From 8995b83bcbfbb68245f779b64e5517627c6cc6ea Mon Sep 17 00:00:00 2001 From: Simon Hausmann Date: Wed, 17 Oct 2012 16:21:14 +0200 Subject: Imported WebKit commit cf4f8fc6f19b0629f51860cb2d4b25e139d07e00 (http://svn.webkit.org/repository/webkit/trunk@131592) New snapshot that includes the build fixes for Mac OS X 10.6 and earlier as well as the previously cherry-picked changes --- .../JavaScriptCore/API/JSCallbackConstructor.cpp | 4 +- Source/JavaScriptCore/API/JSCallbackConstructor.h | 6 +- Source/JavaScriptCore/API/JSCallbackFunction.cpp | 1 - Source/JavaScriptCore/API/JSCallbackObject.cpp | 21 +- Source/JavaScriptCore/API/JSCallbackObject.h | 20 +- .../JavaScriptCore/API/JSCallbackObjectFunctions.h | 8 +- Source/JavaScriptCore/API/JSClassRef.cpp | 16 +- Source/JavaScriptCore/API/JSObjectRef.cpp | 22 +- Source/JavaScriptCore/API/JSValueRef.cpp | 11 +- .../API/JSWeakObjectMapRefPrivate.cpp | 2 +- Source/JavaScriptCore/API/OpaqueJSString.cpp | 17 +- Source/JavaScriptCore/API/OpaqueJSString.h | 23 +- Source/JavaScriptCore/API/tests/minidom.c | 1 + Source/JavaScriptCore/API/tests/testapi.c | 26 + Source/JavaScriptCore/CMakeLists.txt | 10 +- Source/JavaScriptCore/ChangeLog | 22586 +++---------------- Source/JavaScriptCore/ChangeLog-2012-10-02 | 20888 +++++++++++++++++ .../Configurations/FeatureDefines.xcconfig | 14 +- .../JavaScriptCore/Configurations/Version.xcconfig | 2 +- Source/JavaScriptCore/DerivedSources.pri | 17 + Source/JavaScriptCore/GNUmakefile.list.am | 23 +- Source/JavaScriptCore/JSCTypedArrayStubs.h | 6 +- Source/JavaScriptCore/JavaScriptCore.order | 29 +- Source/JavaScriptCore/JavaScriptCore.pro | 7 + .../JavaScriptCore/JavaScriptCore.def | 92 +- .../JavaScriptCore/JavaScriptCore.vcproj | 66 +- .../JavaScriptCore.xcodeproj/project.pbxproj | 198 +- Source/JavaScriptCore/LLIntOffsetsExtractor.pro | 55 + Source/JavaScriptCore/Target.pri | 17 +- .../assembler/AbstractMacroAssembler.h | 48 +- Source/JavaScriptCore/assembler/MIPSAssembler.h | 156 +- Source/JavaScriptCore/assembler/MacroAssembler.cpp | 38 + Source/JavaScriptCore/assembler/MacroAssembler.h | 431 +- .../JavaScriptCore/assembler/MacroAssemblerARM.h | 11 + .../JavaScriptCore/assembler/MacroAssemblerARMv7.h | 36 + .../JavaScriptCore/assembler/MacroAssemblerMIPS.h | 359 +- .../JavaScriptCore/assembler/MacroAssemblerX86.h | 16 + .../assembler/MacroAssemblerX86Common.h | 8 + .../assembler/MacroAssemblerX86_64.h | 198 +- Source/JavaScriptCore/bytecode/ByValInfo.h | 158 + .../JavaScriptCore/bytecode/BytecodeConventions.h | 2 +- Source/JavaScriptCore/bytecode/CodeBlock.cpp | 10 +- Source/JavaScriptCore/bytecode/CodeBlock.h | 35 +- Source/JavaScriptCore/bytecode/Instruction.h | 4 + Source/JavaScriptCore/bytecode/JumpTable.h | 4 +- .../bytecode/LazyOperandValueProfile.cpp | 2 +- Source/JavaScriptCore/bytecode/SamplingTool.cpp | 6 +- Source/JavaScriptCore/bytecode/SamplingTool.h | 1 + Source/JavaScriptCore/bytecode/SpecialPointer.cpp | 45 + Source/JavaScriptCore/bytecode/SpecialPointer.h | 60 + Source/JavaScriptCore/bytecode/ValueRecovery.h | 94 +- .../bytecompiler/BytecodeGenerator.cpp | 34 +- .../bytecompiler/BytecodeGenerator.h | 4 +- .../JavaScriptCore/bytecompiler/NodesCodegen.cpp | 4 +- Source/JavaScriptCore/debugger/Debugger.cpp | 2 +- Source/JavaScriptCore/dfg/DFGAbstractState.cpp | 32 +- Source/JavaScriptCore/dfg/DFGAbstractState.h | 2 +- .../dfg/DFGArgumentsSimplificationPhase.cpp | 24 +- Source/JavaScriptCore/dfg/DFGArrayMode.cpp | 81 +- Source/JavaScriptCore/dfg/DFGArrayMode.h | 107 +- Source/JavaScriptCore/dfg/DFGAssemblyHelpers.cpp | 6 +- Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h | 33 +- Source/JavaScriptCore/dfg/DFGByteCodeCache.h | 8 +- Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp | 140 +- Source/JavaScriptCore/dfg/DFGCCallHelpers.h | 15 + Source/JavaScriptCore/dfg/DFGCSEPhase.cpp | 22 +- .../dfg/DFGCallArrayAllocatorSlowPathGenerator.h | 128 + Source/JavaScriptCore/dfg/DFGCapabilities.h | 4 - .../JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp | 3 +- Source/JavaScriptCore/dfg/DFGFixupPhase.cpp | 45 +- Source/JavaScriptCore/dfg/DFGGenerationInfo.h | 6 +- Source/JavaScriptCore/dfg/DFGGraph.h | 7 +- Source/JavaScriptCore/dfg/DFGJITCompiler.cpp | 34 +- Source/JavaScriptCore/dfg/DFGJITCompiler.h | 2 +- Source/JavaScriptCore/dfg/DFGOSREntry.cpp | 2 +- .../JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp | 88 +- Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp | 56 +- Source/JavaScriptCore/dfg/DFGOperations.cpp | 76 +- Source/JavaScriptCore/dfg/DFGOperations.h | 19 +- Source/JavaScriptCore/dfg/DFGRepatch.cpp | 4 +- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp | 370 +- Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h | 169 +- .../JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp | 579 +- Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp | 560 +- .../dfg/DFGStructureCheckHoistingPhase.cpp | 222 +- Source/JavaScriptCore/dfg/DFGThunks.cpp | 14 +- Source/JavaScriptCore/dfg/DFGValueSource.cpp | 12 +- Source/JavaScriptCore/dfg/DFGValueSource.h | 62 +- .../JavaScriptCore/dfg/DFGVariableEventStream.cpp | 4 +- Source/JavaScriptCore/heap/BlockAllocator.cpp | 73 +- Source/JavaScriptCore/heap/BlockAllocator.h | 280 +- Source/JavaScriptCore/heap/CopiedBlock.h | 101 +- Source/JavaScriptCore/heap/CopiedSpace.cpp | 72 +- Source/JavaScriptCore/heap/CopiedSpace.h | 12 +- .../JavaScriptCore/heap/CopiedSpaceInlineMethods.h | 25 +- Source/JavaScriptCore/heap/CopyVisitor.cpp | 57 + Source/JavaScriptCore/heap/CopyVisitor.h | 60 + .../JavaScriptCore/heap/CopyVisitorInlineMethods.h | 121 + Source/JavaScriptCore/heap/GCThread.cpp | 130 + Source/JavaScriptCore/heap/GCThread.h | 63 + Source/JavaScriptCore/heap/GCThreadSharedData.cpp | 107 +- Source/JavaScriptCore/heap/GCThreadSharedData.h | 45 +- Source/JavaScriptCore/heap/Heap.cpp | 174 +- Source/JavaScriptCore/heap/Heap.h | 54 +- Source/JavaScriptCore/heap/HeapBlock.h | 22 +- Source/JavaScriptCore/heap/HeapStatistics.cpp | 258 + Source/JavaScriptCore/heap/HeapStatistics.h | 61 + Source/JavaScriptCore/heap/IncrementalSweeper.cpp | 25 +- Source/JavaScriptCore/heap/IncrementalSweeper.h | 19 +- Source/JavaScriptCore/heap/JITStubRoutineSet.cpp | 4 +- Source/JavaScriptCore/heap/MarkedAllocator.cpp | 23 +- Source/JavaScriptCore/heap/MarkedAllocator.h | 16 +- Source/JavaScriptCore/heap/MarkedBlock.cpp | 46 +- Source/JavaScriptCore/heap/MarkedBlock.h | 35 +- Source/JavaScriptCore/heap/MarkedSpace.cpp | 57 +- Source/JavaScriptCore/heap/MarkedSpace.h | 62 +- Source/JavaScriptCore/heap/SlotVisitor.cpp | 75 +- Source/JavaScriptCore/heap/SlotVisitor.h | 21 +- .../JavaScriptCore/heap/SlotVisitorInlineMethods.h | 41 +- Source/JavaScriptCore/heap/Weak.h | 4 +- Source/JavaScriptCore/interpreter/CallFrame.cpp | 4 +- Source/JavaScriptCore/interpreter/CallFrame.h | 65 +- .../JavaScriptCore/interpreter/CallFrameClosure.h | 6 +- Source/JavaScriptCore/interpreter/Interpreter.cpp | 127 +- Source/JavaScriptCore/interpreter/Interpreter.h | 16 +- Source/JavaScriptCore/interpreter/JSStack.cpp | 107 + Source/JavaScriptCore/interpreter/JSStack.h | 124 + Source/JavaScriptCore/interpreter/RegisterFile.cpp | 107 - Source/JavaScriptCore/interpreter/RegisterFile.h | 124 - Source/JavaScriptCore/interpreter/VMInspector.cpp | 32 +- .../jit/ExecutableAllocatorFixedVMPool.cpp | 1 - Source/JavaScriptCore/jit/HostCallReturnValue.h | 16 +- Source/JavaScriptCore/jit/JIT.cpp | 47 +- Source/JavaScriptCore/jit/JIT.h | 82 +- Source/JavaScriptCore/jit/JITCall.cpp | 22 +- Source/JavaScriptCore/jit/JITCall32_64.cpp | 34 +- Source/JavaScriptCore/jit/JITCode.h | 6 +- Source/JavaScriptCore/jit/JITInlineMethods.h | 83 +- Source/JavaScriptCore/jit/JITOpcodes.cpp | 103 +- Source/JavaScriptCore/jit/JITOpcodes32_64.cpp | 132 +- Source/JavaScriptCore/jit/JITPropertyAccess.cpp | 557 +- .../JavaScriptCore/jit/JITPropertyAccess32_64.cpp | 192 +- Source/JavaScriptCore/jit/JITStubs.cpp | 203 +- Source/JavaScriptCore/jit/JITStubs.h | 20 +- Source/JavaScriptCore/jit/JSInterfaceJIT.h | 2 +- Source/JavaScriptCore/jit/SpecializedThunkJIT.h | 10 +- Source/JavaScriptCore/jsc.cpp | 10 +- Source/JavaScriptCore/llint/LLIntData.cpp | 20 +- .../JavaScriptCore/llint/LLIntOfflineAsmConfig.h | 7 + .../JavaScriptCore/llint/LLIntOffsetsExtractor.cpp | 2 +- Source/JavaScriptCore/llint/LLIntSlowPaths.cpp | 20 +- Source/JavaScriptCore/llint/LLIntSlowPaths.h | 2 +- .../JavaScriptCore/llint/LowLevelInterpreter.asm | 31 +- .../llint/LowLevelInterpreter32_64.asm | 96 +- .../JavaScriptCore/llint/LowLevelInterpreter64.asm | 92 +- Source/JavaScriptCore/offlineasm/armv7.rb | 2 +- Source/JavaScriptCore/offlineasm/offsets.rb | 13 +- Source/JavaScriptCore/parser/Nodes.cpp | 8 +- Source/JavaScriptCore/parser/Parser.cpp | 27 +- Source/JavaScriptCore/parser/Parser.h | 23 +- Source/JavaScriptCore/profiler/Profile.cpp | 4 +- Source/JavaScriptCore/runtime/Arguments.cpp | 14 +- Source/JavaScriptCore/runtime/Arguments.h | 9 +- Source/JavaScriptCore/runtime/ArrayConstructor.cpp | 2 - Source/JavaScriptCore/runtime/ArrayConventions.h | 2 +- Source/JavaScriptCore/runtime/ArrayPrototype.cpp | 33 +- Source/JavaScriptCore/runtime/ArrayStorage.h | 2 + .../JavaScriptCore/runtime/BooleanConstructor.cpp | 1 - Source/JavaScriptCore/runtime/BooleanObject.cpp | 1 - Source/JavaScriptCore/runtime/BooleanPrototype.cpp | 1 - Source/JavaScriptCore/runtime/Butterfly.h | 25 +- .../runtime/ButterflyInlineMethods.h | 8 +- Source/JavaScriptCore/runtime/ClassInfo.h | 4 + Source/JavaScriptCore/runtime/CommonSlowPaths.h | 6 +- Source/JavaScriptCore/runtime/DateConstructor.cpp | 1 - Source/JavaScriptCore/runtime/DatePrototype.cpp | 2 - Source/JavaScriptCore/runtime/Error.cpp | 2 - Source/JavaScriptCore/runtime/ErrorConstructor.cpp | 1 - Source/JavaScriptCore/runtime/ErrorPrototype.cpp | 4 +- Source/JavaScriptCore/runtime/Executable.h | 2 + .../JavaScriptCore/runtime/FunctionConstructor.cpp | 1 - .../JavaScriptCore/runtime/FunctionPrototype.cpp | 1 - Source/JavaScriptCore/runtime/Identifier.cpp | 9 +- .../runtime/IndexingHeaderInlineMethods.h | 13 +- Source/JavaScriptCore/runtime/IndexingType.cpp | 76 + Source/JavaScriptCore/runtime/IndexingType.h | 53 +- .../JavaScriptCore/runtime/InitializeThreading.cpp | 5 +- Source/JavaScriptCore/runtime/InternalFunction.cpp | 5 +- Source/JavaScriptCore/runtime/InternalFunction.h | 6 +- Source/JavaScriptCore/runtime/JSActivation.cpp | 12 +- Source/JavaScriptCore/runtime/JSArray.cpp | 914 +- Source/JavaScriptCore/runtime/JSArray.h | 130 +- Source/JavaScriptCore/runtime/JSBoundFunction.cpp | 1 - Source/JavaScriptCore/runtime/JSCell.cpp | 4 + Source/JavaScriptCore/runtime/JSCell.h | 59 +- .../JavaScriptCore/runtime/JSDestructibleObject.h | 43 + Source/JavaScriptCore/runtime/JSFunction.cpp | 1 - Source/JavaScriptCore/runtime/JSGlobalData.cpp | 2 + Source/JavaScriptCore/runtime/JSGlobalData.h | 48 +- Source/JavaScriptCore/runtime/JSGlobalObject.cpp | 22 +- Source/JavaScriptCore/runtime/JSGlobalObject.h | 33 +- Source/JavaScriptCore/runtime/JSGlobalThis.cpp | 58 - Source/JavaScriptCore/runtime/JSGlobalThis.h | 76 - Source/JavaScriptCore/runtime/JSLock.cpp | 8 +- Source/JavaScriptCore/runtime/JSNameScope.cpp | 2 - Source/JavaScriptCore/runtime/JSNotAnObject.cpp | 1 - Source/JavaScriptCore/runtime/JSONObject.cpp | 1 - Source/JavaScriptCore/runtime/JSObject.cpp | 473 +- Source/JavaScriptCore/runtime/JSObject.h | 212 +- .../runtime/JSPropertyNameIterator.cpp | 2 - .../runtime/JSPropertyNameIterator.h | 14 +- Source/JavaScriptCore/runtime/JSProxy.cpp | 129 + Source/JavaScriptCore/runtime/JSProxy.h | 95 + Source/JavaScriptCore/runtime/JSScope.cpp | 2 +- Source/JavaScriptCore/runtime/JSString.h | 2 + .../JavaScriptCore/runtime/JSSymbolTableObject.cpp | 4 +- .../JavaScriptCore/runtime/JSSymbolTableObject.h | 12 +- Source/JavaScriptCore/runtime/JSType.h | 2 +- Source/JavaScriptCore/runtime/JSValue.cpp | 11 +- Source/JavaScriptCore/runtime/JSVariableObject.h | 2 +- Source/JavaScriptCore/runtime/JSWithScope.cpp | 2 - Source/JavaScriptCore/runtime/JSWrapperObject.cpp | 1 - Source/JavaScriptCore/runtime/JSWrapperObject.h | 10 +- Source/JavaScriptCore/runtime/MathObject.cpp | 6 +- Source/JavaScriptCore/runtime/MemoryStatistics.cpp | 4 +- Source/JavaScriptCore/runtime/NameConstructor.cpp | 1 - Source/JavaScriptCore/runtime/NameInstance.h | 6 +- Source/JavaScriptCore/runtime/NamePrototype.cpp | 4 - .../runtime/NativeErrorConstructor.cpp | 1 - .../runtime/NativeErrorPrototype.cpp | 2 - .../JavaScriptCore/runtime/NumberConstructor.cpp | 2 - Source/JavaScriptCore/runtime/NumberObject.cpp | 1 - Source/JavaScriptCore/runtime/NumberPrototype.cpp | 1 - .../JavaScriptCore/runtime/ObjectConstructor.cpp | 2 - Source/JavaScriptCore/runtime/ObjectPrototype.cpp | 2 - Source/JavaScriptCore/runtime/Options.cpp | 18 +- Source/JavaScriptCore/runtime/Options.h | 16 +- .../JavaScriptCore/runtime/PropertyMapHashTable.h | 11 +- Source/JavaScriptCore/runtime/PropertyOffset.h | 52 +- Source/JavaScriptCore/runtime/RegExp.h | 2 + Source/JavaScriptCore/runtime/RegExpCache.cpp | 2 +- .../JavaScriptCore/runtime/RegExpConstructor.cpp | 2 - .../JavaScriptCore/runtime/RegExpMatchesArray.cpp | 2 - Source/JavaScriptCore/runtime/RegExpObject.cpp | 4 +- Source/JavaScriptCore/runtime/RegExpPrototype.cpp | 2 - .../JavaScriptCore/runtime/SparseArrayValueMap.cpp | 6 +- .../JavaScriptCore/runtime/SparseArrayValueMap.h | 2 + .../JavaScriptCore/runtime/StringConstructor.cpp | 1 - Source/JavaScriptCore/runtime/StringObject.cpp | 1 - Source/JavaScriptCore/runtime/StringPrototype.cpp | 1 - Source/JavaScriptCore/runtime/Structure.cpp | 33 +- Source/JavaScriptCore/runtime/Structure.h | 82 +- Source/JavaScriptCore/runtime/StructureChain.h | 5 +- .../runtime/StructureTransitionTable.h | 14 +- Source/JavaScriptCore/runtime/SymbolTable.h | 5 + .../JavaScriptCore/runtime/TypedArrayDescriptor.h | 76 + Source/JavaScriptCore/runtime/WeakGCMap.h | 6 +- Source/JavaScriptCore/shell/CMakeLists.txt | 4 + Source/JavaScriptCore/testRegExp.cpp | 7 +- Source/JavaScriptCore/tools/ProfileTreeNode.h | 16 +- 260 files changed, 32822 insertions(+), 23869 deletions(-) create mode 100644 Source/JavaScriptCore/ChangeLog-2012-10-02 create mode 100644 Source/JavaScriptCore/LLIntOffsetsExtractor.pro create mode 100644 Source/JavaScriptCore/assembler/MacroAssembler.cpp create mode 100644 Source/JavaScriptCore/bytecode/ByValInfo.h create mode 100644 Source/JavaScriptCore/bytecode/SpecialPointer.cpp create mode 100644 Source/JavaScriptCore/bytecode/SpecialPointer.h create mode 100644 Source/JavaScriptCore/dfg/DFGCallArrayAllocatorSlowPathGenerator.h create mode 100644 Source/JavaScriptCore/heap/CopyVisitor.cpp create mode 100644 Source/JavaScriptCore/heap/CopyVisitor.h create mode 100644 Source/JavaScriptCore/heap/CopyVisitorInlineMethods.h create mode 100644 Source/JavaScriptCore/heap/GCThread.cpp create mode 100644 Source/JavaScriptCore/heap/GCThread.h create mode 100644 Source/JavaScriptCore/heap/HeapStatistics.cpp create mode 100644 Source/JavaScriptCore/heap/HeapStatistics.h create mode 100644 Source/JavaScriptCore/interpreter/JSStack.cpp create mode 100644 Source/JavaScriptCore/interpreter/JSStack.h delete mode 100644 Source/JavaScriptCore/interpreter/RegisterFile.cpp delete mode 100644 Source/JavaScriptCore/interpreter/RegisterFile.h create mode 100644 Source/JavaScriptCore/runtime/IndexingType.cpp create mode 100644 Source/JavaScriptCore/runtime/JSDestructibleObject.h delete mode 100644 Source/JavaScriptCore/runtime/JSGlobalThis.cpp delete mode 100644 Source/JavaScriptCore/runtime/JSGlobalThis.h create mode 100644 Source/JavaScriptCore/runtime/JSProxy.cpp create mode 100644 Source/JavaScriptCore/runtime/JSProxy.h create mode 100644 Source/JavaScriptCore/runtime/TypedArrayDescriptor.h (limited to 'Source/JavaScriptCore') diff --git a/Source/JavaScriptCore/API/JSCallbackConstructor.cpp b/Source/JavaScriptCore/API/JSCallbackConstructor.cpp index 8fd2b61f1..c43182e8f 100644 --- a/Source/JavaScriptCore/API/JSCallbackConstructor.cpp +++ b/Source/JavaScriptCore/API/JSCallbackConstructor.cpp @@ -36,10 +36,10 @@ namespace JSC { -const ClassInfo JSCallbackConstructor::s_info = { "CallbackConstructor", &JSNonFinalObject::s_info, 0, 0, CREATE_METHOD_TABLE(JSCallbackConstructor) }; +const ClassInfo JSCallbackConstructor::s_info = { "CallbackConstructor", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(JSCallbackConstructor) }; JSCallbackConstructor::JSCallbackConstructor(JSGlobalObject* globalObject, Structure* structure, JSClassRef jsClass, JSObjectCallAsConstructorCallback callback) - : JSNonFinalObject(globalObject->globalData(), structure) + : JSDestructibleObject(globalObject->globalData(), structure) , m_class(jsClass) , m_callback(callback) { diff --git a/Source/JavaScriptCore/API/JSCallbackConstructor.h b/Source/JavaScriptCore/API/JSCallbackConstructor.h index 25fde1324..2bb4d07af 100644 --- a/Source/JavaScriptCore/API/JSCallbackConstructor.h +++ b/Source/JavaScriptCore/API/JSCallbackConstructor.h @@ -27,13 +27,13 @@ #define JSCallbackConstructor_h #include "JSObjectRef.h" -#include +#include "runtime/JSDestructibleObject.h" namespace JSC { -class JSCallbackConstructor : public JSNonFinalObject { +class JSCallbackConstructor : public JSDestructibleObject { public: - typedef JSNonFinalObject Base; + typedef JSDestructibleObject Base; static JSCallbackConstructor* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, JSClassRef classRef, JSObjectCallAsConstructorCallback callback) { diff --git a/Source/JavaScriptCore/API/JSCallbackFunction.cpp b/Source/JavaScriptCore/API/JSCallbackFunction.cpp index 0f63d3c16..aada87bfa 100644 --- a/Source/JavaScriptCore/API/JSCallbackFunction.cpp +++ b/Source/JavaScriptCore/API/JSCallbackFunction.cpp @@ -38,7 +38,6 @@ namespace JSC { -ASSERT_CLASS_FITS_IN_CELL(JSCallbackFunction); ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSCallbackFunction); const ClassInfo JSCallbackFunction::s_info = { "CallbackFunction", &InternalFunction::s_info, 0, 0, CREATE_METHOD_TABLE(JSCallbackFunction) }; diff --git a/Source/JavaScriptCore/API/JSCallbackObject.cpp b/Source/JavaScriptCore/API/JSCallbackObject.cpp index 921d37897..76866feb0 100644 --- a/Source/JavaScriptCore/API/JSCallbackObject.cpp +++ b/Source/JavaScriptCore/API/JSCallbackObject.cpp @@ -32,15 +32,24 @@ namespace JSC { -ASSERT_CLASS_FITS_IN_CELL(JSCallbackObject); -ASSERT_CLASS_FITS_IN_CELL(JSCallbackObject); - // Define the two types of JSCallbackObjects we support. -template <> const ClassInfo JSCallbackObject::s_info = { "CallbackObject", &JSNonFinalObject::s_info, 0, 0, CREATE_METHOD_TABLE(JSCallbackObject) }; -template <> const ClassInfo JSCallbackObject::s_info = { "CallbackGlobalObject", &JSGlobalObject::s_info, 0, 0, CREATE_METHOD_TABLE(JSCallbackObject) }; +template <> const ClassInfo JSCallbackObject::s_info = { "CallbackObject", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(JSCallbackObject) }; +template <> const ClassInfo JSCallbackObject::s_info = { "CallbackGlobalObject", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(JSCallbackObject) }; + +template<> const bool JSCallbackObject::needsDestruction = true; +template<> const bool JSCallbackObject::needsDestruction = false; + +template<> +JSCallbackObject* JSCallbackObject::create(JSGlobalData& globalData, JSClassRef classRef, Structure* structure) +{ + JSCallbackObject* callbackObject = new (NotNull, allocateCell >(globalData.heap)) JSCallbackObject(globalData, classRef, structure); + callbackObject->finishCreation(globalData); + globalData.heap.addFinalizer(callbackObject, destroy); + return callbackObject; +} template <> -Structure* JSCallbackObject::createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue proto) +Structure* JSCallbackObject::createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(globalData, globalObject, proto, TypeInfo(ObjectType, StructureFlags), &s_info); } diff --git a/Source/JavaScriptCore/API/JSCallbackObject.h b/Source/JavaScriptCore/API/JSCallbackObject.h index 5022aaf40..3acf2ef10 100644 --- a/Source/JavaScriptCore/API/JSCallbackObject.h +++ b/Source/JavaScriptCore/API/JSCallbackObject.h @@ -83,13 +83,13 @@ struct JSCallbackObjectData : WeakHandleOwner { PrivatePropertyMap::const_iterator location = m_propertyMap.find(propertyName.impl()); if (location == m_propertyMap.end()) return JSValue(); - return location->second.get(); + return location->value.get(); } void setPrivateProperty(JSGlobalData& globalData, JSCell* owner, const Identifier& propertyName, JSValue value) { WriteBarrier empty; - m_propertyMap.add(propertyName.impl(), empty).iterator->second.set(globalData, owner, value); + m_propertyMap.add(propertyName.impl(), empty).iterator->value.set(globalData, owner, value); } void deletePrivateProperty(const Identifier& propertyName) @@ -100,8 +100,8 @@ struct JSCallbackObjectData : WeakHandleOwner { void visitChildren(SlotVisitor& visitor) { for (PrivatePropertyMap::iterator ptr = m_propertyMap.begin(); ptr != m_propertyMap.end(); ++ptr) { - if (ptr->second) - visitor.append(&ptr->second); + if (ptr->value) + visitor.append(&ptr->value); } } @@ -133,12 +133,10 @@ public: callbackObject->finishCreation(exec); return callbackObject; } - static JSCallbackObject* create(JSGlobalData& globalData, JSClassRef classRef, Structure* structure) - { - JSCallbackObject* callbackObject = new (NotNull, allocateCell(globalData.heap)) JSCallbackObject(globalData, classRef, structure); - callbackObject->finishCreation(globalData); - return callbackObject; - } + static JSCallbackObject* create(JSGlobalData&, JSClassRef, Structure*); + + static const bool needsDestruction; + static void destroy(JSCell*); void setPrivate(void* data); void* getPrivate(); @@ -173,8 +171,6 @@ protected: private: static String className(const JSObject*); - static void destroy(JSCell*); - static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType); static bool getOwnPropertySlot(JSCell*, ExecState*, PropertyName, PropertySlot&); diff --git a/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h b/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h index 688e7b8b9..1a063e620 100644 --- a/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h +++ b/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h @@ -471,8 +471,8 @@ void JSCallbackObject::getOwnNonIndexPropertyNames(JSObject* object, Exe typedef OpaqueJSClassStaticValuesTable::const_iterator iterator; iterator end = staticValues->end(); for (iterator it = staticValues->begin(); it != end; ++it) { - StringImpl* name = it->first.get(); - StaticValueEntry* entry = it->second.get(); + StringImpl* name = it->key.get(); + StaticValueEntry* entry = it->value.get(); if (entry->getProperty && (!(entry->attributes & kJSPropertyAttributeDontEnum) || (mode == IncludeDontEnumProperties))) propertyNames.add(Identifier(exec, name)); } @@ -482,8 +482,8 @@ void JSCallbackObject::getOwnNonIndexPropertyNames(JSObject* object, Exe typedef OpaqueJSClassStaticFunctionsTable::const_iterator iterator; iterator end = staticFunctions->end(); for (iterator it = staticFunctions->begin(); it != end; ++it) { - StringImpl* name = it->first.get(); - StaticFunctionEntry* entry = it->second.get(); + StringImpl* name = it->key.get(); + StaticFunctionEntry* entry = it->value.get(); if (!