.cpp:
2059         (JSC::DFG::JITCompiler::link):
2060         * interpreter/Interpreter.cpp:
2061         (JSC):
2062         (JSC::Interpreter::dumpRegisters):
2063         (JSC::getCallerInfo):
2064         (JSC::Interpreter::getStackTrace):
2065         (JSC::Interpreter::retrieveCallerFromVMCode):
2066         * interpreter/Interpreter.h:
2067         (Interpreter):
2068         * jsc.cpp:
2069         (GlobalObject::finishCreation):
2070
2071 2012-07-16  Oliver Hunt  <oliver@apple.com>
2072
2073         dumpCallFrame is broken in ToT
2074         https://bugs.webkit.org/show_bug.cgi?id=91444
2075
2076         Reviewed by Gavin Barraclough.
2077
2078         Various changes have been made to the SF calling convention, but
2079         dumpCallFrame has not been updated to reflect these changes.
2080         That resulted in both bogus information, as well as numerous
2081         assertions of sadness.
2082
2083         This patch makes dumpCallFrame actually work again and adds the
2084         wonderful feature of telling you the name of the variable that a
2085         register reflects, or what value it contains.
2086
2087         * bytecode/CodeBlock.cpp:
2088         (JSC::CodeBlock::nameForRegister):
2089             A really innefficient mechanism for finding the name of a local register.
2090             This should only ever be used by debug code so this should be okay.
2091         * bytecode/CodeBlock.h:
2092         (CodeBlock):
2093         * bytecompiler/BytecodeGenerator.cpp:
2094         (JSC::BytecodeGenerator::generate):
2095             Debug builds no longer throw away a functions symbol table, this allows
2096             us to actually perform a register# to name mapping
2097         * dfg/DFGJITCompiler.cpp:
2098         (JSC::DFG::JITCompiler::link):
2099             We weren't propogating the bytecode offset here leading to assertions
2100             in debug builds when dumping bytecode of DFG compiled code.
2101         * interpreter/Interpreter.cpp:
2102         (JSC):
2103         (JSC::Interpreter::dumpRegisters):
2104              Rework to actually be correct.
2105         (JSC::getCallerInfo):
2106              Return the byteocde offset as well now, given we have to determine it
2107              anyway.
2108         (JSC::Interpreter::getStackTrace):
2109         (JSC::Interpreter::retrieveCallerFromVMCode):
2110         * interpreter/Interpreter.h:
2111         (Interpreter):
2112         * jsc.cpp:
2113         (GlobalObject::finishCreation):
2114         (functionDumpCallFrame):
2115              Give debug builds of JSC a method for calling dumpCallFrame so we can
2116              inspect a callframe without requiring us to break in a debugger.
2117
2118 2012-07-16  Filip Pizlo  <fpizlo@apple.com>
2119
2120         Unreviewed, adding forgotten files.
2121
2122         * dfg/DFGRegisterSet.h: Added.
2123         (DFG):
2124         (RegisterSet):
2125         (JSC::DFG::RegisterSet::RegisterSet):
2126         (JSC::DFG::RegisterSet::asPOD):
2127         (JSC::DFG::RegisterSet::copyInfo):
2128         (JSC::DFG::RegisterSet::set):
2129         (JSC::DFG::RegisterSet::setGPRByIndex):
2130         (JSC::DFG::RegisterSet::clear):
2131         (JSC::DFG::RegisterSet::get):
2132         (JSC::DFG::RegisterSet::getGPRByIndex):
2133         (JSC::DFG::RegisterSet::getFreeGPR):
2134         (JSC::DFG::RegisterSet::setFPRByIndex):
2135         (JSC::DFG::RegisterSet::getFPRByIndex):
2136         (JSC::DFG::RegisterSet::setByIndex):
2137         (JSC::DFG::RegisterSet::getByIndex):
2138         (JSC::DFG::RegisterSet::numberOfSetGPRs):
2139         (JSC::DFG::RegisterSet::numberOfSetFPRs):
2140         (JSC::DFG::RegisterSet::numberOfSetRegisters):
2141         (JSC::DFG::RegisterSet::setBit):
2142         (JSC::DFG::RegisterSet::clearBit):
2143         (JSC::DFG::RegisterSet::getBit):
2144         * dfg/DFGScratchRegisterAllocator.h: Added.
2145         (DFG):
2146         (ScratchRegisterAllocator):
2147         (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator):
2148         (JSC::DFG::ScratchRegisterAllocator::lock):
2149         (JSC::DFG::ScratchRegisterAllocator::allocateScratch):
2150         (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR):
2151         (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR):
2152         (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters):
2153         (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
2154         (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
2155         (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize):
2156         (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
2157         (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
2158
2159 2012-07-15  Filip Pizlo  <fpizlo@apple.com>
2160
2161         DFG PutById transition should handle storage allocation, and inline it
2162         https://bugs.webkit.org/show_bug.cgi?id=91337
2163
2164         Reviewed by Oliver Hunt.
2165
2166         This enables the patching of DFG PutById to handle the out-of-line storage
2167         allocation case. Furthermore, it inlines out-of-line storage allocation (and
2168         reallocation) into the generated stubs.
2169
2170         To do this, this patch adds the ability to store the relevant register
2171         allocation state (i.e. the set of in-use registers) in the structure stub
2172         info so that the stub generation code can more flexibly select scratch
2173         registers: sometimes it needs none, sometimes one - or sometimes up to
2174         three. Moreover, to make the stub generation register allocation simple and
2175         maintainable, this patch introduces a reusable scratch register allocator
2176         class. This register allocator understands that some registers are in use by
2177         the main path code and so must be spilled as necessary, other registers are
2178         locked for use in the stub itself and so cannot even be spilled, while still
2179         others may be allocated for scratch purposes. A scratch register that is
2180         used must be spilled. If a register is locked, it cannot be used as a
2181         scratch register. If a register is used, it can be used as a scratch
2182         register so long as it is spilled.
2183
2184         This is a sub-1% speed-up on V8 and neutral elsewhere.
2185
2186         * GNUmakefile.list.am:
2187         * JavaScriptCore.xcodeproj/project.pbxproj:
2188         * assembler/MacroAssemblerCodeRef.h:
2189         (FunctionPtr):
2190         (JSC::FunctionPtr::FunctionPtr):
2191         * bytecode/StructureStubInfo.h:
2192         * dfg/DFGCCallHelpers.h:
2193         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
2194         (CCallHelpers):
2195         * dfg/DFGGPRInfo.h:
2196         * dfg/DFGJITCompiler.cpp:
2197         (JSC::DFG::JITCompiler::link):
2198         * dfg/DFGJITCompiler.h:
2199         (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
2200         (PropertyAccessRecord):
2201         * dfg/DFGOperations.cpp:
2202         * dfg/DFGOperations.h:
2203         * dfg/DFGRegisterBank.h:
2204         (JSC::DFG::RegisterBank::isInUse):
2205         (RegisterBank):
2206         * dfg/DFGRegisterSet.h: Added.
2207         (DFG):
2208         (RegisterSet):
2209         (JSC::DFG::RegisterSet::RegisterSet):
2210         (JSC::DFG::RegisterSet::asPOD):
2211         (JSC::DFG::RegisterSet::copyInfo):
2212         (JSC::DFG::RegisterSet::set):
2213         (JSC::DFG::RegisterSet::setGPRByIndex):
2214         (JSC::DFG::RegisterSet::clear):
2215         (JSC::DFG::RegisterSet::get):
2216         (JSC::DFG::RegisterSet::getGPRByIndex):
2217         (JSC::DFG::RegisterSet::getFreeGPR):
2218         (JSC::DFG::RegisterSet::setFPRByIndex):
2219         (JSC::DFG::RegisterSet::getFPRByIndex):
2220         (JSC::DFG::RegisterSet::setByIndex):
2221         (JSC::DFG::RegisterSet::getByIndex):
2222         (JSC::DFG::RegisterSet::numberOfSetGPRs):
2223         (JSC::DFG::RegisterSet::numberOfSetFPRs):
2224         (JSC::DFG::RegisterSet::numberOfSetRegisters):
2225         (JSC::DFG::RegisterSet::setBit):
2226         (JSC::DFG::RegisterSet::clearBit):
2227         (JSC::DFG::RegisterSet::getBit):
2228         * dfg/DFGRepatch.cpp:
2229         (JSC::DFG::generateProtoChainAccessStub):
2230         (JSC::DFG::tryCacheGetByID):
2231         (JSC::DFG::tryBuildGetByIDList):
2232         (JSC::DFG::emitPutReplaceStub):
2233         (JSC::DFG::emitPutTransitionStub):
2234         (JSC::DFG::tryCachePutByID):
2235         (JSC::DFG::tryBuildPutByIdList):
2236         * dfg/DFGScratchRegisterAllocator.h: Added.
2237         (DFG):
2238         (ScratchRegisterAllocator):
2239         (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator):
2240         (JSC::DFG::ScratchRegisterAllocator::lock):
2241         (JSC::DFG::ScratchRegisterAllocator::allocateScratch):
2242         (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR):
2243         (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR):
2244         (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters):
2245         (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
2246         (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
2247         (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize):
2248         (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer):
2249         (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer):
2250         * dfg/DFGSpeculativeJIT.h:
2251         (SpeculativeJIT):
2252         (JSC::DFG::SpeculativeJIT::usedRegisters):
2253         * dfg/DFGSpeculativeJIT32_64.cpp:
2254         (JSC::DFG::SpeculativeJIT::cachedGetById):
2255         (JSC::DFG::SpeculativeJIT::cachedPutById):
2256         (JSC::DFG::SpeculativeJIT::compile):
2257         * dfg/DFGSpeculativeJIT64.cpp:
2258         (JSC::DFG::SpeculativeJIT::cachedGetById):
2259         (JSC::DFG::SpeculativeJIT::cachedPutById):
2260         (JSC::DFG::SpeculativeJIT::compile):
2261         * heap/CopiedAllocator.h:
2262         (CopiedAllocator):
2263         (JSC::CopiedAllocator::fastPathShouldSucceed):
2264         (JSC):
2265
2266 2012-07-16  Patrick Gansterer  <paroga@webkit.org>
2267
2268         Add dfg switch to create_jit_stubs script
2269         https://bugs.webkit.org/show_bug.cgi?id=91256
2270
2271         Reviewed by Geoffrey Garen.
2272
2273         * create_jit_stubs: Add a switch to enable or disable the generation of
2274                             stub functions in #if ENABLE(DFG_JIT) conditions.
2275
2276 2012-07-16  Gabor Rapcsanyi  <rgabor@webkit.org>
2277
2278         Unreviewed buildfix after r122729. Typo fix.
2279
2280         * assembler/MacroAssemblerARM.h:
2281         (JSC::MacroAssemblerARM::add32):
2282
2283 2012-07-16  Gabor Rapcsanyi  <rgabor@webkit.org>
2284
2285         Unreviewed buildfix from Zoltan Herczeg after r122677.
2286         Implement missing add32 function to MacroAssemblerARM.
2287
2288         * assembler/MacroAssemblerARM.h:
2289         (JSC::MacroAssemblerARM::add32):
2290         (MacroAssemblerARM):
2291
2292 2012-07-14  Filip Pizlo  <fpizlo@apple.com>
2293
2294         DFG PutByVal opcodes should accept more than 3 operands
2295         https://bugs.webkit.org/show_bug.cgi?id=91332
2296
2297         Reviewed by Oliver Hunt.
2298
2299         Turned PutByVal/PutByValAlias into var-arg nodes, so that we can give them
2300         4 or more operands in the future.
2301
2302         * dfg/DFGAbstractState.cpp:
2303         (JSC::DFG::AbstractState::execute):
2304         * dfg/DFGByteCodeParser.cpp:
2305         (JSC::DFG::ByteCodeParser::parseBlock):
2306         * dfg/DFGCSEPhase.cpp:
2307         (JSC::DFG::CSEPhase::getByValLoadElimination):
2308         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
2309         (JSC::DFG::CSEPhase::performNodeCSE):
2310         * dfg/DFGFixupPhase.cpp:
2311         (JSC::DFG::FixupPhase::fixupNode):
2312         (JSC::DFG::FixupPhase::fixDoubleEdge):
2313         * dfg/DFGGraph.h:
2314         (JSC::DFG::Graph::byValIsPure):
2315         (JSC::DFG::Graph::varArgNumChildren):
2316         (Graph):
2317         (JSC::DFG::Graph::numChildren):
2318         (JSC::DFG::Graph::varArgChild):
2319         (JSC::DFG::Graph::child):
2320         * dfg/DFGNodeType.h:
2321         (DFG):
2322         * dfg/DFGPredictionPropagationPhase.cpp:
2323         (JSC::DFG::PredictionPropagationPhase::propagate):
2324         * dfg/DFGSpeculativeJIT.cpp:
2325         (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
2326         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
2327         * dfg/DFGSpeculativeJIT32_64.cpp:
2328         (JSC::DFG::SpeculativeJIT::compile):
2329         * dfg/DFGSpeculativeJIT64.cpp:
2330         (JSC::DFG::SpeculativeJIT::compile):
2331
2332 2012-07-14  Filip Pizlo  <fpizlo@apple.com>
2333
2334         Rationalize and optimize storage allocation
2335         https://bugs.webkit.org/show_bug.cgi?id=91303
2336
2337         Reviewed by Oliver Hunt.
2338
2339         This implements a backwards bump allocator for copied space storage
2340         allocation, shown in pseudo-code below:
2341
2342             pointer bump(size) {
2343                 pointer tmp = allocator->remaining;
2344                 tmp -= size;
2345                 if (tmp < 0)
2346                     fail;
2347                 allocator->remaining = tmp;
2348                 return allocator->payloadEnd - tmp - size;
2349             }
2350
2351         The advantage of this allocator is that it:
2352
2353         - Only requires one comparison in the common case where size is known to
2354           not be huge, and this comparison can be done by checking the sign bit
2355           of the subtraction.
2356
2357         - Can be implemented even when only one register is available. This
2358           register is reused for both temporary storage during allocation and
2359           for the result.
2360
2361         - Preserves the behavior that memory in a block is filled in from lowest
2362           address to highest address, which allows for a cheap reallocation fast
2363           path.
2364
2365         - Is resilient against the block used for allocation being the last one
2366           in virtual memory, thereby otherwise leading to the risk of overflow
2367           in the bump pointer, despite only doing one branch.
2368
2369         In order to implement this allocator using the smallest possible chunk
2370         of code, I refactored the copied space code so that all of the allocation
2371         logic is in CopiedAllocator, and all of the state is in either
2372         CopiedBlock or CopiedAllocator. This should make changing the allocation
2373         fast path easier in the future.
2374
2375         In order to do this, I needed to add some new assembler support,
2376         particularly for various forms of add(address, register) and negPtr().
2377
2378         This is performance neutral. The purpose of this change is to facilitate
2379         further inlining of storage allocation without having to reserve
2380         additional registers or emit too much code.
2381
2382         * assembler/MacroAssembler.h:
2383         (JSC::MacroAssembler::addPtr):
2384         (MacroAssembler):
2385         (JSC::MacroAssembler::negPtr):
2386         * assembler/MacroAssemblerARMv7.h:
2387         (MacroAssemblerARMv7):
2388         (JSC::MacroAssemblerARMv7::add32):
2389         * assembler/MacroAssemblerX86.h:
2390         (JSC::MacroAssemblerX86::add32):
2391         (MacroAssemblerX86):
2392         * assembler/MacroAssemblerX86_64.h:
2393         (MacroAssemblerX86_64):
2394         (JSC::MacroAssemblerX86_64::addPtr):
2395         (JSC::MacroAssemblerX86_64::negPtr):
2396         * assembler/X86Assembler.h:
2397         (X86Assembler):
2398         (JSC::X86Assembler::addl_mr):
2399         (JSC::X86Assembler::addq_mr):
2400         (JSC::X86Assembler::negq_r):
2401         * heap/CopiedAllocator.h:
2402         (CopiedAllocator):
2403         (JSC::CopiedAllocator::isValid):
2404         (JSC::CopiedAllocator::CopiedAllocator):
2405         (JSC::CopiedAllocator::tryAllocate):
2406         (JSC):
2407         (JSC::CopiedAllocator::tryReallocate):
2408         (JSC::CopiedAllocator::forceAllocate):
2409         (JSC::CopiedAllocator::resetCurrentBlock):
2410         (JSC::CopiedAllocator::setCurrentBlock):
2411         (JSC::CopiedAllocator::currentCapacity):
2412         * heap/CopiedBlock.h:
2413         (CopiedBlock):
2414         (JSC::CopiedBlock::create):
2415         (JSC::CopiedBlock::zeroFillWilderness):
2416         (JSC::CopiedBlock::CopiedBlock):
2417         (JSC::CopiedBlock::payloadEnd):
2418         (JSC):
2419         (JSC::CopiedBlock::payloadCapacity):
2420         (JSC::CopiedBlock::data):
2421         (JSC::CopiedBlock::dataEnd):
2422         (JSC::CopiedBlock::dataSize):
2423         (JSC::CopiedBlock::wilderness):
2424         (JSC::CopiedBlock::wildernessEnd):
2425         (JSC::CopiedBlock::wildernessSize):
2426         (JSC::CopiedBlock::size):
2427         * heap/CopiedSpace.cpp:
2428         (JSC::CopiedSpace::tryAllocateSlowCase):
2429         (JSC::CopiedSpace::tryAllocateOversize):
2430         (JSC::CopiedSpace::tryReallocate):
2431         (JSC::CopiedSpace::doneFillingBlock):
2432         (JSC::CopiedSpace::doneCopying):
2433         * heap/CopiedSpace.h:
2434         (CopiedSpace):
2435         * heap/CopiedSpaceInlineMethods.h:
2436         (JSC::CopiedSpace::startedCopying):
2437         (JSC::CopiedSpace::allocateBlockForCopyingPhase):
2438         (JSC::CopiedSpace::allocateBlock):
2439         (JSC::CopiedSpace::tryAllocate):
2440         (JSC):
2441         * heap/MarkStack.cpp:
2442         (JSC::SlotVisitor::startCopying):
2443         (JSC::SlotVisitor::allocateNewSpace):
2444         (JSC::SlotVisitor::doneCopying):
2445         * heap/SlotVisitor.h:
2446         (JSC::SlotVisitor::SlotVisitor):
2447         * jit/JIT.h:
2448         * jit/JITInlineMethods.h:
2449         (JSC::JIT::emitAllocateBasicStorage):
2450         (JSC::JIT::emitAllocateJSArray):
2451
2452 2012-07-13  Mark Lam  <mark.lam@apple.com>
2453
2454         OfflineASM Pretty printing and commenting enhancements.
2455         https://bugs.webkit.org/show_bug.cgi?id=91281
2456
2457         Reviewed by Filip Pizlo.
2458
2459         Added some minor pretty printing in the OfflineASM.
2460         Also added infrastruture for adding multiple types of comments and
2461         annotations with the ability to enable/disable them in the generated
2462         output as desired.
2463
2464         * GNUmakefile.list.am: add new file config.rb.
2465         * llint/LLIntOfflineAsmConfig.h:
2466           Added OFFLINE_ASM_BEGIN, OFFLINE_ASM_END, and OFFLINE_ASM_LOCAL_LABEL macros.
2467           This will allow us to redefine these for other backends later.
2468         * llint/LowLevelInterpreter32_64.asm:
2469           Add a small example of instruction annotations for now.
2470         * llint/LowLevelInterpreter64.asm:
2471           Add a small example of instruction annotations for now.
2472         * offlineasm/armv7.rb: Added handling of annotations.
2473         * offlineasm/asm.rb:
2474           Added machinery to dump the new comments and annotations.
2475           Also added some indentations to make the output a little prettier.
2476         * offlineasm/ast.rb: Added annotation field in class Instruction.
2477         * offlineasm/backends.rb:
2478         * offlineasm/config.rb: Added.
2479           Currently only contains commenting options.  This file is meant to be
2480           a centralized place for build config values much like config.h for
2481           JavaScriptCore.
2482         * offlineasm/generate_offset_extractor.rb:
2483         * offlineasm/instructions.rb:
2484         * offlineasm/offsets.rb:
2485         * offlineasm/opt.rb:
2486         * offlineasm/parser.rb: Parse and record annotations.
2487         * offlineasm/registers.rb:
2488         * offlineasm/self_hash.rb:
2489         * offlineasm/settings.rb:
2490         * offlineasm/transform.rb:
2491         * offlineasm/x86.rb: Added handling of annotations.
2492
2493 2012-07-13  Filip Pizlo  <fpizlo@apple.com>
2494
2495         ASSERTION FAILED: use.useKind() != DoubleUse
2496         https://bugs.webkit.org/show_bug.cgi?id=91082
2497
2498         Reviewed by Geoffrey Garen.
2499
2500         The implementation of Branch() was unwisely relying on register allocation state
2501         to decide what speculations to perform. That's never correct.
2502
2503         * dfg/DFGSpeculativeJIT32_64.cpp:
2504         (JSC::DFG::SpeculativeJIT::compile):
2505         * dfg/DFGSpeculativeJIT64.cpp:
2506         (JSC::DFG::SpeculativeJIT::compile):
2507
2508 2012-07-13  Sheriff Bot  <webkit.review.bot@gmail.com>
2509
2510         Unreviewed, rolling out r122640.
2511         http://trac.webkit.org/changeset/122640
2512         https://bugs.webkit.org/show_bug.cgi?id=91298
2513
2514         LLInt apparently does not expect to mark these (Requested by
2515         olliej on #webkit).
2516
2517         * bytecode/CodeBlock.cpp:
2518         (JSC::CodeBlock::visitStructures):
2519         (JSC::CodeBlock::stronglyVisitStrongReferences):
2520
2521 2012-07-13  Oliver Hunt  <oliver@apple.com>
2522
2523         LLInt fails to mark structures stored in the bytecode
2524         https://bugs.webkit.org/show_bug.cgi?id=91296
2525
2526         Reviewed by Geoffrey Garen.
2527
2528         LLInt stores structures in the bytecode, so we need to visit the appropriate
2529         instructions as we would if we were running in the classic interpreter.
2530         This requires adding additional checks for the LLInt specific opcodes, and
2531         the lint specific variants of operand ordering.
2532
2533         * bytecode/CodeBlock.cpp:
2534         (JSC::CodeBlock::visitStructures):
2535         (JSC::CodeBlock::stronglyVisitStrongReferences):
2536
2537 2012-07-13  Yong Li  <yoli@rim.com>
2538
2539         [BlackBerry] Implement GCActivityCallback with platform timer
2540         https://bugs.webkit.org/show_bug.cgi?id=90175
2541
2542         Reviewed by Rob Buis.
2543
2544         Implement GCActivityCallback and HeapTimer for BlackBerry port.
2545
2546         * heap/HeapTimer.cpp:
2547         (JSC):
2548         (JSC::HeapTimer::HeapTimer):
2549         (JSC::HeapTimer::~HeapTimer):
2550         (JSC::HeapTimer::timerDidFire):
2551         (JSC::HeapTimer::synchronize):
2552         (JSC::HeapTimer::invalidate):
2553         (JSC::HeapTimer::didStartVMShutdown):
2554         * heap/HeapTimer.h:
2555         (HeapTimer):
2556         * runtime/GCActivityCallbackBlackBerry.cpp:
2557         (JSC):
2558         (JSC::DefaultGCActivityCallback::doWork):
2559         (JSC::DefaultGCActivityCallback::didAllocate):
2560         (JSC::DefaultGCActivityCallback::willCollect):
2561         (JSC::DefaultGCActivityCallback::cancel):
2562
2563 2012-07-13  Patrick Gansterer  <paroga@webkit.org>
2564
2565         [WIN] Fix compilation of DFGRepatch.cpp
2566         https://bugs.webkit.org/show_bug.cgi?id=91241
2567
2568         Reviewed by Geoffrey Garen.
2569
2570         Use intptr_t instead of uintptr_t when calling CodeLocationCommon::dataLabelPtrAtOffset(int)
2571         to fix MSVC "unary minus operator applied to unsigned type, result still unsigned" warning.
2572
2573         * dfg/DFGRepatch.cpp:
2574         (JSC::DFG::dfgResetGetByID):
2575         (JSC::DFG::dfgResetPutByID):
2576
2577 2012-07-13  Patrick Gansterer  <paroga@webkit.org>
2578
2579         Fix ARM_TRADITIONAL JIT for COMPILER(MSVC) and COMPILER(RVCT) after r121885
2580         https://bugs.webkit.org/show_bug.cgi?id=91238
2581
2582         Reviewed by Zoltan Herczeg.
2583
2584         r121885 changed the assembler instruction only for COMPILER(GCC).
2585         Use the same instructions for the other compilers too.
2586
2587         * jit/JITStubs.cpp:
2588         (JSC::ctiTrampoline):
2589         (JSC::ctiTrampolineEnd):
2590         (JSC::ctiVMThrowTrampoline):
2591
2592 2012-07-12  Filip Pizlo  <fpizlo@apple.com>
2593
2594         DFG property access stubs should use structure transition watchpoints
2595         https://bugs.webkit.org/show_bug.cgi?id=91135
2596
2597         Reviewed by Geoffrey Garen.
2598
2599         This adds a Watchpoint subclass that will clear a structure stub (i.e.
2600         a property access stub) when fired. The DFG stub generation code now
2601         uses this optimization.
2602
2603         * CMakeLists.txt:
2604         * GNUmakefile.list.am:
2605         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2606         * JavaScriptCore.xcodeproj/project.pbxproj:
2607         * Target.pri:
2608         * bytecode/CodeBlock.cpp:
2609         (JSC):
2610         (JSC::CodeBlock::finalizeUnconditionally):
2611         (JSC::CodeBlock::resetStub):
2612         (JSC::CodeBlock::resetStubInternal):
2613         * bytecode/CodeBlock.h:
2614         (JSC):
2615         (CodeBlock):
2616         * bytecode/StructureStubClearingWatchpoint.cpp: Added.
2617         (JSC):
2618         (JSC::StructureStubClearingWatchpoint::~StructureStubClearingWatchpoint):
2619         (JSC::StructureStubClearingWatchpoint::push):
2620         (JSC::StructureStubClearingWatchpoint::fireInternal):
2621         (JSC::WatchpointsOnStructureStubInfo::~WatchpointsOnStructureStubInfo):
2622         (JSC::WatchpointsOnStructureStubInfo::addWatchpoint):
2623         (JSC::WatchpointsOnStructureStubInfo::ensureReferenceAndAddWatchpoint):
2624         * bytecode/StructureStubClearingWatchpoint.h: Added.
2625         (JSC):
2626         (StructureStubClearingWatchpoint):
2627         (JSC::StructureStubClearingWatchpoint::StructureStubClearingWatchpoint):
2628         (WatchpointsOnStructureStubInfo):
2629         (JSC::WatchpointsOnStructureStubInfo::WatchpointsOnStructureStubInfo):
2630         (JSC::WatchpointsOnStructureStubInfo::codeBlock):
2631         (JSC::WatchpointsOnStructureStubInfo::stubInfo):
2632         * bytecode/StructureStubInfo.h:
2633         (JSC::StructureStubInfo::reset):
2634         (JSC::StructureStubInfo::addWatchpoint):
2635         (StructureStubInfo):
2636         * dfg/DFGRepatch.cpp:
2637         (JSC::DFG::addStructureTransitionCheck):
2638         (DFG):
2639         (JSC::DFG::generateProtoChainAccessStub):
2640         (JSC::DFG::emitPutTransitionStub):
2641         * jit/JumpReplacementWatchpoint.h:
2642
2643 2012-07-12  Filip Pizlo  <fpizlo@apple.com>
2644
2645         DFG CFA may get overzealous in loops that have code that must exit
2646         https://bugs.webkit.org/show_bug.cgi?id=91188
2647
2648         Reviewed by Gavin Barraclough.
2649
2650         Ensure that if the CFA assumes that an operation must exit, then it will always exit
2651         no matter what happens after. That's necessary to preserve soundness.
2652
2653         Remove a broken fixup done by the DFG simplifier, where it was trying to say that the
2654         variable-at-head was the first access in the second block in the merge, if the first
2655         block did not read the variable. That's totally wrong, if the first block was in fact
2656         doing a phantom read. I removed that fixup and instead hardened the rest of the
2657         compiler.
2658
2659         * dfg/DFGAbstractState.cpp:
2660         (JSC::DFG::AbstractState::endBasicBlock):
2661         * dfg/DFGBasicBlock.h:
2662         (JSC::DFG::BasicBlock::BasicBlock):
2663         (BasicBlock):
2664         * dfg/DFGCFAPhase.cpp:
2665         (JSC::DFG::CFAPhase::performBlockCFA):
2666         * dfg/DFGCFGSimplificationPhase.cpp:
2667         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
2668         * dfg/DFGConstantFoldingPhase.cpp:
2669         (JSC::DFG::ConstantFoldingPhase::ConstantFoldingPhase):
2670         (JSC::DFG::ConstantFoldingPhase::run):
2671         (ConstantFoldingPhase):
2672         (JSC::DFG::ConstantFoldingPhase::foldConstants):
2673         (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode):
2674         * dfg/DFGVariableEventStream.cpp:
2675         (JSC::DFG::VariableEventStream::reconstruct):
2676
2677 2012-07-12  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
2678
2679         [Qt] Implement MemoryUsageSupport
2680         https://bugs.webkit.org/show_bug.cgi?id=91094
2681
2682         Reviewed by Adam Barth.
2683
2684         Compile in MemoryStatistics so we can make use of the interface.
2685
2686         * Target.pri:
2687
2688 2012-07-12  Csaba Osztrogonác  <ossy@webkit.org>
2689
2690         Remove dead code after r122392.
2691         https://bugs.webkit.org/show_bug.cgi?id=91049
2692
2693         Reviewed by Filip Pizlo.
2694
2695         * dfg/DFGSpeculativeJIT64.cpp:
2696         (JSC::DFG::SpeculativeJIT::emitCall):
2697
2698 2012-07-11  Adenilson Cavalcanti  <cavalcantii@gmail.com>
2699
2700         Build fix + remove dead code
2701         https://bugs.webkit.org/show_bug.cgi?id=91039
2702
2703         Reviewed by Filip Pizlo.
2704
2705         An unused variable was breaking compilation (thanks to warnings being treated as errors).
2706
2707         * dfg/DFGSpeculativeJIT32_64.cpp:
2708         (JSC::DFG::SpeculativeJIT::emitCall):
2709
2710 2012-07-11  Mark Rowe  <mrowe@apple.com>
2711
2712         <http://webkit.org/b/91024> Build against the latest SDK when targeting older OS X versions.
2713
2714         Reviewed by Dan Bernstein.
2715
2716         The deployment target is already set to the version that we're targeting, and it's that setting
2717         which determines which functionality from the SDK is available to us.
2718
2719         * Configurations/Base.xcconfig:
2720
2721 2012-07-11  Filip Pizlo  <fpizlo@apple.com>
2722
2723         DFG should have fast virtual calls
2724         https://bugs.webkit.org/show_bug.cgi?id=90924
2725
2726         Reviewed by Gavin Barraclough.
2727
2728         Implements virtual call support in the style of the old JIT, with the
2729         caveat that we still use the same slow path for both InternalFunction
2730         calls and JSFunction calls. Also rationalized the way that our
2731         CodeOrigin indices tie into exception checks (previously it was a
2732         strange one-to-one mapping with fairly limited assertions; now it's a
2733         one-to-many mapping for CodeOrigins to exception checks, respectively).
2734         I also took the opportunity to clean up
2735         CallLinkInfo::callReturnLocation, which previously was either a Call or
2736         a NearCall. Now it's just a NearCall. As well, exceptions during slow
2737         path call resolution are now handled by returning an exception throwing
2738         thunk rather than returning null. And finally, I made a few things
2739         public that were previously private-with-lots-of-friends, because I
2740         truly despise the thought of listing each thunk generating function as
2741         a friend of JSValue and friends.
2742
2743         * bytecode/CallLinkInfo.cpp:
2744         (JSC::CallLinkInfo::unlink):
2745         * bytecode/CallLinkInfo.h:
2746         (CallLinkInfo):
2747         * bytecode/CodeOrigin.h:
2748         (JSC::CodeOrigin::CodeOrigin):
2749         (JSC::CodeOrigin::isSet):
2750         * dfg/DFGAssemblyHelpers.h:
2751         (JSC::DFG::AssemblyHelpers::AssemblyHelpers):
2752         * dfg/DFGCCallHelpers.h:
2753         (JSC::DFG::CCallHelpers::CCallHelpers):
2754         * dfg/DFGGPRInfo.h:
2755         (GPRInfo):
2756         * dfg/DFGJITCompiler.cpp:
2757         (JSC::DFG::JITCompiler::link):
2758         (JSC::DFG::JITCompiler::compileFunction):
2759         * dfg/DFGJITCompiler.h:
2760         (JSC::DFG::CallBeginToken::CallBeginToken):
2761         (JSC::DFG::CallBeginToken::~CallBeginToken):
2762         (CallBeginToken):
2763         (JSC::DFG::CallBeginToken::set):
2764         (JSC::DFG::CallBeginToken::registerWithExceptionCheck):
2765         (JSC::DFG::CallBeginToken::codeOrigin):
2766         (JSC::DFG::CallExceptionRecord::CallExceptionRecord):
2767         (CallExceptionRecord):
2768         (JSC::DFG::JITCompiler::currentCodeOriginIndex):
2769         (JITCompiler):
2770         (JSC::DFG::JITCompiler::beginCall):
2771         (JSC::DFG::JITCompiler::notifyCall):
2772         (JSC::DFG::JITCompiler::prepareForExceptionCheck):
2773         (JSC::DFG::JITCompiler::addExceptionCheck):
2774         (JSC::DFG::JITCompiler::addFastExceptionCheck):
2775         * dfg/DFGOperations.cpp:
2776         * dfg/DFGRepatch.cpp:
2777         (JSC::DFG::dfgLinkFor):
2778         * dfg/DFGSpeculativeJIT.h:
2779         (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck):
2780         * dfg/DFGSpeculativeJIT32_64.cpp:
2781         (JSC::DFG::SpeculativeJIT::emitCall):
2782         * dfg/DFGSpeculativeJIT64.cpp:
2783         (JSC::DFG::SpeculativeJIT::emitCall):
2784         * dfg/DFGThunks.cpp:
2785         (JSC::DFG::emitPointerValidation):
2786         (DFG):
2787         (JSC::DFG::throwExceptionFromCallSlowPathGenerator):
2788         (JSC::DFG::slowPathFor):
2789         (JSC::DFG::linkForThunkGenerator):
2790         (JSC::DFG::linkCallThunkGenerator):
2791         (JSC::DFG::linkConstructThunkGenerator):
2792         (JSC::DFG::virtualForThunkGenerator):
2793         (JSC::DFG::virtualCallThunkGenerator):
2794         (JSC::DFG::virtualConstructThunkGenerator):
2795         * dfg/DFGThunks.h:
2796         (DFG):
2797         * jit/JIT.cpp:
2798         (JSC::JIT::privateCompile):
2799         (JSC::JIT::linkFor):
2800         * runtime/Executable.h:
2801         (ExecutableBase):
2802         (JSC::ExecutableBase::offsetOfJITCodeFor):
2803         (JSC::ExecutableBase::offsetOfNumParametersFor):
2804         * runtime/JSValue.h:
2805         (JSValue):
2806
2807 2012-07-11  Filip Pizlo  <fpizlo@apple.com>
2808
2809         Accidentally used the wrong license (3-clause instead of 2-clause) in some
2810         files I just committed.
2811
2812         Rubber stamped by Oliver Hunt.
2813
2814         * bytecode/Watchpoint.cpp:
2815         * bytecode/Watchpoint.h:
2816         * jit/JumpReplacementWatchpoint.cpp:
2817         * jit/JumpReplacementWatchpoint.h:
2818
2819 2012-07-11  Filip Pizlo  <fpizlo@apple.com>
2820
2821         Watchpoints and jump replacement should be decoupled
2822         https://bugs.webkit.org/show_bug.cgi?id=91016
2823
2824         Reviewed by Oliver Hunt.
2825
2826         * CMakeLists.txt:
2827         * GNUmakefile.list.am:
2828         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
2829         * JavaScriptCore.xcodeproj/project.pbxproj:
2830         * Target.pri:
2831         * assembler/AbstractMacroAssembler.h:
2832         (JSC):
2833         (Label):
2834         * bytecode/CodeBlock.h:
2835         (JSC::CodeBlock::appendWatchpoint):
2836         (JSC::CodeBlock::watchpoint):
2837         (DFGData):
2838         * bytecode/Watchpoint.cpp:
2839         (JSC):
2840         * bytecode/Watchpoint.h:
2841         (JSC::Watchpoint::Watchpoint):
2842         (Watchpoint):
2843         (JSC::Watchpoint::fire):
2844         * dfg/DFGSpeculativeJIT.h:
2845         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
2846         * jit/JumpReplacementWatchpoint.cpp: Added.
2847         (JSC):
2848         (JSC::JumpReplacementWatchpoint::correctLabels):
2849         (JSC::JumpReplacementWatchpoint::fireInternal):
2850         * jit/JumpReplacementWatchpoint.h: Added.
2851         (JSC):
2852         (JumpReplacementWatchpoint):
2853         (JSC::JumpReplacementWatchpoint::JumpReplacementWatchpoint):
2854         (JSC::JumpReplacementWatchpoint::setDestination):
2855
2856 2012-07-11  Kevin Ollivier  <kevino@theolliviers.com>
2857
2858         [wx] Unreviewed build fix. Don't try to build udis86_itab.c since it's included by
2859         another file.
2860
2861         * wscript:
2862
2863 2012-07-11  Chao-ying Fu  <fu@mips.com>
2864
2865         Add MIPS convertibleLoadPtr and other functions
2866         https://bugs.webkit.org/show_bug.cgi?id=90714
2867
2868         Reviewed by Oliver Hunt.
2869
2870         * assembler/MIPSAssembler.h:
2871         (JSC::MIPSAssembler::labelIgnoringWatchpoints):
2872         (MIPSAssembler):
2873         (JSC::MIPSAssembler::replaceWithLoad):
2874         (JSC::MIPSAssembler::replaceWithAddressComputation):
2875         * assembler/MacroAssemblerMIPS.h:
2876         (JSC::MacroAssemblerMIPS::convertibleLoadPtr):
2877         (MacroAssemblerMIPS):
2878
2879 2012-07-11  Anders Carlsson  <andersca@apple.com>
2880
2881         Add -Wtautological-compare and -Wsign-compare warning flags
2882         https://bugs.webkit.org/show_bug.cgi?id=90994
2883
2884         Reviewed by Mark Rowe.
2885
2886         * Configurations/Base.xcconfig:
2887
2888 2012-07-11  Benjamin Poulain  <bpoulain@apple.com>
2889
2890         Simplify the copying of JSC ARMv7's LinkRecord
2891         https://bugs.webkit.org/show_bug.cgi?id=90930
2892
2893         Reviewed by Filip Pizlo.
2894
2895         The class LinkRecord is used by value everywhere in ARMv7Assembler. The compiler uses
2896         memmove() to move the objects.
2897
2898         The problem is memmove() is overkill for this object, moving the value can be done with
2899         3 load-store. This patch adds an operator= to the class doing more efficient copying.
2900         This reduces the link time by 19%.
2901
2902         * assembler/ARMv7Assembler.h:
2903         (JSC::ARMv7Assembler::LinkRecord::LinkRecord):
2904         (JSC::ARMv7Assembler::LinkRecord::operator=):
2905         (JSC::ARMv7Assembler::LinkRecord::from):
2906         (JSC::ARMv7Assembler::LinkRecord::setFrom):
2907         (JSC::ARMv7Assembler::LinkRecord::to):
2908         (JSC::ARMv7Assembler::LinkRecord::type):
2909         (JSC::ARMv7Assembler::LinkRecord::linkType):
2910         (JSC::ARMv7Assembler::LinkRecord::setLinkType):
2911         (JSC::ARMv7Assembler::LinkRecord::condition):
2912
2913 2012-07-11  Andy Wingo  <wingo@igalia.com>
2914
2915         jsc: Parse options before creating global data
2916         https://bugs.webkit.org/show_bug.cgi?id=90975
2917
2918         Reviewed by Filip Pizlo.
2919
2920         This patch moves the options parsing in "jsc" before the creation
2921         of the JSGlobalData, so that --useJIT=no has a chance to take
2922         effect.
2923
2924         * jsc.cpp:
2925         (CommandLine::parseArguments): Refactor to be a class, and take
2926         argc and argv as constructor arguments.
2927         (jscmain): Move arg parsing before JSGlobalData creation.
2928
2929 2012-07-10  Filip Pizlo  <fpizlo@apple.com>
2930
2931         REGRESSION(r122166): It made 170 tests crash on 32 bit platforms
2932         https://bugs.webkit.org/show_bug.cgi?id=90852
2933
2934         Reviewed by Zoltan Herczeg.
2935
2936         If we can't use the range filter, we should still make sure that the
2937         address is remotely sane, otherwise the hashtables will assert.
2938
2939         * jit/JITStubRoutine.h:
2940         (JSC::JITStubRoutine::passesFilter):
2941
2942 2012-07-10  Filip Pizlo  <fpizlo@apple.com>
2943
2944         DFG recompilation heuristics should be based on count, not rate
2945         https://bugs.webkit.org/show_bug.cgi?id=90146
2946
2947         Reviewed by Oliver Hunt.
2948
2949         Rolling r121511 back in after fixing the DFG's interpretation of op_div
2950         profiling, with Gavin's rubber stamp.
2951
2952         This removes a bunch of code that was previously trying to prevent spurious
2953         reoptimizations if a large enough majority of executions of a code block did
2954         not result in OSR exit. It turns out that this code was purely harmful. This
2955         patch removes all of that logic and replaces it with a dead-simple
2956         heuristic: if you exit more than N times (where N is an exponential function
2957         of the number of times the code block has already been recompiled) then we
2958         will recompile.
2959
2960         This appears to be a broad ~1% win on many benchmarks large and small.
2961
2962         * bytecode/CodeBlock.cpp:
2963         (JSC::CodeBlock::CodeBlock):
2964         * bytecode/CodeBlock.h:
2965         (JSC::CodeBlock::couldTakeSpecialFastCase):
2966         (CodeBlock):
2967         (JSC::CodeBlock::osrExitCounter):
2968         (JSC::CodeBlock::countOSRExit):
2969         (JSC::CodeBlock::addressOfOSRExitCounter):
2970         (JSC::CodeBlock::offsetOfOSRExitCounter):
2971         (JSC::CodeBlock::adjustedExitCountThreshold):
2972         (JSC::CodeBlock::exitCountThresholdForReoptimization):
2973         (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
2974         (JSC::CodeBlock::shouldReoptimizeNow):
2975         (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
2976         * bytecode/ExecutionCounter.cpp:
2977         (JSC::ExecutionCounter::setThreshold):
2978         * bytecode/ExecutionCounter.h:
2979         (ExecutionCounter):
2980         (JSC::ExecutionCounter::clippedThreshold):
2981         * dfg/DFGByteCodeParser.cpp:
2982         (JSC::DFG::ByteCodeParser::makeDivSafe):
2983         * dfg/DFGJITCompiler.cpp:
2984         (JSC::DFG::JITCompiler::compileBody):
2985         * dfg/DFGOSRExit.cpp:
2986         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
2987         * dfg/DFGOSRExitCompiler.cpp:
2988         (JSC::DFG::OSRExitCompiler::handleExitCounts):
2989         * dfg/DFGOperations.cpp:
2990         * jit/JITStubs.cpp:
2991         (JSC::DEFINE_STUB_FUNCTION):
2992         * runtime/Options.h:
2993         (JSC):
2994
2995 2012-07-09  Matt Falkenhagen  <falken@chromium.org>
2996
2997         Add ENABLE_DIALOG_ELEMENT and skeleton files
2998         https://bugs.webkit.org/show_bug.cgi?id=90521
2999
3000         Reviewed by Kent Tamura.
3001
3002         * Configurations/FeatureDefines.xcconfig:
3003
3004 2012-07-09  Filip Pizlo  <fpizlo@apple.com>
3005
3006         Unreviewed, roll out http://trac.webkit.org/changeset/121511
3007         It made in-browser V8v7 10% slower.
3008
3009         * bytecode/CodeBlock.cpp:
3010         (JSC::CodeBlock::CodeBlock):
3011         * bytecode/CodeBlock.h:
3012         (CodeBlock):
3013         (JSC::CodeBlock::countSpeculationSuccess):
3014         (JSC::CodeBlock::countSpeculationFailure):
3015         (JSC::CodeBlock::speculativeSuccessCounter):
3016         (JSC::CodeBlock::speculativeFailCounter):
3017         (JSC::CodeBlock::forcedOSRExitCounter):
3018         (JSC::CodeBlock::addressOfSpeculativeSuccessCounter):
3019         (JSC::CodeBlock::addressOfSpeculativeFailCounter):
3020         (JSC::CodeBlock::addressOfForcedOSRExitCounter):
3021         (JSC::CodeBlock::offsetOfSpeculativeSuccessCounter):
3022         (JSC::CodeBlock::offsetOfSpeculativeFailCounter):
3023         (JSC::CodeBlock::offsetOfForcedOSRExitCounter):
3024         (JSC::CodeBlock::largeFailCountThreshold):
3025         (JSC::CodeBlock::largeFailCountThresholdForLoop):
3026         (JSC::CodeBlock::shouldReoptimizeNow):
3027         (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
3028         * bytecode/ExecutionCounter.cpp:
3029         (JSC::ExecutionCounter::setThreshold):
3030         * bytecode/ExecutionCounter.h:
3031         (ExecutionCounter):
3032         * dfg/DFGJITCompiler.cpp:
3033         (JSC::DFG::JITCompiler::compileBody):
3034         * dfg/DFGOSRExit.cpp:
3035         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
3036         * dfg/DFGOSRExitCompiler.cpp:
3037         (JSC::DFG::OSRExitCompiler::handleExitCounts):
3038         * dfg/DFGOperations.cpp:
3039         * jit/JITStubs.cpp:
3040         (JSC::DEFINE_STUB_FUNCTION):
3041         * runtime/Options.h:
3042         (JSC):
3043
3044 2012-07-09  Filip Pizlo  <fpizlo@apple.com>
3045
3046         DFG may get stuck in an infinite fix point if it constant folds a mispredicted node
3047         https://bugs.webkit.org/show_bug.cgi?id=90829
3048         <rdar://problem/11823843>
3049
3050         Reviewed by Oliver Hunt.
3051
3052         If a node is shown to have been mispredicted during CFA, then don't allow constant
3053         folding to make the graph even more degenerate. Instead, pull back on constant folding
3054         and allow the normal OSR machinery to fix our profiling so that a future recompilation
3055         doesn't see the same mistake.
3056
3057         * dfg/DFGAbstractState.cpp:
3058         (JSC::DFG::AbstractState::execute):
3059         * dfg/DFGAbstractState.h:
3060         (JSC::DFG::AbstractState::trySetConstant):
3061         (AbstractState):
3062         * dfg/DFGPhase.h:
3063         (JSC::DFG::Phase::name):
3064         (Phase):
3065         (JSC::DFG::runAndLog):
3066         (DFG):
3067         (JSC::DFG::runPhase):
3068
3069 2012-07-09  Filip Pizlo  <fpizlo@apple.com>
3070
3071         It should be possible to jettison JIT stub routines even if they are currently running
3072         https://bugs.webkit.org/show_bug.cgi?id=90731
3073
3074         Reviewed by Gavin Barraclough.
3075
3076         This gives the GC awareness of all JIT-generated stubs for inline caches. That
3077         means that if you want to delete a JIT-generated stub, you don't have to worry
3078         about whether or not it is currently running: if there is a chance that it might
3079         be, the GC will kindly defer deletion until non-running-ness is proved.
3080
3081         * CMakeLists.txt:
3082         * GNUmakefile.list.am:
3083         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3084         * JavaScriptCore.xcodeproj/project.pbxproj:
3085         * Target.pri:
3086         * bytecode/Instruction.h:
3087         (JSC):
3088         (PolymorphicStubInfo):
3089         (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
3090         (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
3091         * bytecode/PolymorphicPutByIdList.cpp:
3092         (JSC::PutByIdAccess::fromStructureStubInfo):
3093         * bytecode/PolymorphicPutByIdList.h:
3094         (JSC::PutByIdAccess::transition):
3095         (JSC::PutByIdAccess::replace):
3096         (JSC::PutByIdAccess::stubRoutine):
3097         (PutByIdAccess):
3098         (JSC::PolymorphicPutByIdList::currentSlowPathTarget):
3099         * bytecode/StructureStubInfo.h:
3100         (JSC::StructureStubInfo::reset):
3101         * dfg/DFGRepatch.cpp:
3102         (JSC::DFG::generateProtoChainAccessStub):
3103         (JSC::DFG::tryCacheGetByID):
3104         (JSC::DFG::tryBuildGetByIDList):
3105         (JSC::DFG::tryBuildGetByIDProtoList):
3106         (JSC::DFG::emitPutReplaceStub):
3107         (JSC::DFG::emitPutTransitionStub):
3108         (JSC::DFG::tryCachePutByID):
3109         (JSC::DFG::tryBuildPutByIdList):
3110         * heap/ConservativeRoots.cpp:
3111         (JSC):
3112         (DummyMarkHook):
3113         (JSC::DummyMarkHook::mark):
3114         (JSC::ConservativeRoots::add):
3115         (CompositeMarkHook):
3116         (JSC::CompositeMarkHook::CompositeMarkHook):
3117         (JSC::CompositeMarkHook::mark):
3118         * heap/ConservativeRoots.h:
3119         (JSC):
3120         (ConservativeRoots):
3121         * heap/Heap.cpp:
3122         (JSC::Heap::markRoots):
3123         (JSC::Heap::deleteUnmarkedCompiledCode):
3124         * heap/Heap.h:
3125         (JSC):
3126         (Heap):
3127         * heap/JITStubRoutineSet.cpp: Added.
3128         (JSC):
3129         (JSC::JITStubRoutineSet::JITStubRoutineSet):
3130         (JSC::JITStubRoutineSet::~JITStubRoutineSet):
3131         (JSC::JITStubRoutineSet::add):
3132         (JSC::JITStubRoutineSet::clearMarks):
3133         (JSC::JITStubRoutineSet::markSlow):
3134         (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
3135         (JSC::JITStubRoutineSet::traceMarkedStubRoutines):
3136         * heap/JITStubRoutineSet.h: Added.
3137         (JSC):
3138         (JITStubRoutineSet):
3139         (JSC::JITStubRoutineSet::mark):
3140         * heap/MachineStackMarker.h:
3141         (JSC):
3142         * interpreter/RegisterFile.cpp:
3143         (JSC::RegisterFile::gatherConservativeRoots):
3144         * interpreter/RegisterFile.h:
3145         (JSC):
3146         * jit/ExecutableAllocator.cpp:
3147         (JSC::DemandExecutableAllocator::DemandExecutableAllocator):
3148         * jit/ExecutableAllocator.h:
3149         (JSC):
3150         * jit/ExecutableAllocatorFixedVMPool.cpp:
3151         (JSC):
3152         (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
3153         * jit/GCAwareJITStubRoutine.cpp: Added.
