summaryrefslogtreecommitdiff
path: root/Source/JavaScriptCore
Commit message (Collapse)AuthorAgeFilesLines
* [mips] Wrong register usage in LLInt.old/5.2Balazs Kilvady2014-02-102-52/+115
| | | | | | | | | | | Fix register usage and add PIC header to all LLInt operations. This patch is taken from https://bugs.webkit.org/show_bug.cgi?id=125168. It fixes the crash of fast/js/exception-propagate-from-dfg-to-llint test on mips architecture. Change-Id: I98ad3b5766451cab48a76f7e028b210f9ebe99ed Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
* Do not completely erase LIBS variableJürgen Hunold2013-12-171-1/+0
| | | | | | | | | | Using an empty LIBS variable prevents usage of custom library paths and libraries via configure -L <path> -l <extra_lib>. This is needed for linking with an alternative stdlib implementation. Change-Id: Ie1009bfd435436bf584b2963066535ee90f4d5d0 Reviewed-by: Pierre Rossi <pierre.rossi@gmail.com> Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
* Merge remote-tracking branch 'origin/release' into stableFrederik Gladhorn2013-11-261-3/+3
|\ | | | | | | Change-Id: I9088052f76de19e584cd16fd039502de6b22bec2
| * Fix compilation on ARMSamuli Piippo2013-11-181-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | Android fix broke ARM compilation on non-Android Linux platforms. Now correcly define Elf32_auxv_t only on Android/Qt and otherwise include asm/hwcap.h Same fix was previously applied to QtScript, which had the exact same android problem (QTBUG-30978). Task-number: QTBUG-34917 Change-Id: I29d570731754c6291f8dc0c379e6fdc8ec72b897 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
* | [sh4] Fix revertJumpReplacementToBranchPtrWithPatch in MacroAssembler.commit-queue@webkit.org2013-11-202-11/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=124468 Patch by Julien Brianceau <jbriance@cisco.com> on 2013-11-17 Reviewed by Michael Saboff. Current implementation of revertJumpReplacementToBranchPtrWithPatch is wrong in the sh4 MacroAssembler part, leading to random instabilities. This patch fixes it and also renames the bad-named revertJumpToMove to revertJumpReplacementToBranchPtrWithPatch in the SH4Assembler. * assembler/MacroAssemblerSH4.h: (JSC::MacroAssemblerSH4::revertJumpReplacementToBranchPtrWithPatch): * assembler/SH4Assembler.h: (JSC::SH4Assembler::replaceWithJump): (JSC::SH4Assembler::revertJumpReplacementToBranchPtrWithPatch): Change-Id: Ifbc6851f506a1303c85cff3a47c23e932fad033c git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159400 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
* | [sh4] Protect repatchCompact from flushConstantPool.commit-queue@webkit.org2013-11-201-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=124278 Patch by Julien Brianceau <jbriance@cisco.com> on 2013-11-13 Reviewed by Michael Saboff. Random crashes may occur with sh4 architecture, when a flushConstantPool occurs in movlMemRegCompact. As in this case a branch opcode and the constant pool are put before the movlMemRegCompact, the branch itself is patched when calling repatchCompact instead of the mov instruction, which is really bad. * assembler/SH4Assembler.h: (JSC::SH4Assembler::repatchCompact): Handle this specific case and add an ASSERT. Change-Id: I9c0e78cade4d20d0d83d683ffe6a499cee63bdbb git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159203 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
* | [sh4] Fix load32WithUnalignedHalfWords function in baseline JIT.commit-queue@webkit.org2013-11-201-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=124233 Patch by Julien Brianceau <jbriance@cisco.com> on 2013-11-12 Reviewed by Michael Saboff. * assembler/MacroAssemblerSH4.h: (JSC::MacroAssemblerSH4::load32WithUnalignedHalfWords): Do not claim scratch register too early. Test already covered by fast/regex/pcre-test-1. Change-Id: Ib783d70723754e80d961ade9463d7dc85ccb83f0 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159153 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
* | [sh4] Refactor jumps in baseline JIT to return label after the jump.commit-queue@webkit.org2013-11-202-93/+33