(entry->attributes & kJSPropertyAttributeDontEnum) || (mode == IncludeDontEnumProperties)) propertyNames.add(Identifier(exec, name)); } diff --git a/Source/JavaScriptCore/API/JSClassRef.cpp b/Source/JavaScriptCore/API/JSClassRef.cpp index a95d42e39..976203f08 100644 --- a/Source/JavaScriptCore/API/JSClassRef.cpp +++ b/Source/JavaScriptCore/API/JSClassRef.cpp @@ -93,13 +93,13 @@ OpaqueJSClass::~OpaqueJSClass() if (m_staticValues) { OpaqueJSClassStaticValuesTable::const_iterator end = m_staticValues->end(); for (OpaqueJSClassStaticValuesTable::const_iterator it = m_staticValues->begin(); it != end; ++it) - ASSERT(!it->first->isIdentifier()); + ASSERT(!it->key->isIdentifier()); } if (m_staticFunctions) { OpaqueJSClassStaticFunctionsTable::const_iterator end = m_staticFunctions->end(); for (OpaqueJSClassStaticFunctionsTable::const_iterator it = m_staticFunctions->begin(); it != end; ++it) - ASSERT(!it->first->isIdentifier()); + ASSERT(!it->key->isIdentifier()); } #endif @@ -133,8 +133,8 @@ OpaqueJSClassContextData::OpaqueJSClassContextData(JSC::JSGlobalData&, OpaqueJSC staticValues = adoptPtr(new OpaqueJSClassStaticValuesTable); OpaqueJSClassStaticValuesTable::const_iterator end = jsClass->m_staticValues->end(); for (OpaqueJSClassStaticValuesTable::const_iterator it = jsClass->m_staticValues->begin(); it != end; ++it) { - ASSERT(!it->first->isIdentifier()); - staticValues->add(StringImpl::create(it->first->characters(), it->first->length()), adoptPtr(new StaticValueEntry(it->second->getProperty, it->second->setProperty, it->second->attributes))); + ASSERT(!it->key->isIdentifier()); + staticValues->add(StringImpl::create(it->key->characters(), it->key->length()), adoptPtr(new StaticValueEntry(it->value->getProperty, it->value->setProperty, it->value->attributes))); } } @@ -142,15 +142,15 @@ OpaqueJSClassContextData::OpaqueJSClassContextData(JSC::JSGlobalData&, OpaqueJSC staticFunctions = adoptPtr(new OpaqueJSClassStaticFunctionsTable); OpaqueJSClassStaticFunctionsTable::const_iterator end = jsClass->m_staticFunctions->end(); for (OpaqueJSClassStaticFunctionsTable::const_iterator it = jsClass->m_staticFunctions->begin(); it != end; ++it) { - ASSERT(!it->first->isIdentifier()); - staticFunctions->add(StringImpl::create(it->first->characters(), it->first->length()), adoptPtr(new StaticFunctionEntry(it->second->callAsFunction, it->second->attributes))); + ASSERT(!it->key->isIdentifier()); + staticFunctions->add(StringImpl::create(it->key->characters(), it->key->length()), adoptPtr(new StaticFunctionEntry(it->value->callAsFunction, it->value->attributes))); } } } OpaqueJSClassContextData& OpaqueJSClass::contextData(ExecState* exec) { - OwnPtr& contextData = exec->globalData().opaqueJSClassData.add(this, nullptr).iterator->second; + OwnPtr& contextData = exec->globalData().opaqueJSClassData.add(this, nullptr).iterator->value; if (!contextData) contextData = adoptPtr(new OpaqueJSClassContextData(exec->globalData(), this)); return *contextData; @@ -199,7 +199,7 @@ JSObject* OpaqueJSClass::prototype(ExecState* exec) return prototype; // Recursive, but should be good enough for our purposes - JSObject* prototype = JSCallbackObject::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), prototypeClass, &jsClassData); // set jsClassData as the object's private data, so it can clear our reference on destruction + JSObject* prototype = JSCallbackObject::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), prototypeClass, &jsClassData); // set jsClassData as the object's private data, so it can clear our reference on destruction if (parentClass) { if (JSObject* parentPrototype = parentClass->prototype(exec)) prototype->setPrototype(exec->globalData(), parentPrototype); diff --git a/Source/JavaScriptCore/API/JSObjectRef.cpp b/Source/JavaScriptCore/API/JSObjectRef.cpp index 7a8956e4a..491fa988f 100644 --- a/Source/JavaScriptCore/API/JSObjectRef.cpp +++ b/Source/JavaScriptCore/API/JSObjectRef.cpp @@ -83,7 +83,7 @@ JSObjectRef JSObjectMake(JSContextRef ctx, JSClassRef jsClass, void* data) if (!jsClass) return toRef(constructEmptyObject(exec)); - JSCallbackObject* object = JSCallbackObject::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), jsClass, data); + JSCallbackObject* object = JSCallbackObject::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), jsClass, data); if (JSObject* prototype = jsClass->prototype(exec)) object->setPrototype(exec->globalData(), prototype); @@ -341,8 +341,8 @@ void* JSObjectGetPrivate(JSObjectRef object) if (jsObject->inherits(&JSCallbackObject::s_info)) return jsCast*>(jsObject)->getPrivate(); - if (jsObject->inherits(&JSCallbackObject::s_info)) - return jsCast*>(jsObject)->getPrivate(); + if (jsObject->inherits(&JSCallbackObject::s_info)) + return jsCast*>(jsObject)->getPrivate(); return 0; } @@ -355,8 +355,8 @@ bool JSObjectSetPrivate(JSObjectRef object, void* data) jsCast*>(jsObject)->setPrivate(data); return true; } - if (jsObject->inherits(&JSCallbackObject::s_info)) { - jsCast*>(jsObject)->setPrivate(data); + if (jsObject->inherits(&JSCallbackObject::s_info)) { + jsCast*>(jsObject)->setPrivate(data); return true; } @@ -372,8 +372,8 @@ JSValueRef JSObjectGetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSSt Identifier name(propertyName->identifier(&exec->globalData())); if (jsObject->inherits(&JSCallbackObject::s_info)) result = jsCast*>(jsObject)->getPrivateProperty(name); - else if (jsObject->inherits(&JSCallbackObject::s_info)) - result = jsCast*>(jsObject)->getPrivateProperty(name); + else if (jsObject->inherits(&JSCallbackObject::s_info)) + result = jsCast*>(jsObject)->getPrivateProperty(name); return toRef(exec, result); } @@ -388,8 +388,8 @@ bool JSObjectSetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRe jsCast*>(jsObject)->setPrivateProperty(exec->globalData(), name, jsValue); return true; } - if (jsObject->inherits(&JSCallbackObject::s_info)) { - jsCast*>(jsObject)->setPrivateProperty(exec->globalData(), name, jsValue); + if (jsObject->inherits(&JSCallbackObject::s_info)) { + jsCast*>(jsObject)->setPrivateProperty(exec->globalData(), name, jsValue); return true; } return false; @@ -405,8 +405,8 @@ bool JSObjectDeletePrivateProperty(JSContextRef ctx, JSObjectRef object, JSStrin jsCast*>(jsObject)->deletePrivateProperty(name); return true; } - if (jsObject->inherits(&JSCallbackObject::s_info)) { - jsCast*>(jsObject)->deletePrivateProperty(name); + if (jsObject->inherits(&JSCallbackObject::s_info)) { + jsCast*>(jsObject)->deletePrivateProperty(name); return true; } return false; diff --git a/Source/JavaScriptCore/API/JSValueRef.cpp b/Source/JavaScriptCore/API/JSValueRef.cpp index bb92454bd..de84508c1 100644 --- a/Source/JavaScriptCore/API/JSValueRef.cpp +++ b/Source/JavaScriptCore/API/JSValueRef.cpp @@ -131,8 +131,8 @@ bool JSValueIsObjectOfClass(JSContextRef ctx, JSValueRef value, JSClassRef jsCla if (JSObject* o = jsValue.getObject()) { if (o->inherits(&JSCallbackObject::s_info)) return jsCast*>(o)->inherits(jsClass); - if (o->inherits(&JSCallbackObject::s_info)) - return jsCast*>(o)->inherits(jsClass); + if (o->inherits(&JSCallbackObject::s_info)) + return jsCast*>(o)->inherits(jsClass); } return false; } @@ -235,11 +235,12 @@ JSValueRef JSValueMakeFromJSONString(JSContextRef ctx, JSStringRef string) ExecState* exec = toJS(ctx); APIEntryShim entryShim(exec); String str = string->string(); - if (str.is8Bit()) { - LiteralParser parser(exec, str.characters8(), str.length(), StrictJSON); + unsigned length = str.length(); + if (length && str.is8Bit()) { + LiteralParser parser(exec, str.characters8(), length, StrictJSON); return toRef(exec, parser.tryLiteralParse()); } - LiteralParser parser(exec, str.characters16(), str.length(), StrictJSON); + LiteralParser parser(exec, str.characters(), length, StrictJSON); return toRef(exec, parser.tryLiteralParse()); } diff --git a/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp b/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp index bfb006021..bdfce08ee 100644 --- a/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp +++ b/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp @@ -57,7 +57,7 @@ void JSWeakObjectMapSet(JSContextRef ctx, JSWeakObjectMapRef map, void* key, JSO JSObject* obj = toJS(object); if (!obj) return; - ASSERT(obj->inherits(&JSCallbackObject::s_info) || obj->inherits(&JSCallbackObject::s_info)); + ASSERT(obj->inherits(&JSCallbackObject::s_info) || obj->inherits(&JSCallbackObject::s_info)); map->map().set(exec->globalData(), key, obj); } diff --git a/Source/JavaScriptCore/API/OpaqueJSString.cpp b/Source/JavaScriptCore/API/OpaqueJSString.cpp index 457cb27f7..ac7cfd16a 100644 --- a/Source/JavaScriptCore/API/OpaqueJSString.cpp +++ b/Source/JavaScriptCore/API/OpaqueJSString.cpp @@ -35,21 +35,26 @@ using namespace JSC; PassRefPtr OpaqueJSString::create(const String& string) { if (!string.isNull()) - return adoptRef(new OpaqueJSString(string.characters(), string.length())); + return adoptRef(new OpaqueJSString(string)); return 0; } String OpaqueJSString::string() const { - if (this && m_characters) - return String(m_characters, m_length); - return String(); + if (!this) + return String(); + + // Return a copy of the wrapped string, because the caller may make it an Identifier. + return m_string.isolatedCopy(); } Identifier OpaqueJSString::identifier(JSGlobalData* globalData) const { - if (!this || !m_characters) + if (!this || !m_string.length()) return Identifier(globalData, static_cast(0)); - return Identifier(globalData, m_characters, m_length); + if (m_string.is8Bit()) + return Identifier(globalData, m_string.characters8(), m_string.length()); + + return Identifier(globalData, m_string.characters16(), m_string.length()); } diff --git a/Source/JavaScriptCore/API/OpaqueJSString.h b/Source/JavaScriptCore/API/OpaqueJSString.h index 35543cdd6..36680388d 100644 --- a/Source/JavaScriptCore/API/OpaqueJSString.h +++ b/Source/JavaScriptCore/API/OpaqueJSString.h @@ -48,8 +48,8 @@ struct OpaqueJSString : public ThreadSafeRefCounted { JS_EXPORT_PRIVATE static PassRefPtr create(const String&); - UChar* characters() { return this ? m_characters : 0; } - unsigned length() { return this ? m_length : 0; } + const UChar* characters() { return !!this ? m_string.characters() : 0; } + unsigned length() { return !!this ? m_string.length() : 0; } String string() const; JSC::Identifier identifier(JSC::JSGlobalData*) const; @@ -58,25 +58,24 @@ private: friend class WTF::ThreadSafeRefCounted; OpaqueJSString() - : m_characters(0) - , m_length(0) { } - OpaqueJSString(const UChar* characters, unsigned length) - : m_length(length) + OpaqueJSString(const String& string) { - m_characters = new UChar[length]; - memcpy(m_characters, characters, length * sizeof(UChar)); + // Make a copy of the source string. + if (string.is8Bit()) + m_string = String(string.characters8(), string.length()); + else + m_string = String(string.characters16(), string.length()); } - ~OpaqueJSString() + OpaqueJSString(const UChar* characters, unsigned length) { - delete[] m_characters; + m_string = String(characters, length); } - UChar* m_characters; - unsigned m_length; + String m_string; }; #endif diff --git a/Source/JavaScriptCore/API/tests/minidom.c b/Source/JavaScriptCore/API/tests/minidom.c index 43ae2c1a8..bd3e119e5 100644 --- a/Source/JavaScriptCore/API/tests/minidom.c +++ b/Source/JavaScriptCore/API/tests/minidom.c @@ -30,6 +30,7 @@ #include "JSStringRef.h" #include #include +#include #include #include diff --git a/Source/JavaScriptCore/API/tests/testapi.c b/Source/JavaScriptCore/API/tests/testapi.c index 91978bbfd..b52a2b440 100644 --- a/Source/JavaScriptCore/API/tests/testapi.c +++ b/Source/JavaScriptCore/API/tests/testapi.c @@ -29,6 +29,7 @@ #include "JSObjectRefPrivate.h" #include #define ASSERT_DISABLED 0 +#include #include #include @@ -1131,6 +1132,22 @@ int main(int argc, char* argv[]) ASSERT(JSValueGetType(context, jsCFEmptyString) == kJSTypeString); ASSERT(JSValueGetType(context, jsCFEmptyStringWithCharacters) == kJSTypeString); + JSStringRef nullString = JSStringCreateWithUTF8CString(0); + const JSChar* characters = JSStringGetCharactersPtr(nullString); + if (characters) { + printf("FAIL: Didn't return null when accessing character pointer of a null String.\n"); + failed = 1; + } else + printf("PASS: returned null when accessing character pointer of a null String.\n"); + + size_t length = JSStringGetLength(nullString); + if (length) { + printf("FAIL: Didn't return 0 length for null String.\n"); + failed = 1; + } else + printf("PASS: returned 0 length for null String.\n"); + JSStringRelease(nullString); + JSObjectRef propertyCatchalls = JSObjectMake(context, PropertyCatchalls_class(context), NULL); JSStringRef propertyCatchallsString = JSStringCreateWithUTF8CString("PropertyCatchalls"); JSObjectSetProperty(context, globalObject, propertyCatchallsString, propertyCatchalls, kJSPropertyAttributeNone, NULL); @@ -1208,6 +1225,15 @@ int main(int argc, char* argv[]) } else printf("PASS: Retrieved private property.\n"); + JSStringRef nullJSON = JSStringCreateWithUTF8CString(0); + JSValueRef nullJSONObject = JSValueMakeFromJSONString(context, nullJSON); + if (nullJSONObject) { + printf("FAIL: Did not parse null String as JSON correctly\n"); + failed = 1; + } else + printf("PASS: Parsed null String as JSON correctly.\n"); + JSStringRelease(nullJSON); + JSStringRef validJSON = JSStringCreateWithUTF8CString("{\"aProperty\":true}"); JSValueRef jsonObject = JSValueMakeFromJSONString(context, validJSON); JSStringRelease(validJSON); diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt index 9a2e7b56c..4656c5aab 100644 --- a/Source/JavaScriptCore/CMakeLists.txt +++ b/Source/JavaScriptCore/CMakeLists.txt @@ -37,6 +37,7 @@ SET(JavaScriptCore_SOURCES API/JSWeakObjectMapRefPrivate.cpp API/OpaqueJSString.cpp + assembler/MacroAssembler.cpp assembler/LinkBuffer.cpp bytecode/ArrayProfile.cpp @@ -57,6 +58,7 @@ SET(JavaScriptCore_SOURCES bytecode/PutByIdStatus.cpp bytecode/ResolveGlobalStatus.cpp bytecode/SamplingTool.cpp + bytecode/SpecialPointer.cpp bytecode/StructureStubClearingWatchpoint.cpp bytecode/StructureStubInfo.cpp bytecode/Watchpoint.cpp @@ -105,12 +107,15 @@ SET(JavaScriptCore_SOURCES heap/BlockAllocator.cpp heap/CopiedSpace.cpp + heap/CopyVisitor.cpp heap/ConservativeRoots.cpp heap/DFGCodeBlocks.cpp + heap/GCThread.cpp heap/GCThreadSharedData.cpp heap/HandleSet.cpp heap/HandleStack.cpp heap/Heap.cpp + heap/HeapStatistics.cpp heap/HeapTimer.cpp heap/IncrementalSweeper.cpp heap/JITStubRoutineSet.cpp @@ -131,7 +136,7 @@ SET(JavaScriptCore_SOURCES interpreter/AbstractPC.cpp interpreter/CallFrame.cpp interpreter/Interpreter.cpp - interpreter/RegisterFile.cpp + interpreter/JSStack.cpp interpreter/VMInspector.cpp jit/ExecutableAllocator.cpp @@ -189,6 +194,7 @@ SET(JavaScriptCore_SOURCES runtime/GCActivityCallback.cpp runtime/GetterSetter.cpp runtime/Identifier.cpp + runtime/IndexingType.cpp runtime/InitializeThreading.cpp runtime/InternalFunction.cpp runtime/JSActivation.cpp @@ -201,7 +207,7 @@ SET(JavaScriptCore_SOURCES runtime/JSGlobalData.cpp runtime/JSGlobalObject.cpp runtime/JSGlobalObjectFunctions.cpp - runtime/JSGlobalThis.cpp + runtime/JSProxy.cpp runtime/JSLock.cpp runtime/JSNotAnObject.cpp runtime/JSObject.cpp diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog index a5b548cab..69429a65d 100644 --- a/Source/JavaScriptCore/ChangeLog +++ b/Source/JavaScriptCore/ChangeLog @@ -1,20458 +1,2950 @@ -2012-09-25 Gavin Barraclough +2012-10-16 Csaba Osztrogonác - REGRESSION (r129456): http/tests/security/xss-eval.html is failing on JSC platforms - https://bugs.webkit.org/show_bug.cgi?id=97529 + Unreviewed, rolling out r131516 and r131550. + http://trac.webkit.org/changeset/131516 + http://trac.webkit.org/changeset/131550 + https://bugs.webkit.org/show_bug.cgi?id=99349 - Reviewed by Filip Pizlo. - - A recent patch changed JSC's EvalError behaviour; bring this more into line with other browsers. - - JSC currently throws an EvalError if you try to call eval with a this object that doesn't - match the given eval function. This does not match other browsers, which generally just - ignore the this value that was passed, and eval the string in the eval function's environment. - - * runtime/JSGlobalObjectFunctions.cpp: - (JSC::globalFuncEval): - - Remove EvalError, ignore passed this value. - -2012-09-25 Filip Pizlo - - DFG ArrayPush, ArrayPop don't handle clobbering or having a bad time correctly - https://bugs.webkit.org/show_bug.cgi?id=97535 - - Reviewed by Oliver Hunt. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::handleIntrinsic): - * dfg/DFGStructureCheckHoistingPhase.cpp: - (JSC::DFG::StructureCheckHoistingPhase::run): - -2012-09-25 Geoffrey Garen - - JSC should dump object size inference statistics - https://bugs.webkit.org/show_bug.cgi?id=97618 - - Reviewed by Filip Pizlo. - - Added an option to dump object size inference statistics. - - To see statistics on live objects: - - jsc --showHeapStatistics=1 - - To see cumulative statistics on all objects ever allocated: - - jsc --showHeapStatistics=1 --objectsAreImmortal=1 - - (This is useful for showing GC churn caused by over-allocation.) - - To support this second mode, I refactored Zombies to separate out their - immortality feature so I could reuse it. - - * heap/Heap.cpp: - (JSC::MarkObject): Helper for making things immortal. We have to checked - for being zapped because blocks start out in this state. - - (JSC::StorageStatistics): Gather statistics by walking the heap. Ignore - arrays and hash tables for now because they're not our focus. (We'll - remove these exceptions in future.) - - (JSC::Heap::collect): Moved zombify to the end so it wouldn't interfere - with statistics gathering. - - (JSC::Heap::showStatistics): - (JSC::Heap::markAllObjects): Factored out helper, so statistics could - take advantage of immortal objects. - - (Zombify): Don't mark immortal objects -- that's another class's job now. - - (JSC::Zombify::operator()): - (JSC::Heap::zombifyDeadObjects): Take advantage of forEachDeadCell instead - of rolling our own. - - * heap/Heap.h: - (Heap): - * heap/MarkedSpace.h: - (MarkedSpace): - (JSC::MarkedSpace::forEachDeadCell): Added, so clients don't have to do - the iteration logic themselves. - - * runtime/Options.cpp: - (JSC::Options::initialize): - * runtime/Options.h: New options, listed above. Make sure to initialize - based on environment variable first, so we can override with specific settings. - -2012-09-25 Filip Pizlo - - We shouldn't use the optimized versions of shift/unshift if the user is doing crazy things to the array - https://bugs.webkit.org/show_bug.cgi?id=97603 - - - Reviewed by Gavin Barraclough. - - You changed the length behind our backs? No optimizations for you then! - - * runtime/ArrayPrototype.cpp: - (JSC::shift): - (JSC::unshift): - * runtime/JSArray.cpp: - (JSC::JSArray::shiftCount): - -2012-09-25 Filip Pizlo - - JSC bindings appear to sometimes ignore the possibility of arrays being in sparse mode - https://bugs.webkit.org/show_bug.cgi?id=95610 - - Reviewed by Oliver Hunt. - - Add better support for quickly accessing the indexed storage from bindings. - - * runtime/JSObject.h: - (JSC::JSObject::tryGetIndexQuickly): - (JSObject): - (JSC::JSObject::getDirectIndex): - (JSC::JSObject::getIndex): - -2012-09-25 Filip Pizlo - - Structure check hoisting phase doesn't know about the side-effecting nature of Arrayify - https://bugs.webkit.org/show_bug.cgi?id=97537 - - Reviewed by Mark Hahnenberg. - - No tests because if we use Arrayify then we also use PutByVal(BlankToXYZ), and the latter is - already known to be side-effecting. So this bug shouldn't have had any symptoms, as far as I - can tell. - - * dfg/DFGStructureCheckHoistingPhase.cpp: - (JSC::DFG::StructureCheckHoistingPhase::run): - -2012-09-25 Gavin Barraclough - - Regression: put beyond vector length prefers prototype setters to sparse properties - https://bugs.webkit.org/show_bug.cgi?id=97593 - - Reviewed by Geoff Garen & Filip Pizlo. - - * runtime/JSObject.cpp: - (JSC::JSObject::putByIndexBeyondVectorLength): - - Check for self properties in the sparse map - if present, don't examine the protochain. - -2012-09-24 Gavin Barraclough - - https://bugs.webkit.org/show_bug.cgi?id=97530 - Regression, freeze applied to numeric properties of non-array objects - - Reviewed by Filip Pizlo. - - Object.freeze has a fast implementation in JSObject, but this hasn't been updated to take into account numeric properties in butterflies. - For now, just fall back to the generic implementation if the object has numeric properties. - - * runtime/ObjectConstructor.cpp: - (JSC::objectConstructorFreeze): - - fallback if the object has a non-zero indexed property vector length. - -2012-09-24 Gavin Barraclough - - Bug in numeric accessors on global environment - https://bugs.webkit.org/show_bug.cgi?id=97526 - - Reviewed by Geoff Garen. - - I've hit this assert in test262 in browser, but haven't yet worked out how to repro in a test case :-/ - The sparsemap is failing to map back from the global object to the window shell. - A test case would need to resolve a numeric property name against the global environment. - - (JSC::SparseArrayEntry::get): - (JSC::SparseArrayEntry::put): - - Add missing toThisObject calls. - -2012-09-24 Filip Pizlo - - SerializedScriptValue isn't aware of indexed storage, but should be - https://bugs.webkit.org/show_bug.cgi?id=97515 - - - Reviewed by Sam Weinig. - - Export a method that WebCore now uses. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - * runtime/JSObject.h: - (JSObject): - -2012-09-24 Gavin Barraclough - - Remove JSObject::unwrappedGlobalObject(), JSObject::unwrappedObject() - https://bugs.webkit.org/show_bug.cgi?id=97519 - - Reviewed by Geoff Garen. - - unwrappedGlobalObject() was only needed because globalObject() doesn't always return a helpful result - - specifically for WebCore's window shell the structure's globalObject is set to null. We can fix this by - simply keeping the structure up to date as the window navigates, obviating the need for this function. - - The only other use of unwrappedObject() came from globalFuncEval(), and this can be trivially removed - by flipping the way we perform this globalObject check (which we may also be able to remove!) - instead - of getting the globalObject from the provided this value & comparing to the expected globalObject, we - can get the this value from the expected globalObject, and compare to that provided. - - * runtime/JSGlobalObject.cpp: - - Call globalObject() instead of unwrappedGlobalObject(). - * runtime/JSGlobalObjectFunctions.cpp: - (JSC::globalFuncEval): - - Changed to compare this object values, instead of globalObjects - - this means we only need to be able to map globalObject -> this, - and not vice versa. - * runtime/JSObject.cpp: - (JSC::JSObject::allowsAccessFrom): - (JSC::JSObject::createInheritorID): - - Call globalObject() instead of unwrappedGlobalObject(). - * runtime/JSObject.h: - (JSObject): - - Removed unwrappedGlobalObject(), unwrappedObject(). - -2012-09-24 Mark Lam - - Deleting the classic interpreter and cleaning up some build options. - https://bugs.webkit.org/show_bug.cgi?id=96969. - - Reviewed by Geoffrey Garen. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - (JSC::CodeBlock::finalizeUnconditionally): - (JSC::CodeBlock::stronglyVisitStrongReferences): - (JSC): - * bytecode/Instruction.h: - (JSC::Instruction::Instruction): - * interpreter/AbstractPC.cpp: - (JSC::AbstractPC::AbstractPC): - * interpreter/AbstractPC.h: - (AbstractPC): - * interpreter/CallFrame.h: - (ExecState): - * interpreter/Interpreter.cpp: - (JSC): - (JSC::Interpreter::Interpreter): - (JSC::Interpreter::~Interpreter): - (JSC::Interpreter::initialize): - (JSC::Interpreter::isOpcode): - (JSC::Interpreter::unwindCallFrame): - (JSC::getLineNumberForCallFrame): - (JSC::getCallerInfo): - (JSC::getSourceURLFromCallFrame): - (JSC::Interpreter::execute): - (JSC::Interpreter::executeCall): - (JSC::Interpreter::executeConstruct): - (JSC::Interpreter::retrieveArgumentsFromVMCode): - (JSC::Interpreter::retrieveCallerFromVMCode): - (JSC::Interpreter::retrieveLastCaller): - * interpreter/Interpreter.h: - (JSC::Interpreter::getOpcodeID): - (Interpreter): - * jit/ExecutableAllocatorFixedVMPool.cpp: - (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator): - * offlineasm/asm.rb: - * offlineasm/offsets.rb: - * runtime/Executable.cpp: - (JSC::EvalExecutable::compileInternal): - (JSC::ProgramExecutable::compileInternal): - (JSC::FunctionExecutable::compileForCallInternal): - (JSC::FunctionExecutable::compileForConstructInternal): - * runtime/Executable.h: - (JSC::NativeExecutable::create): - (NativeExecutable): - (JSC::NativeExecutable::finishCreation): - * runtime/JSGlobalData.cpp: - (JSC): - (JSC::JSGlobalData::JSGlobalData): - (JSC::JSGlobalData::getHostFunction): - * runtime/JSGlobalData.h: - (JSGlobalData): - (JSC::JSGlobalData::canUseJIT): - (JSC::JSGlobalData::canUseRegExpJIT): - * runtime/Options.cpp: - (JSC::Options::initialize): - -2012-09-24 Filip Pizlo - - Nested try/finally should not confuse the finally unpopper in BytecodeGenerator::emitComplexJumpScopes - https://bugs.webkit.org/show_bug.cgi?id=97508 - - - Reviewed by Sam Weinig. - - We're reusing some vector for multiple iterations of a loop, but we were forgetting to clear its - contents from one iteration to the next. Hence if you did multiple iterations of finally unpopping - (like in a nested try/finally and a jump out of both of them) then you'd get a corrupted try - context stack afterwards. - - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::emitComplexJumpScopes): - -2012-09-24 Filip Pizlo - - ValueToInt32 bool case does bad things to registers - https://bugs.webkit.org/show_bug.cgi?id=97505 - - - Reviewed by Mark Hahnenberg. - - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compileValueToInt32): - -2012-09-24 Mark Lam - - Add cloopDo instruction for debugging the llint C++ backend. - https://bugs.webkit.org/show_bug.cgi?id=97502. - - Reviewed by Geoffrey Garen. - - * offlineasm/cloop.rb: - * offlineasm/instructions.rb: - * offlineasm/parser.rb: - -2012-09-24 Filip Pizlo - - JSArray::putByIndex asserts with readonly property on prototype - https://bugs.webkit.org/show_bug.cgi?id=97435 - - - Reviewed by Geoffrey Garen. - - Boy, there were some problems: - - - putDirectIndex() should know that it can set the index quickly even if it's a hole and we're - in SlowPut mode, since that's the whole point of PutDirect. - - - We should have a fast path for putByIndex(). - - - The LiteralParser should not use push(), since that may throw if we're having a bad time. - - * interpreter/Interpreter.cpp: - (JSC::eval): - * runtime/JSObject.h: - (JSC::JSObject::putByIndexInline): - (JSObject): - (JSC::JSObject::putDirectIndex): - * runtime/LiteralParser.cpp: - (JSC::::parse): - -2012-09-24 Mark Lam - - Added a missing "if VALUE_PROFILER" around an access to ArrayProfile record. - https://bugs.webkit.org/show_bug.cgi?id=97496. - - Reviewed by Filip Pizlo. - - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - -2012-09-24 Geoffrey Garen - - Inlined activation tear-off in the DFG - https://bugs.webkit.org/show_bug.cgi?id=97487 - - Reviewed by Filip Pizlo. - - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: Activation tear-off is always inlined now, so I - removed its out-of-line implementation. - - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): Inlined the variable copy and update - of JSVariableObject::m_registers. This usually turns into < 10 instructions, - which is close to pure win as compared to the operation function call. - - * runtime/JSActivation.h: - (JSActivation): - (JSC::JSActivation::registersOffset): - (JSC::JSActivation::tearOff): - (JSC::JSActivation::isTornOff): - (JSC): - (JSC::JSActivation::storageOffset): - (JSC::JSActivation::storage): Tiny bit of refactoring so the JIT can - share the pointer math helper functions we use internally. - -2012-09-24 Balazs Kilvady - - MIPS: store8 functions added to MacroAssembler. - - MIPS store8 functions - https://bugs.webkit.org/show_bug.cgi?id=97243 - - Reviewed by Oliver Hunt. - - Add MIPS store8 functions. - - * assembler/MIPSAssembler.h: - (JSC::MIPSAssembler::lhu): New function. - (MIPSAssembler): - (JSC::MIPSAssembler::sb): New function. - (JSC::MIPSAssembler::sh): New function. - * assembler/MacroAssemblerMIPS.h: - (JSC::MacroAssemblerMIPS::store8): New function. - (MacroAssemblerMIPS): - (JSC::MacroAssemblerMIPS::store16): New function. - -2012-09-23 Geoffrey Garen - - PutScopedVar should not be marked as clobbering the world - https://bugs.webkit.org/show_bug.cgi?id=97416 - - Reviewed by Filip Pizlo. - - No performance change. - - PutScopedVar doesn't have arbitrary side-effects, so it shouldn't be marked - as such. - - * dfg/DFGNodeType.h: - (DFG): - -2012-09-23 Geoffrey Garen - - I accidentally the whole 32-bit :(. - - Unbreak the DFG in 32-bit with the 32-bit path I forgot in my last patch. - - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - -2012-09-23 Byungwoo Lee - - Fix build warnings : -Wunused-parameter, -Wparentheses, -Wuninitialized. - https://bugs.webkit.org/show_bug.cgi?id=97306 - - Reviewed by Benjamin Poulain. - - Fix build warning about -Wunused-parameter on MachineStackMarker.cpp, - LLIntSlowPaths.cpp, DatePrototype.cpp, Options.cpp by using - UNUSED_PARAM() macro or remove parameter name. - - * heap/MachineStackMarker.cpp: - (JSC::pthreadSignalHandlerSuspendResume): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::entryOSR): - * runtime/DatePrototype.cpp: - (JSC::formatLocaleDate): - * runtime/Options.cpp: - (JSC::computeNumberOfGCMarkers): - -2012-09-23 Gavin Barraclough - - Sorting a non-array creates propreties (spec-violation) - https://bugs.webkit.org/show_bug.cgi?id=25477 - - Reviewed by Oliver Hunt. - - We're just calling get() to get properties, which is converting missing properties to - undefined. Hole values should be retained, and moved to the end of the array. - - * runtime/ArrayPrototype.cpp: - (JSC::getOrHole): - - Helper function, returns JSValue() instead of undefined for missing properties. - (JSC::arrayProtoFuncSort): - - Implemented per 15.4.4.11, see comments above. - -2012-09-23 Geoffrey Garen - - CSE for access to closure variables (get_/put_scoped_var) - https://bugs.webkit.org/show_bug.cgi?id=97414 - - Reviewed by Oliver Hunt. - - I separated loading a scope from loading its storage pointer, so we can - CSE the storage pointer load. Then, I copied the global var CSE and adjusted - it for closure vars. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): Renamed GetScopeChain => GetScope to - reflect renames from a few weeks ago. - - Added a case for the storage pointer load, similar to object storage pointer load. - - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): Added an independent node for - the storage pointer. - - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::scopedVarLoadElimination): - (CSEPhase): - (JSC::DFG::CSEPhase::scopedVarStoreElimination): - (JSC::DFG::CSEPhase::getScopeLoadElimination): - (JSC::DFG::CSEPhase::getScopeRegistersLoadElimination): - (JSC::DFG::CSEPhase::setLocalStoreElimination): - (JSC::DFG::CSEPhase::performNodeCSE): Copied globalVarLoad/StoreElimination - and adapted the same logic to closure vars. - - * dfg/DFGNode.h: - (JSC::DFG::Node::hasScopeChainDepth): - (JSC::DFG::Node::scope): - (Node): - * dfg/DFGNodeType.h: - (DFG): GetScopedVar and GetGlobalVar are no longer MustGenerate. I'm not - sure why they ever were. But these are simple load operations so, if they're - unused, they're truly dead. - - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): Updated for renames and split-out - node for getting the storage pointer. - -2012-09-21 Geoffrey Garen - - Unreviewed, rolled out a line I committed by accident. - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::execute): - -2012-09-21 Geoffrey Garen - - Optimized closures that capture arguments - https://bugs.webkit.org/show_bug.cgi?id=97358 - - Reviewed by Oliver Hunt. - - Previously, the activation object was responsible for capturing all - arguments in a way that was convenient for the arguments object. Now, - we move all captured variables into a contiguous region in the stack, - allocate an activation for exactly that size, and make the arguments - object responsible for knowing all the places to which arguments could - have moved. - - This seems like the right tradeoff because - - (a) Closures are common and long-lived, so we want them to be small. - - (b) Our primary strategy for optimizing the arguments object is to make - it go away. If you're allocating arguments objects, you're already having - a bad time. - - (c) It's common to use either the arguments object or named argument - closure, but not both. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - (JSC::CodeBlock::CodeBlock): - * bytecode/CodeBlock.h: - (JSC::CodeBlock::argumentsRegister): - (JSC::CodeBlock::activationRegister): - (JSC::CodeBlock::isCaptured): - (JSC::CodeBlock::argumentIndexAfterCapture): m_numCapturedVars is gone - now -- we have an explicit range instead. - - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::BytecodeGenerator): Move captured arguments - into the captured region of local variables for space efficiency. Record - precise data about where they moved for the sake of the arguments object. - - Some of this data was previously wrong, but it didn't cause any problems - because the arguments weren't actually moving. - - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::flushArgumentsAndCapturedVariables): Don't - assume that captured vars are in any particular location -- always ask - the CodeBlock. This is better encapsulation. - - (JSC::DFG::ByteCodeParser::parseCodeBlock): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): I rename things sometimes. - - * runtime/Arguments.cpp: - (JSC::Arguments::tearOff): Account for a particularly nasty edge case. - - (JSC::Arguments::didTearOffActivation): Don't allocate our slow arguments - data on tear-off. We need to allocate it eagerly instead, since we need - to know about displaced, captured arguments during access before tear-off. - - * runtime/Arguments.h: - (JSC::Arguments::allocateSlowArguments): - (JSC::Arguments::argument): Tell our slow arguments array where all arguments - are, even if they are not captured. This simplifies some things, so we don't - have to account explicitly for the full matrix of (not torn off, torn off) - * (captured, not captured). - - (JSC::Arguments::finishCreation): Allocate our slow arguments array eagerly - because we need to know about displaced, captured arguments during access - before tear-off. - - * runtime/Executable.cpp: - (JSC::FunctionExecutable::FunctionExecutable): - (JSC::FunctionExecutable::compileForCallInternal): - (JSC::FunctionExecutable::compileForConstructInternal): - * runtime/Executable.h: - (JSC::FunctionExecutable::parameterCount): - (FunctionExecutable): - * runtime/JSActivation.cpp: - (JSC::JSActivation::visitChildren): - * runtime/JSActivation.h: - (JSActivation): - (JSC::JSActivation::create): - (JSC::JSActivation::JSActivation): - (JSC::JSActivation::registerOffset): - (JSC::JSActivation::tearOff): - (JSC::JSActivation::allocationSize): - (JSC::JSActivation::isValid): This is really the point of the patch. All - the pointer math in Activations basically boils away, since we always - copy a contiguous region of captured variables now. - - * runtime/SymbolTable.h: - (JSC::SlowArgument::SlowArgument): - (SlowArgument): - (SharedSymbolTable): - (JSC::SharedSymbolTable::captureCount): - (JSC::SharedSymbolTable::SharedSymbolTable): AllOfTheThings capture mode - is gone now -- that's the point of the patch. indexIfCaptured gets renamed - to index because we always have an index, even if not captured. (The only - time when the index is meaningless is when we're Deleted.) - -2012-09-21 Gavin Barraclough - - Eeeep - broke early boyer in bug#97382 - https://bugs.webkit.org/show_bug.cgi?id=97383 - - Rubber stamped by Sam Weinig. - - missed a child3 -> child2! - - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compileInstanceOf): - -2012-09-21 Gavin Barraclough - - Unreviewed windows build fix. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - -2012-09-21 Gavin Barraclough - - Pedantic test in Mozilla's JavaScript test suite fails. function-001.js function-001-n.js - https://bugs.webkit.org/show_bug.cgi?id=27219 - - Reviewed by Sam Weinig. - - These tests are just wrong. - See ECMA 262 A.5, FunctionDelcaration does not require a semicolon. - - * tests/mozilla/expected.html: - * tests/mozilla/js1_2/function/function-001-n.js: - * tests/mozilla/js1_3/Script/function-001-n.js: - * tests/mozilla/js1_3/regress/function-001-n.js: - -2012-09-21 Gavin Barraclough - - Remove redundant argument to op_instanceof - https://bugs.webkit.org/show_bug.cgi?id=97382 - - Reviewed by Geoff Garen. - - No longer needed after my last change. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - * bytecode/Opcode.h: - (JSC): - (JSC::padOpcodeName): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::emitInstanceOf): - * bytecompiler/BytecodeGenerator.h: - (BytecodeGenerator): - * bytecompiler/NodesCodegen.cpp: - (JSC::InstanceOfNode::emitBytecode): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compileInstanceOf): - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_instanceof): - (JSC::JIT::emitSlow_op_instanceof): - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::emit_op_instanceof): - (JSC::JIT::emitSlow_op_instanceof): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - -2012-09-21 Gavin Barraclough - - Unreviewed windows build fix. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - -2012-09-21 Gavin Barraclough - - instanceof should not get the prototype for non-default HasInstance - https://bugs.webkit.org/show_bug.cgi?id=68656 - - Reviewed by Oliver Hunt. - - Instanceof is currently implemented as a sequance of three opcodes: - check_has_instance - get_by_id(prototype) - op_instanceof - There are three interesting types of base value that instanceof can be applied to: - (A) Objects supporting default instanceof behaviour (functions, other than those created with bind) - (B) Objects overriding the default instancecof behaviour with a custom one (API objects, bound functions) - (C) Values that do not respond to the [[HasInstance]] trap. - Currently check_has_instance handles case (C), leaving the op_instanceof opcode to handle (A) & (B). There are - two problems with this apporach. Firstly, this is suboptimal for case (A), since we have to check for - hasInstance support twice (once in check_has_instance, then for default behaviour in op_instanceof). Secondly, - this means that in cases (B) we also perform the get_by_id, which is both suboptimal and an observable spec - violation. - - The fix here is to move handing of non-default instanceof (cases (B)) to the check_has_instance op, leaving - op_instanceof to handle only cases (A). - - * API/JSCallbackObject.h: - (JSCallbackObject): - * API/JSCallbackObjectFunctions.h: - (JSC::::customHasInstance): - * API/JSValueRef.cpp: - (JSValueIsInstanceOfConstructor): - - renamed hasInstance to customHasInstance - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - - added additional parameters to check_has_instance opcode - * bytecode/Opcode.h: - (JSC): - (JSC::padOpcodeName): - - added additional parameters to check_has_instance opcode - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::emitCheckHasInstance): - - added additional parameters to check_has_instance opcode - * bytecompiler/BytecodeGenerator.h: - (BytecodeGenerator): - - added additional parameters to check_has_instance opcode - * bytecompiler/NodesCodegen.cpp: - (JSC::InstanceOfNode::emitBytecode): - - added additional parameters to check_has_instance opcode - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): - - added additional parameters to check_has_instance opcode - * interpreter/Interpreter.cpp: - (JSC::isInvalidParamForIn): - (JSC::Interpreter::privateExecute): - - Add handling for non-default instanceof to op_check_has_instance - * jit/JITInlineMethods.h: - (JSC::JIT::emitArrayProfilingSiteForBytecodeIndex): - - Fixed no-LLInt no_DFG build - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_check_has_instance): - (JSC::JIT::emitSlow_op_check_has_instance): - - check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance. - (JSC::JIT::emit_op_instanceof): - (JSC::JIT::emitSlow_op_instanceof): - - no need to check for ImplementsDefaultHasInstance. - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::emit_op_check_has_instance): - (JSC::JIT::emitSlow_op_check_has_instance): - - check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance. - (JSC::JIT::emit_op_instanceof): - (JSC::JIT::emitSlow_op_instanceof): - - no need to check for ImplementsDefaultHasInstance. - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * jit/JITStubs.h: - - Add handling for non-default instanceof to op_check_has_instance - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - - move check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance. - * runtime/ClassInfo.h: - (MethodTable): - (JSC): - - renamed hasInstance to customHasInstance - * runtime/CommonSlowPaths.h: - (CommonSlowPaths): - - removed opInstanceOfSlow (this was whittled down to one function call!) - * runtime/JSBoundFunction.cpp: - (JSC::JSBoundFunction::customHasInstance): - * runtime/JSBoundFunction.h: - (JSBoundFunction): - - renamed hasInstance to customHasInstance, reimplemented. - * runtime/JSCell.cpp: - (JSC::JSCell::customHasInstance): - * runtime/JSCell.h: - (JSCell): - * runtime/JSObject.cpp: - (JSC::JSObject::hasInstance): - (JSC): - (JSC::JSObject::defaultHasInstance): - * runtime/JSObject.h: - (JSObject): - -2012-09-21 Filip Pizlo - - Unreviewed, fix ARM build. - - * assembler/MacroAssemblerARMv7.h: - (JSC::MacroAssemblerARMv7::store8): - (MacroAssemblerARMv7): - * offlineasm/armv7.rb: - -2012-09-21 Filip Pizlo - - REGRESSION (r128400): Opening Google Web Fonts page hangs or crashes - https://bugs.webkit.org/show_bug.cgi?id=97328 - - Reviewed by Mark Hahnenberg. - - It's a bad idea to emit stub code that reallocates property storage when we're in indexed - storage mode. DFGRepatch.cpp knew this and had the appropriate check in one of the places, - but it didn't have it in all of the places. - - This change also adds some more handy disassembly support, which I used to find the bug. - - * assembler/LinkBuffer.h: - (JSC): - * dfg/DFGRepatch.cpp: - (JSC::DFG::generateProtoChainAccessStub): - (JSC::DFG::tryCacheGetByID): - (JSC::DFG::tryBuildGetByIDList): - (JSC::DFG::emitPutReplaceStub): - (JSC::DFG::emitPutTransitionStub): - (JSC::DFG::tryCachePutByID): - * jit/JITStubRoutine.h: - (JSC): - -2012-09-21 Filip Pizlo - - DFG CSE assumes that a holy PutByVal does not interfere with GetArrayLength, when it clearly does - https://bugs.webkit.org/show_bug.cgi?id=97373 - - Reviewed by Mark Hahnenberg. - - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::pureCSE): - (JSC::DFG::CSEPhase::getArrayLengthElimination): - (JSC::DFG::CSEPhase::putStructureStoreElimination): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGGraph.h: - (Graph): - -2012-09-21 Chris Rogers - - Add Web Audio support for deprecated/legacy APIs - https://bugs.webkit.org/show_bug.cgi?id=97050 - - Reviewed by Eric Carlson. - - * Configurations/FeatureDefines.xcconfig: - -2012-09-21 Gavin Barraclough - - Global Math object should be configurable but isn't - https://bugs.webkit.org/show_bug.cgi?id=55343 - - Reviewed by Oliver Hunt. - - This has no performance impact. - - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::reset): - - Make 'Math' a regular property. - -2012-09-21 Chao-ying Fu - - Add MIPS or32 function - https://bugs.webkit.org/show_bug.cgi?id=97157 - - Reviewed by Gavin Barraclough. - - Add a missing or32 function. - - * assembler/MacroAssemblerMIPS.h: - (JSC::MacroAssemblerMIPS::or32): New function. - (MacroAssemblerMIPS): - -2012-09-20 Filip Pizlo - - CHECK_ARRAY_CONSISTENCY isn't being used or tested, so we should remove it - https://bugs.webkit.org/show_bug.cgi?id=97260 - - Rubber stamped by Geoffrey Garen. - - Supporting it will become difficult as we add more indexing types. It makes more - sense to kill, especially since we don't appear to use it or test it, ever. - - * runtime/ArrayConventions.h: - (JSC): - * runtime/ArrayPrototype.cpp: - (JSC::arrayProtoFuncSplice): - * runtime/ArrayStorage.h: - (JSC::ArrayStorage::copyHeaderFromDuringGC): - (ArrayStorage): - * runtime/FunctionPrototype.cpp: - (JSC::functionProtoFuncBind): - * runtime/JSArray.cpp: - (JSC::createArrayButterflyInDictionaryIndexingMode): - (JSC::JSArray::setLength): - (JSC::JSArray::pop): - (JSC::JSArray::push): - (JSC::JSArray::sortNumeric): - (JSC::JSArray::sort): - (JSC::JSArray::compactForSorting): - * runtime/JSArray.h: - (JSArray): - (JSC::createArrayButterfly): - (JSC::JSArray::tryCreateUninitialized): - (JSC::constructArray): - * runtime/JSObject.cpp: - (JSC::JSObject::putByIndex): - (JSC::JSObject::createArrayStorage): - (JSC::JSObject::deletePropertyByIndex): - (JSC): - * runtime/JSObject.h: - (JSC::JSObject::initializeIndex): - (JSObject): - -2012-09-20 Mark Lam - - Fixed a missing semicolon in the C++ llint backend. - https://bugs.webkit.org/show_bug.cgi?id=97252. - - Reviewed by Geoff Garen. - - * offlineasm/cloop.rb: - -2012-09-20 Geoffrey Garen - - Refactored the interpreter and JIT so they don't dictate closure layout - https://bugs.webkit.org/show_bug.cgi?id=97221 - - Reviewed by Oliver Hunt. - - Capture may change the location of an argument for space efficiency. This - patch removes static assumptions about argument location from the interpreter - and JIT. - - * bytecode/CodeBlock.h: - (JSC::CodeBlock::argumentIndexAfterCapture): - (JSC::ExecState::argumentAfterCapture): Factored out a helper function - so the compiler could share this logic. - - * bytecompiler/NodesCodegen.cpp: - (JSC::BracketAccessorNode::emitBytecode): Don't emit optimized bracket - access on arguments if a parameter has been captured by name. This case is - rare and, where I've seen it in the wild, the optimization mostly failed - anyway due to arguments escape, so I didn't feel like writing and testing - five copies of the code that would handle it in the baseline engines. - - The DFG can still synthesize this optimization even if we don't emit the - optimized bytecode for it. - - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - * dfg/DFGAssemblyHelpers.h: - (JSC::DFG::AssemblyHelpers::symbolTableFor): - (AssemblyHelpers): Use the right helper function to account for the fact - that a parameter may have been captured by name and moved. - - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): ASSERT that we haven't inlined - a .apply on captured arguments. Once we do start inlining such things, - we'll need to do a little bit of math here to get them right. - - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): Added support for bracket access on - an arguments object where arguments have also been captured by name. We - load the true index of the argument from a side vector. Arguments elision - is very powerful in the DFG, so I wanted to keep it working, even in this - rare case. - - * interpreter/Interpreter.cpp: - (JSC::loadVarargs): Use the right helper function to account for the fact - that a parameter may have been captured by name and moved. - - * jit/JITCall.cpp: - (JSC::JIT::compileLoadVarargs): - * jit/JITCall32_64.cpp: - (JSC::JIT::compileLoadVarargs): Don't use the inline copy loop if some - of our arguments have moved, since it would copy stale values. (We still - optimize the actual call, and elide the arguments object.) - -2012-09-20 Gabor Rapcsanyi - - [Qt] r129045 broke the ARM build - https://bugs.webkit.org/show_bug.cgi?id=97195 - - Reviewed by Zoltan Herczeg. - - Implementing missing store8 function. - - * assembler/MacroAssemblerARM.h: - (JSC::MacroAssemblerARM::store8): - (MacroAssemblerARM): - -2012-09-19 Geoffrey Garen - - OSR exit sometimes neglects to create the arguments object - https://bugs.webkit.org/show_bug.cgi?id=97162 - - Reviewed by Filip Pizlo. - - No performance change. - - I don't know of any case where this is a real problem in TOT, but it - will become a problem if we start compiling eval, with, or catch, and/or - sometimes stop doing arguments optimizations in the bytecode. - - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): Account for a - CreateArguments that has transformed into PhantomArguments. We used to - clear our reference to the CreateArguments node, but now we hold onto it, - so we need to account for it