3154         (JSC):
3155         (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
3156         (JSC::GCAwareJITStubRoutine::~GCAwareJITStubRoutine):
3157         (JSC::GCAwareJITStubRoutine::observeZeroRefCount):
3158         (JSC::GCAwareJITStubRoutine::deleteFromGC):
3159         (JSC::GCAwareJITStubRoutine::markRequiredObjectsInternal):
3160         (JSC::MarkingGCAwareJITStubRoutineWithOneObject::MarkingGCAwareJITStubRoutineWithOneObject):
3161         (JSC::MarkingGCAwareJITStubRoutineWithOneObject::~MarkingGCAwareJITStubRoutineWithOneObject):
3162         (JSC::MarkingGCAwareJITStubRoutineWithOneObject::markRequiredObjectsInternal):
3163         (JSC::createJITStubRoutine):
3164         * jit/GCAwareJITStubRoutine.h: Added.
3165         (JSC):
3166         (GCAwareJITStubRoutine):
3167         (JSC::GCAwareJITStubRoutine::markRequiredObjects):
3168         (MarkingGCAwareJITStubRoutineWithOneObject):
3169         * jit/JITPropertyAccess.cpp:
3170         (JSC::JIT::privateCompilePutByIdTransition):
3171         (JSC::JIT::privateCompilePatchGetArrayLength):
3172         (JSC::JIT::privateCompileGetByIdProto):
3173         (JSC::JIT::privateCompileGetByIdSelfList):
3174         (JSC::JIT::privateCompileGetByIdProtoList):
3175         (JSC::JIT::privateCompileGetByIdChainList):
3176         (JSC::JIT::privateCompileGetByIdChain):
3177         * jit/JITPropertyAccess32_64.cpp:
3178         (JSC::JIT::privateCompilePutByIdTransition):
3179         (JSC::JIT::privateCompilePatchGetArrayLength):
3180         (JSC::JIT::privateCompileGetByIdProto):
3181         (JSC::JIT::privateCompileGetByIdSelfList):
3182         (JSC::JIT::privateCompileGetByIdProtoList):
3183         (JSC::JIT::privateCompileGetByIdChainList):
3184         (JSC::JIT::privateCompileGetByIdChain):
3185         * jit/JITStubRoutine.cpp: Added.
3186         (JSC):
3187         (JSC::JITStubRoutine::~JITStubRoutine):
3188         (JSC::JITStubRoutine::observeZeroRefCount):
3189         * jit/JITStubRoutine.h: Added.
3190         (JSC):
3191         (JITStubRoutine):
3192         (JSC::JITStubRoutine::JITStubRoutine):
3193         (JSC::JITStubRoutine::createSelfManagedRoutine):
3194         (JSC::JITStubRoutine::code):
3195         (JSC::JITStubRoutine::asCodePtr):
3196         (JSC::JITStubRoutine::ref):
3197         (JSC::JITStubRoutine::deref):
3198         (JSC::JITStubRoutine::startAddress):
3199         (JSC::JITStubRoutine::endAddress):
3200         (JSC::JITStubRoutine::addressStep):
3201         (JSC::JITStubRoutine::canPerformRangeFilter):
3202         (JSC::JITStubRoutine::filteringStartAddress):
3203         (JSC::JITStubRoutine::filteringExtentSize):
3204         (JSC::JITStubRoutine::passesFilter):
3205         * jit/JITStubs.cpp:
3206         (JSC::DEFINE_STUB_FUNCTION):
3207         (JSC::getPolymorphicAccessStructureListSlot):
3208
3209 2012-07-09  Sheriff Bot  <webkit.review.bot@gmail.com>
3210
3211         Unreviewed, rolling out r122107.
3212         http://trac.webkit.org/changeset/122107
3213         https://bugs.webkit.org/show_bug.cgi?id=90794
3214
3215         Build failure on Mac debug bots (Requested by falken_ on
3216         #webkit).
3217
3218         * Configurations/FeatureDefines.xcconfig:
3219
3220 2012-07-09  Matt Falkenhagen  <falken@chromium.org>
3221
3222         Add ENABLE_DIALOG_ELEMENT and skeleton files
3223         https://bugs.webkit.org/show_bug.cgi?id=90521
3224
3225         Reviewed by Kent Tamura.
3226
3227         * Configurations/FeatureDefines.xcconfig:
3228
3229 2012-07-08  Ryosuke Niwa  <rniwa@webkit.org>
3230
3231         gcc build fix after r121925.
3232
3233         * runtime/JSObject.h:
3234         (JSC::JSFinalObject::finishCreation):
3235
3236 2012-07-08  Zoltan Herczeg  <zherczeg@webkit.org>
3237
3238         [Qt][ARM] Implementing missing macro assembler instructions after r121925
3239         https://bugs.webkit.org/show_bug.cgi?id=90657
3240
3241         Reviewed by Csaba Osztrogonác.
3242
3243         Implementing convertibleLoadPtr, replaceWithLoad and
3244         replaceWithAddressComputation.
3245
3246         * assembler/ARMAssembler.h:
3247         (JSC::ARMAssembler::replaceWithLoad):
3248         (ARMAssembler):
3249         (JSC::ARMAssembler::replaceWithAddressComputation):
3250         * assembler/MacroAssemblerARM.h:
3251         (JSC::MacroAssemblerARM::convertibleLoadPtr):
3252         (MacroAssemblerARM):
3253
3254 2012-07-06  Filip Pizlo  <fpizlo@apple.com>
3255
3256         WebKit Version 5.1.7 (6534.57.2, r121935): Double-click no longer works on OpenStreetMap
3257         https://bugs.webkit.org/show_bug.cgi?id=90703
3258
3259         Reviewed by Michael Saboff.
3260
3261         It turns out that in my object model refactoring, I managed to fix get_by_pname in all
3262         execution engines except 64-bit baseline JIT.
3263
3264         * jit/JITPropertyAccess.cpp:
3265         (JSC::JIT::emit_op_get_by_pname):
3266
3267 2012-07-06  Pravin D  <pravind.2k4@gmail.com>
3268
3269         Build Error on Qt Linux build
3270         https://bugs.webkit.org/show_bug.cgi?id=90699
3271
3272         Reviewed by Laszlo Gombos.
3273
3274         * parser/Parser.cpp:
3275         (JSC::::parseForStatement):
3276         Removed unused boolean variable as this was causing build error on Qt Linux.
3277
3278 2012-07-06  Nuno Lopes  <nlopes@apple.com>
3279
3280         Fix build with recent clang.
3281         https://bugs.webkit.org/show_bug.cgi?id=90634
3282
3283         Reviewed by Oliver Hunt.
3284
3285         * jit/SpecializedThunkJIT.h:
3286         (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
3287         (SpecializedThunkJIT):
3288         * jit/ThunkGenerators.cpp:
3289         (JSC::charCodeAtThunkGenerator):
3290         (JSC::charAtThunkGenerator):
3291         (JSC::fromCharCodeThunkGenerator):
3292         (JSC::sqrtThunkGenerator):
3293         (JSC::floorThunkGenerator):
3294         (JSC::ceilThunkGenerator):
3295         (JSC::roundThunkGenerator):
3296         (JSC::expThunkGenerator):
3297         (JSC::logThunkGenerator):
3298         (JSC::absThunkGenerator):
3299         (JSC::powThunkGenerator):
3300         * parser/ASTBuilder.h:
3301         (JSC::ASTBuilder::createAssignResolve):
3302         (JSC::ASTBuilder::createForLoop):
3303         (JSC::ASTBuilder::createForInLoop):
3304         (JSC::ASTBuilder::makeAssignNode):
3305         (JSC::ASTBuilder::makePrefixNode):
3306         (JSC::ASTBuilder::makePostfixNode):
3307         * parser/NodeConstructors.h:
3308         (JSC::PostfixErrorNode::PostfixErrorNode):
3309         (JSC::PrefixErrorNode::PrefixErrorNode):
3310         (JSC::AssignResolveNode::AssignResolveNode):
3311         (JSC::AssignErrorNode::AssignErrorNode):
3312         (JSC::ForNode::ForNode):
3313         (JSC::ForInNode::ForInNode):
3314         * parser/Nodes.h:
3315         (FunctionCallResolveNode):
3316         (PostfixErrorNode):
3317         (PrefixErrorNode):
3318         (ReadModifyResolveNode):
3319         (AssignResolveNode):
3320         (AssignErrorNode):
3321         (ForNode):
3322         (ForInNode):
3323         * parser/Parser.cpp:
3324         (JSC::::parseVarDeclarationList):
3325         (JSC::::parseForStatement):
3326         * parser/SyntaxChecker.h:
3327         (JSC::SyntaxChecker::createAssignResolve):
3328         (JSC::SyntaxChecker::createForLoop):
3329
3330 2012-07-06  Zoltan Herczeg  <zherczeg@webkit.org>
3331
3332         [Qt][ARM] REGRESSION(r121885): It broke 30 jsc tests, 500+ layout tests
3333         https://bugs.webkit.org/show_bug.cgi?id=90656
3334
3335         Reviewed by Csaba Osztrogonác.
3336
3337         Typo fixes.
3338
3339         * assembler/MacroAssemblerARM.cpp:
3340         (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
3341         Rename getOp2Byte() -> getOp2Half()
3342         * assembler/MacroAssemblerARMv7.h:
3343         (JSC::MacroAssemblerARMv7::convertibleLoadPtr):
3344         Add a necessary space.
3345         * jit/JITStubs.cpp:
3346         (JSC):
3347         Revert INLINE_ARM_FUNCTION macro.
3348
3349 2012-07-05  Filip Pizlo  <fpizlo@apple.com>
3350
3351         REGRESSION(r121925): It broke 5 sputnik tests on x86 platforms
3352         https://bugs.webkit.org/show_bug.cgi?id=90658
3353
3354         Reviewed by Zoltan Herczeg.
3355
3356         Under the new object model, out-of-line property accesses such as those
3357         in ResolveGlobal must account for the fact that the offset to the Kth
3358         property is represented by K + inlineStorageCapacity. Hence, the property
3359         loads in ResolveGlobal must have an additional -inlineStorageCapacity *
3360         sizeof(JSValue) offset.
3361
3362         * dfg/DFGSpeculativeJIT32_64.cpp:
3363         (JSC::DFG::SpeculativeJIT::compile):
3364
3365 2012-07-05  Csaba Osztrogonác  <ossy@webkit.org>
3366
3367         [Qt] Unreviewed 64 bit buildfix after r121925.
3368
3369         * bytecode/PutByIdStatus.cpp:
3370         (JSC::PutByIdStatus::computeFromLLInt):
3371
3372 2012-07-05  Michael Saboff  <msaboff@apple.com>
3373
3374         JSString::tryHashConstLock() fails to get exclusive lock
3375         https://bugs.webkit.org/show_bug.cgi?id=90639
3376
3377         Reviewed by Oliver Hunt.
3378
3379         Added check that the string is already locked even before compare and swap.
3380
3381         * heap/MarkStack.cpp:
3382         (JSC::JSString::tryHashConstLock):
3383
3384 2012-07-04  Filip Pizlo  <fpizlo@apple.com>
3385
3386         Inline property storage should not be wasted when it is exhausted
3387         https://bugs.webkit.org/show_bug.cgi?id=90347
3388
3389         Reviewed by Gavin Barraclough.
3390
3391         Previously, if we switched an object from using inline storage to out-of-line
3392         storage, we would abandon the inline storage. This would have two main implications:
3393         (i) all accesses to the object, even for properties that were previously in inline
3394         storage, must now take an extra indirection; and (ii) we waste a non-trivial amount
3395         of space since we must allocate additional out-of-line storage to hold properties
3396         that would have fit in the inline storage. There's also the copying cost when
3397         switching to out-of-line storage - we must copy all inline properties into ouf-of-line
3398         storage.
3399
3400         This patch changes the way that object property storage works so that we can use both
3401         inline and out-of-line storage concurrently. This is accomplished by introducing a
3402         new notion of property offset. This PropertyOffset is a 32-bit signed integer and it
3403         behaves as follows:
3404
3405         offset == -1: invalid offset, indicating a property that does not exist.
3406
3407         0 <= offset <= inlineStorageCapacity: offset into inline storage.
3408
3409         inlineStorageCapacity < offset: offset into out-of-line storage.
3410
3411         Because non-final objects don't have inline storage, the only valid PropertyOffsets
3412         for those objects' properties are -1 or > inlineStorageCapacity.
3413
3414         This now means that the decision to use inline or out-of-line storage for an access is
3415         made based on the offset, rather than the structure. It also means that any access
3416         where the offset is a variable must have an extra branch, unless the type of the
3417         object is also known (if it's known to be a non-final object then we can just assert
3418         that the offset is >= inlineStorageCapacity).
3419
3420         This looks like a big Kraken speed-up and a slight V8 speed-up.
3421
3422         * GNUmakefile.list.am:
3423         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
3424         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
3425         * JavaScriptCore.xcodeproj/project.pbxproj:
3426         * assembler/ARMv7Assembler.h:
3427         (ARMv7Assembler):
3428         (JSC::ARMv7Assembler::ldrWide8BitImmediate):
3429         (JSC::ARMv7Assembler::replaceWithLoad):
3430         (JSC::ARMv7Assembler::replaceWithAddressComputation):
3431         * assembler/AbstractMacroAssembler.h:
3432         (AbstractMacroAssembler):
3433         (ConvertibleLoadLabel):
3434         (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::ConvertibleLoadLabel):
3435         (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::isSet):
3436         (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints):
3437         (JSC::AbstractMacroAssembler::replaceWithLoad):
3438         (JSC::AbstractMacroAssembler::replaceWithAddressComputation):
3439         * assembler/CodeLocation.h:
3440         (JSC):
3441         (CodeLocationCommon):
3442         (CodeLocationConvertibleLoad):
3443         (JSC::CodeLocationConvertibleLoad::CodeLocationConvertibleLoad):
3444         (JSC::CodeLocationCommon::convertibleLoadAtOffset):
3445         * assembler/LinkBuffer.cpp:
3446         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
3447         * assembler/LinkBuffer.h:
3448         (LinkBuffer):
3449         (JSC::LinkBuffer::locationOf):
3450         * assembler/MacroAssemblerARMv7.h:
3451         (MacroAssemblerARMv7):
3452         (JSC::MacroAssemblerARMv7::convertibleLoadPtr):
3453         * assembler/MacroAssemblerX86.h:
3454         (JSC::MacroAssemblerX86::convertibleLoadPtr):
3455         (MacroAssemblerX86):
3456         * assembler/MacroAssemblerX86_64.h:
3457         (JSC::MacroAssemblerX86_64::convertibleLoadPtr):
3458         (MacroAssemblerX86_64):
3459         * assembler/RepatchBuffer.h:
3460         (RepatchBuffer):
3461         (JSC::RepatchBuffer::replaceWithLoad):
3462         (JSC::RepatchBuffer::replaceWithAddressComputation):
3463         (JSC::RepatchBuffer::setLoadInstructionIsActive):
3464         * assembler/X86Assembler.h:
3465         (JSC::X86Assembler::replaceWithLoad):
3466         (X86Assembler):
3467         (JSC::X86Assembler::replaceWithAddressComputation):
3468         * bytecode/CodeBlock.cpp:
3469         (JSC::CodeBlock::printGetByIdOp):
3470         (JSC::CodeBlock::dump):
3471         (JSC::CodeBlock::finalizeUnconditionally):
3472         * bytecode/GetByIdStatus.cpp:
3473         (JSC::GetByIdStatus::computeFromLLInt):
3474         (JSC::GetByIdStatus::computeForChain):
3475         (JSC::GetByIdStatus::computeFor):
3476         * bytecode/GetByIdStatus.h:
3477         (JSC::GetByIdStatus::GetByIdStatus):
3478         (JSC::GetByIdStatus::offset):
3479         (GetByIdStatus):
3480         * bytecode/Opcode.h:
3481         (JSC):
3482         (JSC::padOpcodeName):
3483         * bytecode/PutByIdStatus.cpp:
3484         (JSC::PutByIdStatus::computeFromLLInt):
3485         (JSC::PutByIdStatus::computeFor):
3486         * bytecode/PutByIdStatus.h:
3487         (JSC::PutByIdStatus::PutByIdStatus):
3488         (JSC::PutByIdStatus::offset):
3489         (PutByIdStatus):
3490         * bytecode/ResolveGlobalStatus.cpp:
3491         (JSC):
3492         (JSC::computeForStructure):
3493         * bytecode/ResolveGlobalStatus.h:
3494         (JSC::ResolveGlobalStatus::ResolveGlobalStatus):
3495         (JSC::ResolveGlobalStatus::offset):
3496         (ResolveGlobalStatus):
3497         * bytecode/StructureSet.h:
3498         (StructureSet):
3499         * bytecode/StructureStubInfo.h:
3500         * dfg/DFGByteCodeParser.cpp:
3501         (ByteCodeParser):
3502         (JSC::DFG::ByteCodeParser::handleGetByOffset):
3503         (JSC::DFG::ByteCodeParser::handleGetById):
3504         (JSC::DFG::ByteCodeParser::parseBlock):
3505         * dfg/DFGCapabilities.h:
3506         (JSC::DFG::canCompileOpcode):
3507         * dfg/DFGJITCompiler.cpp:
3508         (JSC::DFG::JITCompiler::link):
3509         * dfg/DFGJITCompiler.h:
3510         (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
3511         (PropertyAccessRecord):
3512         * dfg/DFGRepatch.cpp:
3513         (JSC::DFG::dfgRepatchByIdSelfAccess):
3514         (JSC::DFG::generateProtoChainAccessStub):
3515         (JSC::DFG::tryCacheGetByID):
3516         (JSC::DFG::tryBuildGetByIDList):
3517         (JSC::DFG::tryBuildGetByIDProtoList):
3518         (JSC::DFG::emitPutReplaceStub):
3519         (JSC::DFG::emitPutTransitionStub):
3520         (JSC::DFG::tryCachePutByID):
3521         (JSC::DFG::tryBuildPutByIdList):
3522         * dfg/DFGSpeculativeJIT.h:
3523         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
3524         * dfg/DFGSpeculativeJIT32_64.cpp:
3525         (JSC::DFG::SpeculativeJIT::cachedGetById):
3526         (JSC::DFG::SpeculativeJIT::cachedPutById):
3527         (JSC::DFG::SpeculativeJIT::compile):
3528         * dfg/DFGSpeculativeJIT64.cpp:
3529         (JSC::DFG::SpeculativeJIT::cachedGetById):
3530         (JSC::DFG::SpeculativeJIT::cachedPutById):
3531         (JSC::DFG::SpeculativeJIT::compile):
3532         * heap/MarkStack.cpp:
3533         (JSC::visitChildren):
3534         * interpreter/Interpreter.cpp:
3535         (JSC::Interpreter::tryCacheGetByID):
3536         (JSC::Interpreter::privateExecute):
3537         * jit/JIT.cpp:
3538         (JSC::JIT::privateCompileMainPass):
3539         (JSC::JIT::privateCompileSlowCases):
3540         (JSC::PropertyStubCompilationInfo::copyToStubInfo):
3541         * jit/JIT.h:
3542         (JSC::PropertyStubCompilationInfo::PropertyStubCompilationInfo):
3543         (JSC::JIT::compileGetByIdProto):
3544         (JSC::JIT::compileGetByIdSelfList):
3545         (JSC::JIT::compileGetByIdProtoList):
3546         (JSC::JIT::compileGetByIdChainList):
3547         (JSC::JIT::compileGetByIdChain):
3548         (JSC::JIT::compilePutByIdTransition):
3549         (JIT):
3550         * jit/JITInlineMethods.h:
3551         (JSC::JIT::emitAllocateBasicJSObject):
3552         * jit/JITOpcodes.cpp:
3553         (JSC::JIT::emit_op_resolve_global):
3554         * jit/JITOpcodes32_64.cpp:
3555         (JSC::JIT::emit_op_resolve_global):
3556         * jit/JITPropertyAccess.cpp:
3557         (JSC::JIT::compileGetDirectOffset):
3558         (JSC::JIT::emit_op_method_check):
3559         (JSC::JIT::compileGetByIdHotPath):
3560         (JSC::JIT::emit_op_put_by_id):
3561         (JSC::JIT::compilePutDirectOffset):
3562         (JSC::JIT::privateCompilePutByIdTransition):
3563         (JSC::JIT::patchGetByIdSelf):
3564         (JSC::JIT::patchPutByIdReplace):
3565         (JSC::JIT::privateCompileGetByIdProto):
3566         (JSC::JIT::privateCompileGetByIdSelfList):
3567         (JSC::JIT::privateCompileGetByIdProtoList):
3568         (JSC::JIT::privateCompileGetByIdChainList):
3569         (JSC::JIT::privateCompileGetByIdChain):
3570         * jit/JITPropertyAccess32_64.cpp:
3571         (JSC::JIT::emit_op_method_check):
3572         (JSC::JIT::compileGetByIdHotPath):
3573         (JSC::JIT::emit_op_put_by_id):
3574         (JSC::JIT::compilePutDirectOffset):
3575         (JSC::JIT::compileGetDirectOffset):
3576         (JSC::JIT::privateCompilePutByIdTransition):
3577         (JSC::JIT::patchGetByIdSelf):
3578         (JSC::JIT::patchPutByIdReplace):
3579         (JSC::JIT::privateCompileGetByIdProto):
3580         (JSC::JIT::privateCompileGetByIdSelfList):
3581         (JSC::JIT::privateCompileGetByIdProtoList):
3582         (JSC::JIT::privateCompileGetByIdChainList):
3583         (JSC::JIT::privateCompileGetByIdChain):
3584         (JSC::JIT::emit_op_get_by_pname):
3585         * jit/JITStubs.cpp:
3586         (JSC::JITThunks::tryCacheGetByID):
3587         (JSC::DEFINE_STUB_FUNCTION):
3588         * llint/LLIntSlowPaths.cpp:
3589         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
3590         * llint/LowLevelInterpreter.asm:
3591         * llint/LowLevelInterpreter32_64.asm:
3592         * llint/LowLevelInterpreter64.asm:
3593         * offlineasm/x86.rb:
3594         * runtime/JSGlobalObject.h:
3595         (JSGlobalObject):
3596         (JSC::JSGlobalObject::functionNameOffset):
3597         * runtime/JSObject.cpp:
3598         (JSC::JSObject::visitChildren):
3599         (JSC):
3600         (JSC::JSFinalObject::visitChildren):
3601         (JSC::JSObject::put):
3602         (JSC::JSObject::deleteProperty):
3603         (JSC::JSObject::getPropertySpecificValue):
3604         (JSC::JSObject::removeDirect):
3605         (JSC::JSObject::growOutOfLineStorage):
3606         (JSC::JSObject::getOwnPropertyDescriptor):
3607         * runtime/JSObject.h:
3608         (JSObject):
3609         (JSC::JSObject::getDirect):
3610         (JSC::JSObject::getDirectLocation):
3611         (JSC::JSObject::hasInlineStorage):
3612         (JSC::JSObject::inlineStorageUnsafe):
3613         (JSC::JSObject::inlineStorage):
3614         (JSC::JSObject::outOfLineStorage):
3615         (JSC::JSObject::locationForOffset):
3616         (JSC::JSObject::offsetForLocation):
3617         (JSC::JSObject::getDirectOffset):
3618         (JSC::JSObject::putDirectOffset):
3619         (JSC::JSObject::putUndefinedAtDirectOffset):
3620         (JSC::JSObject::addressOfOutOfLineStorage):
3621         (JSC::JSObject::finishCreation):
3622         (JSC::JSNonFinalObject::JSNonFinalObject):
3623         (JSC::JSNonFinalObject::finishCreation):
3624         (JSFinalObject):
3625         (JSC::JSFinalObject::finishCreation):
3626         (JSC::JSFinalObject::JSFinalObject):
3627         (JSC::JSObject::offsetOfOutOfLineStorage):
3628         (JSC::JSObject::setOutOfLineStorage):
3629         (JSC::JSObject::JSObject):
3630         (JSC):
3631         (JSC::JSCell::fastGetOwnProperty):
3632         (JSC::JSObject::putDirectInternal):
3633         (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
3634         (JSC::JSObject::putDirectWithoutTransition):
3635         (JSC::offsetRelativeToPatchedStorage):
3636         (JSC::indexRelativeToBase):
3637         (JSC::offsetRelativeToBase):
3638         * runtime/JSPropertyNameIterator.cpp:
3639         (JSC::JSPropertyNameIterator::create):
3640         * runtime/JSPropertyNameIterator.h:
3641         (JSPropertyNameIterator):
3642         (JSC::JSPropertyNameIterator::getOffset):
3643         (JSC::JSPropertyNameIterator::finishCreation):
3644         * runtime/JSValue.cpp:
3645         (JSC::JSValue::putToPrimitive):
3646         * runtime/Operations.h:
3647         (JSC::normalizePrototypeChain):
3648         * runtime/Options.cpp:
3649         (JSC):
3650         (JSC::Options::initialize):
3651         * runtime/PropertyMapHashTable.h:
3652         (PropertyMapEntry):
3653         (JSC::PropertyMapEntry::PropertyMapEntry):
3654         (PropertyTable):
3655         (JSC::PropertyTable::PropertyTable):
3656         (JSC::PropertyTable::getDeletedOffset):
3657         (JSC::PropertyTable::addDeletedOffset):
3658         (JSC::PropertyTable::nextOffset):
3659         (JSC):
3660         (JSC::PropertyTable::sizeInMemory):
3661         * runtime/PropertyOffset.h: Added.
3662         (JSC):
3663         (JSC::checkOffset):
3664         (JSC::validateOffset):
3665         (JSC::isValidOffset):
3666         (JSC::isInlineOffset):
3667         (JSC::isOutOfLineOffset):
3668         (JSC::offsetInInlineStorage):
3669         (JSC::offsetInOutOfLineStorage):
3670         (JSC::offsetInRespectiveStorage):
3671         (JSC::numberOfOutOfLineSlotsForLastOffset):
3672         (JSC::numberOfSlotsForLastOffset):
3673         (JSC::nextPropertyOffsetFor):
3674         (JSC::firstPropertyOffsetFor):
3675         * runtime/PropertySlot.h:
3676         (JSC::PropertySlot::cachedOffset):
3677         (JSC::PropertySlot::setValue):
3678         (JSC::PropertySlot::setCacheableGetterSlot):
3679         (JSC::PropertySlot::clearOffset):
3680         * runtime/PutPropertySlot.h:
3681         (JSC::PutPropertySlot::setExistingProperty):
3682         (JSC::PutPropertySlot::setNewProperty):
3683         (JSC::PutPropertySlot::cachedOffset):
3684         (PutPropertySlot):
3685         * runtime/Structure.cpp:
3686         (JSC::Structure::Structure):
3687         (JSC::Structure::materializePropertyMap):
3688         (JSC::nextOutOfLineStorageCapacity):
3689         (JSC::Structure::growOutOfLineCapacity):
3690         (JSC::Structure::suggestedNewOutOfLineStorageCapacity):
3691         (JSC::Structure::addPropertyTransitionToExistingStructure):
3692         (JSC::Structure::addPropertyTransition):
3693         (JSC::Structure::removePropertyTransition):
3694         (JSC::Structure::flattenDictionaryStructure):
3695         (JSC::Structure::addPropertyWithoutTransition):
3696         (JSC::Structure::removePropertyWithoutTransition):
3697         (JSC::Structure::copyPropertyTableForPinning):
3698         (JSC::Structure::get):
3699         (JSC::Structure::putSpecificValue):
3700         (JSC::Structure::remove):
3701         * runtime/Structure.h:
3702         (Structure):
3703         (JSC::Structure::putWillGrowOutOfLineStorage):
3704         (JSC::Structure::previousID):
3705         (JSC::Structure::outOfLineCapacity):
3706         (JSC::Structure::outOfLineSizeForKnownFinalObject):
3707         (JSC::Structure::outOfLineSizeForKnownNonFinalObject):
3708         (JSC::Structure::outOfLineSize):
3709         (JSC::Structure::hasInlineStorage):
3710         (JSC::Structure::inlineCapacity):
3711         (JSC::Structure::inlineSizeForKnownFinalObject):
3712         (JSC::Structure::inlineSize):
3713         (JSC::Structure::totalStorageSize):
3714         (JSC::Structure::totalStorageCapacity):
3715         (JSC::Structure::firstValidOffset):
3716         (JSC::Structure::lastValidOffset):
3717         (JSC::Structure::isValidOffset):
3718         (JSC::Structure::isEmpty):
3719         (JSC::Structure::transitionCount):
3720         (JSC::Structure::get):
3721
3722 2012-07-05  Oliver Hunt  <oliver@apple.com>
3723
3724         JSObjectCallAsFunction should thisConvert the provided thisObject
3725         https://bugs.webkit.org/show_bug.cgi?id=90628
3726
3727         Reviewed by Gavin Barraclough.
3728
3729         Perform this conversion on the provided this object.
3730
3731         * API/JSObjectRef.cpp:
3732         (JSObjectCallAsFunction):
3733
3734 2012-07-05  Zoltan Herczeg  <zherczeg@webkit.org>
3735
3736         [Qt] Unreviewed buildfix after r121886. Typo fix.
3737
3738         * assembler/MacroAssemblerARM.cpp:
3739         (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
3740
3741 2012-07-05  Zoltan Herczeg  <zherczeg@webkit.org>
3742
3743         Port DFG JIT to traditional ARM
3744         https://bugs.webkit.org/show_bug.cgi?id=90198
3745
3746         Reviewed by Filip Pizlo.
3747
3748         This patch contains the macro assembler part of the
3749         DFG JIT support on ARM systems with fixed 32 bit instruction
3750         width. A large amount of old code was refactored, and the ARMv4
3751         or lower support is removed from the macro assembler.
3752
3753         Sunspider is improved by 8%, and V8 is 92%.
3754
3755         * assembler/ARMAssembler.cpp:
3756         (JSC::ARMAssembler::dataTransfer32):
3757         (JSC::ARMAssembler::baseIndexTransfer32):
3758         (JSC):
3759         (JSC::ARMAssembler::dataTransfer16):
3760         (JSC::ARMAssembler::baseIndexTransfer16):
3761         (JSC::ARMAssembler::dataTransferFloat):
3762         (JSC::ARMAssembler::baseIndexTransferFloat):
3763         (JSC::ARMAssembler::executableCopy):
3764         * assembler/ARMAssembler.h:
3765         (JSC::ARMAssembler::ARMAssembler):
3766         (JSC::ARMAssembler::emitInst):
3767         (JSC::ARMAssembler::vmov_f64_r):
3768         (ARMAssembler):
3769         (JSC::ARMAssembler::vabs_f64_r):
3770         (JSC::ARMAssembler::vneg_f64_r):
3771         (JSC::ARMAssembler::ldr_imm):
3772         (JSC::ARMAssembler::ldr_un_imm):
3773         (JSC::ARMAssembler::dtr_u):
3774         (JSC::ARMAssembler::dtr_ur):
3775         (JSC::ARMAssembler::dtr_d):
3776         (JSC::ARMAssembler::dtr_dr):
3777         (JSC::ARMAssembler::dtrh_u):
3778         (JSC::ARMAssembler::dtrh_ur):
3779         (JSC::ARMAssembler::dtrh_d):
3780         (JSC::ARMAssembler::dtrh_dr):
3781         (JSC::ARMAssembler::fdtr_u):
3782         (JSC::ARMAssembler::fdtr_d):
3783         (JSC::ARMAssembler::push_r):
3784         (JSC::ARMAssembler::pop_r):
3785         (JSC::ARMAssembler::poke_r):
3786         (JSC::ARMAssembler::peek_r):
3787         (JSC::ARMAssembler::vmov_vfp64_r):
3788         (JSC::ARMAssembler::vmov_arm64_r):
3789         (JSC::ARMAssembler::vmov_vfp32_r):
3790         (JSC::ARMAssembler::vmov_arm32_r):
3791         (JSC::ARMAssembler::vcvt_u32_f64_r):
3792         (JSC::ARMAssembler::vcvt_f64_f32_r):
3793         (JSC::ARMAssembler::vcvt_f32_f64_r):
3794         (JSC::ARMAssembler::clz_r):
3795         (JSC::ARMAssembler::bkpt):
3796         (JSC::ARMAssembler::bx):
3797         (JSC::ARMAssembler::blx):
3798         (JSC::ARMAssembler::labelIgnoringWatchpoints):
3799         (JSC::ARMAssembler::labelForWatchpoint):
3800         (JSC::ARMAssembler::label):
3801         (JSC::ARMAssembler::getLdrImmAddress):
3802         (JSC::ARMAssembler::replaceWithJump):
3803         (JSC::ARMAssembler::maxJumpReplacementSize):
3804         (JSC::ARMAssembler::getOp2Byte):
3805         (JSC::ARMAssembler::getOp2Half):
3806         (JSC::ARMAssembler::RM):
3807         (JSC::ARMAssembler::RS):
3808         (JSC::ARMAssembler::RD):
3809         (JSC::ARMAssembler::RN):
3810         * assembler/AssemblerBufferWithConstantPool.h:
3811         (JSC::AssemblerBufferWithConstantPool::ensureSpaceForAnyInstruction):
3812         * assembler/MacroAssemblerARM.cpp:
3813         (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
3814         * assembler/MacroAssemblerARM.h:
3815         (JSC::MacroAssemblerARM::add32):
3816         (MacroAssemblerARM):
3817         (JSC::MacroAssemblerARM::and32):
3818         (JSC::MacroAssemblerARM::lshift32):
3819         (JSC::MacroAssemblerARM::mul32):
3820         (JSC::MacroAssemblerARM::neg32):
3821         (JSC::MacroAssemblerARM::rshift32):
3822         (JSC::MacroAssemblerARM::urshift32):
3823         (JSC::MacroAssemblerARM::xor32):
3824         (JSC::MacroAssemblerARM::load8):
3825         (JSC::MacroAssemblerARM::load8Signed):
3826         (JSC::MacroAssemblerARM::load16):
3827         (JSC::MacroAssemblerARM::load16Signed):
3828         (JSC::MacroAssemblerARM::load32):
3829         (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch):
3830         (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch):
3831         (JSC::MacroAssemblerARM::store8):
3832         (JSC::MacroAssemblerARM::store16):
3833         (JSC::MacroAssemblerARM::store32):
3834         (JSC::MacroAssemblerARM::move):
3835         (JSC::MacroAssemblerARM::jump):
3836         (JSC::MacroAssemblerARM::branchAdd32):
3837         (JSC::MacroAssemblerARM::mull32):
3838         (JSC::MacroAssemblerARM::branchMul32):
3839         (JSC::MacroAssemblerARM::nearCall):
3840         (JSC::MacroAssemblerARM::compare32):
3841         (JSC::MacroAssemblerARM::test32):
3842         (JSC::MacroAssemblerARM::sub32):
3843         (JSC::MacroAssemblerARM::call):
3844         (JSC::MacroAssemblerARM::loadFloat):
3845         (JSC::MacroAssemblerARM::loadDouble):
3846         (JSC::MacroAssemblerARM::storeFloat):
3847         (JSC::MacroAssemblerARM::storeDouble):
3848         (JSC::MacroAssemblerARM::moveDouble):
3849         (JSC::MacroAssemblerARM::addDouble):
3850         (JSC::MacroAssemblerARM::divDouble):
3851         (JSC::MacroAssemblerARM::subDouble):
3852         (JSC::MacroAssemblerARM::mulDouble):
3853         (JSC::MacroAssemblerARM::absDouble):
3854         (JSC::MacroAssemblerARM::negateDouble):
3855         (JSC::MacroAssemblerARM::convertInt32ToDouble):
3856         (JSC::MacroAssemblerARM::convertFloatToDouble):
3857         (JSC::MacroAssemblerARM::convertDoubleToFloat):
3858         (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
3859         (JSC::MacroAssemblerARM::branchTruncateDoubleToUint32):
3860         (JSC::MacroAssemblerARM::truncateDoubleToInt32):
3861         (JSC::MacroAssemblerARM::truncateDoubleToUint32):
3862         (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
3863         (JSC::MacroAssemblerARM::branchDoubleNonZero):
3864         (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN):
3865         (JSC::MacroAssemblerARM::invert):
3866         (JSC::MacroAssemblerARM::replaceWithJump):
3867         (JSC::MacroAssemblerARM::maxJumpReplacementSize):
3868         (JSC::MacroAssemblerARM::call32):
3869         * assembler/SH4Assembler.h:
3870         (JSC::SH4Assembler::label):
3871         * dfg/DFGAssemblyHelpers.h:
3872         (JSC::DFG::AssemblyHelpers::debugCall):
3873         (JSC::DFG::AssemblyHelpers::boxDouble):
3874         (JSC::DFG::AssemblyHelpers::unboxDouble):
3875         * dfg/DFGCCallHelpers.h:
3876         (CCallHelpers):
3877         (JSC::DFG::CCallHelpers::setupArguments):
3878         * dfg/DFGFPRInfo.h:
3879         (DFG):
3880         * dfg/DFGGPRInfo.h:
3881         (DFG):
3882         (GPRInfo):
3883         * dfg/DFGOperations.cpp:
3884         (JSC):
3885         * dfg/DFGSpeculativeJIT.h:
3886         (SpeculativeJIT):
3887         (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult):
3888         (JSC::DFG::SpeculativeJIT::appendCallSetResult):
3889         * jit/JITStubs.cpp:
3890         (JSC):
3891         * jit/JITStubs.h:
3892         (JITStackFrame):
3893         * jit/JSInterfaceJIT.h:
3894         (JSInterfaceJIT):
3895
3896 2012-07-04  Anthony Scian  <ascian@rim.com>
3897
3898         Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
3899         https://bugs.webkit.org/show_bug.cgi?id=40118
3900
3901         Reviewed by Yong Li.
3902
3903         Added member functions to expose function name, urlString, and line #.
3904         Refactored toString to make use of these member functions to reduce
3905         duplicated code for future maintenance.
3906
3907         Manually tested refactoring of toString by tracing thrown exceptions.
3908
3909         * interpreter/Interpreter.h:
3910         (JSC::StackFrame::toString):
3911         (JSC::StackFrame::friendlySourceURL):
3912         (JSC::StackFrame::friendlyFunctionName):
3913         (JSC::StackFrame::friendlyLineNumber):
3914
3915 2012-07-04  Andy Wingo  <wingo@igalia.com>
3916
3917         [GTK] Enable parallel GC
3918         https://bugs.webkit.org/show_bug.cgi?id=90568
3919
3920         Reviewed by Martin Robinson.
3921
3922         * runtime/Options.cpp: Include <algorithm.h> for std::min.
3923
3924 2012-07-04  John Mellor  <johnme@chromium.org>
3925
3926         Text Autosizing: Add compile flag and runtime setting
3927         https://bugs.webkit.org/show_bug.cgi?id=87394
3928
3929         This patch renames Font Boosting to Text Autosizing.
3930
3931         Reviewed by Adam Barth.
3932
3933         * Configurations/FeatureDefines.xcconfig:
3934
3935 2012-07-03  Michael Saboff  <msaboff@apple.com>
3936
3937         Enh: Hash Const JSString in Backing Stores to Save Memory
3938         https://bugs.webkit.org/show_bug.cgi?id=86024
3939
3940         Reviewed by Oliver Hunt.
3941
3942         During garbage collection, each marking thread keeps a HashMap of
3943         strings.  While visiting via MarkStack::copyAndAppend(), we check to
3944         see if the string we are visiting is already in the HashMap.  If not
3945         we add it. If so, we change the reference to the current string we're
3946         visiting to the prior string.
3947
3948         To reduce the performance impact of this change, two throttles have
3949         ben added.  1) We only try hash consting if a significant number of new
3950         strings have been created since the last hash const.  Currently this is
3951         set at 100 strings.  2) If a string is unique at the end of a marking
3952         it will not be checked during further GC phases. In some cases this
3953         won't catch all duplicates, but we are trying to catch the growth of
3954         duplicate strings.
3955
3956         * heap/Heap.cpp:
3957         (JSC::Heap::markRoots):
3958         * heap/MarkStack.cpp:
3959         (JSC::MarkStackThreadSharedData::resetChildren):
3960         (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
3961         (JSC::MarkStackThreadSharedData::reset):
3962         (JSC::MarkStack::setup): Check to see if enough strings have been created
3963         to hash const.
3964         (JSC::MarkStack::reset): Added call to clear m_uniqueStrings.
3965         (JSC::JSString::tryHashConstLock): New method to lock JSString for
3966         hash consting.
3967         (JSC::JSString::releaseHashConstLock): New unlock method.
3968         (JSC::JSString::shouldTryHashConst): Set of checks to see if we should
3969         try to hash const the string.
3970         (JSC::MarkStack::internalAppend): New method that performs the hash consting.
3971         (JSC::SlotVisitor::copyAndAppend): Changed to call the new hash
3972         consting internalAppend().
3973         * heap/MarkStack.h:
3974         (MarkStackThreadSharedData):
3975         (MarkStack):
3976         * runtime/JSGlobalData.cpp:
3977         (JSC::JSGlobalData::JSGlobalData):
3978         * runtime/JSGlobalData.h:
3979         (JSGlobalData):
3980         (JSC::JSGlobalData::haveEnoughNewStringsToHashConst):
3981         (JSC::JSGlobalData::resetNewStringsSinceLastHashConst):
3982         * runtime/JSString.h:
3983         (JSString): Changed from using bool flags to using an unsigned
3984         m_flags field.  This works better with the weakCompareAndSwap in
3985         JSString::tryHashConstLock(). Changed the 8bitness setting and
3986         checking to use new accessors.
3987         (JSC::JSString::JSString):
3988         (JSC::JSString::finishCreation):
3989         (JSC::JSString::is8Bit): Updated for new m_flags.
3990         (JSC::JSString::setIs8Bit): New setter.
3991         New hash const flags accessors:
3992         (JSC::JSString::isHashConstSingleton):
3993         (JSC::JSString::clearHashConstSingleton):
3994         (JSC::JSString::setHashConstSingleton):
3995         (JSC::JSRopeString::finishCreation):
3996         (JSC::JSRopeString::append):
3997
3998 2012-07-03  Tony Chang  <tony@chromium.org>
3999
4000         [chromium] Unreviewed, update .gitignore to handle VS2010 files.
4001
4002         * JavaScriptCore.gyp/.gitignore:
4003
4004 2012-07-03  Mark Lam  <mark.lam@apple.com>
4005
4006         Add ability to symbolically set and dump JSC VM options.
4007         See comments in runtime/Options.h for details on how the options work.
4008         https://bugs.webkit.org/show_bug.cgi?id=90420
4009
4010         Reviewed by Filip Pizlo.
4011
4012         * assembler/LinkBuffer.cpp:
4013         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
4014         * assembler/LinkBuffer.h:
4015         (JSC):
4016         * bytecode/CodeBlock.cpp:
4017         (JSC::CodeBlock::shouldOptimizeNow):
4018         * bytecode/CodeBlock.h:
4019         (JSC::CodeBlock::likelyToTakeSlowCase):
4020         (JSC::CodeBlock::couldTakeSlowCase):
4021         (JSC::CodeBlock::likelyToTakeSpecialFastCase):
4022         (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
4023         (JSC::CodeBlock::likelyToTakeAnySlowCase):
4024         (JSC::CodeBlock::jitAfterWarmUp):
4025         (JSC::CodeBlock::jitSoon):
4026         (JSC::CodeBlock::reoptimizationRetryCounter):
4027         (JSC::CodeBlock::countReoptimization):
4028         (JSC::CodeBlock::counterValueForOptimizeAfterWarmUp):
4029         (JSC::CodeBlock::counterValueForOptimizeAfterLongWarmUp):
4030         (JSC::CodeBlock::optimizeSoon):
4031         (JSC::CodeBlock::exitCountThresholdForReoptimization):
4032         (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
4033         * bytecode/ExecutionCounter.h:
4034         (JSC::ExecutionCounter::clippedThreshold):
4035         * dfg/DFGByteCodeParser.cpp:
4036         (JSC::DFG::ByteCodeParser::handleInlining):
4037         * dfg/DFGCapabilities.h:
4038         (JSC::DFG::mightCompileEval):
4039         (JSC::DFG::mightCompileProgram):
4040         (JSC::DFG::mightCompileFunctionForCall):
4041         (JSC::DFG::mightCompileFunctionForConstruct):
4042         (JSC::DFG::mightInlineFunctionForCall):
4043         (JSC::DFG::mightInlineFunctionForConstruct):
4044         * dfg/DFGCommon.h:
4045         (JSC::DFG::shouldShowDisassembly):
4046         * dfg/DFGDriver.cpp:
4047         (JSC::DFG::compile):
4048         * dfg/DFGOSRExit.cpp:
4049         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
4050         * dfg/DFGVariableAccessData.h:
4051         (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
4052         * heap/MarkStack.cpp:
4053         (JSC::MarkStackSegmentAllocator::allocate):
4054         (JSC::MarkStackSegmentAllocator::shrinkReserve):
4055         (JSC::MarkStackArray::MarkStackArray):
4056         (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
4057         (JSC::SlotVisitor::donateKnownParallel):
4058         (JSC::SlotVisitor::drain):
4059         (JSC::SlotVisitor::drainFromShared):
4060         * heap/MarkStack.h:
4061         (JSC::MarkStack::mergeOpaqueRootsIfProfitable):
4062         (JSC::MarkStack::addOpaqueRoot):
4063         * heap/SlotVisitor.h:
4064         (JSC::SlotVisitor::donate):
4065         * jit/JIT.cpp:
4066         (JSC::JIT::emitOptimizationCheck):
4067         * jsc.cpp:
4068         (printUsageStatement):
4069         (parseArguments):
4070         * runtime/InitializeThreading.cpp:
4071         (JSC::initializeThreadingOnce):
4072         * runtime/JSGlobalData.cpp:
4073         (JSC::enableAssembler):
4074         * runtime/JSGlobalObject.cpp:
4075         (JSC::JSGlobalObject::JSGlobalObject):
4076         * runtime/Options.cpp:
4077         (JSC):
4078         (JSC::overrideOptionWithHeuristic):
4079         (JSC::Options::initialize):
4080         (JSC::Options::setOption):
4081         (JSC::Options::dumpAllOptions):
4082         (JSC::Options::dumpOption):
4083         * runtime/Options.h:
4084         (JSC):
4085         (Options):
4086         (EntryInfo):
4087
4088 2012-07-03  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>  Joel Dillon <joel.dillon@codethink.co.uk>
4089
4090         [Qt][Win] Fix broken QtWebKit5.lib linking
4091         https://bugs.webkit.org/show_bug.cgi?id=88321
4092
4093         Reviewed by Kenneth Rohde Christiansen.
4094
4095         The goal is to have different ports build systems define STATICALLY_LINKED_WITH_WTF
4096         when building JavaScriptCore, if both are packaged in the same DLL, instead
4097         of relying on the code to handle this.
4098         The effects of BUILDING_* and STATICALLY_LINKED_WITH_* are currently the same
4099         except for a check in Source/JavaScriptCore/config.h.
4100
4101         Keeping the old way for the WX port as requested by the port's contributors.
4102         For non-Windows ports there is no difference between IMPORT and EXPORT, no
4103         change is needed.
4104
4105         * API/JSBase.h:
4106           JS symbols shouldn't be included by WTF objects anymore. Remove the export when BUILDING_WTF.
4107         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
4108           Make sure that JavaScriptCore uses import symbols of WTF for the Win port.
4109         * runtime/JSExportMacros.h:
4110
4111 2012-07-02  Filip Pizlo  <fpizlo@apple.com>
4112
4113         DFG OSR exit value recoveries should be computed lazily
4114         https://bugs.webkit.org/show_bug.cgi?id=82155
4115
4116         Reviewed by Gavin Barraclough.
4117
4118         This change aims to reduce one aspect of DFG compile times: the fact
4119         that we currently compute the value recoveries for each local and
4120         argument on every speculation check. We compile many speculation checks,
4121         so this can add up quick. The strategy that this change takes is to
4122         have the DFG save just enough information about how the compiler is
4123         choosing to represent state, that the DFG::OSRExitCompiler can reify
4124         the value recoveries lazily.
4125
4126         This appears to be an 0.3% SunSpider speed-up and is neutral elsewhere.
4127
4128         I also took the opportunity to fix the sampling regions profiler (it
4129         was missing an export macro) and to put in more sampling regions in
4130         the DFG (which are disabled so long as ENABLE(SAMPLING_REGIONS) is
4131         false).
4132
4133         * CMakeLists.txt:
4134         * GNUmakefile.list.am:
4135         * JavaScriptCore.xcodeproj/project.pbxproj:
4136         * Target.pri:
4137         * bytecode/CodeBlock.cpp:
4138         (JSC):
4139         (JSC::CodeBlock::shrinkDFGDataToFit):
4140         * bytecode/CodeBlock.h:
4141         (CodeBlock):
4142         (JSC::CodeBlock::minifiedDFG):
4143         (JSC::CodeBlock::variableEventStream):
4144         (DFGData):
4145         * bytecode/Operands.h:
4146         (JSC::Operands::hasOperand):
4147         (Operands):
4148         (JSC::Operands::size):
4149         (JSC::Operands::at):
4150         (JSC::Operands::operator[]):
4151         (JSC::Operands::isArgument):
4152         (JSC::Operands::isVariable):
4153         (JSC::Operands::argumentForIndex):
4154         (JSC::Operands::variableForIndex):
4155         (JSC::Operands::operandForIndex):
4156         (JSC):
4157         (JSC::dumpOperands):
4158         * bytecode/SamplingTool.h:
4159         (SamplingRegion):
4160         * dfg/DFGByteCodeParser.cpp:
4161         (JSC::DFG::parse):
4162         * dfg/DFGCFAPhase.cpp:
4163         (JSC::DFG::performCFA):
4164         * dfg/DFGCSEPhase.cpp:
4165         (JSC::DFG::performCSE):
4166         * dfg/DFGFixupPhase.cpp:
4167         (JSC::DFG::performFixup):
4168         * dfg/DFGGenerationInfo.h:
4169         (JSC::DFG::GenerationInfo::GenerationInfo):
4170         (JSC::DFG::GenerationInfo::initConstant):
4171         (JSC::DFG::GenerationInfo::initInteger):
4172         (JSC::DFG::GenerationInfo::initJSValue):
4173         (JSC::DFG::GenerationInfo::initCell):
4174         (JSC::DFG::GenerationInfo::initBoolean):
4175         (JSC::DFG::GenerationInfo::initDouble):
4176         (JSC::DFG::GenerationInfo::initStorage):
4177         (GenerationInfo):
4178         (JSC::DFG::GenerationInfo::noticeOSRBirth):
4179         (JSC::DFG::GenerationInfo::use):
4180         (JSC::DFG::GenerationInfo::spill):
4181         (JSC::DFG::GenerationInfo::setSpilled):
4182         (JSC::DFG::GenerationInfo::fillJSValue):
4183         (JSC::DFG::GenerationInfo::fillCell):
4184         (JSC::DFG::GenerationInfo::fillInteger):
4185         (JSC::DFG::GenerationInfo::fillBoolean):
4186         (JSC::DFG::GenerationInfo::fillDouble):
4187         (JSC::DFG::GenerationInfo::fillStorage):
4188         (JSC::DFG::GenerationInfo::appendFill):
4189         (JSC::DFG::GenerationInfo::appendSpill):
4190         * dfg/DFGJITCompiler.cpp:
4191         (JSC::DFG::JITCompiler::link):
4192         (JSC::DFG::JITCompiler::compile):
4193         (JSC::DFG::JITCompiler::compileFunction):
4194         * dfg/DFGMinifiedGraph.h: Added.
4195         (DFG):
4196         (MinifiedGraph):
4197         (JSC::DFG::MinifiedGraph::MinifiedGraph):
4198         (JSC::DFG::MinifiedGraph::at):
4199         (JSC::DFG::MinifiedGraph::append):
4200         (JSC::DFG::MinifiedGraph::prepareAndShrink):
4201         (JSC::DFG::MinifiedGraph::setOriginalGraphSize):
4202         (JSC::DFG::MinifiedGraph::originalGraphSize):
4203         * dfg/DFGMinifiedNode.cpp: Added.