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=123734 Patch by Julien Brianceau <jbriance@cisco.com> on 2013-11-04 Reviewed by Michael Saboff. Current implementation of jumps in sh4 baseline JIT returns a label on the jump itself and not after it. This is not correct and leads to issues like infinite loop the DFG (https://bugs.webkit.org/show_bug.cgi?id=122597 for instance). This refactor fixes this and also simplifies the link and relink procedures for sh4 jumps. * assembler/MacroAssemblerSH4.h: (JSC::MacroAssemblerSH4::branchDouble): (JSC::MacroAssemblerSH4::branchTrue): (JSC::MacroAssemblerSH4::branchFalse): * assembler/SH4Assembler.h: (JSC::SH4Assembler::jmp): (JSC::SH4Assembler::extraInstrForBranch): (JSC::SH4Assembler::jne): (JSC::SH4Assembler::je): (JSC::SH4Assembler::bra): (JSC::SH4Assembler::linkJump): (JSC::SH4Assembler::relinkJump): Change-Id: Ia31b326a1f3c41e9c913e513563ff1e6b8f8e55e git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158580 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
* Only use 64bit atomics when supportedAllan Sandfeld Jensen2013-10-281-9/+0
| | | | | | | | | | | | | | | | | | | | To support Windows XP we must avoid using the 64bit variants of the atomicIncrement/atomicDecrement operations which are only supported from Windows 2003 and up. This patch rolls back the minimum Win32 API version to WinNT 5.1 (32bit WinXP), and adds a new flag to indicate the support of 64bit atomics. The new flag is now also used to support MIPS and other architectures without 64bit intrinsics, instead of hacking in poor support. This also extends the atomic operations to sparc64 which was previously skipped because it did not work with __exchange_and_add. Task-number: QTBUG-34271 Change-Id: I21b09df3cafb7f0987a2f44c89036ff34ed34aa0 Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com> Reviewed-by: Kai Koehne <kai.koehne@digia.com>
* Fix build for boot2qt eAndroidAllan Sandfeld Jensen2013-10-212-5/+17
| | | | | | | | | | | | | | Reverts the removal of Android support in WTF, and brings the support up to date. Merged change to MacroAssemblerARM.cpp from QtScript. Replaces use of statvfs with statfs in one place. Replaces shm-based shared memory with ashmem-based in WebKit2. Change-Id: I440b1fbd94bb4148f7ba764d77de65230d13ed90 Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
* [sh4] Jump over maxJumpReplacementSize in revertJumpToMove.Julien Brianceau2013-10-211-10/+4
| | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=120007 Patch by Julien Brianceau <jbriance@cisco.com> on 2013-10-07 Reviewed by Oliver Hunt. Jump over maxJumpReplacementSize in revertJumpToMove, even if there is no constant value within the area. This patch fixes debug ASSERTs failures for sh4 architecture. * assembler/SH4Assembler.h: (JSC::SH4Assembler::revertJumpToMove): Change-Id: Ice297393b167eace620ace8d8957014f0b3945c8 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157046 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
* [arm] Inverted src and dest FP registers in DFG speculative JIT when using ↵Julien Brianceau2013-10-181-2/+4
| | | | | | | | | | | | | | | | | hardfp. https://bugs.webkit.org/show_bug.cgi?id=122555 Patch by Julien Brianceau <jbriance@cisco.com> on 2013-10-09 Reviewed by Michael Saboff. * dfg/DFGSpeculativeJIT.h: (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult): (JSC::DFG::SpeculativeJIT::appendCallSetResult): Change-Id: Ib633513948031702efd5ca0d4b89920e99979755 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157173 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
* Revert r152209Allan Sandfeld Jensen2013-10-171-1/+1
| | | | | | | | Revert another fixup patch for one of the commits we reverted in our branch. Change-Id: I423969481d398df7f334ba4fbf2f2e466ff418fb Reviewed-by: Julien Brianceau <jbriance@cisco.com> Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
* 32-bit code gen for TypeOf doesn't properly update the AbstractInterpreter stateMark Hahnenberg2013-10-161-1/+1
| | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=119555 Reviewed by Geoffrey Garen. It uses a speculationCheck where it should be using a DFG_TYPE_CHECK like the 64-bit backend does. This was causing crashes on maps.google.com in 32-bit debug builds. * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): Change-Id: Icdcfe0719d22df7db6dc7ffcee309b75b63914df git-svn-id: http://svn.webkit.org/repository/webkit/trunk@153793 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
* Fix undefined reference linker errors with MinGWKai Koehne2013-10-167-0/+8
| | | | | | | | | | Make sure the inline methods are defined whereever referenced. This fixes 'undefined reference' errors when linking with MinGW-builds 4.8.2 32 bit posix dwarf rev2. Task-number: QTBUG-34083 Change-Id: Iadc7300634780741be9d97bc889290cd113181e1 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
* Fix linux-clang with clang 3.4Allan Sandfeld Jensen2013-10-041-0/+3
| | | | | | | Cherry-picked upstream r153965 to fix linux build with clang 3.4 Change-Id: Ib3eeb5c424c4f0ef00c228ad02b61ef87dd9b3b6 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
* [sh4] Missing instruction in nativeCallTrampoline LLINT function.Julien Brianceau2013-10-041-14/+1
| | | | | | | | | "move t0, a0" is missing in sh4 implementation of nativeCallTrampoline. Reuse MIPS implementation to avoid code duplication. Fixed in changeset 153371 of WebKit trunk. Change-Id: Ifcc729006bcb426a797762aab093cd300401633c Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
* Revert "Un-crashify JSC tests on debug bots after Anders had his way with ↵v5.2.0-alpha1Allan Sandfeld Jensen2013-09-241-1/+1
| | | | | | | | | StringImpl." Revert another commit that depended on the reverted SQLite commit. Change-Id: I629b6ab7822c15f9f61f61cd880edefd9545838b Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
* Fix build with MingWAllan Sandfeld Jensen2013-09-201-2/+2
| | | | | | | | | Fix wrong export/import flags in inlined methods. Use normal GCC inline asm instead of _ReadWriteBarrier. Change-Id: Iba6b923be383777f2807d84349044dbe5a22eb57 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
* QtWebKit should not require SQLite version to 3.6.16.Allan Sandfeld Jensen2013-09-191-1/+1
| | | | | | | | Revert r152134 which raised the minimum SQLite version, and r152201 which removed a method the reverted code needed. Change-Id: Ie028992137f3983d114f3491423afe6303173544 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
* Import Qt5x2 branch of QtWebkit for Qt 5.2Allan Sandfeld Jensen2013-09-19851-45952/+86306
| | | | | | | Importing a new snapshot of webkit. Change-Id: I2d01ad12cdc8af8cb015387641120a9d7ea5f10c Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com>
* Merge branch 'stable' into devSergio Ahumada2013-09-134-14/+14
|\ | | | | | | | | | | | | Conflicts: Source/WebKit2/UIProcess/API/qt/qquickwebview.cpp Change-Id: Iaa6209d0d611d18b8c916bcd165c8bf5b7441b7b
| * JSC ARM traditional failing on Octane NavierStokes testGabor Rapcsanyi2013-09-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=115626 Reviewed by Zoltan Herczeg. Change the ARM traditional assembler to use double precision on value conversions. * assembler/ARMAssembler.h: Change-Id: I2fbf6323a59120b497215696e10a1582ff927347 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@149601 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
| * Failure building with python3Laszlo Papp2013-08-273-12/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=106645 Patch by Laszlo Papp <lpapp@kde.org> on 2013-08-23 Reviewed by Benjamin Poulain. Use print functions instead of python statements to be compatible with python 3.X and 2.7 as well. Archlinux has been using python3 and that is what causes issues while packaging QtWebKit along with Qt5. * disassembler/udis86/itab.py: (UdItabGenerator.genInsnTable): * disassembler/udis86/ud_opcode.py: (UdOpcodeTables.print_table): * disassembler/udis86/ud_optable.py: (UdOptableXmlParser.parseDef): (UdOptableXmlParser.parse): (printFn): Change-Id: Icec0024fc39bb342d23bbeefac4de0c81e176e6c git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154521 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Laszlo Papp <lpapp@kde.org> Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* | JavaScriptCore: Fix header guardTobias Hunger2013-09-031-1/+1