transforming. - - Don't replace a SetLocal(CreateArguments) with a SetLocal(JSValue()) - because that doesn't leave enough information behind for OSR exit to do - the right thing. Instead, maintain our reference to CreateArguments, and - rely on CreateArguments transforming into PhantomArguments after - optimization. SetLocal(PhantomArguments) is efficient, and it's a marker - for OSR exit to create the arguments object. - - Don't ASSERT that all PhantomArguments are unreferenced because we now - leave them in the graph as SetLocal(PhantomArguments), and that's harmless. - - * dfg/DFGArgumentsSimplificationPhase.h: - (NullableHashTraits): - (JSC::DFG::NullableHashTraits::emptyValue): Export our special hash table - for inline call frames so the OSR exit compiler can use it. - - * dfg/DFGOSRExitCompiler32_64.cpp: - (JSC::DFG::OSRExitCompiler::compileExit): - * dfg/DFGOSRExitCompiler64.cpp: - (JSC::DFG::OSRExitCompiler::compileExit): Don't load the 'arguments' - register to decide if we need to create the arguments object. Optimization - may have eliminated the initializing store to this register, in which - case we'll load garbage. Instead, use the global knowledge that all call - frames that optimized out 'arguments' now need to create it, and use a hash - table to make sure we do so only once per call frame. - - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): SetLocal(PhantomArguments) is unique - because we haven't just changed a value's format or elided a load or store; - instead, we've replaced an object with JSValue(). We could try to account - for this in a general way, but for now it's a special-case optimization, - so we give it a specific OSR hint instead. - -2012-09-19 Filip Pizlo - - REGRESSION(r128802): It made some JS tests crash - https://bugs.webkit.org/show_bug.cgi?id=97001 - - Reviewed by Mark Hahnenberg. - - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::visitChildren): - -2012-09-19 Filip Pizlo - - DFG should not assume that a ByVal access is generic just because it was unprofiled - https://bugs.webkit.org/show_bug.cgi?id=97088 - - Reviewed by Geoffrey Garen. - - We were not disambiguating between "Undecided" in the sense that the array profile - has no useful information versus "Undecided" in the sense that the array profile - knows that the access has not executed. That's an important distinction, since - the former form of "Undecided" means that we should consult value profiling, while - the latter means that we should force exit unless the value profiling indicates - that the access must be generic (base is not cell or property is not int). - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGArrayMode.cpp: - (JSC::DFG::fromObserved): - (JSC::DFG::refineArrayMode): - (JSC::DFG::modeAlreadyChecked): - (JSC::DFG::modeToString): - * dfg/DFGArrayMode.h: - (JSC::DFG::canCSEStorage): - (JSC::DFG::modeIsSpecific): - (JSC::DFG::modeSupportsLength): - (JSC::DFG::benefitsFromStructureCheck): - -2012-09-19 Filip Pizlo - - DFG should not emit PutByVal hole case unless it has to - https://bugs.webkit.org/show_bug.cgi?id=97080 - - Reviewed by Geoffrey Garen. - - This causes us to generate less code for typical PutByVal's. But if profiling tells us - that the hole case is being hit, we generate the same code as we would have generated - before. This seems like a slight speed-up across the board. - - * assembler/MacroAssemblerARMv7.h: - (JSC::MacroAssemblerARMv7::store8): - (MacroAssemblerARMv7): - * assembler/MacroAssemblerX86.h: - (MacroAssemblerX86): - (JSC::MacroAssemblerX86::store8): - * assembler/MacroAssemblerX86_64.h: - (MacroAssemblerX86_64): - (JSC::MacroAssemblerX86_64::store8): - * assembler/X86Assembler.h: - (X86Assembler): - (JSC::X86Assembler::movb_i8m): - * bytecode/ArrayProfile.h: - (JSC::ArrayProfile::ArrayProfile): - (JSC::ArrayProfile::addressOfMayStoreToHole): - (JSC::ArrayProfile::mayStoreToHole): - (ArrayProfile): - * dfg/DFGArrayMode.cpp: - (JSC::DFG::fromObserved): - (JSC::DFG::modeAlreadyChecked): - (JSC::DFG::modeToString): - * dfg/DFGArrayMode.h: - (DFG): - (JSC::DFG::mayStoreToHole): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * jit/JIT.h: - (JIT): - * jit/JITInlineMethods.h: - (JSC::JIT::emitArrayProfileStoreToHoleSpecialCase): - (JSC): - * jit/JITPropertyAccess.cpp: - (JSC::JIT::emit_op_put_by_val): - * jit/JITPropertyAccess32_64.cpp: - (JSC::JIT::emit_op_put_by_val): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - -2012-09-18 Filip Pizlo - - DFG should not call out to C++ every time that it tries to put to an object that doesn't yet have array storage - https://bugs.webkit.org/show_bug.cgi?id=96983 - - Reviewed by Oliver Hunt. - - Introduce more polymorphism into the DFG's array mode support. Use that to - introduce the notion of effectul array modes, where the check for the mode - will perform actions necessary to ensure that we have the mode we want, if - the object is not already in that mode. Also added profiling support for - checking if an object is of a type that would not allow us to create array - storage (like a typed array or a string for example). - - This is a ~2x speed-up on loops that transform an object that did not have - indexed storage into one that does. - - * JSCTypedArrayStubs.h: - (JSC): - * bytecode/ArrayProfile.cpp: - (JSC::ArrayProfile::computeUpdatedPrediction): - * bytecode/ArrayProfile.h: - (JSC::ArrayProfile::ArrayProfile): - (JSC::ArrayProfile::mayInterceptIndexedAccesses): - (ArrayProfile): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGArrayMode.cpp: - (JSC::DFG::fromObserved): - (DFG): - (JSC::DFG::modeAlreadyChecked): - (JSC::DFG::modeToString): - * dfg/DFGArrayMode.h: - (DFG): - (JSC::DFG::modeUsesButterfly): - (JSC::DFG::isSlowPutAccess): - (JSC::DFG::benefitsFromStructureCheck): - (JSC::DFG::isEffectful): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::getArrayMode): - (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks): - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination): - * dfg/DFGFixupPhase.cpp: - (JSC::DFG::FixupPhase::fixupNode): - (JSC::DFG::FixupPhase::checkArray): - * dfg/DFGGraph.h: - (JSC::DFG::Graph::byValIsPure): - * dfg/DFGNode.h: - (JSC::DFG::Node::hasArrayMode): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::checkArray): - (JSC::DFG::SpeculativeJIT::arrayify): - (DFG): - * dfg/DFGSpeculativeJIT.h: - (SpeculativeJIT): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * runtime/Arguments.h: - (Arguments): - * runtime/JSNotAnObject.h: - (JSNotAnObject): - * runtime/JSObject.h: - (JSObject): - (JSC::JSObject::ensureArrayStorage): - * runtime/JSString.h: - (JSC::JSString::createStructure): - -2012-09-18 Filip Pizlo - - Include PhantomArguments in DFGDisassembly - https://bugs.webkit.org/show_bug.cgi?id=97043 - - Reviewed by Geoffrey Garen. - - * dfg/DFGNode.h: - (JSC::DFG::Node::willHaveCodeGenOrOSR): - -2012-09-18 Filip Pizlo - - REGRESSION(r128802): It made some JS tests crash - https://bugs.webkit.org/show_bug.cgi?id=97001 - - Reviewed by Mark Hahnenberg. - - IndexingHeaderInlineMethods was incorrectly assuming that if the HasArrayStorage bit is clear, then that means that indexing payload capacity is zero. - - * runtime/IndexingHeaderInlineMethods.h: - (JSC::IndexingHeader::preCapacity): - (JSC::IndexingHeader::indexingPayloadSizeInBytes): - -2012-09-18 Mark Hahnenberg - - Use WTF::HasTrivialDestructor instead of compiler-specific versions in JSC::NeedsDestructor - https://bugs.webkit.org/show_bug.cgi?id=96980 - - Reviewed by Benjamin Poulain. - - * runtime/JSCell.h: - (JSC): - (NeedsDestructor): - -2012-09-18 Filip Pizlo - - DFGOperations doesn't use NativeCallFrameTracer in enough places - https://bugs.webkit.org/show_bug.cgi?id=96987 - - Reviewed by Mark Hahnenberg. - - Anything that can GC should use it. - - * dfg/DFGOperations.cpp: - -2012-09-18 Mark Lam - - Not reviewed. Attempt at greening the WinCairo bot. Touching - LowLevelInterpreter.asm to trigger a rebuild of LLIntDesiredOffsets. - https://bugs.webkit.org/show_bug.cgi?id=96992. - - * llint/LowLevelInterpreter.asm: - -2012-09-18 Peter Gal - - [Qt] REGRESSION(r128790): It broke the ARM build - https://bugs.webkit.org/show_bug.cgi?id=96968 - - Reviewed by Filip Pizlo. - - Implement the missing or32 method in the MacroAssemblerARM.h. - - * assembler/MacroAssemblerARM.h: - (JSC::MacroAssemblerARM::or32): - (MacroAssemblerARM): - -2012-09-18 Mark Lam - - Fix for WinCairo builds. - https://bugs.webkit.org/show_bug.cgi?id=96992. - - Reviewed by Filip Pizlo. - - Adding additional vcproj build targets in LLIntDesiredOffsets.vcproj, - LLIntOffsetsExtractor.vcproj, and LLIntAssembly.vcproj to match those - in jsc.vcproj. - - * JavaScriptCore.vcproj/LLIntAssembly/LLIntAssembly.vcproj: - * JavaScriptCore.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcproj: - * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcproj: - * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.vsprops: Added property svn:eol-style. - * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.vsprops: Added property svn:eol-style. - * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebugAll.vsprops: Added. - * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebugCairoCFLite.vsprops: Added. - * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorProduction.vsprops: Added. - * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.vsprops: Added property svn:eol-style. - * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorReleaseCairoCFLite.vsprops: Added. - * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorReleasePGO.vsprops: Added. - -2012-09-18 Filip Pizlo - - Unreviewed, fix sloppy English in comment. - - * runtime/JSGlobalObject.cpp: - (JSC): - -2012-09-17 Csaba Osztrogonác - - Unreviewed, rolling out r128826 and r128813. - - * API/JSCallbackConstructor.cpp: - (JSC): - (JSC::JSCallbackConstructor::JSCallbackConstructor): - * API/JSCallbackConstructor.h: - (JSCallbackConstructor): - * API/JSCallbackObject.cpp: - (JSC): - (JSC::::createStructure): - * API/JSCallbackObject.h: - (JSC::JSCallbackObject::create): - (JSCallbackObject): - * API/JSClassRef.cpp: - (OpaqueJSClass::prototype): - * API/JSObjectRef.cpp: - (JSObjectMake): - (JSObjectGetPrivate): - (JSObjectSetPrivate): - (JSObjectGetPrivateProperty): - (JSObjectSetPrivateProperty): - (JSObjectDeletePrivateProperty): - * API/JSValueRef.cpp: - (JSValueIsObjectOfClass): - * API/JSWeakObjectMapRefPrivate.cpp: - * GNUmakefile.list.am: - * JSCTypedArrayStubs.h: - (JSC): - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): - (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject): - * heap/Heap.cpp: - (JSC::Heap::isSafeToSweepStructures): - (JSC): - * heap/Heap.h: - (JSC::Heap::allocatorForObjectWithDestructor): - (Heap): - (JSC::Heap::allocateWithDestructor): - (JSC::Heap::allocateStructure): - (JSC): - * heap/IncrementalSweeper.cpp: - (JSC::IncrementalSweeper::IncrementalSweeper): - (JSC::IncrementalSweeper::sweepNextBlock): - (JSC::IncrementalSweeper::startSweeping): - (JSC::IncrementalSweeper::willFinishSweeping): - (JSC::IncrementalSweeper::structuresCanBeSwept): - (JSC): - * heap/IncrementalSweeper.h: - (IncrementalSweeper): - * heap/MarkedAllocator.cpp: - (JSC::MarkedAllocator::tryAllocateHelper): - (JSC::MarkedAllocator::allocateBlock): - * heap/MarkedAllocator.h: - (JSC::MarkedAllocator::cellsNeedDestruction): - (JSC::MarkedAllocator::onlyContainsStructures): - (MarkedAllocator): - (JSC::MarkedAllocator::MarkedAllocator): - (JSC::MarkedAllocator::init): - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::create): - (JSC::MarkedBlock::MarkedBlock): - (JSC): - (JSC::MarkedBlock::specializedSweep): - (JSC::MarkedBlock::sweep): - (JSC::MarkedBlock::sweepHelper): - * heap/MarkedBlock.h: - (JSC): - (MarkedBlock): - (JSC::MarkedBlock::cellsNeedDestruction): - (JSC::MarkedBlock::onlyContainsStructures): - * heap/MarkedSpace.cpp: - (JSC::MarkedSpace::MarkedSpace): - (JSC::MarkedSpace::resetAllocators): - (JSC::MarkedSpace::canonicalizeCellLivenessData): - (JSC::MarkedSpace::isPagedOut): - (JSC::MarkedSpace::freeBlock): - * heap/MarkedSpace.h: - (MarkedSpace): - (Subspace): - (JSC::MarkedSpace::allocatorFor): - (JSC::MarkedSpace::destructorAllocatorFor): - (JSC::MarkedSpace::allocateWithDestructor): - (JSC::MarkedSpace::allocateStructure): - (JSC::MarkedSpace::forEachBlock): - * heap/SlotVisitor.cpp: - * jit/JIT.h: - * jit/JITInlineMethods.h: - (JSC::JIT::emitAllocateBasicJSObject): - (JSC::JIT::emitAllocateJSFinalObject): - (JSC::JIT::emitAllocateJSArray): - * jsc.cpp: - (GlobalObject::create): - * runtime/Arguments.cpp: - (JSC): - * runtime/Arguments.h: - (Arguments): - (JSC::Arguments::Arguments): - * runtime/ErrorPrototype.cpp: - (JSC): - * runtime/Executable.h: - * runtime/InternalFunction.cpp: - (JSC): - (JSC::InternalFunction::InternalFunction): - * runtime/InternalFunction.h: - (InternalFunction): - * runtime/JSCell.h: - (JSC): - (JSC::allocateCell): - * runtime/JSDestructibleObject.h: Removed. - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::reset): - (JSC): - * runtime/JSGlobalObject.h: - (JSGlobalObject): - (JSC::JSGlobalObject::createRareDataIfNeeded): - (JSC::JSGlobalObject::create): - * runtime/JSGlobalThis.h: - (JSGlobalThis): - (JSC::JSGlobalThis::JSGlobalThis): - * runtime/JSPropertyNameIterator.h: - * runtime/JSScope.cpp: - (JSC): - * runtime/JSString.h: - (JSC): - * runtime/JSWrapperObject.h: - (JSWrapperObject): - (JSC::JSWrapperObject::JSWrapperObject): - * runtime/MathObject.cpp: - (JSC): - * runtime/NameInstance.h: - (NameInstance): - * runtime/RegExp.h: - * runtime/RegExpObject.cpp: - (JSC): - * runtime/SparseArrayValueMap.h: - * runtime/Structure.h: - (JSC::Structure): - (JSC::JSCell::classInfo): - (JSC): - * runtime/StructureChain.h: - * runtime/SymbolTable.h: - * testRegExp.cpp: - (GlobalObject::create): - -2012-09-17 Geoffrey Garen - - Refactored the arguments object so it doesn't dictate closure layout - https://bugs.webkit.org/show_bug.cgi?id=96955 - - Reviewed by Oliver Hunt. - - * bytecode/CodeBlock.h: - (JSC::ExecState::argumentAfterCapture): Helper function for accessing an - argument that has been moved for capture. - - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::BytecodeGenerator): Generate metadata for arguments - that are captured. We don't move any arguments yet, but we do use this - metadata to tell the arguments object if an argument is stored in the - activation. - - * dfg/DFGOperations.cpp: - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments): - (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): Updated for the arguments object not - malloc'ing a separate backing store, and for a rename from deletedArguments - to slowArguments. - - * interpreter/CallFrame.h: - (ExecState): - * interpreter/Interpreter.cpp: - (JSC::Interpreter::unwindCallFrame): - (JSC::Interpreter::privateExecute): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): Updated for small interface changes. - - * runtime/Arguments.cpp: - (JSC::Arguments::visitChildren): - (JSC::Arguments::copyToArguments): - (JSC::Arguments::fillArgList): - (JSC::Arguments::getOwnPropertySlotByIndex): - (JSC::Arguments::createStrictModeCallerIfNecessary): - (JSC::Arguments::createStrictModeCalleeIfNecessary): - (JSC::Arguments::getOwnPropertySlot): - (JSC::Arguments::getOwnPropertyDescriptor): - (JSC::Arguments::getOwnPropertyNames): - (JSC::Arguments::putByIndex): - (JSC::Arguments::put): - (JSC::Arguments::deletePropertyByIndex): - (JSC::Arguments::deleteProperty): - (JSC::Arguments::defineOwnProperty): - (JSC::Arguments::tearOff): Moved all data inline into the object, for speed, - and refactored all internal argument accesses to use helper functions, so - we can change the implementation without changing lots of code. - - (JSC::Arguments::didTearOffActivation): This function needs to account - for arguments that were moved by the activation object. We do this accounting - through a side vector that tells us where our arguments will be in the - activation. - - (JSC::Arguments::tearOffForInlineCallFrame): - * runtime/Arguments.h: - (Arguments): - (JSC::Arguments::length): - (JSC::Arguments::isTornOff): - (JSC::Arguments::Arguments): - (JSC::Arguments::allocateSlowArguments): - (JSC::Arguments::tryDeleteArgument): - (JSC::Arguments::trySetArgument): - (JSC::Arguments::tryGetArgument): - (JSC::Arguments::isDeletedArgument): - (JSC::Arguments::isArgument): - (JSC::Arguments::argument): - (JSC::Arguments::finishCreation): - - * runtime/JSActivation.h: - (JSC::JSActivation::create): - (JSActivation): - (JSC::JSActivation::captureStart): - (JSC::JSActivation::storageSize): - (JSC::JSActivation::registerOffset): - (JSC::JSActivation::isValid): The activation object is no longer responsible - for copying extra arguments provided by the caller. The argumnents object - does this instead. This means we can allocate and initialize an activation - without worrying about the call frame's argument count. - - * runtime/SymbolTable.h: - (JSC::SlowArgument::SlowArgument): - (SlowArgument): - (JSC): - (JSC::SharedSymbolTable::parameterCount): - (SharedSymbolTable): - (JSC::SharedSymbolTable::slowArguments): - (JSC::SharedSymbolTable::setSlowArguments): Added data structures to back - the algorithms above. - -2012-09-17 Filip Pizlo - - 32-bit LLInt get_by_val does vector length checks incorrectly - https://bugs.webkit.org/show_bug.cgi?id=96893 - - - Reviewed by Mark Hahnenberg. - - * llint/LowLevelInterpreter32_64.asm: - -2012-09-17 Filip Pizlo - - We don't have a bad enough time if an object's prototype chain crosses global objects - https://bugs.webkit.org/show_bug.cgi?id=96962 - - Reviewed by Geoffrey Garen. - - * runtime/JSGlobalObject.cpp: - (JSC): - -2012-09-17 Filip Pizlo - - Unreviewed, fix a broken assertion in offlineasm. - - * offlineasm/armv7.rb: - * offlineasm/backends.rb: - -2012-09-16 Mark Hahnenberg - - Delayed structure sweep can leak structures without bound - https://bugs.webkit.org/show_bug.cgi?id=96546 - - Reviewed by Gavin Barraclough. - - This patch gets rid of the separate Structure allocator in the MarkedSpace and adds two new destructor-only - allocators. We now have separate allocators for our three types of objects: those objects with no destructors, - those objects with destructors and with immortal structures, and those objects with destructors that don't have - immortal structures. All of the objects of the third type (destructors without immortal structures) now - inherit from a new class named JSDestructibleObject (which in turn is a subclass of JSNonFinalObject), which stores - the ClassInfo for these classes at a fixed offset for safe retrieval during sweeping/destruction. - - * API/JSCallbackConstructor.cpp: Use JSDestructibleObject for JSCallbackConstructor. - (JSC): - (JSC::JSCallbackConstructor::JSCallbackConstructor): - * API/JSCallbackConstructor.h: - (JSCallbackConstructor): - * API/JSCallbackObject.cpp: Inherit from JSDestructibleObject for normal JSCallbackObjects and use a finalizer for - JSCallbackObject, since JSGlobalObject also uses a finalizer. - (JSC): - (JSC::::create): We need to move the create function for JSCallbackObject out of line so we can add - the finalizer for it. We don't want to add the finalizer is something like finishCreation in case somebody decides - to subclass this. We use this same technique for many other subclasses of JSGlobalObject. - (JSC::::createStructure): - * API/JSCallbackObject.h: - (JSCallbackObject): - (JSC): - * API/JSClassRef.cpp: Change all the JSCallbackObject to use JSDestructibleObject instead. - (OpaqueJSClass::prototype): - * API/JSObjectRef.cpp: Ditto. - (JSObjectMake): - (JSObjectGetPrivate): - (JSObjectSetPrivate): - (JSObjectGetPrivateProperty): - (JSObjectSetPrivateProperty): - (JSObjectDeletePrivateProperty): - * API/JSValueRef.cpp: Ditto. - (JSValueIsObjectOfClass): - * API/JSWeakObjectMapRefPrivate.cpp: Ditto. - * JSCTypedArrayStubs.h: - (JSC): - * JavaScriptCore.xcodeproj/project.pbxproj: - * dfg/DFGSpeculativeJIT.h: Use the proper allocator type when doing inline allocation in the DFG. - (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): - (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject): - * heap/Heap.cpp: - (JSC): - * heap/Heap.h: Add accessors for the various types of allocators now. Also remove the isSafeToSweepStructures function - since it's always safe to sweep Structures now. - (JSC::Heap::allocatorForObjectWithNormalDestructor): - (JSC::Heap::allocatorForObjectWithImmortalStructureDestructor): - (Heap): - (JSC::Heap::allocateWithNormalDestructor): - (JSC): - (JSC::Heap::allocateWithImmortalStructureDestructor): - * heap/IncrementalSweeper.cpp: Remove all the logic to detect when it's safe to sweep Structures from the - IncrementalSweeper since it's always safe to sweep Structures now. - (JSC::IncrementalSweeper::IncrementalSweeper): - (JSC::IncrementalSweeper::sweepNextBlock): - (JSC::IncrementalSweeper::startSweeping): - (JSC::IncrementalSweeper::willFinishSweeping): - (JSC): - * heap/IncrementalSweeper.h: - (IncrementalSweeper): - * heap/MarkedAllocator.cpp: Remove the logic that was preventing us from sweeping Structures if it wasn't safe. Add - tracking of the specific destructor type of allocator. - (JSC::MarkedAllocator::tryAllocateHelper): - (JSC::MarkedAllocator::allocateBlock): - * heap/MarkedAllocator.h: - (JSC::MarkedAllocator::destructorType): - (MarkedAllocator): - (JSC::MarkedAllocator::MarkedAllocator): - (JSC::MarkedAllocator::init): - * heap/MarkedBlock.cpp: Add all the destructor type stuff to MarkedBlocks so that we do the right thing when sweeping. - We also use the stored destructor type to determine the right thing to do in all JSCell::classInfo() calls. - (JSC::MarkedBlock::create): - (JSC::MarkedBlock::MarkedBlock): - (JSC): - (JSC::MarkedBlock::specializedSweep): - (JSC::MarkedBlock::sweep): - (JSC::MarkedBlock::sweepHelper): - * heap/MarkedBlock.h: - (JSC): - (JSC::MarkedBlock::allocator): - (JSC::MarkedBlock::destructorType): - * heap/MarkedSpace.cpp: Add the new destructor allocators to MarkedSpace. - (JSC::MarkedSpace::MarkedSpace): - (JSC::MarkedSpace::resetAllocators): - (JSC::MarkedSpace::canonicalizeCellLivenessData): - (JSC::MarkedSpace::isPagedOut): - (JSC::MarkedSpace::freeBlock): - * heap/MarkedSpace.h: - (MarkedSpace): - (JSC::MarkedSpace::immortalStructureDestructorAllocatorFor): - (JSC::MarkedSpace::normalDestructorAllocatorFor): - (JSC::MarkedSpace::allocateWithImmortalStructureDestructor): - (JSC::MarkedSpace::allocateWithNormalDestructor): - (JSC::MarkedSpace::forEachBlock): - * heap/SlotVisitor.cpp: Add include because the symbol was needed in an inlined function. - * jit/JIT.h: Make sure we use the correct allocator when doing inline allocations in the baseline JIT. - * jit/JITInlineMethods.h: - (JSC::JIT::emitAllocateBasicJSObject): - (JSC::JIT::emitAllocateJSFinalObject): - (JSC::JIT::emitAllocateJSArray): - * jsc.cpp: - (GlobalObject::create): Add finalizer here since JSGlobalObject needs to use a finalizer instead of inheriting from - JSDestructibleObject. - * runtime/Arguments.cpp: Inherit from JSDestructibleObject. - (JSC): - * runtime/Arguments.h: - (Arguments): - (JSC::Arguments::Arguments): - * runtime/ErrorPrototype.cpp: Added an assert to make sure we have a trivial destructor. - (JSC): - * runtime/Executable.h: Indicate that all of the Executable* classes have immortal Structures. - (JSC): - * runtime/InternalFunction.cpp: Inherit from JSDestructibleObject. - (JSC): - (JSC::InternalFunction::InternalFunction): - * runtime/InternalFunction.h: - (InternalFunction): - * runtime/JSCell.h: Added the NEEDS_DESTRUCTOR macro to make it easier for classes to indicate that instead of being - allocated in a destructor MarkedAllocator that they will handle their destruction themselves through the - use of a finalizer. - (JSC): - (HasImmortalStructure): New template to help us determine at compile-time if a particular class - should be allocated in the immortal structure MarkedAllocator. The