4204         (DFG):
4205         (JSC::DFG::MinifiedNode::fromNode):
4206         * dfg/DFGMinifiedNode.h: Added.
4207         (DFG):
4208         (JSC::DFG::belongsInMinifiedGraph):
4209         (MinifiedNode):
4210         (JSC::DFG::MinifiedNode::MinifiedNode):
4211         (JSC::DFG::MinifiedNode::index):
4212         (JSC::DFG::MinifiedNode::op):
4213         (JSC::DFG::MinifiedNode::hasChild1):
4214         (JSC::DFG::MinifiedNode::child1):
4215         (JSC::DFG::MinifiedNode::hasConstant):
4216         (JSC::DFG::MinifiedNode::hasConstantNumber):
4217         (JSC::DFG::MinifiedNode::constantNumber):
4218         (JSC::DFG::MinifiedNode::hasWeakConstant):
4219         (JSC::DFG::MinifiedNode::weakConstant):
4220         (JSC::DFG::MinifiedNode::getIndex):
4221         (JSC::DFG::MinifiedNode::compareByNodeIndex):
4222         (JSC::DFG::MinifiedNode::hasChild):
4223         * dfg/DFGNode.h:
4224         (Node):
4225         * dfg/DFGOSRExit.cpp:
4226         (JSC::DFG::OSRExit::OSRExit):
4227         * dfg/DFGOSRExit.h:
4228         (OSRExit):
4229         * dfg/DFGOSRExitCompiler.cpp:
4230         * dfg/DFGOSRExitCompiler.h:
4231         (OSRExitCompiler):
4232         * dfg/DFGOSRExitCompiler32_64.cpp:
4233         (JSC::DFG::OSRExitCompiler::compileExit):
4234         * dfg/DFGOSRExitCompiler64.cpp:
4235         (JSC::DFG::OSRExitCompiler::compileExit):
4236         * dfg/DFGPredictionPropagationPhase.cpp:
4237         (JSC::DFG::performPredictionPropagation):
4238         * dfg/DFGRedundantPhiEliminationPhase.cpp:
4239         (JSC::DFG::performRedundantPhiElimination):
4240         * dfg/DFGSpeculativeJIT.cpp:
4241         (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
4242         (DFG):
4243         (JSC::DFG::SpeculativeJIT::fillStorage):
4244         (JSC::DFG::SpeculativeJIT::noticeOSRBirth):
4245         (JSC::DFG::SpeculativeJIT::compileMovHint):
4246         (JSC::DFG::SpeculativeJIT::compile):
4247         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
4248         * dfg/DFGSpeculativeJIT.h:
4249         (DFG):
4250         (JSC::DFG::SpeculativeJIT::use):
4251         (SpeculativeJIT):
4252         (JSC::DFG::SpeculativeJIT::spill):
4253         (JSC::DFG::SpeculativeJIT::speculationCheck):
4254         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
4255         (JSC::DFG::SpeculativeJIT::recordSetLocal):
4256         * dfg/DFGSpeculativeJIT32_64.cpp:
4257         (JSC::DFG::SpeculativeJIT::fillInteger):
4258         (JSC::DFG::SpeculativeJIT::fillDouble):
4259         (JSC::DFG::SpeculativeJIT::fillJSValue):
4260         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
4261         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
4262         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
4263         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
4264         (JSC::DFG::SpeculativeJIT::compile):
4265         * dfg/DFGSpeculativeJIT64.cpp:
4266         (JSC::DFG::SpeculativeJIT::fillInteger):
4267         (JSC::DFG::SpeculativeJIT::fillDouble):
4268         (JSC::DFG::SpeculativeJIT::fillJSValue):
4269         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
4270         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
4271         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
4272         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
4273         (JSC::DFG::SpeculativeJIT::compile):
4274         * dfg/DFGValueRecoveryOverride.h: Added.
4275         (DFG):
4276         (ValueRecoveryOverride):
4277         (JSC::DFG::ValueRecoveryOverride::ValueRecoveryOverride):
4278         * dfg/DFGValueSource.cpp: Added.
4279         (DFG):
4280         (JSC::DFG::ValueSource::dump):
4281         * dfg/DFGValueSource.h: Added.
4282         (DFG):
4283         (JSC::DFG::dataFormatToValueSourceKind):
4284         (JSC::DFG::valueSourceKindToDataFormat):
4285         (JSC::DFG::isInRegisterFile):
4286         (ValueSource):
4287         (JSC::DFG::ValueSource::ValueSource):
4288         (JSC::DFG::ValueSource::forPrediction):
4289         (JSC::DFG::ValueSource::forDataFormat):
4290         (JSC::DFG::ValueSource::isSet):
4291         (JSC::DFG::ValueSource::kind):
4292         (JSC::DFG::ValueSource::isInRegisterFile):
4293         (JSC::DFG::ValueSource::dataFormat):
4294         (JSC::DFG::ValueSource::valueRecovery):
4295         (JSC::DFG::ValueSource::nodeIndex):
4296         (JSC::DFG::ValueSource::nodeIndexFromKind):
4297         (JSC::DFG::ValueSource::kindFromNodeIndex):
4298         * dfg/DFGVariableEvent.cpp: Added.
4299         (DFG):
4300         (JSC::DFG::VariableEvent::dump):
4301         (JSC::DFG::VariableEvent::dumpFillInfo):
4302         (JSC::DFG::VariableEvent::dumpSpillInfo):
4303         * dfg/DFGVariableEvent.h: Added.
4304         (DFG):
4305         (VariableEvent):
4306         (JSC::DFG::VariableEvent::VariableEvent):
4307         (JSC::DFG::VariableEvent::reset):
4308         (JSC::DFG::VariableEvent::fillGPR):
4309         (JSC::DFG::VariableEvent::fillPair):
4310         (JSC::DFG::VariableEvent::fillFPR):
4311         (JSC::DFG::VariableEvent::spill):
4312         (JSC::DFG::VariableEvent::death):
4313         (JSC::DFG::VariableEvent::setLocal):
4314         (JSC::DFG::VariableEvent::movHint):
4315         (JSC::DFG::VariableEvent::kind):
4316         (JSC::DFG::VariableEvent::nodeIndex):
4317         (JSC::DFG::VariableEvent::dataFormat):
4318         (JSC::DFG::VariableEvent::gpr):
4319         (JSC::DFG::VariableEvent::tagGPR):
4320         (JSC::DFG::VariableEvent::payloadGPR):
4321         (JSC::DFG::VariableEvent::fpr):
4322         (JSC::DFG::VariableEvent::virtualRegister):
4323         (JSC::DFG::VariableEvent::operand):
4324         (JSC::DFG::VariableEvent::variableRepresentation):
4325         * dfg/DFGVariableEventStream.cpp: Added.
4326         (DFG):
4327         (JSC::DFG::VariableEventStream::logEvent):
4328         (MinifiedGenerationInfo):
4329         (JSC::DFG::MinifiedGenerationInfo::MinifiedGenerationInfo):
4330         (JSC::DFG::MinifiedGenerationInfo::update):
4331         (JSC::DFG::VariableEventStream::reconstruct):
4332         * dfg/DFGVariableEventStream.h: Added.
4333         (DFG):
4334         (VariableEventStream):
4335         (JSC::DFG::VariableEventStream::appendAndLog):
4336         * dfg/DFGVirtualRegisterAllocationPhase.cpp:
4337         (JSC::DFG::performVirtualRegisterAllocation):
4338
4339 2012-07-02  Filip Pizlo  <fpizlo@apple.com>
4340
4341         DFG::ArgumentsSimplificationPhase should assert that the PhantomArguments nodes it creates are not shouldGenerate()
4342         https://bugs.webkit.org/show_bug.cgi?id=90407
4343
4344         Reviewed by Mark Hahnenberg.
4345
4346         * dfg/DFGArgumentsSimplificationPhase.cpp:
4347         (JSC::DFG::ArgumentsSimplificationPhase::run):
4348
4349 2012-07-02  Gavin Barraclough  <barraclough@apple.com>
4350
4351         Array.prototype.pop should throw if property is not configurable
4352         https://bugs.webkit.org/show_bug.cgi?id=75788
4353
4354         Rubber Stamped by Oliver Hunt.
4355
4356         No real bug here any more, but the error we throw sometimes has a misleading message.
4357
4358         * runtime/JSArray.cpp:
4359         (JSC::JSArray::pop):
4360
4361 2012-06-29  Filip Pizlo  <fpizlo@apple.com>
4362
4363         JSObject wastes too much memory on unused property slots
4364         https://bugs.webkit.org/show_bug.cgi?id=90255
4365
4366         Reviewed by Mark Hahnenberg.
4367
4368         Rolling back in after applying a simple fix: it appears that
4369         JSObject::setStructureAndReallocateStorageIfNecessary() was allocating more
4370         property storage than necessary. Fixing this appears to resolve the crash.
4371
4372         This does a few things:
4373
4374         - JSNonFinalObject no longer has inline property storage.
4375
4376         - Initial out-of-line property storage size is 4 slots for JSNonFinalObject,
4377           or 2x the inline storage for JSFinalObject.
4378
4379         - Property storage is only reallocated if it needs to be. Previously, we
4380           would reallocate the property storage on any transition where the original
4381           structure said shouldGrowProperyStorage(), but this led to spurious
4382           reallocations when doing transitionless property adds and there are
4383           deleted property slots available. That in turn led to crashes, because we
4384           would switch to out-of-line storage even if the capacity matched the
4385           criteria for inline storage.
4386
4387         - Inline JSFunction allocation is killed off because we don't have a good
4388           way of inlining property storage allocation. This didn't hurt performance.
4389           Killing off code is better than fixing it if that code wasn't doing any
4390           good.
4391
4392         This looks like a 1% progression on V8.
4393
4394         * interpreter/Interpreter.cpp:
4395         (JSC::Interpreter::privateExecute):
4396         * jit/JIT.cpp:
4397         (JSC::JIT::privateCompileSlowCases):
4398         * jit/JIT.h:
4399         * jit/JITInlineMethods.h:
4400         (JSC::JIT::emitAllocateBasicJSObject):
4401         (JSC):
4402         * jit/JITOpcodes.cpp:
4403         (JSC::JIT::emit_op_new_func):
4404         (JSC):
4405         (JSC::JIT::emit_op_new_func_exp):
4406         * runtime/JSFunction.cpp:
4407         (JSC::JSFunction::finishCreation):
4408         * runtime/JSObject.h:
4409         (JSC::JSObject::isUsingInlineStorage):
4410         (JSObject):
4411         (JSC::JSObject::finishCreation):
4412         (JSC):
4413         (JSC::JSNonFinalObject::hasInlineStorage):
4414         (JSNonFinalObject):
4415         (JSC::JSNonFinalObject::JSNonFinalObject):
4416         (JSC::JSNonFinalObject::finishCreation):
4417         (JSC::JSFinalObject::hasInlineStorage):
4418         (JSC::JSFinalObject::finishCreation):
4419         (JSC::JSObject::offsetOfInlineStorage):
4420         (JSC::JSObject::setPropertyStorage):
4421         (JSC::Structure::inlineStorageCapacity):
4422         (JSC::Structure::isUsingInlineStorage):
4423         (JSC::JSObject::putDirectInternal):
4424         (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
4425         (JSC::JSObject::putDirectWithoutTransition):
4426         * runtime/Structure.cpp:
4427         (JSC::Structure::Structure):
4428         (JSC::nextPropertyStorageCapacity):
4429         (JSC):
4430         (JSC::Structure::growPropertyStorageCapacity):
4431         (JSC::Structure::suggestedNewPropertyStorageSize):
4432         * runtime/Structure.h:
4433         (JSC::Structure::putWillGrowPropertyStorage):
4434         (Structure):
4435
4436 2012-06-29  Filip Pizlo  <fpizlo@apple.com>
4437
4438         Webkit crashes in DFG on Google Docs when creating a new document
4439         https://bugs.webkit.org/show_bug.cgi?id=90209
4440
4441         Reviewed by Gavin Barraclough.
4442
4443         Don't attempt to short-circuit Phantom(GetLocal) if the GetLocal is for a
4444         captured variable.
4445
4446         * dfg/DFGCFGSimplificationPhase.cpp:
4447         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
4448
4449 2012-06-30  Zan Dobersek  <zandobersek@gmail.com>
4450
4451         Unreviewed, rolling out r121605.
4452         http://trac.webkit.org/changeset/121605
4453         https://bugs.webkit.org/show_bug.cgi?id=90336
4454
4455         Changes caused flaky crashes in sputnik/Unicode tests on Apple
4456         WK1 and GTK Linux builders
4457
4458         * interpreter/Interpreter.cpp:
4459         (JSC::Interpreter::privateExecute):
4460         * jit/JIT.cpp:
4461         (JSC::JIT::privateCompileSlowCases):
4462         * jit/JIT.h:
4463         * jit/JITInlineMethods.h:
4464         (JSC::JIT::emitAllocateBasicJSObject):
4465         (JSC::JIT::emitAllocateJSFinalObject):
4466         (JSC):
4467         (JSC::JIT::emitAllocateJSFunction):
4468         * jit/JITOpcodes.cpp:
4469         (JSC::JIT::emit_op_new_func):
4470         (JSC::JIT::emitSlow_op_new_func):
4471         (JSC):
4472         (JSC::JIT::emit_op_new_func_exp):
4473         (JSC::JIT::emitSlow_op_new_func_exp):
4474         * runtime/JSFunction.cpp:
4475         (JSC::JSFunction::finishCreation):
4476         * runtime/JSObject.h:
4477         (JSC::JSObject::isUsingInlineStorage):
4478         (JSObject):
4479         (JSC::JSObject::finishCreation):
4480         (JSC):
4481         (JSNonFinalObject):
4482         (JSC::JSNonFinalObject::JSNonFinalObject):
4483         (JSC::JSNonFinalObject::finishCreation):
4484         (JSFinalObject):
4485         (JSC::JSFinalObject::finishCreation):
4486         (JSC::JSObject::offsetOfInlineStorage):
4487         (JSC::JSObject::setPropertyStorage):
4488         (JSC::Structure::isUsingInlineStorage):
4489         (JSC::JSObject::putDirectInternal):
4490         (JSC::JSObject::putDirectWithoutTransition):
4491         (JSC::JSObject::transitionTo):
4492         * runtime/Structure.cpp:
4493         (JSC::Structure::Structure):
4494         (JSC):
4495         (JSC::Structure::growPropertyStorageCapacity):
4496         (JSC::Structure::suggestedNewPropertyStorageSize):
4497         * runtime/Structure.h:
4498         (JSC::Structure::shouldGrowPropertyStorage):
4499         (JSC::Structure::propertyStorageSize):
4500
4501 2012-06-29  Mark Hahnenberg  <mhahnenberg@apple.com>
4502
4503         Remove warning about protected values when the Heap is being destroyed
4504         https://bugs.webkit.org/show_bug.cgi?id=90302
4505
4506         Reviewed by Geoffrey Garen.
4507
4508         Having to do book-keeping about whether values allocated from a certain
4509         VM are or are not protected makes the JSC API much more difficult to use
4510         correctly. Clients should be able to throw an entire VM away and not have
4511         to worry about unprotecting all of the values that they protected earlier.
4512
4513         * heap/Heap.cpp:
4514         (JSC::Heap::lastChanceToFinalize):
4515
4516 2012-06-29  Filip Pizlo  <fpizlo@apple.com>
4517
4518         JSObject wastes too much memory on unused property slots
4519         https://bugs.webkit.org/show_bug.cgi?id=90255
4520
4521         Reviewed by Mark Hahnenberg.
4522
4523         This does a few things:
4524
4525         - JSNonFinalObject no longer has inline property storage.
4526
4527         - Initial out-of-line property storage size is 4 slots for JSNonFinalObject,
4528           or 2x the inline storage for JSFinalObject.
4529
4530         - Property storage is only reallocated if it needs to be. Previously, we
4531           would reallocate the property storage on any transition where the original
4532           structure said shouldGrowProperyStorage(), but this led to spurious
4533           reallocations when doing transitionless property adds and there are
4534           deleted property slots available. That in turn led to crashes, because we
4535           would switch to out-of-line storage even if the capacity matched the
4536           criteria for inline storage.
4537
4538         - Inline JSFunction allocation is killed off because we don't have a good
4539           way of inlining property storage allocation. This didn't hurt performance.
4540           Killing off code is better than fixing it if that code wasn't doing any
4541           good.
4542
4543         This looks like a 1% progression on V8.
4544
4545         * interpreter/Interpreter.cpp:
4546         (JSC::Interpreter::privateExecute):
4547         * jit/JIT.cpp:
4548         (JSC::JIT::privateCompileSlowCases):
4549         * jit/JIT.h:
4550         * jit/JITInlineMethods.h:
4551         (JSC::JIT::emitAllocateBasicJSObject):
4552         (JSC):
4553         * jit/JITOpcodes.cpp:
4554         (JSC::JIT::emit_op_new_func):
4555         (JSC):
4556         (JSC::JIT::emit_op_new_func_exp):
4557         * runtime/JSFunction.cpp:
4558         (JSC::JSFunction::finishCreation):
4559         * runtime/JSObject.h:
4560         (JSC::JSObject::isUsingInlineStorage):
4561         (JSObject):
4562         (JSC::JSObject::finishCreation):
4563         (JSC):
4564         (JSC::JSNonFinalObject::hasInlineStorage):
4565         (JSNonFinalObject):
4566         (JSC::JSNonFinalObject::JSNonFinalObject):
4567         (JSC::JSNonFinalObject::finishCreation):
4568         (JSC::JSFinalObject::hasInlineStorage):
4569         (JSC::JSFinalObject::finishCreation):
4570         (JSC::JSObject::offsetOfInlineStorage):
4571         (JSC::JSObject::setPropertyStorage):
4572         (JSC::Structure::inlineStorageCapacity):
4573         (JSC::Structure::isUsingInlineStorage):
4574         (JSC::JSObject::putDirectInternal):
4575         (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
4576         (JSC::JSObject::putDirectWithoutTransition):
4577         * runtime/Structure.cpp:
4578         (JSC::Structure::Structure):
4579         (JSC::nextPropertyStorageCapacity):
4580         (JSC):
4581         (JSC::Structure::growPropertyStorageCapacity):
4582         (JSC::Structure::suggestedNewPropertyStorageSize):
4583         * runtime/Structure.h:
4584         (JSC::Structure::putWillGrowPropertyStorage):
4585         (Structure):
4586
4587 2012-06-28  Filip Pizlo  <fpizlo@apple.com>
4588
4589         DFG recompilation heuristics should be based on count, not rate
4590         https://bugs.webkit.org/show_bug.cgi?id=90146
4591
4592         Reviewed by Oliver Hunt.
4593
4594         This removes a bunch of code that was previously trying to prevent spurious
4595         reoptimizations if a large enough majority of executions of a code block did
4596         not result in OSR exit. It turns out that this code was purely harmful. This
4597         patch removes all of that logic and replaces it with a dead-simple
4598         heuristic: if you exit more than N times (where N is an exponential function
4599         of the number of times the code block has already been recompiled) then we
4600         will recompile.
4601
4602         This appears to be a broad ~1% win on many benchmarks large and small.
4603
4604         * bytecode/CodeBlock.cpp:
4605         (JSC::CodeBlock::CodeBlock):
4606         * bytecode/CodeBlock.h:
4607         (JSC::CodeBlock::osrExitCounter):
4608         (JSC::CodeBlock::countOSRExit):
4609         (CodeBlock):
4610         (JSC::CodeBlock::addressOfOSRExitCounter):
4611         (JSC::CodeBlock::offsetOfOSRExitCounter):
4612         (JSC::CodeBlock::adjustedExitCountThreshold):
4613         (JSC::CodeBlock::exitCountThresholdForReoptimization):
4614         (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
4615         (JSC::CodeBlock::shouldReoptimizeNow):
4616         (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
4617         * bytecode/ExecutionCounter.cpp:
4618         (JSC::ExecutionCounter::setThreshold):
4619         * bytecode/ExecutionCounter.h:
4620         (ExecutionCounter):
4621         (JSC::ExecutionCounter::clippedThreshold):
4622         * dfg/DFGJITCompiler.cpp:
4623         (JSC::DFG::JITCompiler::compileBody):
4624         * dfg/DFGOSRExit.cpp:
4625         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
4626         * dfg/DFGOSRExitCompiler.cpp:
4627         (JSC::DFG::OSRExitCompiler::handleExitCounts):
4628         * dfg/DFGOperations.cpp:
4629         * jit/JITStubs.cpp:
4630         (JSC::DEFINE_STUB_FUNCTION):
4631         * runtime/Options.cpp:
4632         (Options):
4633         (JSC::Options::initializeOptions):
4634         * runtime/Options.h:
4635         (Options):
4636
4637 2012-06-28  Mark Lam  <mark.lam@apple.com>
4638
4639         Adding a commenting utility to record BytecodeGenerator comments
4640         with opcodes that are emitted.  Presently, the comments can only
4641         be constant strings.  Adding comments for opcodes is optional.
4642         If a comment is added, the comment will be printed following the
4643         opcode when CodeBlock::dump() is called.
4644
4645         This utility is disabled by default, and is only meant for VM
4646         development purposes.  It should not be enabled for product builds.
4647
4648         To enable this utility, set ENABLE_BYTECODE_COMMENTS in CodeBlock.h
4649         to 1.
4650
4651         https://bugs.webkit.org/show_bug.cgi?id=90095
4652
4653         Reviewed by Geoffrey Garen.
4654
4655         * GNUmakefile.list.am:
4656         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
4657         * JavaScriptCore.xcodeproj/project.pbxproj:
4658         * bytecode/CodeBlock.cpp:
4659         (JSC::CodeBlock::dumpBytecodeCommentAndNewLine): Dumps the comment.
4660         (JSC):
4661         (JSC::CodeBlock::printUnaryOp): Add comment dumps.
4662         (JSC::CodeBlock::printBinaryOp): Add comment dumps.
4663         (JSC::CodeBlock::printConditionalJump): Add comment dumps.
4664         (JSC::CodeBlock::printCallOp): Add comment dumps.
4665         (JSC::CodeBlock::printPutByIdOp): Add comment dumps.
4666         (JSC::CodeBlock::dump): Add comment dumps.
4667         (JSC::CodeBlock::CodeBlock):
4668         (JSC::CodeBlock::commentForBytecodeOffset):
4669             Finds the comment for an opcode if available.
4670         (JSC::CodeBlock::dumpBytecodeComments):
4671             For debugging whether comments are collected.
4672             It is not being called anywhere.
4673         * bytecode/CodeBlock.h:
4674         (CodeBlock):
4675         (JSC::CodeBlock::bytecodeComments):
4676         * bytecode/Comment.h: Added.
4677         (JSC):
4678         (Comment):
4679         * bytecompiler/BytecodeGenerator.cpp:
4680         (JSC::BytecodeGenerator::BytecodeGenerator):
4681         (JSC::BytecodeGenerator::emitOpcode): Calls emitComment().
4682         (JSC):
4683         (JSC::BytecodeGenerator::emitComment): Adds comment to CodeBlock.
4684         (JSC::BytecodeGenerator::prependComment):
4685             Registers a comment for emitComemnt() to use later.
4686         * bytecompiler/BytecodeGenerator.h:
4687         (BytecodeGenerator):
4688         (JSC::BytecodeGenerator::emitComment):
4689         (JSC::BytecodeGenerator::prependComment):
4690             These are inlined versions of these functions that nullify them
4691             when ENABLE_BYTECODE_COMMENTS is 0.
4692         (JSC::BytecodeGenerator::comments):
4693
4694 2012-06-28  Oliver Hunt  <oliver@apple.com>
4695
4696         32bit DFG incorrectly claims an fpr is fillable even if it has not been proven double
4697         https://bugs.webkit.org/show_bug.cgi?id=90127
4698
4699         Reviewed by Filip Pizlo.
4700
4701         The 32-bit version of fillSpeculateDouble doesn't handle Number->fpr loads
4702         correctly.  This patch fixes this by killing the fill info in the GenerationInfo
4703         when the spillFormat doesn't guarantee the value is a double.
4704
4705         * dfg/DFGSpeculativeJIT32_64.cpp:
4706         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
4707
4708 2012-06-28  Kent Tamura  <tkent@chromium.org>
4709
4710         Classify form control states by their owner forms
4711         https://bugs.webkit.org/show_bug.cgi?id=89950
4712
4713         Reviewed by Hajime Morita.
4714
4715         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
4716         Expose WTF::StringBuilder::canShrink()
4717
4718 2012-06-27  Michael Saboff  <msaboff@apple.com>
4719
4720         [Win] jscore-tests flakey
4721         https://bugs.webkit.org/show_bug.cgi?id=88118
4722
4723         Reviewed by Jessie Berlin.
4724
4725         jsDriver.pl on windows intermittently doesn't get the returned value from jsc,
4726         instead it gets 126.  Added a new option to jsc (-x) which prints the exit
4727         code before exiting.  jsDriver.pl uses this option on Windows and parses the
4728         exit code output for the exit code, removing it before comparing the actual
4729         and expected outputs.  Filed a follow on "FIXME" defect:
4730         [WIN] Intermittent failure for jsc return value to propagate through jsDriver.pl
4731         https://bugs.webkit.org/show_bug.cgi?id=90119
4732
4733         * jsc.cpp:
4734         (CommandLine::CommandLine):
4735         (CommandLine):
4736         (printUsageStatement):
4737         (parseArguments):
4738         (jscmain):
4739         * tests/mozilla/jsDriver.pl:
4740         (execute_tests):
4741
4742 2012-06-27  Sheriff Bot  <webkit.review.bot@gmail.com>
4743
4744         Unreviewed, rolling out r121359.
4745         http://trac.webkit.org/changeset/121359
4746         https://bugs.webkit.org/show_bug.cgi?id=90115
4747
4748         Broke many inspector tests (Requested by jpfau on #webkit).
4749
4750         * interpreter/Interpreter.h:
4751         (JSC::StackFrame::toString):
4752
4753 2012-06-27  Filip Pizlo  <fpizlo@apple.com>
4754
4755         Javascript SHA-512 gives wrong hash on second and subsequent runs unless Web Inspector Javascript Debugging is on
4756         https://bugs.webkit.org/show_bug.cgi?id=90053
4757         <rdar://problem/11764613>
4758
4759         Reviewed by Mark Hahnenberg.
4760
4761         The problem is that the code was assuming that the recovery should be Undefined if the source of
4762         the SetLocal was !shouldGenerate(). But that's wrong, since the DFG optimizer may skip around a
4763         UInt32ToNumber node (hence making it !shouldGenerate()) and keep the source of that node alive.
4764         In that case we should base the recovery on the source of the UInt32ToNumber. The logic for this
4765         was already in place but the fast check for !shouldGenerate() broke it.
4766
4767         * dfg/DFGSpeculativeJIT.cpp:
4768         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
4769
4770 2012-06-27  Filip Pizlo  <fpizlo@apple.com>
4771
4772         DFG disassembly should be easier to read
4773         https://bugs.webkit.org/show_bug.cgi?id=90106
4774
4775         Reviewed by Mark Hahnenberg.
4776
4777         Did a few things:
4778
4779         - Options::showDFGDisassembly now shows OSR exit disassembly as well.
4780
4781         - Phi node dumping doesn't attempt to do line wrapping since it just made the dump harder
4782           to read.
4783
4784         - DFG graph disassembly view shows a few additional node types that turn out to be
4785           essential for understanding OSR exits.
4786
4787         Put together, these changes reinforce the philosophy that anything needed for computing
4788         OSR exit is just as important as the machine code itself. Of course, we still don't take
4789         that philosophy to its full extreme - for example Phantom nodes are not dumped. We may
4790         revisit that in the future.
4791
4792         * assembler/LinkBuffer.cpp:
4793         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
4794         * assembler/LinkBuffer.h:
4795         (JSC):
4796         * dfg/DFGDisassembler.cpp:
4797         (JSC::DFG::Disassembler::dump):
4798         * dfg/DFGGraph.cpp:
4799         (JSC::DFG::Graph::dumpBlockHeader):
4800         * dfg/DFGNode.h:
4801         (JSC::DFG::Node::willHaveCodeGenOrOSR):
4802         * dfg/DFGOSRExitCompiler.cpp:
4803         * jit/JIT.cpp:
4804         (JSC::JIT::privateCompile):
4805
4806 2012-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
4807
4808         JSLock should be per-JSGlobalData
4809         https://bugs.webkit.org/show_bug.cgi?id=89123
4810
4811         Reviewed by Geoffrey Garen.
4812
4813         * API/APIShims.h:
4814         (APIEntryShimWithoutLock):
4815         (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to
4816         determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the
4817         HeapTimer class because timerDidFire could run after somebody has started to tear down that particular
4818         JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after
4819         its destruction has begun.
4820         (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
4821         (JSC::APIEntryShim::APIEntryShim):
4822         (APIEntryShim):
4823         (JSC::APIEntryShim::~APIEntryShim):
4824         (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors.
4825         Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock
4826         and before we've released it, which can only done in APIEntryShim.
4827         (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here.
4828         * API/JSContextRef.cpp:
4829         (JSGlobalContextCreate):
4830         (JSGlobalContextCreateInGroup):
4831         (JSGlobalContextRelease):
4832         (JSContextCreateBacktrace):
4833         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
4834         * heap/CopiedSpace.cpp:
4835         (JSC::CopiedSpace::tryAllocateSlowCase):
4836         * heap/Heap.cpp:
4837         (JSC::Heap::protect):
4838         (JSC::Heap::unprotect):
4839         (JSC::Heap::collect):
4840         (JSC::Heap::setActivityCallback):
4841         (JSC::Heap::activityCallback):
4842         (JSC::Heap::sweeper):
4843         * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they
4844         are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback
4845         and the IncrementalSweeper to make sure they're the last things that get initialized during construction to
4846         prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about.
4847         (Heap):
4848         * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown.
4849         (JSC::HeapTimer::~HeapTimer):
4850         (JSC::HeapTimer::invalidate):
4851         (JSC):
4852         (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread
4853         that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the
4854         HeapTimer and schedule it to fire immediately so that it can notice and kill itself.
4855         (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed
4856         out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim,
4857         but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case
4858         we were interrupted between releasing our mutex and trying to grab the APILock.
4859         * heap/HeapTimer.h:
4860         (HeapTimer):
4861         * heap/IncrementalSweeper.cpp:
4862         (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles
4863         all of that for us.
4864         (JSC::IncrementalSweeper::create):
4865         * heap/IncrementalSweeper.h:
4866         (IncrementalSweeper):
4867         * heap/MarkedAllocator.cpp:
4868         (JSC::MarkedAllocator::allocateSlowCase):
4869         * heap/WeakBlock.cpp:
4870         (JSC::WeakBlock::reap):
4871         * jsc.cpp:
4872         (functionGC):
4873         (functionReleaseExecutableMemory):
4874         (jscmain):
4875         * runtime/Completion.cpp:
4876         (JSC::checkSyntax):
4877         (JSC::evaluate):
4878         * runtime/GCActivityCallback.h:
4879         (DefaultGCActivityCallback):
4880         (JSC::DefaultGCActivityCallback::create):
4881         * runtime/JSGlobalData.cpp:
4882         (JSC::JSGlobalData::JSGlobalData):
4883         (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper)
4884         that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity
4885         it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the
4886         APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes.
4887         (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock.
4888         (JSC::JSGlobalData::sharedInstanceInternal):
4889         * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and
4890         de-refing JSGlobalDatas on separate threads since we don't do it that often anyways.
4891         (JSGlobalData):
4892         (JSC::JSGlobalData::apiLock):
4893         * runtime/JSGlobalObject.cpp:
4894         (JSC::JSGlobalObject::~JSGlobalObject):
4895         (JSC::JSGlobalObject::init):
4896         * runtime/JSLock.cpp:
4897         (JSC):
4898         (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance.
4899         (JSC::GlobalJSLock::~GlobalJSLock):
4900         (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that
4901         it can successfully unlock it later without it disappearing from underneath it.
4902         (JSC::JSLockHolder::~JSLockHolder):
4903         (JSC::JSLock::JSLock):
4904         (JSC::JSLock::~JSLock):
4905         (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for
4906         actually waiting for long periods.
4907         (JSC::JSLock::unlock):
4908         (JSC::JSLock::currentThreadIsHoldingLock):
4909         (JSC::JSLock::dropAllLocks):
4910         (JSC::JSLock::dropAllLocksUnconditionally):
4911         (JSC::JSLock::grabAllLocks):
4912         (JSC::JSLock::DropAllLocks::DropAllLocks):
4913         (JSC::JSLock::DropAllLocks::~DropAllLocks):
4914         * runtime/JSLock.h:
4915         (JSC):
4916         (GlobalJSLock):
4917         (JSLockHolder):
4918         (JSLock):
4919         (DropAllLocks):
4920         * runtime/WeakGCMap.h:
4921         (JSC::WeakGCMap::set):
4922         * testRegExp.cpp:
4923         (realMain):
4924
4925 2012-06-27  Filip Pizlo  <fpizlo@apple.com>
4926
4927         x86 disassembler confuses immediates with addresses
4928         https://bugs.webkit.org/show_bug.cgi?id=90099
4929
4930         Reviewed by Mark Hahnenberg.
4931
4932         Prepend "$" to immediates to disambiguate between immediates and addresses. This is in
4933         accordance with the gas and AT&T syntax.
4934
4935         * disassembler/udis86/udis86_syn-att.c:
4936         (gen_operand):
4937
4938 2012-06-27  Filip Pizlo  <fpizlo@apple.com>
4939
4940         Add a comment clarifying Options::showDisassembly versus Options::showDFGDisassembly.
4941
4942         Rubber stamped by Mark Hahnenberg.
4943
4944         * runtime/Options.cpp:
4945         (JSC::Options::initializeOptions):
4946
4947 2012-06-27  Anthony Scian  <ascian@rim.com>
4948
4949         Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
4950         https://bugs.webkit.org/show_bug.cgi?id=40118
4951
4952         Reviewed by Yong Li.
4953
4954         Added member functions to expose function name, urlString, and line #.
4955         Refactored toString to make use of these member functions to reduce
4956         duplicated code for future maintenance.
4957
4958         Manually tested refactoring of toString by tracing thrown exceptions.
4959
4960         * interpreter/Interpreter.h:
4961         (StackFrame):
4962         (JSC::StackFrame::toString):
4963         (JSC::StackFrame::friendlySourceURL):
4964         (JSC::StackFrame::friendlyFunctionName):
4965         (JSC::StackFrame::friendlyLineNumber):
4966
4967 2012-06-27  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
4968
4969         [Qt] Remove redundant c++11 warning suppression code
4970
4971         This is already handled in default_post.
4972
4973         Reviewed by Tor Arne Vestbø.
4974
4975         * Target.pri:
4976
4977 2012-06-26  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
4978
4979         [Qt] Add missing heades to HEADERS
4980
4981         For JavaScriptCore there aren't any Qt specific files, so we include all
4982         headers for easy editing in Qt Creator.
4983
4984         Reviewed by Simon Hausmann.
4985
4986         * Target.pri:
4987
4988 2012-06-26  Dominic Cooney  <dominicc@chromium.org>
4989
4990         [Chromium] Remove unused build scripts and empty folders for JavaScriptCore w/ gyp
4991         https://bugs.webkit.org/show_bug.cgi?id=90029
4992
4993         Reviewed by Adam Barth.
4994
4995         * gyp: Removed.
4996         * gyp/generate-derived-sources.sh: Removed.
4997         * gyp/generate-dtrace-header.sh: Removed.
4998         * gyp/run-if-exists.sh: Removed.
4999         * gyp/update-info-plist.sh: Removed.
5000
5001 2012-06-26  Geoffrey Garen  <ggaren@apple.com>
5002
5003         Reduced (but did not eliminate) use of "berzerker GC"
5004         https://bugs.webkit.org/show_bug.cgi?id=89237
5005
5006         Reviewed by Gavin Barraclough.
5007
5008         (PART 2)
5009
5010         This part turns off "berzerker GC" and turns on incremental shrinking.
5011
5012         * heap/IncrementalSweeper.cpp:
5013         (JSC::IncrementalSweeper::doSweep): Free or shrink after sweeping to
5014         maintain the behavior we used to get from the occasional berzerker GC,
5015         which would run all finalizers and then free or shrink all blocks
5016         synchronously.
5017
5018         * heap/MarkedBlock.h:
5019         (JSC::MarkedBlock::needsSweeping): Sweep zapped blocks, too. It's always
5020         safe to sweep a zapped block (that's the point of zapping), and it's
5021         sometimes profitable. For example, consider this case: Block A does some
5022         allocation (transitioning Block A from Marked to FreeListed), then GC
5023         happens (transitioning Block A to Zapped), then all objects in Block A
5024         are free, then the incremental sweeper visits Block A. If we skipped
5025         Zapped blocks, we'd skip Block A, even though it would be profitable to
5026         run its destructors and free its memory.
5027
5028         * runtime/GCActivityCallback.cpp:
5029         (JSC::DefaultGCActivityCallback::doWork): Don't sweep eagerly; we'll do
5030         this incrementally.
5031
5032 2012-06-26  Filip Pizlo  <fpizlo@apple.com>
5033
5034         DFG PutByValAlias is too aggressive
5035         https://bugs.webkit.org/show_bug.cgi?id=90026
5036         <rdar://problem/11751830>
5037
5038         Reviewed by Gavin Barraclough.
5039
5040         For CSE on normal arrays, we now treat PutByVal as impure. This does not appear to affect
5041         performance by much.
5042
5043         For CSE on typed arrays, we fix PutByValAlias by making GetByVal speculate that the access
5044         is within bounds. This also has the effect of making our out-of-bounds handling consistent
5045         with WebCore.
5046
5047         * dfg/DFGCSEPhase.cpp:
5048         (JSC::DFG::CSEPhase::performNodeCSE):
5049         * dfg/DFGGraph.h:
5050         (JSC::DFG::Graph::byValIsPure):
5051         (JSC::DFG::Graph::clobbersWorld):
5052         * dfg/DFGNodeType.h:
5053         (DFG):
5054         * dfg/DFGSpeculativeJIT.cpp:
5055         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
5056         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
5057
5058 2012-06-26  Yong Li  <yoli@rim.com>
5059
5060         [BlackBerry] Add JSC statistics into about:memory
5061         https://bugs.webkit.org/show_bug.cgi?id=89779
5062
5063         Reviewed by Rob Buis.
5064
5065         Fix non-JIT build on BlackBerry broken by r121196.
5066
5067         * runtime/MemoryStatistics.cpp:
5068         (JSC::globalMemoryStatistics):
5069
5070 2012-06-25  Filip Pizlo  <fpizlo@apple.com>
5071
5072         DFG::operationNewArray is unnecessarily slow, and may use the wrong array
5073         prototype when inlined
5074         https://bugs.webkit.org/show_bug.cgi?id=89821
5075
5076         Reviewed by Geoffrey Garen.
5077
5078         Fixes all array allocations to use the right structure, and hence the right prototype. Adds
5079         inlining of new Array(...) with a non-zero number of arguments. Optimizes allocations of
5080         empty arrays.
5081
5082         * dfg/DFGAbstractState.cpp:
5083         (JSC::DFG::AbstractState::execute):
5084         * dfg/DFGByteCodeParser.cpp:
5085         (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
5086         * dfg/DFGCCallHelpers.h:
5087         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
5088         (CCallHelpers):
5089         * dfg/DFGNodeType.h:
5090         (DFG):
5091         * dfg/DFGOperations.cpp:
5092         * dfg/DFGOperations.h:
5093         * dfg/DFGPredictionPropagationPhase.cpp:
5094         (JSC::DFG::PredictionPropagationPhase::propagate):
5095         * dfg/DFGSpeculativeJIT.h:
5096         (JSC::DFG::SpeculativeJIT::callOperation):
5097         * dfg/DFGSpeculativeJIT32_64.cpp:
5098         (JSC::DFG::SpeculativeJIT::compile):
5099         * dfg/DFGSpeculativeJIT64.cpp:
5100         (JSC::DFG::SpeculativeJIT::compile):
5101         * runtime/JSArray.h:
5102         (JSC):
5103         (JSC::constructArray):
5104         * runtime/JSGlobalObject.h:
5105         (JSC):
5106         (JSC::constructArray):
5107
5108 2012-06-26  Filip Pizlo  <fpizlo@apple.com>
5109
5110         New fast/js/dfg-store-unexpected-value-into-argument-and-osr-exit.html fails on 32 bit
5111         https://bugs.webkit.org/show_bug.cgi?id=89953
5112
5113         Reviewed by Zoltan Herczeg.
5114
5115         DFG 32-bit JIT was confused about the difference between a predicted type and a
5116         proven type. This is easy to get confused about, since a local that is predicted int32
5117         almost always means that the local must be an int32 since speculations are hoisted to
5118         stores to locals. But that is less likely to be the case for arguments, where there is
5119         an additional least-upper-bounding step: any store to an argument with a weird type
5120         may force the argument to be any type.
5121
5122         This patch basically duplicates the functionality in DFGSpeculativeJIT64.cpp for
5123         GetLocal: the decision of whether to load a local as an int32 (or as an array, or as
5124         a boolean) is made based on the AbstractValue::m_type, which is a type proof, rather
5125         than the VariableAccessData::prediction(), which is a predicted type.
5126
5127         * dfg/DFGSpeculativeJIT32_64.cpp:
5128         (JSC::DFG::SpeculativeJIT::compile):
5129
5130 2012-06-25  Filip Pizlo  <fpizlo@apple.com>
5131
5132         JSC should try to make profiling deterministic because otherwise reproducing failures is
5133         nearly impossible
5134         https://bugs.webkit.org/show_bug.cgi?id=89940
5135
5136         Rubber stamped by Gavin Barraclough.
5137
5138         This rolls out the part of http://trac.webkit.org/changeset/121215 that introduced randomness
5139         into the system. Now, instead of randomizing the tier-up threshold, we always set it to an
5140         artificially low (and statically predetermined!) value. This gives most of the benefit of
5141         threshold randomization without actually making the system behave completely differently on
5142         each invocation.
5143
5144         * bytecode/ExecutionCounter.cpp:
5145         (JSC::ExecutionCounter::setThreshold):
5146         * runtime/Options.cpp:
5147         (Options):
5148         (JSC::Options::initializeOptions):
5149         * runtime/Options.h:
5150         (Options):
5151
5152 2012-06-22  Filip Pizlo  <fpizlo@apple.com>
5153
5154         Value profiling should use tier-up threshold randomization to get more coverage
5155         https://bugs.webkit.org/show_bug.cgi?id=89802
5156
5157         Reviewed by Gavin Barraclough.
5158
5159         This patch causes both LLInt and Baseline JIT code to take the OSR slow path several
5160         times before actually doing OSR. If we take the OSR slow path before the execution
5161         count threshold is reached, then we just call CodeBlock::updateAllPredictions() to
5162         compute the current latest least-upper-bound SpecType of all values seen in each
5163         ValueProfile.
5164
5165         * bytecode/CodeBlock.cpp:
5166         (JSC::CodeBlock::stronglyVisitStrongReferences):
5167         (JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
5168         (JSC):
5169         (JSC::CodeBlock::updateAllPredictions):
5170         (JSC::CodeBlock::shouldOptimizeNow):
5171         * bytecode/CodeBlock.h:
5172         (JSC::CodeBlock::llintExecuteCounter):
5173         (JSC::CodeBlock::jitExecuteCounter):
5174         (CodeBlock):
5175         (JSC::CodeBlock::updateAllPredictions):
5176         * bytecode/ExecutionCounter.cpp:
5177         (JSC::ExecutionCounter::setThreshold):
5178         (JSC::ExecutionCounter::status):
5179         (JSC):
5180         * bytecode/ExecutionCounter.h:
5181         (JSC::ExecutionCounter::count):
5182         (ExecutionCounter):
5183         * dfg/DFGAbstractState.cpp:
5184         (JSC::DFG::AbstractState::execute):
5185         * dfg/DFGOperations.cpp:
5186         * dfg/DFGSpeculativeJIT.cpp:
5187         (JSC::DFG::SpeculativeJIT::compile):
5188         * jit/JITStubs.cpp:
5189         (JSC::DEFINE_STUB_FUNCTION):
5190         * llint/LLIntSlowPaths.cpp:
5191         (JSC::LLInt::jitCompileAndSetHeuristics):
5192         (JSC::LLInt::entryOSR):
5193         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
5194         * runtime/JSGlobalObject.cpp:
5195         (JSC::JSGlobalObject::JSGlobalObject):
5196         (JSC):
5197         * runtime/JSGlobalObject.h:
5198         (JSGlobalObject):
5199         (JSC::JSGlobalObject::weakRandomInteger):
5200         * runtime/Options.cpp:
5201         (Options):
5202         (JSC::Options::initializeOptions):
5203         * runtime/Options.h:
5204         (Options):
5205         * runtime/WeakRandom.h:
5206         (WeakRandom):
5207         (JSC::WeakRandom::seedUnsafe):
5208
5209 2012-06-25  Yong Li  <yoli@rim.com>
5210
5211         [BlackBerry] Add JSC statistics into about:memory
5212         https://bugs.webkit.org/show_bug.cgi?id=89779
5213
5214         Reviewed by Rob Buis.
5215
5216         Add MemoryStatistics.cpp into build, and fill JITBytes for BlackBerry port.
5217
5218         * PlatformBlackBerry.cmake:
5219         * runtime/MemoryStatistics.cpp:
5220         (JSC::globalMemoryStatistics):
5221
5222 2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
5223
5224         Unreviewed, rolling out r121058.
5225         http://trac.webkit.org/changeset/121058
5226         https://bugs.webkit.org/show_bug.cgi?id=89809
5227
5228         Patch causes plugins tests to crash in GTK debug builds
5229         (Requested by zdobersek on #webkit).
5230
5231         * API/APIShims.h:
5232         (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock):
5233         (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
5234         (APIEntryShimWithoutLock):
5235         (JSC::APIEntryShim::APIEntryShim):
5236         (APIEntryShim):
5237         (JSC::APICallbackShim::~APICallbackShim):
5238         * API/JSContextRef.cpp:
5239         (JSGlobalContextCreate):
5240         (JSGlobalContextCreateInGroup):
5241         (JSGlobalContextRelease):
5242         (JSContextCreateBacktrace):
5243         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
5244         * heap/CopiedSpace.cpp:
5245         (JSC::CopiedSpace::tryAllocateSlowCase):
5246         * heap/Heap.cpp:
5247         (JSC::Heap::protect):
5248         (JSC::Heap::unprotect):
5249         (JSC::Heap::collect):
5250         (JSC::Heap::setActivityCallback):
5251         (JSC::Heap::activityCallback):
5252         (JSC::Heap::sweeper):
5253         * heap/Heap.h:
5254         (Heap):
5255         * heap/HeapTimer.cpp:
5256         (JSC::HeapTimer::~HeapTimer):
5257         (JSC::HeapTimer::invalidate):
5258         (JSC::HeapTimer::timerDidFire):
5259         (JSC):
5260         * heap/HeapTimer.h:
5261         (HeapTimer):
5262         * heap/IncrementalSweeper.cpp:
5263         (JSC::IncrementalSweeper::doWork):
5264         (JSC::IncrementalSweeper::create):
5265         * heap/IncrementalSweeper.h:
5266         (IncrementalSweeper):
5267         * heap/MarkedAllocator.cpp:
5268         (JSC::MarkedAllocator::allocateSlowCase):
5269         * heap/WeakBlock.cpp:
5270         (JSC::WeakBlock::reap):
5271         * jsc.cpp:
5272         (functionGC):
5273         (functionReleaseExecutableMemory):
5274         (jscmain):
5275         * runtime/Completion.cpp:
5276         (JSC::checkSyntax):
5277         (JSC::evaluate):
5278         * runtime/GCActivityCallback.h:
5279         (DefaultGCActivityCallback):
5280         (JSC::DefaultGCActivityCallback::create):
5281         * runtime/JSGlobalData.cpp:
5282         (JSC::JSGlobalData::JSGlobalData):
5283         (JSC::JSGlobalData::~JSGlobalData):
5284         (JSC::JSGlobalData::sharedInstance):
5285         (JSC::JSGlobalData::sharedInstanceInternal):
5286         * runtime/JSGlobalData.h:
5287         (JSGlobalData):
5288         * runtime/JSGlobalObject.cpp:
5289         (JSC::JSGlobalObject::~JSGlobalObject):
5290         (JSC::JSGlobalObject::init):
5291         * runtime/JSLock.cpp:
5292         (JSC):
5293         (JSC::createJSLockCount):
5294         (JSC::JSLock::lockCount):
5295         (JSC::setLockCount):
5296         (JSC::JSLock::JSLock):
5297         (JSC::JSLock::lock):
5298         (JSC::JSLock::unlock):
5299         (JSC::JSLock::currentThreadIsHoldingLock):
5300         (JSC::JSLock::DropAllLocks::DropAllLocks):
5301         (JSC::JSLock::DropAllLocks::~DropAllLocks):
5302         * runtime/JSLock.h:
5303         (JSC):
5304         (JSLock):
5305         (JSC::JSLock::JSLock):
5306         (JSC::JSLock::~JSLock):
5307         (DropAllLocks):
5308         * runtime/WeakGCMap.h:
5309         (JSC::WeakGCMap::set):
5310         * testRegExp.cpp:
5311         (realMain):
5312
5313 2012-06-22  Alexandru Chiculita  <achicu@adobe.com>
5314
5315         [CSS Shaders] Re-enable the CSS Shaders compile time flag on Safari Mac
5316         https://bugs.webkit.org/show_bug.cgi?id=89781
5317
5318         Reviewed by Dean Jackson.
5319
5320         Added ENABLE_CSS_SHADERS flag as enabled by default on Safari for Mac.
5321
5322         * Configurations/FeatureDefines.xcconfig:
5323
5324 2012-06-22  Filip Pizlo  <fpizlo@apple.com>
5325
5326         DFG tier-up should happen in prologues, not epilogues
5327         https://bugs.webkit.org/show_bug.cgi?id=89752
5328
5329         Reviewed by Geoffrey Garen.
5330
5331         This change has two outcomes:
5332
5333         1) Slightly reduces the likelihood that a function will be optimized both
5334         standalone and via inlining.  Previously, if you had a call sequence like foo()
5335         calls bar() exactly once, and nobody else calls bar(), then bar() would get
5336         optimized first (because it returns first) and then foo() gets optimized.  If foo()
5337         can inline bar() then that means that bar() gets optimized twice.  But now, if we
5338         optimize in prologues, then foo() will be optimized first.  If it inlines bar(),
5339         that means that there will no longer be any calls to bar().
5340
5341         2) It lets us kill some code in JITStubs.  Epilogue tier-up was very different from
5342         loop tier-up, since epilogue tier-up should not attempt OSR.  But prologue tier-up
5343         requires OSR (albeit really easy OSR since it's the top of the compilation unit),
5344         so it becomes just like loop tier-up.  As a result, we now have one optimization
5345         hook (cti_optimize) instead of two (cti_optimize_from_loop and
5346         cti_optimize_from_ret).
5347
5348         As a consequence of not having an optimization check in epilogues, the OSR exit
5349         code must now trigger reoptimization itself instead of just signaling the epilogue
5350         check to fire.
5351
5352         This also adds the ability to count the number of DFG compilations, which was
5353         useful for debugging this patch and might be useful for other things in the future.