|/ | | | | | | Clang nags about it. Change-Id: I0f4629048e2e02370202cf47748be05bfa0cbf81 Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* JSObject::getOwnNonIndexPropertyNames calculates numCacheableSlots ↵Mark Hahnenberg2013-07-012-2/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | incorrectly (2/2) https://bugs.webkit.org/show_bug.cgi?id=114235 Reviewed by Filip Pizlo. If the object doesn't have any properties but the prototype does, we'll assume those prototype properties are accessible in the base object's backing store, which is bad. Source/JavaScriptCore: * runtime/JSObject.cpp: (JSC::JSObject::getPropertyNames): (JSC::JSObject::getOwnNonIndexPropertyNames): * runtime/PropertyNameArray.h: (JSC::PropertyNameArray::PropertyNameArray): (JSC::PropertyNameArray::setNumCacheableSlotsForObject): (JSC::PropertyNameArray::setBaseObject): (PropertyNameArray): Change-Id: If61b609438fa1d62364bac556af635413198d8ad git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148142 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* JSObject::getOwnNonIndexPropertyNames calculates numCacheableSlots incorrectlyMark Hahnenberg2013-07-011-3/+5
| | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=114235 Reviewed by Geoffrey Garen. Due to the way that numCacheableSlots is currently calculated, checking an object's prototype for enumerable properties causes us not to cache any properties at all. We should only cache properties on the object itself since we currently don't take advantage of any sort of name caching for properties in the prototype chain. This fix undoes a ~2% SunSpider regression caused by http://trac.webkit.org/changeset/147570. * runtime/JSObject.cpp: (JSC::JSObject::getOwnNonIndexPropertyNames): Change-Id: I5853ab567cd0a8cd20aeac1372ec64fc4f25df1a git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148036 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* get_by_pname can become confused when iterating over objects with static ↵Mark Hahnenberg2013-07-013-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | properties https://bugs.webkit.org/show_bug.cgi?id=113831 Reviewed by Geoffrey Garen. get_by_pname doesn't take static properties into account when using a JSPropertyNameIterator to directly access an object's backing store. One way to fix this is to not cache any properties when iterating over objects with static properties. This patch fixes the bug that was originally reported on swisscom.ch. Source/JavaScriptCore: * runtime/JSObject.cpp: (JSC::JSObject::getOwnNonIndexPropertyNames): * runtime/JSPropertyNameIterator.cpp: (JSC::JSPropertyNameIterator::create): * runtime/PropertyNameArray.h: (JSC::PropertyNameArray::PropertyNameArray): (JSC::PropertyNameArray::numCacheableSlots): (JSC::PropertyNameArray::setNumCacheableSlots): (PropertyNameArray): Change-Id: I7ae9c48eea3c5300c4825a10a660b0e2210c8862 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@147570 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* LLInt conditional branch compilation fault on MIPS.Balazs Kilvady2013-05-232-14/+20
| | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=114264 Patch by Balazs Kilvady <kilvadyb@homejinni.com> on 2013-04-09 Reviewed by Filip Pizlo. Fix conditional branch compilation in LLInt offlineasm. * offlineasm/mips.rb: git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148045 268f45cc-cd09-0410-ab3c-d52691b4dbfc Conflicts: Source/JavaScriptCore/ChangeLog Change-Id: I31b5c06f4424d06785ae53f2f5e34584082b4b02 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com> Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* offlineasm BaseIndex handling is broken on ARM due to MIPS changesBalazs Kilvady2013-05-233-4/+46
| | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=108261 Patch by Balazs Kilvady <kilvadyb@homejinni.com> on 2013-02-01 Reviewed by Filip Pizlo. offlineasm BaseIndex handling fix on MIPS. * offlineasm/mips.rb: * offlineasm/risc.rb: git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141641 268f45cc-cd09-0410-ab3c-d52691b4dbfc Conflicts: Source/JavaScriptCore/ChangeLog Source/JavaScriptCore/offlineasm/mips.rb Change-Id: I7ec4d500e11717e1cb2b6fd7f310e4e66cfa7955 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com> Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* MIPS DFG implementation.Balazs Kilvady2013-05-2311-73/+873
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=101328 Patch by Balazs Kilvady <kilvadyb@homejinni.com> on 2013-02-18 Reviewed by Oliver Hunt. DFG implementation for MIPS. Source/JavaScriptCore: * assembler/MIPSAssembler.h: (JSC::MIPSAssembler::MIPSAssembler): (JSC::MIPSAssembler::sllv): (JSC::MIPSAssembler::movd): (MIPSAssembler): (JSC::MIPSAssembler::negd): (JSC::MIPSAssembler::labelForWatchpoint): (JSC::MIPSAssembler::label): (JSC::MIPSAssembler::vmov): (JSC::MIPSAssembler::linkDirectJump): (JSC::MIPSAssembler::maxJumpReplacementSize): (JSC::MIPSAssembler::revertJumpToMove): (JSC::MIPSAssembler::replaceWithJump): * assembler/MacroAssembler.h: (MacroAssembler): (JSC::MacroAssembler::poke): * assembler/MacroAssemblerMIPS.h: (JSC::MacroAssemblerMIPS::add32): (MacroAssemblerMIPS): (JSC::MacroAssemblerMIPS::and32): (JSC::MacroAssemblerMIPS::lshift32): (JSC::MacroAssemblerMIPS::mul32): (JSC::MacroAssemblerMIPS::or32): (JSC::MacroAssemblerMIPS::rshift32): (JSC::MacroAssemblerMIPS::urshift32): (JSC::MacroAssemblerMIPS::sub32): (JSC::MacroAssemblerMIPS::xor32): (JSC::MacroAssemblerMIPS::store32): (JSC::MacroAssemblerMIPS::jump): (JSC::MacroAssemblerMIPS::branchAdd32): (JSC::MacroAssemblerMIPS::branchMul32): (JSC::MacroAssemblerMIPS::branchSub32): (JSC::MacroAssemblerMIPS::branchNeg32): (JSC::MacroAssemblerMIPS::call): (JSC::MacroAssemblerMIPS::loadDouble): (JSC::MacroAssemblerMIPS::moveDouble): (JSC::MacroAssemblerMIPS::swapDouble): (JSC::MacroAssemblerMIPS::subDouble): (JSC::MacroAssemblerMIPS::mulDouble): (JSC::MacroAssemblerMIPS::divDouble): (JSC::MacroAssemblerMIPS::negateDouble): (JSC::MacroAssemblerMIPS::branchEqual): (JSC::MacroAssemblerMIPS::branchNotEqual): (JSC::MacroAssemblerMIPS::branchTruncateDoubleToInt32): (JSC::MacroAssemblerMIPS::branchTruncateDoubleToUint32): (JSC::MacroAssemblerMIPS::truncateDoubleToInt32): (JSC::MacroAssemblerMIPS::truncateDoubleToUint32): (JSC::MacroAssemblerMIPS::branchDoubleNonZero): (JSC::MacroAssemblerMIPS::branchDoubleZeroOrNaN): (JSC::MacroAssemblerMIPS::invert): (JSC::MacroAssemblerMIPS::replaceWithJump): (JSC::MacroAssemblerMIPS::maxJumpReplacementSize): * dfg/DFGAssemblyHelpers.h: (AssemblyHelpers): (JSC::DFG::AssemblyHelpers::preserveReturnAddressAfterCall): (JSC::DFG::AssemblyHelpers::restoreReturnAddressBeforeReturn): (JSC::DFG::AssemblyHelpers::debugCall): * dfg/DFGCCallHelpers.h: (CCallHelpers): (JSC::DFG::CCallHelpers::setupArguments): (JSC::DFG::CCallHelpers::setupArgumentsWithExecState): * dfg/DFGFPRInfo.h: (DFG): (FPRInfo): (JSC::DFG::FPRInfo::toRegister): (JSC::DFG::FPRInfo::toIndex): (JSC::DFG::FPRInfo::debugName): * dfg/DFGGPRInfo.h: (DFG): (GPRInfo): (JSC::DFG::GPRInfo::toRegister): (JSC::DFG::GPRInfo::toIndex): (JSC::DFG::GPRInfo::debugName): * dfg/DFGSpeculativeJIT.h: (SpeculativeJIT): * jit/JSInterfaceJIT.h: (JSInterfaceJIT): * runtime/JSGlobalData.h: (JSC::ScratchBuffer::allocationSize): (ScratchBuffer): Source/WTF: * wtf/Platform.h: git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143247 268f45cc-cd09-0410-ab3c-d52691b4dbfc Conflicts: Source/JavaScriptCore/ChangeLog Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h Source/WTF/ChangeLog Change-Id: Ibc6c2a2b1d5c70d351ede37c6c111b66b4cf7fef Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com> Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* MIPS LLInt implementation.Balazs Kilvady2013-05-2311-18/+1047