5354
5355         * bytecode/CodeBlock.cpp:
5356         (JSC::CodeBlock::reoptimize):
5357         (JSC):
5358         * bytecode/CodeBlock.h:
5359         (CodeBlock):
5360         * dfg/DFGByteCodeParser.cpp:
5361         (JSC::DFG::ByteCodeParser::parseCodeBlock):
5362         * dfg/DFGDriver.cpp:
5363         (DFG):
5364         (JSC::DFG::getNumCompilations):
5365         (JSC::DFG::compile):
5366         * dfg/DFGDriver.h:
5367         (DFG):
5368         * dfg/DFGOSRExitCompiler.cpp:
5369         (JSC::DFG::OSRExitCompiler::handleExitCounts):
5370         * dfg/DFGOperations.cpp:
5371         * dfg/DFGOperations.h:
5372         * jit/JIT.cpp:
5373         (JSC::JIT::emitOptimizationCheck):
5374         * jit/JIT.h:
5375         * jit/JITCall32_64.cpp:
5376         (JSC::JIT::emit_op_ret):
5377         (JSC::JIT::emit_op_ret_object_or_this):
5378         * jit/JITOpcodes.cpp:
5379         (JSC::JIT::emit_op_ret):
5380         (JSC::JIT::emit_op_ret_object_or_this):
5381         (JSC::JIT::emit_op_enter):
5382         * jit/JITOpcodes32_64.cpp:
5383         (JSC::JIT::emit_op_enter):
5384         * jit/JITStubs.cpp:
5385         (JSC::DEFINE_STUB_FUNCTION):
5386         * jit/JITStubs.h:
5387
5388 2012-06-20  Mark Hahnenberg  <mhahnenberg@apple.com>
5389
5390         JSLock should be per-JSGlobalData
5391         https://bugs.webkit.org/show_bug.cgi?id=89123
5392
5393         Reviewed by Gavin Barraclough.
5394
5395         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
5396         * API/APIShims.h:
5397         (APIEntryShimWithoutLock):
5398         (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to
5399         determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the
5400         HeapTimer class because timerDidFire could run after somebody has started to tear down that particular
5401         JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after
5402         its destruction has begun.
5403         (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock): Now derefs if it also refed.
5404         (JSC::APIEntryShim::APIEntryShim):
5405         (APIEntryShim):
5406         (JSC::APIEntryShim::~APIEntryShim):
5407         (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors.
5408         Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock
5409         and before we've released it, which can only done in APIEntryShim.
5410         (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here.
5411         * API/JSContextRef.cpp:
5412         (JSGlobalContextCreate):
5413         (JSGlobalContextCreateInGroup):
5414         (JSGlobalContextRelease):
5415         (JSContextCreateBacktrace):
5416         * heap/CopiedSpace.cpp:
5417         (JSC::CopiedSpace::tryAllocateSlowCase):
5418         * heap/Heap.cpp:
5419         (JSC::Heap::protect):
5420         (JSC::Heap::unprotect):
5421         (JSC::Heap::collect):
5422         (JSC::Heap::setActivityCallback):
5423         (JSC::Heap::activityCallback):
5424         (JSC::Heap::sweeper):
5425         * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they
5426         are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback
5427         and the IncrementalSweeper to make sure they're the last things that get initialized during construction to
5428         prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about.
5429         (Heap):
5430         * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown.
5431         (JSC::HeapTimer::~HeapTimer):
5432         (JSC::HeapTimer::invalidate):
5433         (JSC):
5434         (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread
5435         that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the
5436         HeapTimer and schedule it to fire immediately so that it can notice and kill itself.
5437         (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed
5438         out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim,
5439         but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case
5440         we were interrupted between releasing our mutex and trying to grab the APILock.
5441         * heap/HeapTimer.h:
5442         (HeapTimer):
5443         * heap/IncrementalSweeper.cpp:
5444         (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles
5445         all of that for us.
5446         (JSC::IncrementalSweeper::create):
5447         * heap/IncrementalSweeper.h:
5448         (IncrementalSweeper):
5449         * heap/MarkedAllocator.cpp:
5450         (JSC::MarkedAllocator::allocateSlowCase):
5451         * heap/WeakBlock.cpp:
5452         (JSC::WeakBlock::reap):
5453         * jsc.cpp:
5454         (functionGC):
5455         (functionReleaseExecutableMemory):
5456         (jscmain):
5457         * runtime/Completion.cpp:
5458         (JSC::checkSyntax):
5459         (JSC::evaluate):
5460         * runtime/GCActivityCallback.h:
5461         (DefaultGCActivityCallback):
5462         (JSC::DefaultGCActivityCallback::create):
5463         * runtime/JSGlobalData.cpp:
5464         (JSC::JSGlobalData::JSGlobalData):
5465         (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper)
5466         that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity
5467         it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the
5468         APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes.
5469         (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock.
5470         (JSC::JSGlobalData::sharedInstanceInternal):
5471         * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and
5472         de-refing JSGlobalDatas on separate threads since we don't do it that often anyways.
5473         (JSGlobalData):
5474         (JSC::JSGlobalData::apiLock):
5475         * runtime/JSGlobalObject.cpp:
5476         (JSC::JSGlobalObject::~JSGlobalObject):
5477         (JSC::JSGlobalObject::init):
5478         * runtime/JSLock.cpp:
5479         (JSC):
5480         (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance.
5481         (JSC::GlobalJSLock::~GlobalJSLock):
5482         (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that
5483         it can successfully unlock it later without it disappearing from underneath it.
5484         (JSC::JSLockHolder::~JSLockHolder):
5485         (JSC::JSLock::JSLock):
5486         (JSC::JSLock::~JSLock):
5487         (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for
5488         actually waiting for long periods.
5489         (JSC::JSLock::unlock):
5490         (JSC::JSLock::currentThreadIsHoldingLock):
5491         (JSC::JSLock::dropAllLocks):
5492         (JSC::JSLock::dropAllLocksUnconditionally):
5493         (JSC::JSLock::grabAllLocks):
5494         (JSC::JSLock::DropAllLocks::DropAllLocks):
5495         (JSC::JSLock::DropAllLocks::~DropAllLocks):
5496         * runtime/JSLock.h:
5497         (JSC):
5498         (GlobalJSLock):
5499         (JSLockHolder):
5500         (JSLock):
5501         (DropAllLocks):
5502         * runtime/WeakGCMap.h:
5503         (JSC::WeakGCMap::set):
5504         * testRegExp.cpp:
5505         (realMain):
5506
5507 2012-06-22  Peter Beverloo  <peter@chromium.org>
5508
5509         [Chromium] Disable c++0x compatibility warnings in JavaScriptCore.gyp when building for Android
5510         https://bugs.webkit.org/show_bug.cgi?id=88853
5511
5512         Reviewed by Steve Block.
5513
5514         The Android exclusions were necessary to fix a gyp generation error, as
5515         the gcc_version variable wasn't being defined for Android. Remove these
5516         exceptions when Chromium is able to define the gcc_version variable.
5517
5518         * JavaScriptCore.gyp/JavaScriptCore.gyp:
5519
5520 2012-06-21  Filip Pizlo  <fpizlo@apple.com>
5521
5522         op_resolve_global should not prevent DFG inlining
5523         https://bugs.webkit.org/show_bug.cgi?id=89726
5524
5525         Reviewed by Gavin Barraclough.
5526
5527         * bytecode/CodeBlock.cpp:
5528         (JSC::CodeBlock::CodeBlock):
5529         (JSC::CodeBlock::shrinkToFit):
5530         * bytecode/GlobalResolveInfo.h:
5531         (JSC::GlobalResolveInfo::GlobalResolveInfo):
5532         (GlobalResolveInfo):
5533         * dfg/DFGByteCodeParser.cpp:
5534         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
5535         * dfg/DFGCapabilities.h:
5536         (JSC::DFG::canInlineOpcode):
5537         * dfg/DFGOperations.cpp:
5538         * dfg/DFGOperations.h:
5539         * dfg/DFGSpeculativeJIT.h:
5540         (JSC::DFG::SpeculativeJIT::callOperation):
5541         * dfg/DFGSpeculativeJIT32_64.cpp:
5542         (JSC::DFG::SpeculativeJIT::compile):
5543         * dfg/DFGSpeculativeJIT64.cpp:
5544         (JSC::DFG::SpeculativeJIT::compile):
5545
5546 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5547
5548         DFG should inline 'new Array()'
5549         https://bugs.webkit.org/show_bug.cgi?id=89632
5550
5551         Reviewed by Geoffrey Garen.
5552
5553         This adds support for treating InternalFunction like intrinsics. The code
5554         to do so is actually quite clean, so I don't feel bad about perpetuating
5555         the InternalFunction vs. JSFunction-with-NativeExecutable dichotomy.
5556
5557         Currently this newfound power is only used to inline 'new Array()'.
5558
5559         * dfg/DFGByteCodeParser.cpp:
5560         (ByteCodeParser):
5561         (JSC::DFG::ByteCodeParser::handleCall):
5562         (JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
5563         (DFG):
5564         * dfg/DFGGraph.h:
5565         (JSC::DFG::Graph::isInternalFunctionConstant):
5566         (JSC::DFG::Graph::valueOfInternalFunctionConstant):
5567
5568 2012-06-21  Mark Hahnenberg  <mhahnenberg@apple.com>
5569
5570         Adding copyrights to new files.
5571
5572         * heap/HeapTimer.cpp:
5573         * heap/HeapTimer.h:
5574         * heap/IncrementalSweeper.cpp:
5575         * heap/IncrementalSweeper.h:
5576
5577 2012-06-21  Arnaud Renevier  <arno@renevier.net>
5578
5579         make sure headers are included only once per file
5580         https://bugs.webkit.org/show_bug.cgi?id=88922
5581
5582         Reviewed by Alexey Proskuryakov.
5583
5584         * bytecode/CodeBlock.h:
5585         * heap/MachineStackMarker.cpp:
5586         * runtime/JSVariableObject.h:
5587
5588 2012-06-21  Ryuan Choi  <ryuan.choi@gmail.com>
5589
5590         [EFL][WK2] Make WebKit2/Efl headers and resources installable.
5591         https://bugs.webkit.org/show_bug.cgi?id=88207
5592
5593         Reviewed by Chang Shu.
5594
5595         * shell/CMakeLists.txt: Use ${EXEC_INSTALL_DIR} instead of hardcoding "bin"
5596
5597 2012-06-20  Geoffrey Garen  <ggaren@apple.com>
5598
5599         Reduced (but did not eliminate) use of "berzerker GC"
5600         https://bugs.webkit.org/show_bug.cgi?id=89237
5601
5602         Reviewed by Gavin Barraclough.
5603
5604         (PART 1)
5605
5606         This patch turned out to be crashy, so I'm landing the non-crashy bits
5607         first.
5608
5609         This part is pre-requisite refactoring. I didn't actually turn off
5610         "berzerker GC" or turn on incremental shrinking.
5611
5612         * heap/MarkedAllocator.cpp:
5613         (JSC::MarkedAllocator::removeBlock): Make sure to clear the free list when
5614         we throw away the block we're currently allocating out of. Otherwise, we'll
5615         allocate out of a stale free list.
5616
5617         * heap/MarkedSpace.cpp:
5618         (JSC::Free::Free):
5619         (JSC::Free::operator()):
5620         (JSC::Free::returnValue): Refactored this functor to use a shared helper
5621         function, so we can share our implementation with the incremental sweeper.
5622
5623         Also changed to freeing individual blocks immediately instead of linking
5624         them into a list for later freeing. This makes the programming interface
5625         simpler, and it's slightly more efficient to boot.
5626
5627         (JSC::MarkedSpace::~MarkedSpace): Updated for rename.
5628
5629         (JSC::MarkedSpace::freeBlock):
5630         (JSC::MarkedSpace::freeOrShrinkBlock): New helper functions to share behavior
5631         with the incremental sweeper.
5632
5633         (JSC::MarkedSpace::shrink): Updated for new functor behavior.
5634
5635         * heap/MarkedSpace.h: Statically typed languages are awesome.
5636
5637 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5638
5639         DFG should optimize ResolveGlobal
5640         https://bugs.webkit.org/show_bug.cgi?id=89617
5641
5642         Reviewed by Oliver Hunt.
5643
5644         This adds inlining of ResolveGlobal accesses that are known monomorphic. It also
5645         adds the specific function optimization to ResolveGlobal, when it is inlined. And,
5646         it makes internal functions act like specific functions, since that will be the
5647         most common use-case of this optimization.
5648
5649         This is only a slighy speed-up (sub 1%), since we don't yet do the obvious thing
5650         with this optimization, which is to completely inline common "globally resolved"
5651         function and constructor calls, like "new Array()".
5652
5653         * CMakeLists.txt:
5654         * GNUmakefile.list.am:
5655         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
5656         * JavaScriptCore.xcodeproj/project.pbxproj:
5657         * Target.pri:
5658         * bytecode/CodeBlock.cpp:
5659         (JSC::CodeBlock::globalResolveInfoForBytecodeOffset):
5660         * bytecode/CodeBlock.h:
5661         (CodeBlock):
5662         (JSC::CodeBlock::numberOfGlobalResolveInfos):
5663         * bytecode/GlobalResolveInfo.h:
5664         (JSC::getGlobalResolveInfoBytecodeOffset):
5665         (JSC):
5666         * bytecode/ResolveGlobalStatus.cpp: Added.
5667         (JSC):
5668         (JSC::computeForStructure):
5669         (JSC::computeForLLInt):
5670         (JSC::ResolveGlobalStatus::computeFor):
5671         * bytecode/ResolveGlobalStatus.h: Added.
5672         (JSC):
5673         (ResolveGlobalStatus):
5674         (JSC::ResolveGlobalStatus::ResolveGlobalStatus):
5675         (JSC::ResolveGlobalStatus::state):
5676         (JSC::ResolveGlobalStatus::isSet):
5677         (JSC::ResolveGlobalStatus::operator!):
5678         (JSC::ResolveGlobalStatus::isSimple):
5679         (JSC::ResolveGlobalStatus::takesSlowPath):
5680         (JSC::ResolveGlobalStatus::structure):
5681         (JSC::ResolveGlobalStatus::offset):
5682         (JSC::ResolveGlobalStatus::specificValue):
5683         * dfg/DFGByteCodeParser.cpp:
5684         (ByteCodeParser):
5685         (JSC::DFG::ByteCodeParser::handleGetByOffset):
5686         (DFG):
5687         (JSC::DFG::ByteCodeParser::handleGetById):
5688         (JSC::DFG::ByteCodeParser::parseBlock):
5689         * runtime/JSObject.cpp:
5690         (JSC::getCallableObjectSlow):
5691         (JSC):
5692         (JSC::JSObject::put):
5693         (JSC::JSObject::putDirectVirtual):
5694         (JSC::JSObject::putDirectAccessor):
5695         * runtime/JSObject.h:
5696         (JSC):
5697         (JSC::getCallableObject):
5698         (JSC::JSObject::putOwnDataProperty):
5699         (JSC::JSObject::putDirect):
5700         (JSC::JSObject::putDirectWithoutTransition):
5701
5702 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5703
5704         Functions on global objects should be specializable
5705         https://bugs.webkit.org/show_bug.cgi?id=89615
5706
5707         Reviewed by Oliver Hunt.
5708
5709         I tested to see if this brought back the bug in https://bugs.webkit.org/show_bug.cgi?id=33343,
5710         and it didn't. Bug 33343 was the reason why we disabled global object function specialization
5711         to begin with. So I'm guessing this is safe.
5712
5713         * runtime/JSGlobalObject.cpp:
5714         (JSC::JSGlobalObject::init):
5715
5716 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5717
5718         build-webkit failure due to illegal 32-bit integer constants in code
5719         generated by offlineasm
5720         https://bugs.webkit.org/show_bug.cgi?id=89347
5721
5722         Reviewed by Geoffrey Garen.
5723
5724         The offending constants are the magic numbers used by offlineasm to find
5725         offsets in the generated machine code. Added code to turn them into what
5726         the C++ compiler will believe to be valid 32-bit values.
5727
5728         * offlineasm/offsets.rb:
5729
5730 2012-06-19  Geoffrey Garen  <ggaren@apple.com>
5731
5732         Made the incremental sweeper more aggressive
5733         https://bugs.webkit.org/show_bug.cgi?id=89527
5734
5735         Reviewed by Oliver Hunt.
5736
5737         This is a pre-requisite to getting rid of "berzerker GC" because we need
5738         the sweeper to reclaim memory in a timely fashion, or we'll see a memory
5739         footprint regression.
5740
5741         * heap/IncrementalSweeper.h:
5742         * heap/IncrementalSweeper.cpp:
5743         (JSC::IncrementalSweeper::scheduleTimer): Since the time slice is predictable,
5744         no need to use a data member to record it.
5745
5746         (JSC::IncrementalSweeper::doSweep): Sweep as many blocks as we can in a
5747         small time slice. This is better than sweeping only one block per timer
5748         fire because that strategy has a heavy timer overhead, and artificially
5749         delays memory reclamation.
5750
5751 2012-06-20  Filip Pizlo  <fpizlo@apple.com>
5752
5753         DFG should be able to print disassembly interleaved with the IR
5754         https://bugs.webkit.org/show_bug.cgi?id=89551
5755
5756         Reviewed by Geoffrey Garen.
5757
5758         This change also removes running Dominators unconditionally on every DFG
5759         compile. Dominators are designed to be computed on-demand, and currently
5760         the only demand is graph dumps.
5761
5762         * CMakeLists.txt:
5763         * GNUmakefile.list.am:
5764         * JavaScriptCore.xcodeproj/project.pbxproj:
5765         * Target.pri:
5766         * assembler/ARMv7Assembler.h:
5767         (JSC::ARMv7Assembler::labelIgnoringWatchpoints):
5768         (ARMv7Assembler):
5769         * assembler/AbstractMacroAssembler.h:
5770         (AbstractMacroAssembler):
5771         (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints):
5772         * assembler/X86Assembler.h:
5773         (X86Assembler):
5774         (JSC::X86Assembler::labelIgnoringWatchpoints):
5775         * dfg/DFGCommon.h:
5776         (JSC::DFG::shouldShowDisassembly):
5777         (DFG):
5778         * dfg/DFGDisassembler.cpp: Added.
5779         (DFG):
5780         (JSC::DFG::Disassembler::Disassembler):
5781         (JSC::DFG::Disassembler::dump):
5782         (JSC::DFG::Disassembler::dumpDisassembly):
5783         * dfg/DFGDisassembler.h: Added.
5784         (DFG):
5785         (Disassembler):
5786         (JSC::DFG::Disassembler::setStartOfCode):
5787         (JSC::DFG::Disassembler::setForBlock):
5788         (JSC::DFG::Disassembler::setForNode):
5789         (JSC::DFG::Disassembler::setEndOfMainPath):
5790         (JSC::DFG::Disassembler::setEndOfCode):
5791         * dfg/DFGDriver.cpp:
5792         (JSC::DFG::compile):
5793         * dfg/DFGGraph.cpp:
5794         (JSC::DFG::Graph::dumpCodeOrigin):
5795         (JSC::DFG::Graph::amountOfNodeWhiteSpace):
5796         (DFG):
5797         (JSC::DFG::Graph::printNodeWhiteSpace):
5798         (JSC::DFG::Graph::dump):
5799         (JSC::DFG::Graph::dumpBlockHeader):
5800         * dfg/DFGGraph.h:
5801         * dfg/DFGJITCompiler.cpp:
5802         (JSC::DFG::JITCompiler::JITCompiler):
5803         (DFG):
5804         (JSC::DFG::JITCompiler::compile):
5805         (JSC::DFG::JITCompiler::compileFunction):
5806         * dfg/DFGJITCompiler.h:
5807         (JITCompiler):
5808         (JSC::DFG::JITCompiler::setStartOfCode):
5809         (JSC::DFG::JITCompiler::setForBlock):
5810         (JSC::DFG::JITCompiler::setForNode):
5811         (JSC::DFG::JITCompiler::setEndOfMainPath):
5812         (JSC::DFG::JITCompiler::setEndOfCode):
5813         * dfg/DFGNode.h:
5814         (Node):
5815         (JSC::DFG::Node::willHaveCodeGen):
5816         * dfg/DFGNodeFlags.cpp:
5817         (JSC::DFG::nodeFlagsAsString):
5818         * dfg/DFGSpeculativeJIT.cpp:
5819         (JSC::DFG::SpeculativeJIT::compile):
5820         * dfg/DFGSpeculativeJIT.h:
5821         (SpeculativeJIT):
5822         * runtime/Options.cpp:
5823         (Options):
5824         (JSC::Options::initializeOptions):
5825         * runtime/Options.h:
5826         (Options):
5827
5828 2012-06-19  Filip Pizlo  <fpizlo@apple.com>
5829
5830         JSC should be able to show disassembly for all generated JIT code
5831         https://bugs.webkit.org/show_bug.cgi?id=89536
5832
5833         Reviewed by Gavin Barraclough.
5834
5835         Now instead of doing linkBuffer.finalizeCode(), you do
5836         FINALIZE_CODE(linkBuffer, (... explanation ...)). FINALIZE_CODE() then
5837         prints your explanation and the disassembled code, if
5838         Options::showDisassembly is set to true.
5839
5840         * CMakeLists.txt:
5841         * GNUmakefile.list.am:
5842         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
5843         * JavaScriptCore.xcodeproj/project.pbxproj:
5844         * Target.pri:
5845         * assembler/LinkBuffer.cpp: Added.
5846         (JSC):
5847         (JSC::LinkBuffer::finalizeCodeWithoutDisassembly):
5848         (JSC::LinkBuffer::finalizeCodeWithDisassembly):
5849         (JSC::LinkBuffer::linkCode):
5850         (JSC::LinkBuffer::performFinalization):
5851         (JSC::LinkBuffer::dumpLinkStatistics):
5852         (JSC::LinkBuffer::dumpCode):
5853         * assembler/LinkBuffer.h:
5854         (LinkBuffer):
5855         (JSC):
5856         * assembler/MacroAssemblerCodeRef.h:
5857         (JSC::MacroAssemblerCodeRef::tryToDisassemble):
5858         (MacroAssemblerCodeRef):
5859         * dfg/DFGJITCompiler.cpp:
5860         (JSC::DFG::JITCompiler::compile):
5861         (JSC::DFG::JITCompiler::compileFunction):
5862         * dfg/DFGOSRExitCompiler.cpp:
5863         * dfg/DFGRepatch.cpp:
5864         (JSC::DFG::generateProtoChainAccessStub):
5865         (JSC::DFG::tryCacheGetByID):
5866         (JSC::DFG::tryBuildGetByIDList):
5867         (JSC::DFG::emitPutReplaceStub):
5868         (JSC::DFG::emitPutTransitionStub):
5869         * dfg/DFGThunks.cpp:
5870         (JSC::DFG::osrExitGenerationThunkGenerator):
5871         * disassembler/Disassembler.h:
5872         (JSC):
5873         (JSC::tryToDisassemble):
5874         * disassembler/UDis86Disassembler.cpp:
5875         (JSC::tryToDisassemble):
5876         * jit/JIT.cpp:
5877         (JSC::JIT::privateCompile):
5878         * jit/JITCode.h:
5879         (JSC::JITCode::tryToDisassemble):
5880         * jit/JITOpcodes.cpp:
5881         (JSC::JIT::privateCompileCTIMachineTrampolines):
5882         * jit/JITOpcodes32_64.cpp:
5883         (JSC::JIT::privateCompileCTIMachineTrampolines):
5884         (JSC::JIT::privateCompileCTINativeCall):
5885         * jit/JITPropertyAccess.cpp:
5886         (JSC::JIT::stringGetByValStubGenerator):
5887         (JSC::JIT::privateCompilePutByIdTransition):
5888         (JSC::JIT::privateCompilePatchGetArrayLength):
5889         (JSC::JIT::privateCompileGetByIdProto):
5890         (JSC::JIT::privateCompileGetByIdSelfList):
5891         (JSC::JIT::privateCompileGetByIdProtoList):
5892         (JSC::JIT::privateCompileGetByIdChainList):
5893         (JSC::JIT::privateCompileGetByIdChain):
5894         * jit/JITPropertyAccess32_64.cpp:
5895         (JSC::JIT::stringGetByValStubGenerator):
5896         (JSC::JIT::privateCompilePutByIdTransition):
5897         (JSC::JIT::privateCompilePatchGetArrayLength):
5898         (JSC::JIT::privateCompileGetByIdProto):
5899         (JSC::JIT::privateCompileGetByIdSelfList):
5900         (JSC::JIT::privateCompileGetByIdProtoList):
5901         (JSC::JIT::privateCompileGetByIdChainList):
5902         (JSC::JIT::privateCompileGetByIdChain):
5903         * jit/SpecializedThunkJIT.h:
5904         (JSC::SpecializedThunkJIT::finalize):
5905         * jit/ThunkGenerators.cpp:
5906         (JSC::charCodeAtThunkGenerator):
5907         (JSC::charAtThunkGenerator):
5908         (JSC::fromCharCodeThunkGenerator):
5909         (JSC::sqrtThunkGenerator):
5910         (JSC::floorThunkGenerator):
5911         (JSC::ceilThunkGenerator):
5912         (JSC::roundThunkGenerator):
5913         (JSC::expThunkGenerator):
5914         (JSC::logThunkGenerator):
5915         (JSC::absThunkGenerator):
5916         (JSC::powThunkGenerator):
5917         * llint/LLIntThunks.cpp:
5918         (JSC::LLInt::generateThunkWithJumpTo):
5919         (JSC::LLInt::functionForCallEntryThunkGenerator):
5920         (JSC::LLInt::functionForConstructEntryThunkGenerator):
5921         (JSC::LLInt::functionForCallArityCheckThunkGenerator):
5922         (JSC::LLInt::functionForConstructArityCheckThunkGenerator):
5923         (JSC::LLInt::evalEntryThunkGenerator):
5924         (JSC::LLInt::programEntryThunkGenerator):
5925         * runtime/Options.cpp:
5926         (Options):
5927         (JSC::Options::initializeOptions):
5928         * runtime/Options.h:
5929         (Options):
5930         * yarr/YarrJIT.cpp:
5931         (JSC::Yarr::YarrGenerator::compile):
5932
5933 2012-06-19  Mark Hahnenberg  <mhahnenberg@apple.com>
5934
5935         [Qt][Mac] REGRESSION(r120742): It broke the build
5936         https://bugs.webkit.org/show_bug.cgi?id=89516
5937
5938         Reviewed by Geoffrey Garen.
5939
5940         Removing GCActivityCallbackCF.cpp because it doesn't mesh well with cross-platform
5941         code on Darwin (e.g. Qt). We now use plain ol' vanilla ifdefs to handle platforms
5942         without CF support. These if-defs will probably disappear in the future when we
5943         use cross-platform timers in HeapTimer.
5944
5945         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
5946         * JavaScriptCore.xcodeproj/project.pbxproj:
5947         * runtime/GCActivityCallback.cpp:
5948         (JSC):
5949         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
5950         (JSC::DefaultGCActivityCallback::doWork):
5951         (JSC::DefaultGCActivityCallback::scheduleTimer):
5952         (JSC::DefaultGCActivityCallback::cancelTimer):
5953         (JSC::DefaultGCActivityCallback::didAllocate):
5954         (JSC::DefaultGCActivityCallback::willCollect):
5955         (JSC::DefaultGCActivityCallback::cancel):
5956         * runtime/GCActivityCallbackCF.cpp: Removed.
5957
5958 2012-06-19  Filip Pizlo  <fpizlo@apple.com>
5959
5960         DFG CFA forgets to notify subsequent phases of found constants if it proves LogicalNot to be a constant
5961         https://bugs.webkit.org/show_bug.cgi?id=89511
5962         <rdar://problem/11700089>
5963
5964         Reviewed by Geoffrey Garen.
5965
5966         * dfg/DFGAbstractState.cpp:
5967         (JSC::DFG::AbstractState::execute):
5968
5969 2012-06-19  Mark Lam  <mark.lam@apple.com>
5970
5971         CodeBlock::needsCallReturnIndices() is no longer needed.
5972         https://bugs.webkit.org/show_bug.cgi?id=89490
5973
5974         Reviewed by Geoffrey Garen.
5975
5976         * bytecode/CodeBlock.h:
5977         (JSC::CodeBlock::needsCallReturnIndices): removed.
5978         * dfg/DFGJITCompiler.cpp:
5979         (JSC::DFG::JITCompiler::link):
5980         * jit/JIT.cpp:
5981         (JSC::JIT::privateCompile):
5982
5983 2012-06-19  Filip Pizlo  <fpizlo@apple.com>
5984
5985         Unreviewed, try to fix Windows build.
5986
5987         * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd:
5988
5989 2012-06-17  Filip Pizlo  <fpizlo@apple.com>
5990
5991         It should be possible to look at disassembly
5992         https://bugs.webkit.org/show_bug.cgi?id=89319
5993
5994         Reviewed by Sam Weinig.
5995
5996         This imports the udis86 disassembler library. The library is placed
5997         behind an abstraction in disassembler/Disassembler.h, so that we can
5998         in the future use other disassemblers (for other platforms) whenever
5999         appropriate. As a first step, the disassembler is being invoked for
6000         DFG verbose dumps.
6001
6002         If we ever want to merge a new version of udis86 in the future, I've
6003         made notes about changes I made to the library in
6004         disassembler/udis86/differences.txt.
6005
6006         * CMakeLists.txt:
6007         * DerivedSources.make:
6008         * GNUmakefile.list.am:
6009         * JavaScriptCore.pri:
6010         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6011         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
6012         * JavaScriptCore.xcodeproj/project.pbxproj:
6013         * dfg/DFGJITCompiler.cpp:
6014         (JSC::DFG::JITCompiler::compile):
6015         (JSC::DFG::JITCompiler::compileFunction):
6016         * disassembler: Added.
6017         * disassembler/Disassembler.h: Added.
6018         (JSC):
6019         (JSC::tryToDisassemble):
6020         * disassembler/UDis86Disassembler.cpp: Added.
6021         (JSC):
6022         (JSC::tryToDisassemble):
6023         * disassembler/udis86: Added.
6024         * disassembler/udis86/differences.txt: Added.
6025         * disassembler/udis86/itab.py: Added.
6026         (UdItabGenerator):
6027         (UdItabGenerator.__init__):
6028         (UdItabGenerator.toGroupId):
6029         (UdItabGenerator.genLookupTable):
6030         (UdItabGenerator.genLookupTableList):
6031         (UdItabGenerator.genInsnTable):
6032         (genItabH):
6033         (genItabH.UD_ITAB_H):
6034         (genItabC):
6035         (genItab):
6036         (main):
6037         * disassembler/udis86/optable.xml: Added.
6038         * disassembler/udis86/ud_opcode.py: Added.
6039         (UdOpcodeTables):
6040         (UdOpcodeTables.sizeOfTable):
6041         (UdOpcodeTables.nameOfTable):
6042         (UdOpcodeTables.updateTable):
6043         (UdOpcodeTables.Insn):
6044         (UdOpcodeTables.Insn.__init__):
6045         (UdOpcodeTables.Insn.__init__.opcode):
6046         (UdOpcodeTables.parse):
6047         (UdOpcodeTables.addInsnDef):
6048         (UdOpcodeTables.print_table):
6049         (UdOpcodeTables.print_tree):
6050         * disassembler/udis86/ud_optable.py: Added.
6051         (UdOptableXmlParser):
6052         (UdOptableXmlParser.parseDef):
6053         (UdOptableXmlParser.parse):
6054         (printFn):
6055         (parse):
6056         (main):
6057         * disassembler/udis86/udis86.c: Added.
6058         (ud_init):
6059         (ud_disassemble):
6060         (ud_set_mode):
6061         (ud_set_vendor):
6062         (ud_set_pc):
6063         (ud):
6064         (ud_insn_asm):
6065         (ud_insn_off):
6066         (ud_insn_hex):
6067         (ud_insn_ptr):
6068         (ud_insn_len):
6069         * disassembler/udis86/udis86.h: Added.
6070         * disassembler/udis86/udis86_decode.c: Added.
6071         (eff_adr_mode):
6072         (ud_lookup_mnemonic):
6073         (decode_prefixes):
6074         (modrm):
6075         (resolve_operand_size):
6076         (resolve_mnemonic):
6077         (decode_a):
6078         (decode_gpr):
6079         (resolve_gpr64):
6080         (resolve_gpr32):
6081         (resolve_reg):
6082         (decode_imm):
6083         (decode_modrm_reg):
6084         (decode_modrm_rm):
6085         (decode_o):
6086         (decode_operand):
6087         (decode_operands):
6088         (clear_insn):
6089         (resolve_mode):
6090         (gen_hex):
6091         (decode_insn):
6092         (decode_3dnow):
6093         (decode_ssepfx):
6094         (decode_ext):
6095         (decode_opcode):
6096         (ud_decode):
6097         * disassembler/udis86/udis86_decode.h: Added.
6098         (ud_itab_entry_operand):
6099         (ud_itab_entry):
6100         (ud_lookup_table_list_entry):
6101         (sse_pfx_idx):
6102         (mode_idx):
6103         (modrm_mod_idx):
6104         (vendor_idx):
6105         (is_group_ptr):
6106         (group_idx):
6107         * disassembler/udis86/udis86_extern.h: Added.
6108         * disassembler/udis86/udis86_input.c: Added.
6109         (inp_buff_hook):
6110         (inp_file_hook):
6111         (ud):
6112         (ud_set_user_opaque_data):
6113         (ud_get_user_opaque_data):
6114         (ud_set_input_buffer):
6115         (ud_set_input_file):
6116         (ud_input_skip):
6117         (ud_input_end):
6118         (ud_inp_next):
6119         (ud_inp_back):
6120         (ud_inp_peek):
6121         (ud_inp_move):
6122         (ud_inp_uint8):
6123         (ud_inp_uint16):
6124         (ud_inp_uint32):
6125         (ud_inp_uint64):
6126         * disassembler/udis86/udis86_input.h: Added.
6127         * disassembler/udis86/udis86_itab_holder.c: Added.
6128         * disassembler/udis86/udis86_syn-att.c: Added.
6129         (opr_cast):
6130         (gen_operand):
6131         (ud_translate_att):
6132         * disassembler/udis86/udis86_syn-intel.c: Added.
6133         (opr_cast):
6134         (gen_operand):
6135         (ud_translate_intel):
6136         * disassembler/udis86/udis86_syn.c: Added.
6137         * disassembler/udis86/udis86_syn.h: Added.
6138         (mkasm):
6139         * disassembler/udis86/udis86_types.h: Added.
6140         (ud_operand):
6141         (ud):
6142         * jit/JITCode.h:
6143         (JITCode):
6144         (JSC::JITCode::tryToDisassemble):
6145
6146 2012-06-19  Mark Hahnenberg  <mhahnenberg@apple.com>
6147
6148         GCActivityCallback and IncrementalSweeper should share code
6149         https://bugs.webkit.org/show_bug.cgi?id=89400
6150
6151         Reviewed by Geoffrey Garen.
6152
6153         A lot of functionality is duplicated between GCActivityCallback and IncrementalSweeper.
6154         We should extract the common functionality out into a separate class that both of them
6155         can inherit from. This refactoring will be an even greater boon when we add the ability
6156         to shut these two agents down in a thread-safe fashion
6157
6158         * CMakeLists.txt:
6159         * GNUmakefile.list.am:
6160         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6161         * JavaScriptCore.xcodeproj/project.pbxproj:
6162         * Target.pri:
6163         * heap/Heap.cpp:
6164         (JSC::Heap::Heap): Move initialization down so that the JSGlobalData has a valid Heap when
6165         we're initializing the GCActivityCallback and the IncrementalSweeper.
6166         * heap/Heap.h:
6167         (Heap):
6168         * heap/HeapTimer.cpp: Added.
6169         (JSC):
6170         (JSC::HeapTimer::HeapTimer): Initialize the various base class data that
6171         DefaultGCActivityCallback::commonConstructor() used to do.
6172         (JSC::HeapTimer::~HeapTimer): Call to invalidate().
6173         (JSC::HeapTimer::synchronize): Same functionality as the old DefaultGCActivityCallback::synchronize().
6174         Virtual so that non-CF subclasses can override.
6175         (JSC::HeapTimer::invalidate): Tears down the runloop timer to prevent any future firing.
6176         (JSC::HeapTimer::timerDidFire): Callback to pass to the timer function. Casts and calls the virtual doWork().
6177         * heap/HeapTimer.h: Added. This is the class that serves as the common base class for
6178         both GCActivityCallback and IncrementalSweeper. It handles setting up and tearing down run loops and synchronizing
6179         across threads for its subclasses.
6180         (JSC):
6181         (HeapTimer):
6182         * heap/IncrementalSweeper.cpp: Changes to accomodate the extraction of common functionality
6183         between IncrementalSweeper and GCActivityCallback into a common ancestor.
6184         (JSC):
6185         (JSC::IncrementalSweeper::doWork):
6186         (JSC::IncrementalSweeper::IncrementalSweeper):
6187         (JSC::IncrementalSweeper::cancelTimer):
6188         (JSC::IncrementalSweeper::create):
6189         * heap/IncrementalSweeper.h:
6190         (IncrementalSweeper):
6191         * runtime/GCActivityCallback.cpp:
6192         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
6193         (JSC::DefaultGCActivityCallback::doWork):
6194         * runtime/GCActivityCallback.h:
6195         (GCActivityCallback):
6196         (JSC::GCActivityCallback::willCollect):
6197         (JSC::GCActivityCallback::GCActivityCallback):
6198         (JSC):
6199         (DefaultGCActivityCallback): Remove the platform data struct. The platform data should be kept in
6200         the class itself so as to be accessible by doWork(). Most of the platform data for CF is kept in
6201         HeapTimer anyways, so we only need the m_delay field now.
6202         * runtime/GCActivityCallbackBlackBerry.cpp:
6203         (JSC):
6204         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
6205         (JSC::DefaultGCActivityCallback::doWork):
6206         (JSC::DefaultGCActivityCallback::didAllocate):
6207         * runtime/GCActivityCallbackCF.cpp:
6208         (JSC):
6209         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
6210         (JSC::DefaultGCActivityCallback::doWork):
6211         (JSC::DefaultGCActivityCallback::scheduleTimer):
6212         (JSC::DefaultGCActivityCallback::cancelTimer):
6213         (JSC::DefaultGCActivityCallback::didAllocate):
6214         (JSC::DefaultGCActivityCallback::willCollect):
6215         (JSC::DefaultGCActivityCallback::cancel):
6216
6217
6218 2012-06-19  Mike West  <mkwst@chromium.org>
6219
6220         Introduce ENABLE_CSP_NEXT configuration flag.
6221         https://bugs.webkit.org/show_bug.cgi?id=89300
6222
6223         Reviewed by Adam Barth.
6224
6225         The 1.0 draft of the Content Security Policy spec is just about to
6226         move to Last Call. We'll hide work on the upcoming 1.1 spec behind
6227         this ENABLE flag, disabled by default.
6228
6229         Spec: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html
6230
6231         * Configurations/FeatureDefines.xcconfig:
6232
6233 2012-06-18  Mark Lam  <mark.lam@apple.com>
6234
6235         Changed JSC to always record line number information so that error.stack
6236         and window.onerror() can report proper line numbers.
6237         https://bugs.webkit.org/show_bug.cgi?id=89410
6238
6239         Reviewed by Geoffrey Garen.
6240
6241         * bytecode/CodeBlock.cpp:
6242         (JSC::CodeBlock::CodeBlock):
6243         (JSC::CodeBlock::lineNumberForBytecodeOffset):
6244         (JSC::CodeBlock::shrinkToFit): m_lineInfo is now available unconditionally.
6245
6246         * bytecode/CodeBlock.h:
6247         (JSC::CodeBlock::addLineInfo):
6248         (JSC::CodeBlock::hasLineInfo): Unused.  Now removed.
6249         (JSC::CodeBlock::needsCallReturnIndices):
6250         (CodeBlock):
6251         (RareData):  Hoisted m_lineInfo out of m_rareData.  m_lineInfo is now
6252         filled in unconditionally.
6253
6254         * bytecompiler/BytecodeGenerator.h:
6255         (JSC::BytecodeGenerator::addLineInfo):
6256
6257 2012-06-18  Andy Estes  <aestes@apple.com>
6258
6259         Fix r120663, which didn't land the change that was reviewed.
6260
6261 2012-06-18  Andy Estes  <aestes@apple.com>
6262
6263         [JSC] In JSGlobalData.cpp, enableAssembler() sometimes leaks two CF objects
6264         https://bugs.webkit.org/show_bug.cgi?id=89415
6265
6266         Reviewed by Sam Weinig.
6267
6268         In the case where canUseJIT was a non-NULL CFBooleanRef,
6269         enableAssembler() would leak both canUseJITKey and canUseJIT by
6270         returning before calling CFRelease. Fix this by using RetainPtr.
6271
6272         * runtime/JSGlobalData.cpp:
6273         (JSC::enableAssembler):
6274
6275 2012-06-17  Geoffrey Garen  <ggaren@apple.com>
6276
6277         GC copy phase spends needless cycles zero-filling blocks
6278         https://bugs.webkit.org/show_bug.cgi?id=89128
6279
6280         Reviewed by Gavin Barraclough.
6281
6282         We only need to zero-fill when we're allocating memory that might not
6283         get fully initialized before GC.
6284
6285         * heap/CopiedBlock.h:
6286         (JSC::CopiedBlock::createNoZeroFill):
6287         (JSC::CopiedBlock::create): Added a way to create without zero-filling.
6288         This is our optimization.
6289
6290         (JSC::CopiedBlock::zeroFillToEnd):
6291         (JSC::CopiedBlock::CopiedBlock): Split zero-filling out from creation,
6292         so we can sometimes create without zero-filling.
6293
6294         * heap/CopiedSpace.cpp:
6295         (JSC::CopiedSpace::init):
6296         (JSC::CopiedSpace::tryAllocateSlowCase):
6297         (JSC::CopiedSpace::doneCopying): Renamed addNewBlock to allocateBlock()
6298         to clarify that the new block is always newly-allocated.
6299
6300         (JSC::CopiedSpace::doneFillingBlock): Make sure to zero-fill to the end
6301         of a block that might be used in the future for allocation. (Most of the
6302         time, this is a no-op, since we've already filled the block completely.)
6303
6304         (JSC::CopiedSpace::getFreshBlock): Removed this function because the
6305         abstraction of "allocation must succeed" is no longer useful.
6306
6307         * heap/CopiedSpace.h: Updated declarations to match.
6308
6309         * heap/CopiedSpaceInlineMethods.h:
6310         (JSC::CopiedSpace::allocateBlockForCopyingPhase): New function, which
6311         knows that it can skip zero-filling.
6312
6313         Added tighter scoping to our lock, to improve parallelism.
6314
6315         (JSC::CopiedSpace::allocateBlock): Folded getFreshBlock functionality
6316         into this function, for simplicity.
6317
6318         * heap/MarkStack.cpp:
6319         (JSC::SlotVisitor::startCopying):
6320         (JSC::SlotVisitor::allocateNewSpace): Use our new zero-fill-free helper
6321         function for great good.
6322
6323 2012-06-17  Filip Pizlo  <fpizlo@apple.com>
6324
6325         DFG should attempt to use structure watchpoints for all inlined get_by_id's and put_by_id's
6326         https://bugs.webkit.org/show_bug.cgi?id=89316
6327
6328         Reviewed by Oliver Hunt.
6329
6330         * dfg/DFGByteCodeParser.cpp:
6331         (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
6332         (ByteCodeParser):
6333         (JSC::DFG::ByteCodeParser::handleGetById):
6334         (JSC::DFG::ByteCodeParser::parseBlock):
6335
6336 2012-06-15  Yong Li  <yoli@rim.com>
6337
6338         [BlackBerry] Put platform-specific GC policy in GCActivityCallback
6339         https://bugs.webkit.org/show_bug.cgi?id=89236
6340
6341         Reviewed by Rob Buis.
6342
6343         Add GCActivityCallbackBlackBerry.cpp and implement platform-specific
6344         low memory GC policy there.
6345
6346         * PlatformBlackBerry.cmake:
6347         * heap/Heap.h:
6348         (JSC::Heap::isSafeToCollect): Added.
6349         * runtime/GCActivityCallbackBlackBerry.cpp: Added.
6350         (JSC):
6351         (JSC::DefaultGCActivityCallbackPlatformData::DefaultGCActivityCallbackPlatformData):
6352         (DefaultGCActivityCallbackPlatformData):
6353         (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback):
6354         (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback):
6355         (JSC::DefaultGCActivityCallback::didAllocate):
6356         (JSC::DefaultGCActivityCallback::willCollect):
6357         (JSC::DefaultGCActivityCallback::synchronize):
6358         (JSC::DefaultGCActivityCallback::cancel):
6359
6360 2012-06-15  Filip Pizlo  <fpizlo@apple.com>
6361
6362         DFG should be able to set watchpoints on structure transitions in the
6363         method check prototype chain
6364         https://bugs.webkit.org/show_bug.cgi?id=89058
6365
6366         Adding the same assertion to 32-bit that I added to 64-bit. This change
6367         does not affect correctness but it's a good thing for assertion coverage.
6368
6369         * dfg/DFGSpeculativeJIT32_64.cpp:
6370         (JSC::DFG::SpeculativeJIT::compile):
6371
6372 2012-06-13  Filip Pizlo  <fpizlo@apple.com>
6373
6374         DFG should be able to set watchpoints on structure transitions in the
6375         method check prototype chain
6376         https://bugs.webkit.org/show_bug.cgi?id=89058
6377
6378         Reviewed by Gavin Barraclough.
6379
6380         This adds the ability to set watchpoints on Structures, and then does
6381         the most modest thing we can do with this ability: the DFG now sets
6382         watchpoints on structure transitions in the prototype chain of method
6383         checks.
6384
6385         This appears to be a >1% speed-up on V8.
6386
6387         * bytecode/PutByIdStatus.cpp:
6388         (JSC::PutByIdStatus::computeFromLLInt):
6389         (JSC::PutByIdStatus::computeFor):
6390         * bytecode/StructureSet.h:
6391         (JSC::StructureSet::containsOnly):
6392         (StructureSet):
6393         * bytecode/Watchpoint.cpp:
6394         (JSC::WatchpointSet::WatchpointSet):
6395         (JSC::InlineWatchpointSet::add):
6396         (JSC):
6397         (JSC::InlineWatchpointSet::inflateSlow):
6398         (JSC::InlineWatchpointSet::freeFat):
6399         * bytecode/Watchpoint.h:
6400         (WatchpointSet):
6401         (JSC):
6402         (InlineWatchpointSet):
6403         (JSC::InlineWatchpointSet::InlineWatchpointSet):
6404         (JSC::InlineWatchpointSet::~InlineWatchpointSet):
6405         (JSC::InlineWatchpointSet::hasBeenInvalidated):
6406         (JSC::InlineWatchpointSet::isStillValid):
6407         (JSC::InlineWatchpointSet::startWatching):
6408         (JSC::InlineWatchpointSet::notifyWrite):
6409         (JSC::InlineWatchpointSet::isFat):
6410         (JSC::InlineWatchpointSet::fat):
6411         (JSC::InlineWatchpointSet::inflate):
6412         * dfg/DFGAbstractState.cpp:
6413         (JSC::DFG::AbstractState::execute):
6414         * dfg/DFGByteCodeParser.cpp:
6415         (JSC::DFG::ByteCodeParser::addStructureTransitionCheck):
6416         (ByteCodeParser):
6417         (JSC::DFG::ByteCodeParser::parseBlock):
6418         * dfg/DFGCSEPhase.cpp:
6419         (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
6420         (CSEPhase):
6421         (JSC::DFG::CSEPhase::performNodeCSE):
6422         * dfg/DFGCommon.h:
6423         * dfg/DFGGraph.cpp:
6424         (JSC::DFG::Graph::dump):
6425         * dfg/DFGGraph.h:
6426         (JSC::DFG::Graph::isCellConstant):
6427         * dfg/DFGJITCompiler.h:
6428         (JSC::DFG::JITCompiler::addWeakReferences):
6429         (JITCompiler):
6430         * dfg/DFGNode.h:
6431         (JSC::DFG::Node::hasStructure):
6432         (Node):
6433         (JSC::DFG::Node::structure):
6434         * dfg/DFGNodeType.h:
6435         (DFG):
6436         * dfg/DFGPredictionPropagationPhase.cpp:
6437         (JSC::DFG::PredictionPropagationPhase::propagate):
6438         * dfg/DFGRepatch.cpp:
6439         (JSC::DFG::emitPutTransitionStub):
6440         * dfg/DFGSpeculativeJIT64.cpp:
6441         (JSC::DFG::SpeculativeJIT::compile):
6442         * jit/JITStubs.cpp:
6443         (JSC::JITThunks::tryCachePutByID):
6444         * llint/LLIntSlowPaths.cpp:
6445         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
6446         * runtime/Structure.cpp:
6447         (JSC::Structure::Structure):
6448         * runtime/Structure.h:
6449         (JSC::Structure::transitionWatchpointSetHasBeenInvalidated):
6450         (Structure):
6451         (JSC::Structure::transitionWatchpointSetIsStillValid):
6452         (JSC::Structure::addTransitionWatchpoint):
6453         (JSC::Structure::notifyTransitionFromThisStructure):
6454         (JSC::JSCell::setStructure):
6455         * runtime/SymbolTable.cpp:
6456         (JSC::SymbolTableEntry::attemptToWatch):
6457
6458 2012-06-13  Filip Pizlo  <fpizlo@apple.com>
6459
6460         DFG should be able to set watchpoints on global variables
6461         https://bugs.webkit.org/show_bug.cgi?id=88692
6462
6463         Reviewed by Geoffrey Garen.
6464
6465         Rolling back in after fixing Windows build issues, and implementing
6466         branchTest8 for the Qt port's strange assemblers.
6467
6468         This implements global variable constant folding by allowing the optimizing
6469         compiler to set a "watchpoint" on globals that it wishes to constant fold.
6470         If the watchpoint fires, then an OSR exit is forced by overwriting the
6471         machine code that the optimizing compiler generated with a jump.
6472
6473         As such, this patch is adding quite a bit of stuff:
6474
6475         - Jump replacement on those hardware targets supported by the optimizing
6476           JIT. It is now possible to patch in a jump instruction over any recorded
6477           watchpoint label. The jump must be "local" in the sense that it must be
6478           within the range of the largest jump distance supported by a one
6479           instruction jump.
6480
6481         - WatchpointSets and Watchpoints. A Watchpoint is a doubly-linked list node
6482           that records the location where a jump must be inserted and the
6483           destination to which it should jump. Watchpoints can be added to a
6484           WatchpointSet. The WatchpointSet can be fired all at once, which plants
6485           all jumps. WatchpointSet also remembers if it had ever been invalidated,
6486           which allows for monotonicity: we typically don't want to optimize using
6487           watchpoints on something for which watchpoints had previously fired. The
6488           act of notifying a WatchpointSet has a trivial fast path in case no
6489           Watchpoints are registered (one-byte load+branch).
6490
6491         - SpeculativeJIT::speculationWatchpoint(). It's like speculationCheck(),
6492           except that you don't have to emit branches. But, you need to know what
6493           WatchpointSet to add the resulting Watchpoint to. Not everything that
6494           you could write a speculationCheck() for will have a WatchpointSet that
6495           would get notified if the condition you were speculating against became
6496           invalid.
6497
6498         - SymbolTableEntry now has the ability to refer to a WatchpointSet. It can
6499           do so without incurring any space overhead for those entries that don't
6500           have WatchpointSets.
6501
6502         - The bytecode generator infers all global function variables to be
6503           watchable, and makes all stores perform the WatchpointSet's write check,
6504           and marks all loads as being potentially watchable (i.e. you can compile
6505           them to a watchpoint and a constant).