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=99706 Patch by Balazs Kilvady <kilvadyb@homejinni.com> on 2013-01-07 Reviewed by Filip Pizlo. LLInt implementation for MIPS. Source/JavaScriptCore: * assembler/MacroAssemblerMIPS.h: (JSC::MacroAssemblerMIPS::jump): * dfg/DFGOperations.cpp: (JSC): * jit/JITStubs.cpp: (JSC): * jit/JITStubs.h: (JITStackFrame): * llint/LLIntOfflineAsmConfig.h: * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter32_64.asm: * offlineasm/backends.rb: * offlineasm/instructions.rb: * offlineasm/mips.rb: Added. Source/WTF: * wtf/Platform.h: git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138970 268f45cc-cd09-0410-ab3c-d52691b4dbfc Conflicts: Source/JavaScriptCore/ChangeLog Source/JavaScriptCore/jit/JITStubs.h Change-Id: I1677d54c1641cf60e517772944582c8f387eeb6d Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com> Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* [Qt] Use GNU ar's thin archive format for intermediate static libsAndras Becsi2013-04-193-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=109052 http://trac.webkit.org/changeset/142088 Reviewed by Jocelyn Turcotte. With debug builds we exceed the 4GiB limit of GNU ar when creating the WebCore intermediate static library which results in build failure even with a x86_64 toolchain (http://sourceware.org/bugzilla/show_bug.cgi?id=14625). When using a GNU toolchain we can use the thin archive format for these static libraries which also has the benefit of not copying the object files, thus drastically reducing disk usage and overall compile time. Currently qmake does not support GNU ar's thin archive format so for now we need to do the magic in the build system as a stopgap solution. Adjust project files that used activeBuildConfig() to use targetSubDir(). Change-Id: I68604d5fc6acc32d45a734271aa87bfa5a14647f Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* Implement JIT for MinGW-w64 64-bitJonathan Liu2013-04-191-1/+70
| | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=114580 Reviewed by Jocelyn Turcotte. * jit/JITStubs.cpp: (JSC): Change-Id: Ibdda0a09ba3db010bbd7858b745834dff2d92260 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148663 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* Add more assertions to the property storage use in arraysOliver Hunt2013-04-162-5/+20
| | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=107728 Reviewed by Filip Pizlo. Add a bunch of assertions to array and object butterfly usage. This should make debugging somewhat easier. I also converted a couple of assertions to release asserts as they were so low cost it seemed a sensible thing to do. * runtime/JSArray.cpp: (JSC::JSArray::sortVector): (JSC::JSArray::compactForSorting): * runtime/JSObject.h: (JSC::JSObject::getHolyIndexQuickly): Change-Id: Ie6164b837e7671b87c003de3e29fd33ef05f4362 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141029 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* Merge "Merge remote-tracking branch 'origin/release' into stable" into ↵Frederik Gladhorn2013-04-051-2/+2
|\ | | | | | | refs/staging/stable
| * Merge remote-tracking branch 'origin/release' into stableFrederik Gladhorn2013-04-031-2/+2
| |\ | | | | | | | | | Change-Id: If3305d4a24584f4289f840e60a2362220d005013
| | * Crash at JSC::call when loading www.gap.com with JSVALUE32_64 EnabledMichael Saboff2013-03-271-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=108991 Reviewed by Oliver Hunt. Changed the restoration from calleeGPR to nonArgGPR0 because the restoration of the return location may step on calleeGPR is it happen to be nonArgGPR2. * dfg/DFGRepatch.cpp: (JSC::DFG::dfgLinkClosureCall): Change-Id: I2d27a111ae1edbfea9335f3a06c5cc53e065a673 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141951 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* | | Fix the build with GCC 4.8 https://bugs.webkit.org/show_bug.cgi?id=113147Andras Becsi2013-04-051-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reviewed by Allan Sandfeld Jensen. Source/JavaScriptCore: Initialize JSObject* exception to suppress warnings that make the build fail because of -Werror=maybe-uninitialized. * runtime/Executable.cpp: (JSC::FunctionExecutable::compileForCallInternal): (JSC::FunctionExecutable::compileForConstructInternal): Source/WTF: Disable diagnostic warning -Wunused-local-typedefs for GCC 4.8 since dummy typedefs are commonly used in the codebase. * wtf/Compiler.h: Change-Id: I084a47068324c6b9ddd7f4274f7c5a2d10904627 