6506
6507         Put together, this allows for fully sleazy inlining of calls to globally
6508         declared functions. The inline prologue will no longer contain the load of
6509         the function, or any checks of the function you're calling. I.e. it's
6510         pretty much like the kind of inlining you would see in Java or C++.
6511         Furthermore, the watchpointing functionality is built to be fairly general,
6512         and should allow setting watchpoints on all sorts of interesting things
6513         in the future.
6514
6515         The sleazy inlining means that we will now sometimes inline in code paths
6516         that have never executed. Previously, to inline we would have either had
6517         to have executed the call (to read the call's inline cache) or have
6518         executed the method check (to read the method check's inline cache). Now,
6519         we might inline when the callee is a watched global variable. This
6520         revealed some humorous bugs. First, constant folding disagreed with CFA
6521         over what kinds of operations can clobber (example: code path A is dead
6522         but stores a String into variable X, all other code paths store 0 into
6523         X, and then you do CompareEq(X, 0) - CFA will say that this is a non-
6524         clobbering constant, but constant folding thought it was clobbering
6525         because it saw the String prediction). Second, inlining would crash if
6526         the inline callee had not been compiled. This patch fixes both bugs,
6527         since otherwise run-javascriptcore-tests would report regressions.
6528
6529         * CMakeLists.txt:
6530         * GNUmakefile.list.am:
6531         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
6532         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6533         * JavaScriptCore.xcodeproj/project.pbxproj:
6534         * Target.pri:
6535         * assembler/ARMv7Assembler.h:
6536         (ARMv7Assembler):
6537         (JSC::ARMv7Assembler::ARMv7Assembler):
6538         (JSC::ARMv7Assembler::labelForWatchpoint):
6539         (JSC::ARMv7Assembler::label):
6540         (JSC::ARMv7Assembler::replaceWithJump):
6541         (JSC::ARMv7Assembler::maxJumpReplacementSize):
6542         * assembler/AbstractMacroAssembler.h:
6543         (JSC):
6544         (AbstractMacroAssembler):
6545         (Label):
6546         (JSC::AbstractMacroAssembler::watchpointLabel):
6547         (JSC::AbstractMacroAssembler::readPointer):
6548         * assembler/AssemblerBuffer.h:
6549         * assembler/MacroAssemblerARM.h:
6550         (JSC::MacroAssemblerARM::branchTest8):
6551         (MacroAssemblerARM):
6552         (JSC::MacroAssemblerARM::replaceWithJump):
6553         (JSC::MacroAssemblerARM::maxJumpReplacementSize):
6554         * assembler/MacroAssemblerARMv7.h:
6555         (JSC::MacroAssemblerARMv7::load8Signed):
6556         (JSC::MacroAssemblerARMv7::load16Signed):
6557         (MacroAssemblerARMv7):
6558         (JSC::MacroAssemblerARMv7::replaceWithJump):
6559         (JSC::MacroAssemblerARMv7::maxJumpReplacementSize):
6560         (JSC::MacroAssemblerARMv7::branchTest8):
6561         (JSC::MacroAssemblerARMv7::jump):
6562         (JSC::MacroAssemblerARMv7::makeBranch):
6563         * assembler/MacroAssemblerMIPS.h:
6564         (JSC::MacroAssemblerMIPS::branchTest8):
6565         (MacroAssemblerMIPS):
6566         (JSC::MacroAssemblerMIPS::replaceWithJump):
6567         (JSC::MacroAssemblerMIPS::maxJumpReplacementSize):
6568         * assembler/MacroAssemblerSH4.h:
6569         (JSC::MacroAssemblerSH4::branchTest8):
6570         (MacroAssemblerSH4):
6571         (JSC::MacroAssemblerSH4::replaceWithJump):
6572         (JSC::MacroAssemblerSH4::maxJumpReplacementSize):
6573         * assembler/MacroAssemblerX86.h:
6574         (MacroAssemblerX86):
6575         (JSC::MacroAssemblerX86::branchTest8):
6576         * assembler/MacroAssemblerX86Common.h:
6577         (JSC::MacroAssemblerX86Common::replaceWithJump):
6578         (MacroAssemblerX86Common):
6579         (JSC::MacroAssemblerX86Common::maxJumpReplacementSize):
6580         * assembler/MacroAssemblerX86_64.h:
6581         (MacroAssemblerX86_64):
6582         (JSC::MacroAssemblerX86_64::branchTest8):
6583         * assembler/X86Assembler.h:
6584         (JSC::X86Assembler::X86Assembler):
6585         (X86Assembler):
6586         (JSC::X86Assembler::cmpb_im):
6587         (JSC::X86Assembler::testb_im):
6588         (JSC::X86Assembler::labelForWatchpoint):
6589         (JSC::X86Assembler::label):
6590         (JSC::X86Assembler::replaceWithJump):
6591         (JSC::X86Assembler::maxJumpReplacementSize):
6592         (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
6593         * bytecode/CodeBlock.cpp:
6594         (JSC):
6595         (JSC::CodeBlock::printGetByIdCacheStatus):
6596         (JSC::CodeBlock::dump):
6597         * bytecode/CodeBlock.h:
6598         (JSC::CodeBlock::appendOSRExit):
6599         (JSC::CodeBlock::appendSpeculationRecovery):
6600         (CodeBlock):
6601         (JSC::CodeBlock::appendWatchpoint):
6602         (JSC::CodeBlock::numberOfWatchpoints):
6603         (JSC::CodeBlock::watchpoint):
6604         (DFGData):
6605         * bytecode/DFGExitProfile.h:
6606         (JSC::DFG::exitKindToString):
6607         (JSC::DFG::exitKindIsCountable):
6608         * bytecode/GetByIdStatus.cpp:
6609         (JSC::GetByIdStatus::computeForChain):
6610         * bytecode/Instruction.h:
6611         (Instruction):
6612         (JSC::Instruction::Instruction):
6613         * bytecode/Opcode.h:
6614         (JSC):
6615         (JSC::padOpcodeName):
6616         * bytecode/Watchpoint.cpp: Added.
6617         (JSC):
6618         (JSC::Watchpoint::~Watchpoint):
6619         (JSC::Watchpoint::correctLabels):
6620         (JSC::Watchpoint::fire):
6621         (JSC::WatchpointSet::WatchpointSet):
6622         (JSC::WatchpointSet::~WatchpointSet):
6623         (JSC::WatchpointSet::add):
6624         (JSC::WatchpointSet::notifyWriteSlow):
6625         (JSC::WatchpointSet::fireAllWatchpoints):
6626         * bytecode/Watchpoint.h: Added.
6627         (JSC):
6628         (Watchpoint):
6629         (JSC::Watchpoint::Watchpoint):
6630         (JSC::Watchpoint::setDestination):
6631         (WatchpointSet):
6632         (JSC::WatchpointSet::isStillValid):
6633         (JSC::WatchpointSet::hasBeenInvalidated):
6634         (JSC::WatchpointSet::startWatching):
6635         (JSC::WatchpointSet::notifyWrite):
6636         (JSC::WatchpointSet::addressOfIsWatched):
6637         * bytecompiler/BytecodeGenerator.cpp:
6638         (JSC::ResolveResult::checkValidity):
6639         (JSC::BytecodeGenerator::addGlobalVar):
6640         (JSC::BytecodeGenerator::BytecodeGenerator):
6641         (JSC::BytecodeGenerator::resolve):
6642         (JSC::BytecodeGenerator::emitResolve):
6643         (JSC::BytecodeGenerator::emitResolveWithBase):
6644         (JSC::BytecodeGenerator::emitResolveWithThis):
6645         (JSC::BytecodeGenerator::emitGetStaticVar):
6646         (JSC::BytecodeGenerator::emitPutStaticVar):
6647         * bytecompiler/BytecodeGenerator.h:
6648         (BytecodeGenerator):
6649         * bytecompiler/NodesCodegen.cpp:
6650         (JSC::FunctionCallResolveNode::emitBytecode):
6651         (JSC::PostfixResolveNode::emitBytecode):
6652         (JSC::PrefixResolveNode::emitBytecode):
6653         (JSC::ReadModifyResolveNode::emitBytecode):
6654         (JSC::AssignResolveNode::emitBytecode):
6655         (JSC::ConstDeclNode::emitCodeSingle):
6656         * dfg/DFGAbstractState.cpp:
6657         (JSC::DFG::AbstractState::execute):
6658         (JSC::DFG::AbstractState::clobberStructures):
6659         * dfg/DFGAbstractState.h:
6660         (AbstractState):
6661         (JSC::DFG::AbstractState::didClobber):
6662         * dfg/DFGByteCodeParser.cpp:
6663         (JSC::DFG::ByteCodeParser::handleInlining):
6664         (JSC::DFG::ByteCodeParser::parseBlock):
6665         * dfg/DFGCCallHelpers.h:
6666         (CCallHelpers):
6667         (JSC::DFG::CCallHelpers::setupArguments):
6668         * dfg/DFGCSEPhase.cpp:
6669         (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
6670         (CSEPhase):
6671         (JSC::DFG::CSEPhase::globalVarStoreElimination):
6672         (JSC::DFG::CSEPhase::performNodeCSE):
6673         * dfg/DFGCapabilities.h:
6674         (JSC::DFG::canCompileOpcode):
6675         * dfg/DFGConstantFoldingPhase.cpp:
6676         (JSC::DFG::ConstantFoldingPhase::run):
6677         * dfg/DFGCorrectableJumpPoint.h:
6678         (JSC::DFG::CorrectableJumpPoint::isSet):
6679         (CorrectableJumpPoint):
6680         * dfg/DFGJITCompiler.cpp:
6681         (JSC::DFG::JITCompiler::linkOSRExits):
6682         (JSC::DFG::JITCompiler::link):
6683         * dfg/DFGNode.h:
6684         (JSC::DFG::Node::hasIdentifierNumberForCheck):
6685         (Node):
6686         (JSC::DFG::Node::identifierNumberForCheck):
6687         (JSC::DFG::Node::hasRegisterPointer):
6688         * dfg/DFGNodeType.h:
6689         (DFG):
6690         * dfg/DFGOSRExit.cpp:
6691         (JSC::DFG::OSRExit::OSRExit):
6692         * dfg/DFGOSRExit.h:
6693         (OSRExit):
6694         * dfg/DFGOperations.cpp:
6695         * dfg/DFGOperations.h:
6696         * dfg/DFGPredictionPropagationPhase.cpp:
6697         (JSC::DFG::PredictionPropagationPhase::propagate):
6698         * dfg/DFGSpeculativeJIT.h:
6699         (JSC::DFG::SpeculativeJIT::callOperation):
6700         (JSC::DFG::SpeculativeJIT::appendCall):
6701         (SpeculativeJIT):
6702         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
6703         * dfg/DFGSpeculativeJIT32_64.cpp:
6704         (JSC::DFG::SpeculativeJIT::compile):
6705         * dfg/DFGSpeculativeJIT64.cpp:
6706         (JSC::DFG::SpeculativeJIT::compile):
6707         * interpreter/Interpreter.cpp:
6708         (JSC::Interpreter::privateExecute):
6709         * jit/JIT.cpp:
6710         (JSC::JIT::privateCompileMainPass):
6711         (JSC::JIT::privateCompileSlowCases):
6712         * jit/JIT.h:
6713         * jit/JITPropertyAccess.cpp:
6714         (JSC::JIT::emit_op_put_global_var_check):
6715         (JSC):
6716         (JSC::JIT::emitSlow_op_put_global_var_check):
6717         * jit/JITPropertyAccess32_64.cpp:
6718         (JSC::JIT::emit_op_put_global_var_check):
6719         (JSC):
6720         (JSC::JIT::emitSlow_op_put_global_var_check):
6721         * jit/JITStubs.cpp:
6722         (JSC::DEFINE_STUB_FUNCTION):
6723         (JSC):
6724         * jit/JITStubs.h:
6725         * llint/LLIntSlowPaths.cpp:
6726         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
6727         (LLInt):
6728         * llint/LLIntSlowPaths.h:
6729         (LLInt):
6730         * llint/LowLevelInterpreter32_64.asm:
6731         * llint/LowLevelInterpreter64.asm:
6732         * runtime/JSObject.cpp:
6733         (JSC::JSObject::removeDirect):
6734         * runtime/JSObject.h:
6735         (JSObject):
6736         * runtime/JSSymbolTableObject.h:
6737         (JSC::symbolTableGet):
6738         (JSC::symbolTablePut):
6739         (JSC::symbolTablePutWithAttributes):
6740         * runtime/SymbolTable.cpp: Added.
6741         (JSC):
6742         (JSC::SymbolTableEntry::copySlow):
6743         (JSC::SymbolTableEntry::freeFatEntrySlow):
6744         (JSC::SymbolTableEntry::couldBeWatched):
6745         (JSC::SymbolTableEntry::attemptToWatch):
6746         (JSC::SymbolTableEntry::addressOfIsWatched):
6747         (JSC::SymbolTableEntry::addWatchpoint):
6748         (JSC::SymbolTableEntry::notifyWriteSlow):
6749         (JSC::SymbolTableEntry::inflateSlow):
6750         * runtime/SymbolTable.h:
6751         (JSC):
6752         (SymbolTableEntry):
6753         (Fast):
6754         (JSC::SymbolTableEntry::Fast::Fast):
6755         (JSC::SymbolTableEntry::Fast::isNull):
6756         (JSC::SymbolTableEntry::Fast::getIndex):
6757         (JSC::SymbolTableEntry::Fast::isReadOnly):
6758         (JSC::SymbolTableEntry::Fast::getAttributes):
6759         (JSC::SymbolTableEntry::Fast::isFat):
6760         (JSC::SymbolTableEntry::SymbolTableEntry):
6761         (JSC::SymbolTableEntry::~SymbolTableEntry):
6762         (JSC::SymbolTableEntry::operator=):
6763         (JSC::SymbolTableEntry::isNull):
6764         (JSC::SymbolTableEntry::getIndex):
6765         (JSC::SymbolTableEntry::getFast):
6766         (JSC::SymbolTableEntry::getAttributes):
6767         (JSC::SymbolTableEntry::isReadOnly):
6768         (JSC::SymbolTableEntry::watchpointSet):
6769         (JSC::SymbolTableEntry::notifyWrite):
6770         (FatEntry):
6771         (JSC::SymbolTableEntry::FatEntry::FatEntry):
6772         (JSC::SymbolTableEntry::isFat):
6773         (JSC::SymbolTableEntry::fatEntry):
6774         (JSC::SymbolTableEntry::inflate):
6775         (JSC::SymbolTableEntry::bits):
6776         (JSC::SymbolTableEntry::freeFatEntry):
6777         (JSC::SymbolTableEntry::pack):
6778         (JSC::SymbolTableEntry::isValidIndex):
6779
6780 2012-06-13  Sheriff Bot  <webkit.review.bot@gmail.com>
6781
6782         Unreviewed, rolling out r120172.
6783         http://trac.webkit.org/changeset/120172
6784         https://bugs.webkit.org/show_bug.cgi?id=88976
6785
6786         The patch causes compilation failures on Gtk, Qt and Apple Win
6787         bots (Requested by zdobersek on #webkit).
6788
6789         * CMakeLists.txt:
6790         * GNUmakefile.list.am:
6791         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
6792         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
6793         * JavaScriptCore.xcodeproj/project.pbxproj:
6794         * Target.pri:
6795         * assembler/ARMv7Assembler.h:
6796         (JSC::ARMv7Assembler::nop):
6797         (JSC::ARMv7Assembler::label):
6798         (JSC::ARMv7Assembler::readPointer):
6799         (ARMv7Assembler):
6800         * assembler/AbstractMacroAssembler.h:
6801         (JSC):
6802         (AbstractMacroAssembler):
6803         (Label):
6804         * assembler/AssemblerBuffer.h:
6805         * assembler/MacroAssemblerARM.h:
6806         * assembler/MacroAssemblerARMv7.h:
6807         (JSC::MacroAssemblerARMv7::nop):
6808         (JSC::MacroAssemblerARMv7::jump):
6809         (JSC::MacroAssemblerARMv7::makeBranch):
6810         * assembler/MacroAssemblerMIPS.h:
6811         * assembler/MacroAssemblerSH4.h:
6812         * assembler/MacroAssemblerX86.h:
6813         (MacroAssemblerX86):
6814         (JSC::MacroAssemblerX86::moveWithPatch):
6815         * assembler/MacroAssemblerX86Common.h:
6816         * assembler/MacroAssemblerX86_64.h:
6817         (JSC::MacroAssemblerX86_64::branchTest8):
6818         * assembler/X86Assembler.h:
6819         (JSC::X86Assembler::cmpb_im):
6820         (JSC::X86Assembler::codeSize):
6821         (JSC::X86Assembler::label):
6822         (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
6823         * bytecode/CodeBlock.cpp:
6824         (JSC::CodeBlock::dump):
6825         * bytecode/CodeBlock.h:
6826         (JSC::CodeBlock::appendOSRExit):
6827         (JSC::CodeBlock::appendSpeculationRecovery):
6828         (DFGData):
6829         * bytecode/DFGExitProfile.h:
6830         (JSC::DFG::exitKindToString):
6831         (JSC::DFG::exitKindIsCountable):
6832         * bytecode/Instruction.h:
6833         * bytecode/Opcode.h:
6834         (JSC):
6835         (JSC::padOpcodeName):
6836         * bytecode/Watchpoint.cpp: Removed.
6837         * bytecode/Watchpoint.h: Removed.
6838         * bytecompiler/BytecodeGenerator.cpp:
6839         (JSC::ResolveResult::checkValidity):
6840         (JSC::BytecodeGenerator::addGlobalVar):
6841         (JSC::BytecodeGenerator::BytecodeGenerator):
6842         (JSC::BytecodeGenerator::resolve):
6843         (JSC::BytecodeGenerator::emitResolve):
6844         (JSC::BytecodeGenerator::emitResolveWithBase):
6845         (JSC::BytecodeGenerator::emitResolveWithThis):
6846         (JSC::BytecodeGenerator::emitGetStaticVar):
6847         (JSC::BytecodeGenerator::emitPutStaticVar):
6848         * bytecompiler/BytecodeGenerator.h:
6849         (BytecodeGenerator):
6850         * bytecompiler/NodesCodegen.cpp:
6851         (JSC::FunctionCallResolveNode::emitBytecode):
6852         (JSC::PostfixResolveNode::emitBytecode):
6853         (JSC::PrefixResolveNode::emitBytecode):
6854         (JSC::ReadModifyResolveNode::emitBytecode):
6855         (JSC::AssignResolveNode::emitBytecode):
6856         (JSC::ConstDeclNode::emitCodeSingle):
6857         * dfg/DFGAbstractState.cpp:
6858         (JSC::DFG::AbstractState::execute):
6859         (JSC::DFG::AbstractState::clobberStructures):
6860         * dfg/DFGAbstractState.h:
6861         (AbstractState):
6862         * dfg/DFGByteCodeParser.cpp:
6863         (JSC::DFG::ByteCodeParser::handleInlining):
6864         (JSC::DFG::ByteCodeParser::parseBlock):
6865         * dfg/DFGCCallHelpers.h:
6866         (JSC::DFG::CCallHelpers::setupArguments):
6867         * dfg/DFGCSEPhase.cpp:
6868         (JSC::DFG::CSEPhase::globalVarStoreElimination):
6869         (JSC::DFG::CSEPhase::performNodeCSE):
6870         * dfg/DFGCapabilities.h:
6871         (JSC::DFG::canCompileOpcode):
6872         * dfg/DFGConstantFoldingPhase.cpp:
6873         (JSC::DFG::ConstantFoldingPhase::run):
6874         * dfg/DFGCorrectableJumpPoint.h:
6875         * dfg/DFGJITCompiler.cpp:
6876         (JSC::DFG::JITCompiler::linkOSRExits):
6877         (JSC::DFG::JITCompiler::link):
6878         * dfg/DFGNode.h:
6879         (JSC::DFG::Node::hasRegisterPointer):
6880         * dfg/DFGNodeType.h:
6881         (DFG):
6882         * dfg/DFGOSRExit.cpp:
6883         (JSC::DFG::OSRExit::OSRExit):
6884         * dfg/DFGOSRExit.h:
6885         (OSRExit):
6886         * dfg/DFGOperations.cpp:
6887         * dfg/DFGOperations.h:
6888         * dfg/DFGPredictionPropagationPhase.cpp:
6889         (JSC::DFG::PredictionPropagationPhase::propagate):
6890         * dfg/DFGSpeculativeJIT.h:
6891         (JSC::DFG::SpeculativeJIT::callOperation):
6892         (JSC::DFG::SpeculativeJIT::appendCallSetResult):
6893         (JSC::DFG::SpeculativeJIT::speculationCheck):
6894         * dfg/DFGSpeculativeJIT32_64.cpp:
6895         (JSC::DFG::SpeculativeJIT::compile):
6896         * dfg/DFGSpeculativeJIT64.cpp:
6897         (JSC::DFG::SpeculativeJIT::compile):
6898         * jit/JIT.cpp:
6899         (JSC::JIT::privateCompileMainPass):
6900         (JSC::JIT::privateCompileSlowCases):
6901         * jit/JIT.h:
6902         * jit/JITPropertyAccess.cpp:
6903         * jit/JITPropertyAccess32_64.cpp:
6904         * jit/JITStubs.cpp:
6905         * jit/JITStubs.h:
6906         * llint/LLIntSlowPaths.cpp:
6907         * llint/LLIntSlowPaths.h:
6908         (LLInt):
6909         * llint/LowLevelInterpreter32_64.asm:
6910         * llint/LowLevelInterpreter64.asm:
6911         * runtime/JSObject.cpp:
6912         (JSC::JSObject::removeDirect):
6913         * runtime/JSObject.h:
6914         (JSObject):
6915         * runtime/JSSymbolTableObject.h:
6916         (JSC::symbolTableGet):
6917         (JSC::symbolTablePut):
6918         (JSC::symbolTablePutWithAttributes):
6919         * runtime/SymbolTable.cpp: Removed.
6920         * runtime/SymbolTable.h:
6921         (JSC):
6922         (JSC::SymbolTableEntry::isNull):
6923         (JSC::SymbolTableEntry::getIndex):
6924         (SymbolTableEntry):
6925         (JSC::SymbolTableEntry::getAttributes):
6926         (JSC::SymbolTableEntry::isReadOnly):
6927         (JSC::SymbolTableEntry::pack):
6928         (JSC::SymbolTableEntry::isValidIndex):
6929
6930 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
6931
6932         DFG should be able to set watchpoints on global variables
6933         https://bugs.webkit.org/show_bug.cgi?id=88692
6934
6935         Reviewed by Geoffrey Garen.
6936
6937         This implements global variable constant folding by allowing the optimizing
6938         compiler to set a "watchpoint" on globals that it wishes to constant fold.
6939         If the watchpoint fires, then an OSR exit is forced by overwriting the
6940         machine code that the optimizing compiler generated with a jump.
6941
6942         As such, this patch is adding quite a bit of stuff:
6943
6944         - Jump replacement on those hardware targets supported by the optimizing
6945           JIT. It is now possible to patch in a jump instruction over any recorded
6946           watchpoint label. The jump must be "local" in the sense that it must be
6947           within the range of the largest jump distance supported by a one
6948           instruction jump.
6949
6950         - WatchpointSets and Watchpoints. A Watchpoint is a doubly-linked list node
6951           that records the location where a jump must be inserted and the
6952           destination to which it should jump. Watchpoints can be added to a
6953           WatchpointSet. The WatchpointSet can be fired all at once, which plants
6954           all jumps. WatchpointSet also remembers if it had ever been invalidated,
6955           which allows for monotonicity: we typically don't want to optimize using
6956           watchpoints on something for which watchpoints had previously fired. The
6957           act of notifying a WatchpointSet has a trivial fast path in case no
6958           Watchpoints are registered (one-byte load+branch).
6959
6960         - SpeculativeJIT::speculationWatchpoint(). It's like speculationCheck(),
6961           except that you don't have to emit branches. But, you need to know what
6962           WatchpointSet to add the resulting Watchpoint to. Not everything that
6963           you could write a speculationCheck() for will have a WatchpointSet that
6964           would get notified if the condition you were speculating against became
6965           invalid.
6966
6967         - SymbolTableEntry now has the ability to refer to a WatchpointSet. It can
6968           do so without incurring any space overhead for those entries that don't
6969           have WatchpointSets.
6970
6971         - The bytecode generator infers all global function variables to be
6972           watchable, and makes all stores perform the WatchpointSet's write check,
6973           and marks all loads as being potentially watchable (i.e. you can compile
6974           them to a watchpoint and a constant).
6975
6976         Put together, this allows for fully sleazy inlining of calls to globally
6977         declared functions. The inline prologue will no longer contain the load of
6978         the function, or any checks of the function you're calling. I.e. it's
6979         pretty much like the kind of inlining you would see in Java or C++.
6980         Furthermore, the watchpointing functionality is built to be fairly general,
6981         and should allow setting watchpoints on all sorts of interesting things
6982         in the future.
6983
6984         The sleazy inlining means that we will now sometimes inline in code paths
6985         that have never executed. Previously, to inline we would have either had
6986         to have executed the call (to read the call's inline cache) or have
6987         executed the method check (to read the method check's inline cache). Now,
6988         we might inline when the callee is a watched global variable. This
6989         revealed some humorous bugs. First, constant folding disagreed with CFA
6990         over what kinds of operations can clobber (example: code path A is dead
6991         but stores a String into variable X, all other code paths store 0 into
6992         X, and then you do CompareEq(X, 0) - CFA will say that this is a non-
6993         clobbering constant, but constant folding thought it was clobbering
6994         because it saw the String prediction). Second, inlining would crash if
6995         the inline callee had not been compiled. This patch fixes both bugs,
6996         since otherwise run-javascriptcore-tests would report regressions.
6997
6998         * CMakeLists.txt:
6999         * GNUmakefile.list.am:
7000         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
7001         * JavaScriptCore.xcodeproj/project.pbxproj:
7002         * Target.pri:
7003         * assembler/ARMv7Assembler.h:
7004         (ARMv7Assembler):
7005         (JSC::ARMv7Assembler::ARMv7Assembler):
7006         (JSC::ARMv7Assembler::labelForWatchpoint):
7007         (JSC::ARMv7Assembler::label):
7008         (JSC::ARMv7Assembler::replaceWithJump):
7009         (JSC::ARMv7Assembler::maxJumpReplacementSize):
7010         * assembler/AbstractMacroAssembler.h:
7011         (JSC):
7012         (AbstractMacroAssembler):
7013         (Label):
7014         (JSC::AbstractMacroAssembler::watchpointLabel):
7015         * assembler/AssemblerBuffer.h:
7016         * assembler/MacroAssemblerARM.h:
7017         (JSC::MacroAssemblerARM::replaceWithJump):
7018         (MacroAssemblerARM):
7019         (JSC::MacroAssemblerARM::maxJumpReplacementSize):
7020         * assembler/MacroAssemblerARMv7.h:
7021         (MacroAssemblerARMv7):
7022         (JSC::MacroAssemblerARMv7::replaceWithJump):
7023         (JSC::MacroAssemblerARMv7::maxJumpReplacementSize):
7024         (JSC::MacroAssemblerARMv7::branchTest8):
7025         (JSC::MacroAssemblerARMv7::jump):
7026         (JSC::MacroAssemblerARMv7::makeBranch):
7027         * assembler/MacroAssemblerMIPS.h:
7028         (JSC::MacroAssemblerMIPS::replaceWithJump):
7029         (MacroAssemblerMIPS):
7030         (JSC::MacroAssemblerMIPS::maxJumpReplacementSize):
7031         * assembler/MacroAssemblerSH4.h:
7032         (JSC::MacroAssemblerSH4::replaceWithJump):
7033         (MacroAssemblerSH4):
7034         (JSC::MacroAssemblerSH4::maxJumpReplacementSize):
7035         * assembler/MacroAssemblerX86.h:
7036         (MacroAssemblerX86):
7037         (JSC::MacroAssemblerX86::branchTest8):
7038         * assembler/MacroAssemblerX86Common.h:
7039         (JSC::MacroAssemblerX86Common::replaceWithJump):
7040         (MacroAssemblerX86Common):
7041         (JSC::MacroAssemblerX86Common::maxJumpReplacementSize):
7042         * assembler/MacroAssemblerX86_64.h:
7043         (MacroAssemblerX86_64):
7044         (JSC::MacroAssemblerX86_64::branchTest8):
7045         * assembler/X86Assembler.h:
7046         (JSC::X86Assembler::X86Assembler):
7047         (X86Assembler):
7048         (JSC::X86Assembler::cmpb_im):
7049         (JSC::X86Assembler::testb_im):
7050         (JSC::X86Assembler::labelForWatchpoint):
7051         (JSC::X86Assembler::label):
7052         (JSC::X86Assembler::replaceWithJump):
7053         (JSC::X86Assembler::maxJumpReplacementSize):
7054         (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
7055         * bytecode/CodeBlock.cpp:
7056         (JSC::CodeBlock::dump):
7057         * bytecode/CodeBlock.h:
7058         (JSC::CodeBlock::appendOSRExit):
7059         (JSC::CodeBlock::appendSpeculationRecovery):
7060         (CodeBlock):
7061         (JSC::CodeBlock::appendWatchpoint):
7062         (JSC::CodeBlock::numberOfWatchpoints):
7063         (JSC::CodeBlock::watchpoint):
7064         (DFGData):
7065         * bytecode/DFGExitProfile.h:
7066         (JSC::DFG::exitKindToString):
7067         (JSC::DFG::exitKindIsCountable):
7068         * bytecode/Instruction.h:
7069         (Instruction):
7070         (JSC::Instruction::Instruction):
7071         * bytecode/Opcode.h:
7072         (JSC):
7073         (JSC::padOpcodeName):
7074         * bytecode/Watchpoint.cpp: Added.
7075         (JSC):
7076         (JSC::Watchpoint::~Watchpoint):
7077         (JSC::Watchpoint::correctLabels):
7078         (JSC::Watchpoint::fire):
7079         (JSC::WatchpointSet::WatchpointSet):
7080         (JSC::WatchpointSet::~WatchpointSet):
7081         (JSC::WatchpointSet::add):
7082         (JSC::WatchpointSet::notifyWriteSlow):
7083         (JSC::WatchpointSet::fireAllWatchpoints):
7084         * bytecode/Watchpoint.h: Added.
7085         (JSC):
7086         (Watchpoint):
7087         (JSC::Watchpoint::Watchpoint):
7088         (JSC::Watchpoint::setDestination):
7089         (WatchpointSet):
7090         (JSC::WatchpointSet::isStillValid):
7091         (JSC::WatchpointSet::hasBeenInvalidated):
7092         (JSC::WatchpointSet::startWatching):
7093         (JSC::WatchpointSet::notifyWrite):
7094         (JSC::WatchpointSet::addressOfIsWatched):
7095         * bytecompiler/BytecodeGenerator.cpp:
7096         (JSC::ResolveResult::checkValidity):
7097         (JSC::BytecodeGenerator::addGlobalVar):
7098         (JSC::BytecodeGenerator::BytecodeGenerator):
7099         (JSC::BytecodeGenerator::resolve):
7100         (JSC::BytecodeGenerator::emitResolve):
7101         (JSC::BytecodeGenerator::emitResolveWithBase):
7102         (JSC::BytecodeGenerator::emitResolveWithThis):
7103         (JSC::BytecodeGenerator::emitGetStaticVar):
7104         (JSC::BytecodeGenerator::emitPutStaticVar):
7105         * bytecompiler/BytecodeGenerator.h:
7106         (BytecodeGenerator):
7107         * bytecompiler/NodesCodegen.cpp:
7108         (JSC::FunctionCallResolveNode::emitBytecode):
7109         (JSC::PostfixResolveNode::emitBytecode):
7110         (JSC::PrefixResolveNode::emitBytecode):
7111         (JSC::ReadModifyResolveNode::emitBytecode):
7112         (JSC::AssignResolveNode::emitBytecode):
7113         (JSC::ConstDeclNode::emitCodeSingle):
7114         * dfg/DFGAbstractState.cpp:
7115         (JSC::DFG::AbstractState::execute):
7116         (JSC::DFG::AbstractState::clobberStructures):
7117         * dfg/DFGAbstractState.h:
7118         (AbstractState):
7119         (JSC::DFG::AbstractState::didClobber):
7120         * dfg/DFGByteCodeParser.cpp:
7121         (JSC::DFG::ByteCodeParser::handleInlining):
7122         (JSC::DFG::ByteCodeParser::parseBlock):
7123         * dfg/DFGCCallHelpers.h:
7124         (CCallHelpers):
7125         (JSC::DFG::CCallHelpers::setupArguments):
7126         * dfg/DFGCSEPhase.cpp:
7127         (JSC::DFG::CSEPhase::globalVarWatchpointElimination):
7128         (CSEPhase):
7129         (JSC::DFG::CSEPhase::globalVarStoreElimination):
7130         (JSC::DFG::CSEPhase::performNodeCSE):
7131         * dfg/DFGCapabilities.h:
7132         (JSC::DFG::canCompileOpcode):
7133         * dfg/DFGConstantFoldingPhase.cpp:
7134         (JSC::DFG::ConstantFoldingPhase::run):
7135         * dfg/DFGCorrectableJumpPoint.h:
7136         (JSC::DFG::CorrectableJumpPoint::isSet):
7137         (CorrectableJumpPoint):
7138         * dfg/DFGJITCompiler.cpp:
7139         (JSC::DFG::JITCompiler::linkOSRExits):
7140         (JSC::DFG::JITCompiler::link):
7141         * dfg/DFGNode.h:
7142         (JSC::DFG::Node::hasIdentifierNumberForCheck):
7143         (Node):
7144         (JSC::DFG::Node::identifierNumberForCheck):
7145         (JSC::DFG::Node::hasRegisterPointer):
7146         * dfg/DFGNodeType.h:
7147         (DFG):
7148         * dfg/DFGOSRExit.cpp:
7149         (JSC::DFG::OSRExit::OSRExit):
7150         * dfg/DFGOSRExit.h:
7151         (OSRExit):
7152         * dfg/DFGOperations.cpp:
7153         * dfg/DFGOperations.h:
7154         * dfg/DFGPredictionPropagationPhase.cpp:
7155         (JSC::DFG::PredictionPropagationPhase::propagate):
7156         * dfg/DFGSpeculativeJIT.h:
7157         (JSC::DFG::SpeculativeJIT::callOperation):
7158         (JSC::DFG::SpeculativeJIT::appendCall):
7159         (SpeculativeJIT):
7160         (JSC::DFG::SpeculativeJIT::speculationWatchpoint):
7161         * dfg/DFGSpeculativeJIT32_64.cpp:
7162         (JSC::DFG::SpeculativeJIT::compile):
7163         * dfg/DFGSpeculativeJIT64.cpp:
7164         (JSC::DFG::SpeculativeJIT::compile):
7165         * jit/JIT.cpp:
7166         (JSC::JIT::privateCompileMainPass):
7167         (JSC::JIT::privateCompileSlowCases):
7168         * jit/JIT.h:
7169         * jit/JITPropertyAccess.cpp:
7170         (JSC::JIT::emit_op_put_global_var_check):
7171         (JSC):
7172         (JSC::JIT::emitSlow_op_put_global_var_check):
7173         * jit/JITPropertyAccess32_64.cpp:
7174         (JSC::JIT::emit_op_put_global_var_check):
7175         (JSC):
7176         (JSC::JIT::emitSlow_op_put_global_var_check):
7177         * jit/JITStubs.cpp:
7178         (JSC::JITThunks::JITThunks):
7179         (JSC::DEFINE_STUB_FUNCTION):
7180         (JSC):
7181         * jit/JITStubs.h:
7182         * llint/LLIntSlowPaths.cpp:
7183         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
7184         (LLInt):
7185         * llint/LLIntSlowPaths.h:
7186         (LLInt):
7187         * llint/LowLevelInterpreter32_64.asm:
7188         * llint/LowLevelInterpreter64.asm:
7189         * runtime/JSObject.cpp:
7190         (JSC::JSObject::removeDirect):
7191         * runtime/JSObject.h:
7192         (JSObject):
7193         * runtime/JSSymbolTableObject.h:
7194         (JSC::symbolTableGet):
7195         (JSC::symbolTablePut):
7196         (JSC::symbolTablePutWithAttributes):
7197         * runtime/SymbolTable.cpp: Added.
7198         (JSC):
7199         (JSC::SymbolTableEntry::copySlow):
7200         (JSC::SymbolTableEntry::freeFatEntrySlow):
7201         (JSC::SymbolTableEntry::couldBeWatched):
7202         (JSC::SymbolTableEntry::attemptToWatch):
7203         (JSC::SymbolTableEntry::addressOfIsWatched):
7204         (JSC::SymbolTableEntry::addWatchpoint):
7205         (JSC::SymbolTableEntry::notifyWriteSlow):
7206         (JSC::SymbolTableEntry::inflateSlow):
7207         * runtime/SymbolTable.h:
7208         (JSC):
7209         (SymbolTableEntry):
7210         (Fast):
7211         (JSC::SymbolTableEntry::Fast::Fast):
7212         (JSC::SymbolTableEntry::Fast::isNull):
7213         (JSC::SymbolTableEntry::Fast::getIndex):
7214         (JSC::SymbolTableEntry::Fast::isReadOnly):
7215         (JSC::SymbolTableEntry::Fast::getAttributes):
7216         (JSC::SymbolTableEntry::Fast::isFat):
7217         (JSC::SymbolTableEntry::SymbolTableEntry):
7218         (JSC::SymbolTableEntry::~SymbolTableEntry):
7219         (JSC::SymbolTableEntry::operator=):
7220         (JSC::SymbolTableEntry::isNull):
7221         (JSC::SymbolTableEntry::getIndex):
7222         (JSC::SymbolTableEntry::getFast):
7223         (JSC::SymbolTableEntry::getAttributes):
7224         (JSC::SymbolTableEntry::isReadOnly):
7225         (JSC::SymbolTableEntry::watchpointSet):
7226         (JSC::SymbolTableEntry::notifyWrite):
7227         (FatEntry):
7228         (JSC::SymbolTableEntry::FatEntry::FatEntry):
7229         (JSC::SymbolTableEntry::isFat):
7230         (JSC::SymbolTableEntry::fatEntry):
7231         (JSC::SymbolTableEntry::inflate):
7232         (JSC::SymbolTableEntry::bits):
7233         (JSC::SymbolTableEntry::freeFatEntry):
7234         (JSC::SymbolTableEntry::pack):
7235         (JSC::SymbolTableEntry::isValidIndex):
7236
7237 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
7238
7239         Unreviewed build fix for ARMv7 debug builds.
7240
7241         * jit/JITStubs.cpp:
7242         (JSC::JITThunks::JITThunks):
7243
7244 2012-06-12  Geoffrey Garen  <ggaren@apple.com>
7245
7246         Build fix for case-sensitive file systems: use the right case.
7247
7248         * heap/ListableHandler.h:
7249
7250 2012-06-11  Geoffrey Garen  <ggaren@apple.com>
7251
7252         GC should be 1.7X faster
7253         https://bugs.webkit.org/show_bug.cgi?id=88840
7254
7255         Reviewed by Oliver Hunt.
7256
7257         I profiled, and removed anything that showed up as a concurrency
7258         bottleneck. Then, I added 3 threads to our max thread count, since we
7259         can scale up to more threads now.
7260
7261         * heap/BlockAllocator.cpp:
7262         (JSC::BlockAllocator::BlockAllocator):
7263         (JSC::BlockAllocator::~BlockAllocator):
7264         (JSC::BlockAllocator::releaseFreeBlocks):
7265         (JSC::BlockAllocator::waitForRelativeTimeWhileHoldingLock):
7266         (JSC::BlockAllocator::waitForRelativeTime):
7267         (JSC::BlockAllocator::blockFreeingThreadMain):
7268         * heap/BlockAllocator.h:
7269         (BlockAllocator):
7270         (JSC::BlockAllocator::allocate):
7271         (JSC::BlockAllocator::deallocate): Use a spin lock for the common case
7272         where we're just popping a linked list. (A pthread mutex would sleep our
7273         thread even if the lock were only contended for a microsecond.)
7274
7275         Scope the lock to avoid holding it while allocating VM, since that's a
7276         slow activity and it doesn't modify any of our data structures.
7277
7278         We still use a pthread mutex to handle our condition variable since we
7279         have to, and it's not a hot path.
7280
7281         * heap/CopiedSpace.cpp:
7282         (JSC::CopiedSpace::CopiedSpace):
7283         (JSC::CopiedSpace::doneFillingBlock):
7284         * heap/CopiedSpace.h:
7285         (JSC::CopiedSpace::CopiedSpace): Use a spin lock for the to space lock,
7286         since it just guards linked list and hash table manipulation.
7287
7288         * heap/MarkStack.cpp:
7289         (JSC::MarkStackSegmentAllocator::MarkStackSegmentAllocator):
7290         (JSC::MarkStackSegmentAllocator::allocate):
7291         (JSC::MarkStackSegmentAllocator::release):
7292         (JSC::MarkStackSegmentAllocator::shrinkReserve): Use a spin lock, since
7293         we're just managing a linked list.
7294
7295         (JSC::MarkStackArray::donateSomeCellsTo): Changed donation to be proportional
7296         to our current stack size. This fixes cases where we used to donate too
7297         much. Interestingly, donating too much was starving the donor (when it
7298         ran out of work later) *and* the recipient (since it had to wait on a
7299         long donation operation to complete before it could acquire the lock).
7300
7301         In the worst case, we're still guaranteed to donate N cells in roughly log N time.
7302
7303         This change also fixes cases where we used to donate too little, since
7304         we would always keep a fixed minimum number of cells. In the worst case,
7305         with N marking threads, would could have N large object graph roots in
7306         our stack for the duration of GC, and scale to only 1 thread.
7307
7308         It's an interesting observation that a single object in the mark stack
7309         might represent an arbitrarily large object graph -- and only the act
7310         of marking can find out.
7311
7312         (JSC::MarkStackArray::stealSomeCellsFrom): Steal in proportion to idle
7313         threads. Once again, this fixes cases where constants could cause us
7314         to steal too much or too little.
7315
7316         (JSC::SlotVisitor::donateKnownParallel): Always wake up other threads
7317         if they're idle. We can afford to do this because we're conservative
7318         about when we donate.
7319
7320         (JSC::SlotVisitor::drainFromShared):
7321         * heap/MarkStack.h:
7322         (MarkStackSegmentAllocator):
7323         (MarkStackArray):
7324         (JSC):
7325         * heap/SlotVisitor.h: Merged the "should I donate?" decision into a
7326         single function, for simplicity.
7327
7328         * runtime/Options.cpp:
7329         (minimumNumberOfScansBetweenRebalance): Reduced the delay before donation
7330         a lot. We can afford to do this because, in the common case, donation is
7331         a single branch that decides not to donate.
7332
7333         (cpusToUse): Use more CPUs now, since we scale better now.
7334
7335         * runtime/Options.h:
7336         (Options): Removed now-unused variables.
7337
7338 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
7339
7340         REGRESSION(120121): inspector tests crash in DFG
7341         https://bugs.webkit.org/show_bug.cgi?id=88941
7342
7343         Reviewed by Geoffrey Garen.
7344
7345         The CFG simplifier has two different ways of fixing up GetLocal, Phantom, and Flush. If we've
7346         already fixed up the node one way, we shouldn't try the other way. The reason why we shouldn't
7347         is that the second way depends on the node referring to other nodes in the to-be-jettisoned
7348         block. After fixup they potentially will refer to nodes in the block being merged to.
7349
7350         * dfg/DFGCFGSimplificationPhase.cpp:
7351         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
7352         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
7353
7354 2012-06-12  Leo Yang  <leo.yang@torchmobile.com.cn>
7355
7356         Dynamic hash table in DOMObjectHashTableMap is wrong in multiple threads
7357         https://bugs.webkit.org/show_bug.cgi?id=87334
7358
7359         Reviewed by Geoffrey Garen.
7360
7361         Add a copy member function to JSC::HasTable. This function will copy all data
7362         members except for *table* which contains thread specific data that prevents
7363         up copying it. When you want to copy a JSC::HashTable that was constructed
7364         on another thread you should call JSC::HashTable::copy().
7365
7366         * runtime/Lookup.h:
7367         (JSC::HashTable::copy):
7368         (HashTable):
7369
7370 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
7371
7372         DFG should not ASSERT if you have a double use of a variable that is not revealed to be a double
7373         until after CFG simplification
7374         https://bugs.webkit.org/show_bug.cgi?id=88927
7375         <rdar://problem/11513971>
7376
7377         Reviewed by Geoffrey Garen.
7378
7379         Speculation fixup needs to run if simplification did things, because simplification can change
7380         predictions - particularly if you had a control flow path that stored weird things into a
7381         variable, but that path got axed by the simplifier.
7382
7383         Running fixup in the fixpoint requires making it idempotent, which it previously wasn't. Only
7384         one place needed to be changed, namely the un-MustGenerate-ion of ValueToInt32.
7385
7386         * dfg/DFGDriver.cpp:
7387         (JSC::DFG::compile):
7388         * dfg/DFGFixupPhase.cpp:
7389         (JSC::DFG::FixupPhase::fixupNode):
7390
7391 2012-06-12  Filip Pizlo  <fpizlo@apple.com>
7392
7393         REGRESSION (r119779): Javascript TypeError: 'undefined' is not an object
7394         https://bugs.webkit.org/show_bug.cgi?id=88783
7395         <rdar://problem/11640299>
7396
7397         Reviewed by Geoffrey Garen.
7398
7399         If you don't keep alive the base of an object access over the various checks
7400         you do for the prototype chain, you're going to have a bad time.
7401
7402         * dfg/DFGByteCodeParser.cpp:
7403         (JSC::DFG::ByteCodeParser::handleGetById):
7404
7405 2012-06-12  Hojong Han  <hojong.han@samsung.com>
7406
7407         Property names of the built-in object cannot be retrieved
7408         after trying to delete one of its properties
7409         https://bugs.webkit.org/show_bug.cgi?id=86461
7410
7411         Reviewed by Gavin Barraclough.
7412
7413         * runtime/JSObject.cpp:
7414         (JSC::getClassPropertyNames):
7415         (JSC::JSObject::getOwnPropertyNames):
7416
7417 2012-06-11  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
7418
7419         [CMAKE][EFL] Remove duplicated executable output path
7420         https://bugs.webkit.org/show_bug.cgi?id=88765
7421
7422         Reviewed by Daniel Bates.
7423
7424         CMake files for EFL port have redefined executable output path. However, EFL port doesn't
7425         need to define again because it is already defined in top-level CMake file.
7426
7427         * shell/CMakeLists.txt:
7428
7429 2012-06-11  Carlos Garcia Campos  <cgarcia@igalia.com>
7430
7431         Unreviewed. Fix make distcheck issues.
7432
7433         * GNUmakefile.list.am: Remove non existent header file.
7434
7435 2012-06-10  Patrick Gansterer  <paroga@webkit.org>
7436
7437         Unreviewed. Build fix for !ENABLE(JIT) after r119844 and r119925.
7438
7439         * runtime/Executable.h:
7440         (ExecutableBase):
7441         (JSC::ExecutableBase::clearCodeVirtual):
7442
7443 2012-06-10  Patrick Gansterer  <paroga@webkit.org>
7444
7445         Unreviewed. Build fix for !ENABLE(JIT) after r119844.
7446
7447         * runtime/Executable.h:
7448         (ExecutableBase):
7449         (JSC):
7450
7451 2012-06-09  Dominic Cooney  <dominicc@chromium.org>
7452
7453         [Chromium] Remove JavaScriptCore dependencies from gyp
7454         https://bugs.webkit.org/show_bug.cgi?id=88510
7455
7456         Reviewed by Adam Barth.
7457
7458         Chromium doesn't support JSC any more and there doesn't seem to be
7459         a strong interest in using GYP as the common build system in other
7460         ports.
7461
7462         * JavaScriptCore.gyp/JavaScriptCore.gyp: WebCore still depends on YARR interpreter.
7463         * JavaScriptCore.gypi: Only include YARR source.
7464         * gyp/JavaScriptCore.gyp: Removed.
7465         * gyp/gtk.gyp: Removed.
7466
7467 2012-06-09  Geoffrey Garen  <ggaren@apple.com>
7468
7469         Unreviewed, rolling back in part2 of r118646.
7470
7471         This patch removes eager finalization.
7472
7473         Weak pointer finalization should be lazy
7474         https://bugs.webkit.org/show_bug.cgi?id=87599
7475
7476         Reviewed by Sam Weinig.
7477
7478         * heap/Heap.cpp:
7479         (JSC::Heap::collect): Don't finalize eagerly -- we'll do it lazily.
7480
7481         * heap/MarkedBlock.cpp:
7482         (JSC::MarkedBlock::sweep): Do sweep weak sets when sweeping a block,
7483         since we won't get another chance.
7484
7485         * heap/MarkedBlock.h:
7486         (JSC::MarkedBlock::sweepWeakSet):
7487         * heap/MarkedSpace.cpp:
7488         (MarkedSpace::WeakSetSweep):
7489         * heap/MarkedSpace.h:
7490         (JSC::MarkedSpace::sweepWeakSets): Removed now-unused code.
7491
7492 2012-06-09  Sukolsak Sakshuwong  <sukolsak@google.com>
7493
7494         Add UNDO_MANAGER flag
7495         https://bugs.webkit.org/show_bug.cgi?id=87908
7496
7497         Reviewed by Tony Chang.
7498
7499         * Configurations/FeatureDefines.xcconfig:
7500
7501 2012-06-08  Geoffrey Garen  <ggaren@apple.com>
7502
7503         Unreviewed, rolling back in part1 of r118646.
7504
7505         This patch includes everything necessary for lazy finalization, but
7506         keeps eager finalization enabled for the time being.
7507
7508         Weak pointer finalization should be lazy
7509         https://bugs.webkit.org/show_bug.cgi?id=87599
7510
7511         Reviewed by Sam Weinig.
7512
7513         * heap/MarkedBlock.cpp:
7514         * heap/MarkedBlock.h:
7515         (JSC::MarkedBlock::resetAllocator):
7516         * heap/MarkedSpace.cpp:
7517         (JSC::MarkedSpace::resetAllocators):
7518         * heap/MarkedSpace.h:
7519         (JSC::MarkedSpace::resetAllocators): Don't force allocator reset anymore.
7520         It will happen automatically when a weak set is swept. It's simpler to
7521         have only one canonical way for this to happen, and it wasn't buying
7522         us anything to do it eagerly.
7523         * heap/WeakBlock.cpp:
7524         (JSC::WeakBlock::sweep): Don't short-circuit a sweep unless we know
7525         the sweep would be a no-op. If even one finalizer is pending, we need to
7526         run it, since we won't get another chance.
7527         * heap/WeakSet.cpp:
7528         (JSC::WeakSet::sweep): This loop can be simpler now that
7529         WeakBlock::sweep() does what we mean.
7530         Reset our allocator after a sweep because this is the optimal time to
7531         start trying to recycle old weak pointers.
7532         (JSC::WeakSet::tryFindAllocator): Don't sweep when searching for an
7533         allocator because we've swept already, and forcing a new sweep would be
7534         wasteful.
7535         * heap/WeakSet.h:
7536         (JSC::WeakSet::shrink): Be sure to reset our allocator after a shrink
7537         because the shrink may have removed the block the allocator was going to
7538         allocate out of.