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@digia.com> Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* | | WeakSet::removeAllocator leaks WeakBlocksMark Hahnenberg2013-04-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=110228 Reviewed by Geoffrey Garen. We need to return the WeakBlock to the BlockAllocator after the call to WeakBlock::destroy. * heap/WeakSet.cpp: (JSC::WeakSet::removeAllocator): Change-Id: Iba6cff23e3d8b7a544a825dd1e435cf986b0d35f git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143351 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* | | JSC asserting with long parameter list functions in debug mode on ARM ↵Gabor Rapcsanyi2013-04-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | traditional https://bugs.webkit.org/show_bug.cgi?id=109565 Reviewed by Zoltan Herczeg. Increase the value of sequenceGetByIdSlowCaseInstructionSpace to 80. * jit/JIT.h: Change-Id: I593f09494314a36cb50f2511908f6243fd43f902 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142616 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* | | Change set r140201 broke editing/selection/move-by-word-visually-multi-line.htmlMichael Saboff2013-04-041-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=107340 Reviewed by Filip Pizlo. Due to the change landed in r140201, more nodes might end up generating Int32ToDouble nodes. Therefore, changed the JSVALUE64 constant path of compileInt32ToDouble() to use the more restrictive isInt32Constant() check on the input. This check was the same as the existing ASSERT() so the ASSERT was eliminated. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileInt32ToDouble): Change-Id: I8e9f3858414e37f5b8232a58d8f6f9dada755343 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140221 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* | | Harden ArithDiv of integers fix-up by inserting Int32ToDouble node directlyMichael Saboff2013-04-041-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=107321 Reviewed by Filip Pizlo. Split out the Int32ToDouble node insertion from fixDoubleEdge() and used it directly when we're fixing up an ArithDiv node with integer inputs and output for platforms that don't have integer division. Since we are checking that our inputs should be ints, we can just insert the Int32ToDouble node without any further checks. * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): (JSC::DFG::FixupPhase::fixDoubleEdge): (FixupPhase): (JSC::DFG::FixupPhase::injectInt32ToDoubleNode): Change-Id: Ic79f2823a7cfb9ce52bb935536972f48508579fd git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140203 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* | | Fix up of ArithDiv nodes for non-x86 CPUs is brokenMichael Saboff2013-04-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=107309 Reviewed by Filip Pizlo. Changed the logic so that we insert an Int32ToDouble node when the existing edge is not SpecDouble. * dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixDoubleEdge): Change-Id: I8e73ad242feb65c143857d3a4190e095aa5e9d06 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140201 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* | | r134080 causes heap problem on linux systems where PAGESIZE != 4096Balazs Kilvady2013-04-044-25/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=102828 Patch by Balazs Kilvady <kilvadyb@homejinni.com> on 2013-01-18 Reviewed by Mark Hahnenberg. Make MarkStackSegment::blockSize as the capacity of segments of a MarkStackArray. * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreExports.def: * heap/MarkStack.cpp: (JSC): (JSC::MarkStackArray::MarkStackArray): (JSC::MarkStackArray::expand): (JSC::MarkStackArray::donateSomeCellsTo): (JSC::MarkStackArray::stealSomeCellsFrom): * heap/MarkStack.h: (JSC::MarkStackSegment::data): (CapacityFromSize): (MarkStackArray): * heap/MarkStackInlines.h: (JSC::MarkStackArray::setTopForFullSegment): (JSC::MarkStackArray::append): (JSC::MarkStackArray::isEmpty): (JSC::MarkStackArray::size): * runtime/Options.h: (JSC): Change-Id: I4663100b6b8b054bed03c0c6eb01bb9274a1b264 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140195 