7539
7540 2012-06-08  Gavin Barraclough  <barraclough@apple.com>
7541
7542         Unreviewed roll out r119795.
7543
7544         This broke jquery/core.html
7545
7546         * dfg/DFGSpeculativeJIT.h:
7547         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
7548         * jit/JITInlineMethods.h:
7549         (JSC::JIT::emitAllocateBasicJSObject):
7550         * llint/LowLevelInterpreter.asm:
7551         * runtime/JSGlobalData.h:
7552         (JSGlobalData):
7553         * runtime/JSGlobalThis.cpp:
7554         (JSC::JSGlobalThis::setUnwrappedObject):
7555         * runtime/JSObject.cpp:
7556         (JSC::JSObject::visitChildren):
7557         (JSC::JSObject::createInheritorID):
7558         * runtime/JSObject.h:
7559         (JSObject):
7560         (JSC::JSObject::resetInheritorID):
7561         (JSC):
7562         (JSC::JSObject::offsetOfInheritorID):
7563         (JSC::JSObject::inheritorID):
7564
7565 2012-06-08  Filip Pizlo  <fpizlo@apple.com>
7566
7567         PredictedType should be called SpeculatedType
7568         https://bugs.webkit.org/show_bug.cgi?id=88477
7569
7570         Unreviewed, fix a renaming goof from http://trac.webkit.org/changeset/119660.
7571         I accidentally renamed ByteCodeParser::getPrediction to
7572         ByteCodeParser::getSpeculation.  That was not the intent. This changes it
7573         back.
7574
7575         * dfg/DFGByteCodeParser.cpp:
7576         (JSC::DFG::ByteCodeParser::addCall):
7577         (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
7578         (JSC::DFG::ByteCodeParser::getPrediction):
7579         (JSC::DFG::ByteCodeParser::handleCall):
7580         (JSC::DFG::ByteCodeParser::parseBlock):
7581
7582 2012-06-08  Andy Wingo  <wingo@igalia.com>
7583
7584         Explictly mark stubs called by JIT as being internal
7585         https://bugs.webkit.org/show_bug.cgi?id=88552
7586
7587         Reviewed by Filip Pizlo.
7588
7589         * dfg/DFGOSRExitCompiler.h:
7590         * dfg/DFGOperations.cpp:
7591         * dfg/DFGOperations.h:
7592         * jit/HostCallReturnValue.h:
7593         * jit/JITStubs.cpp:
7594         * jit/JITStubs.h:
7595         * jit/ThunkGenerators.cpp:
7596         * llint/LLIntSlowPaths.h: Mark a bunch of stubs as being
7597         WTF_INTERNAL.  Change most calls to SYMBOL_STRING_RELOCATION to
7598         LOCAL_REFERENCE, or GLOBAL_REFERENCE in the case of the wrappers
7599         to truly global symbols.
7600         * offlineasm/asm.rb: Generate LOCAL_REFERENCE instead of
7601         SYMBOL_STRING_RELOCATION.
7602
7603 2012-06-08  Geoffrey Garen  <ggaren@apple.com>
7604
7605         Don't rely on weak pointers for eager CodeBlock finalization
7606         https://bugs.webkit.org/show_bug.cgi?id=88465
7607
7608         Reviewed by Gavin Barraclough.
7609
7610         This is incompatible with lazy weak pointer finalization.
7611
7612         I considered just making CodeBlock finalization lazy-friendly, but it
7613         turns out that the heap is already way up in CodeBlock's business when
7614         it comes to finalization, so I decided to finish the job and move full
7615         responsibility for CodeBlock finalization into the heap.
7616
7617         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Maybe this
7618         will build.
7619
7620         * debugger/Debugger.cpp: Updated for rename.
7621
7622         * heap/Heap.cpp:
7623         (JSC::Heap::deleteAllCompiledCode): Renamed for consistency. Fixed a bug
7624         where we would not delete code for a code block that had been previously
7625         jettisoned. I don't know if this happens in practice -- I mostly did
7626         this to improve consistency with deleteUnmarkedCompiledCode.
7627
7628         (JSC::Heap::deleteUnmarkedCompiledCode): New function, responsible for
7629         eager finalization of unmarked code blocks.
7630
7631         (JSC::Heap::collect): Updated for rename. Updated to call
7632         deleteUnmarkedCompiledCode(), which takes care of jettisoned DFG code
7633         blocks too.
7634
7635         (JSC::Heap::addCompiledCode): Renamed, since this points to all code
7636         now, not just functions.
7637
7638         * heap/Heap.h:
7639         (Heap): Keep track of all user code, not just functions. This is a
7640         negligible additional overhead, since most code is function code.
7641
7642         * runtime/Executable.cpp:
7643         (JSC::*::finalize): Removed these functions, since we don't rely on
7644         weak pointer finalization anymore.
7645
7646         (JSC::FunctionExecutable::FunctionExecutable): Moved linked-list stuff
7647         into base class so all executables can be in the list.
7648
7649         (JSC::EvalExecutable::clearCode):
7650         (JSC::ProgramExecutable::clearCode):
7651         (JSC::FunctionExecutable::clearCode): All we need to do is delete our
7652         CodeBlock -- that will delete all of its internal data structures.
7653
7654         (JSC::FunctionExecutable::clearCodeIfNotCompiling): Factored out a helper
7655         function to improve clarity.
7656
7657         * runtime/Executable.h:
7658         (JSC::ExecutableBase): Moved linked-list stuff
7659         into base class so all executables can be in the list.
7660
7661         (JSC::NativeExecutable::create):
7662         (NativeExecutable):
7663         (ScriptExecutable):
7664         (JSC::ScriptExecutable::finishCreation):
7665         (JSC::EvalExecutable::create):
7666         (EvalExecutable):
7667         (JSC::ProgramExecutable::create):
7668         (ProgramExecutable):
7669         (FunctionExecutable):
7670         (JSC::FunctionExecutable::create): Don't use a finalizer -- the heap
7671         will call us back to destroy our code block.
7672
7673         (JSC::FunctionExecutable::discardCode): Renamed to clearCodeIfNotCompiling()
7674         for clarity.
7675
7676         (JSC::FunctionExecutable::isCompiling): New helper function, for clarity.
7677
7678         (JSC::ScriptExecutable::clearCodeVirtual): New helper function, since
7679         the heap needs to make polymorphic calls to clear code.
7680
7681         * runtime/JSGlobalData.cpp:
7682         (JSC::StackPreservingRecompiler::operator()):
7683         * runtime/JSGlobalObject.cpp:
7684         (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Updated for
7685         renames.
7686
7687 2012-06-07  Filip Pizlo  <fpizlo@apple.com>
7688
7689         DFG should inline prototype chain accesses, and do the right things if the
7690         specific function optimization is available
7691         https://bugs.webkit.org/show_bug.cgi?id=88594
7692
7693         Reviewed by Gavin Barraclough.
7694
7695         Looks like a 3% win on V8.
7696
7697         * bytecode/CodeBlock.h:
7698         (JSC::Structure::prototypeForLookup):
7699         (JSC):
7700         * bytecode/GetByIdStatus.cpp:
7701         (JSC::GetByIdStatus::computeFromLLInt):
7702         (JSC):
7703         (JSC::GetByIdStatus::computeForChain):
7704         (JSC::GetByIdStatus::computeFor):
7705         * bytecode/GetByIdStatus.h:
7706         (JSC::GetByIdStatus::GetByIdStatus):
7707         (JSC::GetByIdStatus::isSimple):
7708         (JSC::GetByIdStatus::chain):
7709         (JSC::GetByIdStatus::specificValue):
7710         (GetByIdStatus):
7711         * bytecode/StructureSet.h:
7712         (StructureSet):
7713         (JSC::StructureSet::singletonStructure):
7714         * bytecode/StructureStubInfo.h:
7715         (JSC::StructureStubInfo::initGetByIdProto):
7716         (JSC::StructureStubInfo::initGetByIdChain):
7717         * dfg/DFGByteCodeParser.cpp:
7718         (JSC::DFG::ByteCodeParser::handleGetById):
7719         * dfg/DFGRepatch.cpp:
7720         (JSC::DFG::tryCacheGetByID):
7721         * jit/JITStubs.cpp:
7722         (JSC::JITThunks::tryCacheGetByID):
7723         * runtime/JSGlobalObject.h:
7724         (JSC::Structure::prototypeForLookup):
7725         (JSC):
7726         * runtime/Structure.h:
7727         (Structure):
7728
7729 2012-06-07  Gavin Barraclough  <barraclough@apple.com>
7730
7731         Remove JSObject::m_inheritorID
7732         https://bugs.webkit.org/show_bug.cgi?id=88378
7733
7734         Reviewed by Geoff Garen.
7735
7736         This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
7737         and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
7738         Instead use a private named value in the object's property storage.
7739
7740         * dfg/DFGSpeculativeJIT.h:
7741         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
7742             - No need m_inheritorID to initialize!
7743         * jit/JITInlineMethods.h:
7744         (JSC::JIT::emitAllocateBasicJSObject):
7745             - No need m_inheritorID to initialize!
7746         * llint/LowLevelInterpreter.asm:
7747             - No need m_inheritorID to initialize!
7748         * runtime/JSGlobalData.h:
7749         (JSGlobalData):
7750             - Added private name 'm_inheritorIDKey'.
7751         * runtime/JSGlobalThis.cpp:
7752         (JSC::JSGlobalThis::setUnwrappedObject):
7753             - resetInheritorID is now passed a JSGlobalData&.
7754         * runtime/JSObject.cpp:
7755         (JSC::JSObject::visitChildren):
7756             - No m_inheritorID to be marked.
7757         (JSC::JSObject::createInheritorID):
7758             - Store the newly created inheritorID in the property map.
7759         * runtime/JSObject.h:
7760         (JSC::JSObject::resetInheritorID):
7761             - Remove the inheritorID from property storage.
7762         (JSC::JSObject::inheritorID):
7763             - Read the inheritorID from property storage.
7764
7765 2012-06-07  Gavin Barraclough  <barraclough@apple.com>
7766
7767         Math.pow on iOS does not support denormal numbers.
7768         https://bugs.webkit.org/show_bug.cgi?id=88592
7769
7770         Reviewed by Filip Pizlo.
7771
7772         Import an implementation from fdlibm, detect cases where it is safe to use the system
7773         implementation & where we should fall back to fdlibm.
7774
7775         * runtime/MathObject.cpp:
7776         (JSC::isDenormal):
7777         (JSC::isEdgeCase):
7778         (JSC::mathPow):
7779             - On iOS, detect cases where denormal support may be required & use fdlibm in these cases.
7780         (JSC::mathProtoFuncPow):
7781             - Changed to use mathPow.
7782         (JSC::fdlibmScalbn):
7783         (JSC::fdlibmPow):
7784             - These functions imported from fdlibm; original style retained to ease future merging.
7785
7786 2012-06-07  Patrick Gansterer  <paroga@webkit.org>
7787
7788         Unreviewed. Build fix for !ENABLE(JIT) after r119441.
7789
7790         * interpreter/Interpreter.cpp:
7791         (JSC::Interpreter::privateExecute):
7792
7793 2012-06-07  Andy Wingo  <wingo@igalia.com>
7794
7795         Unreviewed build fix after r119593.
7796
7797         * llint/LLIntOfflineAsmConfig.h (OFFLINE_ASM_GLOBAL_LABEL): Fix
7798         uses of "name" to be "label", the macro's parameter.  Otherwise we
7799         serialize mentions of the literal symbol "name" into the objcode.
7800         Causes a build error using GNU ld (not gold).
7801
7802 2012-06-06  Ryosuke Niwa  <rniwa@webkit.org>
7803
7804         Chromium build fix attempt. Why do we need to list these files in gyp!?
7805
7806         * JavaScriptCore.gypi:
7807
7808 2012-06-06  Filip Pizlo  <fpizlo@apple.com>
7809
7810         PredictedType should be called SpeculatedType
7811         https://bugs.webkit.org/show_bug.cgi?id=88477
7812
7813         Rubber stamped by Gavin Barraclough.
7814
7815         * CMakeLists.txt:
7816         * GNUmakefile.list.am:
7817         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
7818         * JavaScriptCore.xcodeproj/project.pbxproj:
7819         * Target.pri:
7820         * bytecode/CodeBlock.cpp:
7821         (JSC::CodeBlock::shouldOptimizeNow):
7822         (JSC::CodeBlock::dumpValueProfiles):
7823         * bytecode/CodeBlock.h:
7824         (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset):
7825         * bytecode/LazyOperandValueProfile.cpp:
7826         (JSC::LazyOperandValueProfileParser::prediction):
7827         * bytecode/LazyOperandValueProfile.h:
7828         (LazyOperandValueProfileParser):
7829         * bytecode/PredictedType.cpp: Removed.
7830         * bytecode/PredictedType.h: Removed.
7831         * bytecode/SpeculatedType.cpp: Copied from Source/JavaScriptCore/bytecode/PredictedType.cpp.
7832         (JSC::speculationToString):
7833         (JSC::speculationToAbbreviatedString):
7834         (JSC::speculationFromClassInfo):
7835         (JSC::speculationFromStructure):
7836         (JSC::speculationFromCell):
7837         (JSC::speculationFromValue):
7838         * bytecode/SpeculatedType.h: Copied from Source/JavaScriptCore/bytecode/PredictedType.h.
7839         (JSC):
7840         (JSC::isAnySpeculation):
7841         (JSC::isCellSpeculation):
7842         (JSC::isObjectSpeculation):
7843         (JSC::isFinalObjectSpeculation):
7844         (JSC::isFinalObjectOrOtherSpeculation):
7845         (JSC::isFixedIndexedStorageObjectSpeculation):
7846         (JSC::isStringSpeculation):
7847         (JSC::isArraySpeculation):
7848         (JSC::isFunctionSpeculation):
7849         (JSC::isInt8ArraySpeculation):
7850         (JSC::isInt16ArraySpeculation):
7851         (JSC::isInt32ArraySpeculation):
7852         (JSC::isUint8ArraySpeculation):
7853         (JSC::isUint8ClampedArraySpeculation):
7854         (JSC::isUint16ArraySpeculation):
7855         (JSC::isUint32ArraySpeculation):
7856         (JSC::isFloat32ArraySpeculation):
7857         (JSC::isFloat64ArraySpeculation):
7858         (JSC::isArgumentsSpeculation):
7859         (JSC::isActionableIntMutableArraySpeculation):
7860         (JSC::isActionableFloatMutableArraySpeculation):
7861         (JSC::isActionableTypedMutableArraySpeculation):
7862         (JSC::isActionableMutableArraySpeculation):
7863         (JSC::isActionableArraySpeculation):
7864         (JSC::isArrayOrOtherSpeculation):
7865         (JSC::isMyArgumentsSpeculation):
7866         (JSC::isInt32Speculation):
7867         (JSC::isDoubleRealSpeculation):
7868         (JSC::isDoubleSpeculation):
7869         (JSC::isNumberSpeculation):
7870         (JSC::isBooleanSpeculation):
7871         (JSC::isOtherSpeculation):
7872         (JSC::isEmptySpeculation):
7873         (JSC::mergeSpeculations):
7874         (JSC::mergeSpeculation):
7875         * bytecode/StructureSet.h:
7876         (JSC::StructureSet::speculationFromStructures):
7877         * bytecode/ValueProfile.h:
7878         (JSC::ValueProfileBase::ValueProfileBase):
7879         (JSC::ValueProfileBase::dump):
7880         (JSC::ValueProfileBase::computeUpdatedPrediction):
7881         (ValueProfileBase):
7882         * dfg/DFGAbstractState.cpp:
7883         (JSC::DFG::AbstractState::initialize):
7884         (JSC::DFG::AbstractState::execute):
7885         (JSC::DFG::AbstractState::mergeStateAtTail):
7886         * dfg/DFGAbstractState.h:
7887         (JSC::DFG::AbstractState::speculateInt32Unary):
7888         (JSC::DFG::AbstractState::speculateNumberUnary):
7889         (JSC::DFG::AbstractState::speculateBooleanUnary):
7890         (JSC::DFG::AbstractState::speculateInt32Binary):
7891         (JSC::DFG::AbstractState::speculateNumberBinary):
7892         * dfg/DFGAbstractValue.h:
7893         (JSC::DFG::StructureAbstractValue::filter):
7894         (JSC::DFG::StructureAbstractValue::speculationFromStructures):
7895         (JSC::DFG::AbstractValue::AbstractValue):
7896         (JSC::DFG::AbstractValue::clear):
7897         (JSC::DFG::AbstractValue::isClear):
7898         (JSC::DFG::AbstractValue::makeTop):
7899         (JSC::DFG::AbstractValue::clobberStructures):
7900         (JSC::DFG::AbstractValue::isTop):
7901         (JSC::DFG::AbstractValue::set):
7902         (JSC::DFG::AbstractValue::merge):
7903         (JSC::DFG::AbstractValue::filter):
7904         (JSC::DFG::AbstractValue::validateIgnoringValue):
7905         (JSC::DFG::AbstractValue::validate):
7906         (JSC::DFG::AbstractValue::checkConsistency):
7907         (JSC::DFG::AbstractValue::dump):
7908         (AbstractValue):
7909         * dfg/DFGArgumentPosition.h:
7910         (JSC::DFG::ArgumentPosition::ArgumentPosition):
7911         (JSC::DFG::ArgumentPosition::mergeArgumentAwareness):
7912         (JSC::DFG::ArgumentPosition::prediction):
7913         (ArgumentPosition):
7914         * dfg/DFGArgumentsSimplificationPhase.cpp:
7915         (JSC::DFG::ArgumentsSimplificationPhase::run):
7916         * dfg/DFGByteCodeParser.cpp:
7917         (ByteCodeParser):
7918         (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):
7919         (JSC::DFG::ByteCodeParser::getLocal):
7920         (JSC::DFG::ByteCodeParser::getArgument):
7921         (JSC::DFG::ByteCodeParser::addCall):
7922         (JSC::DFG::ByteCodeParser::getSpeculationWithoutOSRExit):
7923         (JSC::DFG::ByteCodeParser::getSpeculation):
7924         (InlineStackEntry):
7925         (JSC::DFG::ByteCodeParser::handleCall):
7926         (JSC::DFG::ByteCodeParser::handleIntrinsic):
7927         (JSC::DFG::ByteCodeParser::handleGetById):
7928         (JSC::DFG::ByteCodeParser::parseBlock):
7929         (JSC::DFG::ByteCodeParser::fixVariableAccessSpeculations):
7930         (JSC::DFG::ByteCodeParser::parse):
7931         * dfg/DFGCSEPhase.cpp:
7932         (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination):
7933         (JSC::DFG::CSEPhase::performNodeCSE):
7934         * dfg/DFGConstantFoldingPhase.cpp:
7935         (JSC::DFG::ConstantFoldingPhase::run):
7936         * dfg/DFGFixupPhase.cpp:
7937         (JSC::DFG::FixupPhase::fixupNode):
7938         (JSC::DFG::FixupPhase::fixDoubleEdge):
7939         * dfg/DFGGraph.cpp:
7940         (JSC::DFG::Graph::nameOfVariableAccessData):
7941         (JSC::DFG::Graph::dump):
7942         (JSC::DFG::Graph::predictArgumentTypes):
7943         * dfg/DFGGraph.h:
7944         (JSC::DFG::Graph::getJSConstantSpeculation):
7945         (JSC::DFG::Graph::isPredictedNumerical):
7946         (JSC::DFG::Graph::byValIsPure):
7947         * dfg/DFGJITCompiler.h:
7948         (JSC::DFG::JITCompiler::getSpeculation):
7949         * dfg/DFGNode.h:
7950         (JSC::DFG::Node::Node):
7951         (JSC::DFG::Node::getHeapPrediction):
7952         (JSC::DFG::Node::predictHeap):
7953         (JSC::DFG::Node::prediction):
7954         (JSC::DFG::Node::predict):
7955         (JSC::DFG::Node::shouldSpeculateInteger):
7956         (JSC::DFG::Node::shouldSpeculateDouble):
7957         (JSC::DFG::Node::shouldSpeculateNumber):
7958         (JSC::DFG::Node::shouldSpeculateBoolean):
7959         (JSC::DFG::Node::shouldSpeculateFinalObject):
7960         (JSC::DFG::Node::shouldSpeculateFinalObjectOrOther):
7961         (JSC::DFG::Node::shouldSpeculateArray):
7962         (JSC::DFG::Node::shouldSpeculateArguments):
7963         (JSC::DFG::Node::shouldSpeculateInt8Array):
7964         (JSC::DFG::Node::shouldSpeculateInt16Array):
7965         (JSC::DFG::Node::shouldSpeculateInt32Array):
7966         (JSC::DFG::Node::shouldSpeculateUint8Array):
7967         (JSC::DFG::Node::shouldSpeculateUint8ClampedArray):
7968         (JSC::DFG::Node::shouldSpeculateUint16Array):
7969         (JSC::DFG::Node::shouldSpeculateUint32Array):
7970         (JSC::DFG::Node::shouldSpeculateFloat32Array):
7971         (JSC::DFG::Node::shouldSpeculateFloat64Array):
7972         (JSC::DFG::Node::shouldSpeculateArrayOrOther):
7973         (JSC::DFG::Node::shouldSpeculateObject):
7974         (JSC::DFG::Node::shouldSpeculateCell):
7975         (Node):
7976         * dfg/DFGPredictionPropagationPhase.cpp:
7977         (JSC::DFG::PredictionPropagationPhase::setPrediction):
7978         (JSC::DFG::PredictionPropagationPhase::mergePrediction):
7979         (JSC::DFG::PredictionPropagationPhase::propagate):
7980         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
7981         * dfg/DFGSpeculativeJIT.cpp:
7982         (JSC::DFG::SpeculativeJIT::fillStorage):
7983         (JSC::DFG::SpeculativeJIT::writeBarrier):
7984         (JSC::DFG::GPRTemporary::GPRTemporary):
7985         (JSC::DFG::FPRTemporary::FPRTemporary):
7986         (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):
7987         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):
7988         (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
7989         (JSC::DFG::SpeculativeJIT::compile):
7990         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
7991         (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
7992         (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
7993         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
7994         (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):
7995         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
7996         (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLength):
7997         (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
7998         (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
7999         (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
8000         (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
8001         (JSC::DFG::SpeculativeJIT::compileInstanceOf):
8002         (JSC::DFG::SpeculativeJIT::compileAdd):
8003         (JSC::DFG::SpeculativeJIT::compileArithSub):
8004         (JSC::DFG::SpeculativeJIT::compileArithNegate):
8005         (JSC::DFG::SpeculativeJIT::compileArithMul):
8006         (JSC::DFG::SpeculativeJIT::compileArithMod):
8007         (JSC::DFG::SpeculativeJIT::compare):
8008         (JSC::DFG::SpeculativeJIT::compileStrictEq):
8009         (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
8010         (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
8011         (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
8012         (JSC::DFG::SpeculativeJIT::compileRegExpExec):
8013         * dfg/DFGSpeculativeJIT.h:
8014         (DFG):
8015         (JSC::DFG::ValueSource::forSpeculation):
8016         (SpeculativeJIT):
8017         (GPRTemporary):
8018         (FPRTemporary):
8019         (JSC::DFG::SpecDoubleOperand::SpecDoubleOperand):
8020         (JSC::DFG::SpecDoubleOperand::~SpecDoubleOperand):
8021         (JSC::DFG::SpecDoubleOperand::fpr):
8022         (JSC::DFG::SpecCellOperand::SpecCellOperand):
8023         (JSC::DFG::SpecCellOperand::~SpecCellOperand):
8024         (JSC::DFG::SpecCellOperand::gpr):
8025         (JSC::DFG::SpecBooleanOperand::SpecBooleanOperand):
8026         (JSC::DFG::SpecBooleanOperand::~SpecBooleanOperand):
8027         (JSC::DFG::SpecBooleanOperand::gpr):
8028         * dfg/DFGSpeculativeJIT32_64.cpp:
8029         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
8030         (JSC::DFG::SpeculativeJIT::fillSpecDouble):
8031         (JSC::DFG::SpeculativeJIT::fillSpecCell):
8032         (JSC::DFG::SpeculativeJIT::fillSpecBoolean):
8033         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
8034         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
8035         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
8036         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
8037         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
8038         (JSC::DFG::SpeculativeJIT::emitBranch):
8039         (JSC::DFG::SpeculativeJIT::compile):
8040         * dfg/DFGSpeculativeJIT64.cpp:
8041         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
8042         (JSC::DFG::SpeculativeJIT::fillSpecDouble):
8043         (JSC::DFG::SpeculativeJIT::fillSpecCell):
8044         (JSC::DFG::SpeculativeJIT::fillSpecBoolean):
8045         (JSC::DFG::SpeculativeJIT::compileObjectEquality):
8046         (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
8047         (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
8048         (JSC::DFG::SpeculativeJIT::compileDoubleCompare):
8049         (JSC::DFG::SpeculativeJIT::compileLogicalNot):
8050         (JSC::DFG::SpeculativeJIT::emitBranch):
8051         (JSC::DFG::SpeculativeJIT::compile):
8052         * dfg/DFGVariableAccessData.h:
8053         (JSC::DFG::VariableAccessData::VariableAccessData):
8054         (JSC::DFG::VariableAccessData::predict):
8055         (JSC::DFG::VariableAccessData::nonUnifiedPrediction):
8056         (JSC::DFG::VariableAccessData::prediction):
8057         (JSC::DFG::VariableAccessData::argumentAwarePrediction):
8058         (JSC::DFG::VariableAccessData::mergeArgumentAwarePrediction):
8059         (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
8060         (JSC::DFG::VariableAccessData::makePredictionForDoubleFormat):
8061         (VariableAccessData):
8062
8063 2012-06-06  Filip Pizlo  <fpizlo@apple.com>
8064
8065         Global object variable accesses should not require an extra load
8066         https://bugs.webkit.org/show_bug.cgi?id=88385
8067
8068         Reviewed by Gavin Barraclough and Geoffrey Garen.
8069
8070         Previously, if you wanted to access a global variable, you'd first have
8071         to load the register array from the appropriate global object and then
8072         either load or store at an offset to the register array. This is because
8073         JSGlobalObject inherited from JSVariableObject, and JSVariableObject is
8074         designed with the pessimistic assumption that its register array may
8075         point into the call stack. This is never the case for global objects.
8076         Hence, even though the global object may add more registers at any time,
8077         it does not need to store them in a contiguous array. It can use a
8078         SegmentedVector or similar.
8079
8080         This patch refactors global objects and variable objects as follows:
8081
8082         - The functionality to track variables in an indexable array using a
8083           SymbolTable to map names to indices is moved into JSSymbolTableObject,
8084           which is now a supertype of JSVariableObject. JSVariableObject is now
8085           just a holder for a registers array and implements the registerAt()
8086           method that is left abstract in JSSymbolTableObject. Because all users
8087           of JSVariableObject know whether they are a JSStaticScopeObject,
8088           JSActivation, or JSGlobalObject, this "abstract" method is not virtual;
8089           instead the utility methods that would call registerAt() are now
8090           template functions that require you to know statically what subtype of
8091           JSSymbolTableObject you're using (JSVariableObject or something else),
8092           so that registerAt() can be statically bound.
8093
8094         - A new class is added called JSSegmentedVariableObject, which only
8095           differs from JSVariableObject in how it allocates registers. It uses a
8096           SegmentedVector instead of manually managing a pointer to a contiguous
8097           slab of registers. This changes the interface somewhat; for example
8098           with JSVariableObject if you wanted to add a register you had to do
8099           it yourself since the JSVariableObject didn't know how the registers
8100           array ought to be allocated. With JSSegmentedVariableObject you can
8101           just call addRegisters(). JSSegmentedVariableObject preserves the
8102           invariant that once you get a pointer into a register, that pointer
8103           will continue to be valid so long as the JSSegmentedVariableObject is
8104           alive. This allows the JITs and interpreters to skip the extra load.
8105
8106         - JSGlobalObject now inherits from JSSegmentedVariableObject. For now
8107           (and possibly forever) it is the only subtype of this new class.
8108
8109         - The bytecode format is changed so that get_global_var and
8110           put_global_var have a pointer to the register directly rather than
8111           having an index. A convenience method is provided in
8112           JSSegmentedVariableObject to get the index given a a pointer, which is
8113           used for assertions and debug dumps.
8114
8115         This appears to be a 1% across the board win.
8116
8117         * CMakeLists.txt:
8118         * GNUmakefile.list.am:
8119         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
8120         * JavaScriptCore.xcodeproj/project.pbxproj:
8121         * Target.pri:
8122         * bytecode/CodeBlock.cpp:
8123         (JSC::CodeBlock::dump):
8124         * bytecode/Instruction.h:
8125         (Instruction):
8126         (JSC::Instruction::Instruction):
8127         * bytecompiler/BytecodeGenerator.cpp:
8128         (JSC::ResolveResult::registerPointer):
8129         (JSC):
8130         (JSC::BytecodeGenerator::BytecodeGenerator):
8131         (JSC::BytecodeGenerator::retrieveLastUnaryOp):
8132         (JSC::BytecodeGenerator::resolve):
8133         (JSC::BytecodeGenerator::resolveConstDecl):
8134         (JSC::BytecodeGenerator::emitGetStaticVar):
8135         (JSC::BytecodeGenerator::emitPutStaticVar):
8136         * bytecompiler/BytecodeGenerator.h:
8137         (ResolveResult):
8138         (BytecodeGenerator):
8139         * dfg/DFGAssemblyHelpers.h:
8140         (AssemblyHelpers):
8141         * dfg/DFGByteCodeParser.cpp:
8142         (JSC::DFG::ByteCodeParser::parseBlock):
8143         * dfg/DFGCSEPhase.cpp:
8144         (JSC::DFG::CSEPhase::globalVarLoadElimination):
8145         (JSC::DFG::CSEPhase::globalVarStoreElimination):
8146         (JSC::DFG::CSEPhase::performNodeCSE):
8147         * dfg/DFGGraph.cpp:
8148         (JSC::DFG::Graph::dump):
8149         * dfg/DFGGraph.h:
8150         (JSC::DFG::Graph::globalObjectFor):
8151         (Graph):
8152         * dfg/DFGNode.h:
8153         (JSC::DFG::Node::hasVarNumber):
8154         (Node):
8155         (JSC::DFG::Node::hasRegisterPointer):
8156         (JSC::DFG::Node::registerPointer):
8157         * dfg/DFGSpeculativeJIT32_64.cpp:
8158         (JSC::DFG::SpeculativeJIT::compile):
8159         * dfg/DFGSpeculativeJIT64.cpp:
8160         (JSC::DFG::SpeculativeJIT::compile):
8161         * heap/Heap.h:
8162         (Heap):
8163         (JSC::Heap::isWriteBarrierEnabled):
8164         (JSC):
8165         * interpreter/Interpreter.cpp:
8166         (JSC::Interpreter::execute):
8167         (JSC::Interpreter::privateExecute):
8168         * jit/JITPropertyAccess.cpp:
8169         (JSC::JIT::emit_op_get_global_var):
8170         (JSC::JIT::emit_op_put_global_var):
8171         * jit/JITPropertyAccess32_64.cpp:
8172         (JSC::JIT::emit_op_get_global_var):
8173         (JSC::JIT::emit_op_put_global_var):
8174         * llint/LowLevelInterpreter32_64.asm:
8175         * llint/LowLevelInterpreter64.asm:
8176         * runtime/JSGlobalObject.cpp:
8177         (JSC):
8178         (JSC::JSGlobalObject::put):
8179         (JSC::JSGlobalObject::putDirectVirtual):
8180         (JSC::JSGlobalObject::defineOwnProperty):
8181         (JSC::JSGlobalObject::visitChildren):
8182         (JSC::JSGlobalObject::addStaticGlobals):
8183         (JSC::JSGlobalObject::getOwnPropertySlot):
8184         (JSC::JSGlobalObject::getOwnPropertyDescriptor):
8185         * runtime/JSGlobalObject.h:
8186         (JSGlobalObject):
8187         (JSC::JSGlobalObject::JSGlobalObject):
8188         (JSC):
8189         (JSC::JSGlobalObject::hasOwnPropertyForWrite):
8190         * runtime/JSSegmentedVariableObject.cpp: Added.
8191         (JSC):
8192         (JSC::JSSegmentedVariableObject::findRegisterIndex):
8193         (JSC::JSSegmentedVariableObject::addRegisters):
8194         (JSC::JSSegmentedVariableObject::visitChildren):
8195         * runtime/JSSegmentedVariableObject.h: Added.
8196         (JSC):
8197         (JSSegmentedVariableObject):
8198         (JSC::JSSegmentedVariableObject::registerAt):
8199         (JSC::JSSegmentedVariableObject::assertRegisterIsInThisObject):
8200         (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
8201         (JSC::JSSegmentedVariableObject::finishCreation):
8202         * runtime/JSStaticScopeObject.cpp:
8203         (JSC::JSStaticScopeObject::put):
8204         (JSC::JSStaticScopeObject::putDirectVirtual):
8205         (JSC::JSStaticScopeObject::getOwnPropertySlot):
8206         * runtime/JSSymbolTableObject.cpp: Added.
8207         (JSC):
8208         (JSC::JSSymbolTableObject::destroy):
8209         (JSC::JSSymbolTableObject::deleteProperty):
8210         (JSC::JSSymbolTableObject::getOwnPropertyNames):
8211         (JSC::JSSymbolTableObject::putDirectVirtual):
8212         (JSC::JSSymbolTableObject::isDynamicScope):
8213         * runtime/JSSymbolTableObject.h: Added.
8214         (JSC):
8215         (JSSymbolTableObject):
8216         (JSC::JSSymbolTableObject::symbolTable):
8217         (JSC::JSSymbolTableObject::JSSymbolTableObject):
8218         (JSC::JSSymbolTableObject::finishCreation):
8219         (JSC::symbolTableGet):
8220         (JSC::symbolTablePut):
8221         (JSC::symbolTablePutWithAttributes):
8222         * runtime/JSVariableObject.cpp:
8223         (JSC):
8224         * runtime/JSVariableObject.h:
8225         (JSVariableObject):
8226         (JSC::JSVariableObject::JSVariableObject):
8227         (JSC::JSVariableObject::finishCreation):
8228         (JSC):
8229         * runtime/WriteBarrier.h:
8230
8231 2012-06-06  Filip Pizlo  <fpizlo@apple.com>
8232
8233         DFG arguments access slow path should not crash if the arguments haven't been created
8234         https://bugs.webkit.org/show_bug.cgi?id=88471
8235
8236         Reviewed by Gavin Barraclough.
8237
8238         * dfg/DFGCCallHelpers.h:
8239         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
8240         (CCallHelpers):
8241         * dfg/DFGOperations.cpp:
8242         * dfg/DFGOperations.h:
8243         * dfg/DFGSpeculativeJIT.h:
8244         (JSC::DFG::SpeculativeJIT::callOperation):
8245         * dfg/DFGSpeculativeJIT32_64.cpp:
8246         (JSC::DFG::SpeculativeJIT::compile):
8247         * dfg/DFGSpeculativeJIT64.cpp:
8248         (JSC::DFG::SpeculativeJIT::compile):
8249
8250 2012-06-06  Michael Saboff  <msaboff@apple.com>
8251
8252         ENH: Add Logging to GC Marking Phase
8253         https://bugs.webkit.org/show_bug.cgi?id=88364
8254
8255         Reviewed by Filip Pizlo.
8256
8257         Log GC marking to stderr or a file.  The logging in controlled
8258         with the define ENABLE_OBJECT_MARK_LOGGING in wtf/Platform.h.
8259         If DATA_LOG_TO_FILE in wtf/DataLog.cpp is set to 1, output is
8260         logged to a file otherwise it is logged to stderr.
8261
8262         When logging is enabled, the GC is built single threaded since the
8263         log output from the various threads isn't buffered and output in a
8264         thread safe manner.
8265
8266         * heap/Heap.cpp:
8267         (JSC::Heap::markRoots):
8268         * heap/MarkStack.cpp:
8269         (JSC::MarkStackThreadSharedData::resetChildren):
8270         (JSC::MarkStackThreadSharedData::childVisitCount):
8271         (JSC::MarkStackThreadSharedData::markingThreadMain):
8272         (JSC::MarkStackThreadSharedData::markingThreadStartFunc):
8273         (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
8274         (JSC::MarkStackThreadSharedData::reset):
8275         * heap/MarkStack.h:
8276         (MarkStackThreadSharedData):
8277         (MarkStack):
8278         (JSC::MarkStack::sharedData):
8279         (JSC::MarkStack::resetChildCount):
8280         (JSC::MarkStack::childCount):
8281         (JSC::MarkStack::incrementChildCount):
8282         * runtime/JSArray.cpp:
8283         (JSC::JSArray::visitChildren):
8284         * runtime/JSCell.cpp:
8285         (JSC::JSCell::className):
8286         * runtime/JSCell.h:
8287         (JSCell):
8288         (JSC::JSCell::visitChildren):
8289         * runtime/JSString.cpp:
8290         (JSC::JSString::visitChildren):
8291         * runtime/JSString.h:
8292         (JSString):
8293         * runtime/Structure.h:
8294         (JSC::MarkStack::internalAppend):
8295
8296 2012-06-06  Gavin Barraclough  <barraclough@apple.com>
8297
8298         Assigning to a static property should not change iteration order
8299         https://bugs.webkit.org/show_bug.cgi?id=88401
8300
8301         Reviewed by Geoff Garen.
8302
8303         A specific iteration order is not defined by the spec, but test-262 somewhat tenuously
8304         requires that it is at least stable, e.g. ch10/10.4/10.4.2/S10.4.2_A1.1_T1.js
8305
8306         Whilst it is not clear that this behavior really arises from the specification, it
8307         would seem like common sense to conform to this.
8308
8309         The problem here is that we allow properties in the structure to shadow those in the
8310         static table, and we iterate the properties in the structure first - which means that
8311         as values of existing properties are modified, their iteration order changes too.
8312
8313         The easy fix is to iterate the properties from the static table first. This has a
8314         further benefit, since it will mean that user added properties will come after those
8315         present in the static table (respected the expected insertion-order).
8316
8317         * runtime/JSObject.cpp:
8318         (JSC::JSObject::getOwnPropertyNames):
8319             - Iterate static properties first.
8320
8321 2012-06-06  Andy Wingo  <wingo@igalia.com>
8322
8323         Ensure consistent order of evaluation in LLInt slow paths
8324         https://bugs.webkit.org/show_bug.cgi?id=88409
8325
8326         Reviewed by Geoffrey Garen.
8327
8328         * llint/LLIntSlowPaths.cpp:
8329         (slow_path_mul)
8330         (slow_path_sub)
8331         (slow_path_div)
8332         (slow_path_mod)
8333         (slow_path_lshift)
8334         (slow_path_rshift)
8335         (slow_path_urshift)
8336         (slow_path_bitand)
8337         (slow_path_bitor)
8338         (slow_path_bitxor): Avoid calling toNumber, toInt32, or toUInt32
8339         multiple times without intervening sequence points.  Fixes
8340         fast/js/exception-sequencing-binops.html with GCC 4.7 on x86-64
8341         Linux, which reordered evaluation of the arguments to fmod.
8342
8343 2012-06-06  Andy Wingo  <wingo@igalia.com>
8344
8345         [GTK] Enable the LLInt
8346         https://bugs.webkit.org/show_bug.cgi?id=88315
8347
8348         Reviewed by Filip Pizlo.
8349
8350         * GNUmakefile.am: Add rules to generate LLIntDesiredOffsets.h and
8351         LLIntAssembly.h.
8352         * GNUmakefile.list.am: Add offlineasm and llint files to the
8353         dist.  Add LLInt source files to the build.
8354         * llint/LowLevelInterpreter.asm (crash): Generate a store of
8355         0xbbadbeef to a register, not to a constant.  Otherwise, gas was
8356         failing to assemble result.
8357         * offlineasm/asm.rb (labelReference): Generate a
8358         SYMBOL_STRING_RELOCATION instead of a SYMBOL_STRING, so that we go
8359         through the PLT on ELF systems.
8360
8361 2012-06-06  Andy Wingo  <wingo@igalia.com>
8362
8363         REGRESSION (r106478): None of the Paper.js JavaScript examples work
8364         https://bugs.webkit.org/show_bug.cgi?id=87158
8365
8366         Reviewed by Michael Saboff.
8367
8368         * bytecompiler/BytecodeGenerator.cpp:
8369         (JSC::BytecodeGenerator::resolve): If we have to bail out to
8370         dynamicResolve(), only skip static scopes from the head of the
8371         scope chain.  Before, we were also skipping activations with
8372         direct eval as well, which was incorrect.
8373
8374 2012-06-06  Dan Bernstein  <mitz@apple.com>
8375
8376         Reverted r119567, the fix for <http://webkit.org/b/88378>, because it broke the 32-bit build.
8377
8378         * dfg/DFGSpeculativeJIT.h:
8379         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
8380         * jit/JITInlineMethods.h:
8381         (JSC::JIT::emitAllocateBasicJSObject):
8382         * llint/LowLevelInterpreter.asm:
8383         * runtime/JSGlobalData.h:
8384         (JSGlobalData):
8385         * runtime/JSGlobalThis.cpp:
8386         (JSC::JSGlobalThis::setUnwrappedObject):
8387         * runtime/JSObject.cpp:
8388         (JSC::JSObject::visitChildren):
8389         (JSC::JSObject::createInheritorID):
8390         * runtime/JSObject.h:
8391         (JSObject):
8392         (JSC::JSObject::resetInheritorID):
8393         (JSC):
8394         (JSC::JSObject::offsetOfInheritorID):
8395         (JSC::JSObject::inheritorID):
8396
8397 2012-06-05  Yuqiang Xian  <yuqiang.xian@intel.com>
8398
8399         Improve Math.round and Math.floor intrinsic
8400         https://bugs.webkit.org/show_bug.cgi?id=88314
8401
8402         Reviewed by Filip Pizlo.
8403
8404         Currently we call a native function from the JIT code to complete the
8405         "round" and "floor" operations. We could inline some fast paths
8406         especially for those positive values on the platforms where floating
8407         point truncation is supported.
8408         This brings 3% gain on Kraken, especially 32% on audio-oscillator,
8409         and slight win on SunSpider, measured on IA32.
8410
8411         * jit/ThunkGenerators.cpp:
8412         (JSC::floorThunkGenerator):
8413         (JSC):
8414         (JSC::roundThunkGenerator):
8415
8416 2012-06-05  Gavin Barraclough  <barraclough@apple.com>
8417
8418         Remove JSObject::m_inheritorID
8419         https://bugs.webkit.org/show_bug.cgi?id=88378
8420
8421         Reviewed by Geoff Garen.
8422
8423         This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction),
8424         and most objects don't need an inheritorID (this value is only used if the object is used as a prototype).
8425         Instead use a private named value in the object's property storage.
8426
8427         * dfg/DFGSpeculativeJIT.h:
8428         (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
8429             - No need m_inheritorID to initialize!
8430         * jit/JITInlineMethods.h:
8431         (JSC::JIT::emitAllocateBasicJSObject):
8432             - No need m_inheritorID to initialize!
8433         * llint/LowLevelInterpreter.asm:
8434             - No need m_inheritorID to initialize!
8435         * runtime/JSGlobalData.h:
8436         (JSGlobalData):
8437             - Added private name 'm_inheritorIDKey'.
8438         * runtime/JSGlobalThis.cpp:
8439         (JSC::JSGlobalThis::setUnwrappedObject):
8440             - resetInheritorID is now passed a JSGlobalData&.
8441         * runtime/JSObject.cpp:
8442         (JSC::JSObject::visitChildren):
8443             - No m_inheritorID to be marked.
8444         (JSC::JSObject::createInheritorID):
8445             - Store the newly created inheritorID in the property map.
8446         * runtime/JSObject.h:
8447         (JSC::JSObject::resetInheritorID):
8448             - Remove the inheritorID from property storage.
8449         (JSC::JSObject::inheritorID):
8450             - Read the inheritorID from property storage.
8451
8452 2012-06-05  Filip Pizlo  <fpizlo@apple.com>
8453
8454         DFG CFG simplification should not attempt to deref nodes inside of an unreachable subgraph
8455         https://bugs.webkit.org/show_bug.cgi?id=88362
8456
8457         Reviewed by Gavin Barraclough.
8458
8459         * dfg/DFGCFGSimplificationPhase.cpp:
8460         (JSC::DFG::CFGSimplificationPhase::fixPhis):
8461         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
8462
8463 2012-06-05  Mark Hahnenberg  <mhahnenberg@apple.com>
8464
8465         Entry into JSC should CRASH() if the Heap is busy
8466         https://bugs.webkit.org/show_bug.cgi?id=88355
8467
8468         Reviewed by Geoffrey Garen.
8469
8470         Interpreter::execute() returns jsNull() right now if we try to enter it while
8471         the Heap is busy (e.g. with a collection), which is okay, but some code paths
8472         that call Interpreter::execute() allocate objects before checking if the Heap
8473         is busy. Attempting to execute JS code while the Heap is busy should not be
8474         allowed and should be enforced by a release-mode CRASH() to prevent vague,
8475         unhelpful backtraces later on if somebody makes a mistake. Normally, recursively
8476         executing JS code is okay, e.g. for evals, but it should not occur during a
8477         Heap allocation or collection because the Heap is not guaranteed to be in a
8478         consistent state (especially during collections). We are protected from
8479         executing JS on the same Heap concurrently on two separate threads because
8480         they must each take a JSLock first. However, we are not protected from reentrant
8481         execution of JS on the same thread because JSLock allows reentrancy. Therefore,
8482         we should fail early if we detect an entrance into JS code while the Heap is busy.
8483
8484         * heap/Heap.cpp: Changed Heap::collect so that it sets the m_operationInProgress field
8485         at the beginning of collection and then unsets it at the end so that it is set at all
8486         times throughout the duration of a collection rather than sporadically during various
8487         phases. There is no reason to unset during a collection because our collector does
8488         not currently support running additional JS between the phases of a collection.
8489         (JSC::Heap::getConservativeRegisterRoots):
8490         (JSC::Heap::markRoots):
8491         (JSC::Heap::collect):
8492         * interpreter/Interpreter.cpp:
8493         (JSC::Interpreter::execute): Crash if the Heap is busy.
8494         * runtime/Completion.cpp: Crash if the Heap is busy. We do it here before we call
8495         Interpreter::execute() because we do some allocation prior to calling execute() which
8496         could cause Heap corruption if, for example, that allocation caused a collection.
8497         (JSC::evaluate):
8498
8499 2012-06-05  Dongwoo Im  <dw.im@samsung.com>
8500
8501         Add 'isProtocolHandlerRegistered' and 'unregisterProtocolHandler'.
8502         https://bugs.webkit.org/show_bug.cgi?id=73176
8503
8504         Reviewed by Adam Barth.
8505
8506         Two more APIs are added in Custom Scheme Handler specification.
8507         http://dev.w3.org/html5/spec/Overview.html#custom-handlers
8508         One is 'isProtocolHandlerRegistered' to query whether the specific URL
8509         is registered or not.
8510         The other is 'unregisterProtocolHandler' to remove the registered URL.
8511
8512         * Configurations/FeatureDefines.xcconfig: Add a macro 'ENABLE_CUSTOM_SCHEME_HANDLER'.
8513
8514 2012-06-04  Filip Pizlo  <fpizlo@apple.com>
8515
8516         DFG CFG simplification should correct the variables at the head of the predecessor block
8517         https://bugs.webkit.org/show_bug.cgi?id=88284
8518
8519         Reviewed by Geoffrey Garen.
8520
8521         * dfg/DFGCFGSimplificationPhase.cpp:
8522         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
8523
8524 2012-06-04  Geoffrey Garen  <ggaren@apple.com>
8525
8526         Unreviewed.
8527
8528         Rolled out r119364 because it's still causing crashes (when running
8529         v8-earley in release builds of DRT)
8530
8531         This time for sure!
8532
8533         * heap/Heap.cpp:
8534         (JSC::Heap::collect):
8535         * heap/MarkedBlock.cpp:
8536         (JSC::MarkedBlock::sweep):
8537         * heap/MarkedBlock.h:
8538         (JSC::MarkedBlock::resetAllocator):
8539         (JSC):
8540         * heap/MarkedSpace.cpp:
8541         (JSC::ResetAllocator::operator()):
8542         (JSC):
8543         (JSC::MarkedSpace::resetAllocators):
8544         (JSC::MarkedSpace::sweepWeakSets):
8545         * heap/MarkedSpace.h:
8546         (MarkedSpace):
8547         * heap/WeakBlock.cpp:
8548         (JSC::WeakBlock::sweep):
8549         * heap/WeakSet.cpp:
8550         (JSC::WeakSet::sweep):
8551         (JSC::WeakSet::tryFindAllocator):
8552         * heap/WeakSet.h:
8553         (JSC::WeakSet::shrink):
8554
8555 2012-06-04  Filip Pizlo  <fpizlo@apple.com>
8556
8557         DFG arguments simplification should have rationalized handling of TearOffArguments
8558         https://bugs.webkit.org/show_bug.cgi?id=88206
8559
8560         Reviewed by Geoffrey Garen.
8561
8562         - Accesses to the unmodified arguments register ought to have the same effect on
8563           alias/escape analysis of arguments as accesses to the mutable arguments register.
8564
8565         - The existence of TearOffArguments should not get in the way of arguments aliasing.
8566
8567         - TearOffArguments should be eliminated if CreateArguments is eliminated.
8568
8569         * dfg/DFGArgumentsSimplificationPhase.cpp:
8570         (JSC::DFG::ArgumentsSimplificationPhase::run):
8571         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
8572
8573 2012-06-04  Gavin Barraclough  <barraclough@apple.com>
8574
8575         Remove enabledProfilerReference
8576         https://bugs.webkit.org/show_bug.cgi?id=88258
8577
8578         Reviewed by Michael Saboff.
8579
8580         Make the enabled profiler a member of JSGlobalData, and switch code that accesses it to do so directly
8581         via the JSGlobalData, rather than holding a Profiler** reference to it. Do not pass the Profiler**
8582         reference to JIT code. This patch does not change the stack layout on entry into JIT code (passing an
8583         unused void* instead), since this is an intrusive change better handled in a separate patch.
8584
8585         * interpreter/Interpreter.cpp:
8586         (JSC::Interpreter::throwException):
8587         (JSC::Interpreter::execute):
8588         (JSC::Interpreter::executeCall):
8589         (JSC::Interpreter::executeConstruct):
8590         (JSC::Interpreter::privateExecute):
8591         * jit/JITCode.h:
8592         (JSC::JITCode::execute):
8593             - Don't pass Profiler** to JIT code.
8594         * jit/JITOpcodes.cpp:
8595         (JSC::JIT::emit_op_profile_will_call):
8596         (JSC::JIT::emit_op_profile_did_call):
8597         * jit/JITOpcodes32_64.cpp:
8598         (JSC::JIT::emit_op_profile_will_call):
8599         (JSC::JIT::emit_op_profile_did_call):
8600         * jit/JITStubs.cpp:
8601         (JSC):
8602         (JSC::ctiTrampoline):
8603         (JSC::ctiVMThrowTrampoline):
8604         (JSC::ctiOpThrowNotCaught):
8605         (JSC::JITThunks::JITThunks):
8606         (JSC::DEFINE_STUB_FUNCTION):
8607             - For ARM_THUMB2, rename ENABLE_PROFILER_REFERENCE_OFFSET to FIRST_STACK_ARGUMENT (which is how it is being used).
8608             - For MIPS, remove ENABLE_PROFILER_REFERENCE_OFFSET.
8609         * jit/JITStubs.h:
8610         (JITStackFrame):
8611         (JSC):
8612             - Renamed enabledProfilerReference to unusedX.
8613         * llint/LLIntSlowPaths.cpp:
8614         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
8615         * llint/LowLevelInterpreter.asm:
8616         * profiler/Profiler.cpp:
8617         (JSC):
8618         (JSC::Profiler::startProfiling):
8619         (JSC::Profiler::stopProfiling):
8620         * profiler/Profiler.h:
8621         (Profiler):
8622             - Removed s_sharedEnabledProfilerReference, enabledProfilerReference().