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* | | Yarr JIT isn't big endian compatibleTobias Netzel2013-04-041-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=102897 Patch by Tobias Netzel <tobias.netzel@googlemail.com> on 2013-01-22 Reviewed by Oliver Hunt. This patch was tested in the current mozilla codebase only and has passed the regexp tests there. * yarr/YarrJIT.cpp: (JSC::Yarr::YarrGenerator::generatePatternCharacterOnce): Change-Id: I1eb463aa79a7976a87d1f36a6c0123b058c3ec87 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140438 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* | | If array allocation profiling causes a new_array to allocate double arrays, ↵Filip Pizlo2013-04-041-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | then the holes should end up being correctly initialized https://bugs.webkit.org/show_bug.cgi?id=106363 Reviewed by Mark Hahnenberg. Source/JavaScriptCore: * runtime/JSArray.h: (JSC::JSArray::tryCreateUninitialized): LayoutTests: * fast/js/jsc-test-list: * fast/js/new-array-double-with-holes-expected.txt: Added. * fast/js/new-array-double-with-holes.html: Added. * fast/js/script-tests/new-array-double-with-holes.js: Added. (foo): Change-Id: Iad48b7dd0e71bcbe8557fd6f19487fcd9eeed585 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139094 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* | | Dont use a node reference after appending to the graph.Filip Pizlo2013-04-041-8/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=103305 <rdar://problem/12753096> Reviewed by Mark Hahnenberg. * dfg/DFGArgumentsSimplificationPhase.cpp: (JSC::DFG::ArgumentsSimplificationPhase::run): Change-Id: I48ebd652e936ca5781fd6d1bab2df012b2027c34 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139264 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* | | DFG X86: division in the used-as-int case doesn't correctly check for -2^31/-1Michael Saboff2013-04-041-2/+2
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=106978 Reviewed by Filip Pizlo. Source/JavaScriptCore: Changed the numerator equal to -2^31 check to just return if we expect an integer result, since the check is after we have determined that the denominator is -1. The int result of -2^31 / -1 is -2^31, so just return the numerator as the result. * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileIntegerArithDivForX86): LayoutTests: Added a new DFG check for -2^31 / -1 when we expect and integer result. * fast/js/integer-division-neg2tothe32-by-neg1-expected.txt: * fast/js/script-tests/integer-division-neg2tothe32-by-neg1.js: (myDivExpectingInt): Change-Id: Ifd8dd24e75e60520a140c09948dd3ab49aaa3fa8 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139835 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
* | Implement JIT on Windows 64 bitsJocelyn Turcotte2013-03-297-5/+177
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.webkit.org/show_bug.cgi?id=107965 Reviewed by Simon Hausmann. Source/JavaScriptCore: 1. MSVC doesn't support inline assembly for 64 bits, implements the trampoline in a separate ASM file. 2. Windows 64 bits has a different calling convention than other OSes following the AMD64 ABI. Differences that we have to handle here: - Registers passed parameters are RCX, RDX, R8 and R9 instead of RDI, RSI, RDX, RCX, R8 and R9 - RDI and RSI must be preserved by callee - Only return values <= 8 bytes can be returned by register (RDX can't be used to return a second word) - There is no red-zone after RIP on the stack, but instead 4 reserved words before it * Target.pri: * jit/JITStubs.cpp: * jit/JITStubs.h: (JSC): (JITStackFrame): (JSC::JITStackFrame::returnAddressSlot): * jit/JITStubsMSVC64.asm: Added. * jit/JSInterfaceJIT.h: (JSInterfaceJIT): * jit/ThunkGenerators.cpp: (JSC::nativeForGenerator): * yarr/YarrJIT.cpp: (YarrGenerator): (JSC::Yarr::YarrGenerator::generateEnter): (JSC::Yarr::YarrGenerator::generateReturn): Source/WTF: * wtf/Platform.h: Change-Id: Ie1910350e36defcd427a95ceb9aa280fa61083e7 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@144043 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
View Lorry Controller Status