8623         * runtime/JSGlobalData.cpp:
8624         (JSC::JSGlobalData::JSGlobalData):
8625         * runtime/JSGlobalData.h:
8626         (JSC):
8627         (JSC::JSGlobalData::enabledProfiler):
8628         (JSGlobalData):
8629             - Added m_enabledProfiler, enabledProfiler().
8630         * runtime/JSGlobalObject.cpp:
8631         (JSC::JSGlobalObject::~JSGlobalObject):
8632
8633 2012-06-04  Filip Pizlo  <fpizlo@apple.com>
8634
8635         get_argument_by_val should be profiled everywhere
8636         https://bugs.webkit.org/show_bug.cgi?id=88205
8637
8638         Reviewed by Geoffrey Garen.
8639
8640         * jit/JITOpcodes32_64.cpp:
8641         (JSC::JIT::emitSlow_op_get_argument_by_val):
8642         * llint/LLIntSlowPaths.cpp:
8643         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
8644
8645 2012-06-04  Filip Pizlo  <fpizlo@apple.com>
8646
8647         DFG arguments simplification takes unkindly to direct accesses to the arguments register
8648         https://bugs.webkit.org/show_bug.cgi?id=88261
8649
8650         Reviewed by Geoffrey Garen.
8651
8652         Fixed arguments simplification for direct accesses to the arguments register, which may
8653         arise if CSE had not run. Fixed CSE so that it does run prior to arguments simplification,
8654         by making it a full-fledged member of the fixpoint. Fixed other issues in arguments
8655         simplification, like realizing that it needs to bail if there is a direct assignment to
8656         the arguments register, and failing to turn CreateArguments into PhantomArguments. Also
8657         fixed CSE's handling of store elimination of captured locals in the presence of a
8658         GetMyArgumentByVal (or one of its friends), and fixed CSE to correctly fixup variables at
8659         tail if the Flush it removes is the last operation on a local in a basic block.
8660
8661         * bytecode/CodeBlock.cpp:
8662         (JSC::CodeBlock::dump):
8663         * dfg/DFGArgumentsSimplificationPhase.cpp:
8664         (JSC::DFG::ArgumentsSimplificationPhase::run):
8665         (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
8666         * dfg/DFGCSEPhase.cpp:
8667         (JSC::DFG::CSEPhase::run):
8668         (JSC::DFG::CSEPhase::setLocalStoreElimination):
8669         (JSC::DFG::CSEPhase::performNodeCSE):
8670         (CSEPhase):
8671         * dfg/DFGDriver.cpp:
8672         (JSC::DFG::compile):
8673
8674 2012-06-04  Anders Carlsson  <andersca@apple.com>
8675
8676         Fix a struct/class mismatch.
8677
8678         * heap/Handle.h:
8679         (Handle):
8680
8681 2012-06-04  David Kilzer  <ddkilzer@apple.com>
8682
8683         BUILD FIX: FeatureDefines.xcconfig should match across projects
8684
8685         * Configurations/FeatureDefines.xcconfig:
8686         - Add missing ENABLE_LEGACY_CSS_VENDOR_PREFIXES.
8687
8688 2012-06-02  Geoffrey Garen  <ggaren@apple.com>
8689
8690         Weak pointer finalization should be lazy
8691         https://bugs.webkit.org/show_bug.cgi?id=87599
8692
8693         Reviewed by Sam Weinig.
8694
8695         This time for sure!
8696
8697         * heap/Heap.cpp:
8698         (JSC::Heap::collect): Don't sweep eagerly -- we'll sweep lazily instead.
8699
8700         * heap/MarkedBlock.cpp:
8701         (JSC::MarkedBlock::sweep): Sweep our weak set before we sweep our other
8702         destructors -- this is our last chance to run weak set finalizers before
8703         we recycle our memory.
8704
8705         * heap/MarkedBlock.h:
8706         (JSC::MarkedBlock::resetAllocator):
8707         * heap/MarkedSpace.cpp:
8708         (JSC::MarkedSpace::resetAllocators):
8709         * heap/MarkedSpace.h:
8710         (JSC::MarkedSpace::resetAllocators): Don't force allocator reset anymore.
8711         It will happen automatically when a weak set is swept. It's simpler to
8712         have only one canonical way for this to happen, and it wasn't buying
8713         us anything to do it eagerly.
8714
8715         * heap/WeakBlock.cpp:
8716         (JSC::WeakBlock::sweep): Don't short-circuit a sweep unless we know
8717         the sweep would be a no-op. If even one finalizer is pending, we need to
8718         run it, since we won't get another chance.
8719
8720         * heap/WeakSet.cpp:
8721         (JSC::WeakSet::sweep): This loop can be simpler now that
8722         WeakBlock::sweep() does what we mean.
8723
8724         Reset our allocator after a sweep because this is the optimal time to
8725         start trying to recycle old weak pointers.
8726
8727         (JSC::WeakSet::tryFindAllocator): Don't sweep when searching for an
8728         allocator because we've swept already, and forcing a new sweep would be
8729         wasteful.
8730
8731         * heap/WeakSet.h:
8732         (JSC::WeakSet::shrink): Be sure to reset our allocator after a shrink
8733         because the shrink may have removed the block the allocator was going to
8734         allocate out of.
8735
8736 2012-06-02  Filip Pizlo  <fpizlo@apple.com>
8737
8738         If the DFG bytecode parser detects that op_method_check has gone polymorphic, it
8739         shouldn't revert all the way to GetById/GetByIdFlush
8740         https://bugs.webkit.org/show_bug.cgi?id=88176
8741
8742         Reviewed by Geoffrey Garen.
8743
8744         Refactored the code so that the op_method_check case of the parser gracefully falls
8745         through to all of the goodness of the normal op_get_by_id case.
8746
8747         * dfg/DFGByteCodeParser.cpp:
8748         (ByteCodeParser):
8749         (JSC::DFG::ByteCodeParser::handleGetById):
8750         (DFG):
8751         (JSC::DFG::ByteCodeParser::parseBlock):
8752
8753 2012-06-02  Filip Pizlo  <fpizlo@apple.com>
8754
8755         DFG CSE should be able to eliminate unnecessary flushes of arguments and captured variables
8756         https://bugs.webkit.org/show_bug.cgi?id=87929
8757
8758         Reviewed by Geoffrey Garen.
8759
8760         Slight speed-up on V8. Big win (up to 50%) on programs that inline very small functions.
8761
8762         This required a bunch of changes:
8763
8764         - The obvious change is making CSE essentially ignore whether or not the set of
8765           operations between the Flush and the SetLocal can exit, and instead focus on whether or
8766           not that set of operations can clobber the world or access local variables. This code
8767           is now refactored to return a set of flags indicating any of these events, and the CSE
8768           decides what to do based on those flags. If the set of operations is non-clobbering
8769           and non-accessing, then the Flush is turned into a Phantom on the child of the
8770           SetLocal. This expands the liveness of the relevant variable but virtually guarantees
8771           that it will be register allocated and not flushed to the stack. So, yeah, this patch
8772           is a lot of work to save a few stores to the stack.
8773
8774         - Previously, CheckArgumentsNotCreated was optimized "lazily" in that you only knew if
8775           it was a no-op if you were holding onto a CFA abstract state. But this would make the
8776           CSE act pessimistically, since it doesn't use the CFA. Hence, this patch changes the
8777           constant folding phase into something more broad; it now fixes up
8778           CheckArgumentsNotCreated nodes by turning them into phantoms if it knows that they are
8779           no-ops.
8780
8781         - Arguments simplification was previously relying on this very strange PhantomArguments
8782           node, which had two different meanings: for normal execution it meant the empty value
8783           but for OSR exit it meant that the arguments should be reified. This produces problems
8784           when set SetLocals to the captured arguments registers are CSE'd away, since we'd be
8785           triggering reification of arguments without having initialized the arguments registers
8786           to empty. The cleanest solution was to fix PhantomArguments to have one meaning:
8787           namely, arguments reification on OSR exit. Hence, this patch changes arguments
8788           simplification to change SetLocal of CreateArguments on the arguments registers to be
8789           a SetLocal of Empty.
8790
8791         - Argument value recoveries were previously derived from the value source of the
8792           arguments at the InlineStart. But that relies on all SetLocals to arguments having
8793           been flushed. It's possible that we could have elided the SetLocal to the arguments
8794           at the callsite because there were subsequent SetLocals to the arguments inside of the
8795           callee, in which case the InlineStart would get the wrong information. Hence, this
8796           patch changes argument value recovery computation to operate over the ArgumentPositions
8797           directly.
8798
8799         - But that doesn't actually work, because previously, there was no way to link an
8800           InlineStart back to the corresponding ArgumentPositions, at least not without some
8801           ugliness. So this patch instates the rule that the m_argumentPositions vector consists
8802           of disjoint subsequences such that each subsequence corresponds to an inline callsite
8803           and can be identified by its first index, and within each subsequence are the
8804           ArgumentPositions of all of the arguments ordered by argument index. This required
8805           flipping the order in which ArgumentPositions are added to the vector, and giving
8806           InlineStart an operand that indicates the start of that inline callsite's
8807           ArgumentPosition subsequence.
8808
8809         - This patch also revealed a nasty bug in the reification of arguments in inline call
8810           frames on OSR exit. Since the reification was happening after the values of virtual
8811           registers were recovered, the value recoveries of the inline arguments were wrong.
8812           Hence using operationCreateInlinedArguments is wrong. For example a value recovery
8813           might say that you have to box a double, but if we had already boxed it then boxing
8814           it a second time will result in garbage. The specific case of this bug was this patch
8815           uncovered was that now it is possible for an inline call frame to not have any valid
8816           value recoveries for any inline arguments, if the optimization elides all argument
8817           flushes, while at the same time optimizing away arguments creation. Then OSR exit
8818           would try to recover the arguments using the inline call frame, which had bogus
8819           information, and humorous crashes would ensue. This patch fixes this issue by moving
8820           arguments reification to after call frame reification, so that arguments reification
8821           can always use operationCreateArguments instead of operationCreateInlinedArguments.
8822
8823         - This patch may turn a Flush into a Phantom. That's kind of the whole point. But that
8824           broke forward speculation checks, which knew to look for a Flush prior to a SetLocal
8825           but didn't know that there could alternatively be a Phantom in place of the Flush.
8826           This patch fixes that by augmenting the forward speculation check logic.
8827
8828         - Finally, in the process of having fun with all of the above, I realized that my DFG
8829           validation was not actually running on every phase like I had originally designed it
8830           to. In fact it was only running just after bytecode parsing. I initially tried to
8831           make it run in every phase but found that this causes some tests to timeout
8832           (specifically the evil fuzzing ones), so I decided on a compromise where: (i) in
8833           release mode validation never runs, (ii) in debug mode validation will run just
8834           after parsing and just before the backend, and (iii) it's possible with a simple
8835           switch to enable validation to run on every phase.
8836
8837         Luckily all of the above issues were already covered by the 77 or so DFG-specific
8838         layout tests. Hence, this patch does not introduce any new tests despite being so
8839         meaty.
8840
8841         * dfg/DFGAbstractState.cpp:
8842         (JSC::DFG::AbstractState::execute):
8843         * dfg/DFGArgumentPosition.h:
8844         (JSC::DFG::ArgumentPosition::prediction):
8845         (JSC::DFG::ArgumentPosition::doubleFormatState):
8846         (JSC::DFG::ArgumentPosition::shouldUseDoubleFormat):
8847         (ArgumentPosition):
8848         * dfg/DFGArgumentsSimplificationPhase.cpp:
8849         (JSC::DFG::ArgumentsSimplificationPhase::run):
8850         * dfg/DFGByteCodeParser.cpp:
8851         (JSC::DFG::ByteCodeParser::handleInlining):
8852         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
8853         * dfg/DFGCSEPhase.cpp:
8854         (JSC::DFG::CSEPhase::SetLocalStoreEliminationResult::SetLocalStoreEliminationResult):
8855         (SetLocalStoreEliminationResult):
8856         (JSC::DFG::CSEPhase::setLocalStoreElimination):
8857         (JSC::DFG::CSEPhase::performNodeCSE):
8858         * dfg/DFGCommon.h:
8859         * dfg/DFGConstantFoldingPhase.cpp:
8860         (JSC::DFG::ConstantFoldingPhase::run):
8861         * dfg/DFGDriver.cpp:
8862         (JSC::DFG::compile):
8863         * dfg/DFGNode.h:
8864         (Node):
8865         (JSC::DFG::Node::hasArgumentPositionStart):
8866         (JSC::DFG::Node::argumentPositionStart):
8867         * dfg/DFGOSRExitCompiler32_64.cpp:
8868         (JSC::DFG::OSRExitCompiler::compileExit):
8869         * dfg/DFGOSRExitCompiler64.cpp:
8870         (JSC::DFG::OSRExitCompiler::compileExit):
8871         * dfg/DFGPhase.cpp:
8872         (DFG):
8873         * dfg/DFGPhase.h:
8874         (Phase):
8875         * dfg/DFGSpeculativeJIT.cpp:
8876         (JSC::DFG::SpeculativeJIT::compile):
8877         * dfg/DFGSpeculativeJIT.h:
8878         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
8879         * dfg/DFGSpeculativeJIT32_64.cpp:
8880         (JSC::DFG::SpeculativeJIT::compile):
8881         * dfg/DFGSpeculativeJIT64.cpp:
8882         (JSC::DFG::SpeculativeJIT::compile):
8883
8884 2012-06-02  Geoffrey Garen  <ggaren@apple.com>
8885
8886         DOM string cache should hash pointers, not characters
8887         https://bugs.webkit.org/show_bug.cgi?id=88175
8888
8889         Reviewed by Phil Pizlo and Sam Weinig.
8890
8891         * heap/Weak.h:
8892         (JSC::weakAdd):
8893         (JSC::weakRemove): Made these function templates slightly more generic
8894         to accommodate new client types.
8895
8896 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8897
8898         DFG CFA should know that PutByVal can clobber the world
8899         https://bugs.webkit.org/show_bug.cgi?id=88155
8900
8901         Reviewed by Gavin Barraclough.
8902
8903         * dfg/DFGAbstractState.cpp:
8904         (JSC::DFG::AbstractState::execute):
8905
8906 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8907
8908         DFG CFA should mark basic blocks as having constants if local accesses yield constants
8909         https://bugs.webkit.org/show_bug.cgi?id=88153
8910
8911         Reviewed by Gavin Barraclough.
8912
8913         * dfg/DFGAbstractState.cpp:
8914         (JSC::DFG::AbstractState::execute):
8915
8916 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8917
8918         DFG arguments simplification phase uses a node.codeOrigin after appending a node
8919         https://bugs.webkit.org/show_bug.cgi?id=88151
8920
8921         Reviewed by Geoffrey Garen.
8922
8923         The right thing to do is to save the CodeOrigin before appending to the graph.
8924
8925         * dfg/DFGArgumentsSimplificationPhase.cpp:
8926         (JSC::DFG::ArgumentsSimplificationPhase::run):
8927
8928 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8929
8930         DFG should not emit unnecessary speculation checks when performing an int32 to double conversion on
8931         a value that is proved to be a number, predicted to be an int32, but not proved to be an int32
8932         https://bugs.webkit.org/show_bug.cgi?id=88146
8933
8934         Reviewed by Gavin Barraclough.
8935
8936         * dfg/DFGSpeculativeJIT.cpp:
8937         (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
8938
8939 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8940
8941         DFG constant folding search for the last local access skips the immediately previous local access
8942         https://bugs.webkit.org/show_bug.cgi?id=88141
8943
8944         Reviewed by Michael Saboff.
8945
8946         If you use a loop in the style of:
8947
8948         for (i = start; i--;)
8949
8950         then you need to remember that the first value of 'i' that the loop body will see is 'start - 1'.
8951         Hence the following is probably wrong:
8952
8953         for (i = start - 1; i--;)
8954
8955         * dfg/DFGConstantFoldingPhase.cpp:
8956         (JSC::DFG::ConstantFoldingPhase::run):
8957
8958 2012-06-01  Filip Pizlo  <fpizlo@apple.com>
8959
8960         DFG constant folding should be OK with GetLocal of captured variables having a constant
8961         https://bugs.webkit.org/show_bug.cgi?id=88137
8962
8963         Reviewed by Gavin Barraclough.
8964
8965         * dfg/DFGConstantFoldingPhase.cpp:
8966         (JSC::DFG::ConstantFoldingPhase::run):
8967
8968 2012-05-31  Mark Hahnenberg  <mhahnenberg@apple.com>
8969
8970         JSGlobalObject does not mark m_privateNameStructure
8971         https://bugs.webkit.org/show_bug.cgi?id=88023
8972
8973         Rubber stamped by Gavin Barraclough.
8974
8975         * runtime/JSGlobalObject.cpp:
8976         (JSC::JSGlobalObject::visitChildren): We need to mark this so it doesn't get
8977         inadvertently garbage collected.
8978
8979 2012-05-31  Erik Arvidsson  <arv@chromium.org>
8980
8981         Make DOM Exceptions Errors
8982         https://bugs.webkit.org/show_bug.cgi?id=85078
8983
8984         Reviewed by Oliver Hunt.
8985
8986         WebIDL mandates that exceptions should have Error.prototype on its prototype chain.
8987
8988         For JSC we have access to the Error.prototype from the binding code.
8989
8990         For V8 we set a field in the WrapperTypeInfo and when the constructor function is created we
8991         set the prototype as needed.
8992
8993         Updated test: fast/dom/DOMException/prototype-object.html
8994
8995         * JavaScriptCore.xcodeproj/project.pbxproj:
8996         * runtime/JSGlobalObject.cpp:
8997         (JSC::JSGlobalObject::reset):
8998         * runtime/JSGlobalObject.h:
8999         (JSC):
9000         (JSGlobalObject):
9001         (JSC::JSGlobalObject::errorPrototype):
9002
9003 2012-05-31  Andy Wingo  <wingo@igalia.com>
9004
9005         Fix reference to unset variable in debug mode
9006         https://bugs.webkit.org/show_bug.cgi?id=87981
9007
9008         Reviewed by Geoffrey Garen.
9009
9010         * runtime/JSONObject.cpp (Stringifier::Holder::Holder):
9011         Initialize m_size in debug mode, as we check it later in an assert.
9012
9013 2012-05-30  Mark Hahnenberg  <mhahnenberg@apple.com>
9014
9015         Heap should sweep incrementally
9016         https://bugs.webkit.org/show_bug.cgi?id=85429
9017
9018         We shouldn't have to wait for the opportunistic GC timer to fire in order
9019         to call object destructors. Instead, we should incrementally sweep some
9020         subset of the blocks requiring sweeping periodically. We tie this sweeping
9021         to a timer rather than to collections because we want to reclaim this memory
9022         even if we stop allocating. This way, our memory usage scales smoothly with
9023         actual use, regardless of whether we've recently done an opportunistic GC or not.
9024
9025         Reviewed by Geoffrey Garen.
9026
9027         * CMakeLists.txt:
9028         * GNUmakefile.list.am:
9029         * JavaScriptCore.gypi:
9030         * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
9031         * JavaScriptCore.xcodeproj/project.pbxproj:
9032         * Target.pri:
9033         * heap/Heap.cpp:
9034         (JSC::Heap::Heap):
9035         (JSC::Heap::collect): We no longer sweep during a full sweep. We only shrink now,
9036         which we will switch over to being done during incremental sweeping too as soon as
9037         all finalizers can be run lazily (and, by extension, incrementally).
9038         (JSC::Heap::sweeper):
9039         (JSC):
9040         * heap/Heap.h:
9041         (JSC):
9042         (Heap):
9043         * heap/IncrementalSweeper.cpp: Added.
9044         (JSC):
9045         (JSC::IncrementalSweeper::timerDidFire): The IncrementalSweeper works very similarly to
9046         GCActivityCallback. It is tied to a run-loop based timer that fires periodically based
9047         on how long the previous sweep increment took to run. The IncrementalSweeper doesn't do
9048         anything if the platform doesn't support CoreFoundation.
9049         (JSC::IncrementalSweeper::IncrementalSweeper):
9050         (JSC::IncrementalSweeper::~IncrementalSweeper):
9051         (JSC::IncrementalSweeper::create):
9052         (JSC::IncrementalSweeper::scheduleTimer):
9053         (JSC::IncrementalSweeper::cancelTimer):
9054         (JSC::IncrementalSweeper::doSweep): Iterates over the snapshot of the MarkedSpace taken
9055         during the last collection, checking to see which blocks need sweeping. If it successfully
9056         gets to the end of the blocks that need sweeping then it cancels the timer.
9057         (JSC::IncrementalSweeper::startSweeping): We take a snapshot of the Heap and store it in
9058         a Vector that the incremental sweep will iterate over. We also reset our index into this Vector.
9059         * heap/IncrementalSweeper.h: Added.
9060         (JSC):
9061         (IncrementalSweeper):
9062         * heap/MarkedBlock.h:
9063         (JSC::MarkedBlock::needsSweeping): If a block is in the Marked state it needs sweeping
9064         to be usable and to run any destructors that need to be run.
9065
9066 2012-05-30  Patrick Gansterer  <paroga@webkit.org>
9067
9068         [WINCE] Fix JSString after r115516.
9069         https://bugs.webkit.org/show_bug.cgi?id=87892
9070
9071         Reviewed by Geoffrey Garen.
9072
9073         r115516 splitted JSString into two classes, with addition nested classes.
9074         Add a workaround for the WinCE compiler since it can't resolve the friend class
9075         declerations corretly and denies the access to protected members of JSString.
9076
9077         * runtime/JSString.h:
9078         (JSC::JSRopeString::RopeBuilder::append):
9079         (JSC::JSRopeString::append):
9080         (JSRopeString):
9081
9082 2012-05-30  Oliver Hunt  <oliver@apple.com>
9083
9084         Really provide error information with the inspector disabled
9085         https://bugs.webkit.org/show_bug.cgi?id=87910
9086
9087         Reviewed by Filip Pizlo.
9088
9089         Don't bother checking for anything other than pre-existing error info.
9090         In the absence of complete line number information you'll only get the
9091         line a function starts on, but at least it's something.
9092
9093         * interpreter/Interpreter.cpp:
9094         (JSC::Interpreter::throwException):
9095
9096 2012-05-30  Filip Pizlo  <fpizlo@apple.com>
9097
9098         LLInt broken on x86-32 with JIT turned off
9099         https://bugs.webkit.org/show_bug.cgi?id=87906
9100
9101         Reviewed by Geoffrey Garen.
9102
9103         Fixed the code to not clobber registers that contain important things, like the call frame.
9104
9105         * llint/LowLevelInterpreter32_64.asm:
9106
9107 2012-05-30  Filip Pizlo  <fpizlo@apple.com>
9108
9109         ScriptDebugServer wants sourceIDs that are non-zero because that's what HashMaps want, so JSC should placate it
9110         https://bugs.webkit.org/show_bug.cgi?id=87887
9111
9112         Reviewed by Darin Adler.
9113
9114         Better fix - we now never call SourceProvider::asID() if SourceProvider* is 0.
9115
9116         * parser/Nodes.h:
9117         (JSC::ScopeNode::sourceID):
9118         * parser/SourceCode.h:
9119         (JSC::SourceCode::providerID):
9120         (SourceCode):
9121         * parser/SourceProvider.h:
9122         (SourceProvider):
9123         (JSC::SourceProvider::asID):
9124         * runtime/Executable.h:
9125         (JSC::ScriptExecutable::sourceID):
9126
9127 2012-05-30  Filip Pizlo  <fpizlo@apple.com>
9128
9129         ScriptDebugServer wants sourceIDs that are non-zero because that's what HashMaps want, so JSC should placate it
9130         https://bugs.webkit.org/show_bug.cgi?id=87887
9131
9132         Reviewed by Geoffrey Garen.
9133
9134         * parser/SourceProvider.h:
9135         (JSC::SourceProvider::asID):
9136
9137 2012-05-30  Oliver Hunt  <oliver@apple.com>
9138
9139         DFG does not correctly handle exceptions caught in the LLInt
9140         https://bugs.webkit.org/show_bug.cgi?id=87885
9141
9142         Reviewed by Filip Pizlo.
9143
9144         Make the DFG use genericThrow, rather than reimplementing a small portion of it.
9145         Also make the LLInt slow paths validate that their PC is correct.
9146
9147         * dfg/DFGOperations.cpp:
9148         * llint/LLIntSlowPaths.cpp:
9149         (LLInt):
9150
9151 2012-05-29  Filip Pizlo  <fpizlo@apple.com>
9152
9153         DFG CFA should infer types and values of captured variables
9154         https://bugs.webkit.org/show_bug.cgi?id=87813
9155
9156         Reviewed by Gavin Barraclough.
9157
9158         Slight speed-up in V8/earley-boyer (~1%).
9159
9160         * bytecode/CodeBlock.h:
9161         (JSC::CodeBlock::argumentsAreCaptured):
9162         (JSC::CodeBlock::argumentIsCaptured):
9163         (CodeBlock):
9164         * dfg/DFGAbstractState.cpp:
9165         (DFG):
9166         (JSC::DFG::AbstractState::beginBasicBlock):
9167         (JSC::DFG::AbstractState::initialize):
9168         (JSC::DFG::AbstractState::endBasicBlock):
9169         (JSC::DFG::AbstractState::execute):
9170         (JSC::DFG::AbstractState::clobberWorld):
9171         (JSC::DFG::AbstractState::clobberStructures):
9172         (JSC::DFG::AbstractState::mergeStateAtTail):
9173         (JSC::DFG::AbstractState::merge):
9174         (JSC::DFG::AbstractState::mergeToSuccessors):
9175         * dfg/DFGAbstractState.h:
9176         (JSC::DFG::AbstractState::variables):
9177         (AbstractState):
9178         * dfg/DFGSpeculativeJIT32_64.cpp:
9179         (JSC::DFG::SpeculativeJIT::compile):
9180         * dfg/DFGSpeculativeJIT64.cpp:
9181         (JSC::DFG::SpeculativeJIT::compile):
9182
9183 2012-05-30  Patrick Gansterer  <paroga@webkit.org>
9184
9185         Unreviewed. Build fix for !ENABLE(JIT) after r117823.
9186
9187         * bytecode/CodeBlock.cpp:
9188         (JSC::CodeBlock::dump):
9189
9190 2012-05-30  Sheriff Bot  <webkit.review.bot@gmail.com>
9191
9192         Unreviewed, rolling out r118868.
9193         http://trac.webkit.org/changeset/118868
9194         https://bugs.webkit.org/show_bug.cgi?id=87828
9195
9196         introduced ~20 crashes on Mac and Qt bots (Requested by pizlo_
9197         on #webkit).
9198
9199         * heap/Heap.cpp:
9200         (JSC::Heap::collect):
9201         * heap/MarkedBlock.cpp:
9202         (JSC::MarkedBlock::sweep):
9203         * heap/MarkedBlock.h:
9204         (JSC::MarkedBlock::sweepWeakSet):
9205         (JSC):
9206         * heap/MarkedSpace.cpp:
9207         (JSC::SweepWeakSet::operator()):
9208         (JSC):
9209         (JSC::MarkedSpace::sweepWeakSets):
9210         * heap/MarkedSpace.h:
9211         (MarkedSpace):
9212
9213 2012-05-29  Geoffrey Garen  <ggaren@apple.com>
9214
9215         Rolled back in r118646, now that
9216         https://bugs.webkit.org/show_bug.cgi?id=87784 is fixed.
9217
9218         http://trac.webkit.org/changeset/118646
9219         https://bugs.webkit.org/show_bug.cgi?id=87599
9220
9221         * heap/Heap.cpp:
9222         (JSC::Heap::collect):
9223         * heap/MarkedBlock.cpp:
9224         (JSC::MarkedBlock::sweep):
9225         * heap/MarkedBlock.h:
9226         (JSC):
9227         * heap/MarkedSpace.cpp:
9228         (JSC):
9229         * heap/MarkedSpace.h:
9230         (MarkedSpace):
9231
9232 2012-05-29  Filip Pizlo  <fpizlo@apple.com>
9233
9234         DFG should keep captured variables alive until the (inline) return.
9235         https://bugs.webkit.org/show_bug.cgi?id=87205
9236
9237         Reviewed by Gavin Barraclough.
9238
9239         Changes the way we do flushing for captured variables and arguments. Instead of flushing
9240         each SetLocal immediately, we flush at kill points. So a SetLocal will cause a Flush of
9241         whatever was live in the variable previously, and a return will cause a Flush of all
9242         captured variables and all arguments.
9243
9244         * dfg/DFGByteCodeParser.cpp:
9245         (JSC::DFG::ByteCodeParser::setDirect):
9246         (JSC::DFG::ByteCodeParser::set):
9247         (JSC::DFG::ByteCodeParser::setLocal):
9248         (JSC::DFG::ByteCodeParser::getArgument):
9249         (JSC::DFG::ByteCodeParser::setArgument):
9250         (JSC::DFG::ByteCodeParser::findArgumentPositionForArgument):
9251         (ByteCodeParser):
9252         (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
9253         (JSC::DFG::ByteCodeParser::findArgumentPosition):
9254         (JSC::DFG::ByteCodeParser::flush):
9255         (JSC::DFG::ByteCodeParser::flushDirect):
9256         (JSC::DFG::ByteCodeParser::flushArgumentsAndCapturedVariables):
9257         (JSC::DFG::ByteCodeParser::handleInlining):
9258         (JSC::DFG::ByteCodeParser::parseBlock):
9259         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
9260         * dfg/DFGCSEPhase.cpp:
9261         (JSC::DFG::CSEPhase::setLocalStoreElimination):
9262         (JSC::DFG::CSEPhase::performNodeCSE):
9263         * dfg/DFGSpeculativeJIT.cpp:
9264         (JSC::DFG::SpeculativeJIT::compile):
9265         * dfg/DFGSpeculativeJIT.h:
9266         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
9267
9268 2012-05-29  Geoffrey Garen  <ggaren@apple.com>
9269
9270         WeakGCMap should be lazy-finalization-safe
9271         https://bugs.webkit.org/show_bug.cgi?id=87784
9272
9273         Reviewed by Darin Adler.
9274
9275         * runtime/WeakGCMap.h:
9276         (JSC::WeakGCMap::get): Since this is a map of raw WeakImpl pointers, and
9277         not Weak<T>, we need to verify manually that the WeakImpl is live before
9278         we return its payload.
9279
9280 2012-05-29  Mark Hahnenberg  <mhahnenberg@apple.com>
9281
9282         CopiedSpace::doneCopying could start another collection
9283         https://bugs.webkit.org/show_bug.cgi?id=86538
9284
9285         Reviewed by Geoffrey Garen.
9286
9287         It's possible that if we don't have anything at the head of to-space
9288         after a collection and the BlockAllocator doesn't have any fresh blocks
9289         to give us right now we could start another collection while still in
9290         the middle of the first collection when we call CopiedSpace::addNewBlock().
9291
9292         One way to resolve this would be to have Heap::shouldCollect() check that
9293         m_operationInProgress is NoOperation. This would prevent the path in
9294         getFreshBlock() that starts the collection if we're already in the middle of one.
9295
9296         I could not come up with a test case to reproduce this crash on ToT.
9297
9298         * heap/Heap.h:
9299         (JSC::Heap::shouldCollect): We shouldn't collect if we're already in the middle
9300         of a collection, i.e. the current operation should be NoOperation.
9301
9302 2012-05-29  David Barr  <davidbarr@chromium.org>
9303
9304         Introduce ENABLE_CSS_IMAGE_RESOLUTION compile flag
9305         https://bugs.webkit.org/show_bug.cgi?id=87685
9306
9307         Reviewed by Eric Seidel.
9308
9309         Add a configuration option for CSS image-resolution support, disabling it by default.
9310
9311         * Configurations/FeatureDefines.xcconfig:
9312
9313 2012-05-28  Sheriff Bot  <webkit.review.bot@gmail.com>
9314
9315         Unreviewed, rolling out r118646.
9316         http://trac.webkit.org/changeset/118646
9317         https://bugs.webkit.org/show_bug.cgi?id=87691
9318
9319         broke V8 raytrace benchmark (Requested by pizlo_ on #webkit).
9320
9321         * heap/Heap.cpp:
9322         (JSC::Heap::collect):
9323         * heap/MarkedBlock.cpp:
9324         (JSC::MarkedBlock::sweep):
9325         * heap/MarkedBlock.h:
9326         (JSC::MarkedBlock::sweepWeakSet):
9327         (JSC):
9328         * heap/MarkedSpace.cpp:
9329         (JSC::SweepWeakSet::operator()):
9330         (JSC):
9331         (JSC::MarkedSpace::sweepWeakSets):
9332         * heap/MarkedSpace.h:
9333         (MarkedSpace):
9334
9335 2012-05-28  Filip Pizlo  <fpizlo@apple.com>
9336
9337         DFG should not generate code for code that the CFA proves to be unreachable
9338         https://bugs.webkit.org/show_bug.cgi?id=87682
9339
9340         Reviewed by Sam Weinig.
9341
9342         This also fixes a small performance bug where CFA was not marking blocks
9343         as having constants (and hence not triggering constant folding) if the only
9344         constants were on GetLocals.
9345
9346         And fixing that bug revealed another bug: constant folding was assuming that
9347         a GetLocal must be the first access to a local in a basic block. This isn't
9348         true. The first access may be a Flush. This patch fixes that issue using the
9349         safest approach possible, since we don't need to be clever for something that
9350         only happens in one of our benchmarks.
9351
9352         * dfg/DFGAbstractState.cpp:
9353         (JSC::DFG::AbstractState::execute):
9354         * dfg/DFGConstantFoldingPhase.cpp:
9355         (JSC::DFG::ConstantFoldingPhase::run):
9356         * dfg/DFGJITCompiler.h:
9357         (JSC::DFG::JITCompiler::noticeOSREntry):
9358         * dfg/DFGSpeculativeJIT.cpp:
9359         (JSC::DFG::SpeculativeJIT::compile):
9360
9361 2012-05-28  Carlos Garcia Campos  <cgarcia@igalia.com>
9362
9363         Unreviewed. Fix make distcheck.
9364
9365         * GNUmakefile.list.am: Add missing header file.
9366
9367 2012-05-27  Geoffrey Garen  <ggaren@apple.com>
9368
9369         Weak pointer finalization should be lazy
9370         https://bugs.webkit.org/show_bug.cgi?id=87599
9371
9372         Reviewed by Darin Adler.
9373
9374         * heap/Heap.cpp:
9375         (JSC::Heap::collect): Don't force immediate finalization -- it will
9376         happen lazily.
9377
9378         * heap/MarkedBlock.cpp:
9379         (JSC::MarkedBlock::sweep): Sweep a block's weak set when sweeping the
9380         block. The weak set may not have been swept yet, and this is our last
9381         chance to run weak finalizers before we recycle the memory they reference.
9382
9383         * heap/MarkedBlock.h:
9384         * heap/MarkedSpace.cpp:
9385         (JSC::MarkedBlock::sweepWeakSets):
9386         * heap/MarkedSpace.h:
9387         (JSC::MarkedSpace::sweepWeakSets): Nixed sweepWeakSets because it's unused
9388         now.
9389
9390 2012-05-26  Geoffrey Garen  <ggaren@apple.com>
9391
9392         WebKit should be lazy-finalization-safe (esp. the DOM) v2
9393         https://bugs.webkit.org/show_bug.cgi?id=87581
9394
9395         Reviewed by Oliver Hunt.
9396
9397         * heap/MarkedBlock.cpp:
9398         (JSC::MarkedBlock::callDestructor):
9399         * heap/WeakBlock.h:
9400         * heap/WeakSetInlines.h:
9401         (JSC::WeakBlock::finalize): Since we don't guarantee destruction order,
9402         it's not valid to access GC pointers like the Structure pointer during
9403         finalization. We NULL out the structure pointer in debug builds to try
9404         to make this programming mistake more obvious.
9405
9406         * API/JSCallbackConstructor.cpp:
9407         (JSC::JSCallbackConstructor::destroy):
9408         * API/JSCallbackObject.cpp:
9409         (JSC::::destroy):
9410         (JSC::JSCallbackObjectData::finalize):
9411         * runtime/Arguments.cpp:
9412         (JSC::Arguments::destroy):
9413         * runtime/DateInstance.cpp:
9414         (JSC::DateInstance::destroy):
9415         * runtime/Error.cpp:
9416         (JSC::StrictModeTypeErrorFunction::destroy):
9417         * runtime/Executable.cpp:
9418         (JSC::ExecutableBase::destroy):
9419         (JSC::NativeExecutable::destroy):
9420         (JSC::ScriptExecutable::destroy):
9421         (JSC::EvalExecutable::destroy):
9422         (JSC::ProgramExecutable::destroy):
9423         (JSC::FunctionExecutable::destroy):
9424         * runtime/JSGlobalObject.cpp:
9425         (JSC::JSGlobalObject::destroy):
9426         * runtime/JSPropertyNameIterator.cpp:
9427         (JSC::JSPropertyNameIterator::destroy):
9428         * runtime/JSStaticScopeObject.cpp:
9429         (JSC::JSStaticScopeObject::destroy):
9430         * runtime/JSString.cpp:
9431         (JSC::JSString::destroy):
9432         * runtime/JSVariableObject.cpp:
9433         (JSC::JSVariableObject::destroy):
9434         * runtime/NameInstance.cpp:
9435         (JSC::NameInstance::destroy):
9436         * runtime/RegExp.cpp:
9437         (JSC::RegExp::destroy):
9438         * runtime/RegExpConstructor.cpp:
9439         (JSC::RegExpConstructor::destroy):
9440         * runtime/Structure.cpp:
9441         (JSC::Structure::destroy):
9442         * runtime/StructureChain.cpp:
9443         (JSC::StructureChain::destroy): Use static_cast instead of jsCast because
9444         jsCast does Structure-based validation, and our Structure is not guaranteed
9445         to be alive when we get finalized.
9446
9447 2012-05-22  Filip Pizlo  <fpizlo@apple.com>
9448
9449         DFG CSE should eliminate redundant WeakJSConstants
9450         https://bugs.webkit.org/show_bug.cgi?id=87179
9451
9452         Reviewed by Gavin Barraclough.
9453
9454         Merged r118141 from dfgopt.
9455
9456         * dfg/DFGCSEPhase.cpp:
9457         (JSC::DFG::CSEPhase::weakConstantCSE):
9458         (CSEPhase):
9459         (JSC::DFG::CSEPhase::performNodeCSE):
9460         * dfg/DFGNode.h:
9461         (JSC::DFG::Node::weakConstant):
9462
9463 2012-05-22  Filip Pizlo  <fpizlo@apple.com>
9464
9465         DFG CSE should do redundant store elimination
9466         https://bugs.webkit.org/show_bug.cgi?id=87161
9467
9468         Reviewed by Oliver Hunt.
9469
9470         Merge r118138 from dfgopt.
9471
9472         This patch adds redundant store elimination. For example, consider this
9473         code:
9474
9475         o.x = 42;
9476         o.x = 84;
9477
9478         If o.x is speculated to be a well-behaved field, the first assignment is
9479         unnecessary, since the second just overwrites it. We would like to
9480         eliminate the first assignment in these cases. The need for this
9481         optimization arises mostly from stores that our runtime requires. For
9482         example:
9483
9484         o = {f:1, g:2, h:3};
9485
9486         This will have four assignments to the structure for the newly created
9487         object - one assignment for the empty structure, one for {f}, one for
9488         {f, g}, and one for {f, g, h}. We would like to only have the last of
9489         those assigments in this case.
9490
9491         Intriguingly, doing so for captured variables breaks the way arguments
9492         simplification used to work. Consider that prior to either arguments
9493         simplification or store elimination we will have IR that looks like:
9494
9495         a: SetLocal(r0, Empty)
9496         b: SetLocal(r1, Empty)
9497         c: GetLocal(r0)
9498         d: CreateArguments(@c)
9499         e: SetLocal(r0, @d)
9500         f: SetLocal(r1, @d)
9501
9502         Then redundant store elimination will eliminate the stores that
9503         initialize the arguments registers to Empty, but then arguments
9504         simplification eliminates the stores that initialize the arguments to
9505         the newly created arguments - and at this point we no longer have any
9506         stores to the arguments register, leading to hilarious crashes. This
9507         patch therefore changes arguments simplification to replace
9508         CreateArguments with JSConstant(Empty) rather than eliminating the
9509         SetLocals. But this revealed bugs where arguments simplification was
9510         being overzealous, so I fixed those bugs.
9511
9512         This is a minor speed-up on V8/early and a handful of other tests.
9513
9514         * bytecode/CodeBlock.h:
9515         (JSC::CodeBlock::uncheckedActivationRegister):
9516         * dfg/DFGAbstractState.cpp:
9517         (JSC::DFG::AbstractState::execute):
9518         * dfg/DFGArgumentsSimplificationPhase.cpp:
9519         (JSC::DFG::ArgumentsSimplificationPhase::run):
9520         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
9521         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
9522         (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
9523         * dfg/DFGCSEPhase.cpp:
9524         (JSC::DFG::CSEPhase::globalVarStoreElimination):
9525         (CSEPhase):
9526         (JSC::DFG::CSEPhase::putStructureStoreElimination):
9527         (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
9528         (JSC::DFG::CSEPhase::setLocalStoreElimination):
9529         (JSC::DFG::CSEPhase::setReplacement):
9530         (JSC::DFG::CSEPhase::eliminate):
9531         (JSC::DFG::CSEPhase::performNodeCSE):
9532         * dfg/DFGGraph.h:
9533         (JSC::DFG::Graph::uncheckedActivationRegisterFor):
9534         (Graph):
9535         * dfg/DFGNode.h:
9536         (JSC::DFG::Node::isPhantomArguments):
9537         (Node):
9538         (JSC::DFG::Node::hasConstant):
9539         (JSC::DFG::Node::valueOfJSConstant):
9540         (JSC::DFG::Node::hasStructureTransitionData):
9541         * dfg/DFGNodeType.h:
9542         (DFG):
9543         * dfg/DFGPredictionPropagationPhase.cpp:
9544         (JSC::DFG::PredictionPropagationPhase::propagate):
9545         * dfg/DFGSpeculativeJIT.cpp:
9546         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
9547         * dfg/DFGSpeculativeJIT32_64.cpp:
9548         (JSC::DFG::SpeculativeJIT::compile):
9549         * dfg/DFGSpeculativeJIT64.cpp:
9550         (JSC::DFG::SpeculativeJIT::compile):
9551
9552 2012-05-21  Filip Pizlo  <fpizlo@apple.com>
9553
9554         DFG ConvertThis should just be a CheckStructure if the structure is known
9555         https://bugs.webkit.org/show_bug.cgi?id=87057
9556
9557         Reviewed by Gavin Barraclough.
9558
9559         Merged r118021 from dfgopt.
9560
9561         This gives ValueProfile the ability to track singleton values - i.e. profiling
9562         sites that always see the same value.
9563
9564         That is then used to profile the structure in op_convert_this.
9565
9566         This is then used to optimize op_convert_this into a CheckStructure if the
9567         structure is always the same.
9568
9569         That then results in better CSE in inlined code that uses 'this', since
9570         previously we couldn't CSE accesses on 'this' from different inline call frames.
9571
9572         Also fixed a bug where we were unnecessarily flushing 'this'.
9573
9574         * bytecode/CodeBlock.cpp:
9575         (JSC::CodeBlock::dump):
9576         (JSC::CodeBlock::stronglyVisitStrongReferences):
9577         * bytecode/LazyOperandValueProfile.cpp:
9578         (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions):
9579         * bytecode/LazyOperandValueProfile.h:
9580         (CompressedLazyOperandValueProfileHolder):
9581         * bytecode/Opcode.h:
9582         (JSC):
9583         (JSC::padOpcodeName):
9584         * bytecode/ValueProfile.h:
9585         (JSC::ValueProfileBase::ValueProfileBase):
9586         (JSC::ValueProfileBase::dump):
9587         (JSC::ValueProfileBase::computeUpdatedPrediction):
9588         (ValueProfileBase):
9589         * bytecompiler/BytecodeGenerator.cpp:
9590         (JSC::BytecodeGenerator::BytecodeGenerator):
9591         * dfg/DFGByteCodeParser.cpp:
9592         (JSC::DFG::ByteCodeParser::setArgument):
9593         (JSC::DFG::ByteCodeParser::parseBlock):
9594         * jit/JITOpcodes.cpp:
9595         (JSC::JIT::emit_op_convert_this):
9596         (JSC::JIT::emitSlow_op_convert_this):
9597         * jit/JITOpcodes32_64.cpp:
9598         (JSC::JIT::emit_op_convert_this):
9599         (JSC::JIT::emitSlow_op_convert_this):
9600         * llint/LLIntSlowPaths.cpp:
9601         (JSC::LLInt::LLINT_SLOW_PATH_DECL):
9602         * llint/LowLevelInterpreter32_64.asm:
9603         * llint/LowLevelInterpreter64.asm:
9604         * runtime/JSValue.h:
9605         (JSValue):
9606         * runtime/Structure.h:
9607         (JSC::JSValue::structureOrUndefined):
9608         (JSC):
9609
9610 2012-05-24  Tim Horton  <timothy_horton@apple.com>
9611
9612         Add feature defines for web-facing parts of CSS Regions and Exclusions
9613         https://bugs.webkit.org/show_bug.cgi?id=87442
9614         <rdar://problem/10887709>
9615
9616         Reviewed by Dan Bernstein.
9617
9618         * Configurations/FeatureDefines.xcconfig:
9619
9620 2012-05-24  Geoffrey Garen  <ggaren@apple.com>
9621
9622         WebKit should be lazy-finalization-safe (esp. the DOM)
9623         https://bugs.webkit.org/show_bug.cgi?id=87456
9624
9625         Reviewed by Filip Pizlo.
9626
9627         Lazy finalization adds one twist to weak pointer use:
9628
9629                 A HashMap of weak pointers may contain logically null entries.
9630                 (Weak pointers behave as-if null once their payloads die.)
9631                 Insertion must not assume that a pre-existing entry is
9632                 necessarily valid, and iteration must not assume that all
9633                 entries can be dereferenced.
9634
9635         (Previously, I thought that it also added a second twist:
9636
9637                 A demand-allocated weak pointer may replace a dead payload
9638                 before the payload's finalizer runs. In that case, when the
9639                 payload's finalizer runs, the payload has already been
9640                 overwritten, and the finalizer should not clear the payload,
9641                 which now points to something new.
9642
9643         But that's not the case here, since we cancel the old payload's
9644         finalizer when we over-write it. I've added ASSERTs to verify this
9645         assumption, in case it ever changes.)
9646
9647         * API/JSClassRef.cpp:
9648         (OpaqueJSClass::prototype): No need to specify null; that's the default.
9649
9650         * API/JSWeakObjectMapRefPrivate.cpp: Use remove, since take() is gone.
9651
9652         * heap/PassWeak.h:
9653         (WeakImplAccessor::was): This is no longer a debug-only function, since
9654         it's required to reason about lazily finalized pointers.
9655
9656         * heap/Weak.h:
9657         (JSC::weakAdd):
9658         (JSC::weakRemove):
9659         (JSC::weakClear): Added these helper functions for the common idioms of
9660         what clients want to do in their weak pointer finalizers.
9661
9662         * jit/JITStubs.cpp:
9663         (JSC::JITThunks::hostFunctionStub): Use the new idioms. Otherwise, we
9664         would return NULL for a "zombie" executable weak pointer that was waiting
9665         for finalization (item (2)), and finalizing a dead executable weak pointer
9666         would potentially destroy a new, live one (item (1)).
9667
9668         * runtime/RegExpCache.cpp:
9669         (JSC::RegExpCache::lookupOrCreate):
9670         (JSC::RegExpCache::finalize): Ditto.
9671
9672         (JSC::RegExpCache::invalidateCode): Check for null while iterating. (See
9673         item (2).)
9674
9675         * runtime/Structure.cpp:
9676         (JSC::StructureTransitionTable::contains):
9677         (JSC::StructureTransitionTable::add): Use get and set instead of add and
9678         contains, since add and contains are not compatible with lazy finalization.
9679
9680         * runtime/WeakGCMap.h:
9681         (WeakGCMap):
9682         (JSC::WeakGCMap::clear):
9683         (JSC::WeakGCMap::remove): Removed a bunch of code that was incompatible with
9684         lazy finalization because I didn't feel like making it compatible, and I had
9685         no way to test it.
9686
9687 2012-05-24  Filip Pizlo  <fpizlo@apple.com>
9688
9689         REGRESSION (r118013-r118031): Loops/Reloads under www.yahoo.com, quits after three tries with error
9690         https://bugs.webkit.org/show_bug.cgi?id=87327
9691
9692         Reviewed by Geoffrey Garen.
9693
9694         If you use AbstractValue::filter(StructureSet) to test subset relationships between TOP and a
9695         set containing >=2 elements, you're going to have a bad time.
9696
9697         That's because AbstractValue considers a set with >=2 elements to be equivalent to TOP, in order
9698         to save space and speed up convergence. So filtering has no effect in this case, which made
9699         the code think that the abstract value was proving that the structure check was unnecessary.
9700         The correct thing to do is to use isSubsetOf() on the StructureAbstractValue, which does the
9701         right thingies for TOP and >=2 elements.
9702
9703         * dfg/DFGAbstractState.cpp:
9704         (JSC::DFG::AbstractState::execute):
9705         * dfg/DFGSpeculativeJIT32_64.cpp:
9706         (JSC::DFG::SpeculativeJIT::compile):
9707         * dfg/DFGSpeculativeJIT64.cpp:
9708         (JSC::DFG::SpeculativeJIT::compile):
9709
9710 2012-05-24  Filip Pizlo  <fpizlo@apple.com>
9711
9712         new test fast/js/dfg-arguments-mixed-alias.html fails on JSVALUE32_64
9713         https://bugs.webkit.org/show_bug.cgi?id=87378
9714
9715         Reviewed by Gavin Barraclough.
9716
9717         - Captured variable tracking forgot did not consistently handle arguments, leading to OSR
9718           badness.
9719
9720         - Nodes capable of exiting were tracked in a non-monotonic way, leading to compiler errors.
9721
9722         * dfg/DFGByteCodeParser.cpp:
9723         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
9724         * dfg/DFGCSEPhase.cpp:
9725         (JSC::DFG::CSEPhase::CSEPhase):
9726         (CSEPhase):
9727         (JSC::DFG::performCSE):
9728         * dfg/DFGCSEPhase.h:
9729         (DFG):
9730         * dfg/DFGCommon.h:
9731         * dfg/DFGDriver.cpp:
9732         (JSC::DFG::compile):
9733         * dfg/DFGGraph.cpp:
9734         (JSC::DFG::Graph::resetExitStates):
9735         (DFG):
9736         * dfg/DFGGraph.h:
9737         (Graph):
9738         * dfg/DFGPhase.h:
9739         (DFG):
9740         (JSC::DFG::runPhase):
9741
9742 2012-05-24  Geoffrey Garen  <ggaren@apple.com>
9743
9744         Made WeakSet per-block instead of per-heap
9745         https://bugs.webkit.org/show_bug.cgi?id=87401
9746
9747         Reviewed by Oliver Hunt.
9748
9749         This allows us fast access to the set of all weak pointers for a block,
9750         which is a step toward lazy finalization.
9751
9752         No performance change.
9753
9754         * heap/Heap.cpp:
9755         (JSC::Heap::Heap):
9756         (JSC::Heap::lastChanceToFinalize): Removed the per-heap weak set, since
9757         it's per-block now.
9758
9759         (JSC::Heap::markRoots): Delegate weak set visiting to the marked space,
9760         since it knows how to iterate all blocks.
9761
9762         (JSC::Heap::collect): Moved the reaping outside of markRoots, since it
9763         doesn't mark anything.
9764
9765         Make sure to reset allocators after shrinking, since shrinking may
9766         deallocate the current allocator.
9767
9768         * heap/Heap.h:
9769         (Heap): No more per-heap weak set, since it's per-block now.
9770
9771         * heap/MarkedBlock.cpp:
9772         (JSC::MarkedBlock::MarkedBlock):
9773         * heap/MarkedBlock.h:
9774         (MarkedBlock):
9775         (JSC::MarkedBlock::lastChanceToFinalize): Migrated finalization logic
9776         here from the heap, so the heap doesn't need to know about our internal
9777         data structures like our weak set.
9778
9779         (JSC::MarkedBlock::heap):
9780         (JSC::MarkedBlock::weakSet):
9781         (JSC::MarkedBlock::shrink):
9782         (JSC::MarkedBlock::resetAllocator):
9783         (JSC::MarkedBlock::visitWeakSet):
9784         (JSC::MarkedBlock::reapWeakSet):
9785         (JSC::MarkedBlock::sweepWeakSet):
9786         * heap/MarkedSpace.cpp:
9787         (JSC::VisitWeakSet::VisitWeakSet):
9788         (JSC::VisitWeakSet::operator()):
9789         (VisitWeakSet):
9790         (JSC):
9791         (JSC::ReapWeakSet::operator()):
9792         (JSC::SweepWeakSet::operator()):
9793         (JSC::LastChanceToFinalize::operator()):
9794         (JSC::MarkedSpace::lastChanceToFinalize):
9795         (JSC::ResetAllocator::operator()):
9796         (JSC::MarkedSpace::resetAllocators):
9797         (JSC::MarkedSpace::visitWeakSets):
9798         (JSC::MarkedSpace::reapWeakSets):
9799         (JSC::MarkedSpace::sweepWeakSets):
9800         (JSC::Shrink::operator()):
9801         (JSC::MarkedSpace::shrink):
9802         * heap/MarkedSpace.h:
9803         (MarkedSpace): Make sure to account for our weak sets when sweeping,
9804         shrinking, etc.
9805
9806         * heap/WeakSet.cpp:
9807         (JSC):
9808         * heap/WeakSet.h:
9809         (WeakSet):
9810         (JSC::WeakSet::heap):
9811         (JSC):
9812         (JSC::WeakSet::lastChanceToFinalize):
9813         (JSC::WeakSet::visit):
9814         (JSC::WeakSet::reap):
9815         (JSC::WeakSet::shrink):
9816         (JSC::WeakSet::resetAllocator): Inlined some things since they're called
9817         once per block now instead of once per heap.
9818
9819         * heap/WeakSetInlines.h:
9820         (JSC::WeakSet::allocate): Use the per-block weak set since there is no
9821         per-heap weak set anymore.
9822
9823 2012-05-24  Gavin Barraclough  <barraclough@apple.com>
9824
9825         Fix arm build
9826
9827         Rubber stamped by Geoff Garen
9828
9829         * dfg/DFGGPRInfo.h:
9830         (GPRInfo):
9831
9832 2012-05-24  Gavin Barraclough  <barraclough@apple.com>
9833
9834         Move cacheFlush from ExecutableAllocator to Assembler classes
9835         https://bugs.webkit.org/show_bug.cgi?id=87420
9836
9837         Reviewed by Oliver Hunt.
9838
9839         Makes more sense there, & remove a pile of #ifdefs.
9840
9841         * assembler/ARMAssembler.cpp:
9842         (JSC):
9843         (JSC::ARMAssembler::cacheFlush):
9844         * assembler/ARMAssembler.h:
9845         (ARMAssembler):
9846         (JSC::ARMAssembler::cacheFlush):
9847         * assembler/ARMv7Assembler.h:
9848         (JSC::ARMv7Assembler::relinkJump):
9849         (JSC::ARMv7Assembler::cacheFlush):
9850         (ARMv7Assembler):
9851         (JSC::ARMv7Assembler::setInt32):
9852         (JSC::ARMv7Assembler::setUInt7ForLoad):
9853         * assembler/AbstractMacroAssembler.h:
9854         (JSC::AbstractMacroAssembler::cacheFlush):
9855         * assembler/LinkBuffer.h:
9856         (JSC::LinkBuffer::performFinalization):
9857         * assembler/MIPSAssembler.h:
9858         (JSC::MIPSAssembler::relinkJump):
9859         (JSC::MIPSAssembler::relinkCall):
9860         (JSC::MIPSAssembler::repatchInt32):
9861         (JSC::MIPSAssembler::cacheFlush):
9862         (MIPSAssembler):
9863         * assembler/SH4Assembler.h:
9864         (JSC::SH4Assembler::repatchCompact):
9865         (JSC::SH4Assembler::cacheFlush):
9866         (SH4Assembler):
9867         * assembler/X86Assembler.h:
9868         (X86Assembler):
9869         (JSC::X86Assembler::cacheFlush):
9870         * jit/ExecutableAllocator.cpp:
9871         (JSC):
9872         * jit/ExecutableAllocator.h:
9873         (ExecutableAllocator):
9874
9875 2012-05-24  John Mellor  <johnme@chromium.org>
9876
9877         Font Boosting: Add compile flag and runtime setting
9878         https://bugs.webkit.org/show_bug.cgi?id=87394
9879
9880         Reviewed by Adam Barth.
9881
9882         Add ENABLE_FONT_BOOSTING.
9883
9884         * Configurations/FeatureDefines.xcconfig:
9885
9886 2012-05-24  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
9887
9888         cti_vm_throw gets kicked out by gcc 4.6 -flto
9889         https://bugs.webkit.org/show_bug.cgi?id=56088
9890
9891         Reviewed by Darin Adler.
9892
9893         Add REFERENCED_FROM_ASM to functions only referenced from assembler.
9894
9895         * dfg/DFGOperations.cpp:
9896         * jit/HostCallReturnValue.h:
9897         * jit/JITStubs.h:
9898         * jit/ThunkGenerators.cpp:
9899
9900 2012-05-24  Filip Pizlo  <fpizlo@apple.com>
9901
9902         Incorrect merge of r117542 from dfg opt branch in r118323 is leading to fast/js/dfg-arguments-osr-exit.html failing
9903         https://bugs.webkit.org/show_bug.cgi?id=87350
9904
9905         Reviewed by Maciej Stachowiak.
9906
9907         The dfgopt branch introduced the notion of a local variable being killed because it was aliased
9908         to the Arguments object as in cases like:
9909
9910         var a = arguments;
9911         return a.length;
9912
9913         This required changes to OSR exit handling - if the variable is dead but aliased to arguments, then
9914         OSR exit should reify the arguments. But meanwhile, in tip of tree we introduced special handling for
9915         dead variables on OSR exit. When the two were merged in r118323, the structure of the if/else branches
9916         ended up being such that we would treat dead arguments variables as totally dead as opposed to treating
9917         them as variables that need arguments reification.
9918
9919         This fixes the structure of the relevant if/else block so that variables that are dead-but-arguments
9920         end up being treated as reified arguments objects, while variables that are dead but not aliased to
9921         arguments are treated as tip of tree would have treated them (initialize to Undefined).
9922
9923         * dfg/DFGSpeculativeJIT.cpp:
9924         (JSC::DFG::SpeculativeJIT::compile):
9925
9926 2012-05-24  Csaba Osztrogonác  <ossy@webkit.org>
9927
9928         Unreviewed 32 bit buildfix after r118325.
9929
9930         * dfg/DFGSpeculativeJIT32_64.cpp:
9931         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): Use ASSERT_UNUSED instead ASSERT.
9932
9933 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
9934
9935         DFG operationTearOffActivation should return after handling the null activation case
9936         https://bugs.webkit.org/show_bug.cgi?id=87348
9937         <rdar://problem/11522295>
9938
9939         Reviewed by Oliver Hunt.
9940
9941         * dfg/DFGOperations.cpp:
9942
9943 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
9944
9945         Unreviewed, merge the arguments fix in r118138 to get bots green.
9946
9947         * dfg/DFGArgumentsSimplificationPhase.cpp:
9948         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
9949
9950 2012-05-20  Filip Pizlo  <fpizlo@apple.com>
9951
9952         DFG CFA should record if a node can OSR exit
9953         https://bugs.webkit.org/show_bug.cgi?id=86905
9954
9955         Reviewed by Oliver Hunt.
9956
9957         Merged r117931 from dfgopt.
9958
9959         Adds a NodeFlag that denotes nodes that are known to not have OSR exits.
9960         This ought to aid any backwards analyses that need to know when a
9961         backward flow merge might happen due to a side exit.
9962
9963         Also added assertions into speculationCheck() that ensure that we did not
9964         mark a node as non-exiting and then promptly compile in an exit. This
9965         helped catch some minor bugs where we were doing unnecessary speculation
9966         checks.
9967
9968         This is a perf-neutral change. The speculation checks that this removes
9969         were not on hot paths of major benchmarks.
9970
9971         * bytecode/PredictedType.h:
9972         (JSC):
9973         (JSC::isAnyPrediction):
9974         * dfg/DFGAbstractState.cpp:
9975         (JSC::DFG::AbstractState::execute):
9976         * dfg/DFGAbstractState.h:
9977         (JSC::DFG::AbstractState::speculateInt32Unary):
9978         (AbstractState):
9979         (JSC::DFG::AbstractState::speculateNumberUnary):
9980         (JSC::DFG::AbstractState::speculateBooleanUnary):
9981         (JSC::DFG::AbstractState::speculateInt32Binary):
9982         (JSC::DFG::AbstractState::speculateNumberBinary):
9983         * dfg/DFGNode.h:
9984         (JSC::DFG::Node::mergeFlags):
9985         (JSC::DFG::Node::filterFlags):
9986         (Node):
9987         (JSC::DFG::Node::setCanExit):
9988         (JSC::DFG::Node::canExit):
9989         * dfg/DFGNodeFlags.cpp:
9990         (JSC::DFG::nodeFlagsAsString):
9991         * dfg/DFGNodeFlags.h:
9992         (DFG):
9993         * dfg/DFGSpeculativeJIT.cpp:
9994         (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
9995         (JSC::DFG::SpeculativeJIT::checkArgumentTypes):
9996         (JSC::DFG::SpeculativeJIT::compileValueToInt32):
9997         * dfg/DFGSpeculativeJIT.h:
9998         (JSC::DFG::SpeculativeJIT::speculationCheck):
9999         (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
10000         (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):
10001         (SpeculativeJIT):
10002         * dfg/DFGSpeculativeJIT32_64.cpp:
10003         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
10004         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
10005         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
10006         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
10007         (JSC::DFG::SpeculativeJIT::compile):
10008         * dfg/DFGSpeculativeJIT64.cpp:
10009         (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
10010         (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
10011         (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
10012         (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
10013         (JSC::DFG::SpeculativeJIT::compile):
10014
10015 2012-05-20  Filip Pizlo  <fpizlo@apple.com>
10016
10017         DFG should not do unnecessary indirections when storing to objects
10018         https://bugs.webkit.org/show_bug.cgi?id=86959
10019
10020         Reviewed by Oliver Hunt.
10021
10022         Merged r117819 from dfgopt.
10023
10024         * dfg/DFGByteCodeParser.cpp:
10025         (JSC::DFG::ByteCodeParser::parseBlock):
10026         * dfg/DFGCSEPhase.cpp:
10027         (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
10028         * dfg/DFGSpeculativeJIT32_64.cpp:
10029         (JSC::DFG::SpeculativeJIT::compile):
10030         * dfg/DFGSpeculativeJIT64.cpp:
10031         (JSC::DFG::SpeculativeJIT::compile):
10032
10033 2012-05-17  Filip Pizlo  <fpizlo@apple.com>
10034
10035         DFG should optimize aliased uses of the Arguments object of the current call frame
10036         https://bugs.webkit.org/show_bug.cgi?id=86552
10037
10038         Reviewed by Geoff Garen.
10039
10040         Merged r117542 and r117543 from dfgopt.
10041
10042         Performs must-alias and escape analysis on uses of CreateArguments, and if
10043         a variable is must-aliased to CreateArguments and does not escape, then we
10044         turn all uses of that variable into direct arguments accesses.
10045
10046         36% speed-up on V8/earley leading to a 2.3% speed-up overall in V8.
10047
10048         * bytecode/CodeBlock.h:
10049         (JSC::CodeBlock::uncheckedArgumentsRegister):
10050         * bytecode/ValueRecovery.h:
10051         (JSC::ValueRecovery::argumentsThatWereNotCreated):
10052         (ValueRecovery):
10053         (JSC::ValueRecovery::dump):
10054         * dfg/DFGAbstractState.cpp:
10055         (JSC::DFG::AbstractState::execute):
10056         * dfg/DFGAdjacencyList.h:
10057         (AdjacencyList):
10058         (JSC::DFG::AdjacencyList::removeEdgeFromBag):
10059         * dfg/DFGArgumentsSimplificationPhase.cpp:
10060         (JSC::DFG::ArgumentsSimplificationPhase::run):
10061         (ArgumentsSimplificationPhase):
10062         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse):
10063         (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses):
10064         (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse):
10065         (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize):
10066         (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild):
10067         * dfg/DFGAssemblyHelpers.h:
10068         (JSC::DFG::AssemblyHelpers::argumentsRegisterFor):
10069         (AssemblyHelpers):
10070         * dfg/DFGByteCodeParser.cpp:
10071         (JSC::DFG::ByteCodeParser::parseBlock):
10072         * dfg/DFGCFGSimplificationPhase.cpp:
10073         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
10074         * dfg/DFGGPRInfo.h:
10075         (GPRInfo):
10076         * dfg/DFGGraph.cpp:
10077         (JSC::DFG::Graph::collectGarbage):
10078         (DFG):
10079         * dfg/DFGGraph.h:
10080         (Graph):
10081         (JSC::DFG::Graph::executableFor):
10082         (JSC::DFG::Graph::argumentsRegisterFor):
10083         (JSC::DFG::Graph::uncheckedArgumentsRegisterFor):
10084         (JSC::DFG::Graph::clobbersWorld):
10085         * dfg/DFGNode.h:
10086         (JSC::DFG::Node::hasHeapPrediction):
10087         * dfg/DFGNodeType.h:
10088         (DFG):
10089         * dfg/DFGOSRExitCompiler.cpp:
10090         * dfg/DFGOSRExitCompiler.h:
10091         (JSC::DFG::OSRExitCompiler::OSRExitCompiler):
10092         (OSRExitCompiler):
10093         * dfg/DFGOSRExitCompiler32_64.cpp:
10094         (JSC::DFG::OSRExitCompiler::compileExit):
10095         * dfg/DFGOSRExitCompiler64.cpp:
10096         (JSC::DFG::OSRExitCompiler::compileExit):
10097         * dfg/DFGOperations.cpp:
10098         * dfg/DFGPredictionPropagationPhase.cpp:
10099         (JSC::DFG::PredictionPropagationPhase::propagate):
10100         * dfg/DFGSpeculativeJIT.cpp:
10101         (JSC::DFG::ValueSource::dump):
10102         (JSC::DFG::SpeculativeJIT::compile):
10103         (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
10104         * dfg/DFGSpeculativeJIT.h:
10105         * dfg/DFGSpeculativeJIT32_64.cpp:
10106         (JSC::DFG::SpeculativeJIT::compile):
10107         * dfg/DFGSpeculativeJIT64.cpp:
10108         (JSC::DFG::SpeculativeJIT::compile):
10109         * dfg/DFGVariableAccessData.h:
10110         (JSC::DFG::VariableAccessData::VariableAccessData):
10111         (JSC::DFG::VariableAccessData::mergeIsArgumentsAlias):
10112         (VariableAccessData):
10113         (JSC::DFG::VariableAccessData::isArgumentsAlias):
10114         * jit/JITOpcodes.cpp:
10115         (JSC::JIT::emitSlow_op_get_argument_by_val):
10116
10117 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10118
10119         DFGCapabilities should not try to get an arguments register from code blocks that don't have one
10120         https://bugs.webkit.org/show_bug.cgi?id=87332
10121
10122         Reviewed by Andy Estes.
10123
10124         * dfg/DFGCapabilities.h:
10125         (JSC::DFG::canInlineOpcode):
10126
10127 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10128
10129         DFG should have sparse conditional constant propagation
10130         https://bugs.webkit.org/show_bug.cgi?id=86580
10131
10132         Reviewed by Oliver Hunt.
10133
10134         Merged r117370 from dfgopt.
10135
10136         This enhances CFA so that if it suspects at any point during the fixpoint that a
10137         branch will only go one way, then it only propagates in that one way.
10138
10139         This vastly increases the opportunities for CFG simplification. For example, it
10140         enables us to evaporate this loop:
10141
10142         for (var i = 0; i < 1; ++i) doThings(i);
10143
10144         As a result, it uncovered loads of bugs in the CFG simplifier. In particular:
10145
10146         - Phi fixup was assuming that all Phis worth fixing up are shouldGenerate().
10147           That's not true; we also fixup Phis that are dead.
10148
10149         - GetLocal fixup was assuming that it's only necessary to rewire links to a
10150           GetLocal, and that the GetLocal's own links don't need to be rewired. Untrue,
10151           because the GetLocal may not be rewirable (first block has no GetLocal for r42
10152           but second block does have a GetLocal), in which case it will refer to a Phi
10153           in the second block. We need it to refer to a Phi from the first block to
10154           ensure that subsequent transformations work.
10155
10156         - Tail operand fixup was ignoring the fact that Phis in successors may contain
10157           references to the children of our tail variables. Hence, successor Phi child
10158           substitution needs to use the original second block variable table as its
10159           prior, rather than trying to reconstruct the prior later (since by that point
10160           the children of the second block's tail variables will have been fixed up, so
10161           we will not know what the prior would have been).
10162
10163         * dfg/DFGAbstractState.cpp:
10164         (JSC::DFG::AbstractState::beginBasicBlock):
10165         (JSC::DFG::AbstractState::endBasicBlock):
10166         (JSC::DFG::AbstractState::reset):
10167         (JSC::DFG::AbstractState::execute):
10168         (JSC::DFG::AbstractState::mergeToSuccessors):
10169         * dfg/DFGAbstractState.h:
10170         (JSC::DFG::AbstractState::branchDirectionToString):
10171         (AbstractState):
10172         * dfg/DFGCFGSimplificationPhase.cpp:
10173         (JSC::DFG::CFGSimplificationPhase::run):
10174         (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference):
10175         (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::OperandSubstitution):
10176         (OperandSubstitution):
10177         (JSC::DFG::CFGSimplificationPhase::skipGetLocal):
10178         (JSC::DFG::CFGSimplificationPhase::recordPossibleIncomingReference):
10179         (CFGSimplificationPhase):
10180         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
10181         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
10182         * dfg/DFGGraph.h:
10183         (JSC::DFG::Graph::changeEdge):
10184
10185 2012-05-23  Ojan Vafai  <ojan@chromium.org>
10186
10187         add back the ability to disable flexbox
10188         https://bugs.webkit.org/show_bug.cgi?id=87147
10189
10190         Reviewed by Tony Chang.
10191
10192         * Configurations/FeatureDefines.xcconfig:
10193
10194 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10195
10196         Unreviewed, fix Windows build.
10197
10198         * bytecode/CodeBlock.h:
10199         * dfg/DFGCapabilities.h:
10200         (JSC::DFG::canCompileOpcode):
10201         (JSC::DFG::canCompileOpcodes):
10202         * dfg/DFGCommon.h:
10203         (DFG):
10204
10205 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10206
10207         DFG should optimize inlined uses of arguments.length and arguments[i]
10208         https://bugs.webkit.org/show_bug.cgi?id=86327
10209
10210         Reviewed by Gavin Barraclough.
10211
10212         Merged r117017 from dfgopt.
10213
10214         Turns inlined uses of arguments.length into a constant.
10215
10216         Turns inlined uses of arguments[constant] into a direct reference to the
10217         argument.
10218
10219         Big win on micro-benchmarks. Not yet a win on V8 because the hot uses of
10220         arguments.length and arguments[i] are aliased. I'll leave the aliasing
10221         optimizations to a later patch.
10222
10223         * CMakeLists.txt:
10224         * GNUmakefile.list.am:
10225         * JavaScriptCore.xcodeproj/project.pbxproj:
10226         * Target.pri:
10227         * bytecode/DFGExitProfile.h:
10228         (FrequentExitSite):
10229         (JSC::DFG::FrequentExitSite::FrequentExitSite):
10230         (JSC::DFG::QueryableExitProfile::hasExitSite):
10231         (QueryableExitProfile):
10232         * dfg/DFGAbstractState.cpp:
10233         (JSC::DFG::AbstractState::execute):
10234         * dfg/DFGArgumentsSimplificationPhase.cpp: Added.
10235         (DFG):
10236         (ArgumentsSimplificationPhase):
10237         (JSC::DFG::ArgumentsSimplificationPhase::ArgumentsSimplificationPhase):
10238         (JSC::DFG::ArgumentsSimplificationPhase::run):
10239         (JSC::DFG::performArgumentsSimplification):
10240         * dfg/DFGArgumentsSimplificationPhase.h: Added.
10241         (DFG):
10242         * dfg/DFGAssemblyHelpers.cpp:
10243         (JSC::DFG::AssemblyHelpers::executableFor):
10244         (DFG):
10245         * dfg/DFGAssemblyHelpers.h:
10246         (AssemblyHelpers):
10247         * dfg/DFGByteCodeParser.cpp:
10248         (JSC::DFG::ByteCodeParser::parseBlock):
10249         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
10250         * dfg/DFGCSEPhase.cpp:
10251         (JSC::DFG::CSEPhase::getLocalLoadElimination):
10252         (JSC::DFG::CSEPhase::performNodeCSE):
10253         * dfg/DFGDriver.cpp:
10254         (JSC::DFG::compile):
10255         * dfg/DFGGraph.h:
10256         (JSC::DFG::Graph::Graph):
10257         (JSC::DFG::Graph::executableFor):
10258         (Graph):
10259         (JSC::DFG::Graph::clobbersWorld):
10260         * dfg/DFGNode.h:
10261         (JSC::DFG::Node::convertToConstant):
10262         (JSC::DFG::Node::convertToGetLocalUnlinked):
10263         (Node):
10264         (JSC::DFG::Node::unlinkedLocal):
10265         * dfg/DFGNodeType.h:
10266         (DFG):
10267         * dfg/DFGOSRExit.cpp:
10268         (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
10269         * dfg/DFGPredictionPropagationPhase.cpp:
10270         (JSC::DFG::PredictionPropagationPhase::propagate):
10271         * dfg/DFGSpeculativeJIT32_64.cpp:
10272         (JSC::DFG::SpeculativeJIT::compile):
10273         * dfg/DFGSpeculativeJIT64.cpp:
10274         (JSC::DFG::SpeculativeJIT::compile):
10275
10276 2012-05-13  Filip Pizlo  <fpizlo@apple.com>
10277
10278         DFG should be able to optimize foo.apply(bar, arguments)
10279         https://bugs.webkit.org/show_bug.cgi?id=86306
10280
10281         Reviewed by Gavin Barraclough.
10282
10283         Merge r116912 from dfgopt.
10284
10285         Enables compilation of op_jneq_ptr and some forms of op_call_varargs.
10286
10287         Also includes a bunch of bug fixes that were made necessary by the increased
10288         pressure on the CFG simplifier.
10289
10290         This is a 1-2% win on V8.
10291
10292         * bytecode/CodeBlock.cpp:
10293         (JSC::CodeBlock::printCallOp):
10294         (JSC::CodeBlock::CodeBlock):
10295         (JSC::ProgramCodeBlock::canCompileWithDFGInternal):
10296         (JSC::EvalCodeBlock::canCompileWithDFGInternal):
10297         (JSC::FunctionCodeBlock::canCompileWithDFGInternal):
10298         * bytecode/CodeBlock.h:
10299         (CodeBlock):
10300         (JSC::CodeBlock::canCompileWithDFG):
10301         (JSC::CodeBlock::canCompileWithDFGState):
10302         (ProgramCodeBlock):
10303         (EvalCodeBlock):
10304         (FunctionCodeBlock):
10305         * dfg/DFGAbstractState.cpp:
10306         (JSC::DFG::AbstractState::execute):
10307         * dfg/DFGByteCodeParser.cpp:
10308         (JSC::DFG::ByteCodeParser::parseBlock):
10309         (JSC::DFG::ByteCodeParser::processPhiStack):
10310         (JSC::DFG::ByteCodeParser::parse):
10311         * dfg/DFGCFGSimplificationPhase.cpp:
10312         (JSC::DFG::CFGSimplificationPhase::run):
10313         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
10314         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
10315         (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
10316         * dfg/DFGCSEPhase.cpp:
10317         (JSC::DFG::CSEPhase::getLocalLoadElimination):
10318         (CSEPhase):
10319         (JSC::DFG::CSEPhase::setReplacement):
10320         (JSC::DFG::CSEPhase::performNodeCSE):
10321         * dfg/DFGCapabilities.cpp:
10322         (JSC::DFG::debugFail):
10323         (DFG):
10324         (JSC::DFG::canHandleOpcodes):
10325         (JSC::DFG::canCompileOpcodes):
10326         (JSC::DFG::canInlineOpcodes):
10327         * dfg/DFGCapabilities.h:
10328         (JSC::DFG::canCompileOpcode):
10329         (JSC::DFG::canInlineOpcode):
10330         (DFG):
10331         (JSC::DFG::canCompileOpcodes):
10332         (JSC::DFG::canCompileEval):
10333         (JSC::DFG::canCompileProgram):
10334         (JSC::DFG::canCompileFunctionForCall):
10335         (JSC::DFG::canCompileFunctionForConstruct):
10336         * dfg/DFGCommon.h:
10337         * dfg/DFGGraph.cpp:
10338         (JSC::DFG::Graph::dump):
10339         * dfg/DFGNodeType.h:
10340         (DFG):
10341         * dfg/DFGPredictionPropagationPhase.cpp:
10342         (JSC::DFG::PredictionPropagationPhase::propagate):
10343         * dfg/DFGSpeculativeJIT32_64.cpp:
10344         (JSC::DFG::SpeculativeJIT::compile):
10345         * dfg/DFGSpeculativeJIT64.cpp:
10346         (JSC::DFG::SpeculativeJIT::emitCall):
10347         (JSC::DFG::SpeculativeJIT::compile):
10348         * dfg/DFGValidate.cpp:
10349         (Validate):
10350         (JSC::DFG::Validate::validate):
10351         (JSC::DFG::Validate::checkOperand):
10352         (JSC::DFG::Validate::reportValidationContext):
10353         * jit/JIT.cpp:
10354         (JSC::JIT::emitOptimizationCheck):
10355         (JSC::JIT::privateCompileSlowCases):
10356         (JSC::JIT::privateCompile):
10357         * jit/JIT.h:
10358         * jit/JITArithmetic.cpp:
10359         (JSC::JIT::compileBinaryArithOp):
10360         * jit/JITPropertyAccess.cpp:
10361         (JSC::JIT::privateCompilePutByIdTransition):
10362         * jit/JITPropertyAccess32_64.cpp:
10363         (JSC::JIT::privateCompilePutByIdTransition):
10364         * tools/CodeProfile.cpp:
10365         (JSC::CodeProfile::sample):
10366
10367 2012-05-23  Geoffrey Garen  <ggaren@apple.com>
10368
10369         Refactored WeakBlock to use malloc, clarify behavior
10370         https://bugs.webkit.org/show_bug.cgi?id=87318
10371
10372         Reviewed by Filip Pizlo.
10373
10374         We want to use malloc so we can make these smaller than 4KB,
10375         since an individual MarkedBlock will usually have fewer than
10376         4KB worth of weak pointers.
10377
10378         * heap/Heap.cpp:
10379         (JSC::Heap::markRoots): Renamed visitLiveWeakImpls to visit, since
10380         we no longer need to distinguish from "visitDeadWeakImpls".
10381
10382         Renamed "visitDeadWeakImpls" to "reap" because we're not actually
10383         doing any visiting -- we're just tagging things as dead.
10384
10385         * heap/WeakBlock.cpp:
10386         (JSC::WeakBlock::create):
10387         (JSC::WeakBlock::destroy):
10388         (JSC::WeakBlock::WeakBlock): Malloc!
10389
10390         (JSC::WeakBlock::visit):
10391         (JSC::WeakBlock::reap): Renamed as above.
10392
10393         * heap/WeakBlock.h:
10394         (WeakBlock): Reduced to 3KB, as explained above.
10395
10396         * heap/WeakSet.cpp:
10397         (JSC::WeakSet::visit):
10398         (JSC::WeakSet::reap):
10399         * heap/WeakSet.h:
10400         (WeakSet): Updated for renames, and to match WebKit style.
10401
10402 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10403
10404         Use after free in JSC::DFG::ByteCodeParser::processPhiStack
10405         https://bugs.webkit.org/show_bug.cgi?id=87312
10406         <rdar://problem/11518848>
10407
10408         Reviewed by Oliver Hunt.
10409
10410         * dfg/DFGByteCodeParser.cpp:
10411         (JSC::DFG::ByteCodeParser::processPhiStack):
10412         (JSC::DFG::ByteCodeParser::parse):
10413
10414 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10415
10416         It should be possible to make C function calls from DFG code on ARM in debug mode
10417         https://bugs.webkit.org/show_bug.cgi?id=87313
10418
10419         Reviewed by Gavin Barraclough.
10420
10421         * dfg/DFGSpeculativeJIT.h:
10422         (SpeculativeJIT):
10423
10424 2012-05-11  Filip Pizlo  <fpizlo@apple.com>
10425
10426         DFG should be able to inline functions that use arguments reflectively
10427         https://bugs.webkit.org/show_bug.cgi?id=86132
10428
10429         Reviewed by Oliver Hunt.
10430
10431         Merged r116838 from dfgopt.
10432
10433         This turns on inlining of functions that use arguments reflectively, but it
10434         does not do any of the obvious optimizations that this exposes. I'll save that
10435         for another patch - the important thing for now is that this contains all of
10436         the plumbing necessary to make this kind of inlining sound even in bizarro
10437         cases like an inline callee escaping the arguments object to parts of the
10438         inline caller where the arguments are otherwise dead. Or even more fun cases
10439         like where you've inlined to an inline stack that is three-deep, and the
10440         function on top of the inline stack reflectively accesses the arguments of a
10441         function that is in the middle of the inline stack. Any subsequent
10442         optimizations that we do for the obvious cases of arguments usage in inline
10443         functions will have to take care not to break the baseline functionality that
10444         this patch plumbs together.
10445
10446         * bytecode/CodeBlock.cpp:
10447         (JSC::CodeBlock::printCallOp):
10448         (JSC::CodeBlock::dump):
10449         * bytecode/CodeBlock.h:
10450         * dfg/DFGAssemblyHelpers.h:
10451         (JSC::DFG::AssemblyHelpers::argumentsRegisterFor):
10452         (AssemblyHelpers):
10453         * dfg/DFGByteCodeParser.cpp:
10454         (InlineStackEntry):
10455         (JSC::DFG::ByteCodeParser::handleCall):
10456         (JSC::DFG::ByteCodeParser::handleInlining):
10457         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
10458         (JSC::DFG::ByteCodeParser::parse):
10459         * dfg/DFGCCallHelpers.h:
10460         (JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
10461         (CCallHelpers):
10462         * dfg/DFGCapabilities.h:
10463         (JSC::DFG::canInlineOpcode):
10464         * dfg/DFGDriver.cpp:
10465         (JSC::DFG::compile):
10466         * dfg/DFGFixupPhase.cpp:
10467         (JSC::DFG::FixupPhase::fixupNode):
10468         * dfg/DFGOperations.cpp:
10469         * dfg/DFGOperations.h:
10470         * dfg/DFGSpeculativeJIT.h:
10471         (JSC::DFG::SpeculativeJIT::callOperation):
10472         * dfg/DFGSpeculativeJIT32_64.cpp:
10473         (JSC::DFG::SpeculativeJIT::compile):
10474         * dfg/DFGSpeculativeJIT64.cpp:
10475         (JSC::DFG::SpeculativeJIT::compile):
10476         * interpreter/CallFrame.cpp:
10477         (JSC):
10478         (JSC::CallFrame::someCodeBlockForPossiblyInlinedCode):
10479         * interpreter/CallFrame.h:
10480         (ExecState):
10481         (JSC::ExecState::someCodeBlockForPossiblyInlinedCode):
10482         * interpreter/Interpreter.cpp:
10483         (JSC::Interpreter::retrieveArgumentsFromVMCode):
10484         * runtime/Arguments.cpp:
10485         (JSC::Arguments::tearOff):
10486         (JSC):
10487         (JSC::Arguments::tearOffForInlineCallFrame):
10488         * runtime/Arguments.h:
10489         (Arguments):
10490         (JSC::Arguments::create):
10491         (JSC::Arguments::finishCreation):
10492         (JSC):
10493
10494 2012-05-23  Filip Pizlo  <fpizlo@apple.com>
10495
10496         Every OSR exit on ARM results in a crash
10497         https://bugs.webkit.org/show_bug.cgi?id=87307
10498
10499         Reviewed by Geoffrey Garen.
10500
10501         * dfg/DFGThunks.cpp:
10502         (JSC::DFG::osrExitGenerationThunkGenerator):
10503
10504 2012-05-23  Geoffrey Garen  <ggaren@apple.com>
10505
10506         Refactored heap tear-down to use normal value semantics (i.e., destructors)
10507         https://bugs.webkit.org/show_bug.cgi?id=87302
10508
10509         Reviewed by Oliver Hunt.
10510
10511         This is a step toward incremental DOM finalization.
10512
10513         * heap/CopiedSpace.cpp:
10514         (JSC::CopiedSpace::~CopiedSpace):
10515         * heap/CopiedSpace.h:
10516         (CopiedSpace): Just use our destructor, instead of relying on the heap
10517         to send us a special message at a special time.
10518
10519         * heap/Heap.cpp:
10520         (JSC::Heap::Heap): Use OwnPtr for m_markListSet because this is not Sparta.
10521
10522         (JSC::Heap::~Heap): No need for delete or freeAllBlocks because normal
10523         destructors do this work automatically now.
10524
10525         (JSC::Heap::lastChanceToFinalize): Just call lastChanceToFinalize on our
10526         sub-objects, and assume it does the right thing. This improves encapsulation,
10527         so we can add items requiring finalization to our sub-objects.
10528
10529         * heap/Heap.h: Moved m_blockAllocator to get the right destruction order.
10530
10531         * heap/MarkedSpace.cpp:
10532         (Take):
10533         (JSC):
10534         (JSC::Take::Take):
10535         (JSC::Take::operator()):
10536         (JSC::Take::returnValue): Moved to the top of the file so it can be used
10537         in another function.
10538
10539         (JSC::MarkedSpace::~MarkedSpace): Delete all outstanding memory, like a good
10540         destructor should.
10541
10542         (JSC::MarkedSpace::lastChanceToFinalize): Moved some code here from the heap,
10543         since it pertains to our internal implementation details.
10544
10545         * heap/MarkedSpace.h:
10546         (MarkedSpace):
10547         * heap/WeakBlock.cpp:
10548         (JSC::WeakBlock::lastChanceToFinalize):
10549         * heap/WeakBlock.h:
10550         (WeakBlock):
10551         * heap/WeakSet.cpp:
10552         (JSC::WeakSet::lastChanceToFinalize):
10553         * heap/WeakSet.h:
10554         (WeakSet): Stop using a special freeAllBlocks() callback and just implement
10555         lastChanceToFinalize.
10556
10557 2011-05-22  Geoffrey Garen  <ggaren@apple.com>
10558
10559         Encapsulated some calculations for whether portions of the heap are empty
10560         https://bugs.webkit.org/show_bug.cgi?id=87210
10561
10562         Reviewed by Gavin Barraclough.
10563
10564         This is a step toward incremental DOM finalization.
10565
10566         * heap/Heap.cpp:
10567         (JSC::Heap::~Heap): Explicitly call freeAllBlocks() instead of relying
10568         implicitly on all blocks thinking they're empty. In future, we may
10569         choose to tear down the heap without first setting all data structures
10570         to "empty".
10571
10572         * heap/MarkedBlock.h:
10573         (JSC::MarkedBlock::isEmpty):
10574         (JSC::MarkedBlock::gatherDirtyCells): Renamed markCountIsZero to isEmpty,
10575         in preparation for making it check for outstanding finalizers in addition
10576         to marked cells.
10577
10578         * heap/MarkedSpace.cpp:
10579         (Take):
10580         (JSC::Take::Take):
10581         (JSC::Take::operator()):
10582         (JSC::Take::returnValue):
10583         (JSC::MarkedSpace::shrink):
10584         (JSC::MarkedSpace::freeAllBlocks): Refactored the "Take" functor to support
10585         a conditional isEmpty check, so it dould be shared by shrink() and freeAllBlocks().
10586
10587         * heap/WeakBlock.cpp:
10588         (JSC::WeakBlock::WeakBlock):
10589         (JSC::WeakBlock::visitLiveWeakImpls):
10590         (JSC::WeakBlock::visitDeadWeakImpls):
10591         * heap/WeakBlock.h:
10592         (WeakBlock):
10593         (JSC::WeakBlock::isEmpty):
10594         * heap/WeakSet.cpp:
10595         (JSC::WeakSet::sweep):
10596         (JSC::WeakSet::shrink): Use isEmpty(), in preparation for changes in
10597         its implementation.
10598
10599 2012-05-23  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
10600
10601         [Qt] Remove references to $$QT_SOURCE_TREE
10602
10603         With a modularized Qt, it's ambigious. What we really want is qtbase,
10604         which qtcore is a proxy for (we assume it will always live in qtbase).
10605
10606         Reviewed by Tor Arne Vestbø.
10607
10608         * JavaScriptCore.pri:
10609         * Target.pri:
10610
10611 2012-05-09  Filip Pizlo  <fpizlo@apple.com>
10612
10613         DFG should allow inlining in case of certain arity mismatches
10614         https://bugs.webkit.org/show_bug.cgi?id=86059
10615
10616         Reviewed by Geoff Garen.
10617
10618         Merge r116620 from dfgopt.
10619
10620         * dfg/DFGByteCodeParser.cpp:
10621         (JSC::DFG::ByteCodeParser::handleInlining):
10622
10623 2012-05-08  Filip Pizlo  <fpizlo@apple.com>
10624
10625         DFG variable capture analysis should work even if the variables arose through inlining
10626         https://bugs.webkit.org/show_bug.cgi?id=85945
10627
10628         Reviewed by Oliver Hunt.
10629
10630         Merged r116555 from dfgopt.
10631
10632         This just changes how the DFG queries whether a variable is captured. It does not
10633         change any user-visible behavior.
10634
10635         As part of this change, I further solidified the policy that the CFA behaves in an
10636         undefined way for captured locals and queries about their values will not yield
10637         reliable results. This will likely be changed in the future, but for now it makes
10638         sense.
10639
10640         One fun part about this change is that it recognizes that the same variable may
10641         be both captured and not, at the same time, because their live interval spans
10642         inlining boundaries. This only happens in the case of arguments to functions that
10643         capture their arguments, and this change treats them with just the right touch of
10644         conservatism: they will be treated as if captured by the caller as well as the
10645         callee.
10646
10647         Finally, this also adds captured variable reasoning to the InlineCallFrame, which
10648         I thought might be useful for later tooling.
10649
10650         This is perf-neutral, since it does it does not make the DFG take advantage of this
10651         new functionality in any way. In particular, it is still the case that the DFG will
10652         not inline functions that use arguments reflectively or that create activations.
10653
10654         * bytecode/CodeBlock.h:
10655         (CodeBlock):
10656         (JSC::CodeBlock::needsActivation):
10657         (JSC::CodeBlock::argumentIsCaptured):
10658         (JSC::CodeBlock::localIsCaptured):
10659         (JSC::CodeBlock::isCaptured):
10660         * bytecode/CodeOrigin.h:
10661         (InlineCallFrame):
10662         * dfg/DFGAbstractState.cpp:
10663         (JSC::DFG::AbstractState::initialize):
10664         (JSC::DFG::AbstractState::endBasicBlock):
10665         (JSC::DFG::AbstractState::execute):
10666         (JSC::DFG::AbstractState::merge):
10667         * dfg/DFGByteCodeParser.cpp:
10668         (JSC::DFG::ByteCodeParser::newVariableAccessData):
10669         (JSC::DFG::ByteCodeParser::getLocal):
10670         (JSC::DFG::ByteCodeParser::setLocal):
10671         (JSC::DFG::ByteCodeParser::getArgument):
10672         (JSC::DFG::ByteCodeParser::setArgument):
10673         (JSC::DFG::ByteCodeParser::flushArgument):
10674         (JSC::DFG::ByteCodeParser::parseBlock):
10675         (JSC::DFG::ByteCodeParser::processPhiStack):
10676         (JSC::DFG::ByteCodeParser::fixVariableAccessPredictions):
10677         (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
10678         * dfg/DFGCFGSimplificationPhase.cpp:
10679         (CFGSimplificationPhase):
10680         (JSC::DFG::CFGSimplificationPhase::keepOperandAlive):
10681         (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal):
10682         (JSC::DFG::CFGSimplificationPhase::fixTailOperand):
10683         * dfg/DFGCommon.h:
10684         * dfg/DFGFixupPhase.cpp:
10685         (JSC::DFG::FixupPhase::fixupNode):
10686         * dfg/DFGGraph.cpp:
10687         (JSC::DFG::Graph::nameOfVariableAccessData):
10688         * dfg/DFGGraph.h:
10689         (JSC::DFG::Graph::needsActivation):
10690         (JSC::DFG::Graph::usesArguments):
10691         * dfg/DFGPredictionPropagationPhase.cpp:
10692         (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting):
10693         * dfg/DFGSpeculativeJIT.cpp:
10694         (JSC::DFG::SpeculativeJIT::compile):
10695         * dfg/DFGSpeculativeJIT32_64.cpp:
10696         (JSC::DFG::SpeculativeJIT::compile):
10697         * dfg/DFGSpeculativeJIT64.cpp:
10698         (JSC::DFG::SpeculativeJIT::compile):
10699         * dfg/DFGVariableAccessData.h:
10700         (JSC::DFG::VariableAccessData::VariableAccessData):
10701         (JSC::DFG::VariableAccessData::mergeIsCaptured):
10702         (VariableAccessData):
10703         (JSC::DFG::VariableAccessData::isCaptured):
10704
10705 2012-05-08  Filip Pizlo  <fpizlo@apple.com>
10706
10707         DFG should support op_get_argument_by_val and op_get_arguments_length
10708         https://bugs.webkit.org/show_bug.cgi?id=85911
10709
10710         Reviewed by Oliver Hunt.
10711
10712         Merged r116467 from dfgopt.
10713
10714         This adds a simple and relatively conservative implementation of op_get_argument_by_val
10715         and op_get_arguments_length. We can optimize these later. For now it's great to have
10716         the additional coverage.
10717
10718         This patch appears to be perf-neutral.
10719
10720         * dfg/DFGAbstractState.cpp:
10721         (JSC::DFG::AbstractState::execute):
10722         * dfg/DFGAssemblyHelpers.h:
10723         (JSC::DFG::AssemblyHelpers::addressFor):
10724         (JSC::DFG::AssemblyHelpers::tagFor):
10725         (JSC::DFG::AssemblyHelpers::payloadFor):
10726         * dfg/DFGByteCodeParser.cpp:
10727         (JSC::DFG::ByteCodeParser::parseBlock):
10728         * dfg/DFGCapabilities.h:
10729         (JSC::DFG::canCompileOpcode):
10730         (JSC::DFG::canInlineOpcode):
10731         * dfg/DFGNode.h:
10732         (JSC::DFG::Node::hasHeapPrediction):
10733         * dfg/DFGNodeType.h:
10734         (DFG):
10735         * dfg/DFGOperations.cpp:
10736         * dfg/DFGOperations.h:
10737         * dfg/DFGPredictionPropagationPhase.cpp:
10738         (JSC::DFG::PredictionPropagationPhase::propagate):
10739         * dfg/DFGSpeculativeJIT.h:
10740         (JSC::DFG::SpeculativeJIT::callOperation):
10741         (SpeculativeJIT):
10742         * dfg/DFGSpeculativeJIT32_64.cpp:
10743         (JSC::DFG::SpeculativeJIT::compile):
10744         * dfg/DFGSpeculativeJIT64.cpp:
10745         (JSC::DFG::SpeculativeJIT::compile):
10746         * jit/JITOpcodes.cpp:
10747         (JSC::JIT::emit_op_get_argument_by_val):
10748         * jit/JITOpcodes32_64.cpp:
10749         (JSC::JIT::emit_op_get_argument_by_val):
10750         * llint/LowLevelInterpreter32_64.asm:
10751         * llint/LowLevelInterpreter64.asm:
10752
10753 2012-05-07  Filip Pizlo  <fpizlo@apple.com>
10754
10755         DFG should support op_tear_off_arguments
10756         https://bugs.webkit.org/show_bug.cgi?id=85847
10757
10758         Reviewed by Michael Saboff.
10759
10760         Merged r116378 from dfgopt.
10761
10762         * dfg/DFGAbstractState.cpp:
10763         (JSC::DFG::AbstractState::execute):
10764         * dfg/DFGByteCodeParser.cpp:
10765         (JSC::DFG::ByteCodeParser::parseBlock):
10766         * dfg/DFGCapabilities.h:
10767         (JSC::DFG::canCompileOpcode):
10768         (JSC::DFG::canInlineOpcode):
10769         * dfg/DFGNodeType.h:
10770         (DFG):
10771         * dfg/DFGOperations.cpp:
10772         * dfg/DFGOperations.h:
10773         * dfg/DFGPredictionPropagationPhase.cpp:
10774         (JSC::DFG::PredictionPropagationPhase::propagate):
10775         * dfg/DFGSpeculativeJIT.h:
10776         (SpeculativeJIT):
10777         (JSC::DFG::SpeculativeJIT::callOperation):
10778         * dfg/DFGSpeculativeJIT32_64.cpp:
10779         (JSC::DFG::SpeculativeJIT::compile):
10780         * dfg/DFGSpeculativeJIT64.cpp:
10781         (JSC::DFG::SpeculativeJIT::compile):
10782
10783 2012-05-22  Mark Hahnenberg  <mhahnenberg@apple.com>
10784
10785         CopiedSpace::contains doesn't check for oversize blocks
10786         https://bugs.webkit.org/show_bug.cgi?id=87180
10787
10788         Reviewed by Geoffrey Garen.
10789
10790         When doing a conservative scan we use CopiedSpace::contains to determine if a particular
10791         address points into the CopiedSpace. Currently contains() only checks if the address
10792         points to a block in to-space, which means that pointers to oversize blocks may not get scanned.
10793
10794         * heap/CopiedSpace.cpp:
10795         (JSC::CopiedSpace::tryAllocateOversize):
10796         (JSC::CopiedSpace::tryReallocateOversize):
10797         (JSC::CopiedSpace::doneFillingBlock):
10798         (JSC::CopiedSpace::doneCopying):
10799         * heap/CopiedSpace.h: Refactored CopiedSpace so that all blocks (oversize and to-space) are
10800         in a single hash set and bloom filter for membership testing.
10801         (CopiedSpace):
10802         * heap/CopiedSpaceInlineMethods.h:
10803         (JSC::CopiedSpace::contains): We check for the normal block first. Since the oversize blocks are
10804         only page aligned, rather than block aligned, we have to re-mask the ptr to check if it's in
10805         CopiedSpace. Also added a helper function of the same name that takes a CopiedBlock* and checks
10806         if it's in CopiedSpace so that check isn't typed out twice.
10807         (JSC):
10808         (JSC::CopiedSpace::startedCopying):
10809         (JSC::CopiedSpace::addNewBlock):
10810
10811 2012-05-22  Geoffrey Garen  <ggaren@apple.com>
10812
10813         CopiedBlock and MarkedBlock should have proper value semantics (i.e., destructors)
10814         https://bugs.webkit.org/show_bug.cgi?id=87172
10815
10816         Reviewed by Oliver Hunt and Phil Pizlo.
10817
10818         This enables MarkedBlock to own non-trivial sub-objects that require
10819         destruction. It also fixes a FIXME about casting a CopiedBlock to a
10820         MarkedBlock at destroy time.
10821
10822         CopiedBlock and MarkedBlock now accept an allocation chunk at create
10823         time and return it at destroy time. Their client is expected to
10824         allocate, recycle, and destroy these chunks.
10825
10826         * heap/BlockAllocator.cpp:
10827         (JSC::BlockAllocator::releaseFreeBlocks):
10828         (JSC::BlockAllocator::blockFreeingThreadMain): Don't call MarkedBlock::destroy
10829         because we expect that to be called before a block is put on our free
10830         list now. Do manually deallocate our allocation chunk because that's
10831         our job now.
10832
10833         * heap/BlockAllocator.h:
10834         (BlockAllocator):
10835         (JSC::BlockAllocator::allocate): Allocate never fails now. This is a
10836         cleaner abstraction because only one object does all the VM allocation
10837         and deallocation. Caching is an implementation detail.
10838
10839         (JSC::BlockAllocator::deallocate): We take an allocation chunk argument
10840         instead of a block because we now expect the block to have been destroyed
10841         before we recycle its memory. For convenience, we still use the HeapBlock
10842         class as our linked list node. This is OK because HeapBlock is a POD type.
10843
10844         * heap/CopiedBlock.h:
10845         (CopiedBlock):
10846         (JSC::CopiedBlock::create):
10847         (JSC::CopiedBlock::destroy):
10848         (JSC::CopiedBlock::CopiedBlock): Added proper create and destroy functions,
10849         to match MarkedBlock.
10850
10851         * heap/CopiedSpace.cpp:
10852         (JSC::CopiedSpace::tryAllocateOversize):
10853         (JSC::CopiedSpace::tryReallocateOversize):
10854         (JSC::CopiedSpace::doneCopying):
10855         (JSC::CopiedSpace::getFreshBlock):
10856         (JSC::CopiedSpace::freeAllBlocks):
10857         * heap/CopiedSpaceInlineMethods.h:
10858         (JSC::CopiedSpace::recycleBlock): Make sure to call destroy before
10859         returning a block to the BlockAllocator. Otherwise, our destructors
10860         won't run. (If we get this wrong now, we'll get a compile error.)
10861
10862         * heap/HeapBlock.h:
10863         (JSC::HeapBlock::HeapBlock): const!
10864
10865         * heap/MarkedAllocator.cpp:
10866         (JSC::MarkedAllocator::allocateBlock): No need to distinguish between
10867         create and recycle -- MarkedBlock always accepts memory allocated by
10868         its client now.
10869
10870         * heap/MarkedBlock.cpp:
10871         (JSC::MarkedBlock::create): Don't allocate memory -- we assume that we're
10872         passed already-allocated memory, to clarify the responsibility for VM
10873         recycling.
10874
10875         (JSC::MarkedBlock::destroy): Do run our destructor before giving back
10876         our VM -- that is the whole point of this patch.
10877
10878         (JSC::MarkedBlock::MarkedBlock):
10879         * heap/MarkedBlock.h:
10880         (MarkedBlock):
10881         * heap/MarkedSpace.cpp: const!
10882
10883         (JSC::MarkedSpace::freeBlocks): Make sure to call destroy before
10884         returning a block to the BlockAllocator. Otherwise, our destructors
10885         won't run. (If we get this wrong now, we'll get a compile error.)
10886
10887 == Rolled over to ChangeLog-2012-05-22 ==