default value is false. In order - to be allocated in the immortal structure allocator, classes must specialize this template. Also added - a macro to make it easier for classes to specialize the template. - (JSC::allocateCell): Use the appropriate allocator depending on the destructor type. - * runtime/JSDestructibleObject.h: Added. New class that stores the ClassInfo of any subclass so that it can be - accessed safely when the object is being destroyed. - (JSC): - (JSDestructibleObject): - (JSC::JSDestructibleObject::classInfo): - (JSC::JSDestructibleObject::JSDestructibleObject): - (JSC::JSCell::classInfo): Checks the current MarkedBlock to see where it should get the ClassInfo from so that it's always safe. - * runtime/JSGlobalObject.cpp: JSGlobalObject now uses a finalizer instead of a destructor so that it can avoid forcing all - of its relatives in the inheritance hierarchy (e.g. JSScope) to use destructors as well. - (JSC::JSGlobalObject::reset): - * runtime/JSGlobalObject.h: - (JSGlobalObject): - (JSC::JSGlobalObject::createRareDataIfNeeded): Since we always create a finalizer now, we don't have to worry about adding one - for the m_rareData field when it's created. - (JSC::JSGlobalObject::create): - (JSC): - * runtime/JSGlobalThis.h: Inherit from JSDestructibleObject. - (JSGlobalThis): - (JSC::JSGlobalThis::JSGlobalThis): - * runtime/JSPropertyNameIterator.h: Has an immortal Structure. - (JSC): - * runtime/JSScope.cpp: - (JSC): - * runtime/JSString.h: Has an immortal Structure. - (JSC): - * runtime/JSWrapperObject.h: Inherit from JSDestructibleObject. - (JSWrapperObject): - (JSC::JSWrapperObject::JSWrapperObject): - * runtime/MathObject.cpp: Cleaning up some of the inheritance stuff. - (JSC): - * runtime/NameInstance.h: Inherit from JSDestructibleObject. - (NameInstance): - * runtime/RegExp.h: Has immortal Structure. - (JSC): - * runtime/RegExpObject.cpp: Inheritance cleanup. - (JSC): - * runtime/SparseArrayValueMap.h: Has immortal Structure. - (JSC): - * runtime/Structure.h: Has immortal Structure. - (JSC): - * runtime/StructureChain.h: Ditto. - (JSC): - * runtime/SymbolTable.h: Ditto. - (SharedSymbolTable): - (JSC): - -2012-09-17 Filip Pizlo - - If a prototype has indexed setters and its instances have indexed storage, then all put_by_val's should have a bad time - https://bugs.webkit.org/show_bug.cgi?id=96596 - - Reviewed by Gavin Barraclough. - - Added comprehensive support for accessors and read-only indexed properties on the - prototype chain. This is done without any performance regression on benchmarks that - we're aware of, by having the entire VM's strategy with respect to arrays tilted - heavily in favor of: - - - The prototype chain of JSArrays never having any accessors or read-only indexed - properties. If that changes, you're going to have a bad time. - - - Prototypes of non-JSArray objects either having no indexed accessors or read-only - indexed properties, or, having those indexed accessor thingies inserted before - any instance object (i.e. object with that prototype as its prototype) is created. - If you add indexed accessors or read-only indexed properties to an object that is - already used as a prototype, you're going to have a bad time. - - See below for the exact definition of having a bad time. - - Put another way, "fair" uses of indexed accessors and read-only indexed properties - are: - - - Put indexed accessors and read-only indexed properties on an object that is never - used as a prototype. This will slow down accesses to that object, but will not - have any effect on any other object. - - - Put those indexed accessor thingies on an object before it is used as a prototype - and then start instantiating objects that claim that object as their prototype. - This will slightly slow down indexed stores to the instance objects, and greatly - slow down all indexed accesses to the prototype, but will have no other effect. - - In short, "fair" uses only affect the object itself and any instance objects. But - if you start using indexed accessors in more eclectic ways, you're going to have - a bad time. - - Specifically, if an object that may be used as a prototype has an indexed accessor - added, the VM performs a whole-heap scan to find all objects that belong to the - same global object as the prototype you modified. If any of those objects has - indexed storage, their indexed storage is put into slow-put mode, just as if their - prototype chain had indexed accessors. This will happen even for objects that do - not currently have indexed accessors in their prototype chain. As well, all JSArray - allocations are caused to create arrays with slow-put storage, and all future - allocations of indexed storage for non-JSArray objects are also flipped to slow-put - mode. Note there are two aspects to having a bad time: (i) the whole-heap scan and - (ii) the poisoning of all indexed storage in the entire global object. (i) is - necessary for correctness. If we detect that an object that may be used as a - prototype has had an indexed accessor or indexed read-only property inserted into - it, then we need to ensure that henceforth all instances of that object inspect - the prototype chain whenever an indexed hole is stored to. But by default, indexed - stores do no such checking because doing so would be unnecessarily slow. So, we must - find all instances of the affected object and flip them into a different array - storage mode that omits all hole optimizations. Since prototypes never keep a list - of instance objects, the only way to find those objects is a whole-heap scan. But - (i) alone would be a potential disaster, if a program frequently allocated an - object without indexed accessors, then allocated a bunch of objects that used that - one as their prototype, and then added indexed accessors to the prototype. So, to - prevent massive heap scan storms in such awkward programs, having a bad time also - implies (ii): henceforth *all* objects belonging to that global object will use - slow put indexed storage, so that we don't ever have to scan the heap again. Note - that here we are using the global object as just an approximation of a program - module; it may be worth investigating in the future if other approximations can be - used instead. - - * bytecode/ArrayProfile.h: - (JSC): - (JSC::arrayModeFromStructure): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGArrayMode.cpp: - (JSC::DFG::fromObserved): - (JSC::DFG::modeAlreadyChecked): - (JSC::DFG::modeToString): - * dfg/DFGArrayMode.h: - (DFG): - (JSC::DFG::isSlowPutAccess): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::checkArray): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * jit/JIT.h: - * jit/JITInlineMethods.h: - (JSC::JIT::emitAllocateJSArray): - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_new_array): - * runtime/ArrayPrototype.cpp: - (JSC::ArrayPrototype::finishCreation): - (JSC::arrayProtoFuncSort): - * runtime/IndexingType.h: - (JSC): - (JSC::hasIndexedProperties): - (JSC::hasIndexingHeader): - (JSC::hasArrayStorage): - (JSC::shouldUseSlowPut): - * runtime/JSArray.cpp: - (JSC::JSArray::pop): - (JSC::JSArray::push): - (JSC::JSArray::fillArgList): - (JSC::JSArray::copyToArguments): - * runtime/JSArray.h: - (JSC::JSArray::createStructure): - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::JSGlobalObject): - (JSC::JSGlobalObject::reset): - (JSC): - (JSC::JSGlobalObject::haveABadTime): - * runtime/JSGlobalObject.h: - (JSGlobalObject): - (JSC::JSGlobalObject::addressOfArrayStructure): - (JSC::JSGlobalObject::havingABadTimeWatchpoint): - (JSC::JSGlobalObject::isHavingABadTime): - * runtime/JSObject.cpp: - (JSC::JSObject::visitButterfly): - (JSC::JSObject::getOwnPropertySlotByIndex): - (JSC::JSObject::put): - (JSC::JSObject::putByIndex): - (JSC::JSObject::enterDictionaryIndexingMode): - (JSC::JSObject::notifyPresenceOfIndexedAccessors): - (JSC): - (JSC::JSObject::createArrayStorage): - (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode): - (JSC::JSObject::switchToSlowPutArrayStorage): - (JSC::JSObject::setPrototype): - (JSC::JSObject::resetInheritorID): - (JSC::JSObject::inheritorID): - (JSC::JSObject::allowsAccessFrom): - (JSC::JSObject::deletePropertyByIndex): - (JSC::JSObject::getOwnPropertyNames): - (JSC::JSObject::unwrappedGlobalObject): - (JSC::JSObject::notifyUsedAsPrototype): - (JSC::JSObject::createInheritorID): - (JSC::JSObject::defineOwnIndexedProperty): - (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype): - (JSC::JSObject::attemptToInterceptPutByIndexOnHole): - (JSC::JSObject::putByIndexBeyondVectorLength): - (JSC::JSObject::putDirectIndexBeyondVectorLength): - (JSC::JSObject::getNewVectorLength): - (JSC::JSObject::getOwnPropertyDescriptor): - * runtime/JSObject.h: - (JSC::JSObject::mayBeUsedAsPrototype): - (JSObject): - (JSC::JSObject::mayInterceptIndexedAccesses): - (JSC::JSObject::getArrayLength): - (JSC::JSObject::getVectorLength): - (JSC::JSObject::canGetIndexQuickly): - (JSC::JSObject::getIndexQuickly): - (JSC::JSObject::canSetIndexQuickly): - (JSC::JSObject::setIndexQuickly): - (JSC::JSObject::initializeIndex): - (JSC::JSObject::completeInitialization): - (JSC::JSObject::inSparseIndexingMode): - (JSC::JSObject::arrayStorage): - (JSC::JSObject::arrayStorageOrNull): - (JSC::JSObject::ensureArrayStorage): - (JSC): - (JSC::JSValue::putByIndex): - * runtime/JSValue.cpp: - (JSC::JSValue::putToPrimitive): - (JSC::JSValue::putToPrimitiveByIndex): - (JSC): - * runtime/JSValue.h: - (JSValue): - * runtime/ObjectPrototype.cpp: - (JSC::ObjectPrototype::finishCreation): - * runtime/SparseArrayValueMap.cpp: - (JSC::SparseArrayValueMap::putEntry): - (JSC::SparseArrayEntry::put): - (JSC): - * runtime/SparseArrayValueMap.h: - (JSC): - (SparseArrayEntry): - * runtime/Structure.cpp: - (JSC::Structure::anyObjectInChainMayInterceptIndexedAccesses): - (JSC): - (JSC::Structure::suggestedIndexingTransition): - * runtime/Structure.h: - (Structure): - (JSC::Structure::mayInterceptIndexedAccesses): - * runtime/StructureTransitionTable.h: - (JSC::newIndexingType): - -2012-09-17 Filip Pizlo - - Array profiling has convergence issues - https://bugs.webkit.org/show_bug.cgi?id=96891 - - Reviewed by Gavin Barraclough. - - Now each array profiling site merges in the indexing type it observed into - the m_observedArrayModes bitset. The ArrayProfile also uses this to detect - cases where the structure must have gone polymorphic (if the bitset is - polymorphic then the structure must be). This achieves something like the - best of both worlds: on the one hand, we get a probabilistic structure that - we can use to optimize the monomorphic structure case, but on the other hand, - we get an accurate view of the set of types that were encountered. - - * assembler/MacroAssemblerARMv7.h: - (JSC::MacroAssemblerARMv7::or32): - (MacroAssemblerARMv7): - * assembler/MacroAssemblerX86.h: - (JSC::MacroAssemblerX86::or32): - (MacroAssemblerX86): - * assembler/MacroAssemblerX86_64.h: - (JSC::MacroAssemblerX86_64::or32): - (MacroAssemblerX86_64): - * assembler/X86Assembler.h: - (X86Assembler): - (JSC::X86Assembler::orl_rm): - * bytecode/ArrayProfile.cpp: - (JSC::ArrayProfile::computeUpdatedPrediction): - * bytecode/ArrayProfile.h: - (JSC::ArrayProfile::addressOfArrayModes): - (JSC::ArrayProfile::structureIsPolymorphic): - * jit/JIT.h: - (JIT): - * jit/JITInlineMethods.h: - (JSC): - (JSC::JIT::emitArrayProfilingSite): - * jit/JITPropertyAccess.cpp: - (JSC::JIT::emit_op_get_by_val): - (JSC::JIT::emit_op_put_by_val): - (JSC::JIT::privateCompilePatchGetArrayLength): - * jit/JITPropertyAccess32_64.cpp: - (JSC::JIT::emit_op_get_by_val): - (JSC::JIT::emit_op_put_by_val): - (JSC::JIT::privateCompilePatchGetArrayLength): - * llint/LowLevelInterpreter.asm: - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - -2012-09-17 Mark Lam - - Not reviewed. Added svn:eol-style native to unbreak some build bots. - https://bugs.webkit.org/show_bug.cgi?id=96175. - - * JavaScriptCore.vcproj/LLIntAssembly/LLIntAssembly.vcproj: Added property svn:eol-style. - * JavaScriptCore.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcproj: Added property svn:eol-style. - * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcproj: Added property svn:eol-style. - -2012-09-16 Mark Lam - - Added MSVC project changes to enable building the llint. - https://bugs.webkit.org/show_bug.cgi?id=96175. - - Reviewed by Geoff Garen. - - This only adds the ability to build the llint, but currently, only the - C++ backend is supported. By default, the Windows port will remain - running with the baseline JIT. The llint will not be enabled. - - * JavaScriptCore.vcproj/JavaScriptCore.sln: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.vcproj/LLIntAssembly: Added. - * JavaScriptCore.vcproj/LLIntAssembly/LLIntAssembly.make: Added. - * JavaScriptCore.vcproj/LLIntAssembly/LLIntAssembly.vcproj: Added. - * JavaScriptCore.vcproj/LLIntAssembly/build-LLIntAssembly.sh: Added. - * JavaScriptCore.vcproj/LLIntDesiredOffsets: Added. - * JavaScriptCore.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.make: Added. - * JavaScriptCore.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcproj: Added. - * JavaScriptCore.vcproj/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh: Added. - * JavaScriptCore.vcproj/LLIntOffsetsExtractor: Added. - * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcproj: Added. - * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.vsprops: Added. - * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.vsprops: Added. - * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.vsprops: Added. - -2012-09-16 Filip Pizlo - - JSObject.cpp and JSArray.cpp have inconsistent tests for the invalid array index case - https://bugs.webkit.org/show_bug.cgi?id=96878 - - Reviewed by Sam Weinig. - - Removed the uses of UNLIKELY() because I don't believe they are buying us anything, - since we're already on the slow path. Also found other places where we're testing for - the invalid array index case using unusual predicates rather than just using - MAX_ARRAY_INDEX. With this change, I believe that all of our tests for invalid - array indices (i.e. indices that should be treated as non-indexed properties) - uniformly use MAX_ARRAY_INDEX and PropertyName::NotAnIndex. - - * runtime/JSArray.cpp: - (JSC::JSArray::push): - * runtime/JSObject.cpp: - (JSC::JSObject::putByIndex): - (JSC::JSObject::defineOwnIndexedProperty): - -2012-09-15 Filip Pizlo - - Following the Butterfly refactoring, the comment for lastArraySize was not updated - https://bugs.webkit.org/show_bug.cgi?id=96877 - - Reviewed by Sam Weinig. - - * runtime/JSObject.cpp: - (JSC): - -2012-09-15 Mark Lam - - Fixed JSLock to use the platform abstraction for Mutex instead of - depending on pthreads. - https://bugs.webkit.org/show_bug.cgi?id=96858. - - Reviewed by Filip Pizlo. - - This fixes a synchronization problem on the Windows port and makes - it more reliable when running the layout tests. - - * runtime/InitializeThreading.cpp: - (JSC::initializeThreadingOnce): - * runtime/JSLock.cpp: - (JSC): - (JSC::GlobalJSLock::GlobalJSLock): - (JSC::GlobalJSLock::~GlobalJSLock): - (JSC::GlobalJSLock::initialize): - * runtime/JSLock.h: - (GlobalJSLock): - (JSLock): - -2012-09-15 Filip Pizlo - - Structure check hoisting fails to consider the possibility of conflicting checks on the source of the first assignment to the hoisted variable - https://bugs.webkit.org/show_bug.cgi?id=96872 - - Reviewed by Oliver Hunt. - - This does a few related things: - - - It turns off the use of ForceOSRExit for sure-to-fail CheckStructures, because - I noticed that this would sometimes happen for a ForwardCheckStructure. The - problem is that ForceOSRExit exits backwards, not forwards. Since the code that - led to those ForceOSRExit's being inserted was written out of paranoia rather - than need, I removed it. Specifically, I removed the m_isValid = false code - for CheckStructure/StructureTransitionWatchpoint in AbstractState. - - - If a structure check causes a structure set to go empty, we don't want a - PutStructure to revive the set. It should instead be smart enough to realize - that an empty set implies that the code can't execute. This was the only "bug" - that the use of m_isValid = false was preventing. - - - Finally, the main change: structure check hoisting looks at the source of the - SetLocals on structure-check-hoistable variables and ensures that the source - is not checked with a conflicting structure. This is O(n^2) but it does not - show up at all in performance tests. - - The first two parts of this change were auxiliary bugs that were revealed by - the structure check hoister doing bad things. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::initialize): - (JSC::DFG::AbstractState::execute): - * dfg/DFGStructureCheckHoistingPhase.cpp: - (JSC::DFG::StructureCheckHoistingPhase::run): - -2012-09-14 Filip Pizlo - - All of the things in SparseArrayValueMap should be out-of-line - https://bugs.webkit.org/show_bug.cgi?id=96854 - - Reviewed by Andy Estes. - - Those inline methods were buying us nothing. - - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * runtime/JSArray.cpp: - * runtime/JSGlobalData.cpp: - * runtime/JSObject.cpp: - * runtime/RegExpMatchesArray.cpp: - * runtime/SparseArrayValueMap.cpp: - (JSC::SparseArrayValueMap::SparseArrayValueMap): - (JSC): - (JSC::SparseArrayValueMap::~SparseArrayValueMap): - (JSC::SparseArrayValueMap::finishCreation): - (JSC::SparseArrayValueMap::create): - (JSC::SparseArrayValueMap::destroy): - (JSC::SparseArrayValueMap::createStructure): - (JSC::SparseArrayValueMap::add): - (JSC::SparseArrayValueMap::putEntry): - (JSC::SparseArrayValueMap::putDirect): - (JSC::SparseArrayEntry::get): - (JSC::SparseArrayEntry::getNonSparseMode): - (JSC::SparseArrayValueMap::visitChildren): - * runtime/SparseArrayValueMapInlineMethods.h: Removed. - -2012-09-14 Mike West - - JSC should throw a more descriptive exception when blocking 'eval' via CSP. - https://bugs.webkit.org/show_bug.cgi?id=94331 - - Reviewed by Geoffrey Garen. - - Unless explicitly whitelisted, the 'script-src' Content Security Policy - directive blocks 'eval' and 'eval'-like constructs such as - 'new Function()'. When 'eval' is encountered in code, an 'EvalError' is - thrown, but the associated message is poor: "Eval is disabled" doesn't - give developers enough information about why their code isn't behaving - as expected. - - This patch adds an 'errorMessage' parameter to the JavaScriptCore method - used to disable 'eval'; ContentSecurityPolicy has the opportunity to - pass in a more detailed and descriptive error that contains more context - for the developer. - - * runtime/Executable.cpp: - (JSC::EvalExecutable::compileInternal): - Drop the hard-coded "Eval is disabled" error message in favor of - reading the error message off the global object. - * runtime/FunctionConstructor.cpp: - (JSC::FunctionConstructor::getCallData): - Drop the hard-coded "Function constructor is disabled" error message - in favor of reading the error message off the global object. - * runtime/JSGlobalObject.h: - (JSGlobalObject): - (JSC::JSGlobalObject::evalEnabled): - Making this accessor method const. - (JSC::JSGlobalObject::evalDisabledErrorMessage): - Accessor for the error message set via 'setEvalDisabled'. - (JSC::JSGlobalObject::setEvalEnabled): - Adding an 'errorMessage' parameter which is stored on the global - object, and used when exceptions are thrown. - -2012-09-14 Filip Pizlo - - bbc homepage crashes immediately - https://bugs.webkit.org/show_bug.cgi?id=96812 - - - Reviewed by Oliver Hunt. - - If you use the old storage pointer to write to space you thought was newly allocated, - you're going to have a bad time. - - * runtime/JSArray.cpp: - (JSC::JSArray::unshiftCount): - -2012-09-14 Adam Barth - - Remove webkitPostMessage - https://bugs.webkit.org/show_bug.cgi?id=96577 - - Reviewed by Ojan Vafai. - - Add ENABLE_LEGACY_VENDOR_PREFIXES flag. - - * Configurations/FeatureDefines.xcconfig: - -2012-09-14 Tor Arne Vestbø - - [Qt] Make force_static_libs_as_shared work on Mac OS - - We had to move a few LIBS += around that were in the wrong place, - and not caught when everything was just linked into the final - QtWebKit library. - - Reviewed by Simon Hausmann. - - * jsc.pro: No need for AppKit, we get it from WTF.pri - -2012-09-14 Kevin Funk - - Fix interpreter build - https://bugs.webkit.org/show_bug.cgi?id=96617 - - Reviewed by Simon Hausmann. - - Make compile. - - * interpreter/Interpreter.cpp: - -2012-09-14 Parth Patel - - [BlackBerry] Switching from Slogger to Slogger2 requires changes in CMakeList of - webkit in order to include libraries of slog2 - https://bugs.webkit.org/show_bug.cgi?id=96391 - - Reviewed by Yong Li. - - Changes in Cmake files of JavaScriptCore of webkit to include slog2 libs in build - files of webkit in response to switching from Slogger to Slogger2. - - * shell/PlatformBlackBerry.cmake: - -2012-09-14 Mark Hahnenberg - - Remove the Zapped BlockState - https://bugs.webkit.org/show_bug.cgi?id=96708 - - Reviewed by Geoffrey Garen. - - The Zapped block state is rather confusing. It indicates that a block is in one of two different states that we - can't tell the difference between: - - 1) I have run all destructors of things that are zapped, and I have not allocated any more objects. This block - is ready for reclaiming if you so choose. - 2) I have run all the destructors of things that are zapped, but I have allocated more stuff since then, so it - is not safe to reclaim this block. - - This state adds a lot of complexity to our state transition model for MarkedBlocks. We should get rid of it. - We can replace this state by making sure mark bits represent all of the liveness information we need when running - our conservative stack scan. Instead of zapping the free list when canonicalizing cell liveness data prior to - a conservative scan, we can instead mark all objects in the block except for those in the free list. This should - incur no performance penalty since we're doing it on a very small O(1) number of blocks at the beginning of the collection. - - For the time being we still need to use zapping to determine whether we have run an object's destructor or not. - - * heap/MarkedAllocator.cpp: - (JSC::MarkedAllocator::tryAllocateHelper): Renaming stuff. - * heap/MarkedAllocator.h: Renamed zapFreeList to canonicalizeCellLivenessData to match. - (MarkedAllocator): - (JSC::MarkedAllocator::canonicalizeCellLivenessData): Same as old zapFreeList, but just call canonicalize instead. - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::specializedSweep): Remove the check for Zapped block stuff. Also change the block state to Marked - instead of Zapped if we're not producing a FreeList since that's the only other state that really makes any sense. - (JSC::MarkedBlock::sweepHelper): Remove Zapped related code. - (SetAllMarksFunctor): Functor to set all the mark bits in the block since there's not a simple function to call on - the Bitmap itself. - (JSC::SetAllMarksFunctor::operator()): - (JSC): - (JSC::MarkedBlock::canonicalizeCellLivenessData): Remove all the stuff for Zapped. For FreeListed, set all the mark bits - and then clear the ones for the objects in the FreeList. This ensures that only the things that were in the FreeList - are considered to be dead by the conservative scan, just like if we were to have zapped the FreeList like before. - * heap/MarkedBlock.h: - (MarkedBlock): - (JSC::MarkedBlock::clearMarked): Add function to clear individual mark bits, since we need that functionality now. - (JSC): - (JSC::MarkedBlock::isLive): Remove code for Zapped stuff. Marked handles all interesting cases now. - (JSC::MarkedBlock::forEachCell): Add new iterator function that iterates over all cells in the block, regardless of - whether they're live or a dead. - * heap/MarkedSpace.cpp: - (JSC::MarkedSpace::canonicalizeCellLivenessData): Change to call the renamed canonicalize function. - -2012-09-13 Kevin Funk - - Make compile with both OS(WINCE) and PLATFORM(QT) support - https://bugs.webkit.org/show_bug.cgi?id=95536 - - Reviewed by Simon Hausmann. - - Do not link against advapi32 on wince - - * jsc.pro: - -2012-09-13 Geoffrey Garen - - Refactored the DFG to make fewer assumptions about variable capture - https://bugs.webkit.org/show_bug.cgi?id=96680 - - Reviewed by Gavin Barraclough. - - A variable capture optimization patch I'm working on broke DFG - correctness and the arguments simplification optimization phase, so I've - refactored both to make fewer assumptions about variable capture. - - * bytecode/CodeBlock.h: - (JSC::CodeBlock::isCaptured): This is the new One True Way to find out - if a variable was captured. This gives us a single point of maintenance - as we chagne capture behavior. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::clobberCapturedVars): Don't assume that captured - variables have any particular location. Instead, ask the One True Function. - - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse): - (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize): Mechanical - changes to separate being captured from being 'arguments'. What used - to be - if (captured) - if (arguments) - x - y - is now - if (arguments) - x - y - else if (captured) - y - - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::getLocal): - (JSC::DFG::ByteCodeParser::setLocal): - (JSC::DFG::ByteCodeParser::getArgument): - (JSC::DFG::ByteCodeParser::setArgument): - (JSC::DFG::ByteCodeParser::flushDirect): - (JSC::DFG::ByteCodeParser::parseBlock): - (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compile): Use the One True Function. - -2012-09-13 Benjamin Poulain - - Improve the SourceProvider hierarchy - https://bugs.webkit.org/show_bug.cgi?id=95635 - - Reviewed by Geoffrey Garen. - - SourceProvider was designed to have subclasses magically handling the data without - decoding all of it. The virtual methods length() and getRange() were based - on these assumptions. - - In practice, the magic was in our head, there is no implementation that takes - advantage of that. - - SourceProvider is modified to adopt WebCore's ScriptSourceProvider::source() and base - everything on it. - The code using SourceProvider is also simplified. - - * interpreter/Interpreter.cpp: - (JSC::appendSourceToError): Keep a reference to the string instead of querying it for - each time it is used. - * parser/Lexer.cpp: - (JSC::::setCode): - (JSC::::sourceCode): - * parser/Parser.h: - (JSC::parse): - * parser/SourceCode.h: - (JSC::SourceCode::SourceCode): - (JSC::SourceCode::subExpression): - * parser/SourceProvider.h: - (SourceProvider): - (JSC::SourceProvider::getRange): - -2012-09-13 Filip Pizlo - - DFG: Dead GetButterfly's shouldn't be subject to CSE - https://bugs.webkit.org/show_bug.cgi?id=96707 - - - Reviewed by Oliver Hunt. - - There were a number of cases of this that creeped into the CSE: it would - match something even though it was dead. - - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination): - (JSC::DFG::CSEPhase::checkArrayElimination): - (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination): - (JSC::DFG::CSEPhase::getScopeChainLoadElimination): - (JSC::DFG::CSEPhase::getLocalLoadElimination): - -2012-09-13 Oliver Hunt - - Make global const initialisation explicit in the bytecode - https://bugs.webkit.org/show_bug.cgi?id=96711 - - Reviewed by Gavin Barraclough. - - Added op_init_global_const to make initialisation of global const - fields explicit. This will help us keep correct semantics in the - upcoming variable resolution refactoring. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - * bytecode/Opcode.h: - (JSC): - (JSC::padOpcodeName): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::emitInitGlobalConst): - (JSC): - * bytecompiler/BytecodeGenerator.h: - (BytecodeGenerator): - * bytecompiler/NodesCodegen.cpp: - (JSC::ConstDeclNode::emitCodeSingle): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCapabilities.h: - (JSC::DFG::canCompileOpcode): - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): - * jit/JIT.cpp: - (JSC::JIT::privateCompileMainPass): - (JSC::JIT::privateCompileSlowCases): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - -2012-09-13 Mark Hahnenberg - - Rename forEachCell to forEachLiveCell - https://bugs.webkit.org/show_bug.cgi?id=96685 - - Reviewed by Oliver Hunt. - - forEachCell actually only iterates over live cells. We should rename it to - reflect what it actually does. This is also helpful because we want to add a new - forEachCell that actually does iterate each and every cell in a MarkedBlock - regardless of whether or not it is live. - - * debugger/Debugger.cpp: - (JSC::Debugger::recompileAllJSFunctions): - * heap/Heap.cpp: - (JSC::Heap::globalObjectCount): - (JSC::Heap::objectTypeCounts): - * heap/MarkedBlock.h: - (MarkedBlock): - (JSC::MarkedBlock::forEachLiveCell): - * heap/MarkedSpace.h: - (MarkedSpace): - (JSC::MarkedSpace::forEachLiveCell): - * runtime/JSGlobalData.cpp: - (JSC::JSGlobalData::releaseExecutableMemory): - -2012-09-13 Filip Pizlo - - [Qt][Win] REGRESSION(r128400): It broke the build - https://bugs.webkit.org/show_bug.cgi?id=96617 - - Reviewed by Simon Hausmann. - - Changed "JSC::Array" to "JSC::ArrayClass" because it's not used often enough - for the brevity to be beneficial, and because "Array" causes too much namespace - pollution. - - * runtime/IndexingType.h: - (JSC): - * runtime/JSArray.cpp: - (JSC::JSArray::pop): - (JSC::JSArray::push): - (JSC::JSArray::sortNumeric): - (JSC::JSArray::sort): - (JSC::JSArray::fillArgList): - (JSC::JSArray::copyToArguments): - (JSC::JSArray::compactForSorting): - * runtime/JSObject.cpp: - (JSC::JSObject::getOwnPropertySlotByIndex): - (JSC::JSObject::putByIndex): - (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode): - (JSC::JSObject::deletePropertyByIndex): - (JSC::JSObject::getOwnPropertyNames): - (JSC::JSObject::putByIndexBeyondVectorLength): - (JSC::JSObject::putDirectIndexBeyondVectorLength): - (JSC::JSObject::getNewVectorLength): - (JSC::JSObject::getOwnPropertyDescriptor): - * runtime/JSObject.h: - (JSC::JSObject::getArrayLength): - (JSC::JSObject::getVectorLength): - (JSC::JSObject::canGetIndexQuickly): - (JSC::JSObject::canSetIndexQuickly): - (JSC::JSObject::inSparseIndexingMode): - (JSC::JSObject::ensureArrayStorage): - -2012-09-13 Filip Pizlo - - Testing whether indexing type is ArrayWithArrayStorage should not compare against ArrayWithArrayStorage - https://bugs.webkit.org/show_bug.cgi?id=96611 - - Reviewed by Gavin Barraclough. - - * dfg/DFGRepatch.cpp: - (JSC::DFG::tryCacheGetByID): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::checkArray): - * jit/JITPropertyAccess.cpp: - (JSC::JIT::privateCompilePatchGetArrayLength): - * jit/JITPropertyAccess32_64.cpp: - (JSC::JIT::privateCompilePatchGetArrayLength): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - -2012-09-09 Filip Pizlo - - JSC should have property butterflies - https://bugs.webkit.org/show_bug.cgi?id=91933 - - Reviewed by Geoffrey Garen. - - This changes the JSC object model. Previously, all objects had fast lookup for - named properties. Integer indexed properties were only fast if you used a - JSArray. With this change, all objects have fast indexed properties. This is - accomplished without any space overhead by using a bidirectional object layout, - aka butterflies. Each JSObject has a m_butterfly pointer where previously it - had a m_outOfLineStorage pointer. To the left of the location pointed to by - m_butterfly, we place all named out-of-line properties. To the right, we place - all indexed properties along with indexing meta-data. Though, some indexing - meta-data is placed in the 8-byte word immediately left of the pointed-to - location; this is in anticipation of the indexing meta-data being small enough - in the common case that m_butterfly always points to the first indexed - property. - - This is performance neutral, except on tests that use indexed properties on - plain objects, where the speed-up is in excess of an order of magnitude. - - One notable aspect of what this change brings is that it allows indexing - storage to morph over time. Currently this is only used to allow all non-array - objects to start out without any indexed storage. But it could be used for - some kinds of array type inference in the future. - - * API/JSCallbackObject.h: - (JSCallbackObject): - * API/JSCallbackObjectFunctions.h: - (JSC::::getOwnPropertySlotByIndex): - (JSC): - (JSC::::getOwnNonIndexPropertyNames): - * API/JSObjectRef.cpp: - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * bytecode/ArrayProfile.h: - (JSC): - (JSC::arrayModeFromStructure): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::emitDirectPutById): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGAdjacencyList.h: - (JSC::DFG::AdjacencyList::AdjacencyList): - (AdjacencyList): - * dfg/DFGArrayMode.cpp: - (JSC::DFG::fromObserved): - (JSC::DFG::modeAlreadyChecked): - (JSC::DFG::modeToString): - * dfg/DFGArrayMode.h: - (DFG): - (JSC::DFG::modeUsesButterfly): - (JSC::DFG::modeIsJSArray): - (JSC::DFG::isInBoundsAccess): - (JSC::DFG::modeSupportsLength): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::handleGetByOffset): - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGFixupPhase.cpp: - (JSC::DFG::FixupPhase::fixupNode): - (JSC::DFG::FixupPhase::addNode): - (FixupPhase): - (JSC::DFG::FixupPhase::checkArray): - * dfg/DFGGraph.h: - (JSC::DFG::Graph::byValIsPure): - * dfg/DFGNode.h: - (JSC::DFG::Node::Node): - (Node): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGOperations.cpp: - (JSC::DFG::putByVal): - * dfg/DFGOperations.h: - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - * dfg/DFGRepatch.cpp: - (JSC::DFG::generateProtoChainAccessStub): - (JSC::DFG::tryCacheGetByID): - (JSC::DFG::tryBuildGetByIDList): - (JSC::DFG::emitPutReplaceStub): - (JSC::DFG::emitPutTransitionStub): - (JSC::DFG::tryBuildPutByIdList): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::checkArray): - (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage): - (JSC::DFG::SpeculativeJIT::compileGetArrayLength): - (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage): - (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage): - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::callOperation): - (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::cachedGetById): - (JSC::DFG::SpeculativeJIT::cachedPutById): - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::cachedGetById): - (JSC::DFG::SpeculativeJIT::cachedPutById): - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGStructureCheckHoistingPhase.cpp: - (JSC::DFG::StructureCheckHoistingPhase::run): - * heap/CopiedSpace.h: - (CopiedSpace): - * jit/JIT.h: - * jit/JITInlineMethods.h: - (JSC::JIT::emitAllocateBasicJSObject): - (JSC::JIT::emitAllocateBasicStorage): - (JSC::JIT::emitAllocateJSArray): - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_new_array): - (JSC::JIT::emitSlow_op_new_array): - * jit/JITPropertyAccess.cpp: - (JSC::JIT::emit_op_get_by_val): - (JSC::JIT::compileGetDirectOffset): - (JSC::JIT::emit_op_put_by_val): - (JSC::JIT::compileGetByIdHotPath): - (JSC::JIT::emit_op_put_by_id): - (JSC::JIT::compilePutDirectOffset): - (JSC::JIT::privateCompilePatchGetArrayLength): - * jit/JITPropertyAccess32_64.cpp: - (JSC::JIT::emit_op_get_by_val): - (JSC::JIT::emit_op_put_by_val): - (JSC::JIT::compileGetByIdHotPath): - (JSC::JIT::emit_op_put_by_id): - (JSC::JIT::compilePutDirectOffset): - (JSC::JIT::compileGetDirectOffset): - (JSC::JIT::privateCompilePatchGetArrayLength): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * jsc.cpp: - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * llint/LowLevelInterpreter.asm: - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - * runtime/Arguments.cpp: - (JSC::Arguments::deletePropertyByIndex): - (JSC::Arguments::defineOwnProperty): - * runtime/ArrayConstructor.cpp: - * runtime/ArrayConventions.h: Added. - (JSC): - (JSC::isDenseEnoughForVector): - (JSC::indexingHeaderForArray): - (JSC::baseIndexingHeaderForArray): - * runtime/ArrayPrototype.cpp: - (JSC::ArrayPrototype::create): - (JSC): - (JSC::ArrayPrototype::ArrayPrototype): - (JSC::arrayProtoFuncToString): - (JSC::arrayProtoFuncJoin): - (JSC::arrayProtoFuncSort): - (JSC::arrayProtoFuncFilter): - (JSC::arrayProtoFuncMap): - (JSC::arrayProtoFuncEvery): - (JSC::arrayProtoFuncForEach): - (JSC::arrayProtoFuncSome): - (JSC::arrayProtoFuncReduce): - (JSC::arrayProtoFuncReduceRight): - * runtime/ArrayPrototype.h: - (ArrayPrototype): - (JSC::ArrayPrototype::createStructure): - * runtime/ArrayStorage.h: Added. - (JSC): - (ArrayStorage): - (JSC::ArrayStorage::ArrayStorage): - (JSC::ArrayStorage::from): - (JSC::ArrayStorage::butterfly): - (JSC::ArrayStorage::indexingHeader): - (JSC::ArrayStorage::length): - (JSC::ArrayStorage::setLength): - (JSC::ArrayStorage::vectorLength): - (JSC::ArrayStorage::setVectorLength): - (JSC::ArrayStorage::copyHeaderFromDuringGC): - (JSC::ArrayStorage::inSparseMode): - (JSC::ArrayStorage::lengthOffset): - (JSC::ArrayStorage::vectorLengthOffset): - (JSC::ArrayStorage::numValuesInVectorOffset): - (JSC::ArrayStorage::vectorOffset): - (JSC::ArrayStorage::indexBiasOffset): - (JSC::ArrayStorage::sparseMapOffset): - (JSC::ArrayStorage::sizeFor): - * runtime/Butterfly.h: Added. - (JSC): - (Butterfly): - (JSC::Butterfly::Butterfly): - (JSC::Butterfly::totalSize): - (JSC::Butterfly::fromBase): - (JSC::Butterfly::offsetOfIndexingHeader): - (JSC::Butterfly::offsetOfPublicLength): - (JSC::Butterfly::offsetOfVectorLength): - (JSC::Butterfly::indexingHeader): - (JSC::Butterfly::propertyStorage): - (JSC::Butterfly::indexingPayload): - (JSC::Butterfly::arrayStorage): - (JSC::Butterfly::offsetOfPropertyStorage): - (JSC::Butterfly::indexOfPropertyStorage): - (JSC::Butterfly::base): - * runtime/ButterflyInlineMethods.h: Added. - (JSC): - (JSC::Butterfly::createUninitialized): - (JSC::Butterfly::create): - (JSC::Butterfly::createUninitializedDuringCollection): - (JSC::Butterfly::base): - (JSC::Butterfly::growPropertyStorage): - (JSC::Butterfly::growArrayRight): - (JSC::Butterfly::resizeArray): - (JSC::Butterfly::unshift): - (JSC::Butterfly::shift): - * runtime/ClassInfo.h: - (MethodTable): - (JSC): - * runtime/IndexingHeader.h: Added. - (JSC): - (IndexingHeader): - (JSC::IndexingHeader::offsetOfIndexingHeader): - (JSC::IndexingHeader::offsetOfPublicLength): - (JSC::IndexingHeader::offsetOfVectorLength): - (JSC::IndexingHeader::IndexingHeader): - (JSC::IndexingHeader::vectorLength): - (JSC::IndexingHeader::setVectorLength): - (JSC::IndexingHeader::publicLength): - (JSC::IndexingHeader::setPublicLength): - (JSC::IndexingHeader::from): - (JSC::IndexingHeader::fromEndOf): - (JSC::IndexingHeader::propertyStorage): - (JSC::IndexingHeader::arrayStorage): - (JSC::IndexingHeader::butterfly): - * runtime/IndexingHeaderInlineMethods.h: Added. - (JSC): - (JSC::IndexingHeader::preCapacity): - (JSC::IndexingHeader::indexingPayloadSizeInBytes): - * runtime/IndexingType.h: Added. - (JSC): - (JSC::hasIndexingHeader): - * runtime/JSActivation.cpp: - (JSC::JSActivation::JSActivation): - (JSC::JSActivation::visitChildren): - (JSC::JSActivation::getOwnNonIndexPropertyNames): - * runtime/JSActivation.h: - (JSActivation): - (JSC::JSActivation::tearOff): - * runtime/JSArray.cpp: - (JSC): - (JSC::createArrayButterflyInDictionaryIndexingMode): - (JSC::JSArray::setLengthWritable): - (JSC::JSArray::defineOwnProperty): - (JSC::JSArray::getOwnPropertySlot): - (JSC::JSArray::getOwnPropertyDescriptor): - (JSC::JSArray::put): - (JSC::JSArray::deleteProperty): - (JSC::JSArray::getOwnNonIndexPropertyNames): - (JSC::JSArray::unshiftCountSlowCase): - (JSC::JSArray::setLength): - (JSC::JSArray::pop): - (JSC::JSArray::push): - (JSC::JSArray::shiftCount): - (JSC::JSArray::unshiftCount): - (JSC::JSArray::sortNumeric): - (JSC::JSArray::sort): - (JSC::JSArray::fillArgList): - (JSC::JSArray::copyToArguments): - (JSC::JSArray::compactForSorting): - * runtime/JSArray.h: - (JSC): - (JSArray): - (JSC::JSArray::JSArray): - (JSC::JSArray::length): - (JSC::JSArray::createStructure): - (JSC::JSArray::isLengthWritable): - (JSC::createArrayButterfly): - (JSC::JSArray::create): - (JSC::JSArray::tryCreateUninitialized): - * runtime/JSBoundFunction.cpp: - (JSC::boundFunctionCall): - (JSC::boundFunctionConstruct): - (JSC::JSBoundFunction::finishCreation): - * runtime/JSCell.cpp: - (JSC::JSCell::getOwnNonIndexPropertyNames): - (JSC): - * runtime/JSCell.h: - (JSCell): - * runtime/JSFunction.cpp: - (JSC::JSFunction::getOwnPropertySlot): - (JSC::JSFunction::getOwnPropertyDescriptor): - (JSC::JSFunction::getOwnNonIndexPropertyNames): - (JSC::JSFunction::defineOwnProperty): - * runtime/JSFunction.h: - (JSFunction): - * runtime/JSGlobalData.cpp: - (JSC::JSGlobalData::JSGlobalData): - * runtime/JSGlobalData.h: - (JSGlobalData): - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::reset): - * runtime/JSONObject.cpp: - (JSC::Stringifier::Holder::appendNextProperty): - (JSC::Walker::walk): - * runtime/JSObject.cpp: - (JSC): - (JSC::JSObject::visitButterfly): - (JSC::JSObject::visitChildren): - (JSC::JSFinalObject::visitChildren): - (JSC::JSObject::getOwnPropertySlotByIndex): - (JSC::JSObject::put): - (JSC::JSObject::putByIndex): - (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists): - (JSC::JSObject::enterDictionaryIndexingMode): - (JSC::JSObject::createArrayStorage): - (JSC::JSObject::createInitialArrayStorage): - (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode): - (JSC::JSObject::putDirectAccessor): - (JSC::JSObject::deleteProperty): - (JSC::JSObject::deletePropertyByIndex): - (JSC::JSObject::getOwnPropertyNames): - (JSC::JSObject::getOwnNonIndexPropertyNames): - (JSC::JSObject::preventExtensions): - (JSC::JSObject::fillGetterPropertySlot): - (JSC::JSObject::putIndexedDescriptor): - (JSC::JSObject::defineOwnIndexedProperty): - (JSC::JSObject::allocateSparseIndexMap): - (JSC::JSObject::deallocateSparseIndexMap): - (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage): - (JSC::JSObject::putByIndexBeyondVectorLength): - (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage): - (JSC::JSObject::putDirectIndexBeyondVectorLength): - (JSC::JSObject::getNewVectorLength): - (JSC::JSObject::increaseVectorLength): - (JSC::JSObject::checkIndexingConsistency): - (JSC::JSObject::growOutOfLineStorage): - (JSC::JSObject::getOwnPropertyDescriptor): - (JSC::putDescriptor): - (JSC::JSObject::putDirectMayBeIndex): - (JSC::JSObject::defineOwnNonIndexProperty): - (JSC::JSObject::defineOwnProperty): - (JSC::JSObject::getOwnPropertySlotSlow): - * runtime/JSObject.h: - (JSC::JSObject::getArrayLength): - (JSObject): - (JSC::JSObject::getVectorLength): - (JSC::JSObject::putDirectIndex): - (JSC::JSObject::canGetIndexQuickly): - (JSC::JSObject::getIndexQuickly): - (JSC::JSObject::canSetIndexQuickly): - (JSC::JSObject::setIndexQuickly): - (JSC::JSObject::initializeIndex): - (JSC::JSObject::completeInitialization): - (JSC::JSObject::inSparseIndexingMode): - (JSC::JSObject::butterfly): - (JSC::JSObject::outOfLineStorage): - (JSC::JSObject::offsetForLocation): - (JSC::JSObject::indexingShouldBeSparse): - (JSC::JSObject::butterflyOffset): - (JSC::JSObject::butterflyAddress): - (JSC::JSObject::arrayStorage): - (JSC::JSObject::arrayStorageOrZero): - (JSC::JSObject::ensureArrayStorage): - (JSC::JSObject::checkIndexingConsistency): - (JSC::JSNonFinalObject::JSNonFinalObject): - (JSC): - (JSC::JSObject::setButterfly): - (JSC::JSObject::setButterflyWithoutChangingStructure): - (JSC::JSObject::JSObject): - (JSC::JSObject::inlineGetOwnPropertySlot): - (JSC::JSObject::putDirectInternal): - (JSC::JSObject::setStructureAndReallocateStorageIfNecessary): - (JSC::JSObject::putDirectWithoutTransition): - (JSC::offsetInButterfly): - (JSC::offsetRelativeToPatchedStorage): - (JSC::indexRelativeToBase): - (JSC::offsetRelativeToBase): - * runtime/JSPropertyNameIterator.cpp: - (JSC::JSPropertyNameIterator::create): - * runtime/JSSymbolTableObject.cpp: - (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames): - * runtime/JSSymbolTableObject.h: - (JSSymbolTableObject): - * runtime/JSTypeInfo.h: - (JSC): - (JSC::TypeInfo::interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero): - (JSC::TypeInfo::overridesGetPropertyNames): - * runtime/LiteralParser.cpp: - (JSC::::parse): - * runtime/ObjectConstructor.cpp: - * runtime/ObjectPrototype.cpp: - (JSC::ObjectPrototype::ObjectPrototype): - (JSC): - * runtime/ObjectPrototype.h: - (ObjectPrototype): - * runtime/PropertyOffset.h: - (JSC::offsetInOutOfLineStorage): - * runtime/PropertyStorage.h: Added. - (JSC): - * runtime/PutDirectIndexMode.h: Added. - (JSC): - * runtime/RegExpMatchesArray.cpp: - (JSC::RegExpMatchesArray::RegExpMatchesArray): - (JSC): - (JSC::RegExpMatchesArray::create): - (JSC::RegExpMatchesArray::finishCreation): - * runtime/RegExpMatchesArray.h: - (RegExpMatchesArray): - (JSC::RegExpMatchesArray::createStructure): - * runtime/RegExpObject.cpp: - (JSC::RegExpObject::getOwnNonIndexPropertyNames): - * runtime/RegExpObject.h: - (RegExpObject): - * runtime/Reject.h: Added. - (JSC): - (JSC::reject): - * runtime/SparseArrayValueMap.cpp: Added. - (JSC): - * runtime/SparseArrayValueMap.h: Added. - (JSC): - (SparseArrayEntry): - (JSC::SparseArrayEntry::SparseArrayEntry): - (SparseArrayValueMap): - (JSC::SparseArrayValueMap::sparseMode): - (JSC::SparseArrayValueMap::setSparseMode): - (JSC::SparseArrayValueMap::lengthIsReadOnly): - (JSC::SparseArrayValueMap::setLengthIsReadOnly): - (JSC::SparseArrayValueMap::find): - (JSC::SparseArrayValueMap::remove): - (JSC::SparseArrayValueMap::notFound): - (JSC::SparseArrayValueMap::isEmpty): - (JSC::SparseArrayValueMap::contains): - (JSC::SparseArrayValueMap::size): - (JSC::SparseArrayValueMap::begin): - (JSC::SparseArrayValueMap::end): - * runtime/SparseArrayValueMapInlineMethods.h: Added. - (JSC): - (JSC::SparseArrayValueMap::SparseArrayValueMap): - (JSC::SparseArrayValueMap::~SparseArrayValueMap): - (JSC::SparseArrayValueMap::finishCreation): - (JSC::SparseArrayValueMap::create): - (JSC::SparseArrayValueMap::destroy): - (JSC::SparseArrayValueMap::createStructure): - (JSC::SparseArrayValueMap::add): - (JSC::SparseArrayValueMap::putEntry): - (JSC::SparseArrayValueMap::putDirect): - (JSC::SparseArrayEntry::get): - (JSC::SparseArrayEntry::getNonSparseMode): - (JSC::SparseArrayValueMap::visitChildren): - * runtime/StorageBarrier.h: Removed. - * runtime/StringObject.cpp: - (JSC::StringObject::putByIndex): - (JSC): - (JSC::StringObject::deletePropertyByIndex): - * runtime/StringObject.h: - (StringObject): - * runtime/StringPrototype.cpp: - * runtime/Structure.cpp: - (JSC::Structure::Structure): - (JSC::Structure::materializePropertyMap): - (JSC::Structure::nonPropertyTransition): - (JSC): - * runtime/Structure.h: - (Structure): - (JSC::Structure::indexingType): - (JSC::Structure::indexingTypeIncludingHistory): - (JSC::Structure::indexingTypeOffset): - (JSC::Structure::create): - * runtime/StructureTransitionTable.h: - (JSC): - (JSC::toAttributes): - (JSC::newIndexingType): - (JSC::StructureTransitionTable::Hash::hash): - * tests/mozilla/js1_6/Array/regress-304828.js: - -2012-09-12 Mark Lam - - Refactor Opcodes to distinguish between core and extension opcodes. - https://bugs.webkit.org/show_bug.cgi?id=96466. - - Reviewed by Filip Pizlo. - - * bytecode/Opcode.h: - (JSC): Added FOR_EACH_CORE_OPCODE_ID() macro. - * llint/LowLevelInterpreter.h: - (JSC): Auto-generate llint opcode aliases using the - FOR_EACH_CORE_OPCODE_ID() macro. - -2012-09-11 Geoffrey Garen - - Second step to fixing the Windows build: Add new symbols. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - -2012-09-11 Geoffrey Garen - - First step to fixing the Windows build: Remove old symbols. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - -2012-09-11 Geoffrey Garen - - Don't allocate a backing store just for a function's name - https://bugs.webkit.org/show_bug.cgi?id=96468 - - Reviewed by Oliver Hunt. - - Treat function.name like function.length etc., and use a custom getter. - This saves space in closures. - - * debugger/DebuggerCallFrame.cpp: - (JSC::DebuggerCallFrame::functionName): - * debugger/DebuggerCallFrame.h: - (DebuggerCallFrame): Updated for interface change. - - * runtime/Executable.h: - (JSC::JSFunction::JSFunction): Do a little inlining. - - * runtime/JSFunction.cpp: - (JSC::JSFunction::finishCreation): Gone now. That's the point of the patch. - - (JSC::JSFunction::name): - (JSC::JSFunction::displayName): - (JSC::JSFunction::nameGetter): - (JSC::JSFunction::getOwnPropertySlot): - (JSC::JSFunction::getOwnPropertyDescriptor): - (JSC::JSFunction::getOwnPropertyNames): - (JSC::JSFunction::put): - (JSC::JSFunction::deleteProperty): - (JSC::JSFunction::defineOwnProperty): Added custom accessors for .name - just like .length and others. - - * runtime/JSFunction.h: - (JSC::JSFunction::create): - (JSFunction): Updated for interface changes. - -2012-09-11 Mark Hahnenberg - - IncrementalSweeper should not sweep/free Zapped blocks - https://bugs.webkit.org/show_bug.cgi?id=96464 - - Reviewed by Filip Pizlo. - - This is not beneficial in terms of performance because there isn't any way a block can emerge - in the Zapped state from a call to Heap::collect() unless we run an eager sweep on it, in which - case we've already run all the destructors we possibly can. This also causes bugs since we don't - take zapped-ness into account when determining whether or not a block is empty to free it. The - incremental sweeper can then accidentally free blocks that it thinks are empty but are in fact - zapped with still-live objects in them. - - * heap/MarkedBlock.h: - (JSC::MarkedBlock::needsSweeping): It is only valid to sweep a block if it is in the Marked state. - -2012-09-11 Geoffrey Garen - - JSActivation should inline allocate its registers, and eliminate - 'arguments' registers in the common case - https://bugs.webkit.org/show_bug.cgi?id=96427 - - Reviewed by Filip Pizlo. - - This cuts the size class for simple closures down to 64 bytes. - - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::BytecodeGenerator): Set the usesNonStrictEval - flag, which is new. Use a more specific test for whether a function - uses 'arguments', so we can avoid allocating, initializing, and tearing - off those registers in the common case. Distinguish between capturing - arguments and not, so we can avoid allocating space for arguments in - the torn-off object. - - We can make this even more general in the future, with some bytecode - generator refactoring. - - (JSC::BytecodeGenerator::resolve): Updated for new interface. - - * bytecompiler/BytecodeGenerator.h: - (BytecodeGenerator): - (JSC::BytecodeGenerator::symbolTable): Updated some types. - - * heap/Heap.cpp: - (JSC::Heap::isValidAllocation): Allow large allocations, now that they - are both supported and used. - - * heap/Heap.h: - (Heap): Added a new form of allocateCell that specifies the full size - of the allocation, to allow for extra space on the end. - - * interpreter/CallFrame.h: - (JSC::ExecState::argumentOffset): - (JSC::ExecState::argumentOffsetIncludingThis): - * interpreter/Interpreter.cpp: - (JSC::Interpreter::unwindCallFrame): Refactored this code to be more - specific about tearing off 'arguments' vs activations. This is something - I forgot in my last patch, and it is required now that we can have - acitvations without 'arguments' registers. - - * runtime/Arguments.h: - (JSC::Arguments::setRegisters): No need for setRegisters anymore because - the activation object's storage doesn't change. - - * runtime/JSActivation.cpp: - (JSC::JSActivation::JSActivation): Initialize our storage manually because - it's not declared to the C++ compiler. - - (JSC::JSActivation::visitChildren): No copyAndAppend because our storage - is not out-of-line anymore. - - (JSC::JSActivation::symbolTableGet): - (JSC::JSActivation::symbolTablePut): - (JSC::JSActivation::getOwnPropertyNames): - (JSC::JSActivation::symbolTablePutWithAttributes): - (JSC::JSActivation::getOwnPropertySlot): - (JSC::JSActivation::getOwnPropertyDescriptor): - (JSC::JSActivation::argumentsGetter): Refactored isTornOff() testing to - avoid using a data member and to avoid hard-coding any offset assumptions. - - * runtime/JSActivation.h: - (JSC): - (JSActivation): - (JSC::JSActivation::create): - (JSC::JSActivation::isDynamicScope): - (JSC::JSActivation::captureStart): - (JSC::JSActivation::storageSize): - (JSC::JSActivation::storageSizeInBytes): - (JSC::JSActivation::registerOffset): - (JSC::JSActivation::tearOff): - (JSC::JSActivation::isTornOff): - (JSC::JSActivation::storage): - (JSC::JSActivation::allocationSize): - (JSC::JSActivation::isValid): New helper functions for doing the math - on our inline storage. Note that in the "AllOfTheThings" tear-off case, - the number of things is not known at compile time, so we store the - number in the argument count register. We can't just copy the raw contents - of the register beacuse we need a value that is safe for precise marking, - and the value in the register file has an invalid tag. - - * runtime/JSCell.h: - (JSC::allocateCell): New function for allocating with extra storage - on the end. - - * runtime/JSSymbolTableObject.h: - (JSC::JSSymbolTableObject::JSSymbolTableObject): - (JSC::JSSymbolTableObject::finishCreation): - * runtime/JSVariableObject.h: - (JSC::JSVariableObject::JSVariableObject): - (JSVariableObject): Make it easier for subclasses to use their symbol - tables during construction, by passing the table as a constructor argument. - - * runtime/SymbolTable.h: - (JSC::SharedSymbolTable::usesNonStrictEval): - (JSC::SharedSymbolTable::setUsesNonStrictEval): - (SharedSymbolTable): - (JSC::SharedSymbolTable::captureMode): - (JSC::SharedSymbolTable::setCaptureMode): - (JSC::SharedSymbolTable::captureStart): - (JSC::SharedSymbolTable::setCaptureStart): - (JSC::SharedSymbolTable::captureEnd): - (JSC::SharedSymbolTable::setCaptureEnd): - (JSC::SharedSymbolTable::parameterCountIncludingThis): - (JSC::SharedSymbolTable::setParameterCountIncludingThis): - (JSC::SharedSymbolTable::SharedSymbolTable): Added data members to more - precisely describe what kind of capture is in play, and to avoid having - data members in the activation. We expect N activations per symbol table, - so this can be a big savings in heavy closure usage. - -2012-09-11 Ryuan Choi - - Fix build break with LLINT on 32bit machine after r128219 - https://bugs.webkit.org/show_bug.cgi?id=96461 - - Unreviewed build fix. - - * llint/LowLevelInterpreter32_64.asm: Fixed typo. - -2012-09-11 Michael Saboff - - Build fixed for http://trac.webkit.org/changeset/128243 - - Rubber stamped by Stephanie Lewis. - - Added missing include file needed by 96422. - - * icu/unicode/unorm2.h: Added. - -2012-09-11 Michael Saboff - - Build fixed for http://trac.webkit.org/changeset/128243 - - Rubber stamped by Stephanie Lewis. - - Added missing include file needed by 96422. - - * icu/unicode/ptypes.h: Added. - -2012-09-11 Michael Saboff - - Update ICU header files to more recent version - https://bugs.webkit.org/show_bug.cgi?id=96422 - - Reviewed by Geoff Garen. - - Updated ICU header files to 4.6.1. Modifications made as part of the merge are: - platform.h - Changed ifndef / define / endif for U_HAVE_UINT8_T, U_HAVE_UINT16_T, U_HAVE_UINT32_T, - U_HAVE_UINT64_T, U_IS_BIG_ENDIAN and U_ENABLE_TRACING to match the existing platform.h - putil.h (line 132) - Changes defined(U_WINDOWS) to defined(WIN32) || defined(OS2) to match existing putil.h - ustring.h (line 945) - Wrapped macro argument cs with { (const UChar *)cs } to match existing ustring.h - utypes.h (line 545) - Changed defined(U_WINDOWS) to defined(WIN32) to match existing utypes.h - - * icu/unicode/localpointer.h: Added. - * icu/unicode/parseerr.h: - * icu/unicode/platform.h: - * icu/unicode/putil.h: - * icu/unicode/uchar.h: - * icu/unicode/ucnv.h: - * icu/unicode/ucnv_err.h: - * icu/unicode/ucol.h: - * icu/unicode/uconfig.h: - * icu/unicode/uenum.h: - * icu/unicode/uiter.h: - * icu/unicode/uloc.h: - * icu/unicode/umachine.h: - * icu/unicode/unorm.h: - * icu/unicode/urename.h: - * icu/unicode/uscript.h: - * icu/unicode/uset.h: - * icu/unicode/ustring.h: - * icu/unicode/utf.h: - * icu/unicode/utf16.h: - * icu/unicode/utf8.h: - * icu/unicode/utypes.h: - * icu/unicode/uvernum.h: Added. - * icu/unicode/uversion.h: - -2012-09-11 Matt Lilek - - OS X port should compile with newer versions of clang - https://bugs.webkit.org/show_bug.cgi?id=96434 - - m_identIsVarDecl is unused - remove it. - - Reviewed by Anders Carlsson. - - * parser/NodeConstructors.h: - (JSC::ForInNode::ForInNode): - * parser/Nodes.h: - (ForInNode): - -2012-09-11 Filip Pizlo - - LLInt should optimize and profile array length accesses - https://bugs.webkit.org/show_bug.cgi?id=96417 - - Reviewed by Oliver Hunt. - - This fixes the following hole in our array profiling strategy, where the array - is large (more than 1000 elements): - - for (var i = 0; i < array.length; ++i) ... - - The peeled use of array.length (in the array prologue) will execute only once - before DFG optimization kicks in from the loop's OSR point. Since it executed - only once, it executed in the LLInt. And prior to this patch, the LLInt did - not profile array.length accesses - so the DFG will assume, based on the lack - of profiling, that the access is in fact not an access to the JSArray length - property. That could then impede our ability to hoist the array structure - check, and may make us pessimistic in other ways as well, since the generic - GetById used for the array length access will be viewed as a side-effecting - operation. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::printGetByIdCacheStatus): - (JSC::CodeBlock::finalizeUnconditionally): - * bytecode/GetByIdStatus.cpp: - (JSC::GetByIdStatus::computeFromLLInt): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCapabilities.h: - (JSC::DFG::canCompileOpcode): - * dfg/DFGFixupPhase.cpp: - (JSC::DFG::FixupPhase::fixupNode): - * jit/JIT.cpp: - (JSC::JIT::privateCompileMainPass): - (JSC::JIT::privateCompileSlowCases): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * llint/LowLevelInterpreter.asm: - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - -2012-09-11 Raphael Kubo da Costa - - [EFL] Rewrite the EFL-related Find modules - https://bugs.webkit.org/show_bug.cgi?id=95237 - - Reviewed by Kenneth Rohde Christiansen. - - * CMakeLists.txt: Stop setting the LINK_FLAGS property. - * PlatformEfl.cmake: Ditto. - * shell/PlatformEfl.cmake: Ditto. - -2012-09-11 Raphael Kubo da Costa - - [EFL] Unreviewed build fix after r128065. - - * CMakeLists.txt: Link against WTF for FastMalloc symbols, which - are needed when building with SYSTEM_MALLOC off. - -2012-09-10 Mark Hahnenberg - - Remove m_classInfo from JSCell - https://bugs.webkit.org/show_bug.cgi?id=96311 - - Reviewed by Oliver Hunt. - - Now that no one is using the ClassInfo in JSCell, we can remove it for the greater good. This is a 1.5% win on v8v7 and - a 1.7% win on kraken, and is an overall performance progression. - - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): Had to rearrange the order of when we take things off the free list - and when we store the Structure in the object because we would clobber the free list otherwise. This made it not okay for - the structure argument and the scratch register to alias one another. Also removed the store of the ClassInfo pointer in the - object. Yay! - (SpeculativeJIT): - * dfg/DFGSpeculativeJIT32_64.cpp: Since it's no longer okay for for the scratch register and structure register to alias - one another as stated above, had to add an extra temporary for passing the Structure. - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: Ditto. - (JSC::DFG::SpeculativeJIT::compile): - * jit/JITInlineMethods.h: - (JSC::JIT::emitAllocateBasicJSObject): Similar changes to DFG's inline allocation except that it removed the object from - the free list first, so no changes were necessary there. - * llint/LowLevelInterpreter.asm: Change the constants for amount of inline storage to match PropertyOffset.h and remove - the store of the ClassInfo pointer during inline allocation. - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - * runtime/JSCell.h: Remove the m_classInfo field and associated methods. - (JSCell): - * runtime/JSObject.h: - (JSObject): - * runtime/PropertyOffset.h: Expand the number of inline storage properties to take up the extra space that we're freeing - with the removal of the ClassInfo pointer. - (JSC): - * runtime/Structure.h: - (JSC): - (JSC::JSCell::JSCell): - (JSC::JSCell::finishCreation): - -2012-09-10 Geoffrey Garen - - Added large allocation support to MarkedSpace - https://bugs.webkit.org/show_bug.cgi?id=96214 - - Originally reviewed by Oliver Hunt, then I added a design revision by - suggested by Phil Pizlo. - - I expanded the imprecise size classes to cover up to 32KB, then added - an mmap-based allocator for everything bigger. There's a lot of tuning - we could do in these size classes, but currently they're almost - completely unused, so I haven't done any tuning. - - Subtle point: the large allocator is a degenerate case of our free list - logic. Its list only ever contains zero or one items. - - * heap/Heap.h: - (JSC::Heap::allocateStructure): Pipe in size information. - - * heap/MarkedAllocator.cpp: - (JSC::MarkedAllocator::tryAllocateHelper): Handle the case where we - find a free item in the sweep list but the item isn't big enough. This - can happen in the large allocator because it mixes sizes. - - (JSC::MarkedAllocator::tryAllocate): - (JSC::MarkedAllocator::allocateSlowCase): More piping. - - (JSC::MarkedAllocator::allocateBlock): Handle the oversize case. - - (JSC::MarkedAllocator::addBlock): I moved the call to didAddBlock here - because it made more sense. - - * heap/MarkedAllocator.h: - (MarkedAllocator): - (JSC::MarkedAllocator::allocate): - * heap/MarkedSpace.cpp: - (JSC::MarkedSpace::MarkedSpace): - (JSC::MarkedSpace::resetAllocators): - (JSC::MarkedSpace::canonicalizeCellLivenessData): - (JSC::MarkedSpace::isPagedOut): - (JSC::MarkedSpace::freeBlock): - * heap/MarkedSpace.h: - (MarkedSpace): - (JSC::MarkedSpace::allocatorFor): - (JSC::MarkedSpace::destructorAllocatorFor): - (JSC::MarkedSpace::allocateWithoutDestructor): - (JSC::MarkedSpace::allocateWithDestructor): - (JSC::MarkedSpace::allocateStructure): - (JSC::MarkedSpace::forEachBlock): - * runtime/Structure.h: - (JSC::Structure): More piping. - -2012-09-10 Geoffrey Garen - - Try to fix the Windows (32-bit) build. - - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_tear_off_arguments): - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::emit_op_tear_off_arguments): Get operands 1 and 2, not 1 and 1. :( - - Also took this opportunity to rename to indicate that these values are - not destinations anymore. - -2012-09-10 Geoffrey Garen - - DFG misses arguments tear-off for function.arguments if 'arguments' is used - https://bugs.webkit.org/show_bug.cgi?id=96227 - - Reviewed by Gavin Barraclough. - - We've decided not to allow function.arguments to alias the local - 'arguments' object, or a local var or function named 'arguments'. - Aliasing complicates the implementation (cf, this bug) and can produce - surprising behavior for web programmers. - - Eliminating the aliasing has the side-effect of fixing this bug. - - The compatibilty story: function.arguments is deprecated, was never - specified, and throws an exception in strict mode, so we expect it to - disappear over time. Firefox does not alias to 'arguments'; Chrome - does, but not if you use eval or with; IE does; Safari did. - - * dfg/DFGByteCodeParser.cpp: Noticed a little cleanup while verifying - this code. Use the CodeBlock method for better encapsulation. - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::retrieveArgumentsFromVMCode): Behavior change: don't - alias. - - * tests/mozilla/js1_4/Functions/function-001.js: - (TestFunction_4): Updated test expectations for changed behavior. - -2012-09-10 Filip Pizlo - - offlineasm has some impossible to implement, and unused, instructions - https://bugs.webkit.org/show_bug.cgi?id=96310 - - Reviewed by Mark Hahnenberg. - - * offlineasm/armv7.rb: - * offlineasm/instructions.rb: - * offlineasm/x86.rb: - -2012-09-09 Geoffrey Garen - - Refactored op_tear_off* to support activations that don't allocate space for 'arguments' - https://bugs.webkit.org/show_bug.cgi?id=96231 - - Reviewed by Gavin Barraclough. - - This is a step toward smaller activations. - - As a side-effect, this patch eliminates a load and branch from the hot path - of activation tear-off by moving it to the cold path of arguments tear-off. Our - optimizing assumptions are that activations are common and that reifying the - arguments object is less common. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - * bytecode/Opcode.h: - (JSC::padOpcodeName): Updated for new opcode lengths. - - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::BytecodeGenerator): - (JSC::BytecodeGenerator::addConstantValue): Added support for JSValue() - in the bytecode, which we use when we have 'arguments' but no activation. - - (JSC::BytecodeGenerator::emitReturn): Always emit tear_off_arguments - if we've allocated the arguments registers. This allows tear_off_activation - not to worry about the arguments object anymore. - - Also, pass the activation and arguments values directly to these opcodes - instead of requiring the opcodes to infer the values through special - registers. This gives us more flexibility to move or eliminate registers. - - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGNode.h: - (Node): Updated for new opcode lengths. - - * dfg/DFGOperations.cpp: Activation tear-off doesn't worry about the - arguments object anymore. If 'arguments' is in use and reified, it's - responsible for aliasing back to the activation object in tear_off_arguments. - - * dfg/DFGOperations.h: - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::callOperation): - (SpeculativeJIT): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): Don't pass the arguments object to - activation tear-off; do pass the activation object to arguments tear-off. - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): Ditto. - - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_tear_off_activation): - (JSC::JIT::emit_op_tear_off_arguments): - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::emit_op_tear_off_activation): - (JSC::JIT::emit_op_tear_off_arguments): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: Same change in a few more execution engines. - -2012-09-10 Patrick Gansterer - - [JSC] Use StringBuilder::appendNumber() instead of String::number() - https://bugs.webkit.org/show_bug.cgi?id=96236 - - Reviewed by Benjamin Poulain. - - * API/JSContextRef.cpp: - (JSContextCreateBacktrace): - -2012-09-06 Mark Hahnenberg - - Combine MarkStack and SlotVisitor into single class - https://bugs.webkit.org/show_bug.cgi?id=96043 - - Reviewed by Geoff Garen. - - Move all of MarkStack into SlotVisitor. The remaining stuff in MarkStack.cpp actually has to do - with MarkStack management/allocation. Cleaned up a few of the header files while I was at it. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * bytecode/CodeBlock.cpp: - * dfg/DFGCommon.h: - * heap/GCThreadSharedData.cpp: - * heap/GCThreadSharedData.h: - (GCThreadSharedData): - * heap/HeapRootVisitor.h: - * heap/MarkStack.cpp: - (JSC): - * heap/MarkStack.h: - (JSC): - (MarkStackSegment): - (JSC::MarkStackSegment::data): - (JSC::MarkStackSegment::capacityFromSize): - (JSC::MarkStackSegment::sizeFromCapacity): - (MarkStackSegmentAllocator): - (MarkStackArray): - * heap/MarkStackInlineMethods.h: - (JSC::MarkStackArray::postIncTop): - (JSC): - (JSC::MarkStackArray::preDecTop): - (JSC::MarkStackArray::setTopForFullSegment): - (JSC::MarkStackArray::setTopForEmptySegment): - (JSC::MarkStackArray::top): - (JSC::MarkStackArray::validatePrevious): - (JSC::MarkStackArray::append): - (JSC::MarkStackArray::canRemoveLast): - (JSC::MarkStackArray::removeLast): - (JSC::MarkStackArray::isEmpty): - (JSC::MarkStackArray::size): - * heap/SlotVisitor.cpp: Added. - (JSC): - (JSC::SlotVisitor::SlotVisitor): - (JSC::SlotVisitor::~SlotVisitor): - (JSC::SlotVisitor::setup): - (JSC::SlotVisitor::reset): - (JSC::SlotVisitor::append): - (JSC::visitChildren): - (JSC::SlotVisitor::donateKnownParallel): - (JSC::SlotVisitor::drain): - (JSC::SlotVisitor::drainFromShared): - (JSC::SlotVisitor::mergeOpaqueRoots): - (JSC::SlotVisitor::startCopying): - (JSC::SlotVisitor::allocateNewSpaceSlow): - (JSC::SlotVisitor::allocateNewSpaceOrPin): - (JSC::JSString::tryHashConstLock): - (JSC::JSString::releaseHashConstLock): - (JSC::JSString::shouldTryHashConst): - (JSC::SlotVisitor::internalAppend): - (JSC::SlotVisitor::copyAndAppend): - (JSC::SlotVisitor::doneCopying): - (JSC::SlotVisitor::harvestWeakReferences): - (JSC::SlotVisitor::finalizeUnconditionalFinalizers): - (JSC::SlotVisitor::validate): - * heap/SlotVisitor.h: - (JSC): - (SlotVisitor): - (JSC::SlotVisitor::sharedData): - (JSC::SlotVisitor::isEmpty): - (JSC::SlotVisitor::visitCount): - (JSC::SlotVisitor::resetChildCount): - (JSC::SlotVisitor::childCount): - (JSC::SlotVisitor::incrementChildCount): - (ParallelModeEnabler): - (JSC::ParallelModeEnabler::ParallelModeEnabler): - (JSC::ParallelModeEnabler::~ParallelModeEnabler): - * heap/SlotVisitorInlineMethods.h: - (JSC::SlotVisitor::append): - (JSC): - (JSC::SlotVisitor::appendUnbarrieredPointer): - (JSC::SlotVisitor::appendUnbarrieredValue): - (JSC::SlotVisitor::internalAppend): - (JSC::SlotVisitor::addWeakReferenceHarvester): - (JSC::SlotVisitor::addUnconditionalFinalizer): - (JSC::SlotVisitor::addOpaqueRoot): - (JSC::SlotVisitor::containsOpaqueRoot): - (JSC::SlotVisitor::opaqueRootCount): - (JSC::SlotVisitor::mergeOpaqueRootsIfNecessary): - (JSC::SlotVisitor::mergeOpaqueRootsIfProfitable): - (JSC::SlotVisitor::donate): - (JSC::SlotVisitor::donateAndDrain): - * jit/JITWriteBarrier.h: - (JSC::SlotVisitor::append): - * jit/JumpReplacementWatchpoint.cpp: - * runtime/JSCell.h: - * runtime/Structure.h: - (JSC::SlotVisitor::internalAppend): - * runtime/WriteBarrier.h: - (JSC): - (JSC::SlotVisitor::append): - (JSC::SlotVisitor::appendValues): - * yarr/YarrJIT.cpp: - -2012-09-10 Hojong Han - - [EFL] JIT memory usage is not retrieved - https://bugs.webkit.org/show_bug.cgi?id=96095 - - Reviewed by Geoffrey Garen. - - Fill JITBytes for EFL port. - - * runtime/MemoryStatistics.cpp: - (JSC::globalMemoryStatistics): - -2012-09-10 Thiago Marcos P. Santos - - [CMake][EFL] Enable the LLInt - https://bugs.webkit.org/show_bug.cgi?id=92682 - - Reviewed by Csaba Osztrogonác. - - Generate the headers needed by LLint when LLint is enabled. - - * CMakeLists.txt: - -2012-09-10 Carlos Garcia Campos - - Unreviewed. Fix make distcheck. - - * GNUmakefile.list.am: Add missing files. - -2012-09-09 Mark Lam - - Fixed a few llint C++ interpreter bugs. - https://bugs.webkit.org/show_bug.cgi?id=96127. - - Reviewed by Geoffrey Garen. - - * llint/LLIntCLoop.h: - CLoop::execute()'s bootstrapOpcodeId does not need a default - value. There is no case when this function is called without - that parameter being specified. - * llint/LowLevelInterpreter.asm: - Moved the dispatchAfterCall() call to where it is needed. - For the C_LOOP back-end, it generates unreachable code. - * llint/LowLevelInterpreter.cpp: - #include because LLIntAssembly.h needs it. - (JSC): - Fixed bug in SIGN_BIT32() macro. - Placate a MSVC warning for t0, and t1 being uninitialized. - (JSC::CLoop::execute): - The bootstrapOpcodeId arg should always be specified. - MSVC doesn't like UNUSED_PARAM() for labels. Switch to using - the new UNUSED_LABEL() macro. - * offlineasm/cloop.rb: - * offlineasm/generate_offset_extractor.rb: - Resolved a compiler warning found via MSVC. - -2012-09-09 Patrick Gansterer - - Add StringBuilder::appendNumber() and use it - https://bugs.webkit.org/show_bug.cgi?id=96030 - - Reviewed by Eric Seidel. - - Also fix a bunch of append() vs. appendLiteral() issues in the surrounding code. - - * API/JSContextRef.cpp: - (JSContextCreateBacktrace): - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - * interpreter/Interpreter.h: - (JSC::StackFrame::toString): - -2012-09-09 Patrick Gansterer - - Make the String initialization on the function side of String::number() - https://bugs.webkit.org/show_bug.cgi?id=95940 - - Reviewed by Benjamin Poulain. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - -2012-09-09 Geoffrey Garen - - Rolled out because it broke - fast/js/named-function-expression.html. - - Refactored bytecode generator initialization to support moving captured vars around - https://bugs.webkit.org/show_bug.cgi?id=96159 - - Reviewed by Gavin Barraclough. - -2012-09-08 Csaba Osztrogonác - - LLInt buildfix for case sensitive filesystems - https://bugs.webkit.org/show_bug.cgi?id=96099 - - Reviewed by Michael Saboff. - - * llint/LowLevelInterpreter.cpp: Fix filenames. - -2012-09-07 Benjamin Poulain - - Rename the ustring() accessor to string() - https://bugs.webkit.org/show_bug.cgi?id=95919 - - Reviewed by Geoffrey Garen. - - Rename ustring() to string() to make the accessor name more logical after - r127191. - - * API/JSBase.cpp: - (JSEvaluateScript): - (JSCheckScriptSyntax): - * API/JSObjectRef.cpp: - (JSObjectMakeFunctionWithCallback): - (JSObjectMakeFunction): - (JSObjectCopyPropertyNames): - * API/JSProfilerPrivate.cpp: - (JSStartProfiling): - (JSEndProfiling): - * API/JSValueRef.cpp: - (JSValueMakeString): - (JSValueMakeFromJSONString): - * API/OpaqueJSString.cpp: - (OpaqueJSString::string): - * API/OpaqueJSString.h: - (OpaqueJSString): - * bytecode/CodeBlock.cpp: - (JSC::idName): - (JSC::CodeBlock::dump): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::emitLoad): - (JSC::BytecodeGenerator::addStringConstant): - * bytecompiler/NodesCodegen.cpp: - (JSC::RegExpNode::emitBytecode): - (JSC::processClauseList): - * dfg/DFGGraph.cpp: - (JSC::DFG::Graph::dump): - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * jsc.cpp: - (GlobalObject::addFunction): - (GlobalObject::addConstructableFunction): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * parser/ASTBuilder.h: - (JSC::ASTBuilder::createRegExp): - * parser/Parser.cpp: - (JSC::::parsePrimaryExpression): - * parser/Parser.h: - (JSC::Scope::declareVariable): - (JSC::Scope::declareParameter): - (JSC::Scope::useVariable): - * parser/SyntaxChecker.h: - (JSC::SyntaxChecker::createRegExp): - * runtime/ExceptionHelpers.cpp: - (JSC::createUndefinedVariableError): - * runtime/Executable.cpp: - (JSC::FunctionExecutable::paramString): - * runtime/Executable.h: - (JSC::FunctionExecutable::finishCreation): - * runtime/FunctionPrototype.cpp: - (JSC::FunctionPrototype::addFunctionProperties): - * runtime/Identifier.h: - (JSC::Identifier::string): - * runtime/JSFunction.cpp: - (JSC::JSFunction::calculatedDisplayName): - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::reset): - * runtime/JSONObject.cpp: - (JSC::PropertyNameForFunctionCall::value): - (JSC::Stringifier::Holder::appendNextProperty): - (JSC::Walker::walk): - * runtime/JSPropertyNameIterator.h: - (JSC::JSPropertyNameIterator::finishCreation): - * runtime/JSScope.cpp: - (JSC::JSScope::resolveBase): - * runtime/JSString.h: - (JSC::inlineJSValueNotStringtoString): - * runtime/LiteralParser.cpp: - (JSC::::parse): - * runtime/ObjectConstructor.cpp: - (JSC::ObjectConstructor::finishCreation): - (JSC::objectConstructorGetOwnPropertyNames): - (JSC::objectConstructorKeys): - * runtime/RegExpConstructor.cpp: - (JSC::RegExpConstructor::finishCreation): - -2012-09-07 Gavin Barraclough - - CALLFRAME_OFFSET and EXCEPTION_OFFSET are same in ctiTrampoline on ARM Thumb2 - https://bugs.webkit.org/show_bug.cgi?id=82013 - - Reviewed by Geoff Garen. - - Neither of these values need to be stored. At all. - - * jit/JITStubs.cpp: - (JSC): - (JSC::ctiTrampoline): - (JSC::JITThunks::JITThunks): - - Nothing to see here. Move along. - -2012-09-07 Sheriff Bot - - Unreviewed, rolling out r127938. - http://trac.webkit.org/changeset/127938 - https://bugs.webkit.org/show_bug.cgi?id=96166 - - It broke the build (Requested by smfr on #webkit). - - * llint/LowLevelInterpreter.cpp: - (JSC): - (JSC::CLoop::execute): - * offlineasm/cloop.rb: - -2012-09-07 Geoffrey Garen - - Refactored bytecode generator initialization to support moving captured vars around - https://bugs.webkit.org/show_bug.cgi?id=96159 - - Reviewed by Gavin Barraclough. - - This patch separates the stages of allocating registers, declaring identifiers - in the symbol table, and initializing registers, so you can change - allocation decisions without breaking the world. - - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::BytecodeGenerator): Call a set of helper functions - instead of inlining all the code, to help clarity. - - (JSC::BytecodeGenerator::allocateCapturedVars): - (JSC::BytecodeGenerator::allocateUncapturedVars): - (JSC::BytecodeGenerator::allocateActivationVar): - (JSC::BytecodeGenerator::allocateArgumentsVars): - (JSC::BytecodeGenerator::allocateCalleeVarUndeclared): - (JSC::BytecodeGenerator::declareParameters): - (JSC::BytecodeGenerator::declareCallee): - (JSC::BytecodeGenerator::initCalleeVar): - (JSC::BytecodeGenerator::initArgumentsVars): - (JSC::BytecodeGenerator::initActivationVar): - (JSC::BytecodeGenerator::initThisParameter): - (JSC::BytecodeGenerator::initFunctionDeclarations): - (JSC::BytecodeGenerator::declareParameter): - (JSC::BytecodeGenerator::createLazyRegisterIfNecessary): - (JSC::BytecodeGenerator::createActivationIfNecessary): Factored these - helper functions out from pre-existing code. - - * bytecompiler/BytecodeGenerator.h: - (BytecodeGenerator): - * parser/ASTBuilder.h: - (JSC::ASTBuilder::createFuncDeclStatement): - (JSC::ASTBuilder::addVar): - * parser/Nodes.h: - (JSC::DeclarationStacks::VarDeclaration::VarDeclaration): - (VarDeclaration): - (JSC::DeclarationStacks::FunctionDeclaration::FunctionDeclaration): - (FunctionDeclaration): Declaration stacks get a little more data now, - to support allocating registers before putting things in the symbol - table. I'm convinced that we should eventually just expand the symbol - table to understand these things. - -2012-09-07 Mark Lam - - Fix a llint C++ interpreter bugs. - https://bugs.webkit.org/show_bug.cgi?id=96127. - - Reviewed by Filip Pizlo. - - * llint/LowLevelInterpreter.cpp: - (JSC): - (JSC::CLoop::execute): - * offlineasm/cloop.rb: - -2012-09-07 Gavin Barraclough - - Object.prototype.__define{G,S}etter__ with non-callable second parameter should throw TypeError instead of SyntaxError - https://bugs.webkit.org/show_bug.cgi?id=93873 - - Reviewed by Sam Weinig. - - * runtime/ObjectPrototype.cpp: - (JSC::objectProtoFuncDefineGetter): - - throw TypeError instead of SyntaxError - (JSC::objectProtoFuncDefineSetter): - - throw TypeError instead of SyntaxError - -2012-09-06 Mark Hahnenberg - - JSC should have a zombie mode - https://bugs.webkit.org/show_bug.cgi?id=96047 - - Reviewed by Geoffrey Garen. - - To aid clients of JSC while they are debugging memory issues, we should add a zombie - mode that scribbles into objects in the MarkedSpace after they are found to be dead - to prevent a sort of "use after free" situation. As a first cut we should support a - mode that just scribbles on objects prior to their being reused (i.e. while they are - "zombies") and a mode in which, in addition to scribbling on zombies, once an object - has been marked its mark bit will never be cleared, thus giving us "immortal" zombies. - - These two modes will be enabled through the use of environment variables. For now these - will be "JSZombieEnabled" and "JSImmortalZombieEnabled". Setting them to any value will - result in the use of the appropriate mode. - - * heap/Heap.cpp: - (JSC::Heap::collect): Zombifies dead objects at the end of collection if zombie mode is enabled. - (ZombifyCellFunctor): - (JSC::ZombifyCellFunctor::ZombifyCellFunctor): Sets marked bits for dead objects if in immortal mode and writes 0xbbadbeef into them. - (JSC::ZombifyCellFunctor::operator()): - (JSC): - (ZombifyBlockFunctor): - (JSC::ZombifyBlockFunctor::operator()): - (JSC::Heap::zombifyDeadObjects): Eagerly sweeps so that we don't write garbage into an object before it - is finalized/destroyed. - * heap/Heap.h: - (Heap): - * heap/MarkedBlock.h: - (MarkedBlock): - (JSC::MarkedBlock::forEachDeadCell): Used to iterate over dead cells at the end of collection if zombie mode is enabled. - (JSC): - * runtime/Options.cpp: - (JSC::Options::initialize): - * runtime/Options.h: - (JSC): - -2012-09-05 Geoffrey Garen - - Rolled back in with a fix for - fast/dom/HTMLScriptElement/script-reexecution-pretty-diff.html, which - is to make sure that function declarations don't put their names in scope. - - Reviewed by Gavin Barraclough. - - Named functions should not allocate scope objects for their names - https://bugs.webkit.org/show_bug.cgi?id=95659 - - Reviewed by Oliver Hunt. - -2012-09-06 Michael Saboff - - 16 bit JSRopeString up converts an 8 bit fibers to 16 bits during resolution - https://bugs.webkit.org/show_bug.cgi?id=95810 - - Reviewed by Benjamin Poulain. - - Added 8 bit path that copies the contents of an 8 bit fiber to the 16 bit buffer - when resolving a 16 bit rope. - - * runtime/JSString.cpp: - (JSC::JSRopeString::resolveRopeSlowCase): - -2012-09-06 Gavin Barraclough - - JS test suite puts incorrect limitations on Function.toString() - https://bugs.webkit.org/show_bug.cgi?id=3975 - - Reviewed by Geoff Garen. - - The result of function toString is implementation defined; - these test cases were looking for specific whitespace formatting - that matches mozilla's, and for redundant braces to be inserted - around if/else blocks. Stop that. - - * tests/mozilla/expected.html: - * tests/mozilla/js1_2/function/tostring-1.js: - (simplify): - - reduce whitespace differences - * tests/mozilla/js1_2/function/tostring-2.js: - (simplify): - - reduce whitespace differences - (TestOr): - (TestAnd): - - added braces to match expected output - -2012-09-06 Yuqiang Xian - - Performance regressions on 32-bit platforms with revisions 125637 and 126387 - https://bugs.webkit.org/show_bug.cgi?id=95953 - - Reviewed by Filip Pizlo. - - * jit/JITPropertyAccess32_64.cpp: - (JSC::JIT::emit_op_get_by_val): Fix the typo. - -2012-09-05 Geoffrey Garen - - Rolled out because it broke - fast/dom/HTMLScriptElement/script-reexecution-pretty-diff.html - - Named functions should not allocate scope objects for their names - https://bugs.webkit.org/show_bug.cgi?id=95659 - - Reviewed by Oliver Hunt. - -2012-09-06 Mark Lam - - Renamed useYarrJIT() option to useRegExpJIT(). Also fixed regression in - which inadvertantly allows the ASM llint to use the baseline JIT when - useRegExpJIT() is true. - https://bugs.webkit.org/show_bug.cgi?id=95918. - - Reviewed by Geoffrey Garen. - - * runtime/JSGlobalData.cpp: - (JSC::enableAssembler): - (JSC::JSGlobalData::JSGlobalData): - * runtime/JSGlobalData.h: - (JSC::JSGlobalData::canUseJIT): - (JSC::JSGlobalData::canUseRegExpJIT): - (JSGlobalData): - * runtime/Options.cpp: - (JSC::Options::initialize): - * runtime/Options.h: - (JSC): - -2012-09-06 Patrick Gansterer - - Build fix for Interpreter after r127698. - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): - -2012-09-05 Geoffrey Garen - - Named functions should not allocate scope objects for their names - https://bugs.webkit.org/show_bug.cgi?id=95659 - - Reviewed by Oliver Hunt. - - In most cases, we can merge a function expression's name into its symbol - table. This reduces memory footprint per closure from three objects - (function + activation + name scope) to two (function + activation), - speeds up closure allocation, and speeds up recursive calls. - - In the case of a named function expression that contains a non-strict - eval, the rules are so bat-poop crazy that I don't know how to model - them without an extra object. Since functions now default to not having - such an object, this case needs to allocate the object on function - entry. - - Therefore, this patch makes the slow case a bit slower so the fast case - can be faster and more memory-efficient. (Note that the slow case already - allocates an activation on entry, and until recently also allocated a - scope chain node on entry, so adding one allocation on entry shouldn't - break the bank.) - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::CodeBlock): Caught a missed initializer. No behavior change. - - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::BytecodeGenerator): Put the callee in static scope - during compilation so it doesn't need to be in dynamic scope at runtime. - - (JSC::BytecodeGenerator::resolveCallee): - (JSC::BytecodeGenerator::addCallee): Helper functions for either statically - resolving the callee or adding a dynamic scope that will resolve to it, - depending on whether you're in the fast path. - - We move the callee into a var location if it's captured because activations - prefer to have contiguous ranges of captured variables. - - * bytecompiler/BytecodeGenerator.h: - (JSC::BytecodeGenerator::registerFor): - (BytecodeGenerator): - - * dfg/DFGOperations.cpp: - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): This is the point of the patch: remove - one allocation in the case of a named function expression. - - * parser/Parser.cpp: - (JSC::::Parser): - * parser/Parser.h: - (JSC::Scope::declareCallee): - (Scope): - (Parser): - (JSC::parse): - * runtime/Executable.cpp: - (JSC::EvalExecutable::compileInternal): - (JSC::ProgramExecutable::checkSyntax): - (JSC::ProgramExecutable::compileInternal): - (JSC::FunctionExecutable::produceCodeBlockFor): - (JSC::FunctionExecutable::fromGlobalCode): Pipe the callee's name through - the parser so we get accurate information on whether the callee was captured. - - (JSC::FunctionExecutable::FunctionExecutable): - (JSC::EvalExecutable::compileInternal): - (JSC::ProgramExecutable::checkSyntax): - (JSC::ProgramExecutable::compileInternal): - (JSC::FunctionExecutable::produceCodeBlockFor): - (JSC::FunctionExecutable::fromGlobalCode): - * runtime/Executable.h: - (JSC::FunctionExecutable::create): - (FunctionExecutable): - (JSC::FunctionExecutable::finishCreation): I had to refactor function - creation to support the following function constructor quirk: the function - gets a name, but its name is not in lexical scope. - - To simplify this, FunctionExecutable now automatically extracts all the - data it needs from the parsed node. The special "fromGlobalCode" path - used by the function constructor creates an anonymous function, and then - quirkily sets the value used by the .name property to be non-null, even - though the parsed name is null. - - * runtime/JSNameScope.h: - (JSC::JSNameScope::create): - (JSC::JSNameScope::JSNameScope): Added support for explicitly specifying - your container scope. The compiler uses this for named function expressions. - -2012-09-05 Gavin Barraclough - - a = data[a]++; sets the wrong key in data - https://bugs.webkit.org/show_bug.cgi?id=91270 - - Reviewed by Oliver Hunt. - - Postfix inc/dec is unsafely using finalDestination, can trample base/subscript prior to the result being put. - - * bytecompiler/NodesCodegen.cpp: - (JSC::PostfixNode::emitResolve): - - Remove redundant parens. - (JSC::PostfixNode::emitBracket): - (JSC::PostfixNode::emitDot): - - Refactored to use tempDestination instead of finalDestination. - (JSC::PrefixNode::emitBracket): - (JSC::PrefixNode::emitDot): - - Should be using emitPreIncOrDec. - -2012-09-05 Gavin Barraclough - - Bug, assignment within subscript of prefix/postfix increment of bracket access - https://bugs.webkit.org/show_bug.cgi?id=95913 - - Reviewed by Oliver Hunt. - - javascript:alert((function(){ var a = { x:1 }; var b = { x:1 }; a[a=b,"x"]++; return a.x; })()) - - * bytecompiler/NodesCodegen.cpp: - (JSC::PostfixNode::emitBracket): - (JSC::PrefixNode::emitBracket): - - Should check for assigments in the subscript when loading the base. - * parser/Nodes.h: - (JSC::BracketAccessorNode::subscriptHasAssignments): - (BracketAccessorNode): - - Used by emitBracket methods. - -2012-09-05 Gavin Barraclough - - Merge prefix/postfix nodes - https://bugs.webkit.org/show_bug.cgi?id=95898 - - Reviewed by Geoff Garen. - - Simplify the AST. - This will also mean we have access to m_subscriptHasAssignments when generating a prefix/postfix op applied to a bracket access. - - * bytecompiler/NodesCodegen.cpp: - (JSC::PostfixNode::emitResolve): - - was PostfixResolveNode::emitBytecode - (JSC::PostfixNode::emitBracket): - - was PostfixBracketNode::emitBytecode - (JSC::PostfixNode::emitDot): - - was PostfixDotNode::emitBytecode - (JSC::PostfixNode::emitBytecode): - - was PostfixErrorNode::emitBytecode, call resolve/bracket/dot version as appropriate. - (JSC::PrefixNode::emitResolve): - - was PrefixResolveNode::emitBytecode - (JSC::PrefixNode::emitBracket): - - was PrefixBracketNode::emitBytecode - (JSC::PrefixNode::emitDot): - - was PrefixDotNode::emitBytecode - (JSC::PrefixNode::emitBytecode): - - was PrefixErrorNode::emitBytecode, call resolve/bracket/dot version as appropriate. - * parser/ASTBuilder.h: - (JSC::ASTBuilder::makePrefixNode): - - Just makes a PrefixNode! - (JSC::ASTBuilder::makePostfixNode): - - Just makes a PostfixNode! - * parser/NodeConstructors.h: - (JSC::PostfixNode::PostfixNode): - - Added, merge of PostfixResolveNode/PostfixBracketNode/PostfixDotNode/PostfixErrorNode. - (JSC::PrefixNode::PrefixNode): - - Added, merge of PrefixResolveNode/PrefixBracketNode/PrefixDotNode/PrefixErrorNode. - * parser/Nodes.h: - (PostfixNode): - - Added, merge of PostfixResolveNode/PostfixBracketNode/PostfixDotNode/PostfixErrorNode. - (PrefixNode): - - Added, merge of PrefixResolveNode/PrefixBracketNode/PrefixDotNode/PrefixErrorNode. - -2012-09-05 Mark Hahnenberg - - Remove use of JSCell::classInfoOffset() from tryCacheGetByID - https://bugs.webkit.org/show_bug.cgi?id=95860 - - Reviewed by Oliver Hunt. - - We should just do the indirection through the Structure instead. - - * dfg/DFGRepatch.cpp: - (JSC::DFG::tryCacheGetByID): - -2012-09-05 Geoffrey Garen - - Throw exceptions when assigning to const in strict mode - https://bugs.webkit.org/show_bug.cgi?id=95894 - - Reviewed by Oliver Hunt. - - Currently, this never happens; but it will start happening once the - callee is a local const register. In this patch, there's no change in - behavior. - - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded): Helper function - for doing the throwing. - * bytecompiler/BytecodeGenerator.h: - - * bytecompiler/NodesCodegen.cpp: - (JSC::PostfixResolveNode::emitBytecode): - (JSC::PrefixResolveNode::emitBytecode): - (JSC::ReadModifyResolveNode::emitBytecode): - (JSC::AssignResolveNode::emitBytecode): Call the helper function. - -2012-09-05 Geoffrey Garen - - Refactored callee access in the DFG to support it in the general case - https://bugs.webkit.org/show_bug.cgi?id=95887 - - Reviewed by Phil Pizlo and Gavin Barraclough. - - To support named function expressions, the DFG needs to understand the - callee register being used in arbitrary expressions, and not just - create_this. - - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::getDirect): - (JSC::DFG::ByteCodeParser::getCallee): Remap access to the callee register - into a GetCallee node. Otherwise, we get confused and think we have a - negatively indexed argument. - - (ByteCodeParser): - (JSC::DFG::ByteCodeParser::InlineStackEntry::remapOperand): Inlining also - needs to remap, but to the callee in the inline frame, and not the caller's - callee. - - (JSC::DFG::ByteCodeParser::parseBlock): Since we support the callee in - the general case now, there's no need to handle it in a special way for - create_this. - -2012-09-05 Mark Hahnenberg - - Remove use of JSCell::classInfoOffset() from virtualForThunkGenerator - https://bugs.webkit.org/show_bug.cgi?id=95821 - - Reviewed by Oliver Hunt. - - We can replace the load of the ClassInfo from the object with a load from the Structure. - - * dfg/DFGThunks.cpp: - (JSC::DFG::virtualForThunkGenerator): - -2012-09-05 Benjamin Poulain - - Fix the uses of String::operator+=() for Mac - https://bugs.webkit.org/show_bug.cgi?id=95818 - - Reviewed by Dan Bernstein. - - * jsc.cpp: - (functionJSCStack): Use StringBuilder to create the stack dump, it is faster - and avoid String::operator+=(). - - * parser/Parser.h: - (JSC::Parser::updateErrorMessageSpecialCase): - (JSC::Parser::updateErrorMessage): - (JSC::Parser::updateErrorWithNameAndMessage): - Use the String operators (and makeString) to concatenate the strings. - -2012-09-05 Gabor Rapcsanyi - - DFG JIT doesn't work properly on ARM hardfp - https://bugs.webkit.org/show_bug.cgi?id=95684 - - Reviewed by Filip Pizlo. - - Add hardfp support to DFG JIT. The patch is created with the - help of Zoltan Herczeg. - - * dfg/DFGCCallHelpers.h: - (CCallHelpers): - (JSC::DFG::CCallHelpers::setupArguments): - * dfg/DFGFPRInfo.h: - (FPRInfo): - * dfg/DFGSpeculativeJIT.h: - (SpeculativeJIT): - (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult): - (JSC::DFG::SpeculativeJIT::appendCallSetResult): - -2012-09-04 Mark Lam - - Allow the YarrJIT to use the assembler even when useJIT() is false. - Introduce the useYarrJIT() option. - https://bugs.webkit.org/show_bug.cgi?id=95809. - - Reviewed by Geoffrey Garen. - - * runtime/JSGlobalData.cpp: - (JSC::enableAssembler): - * runtime/Options.cpp: - (JSC::Options::initialize): - * runtime/Options.h: - (JSC): - -2012-09-04 Gavin Barraclough - - inc/dec behave incorrectly operating on a resolved const - https://bugs.webkit.org/show_bug.cgi?id=95815 - - Reviewed by Geoff Garen. - - There are two bugs here. - - (1) When the value being incremented is const, and the result is ignored, we assume this cannot be observed, and emit no code. - However if the value being incremented is not a primitive & has a valueOf conversion, then this should be being called. - - (2) In the case of a pre-increment of a const value where the result is not ignored, we'll move +/-1 to the destination, then - add the resolved const value being incremented to this. This is problematic if the destination is a local, and the const - value being incremented has a valueOf conversion that throws - the destination will be modified erroneously. Instead, we - need to use a temporary location. - - * bytecompiler/NodesCodegen.cpp: - (JSC::PostfixResolveNode::emitBytecode): - (JSC::PrefixResolveNode::emitBytecode): - - always at least perform a toNumber conversion, use tempDestination when reducing inc/dec to an add +/-1. - -2012-09-04 Filip Pizlo - - DFG GetByVal for JSArrays shouldn't OSR exit every time that the index is out of bound - https://bugs.webkit.org/show_bug.cgi?id=95717 - - Reviewed by Oliver Hunt. - - Rolling back in after fixing the negative index case. - - Make GetByVal for JSArrayOutOfBounds do meaningful things. The profiling was already - there so we should just use it! - - * bytecode/DFGExitProfile.h: - (JSC::DFG::exitKindToString): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::callOperation): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - -2012-09-04 Sheriff Bot - - Unreviewed, rolling out r127503. - http://trac.webkit.org/changeset/127503 - https://bugs.webkit.org/show_bug.cgi?id=95788 - - broke some tests (fast/js/dfg-negative-array-index, fast/js - /dfg-put-by-val-setter-then-get-by-val) (Requested by thorton - on #webkit). - - * bytecode/DFGExitProfile.h: - (JSC::DFG::exitKindToString): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::callOperation): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - -2012-09-04 Benjamin Poulain - - Improve JSC use of Strings after the UString->String change - https://bugs.webkit.org/show_bug.cgi?id=95633 - - Reviewed by Geoffrey Garen. - - This patch improve the use of strings in the JSC runtime. - - The initialization of Identifier is left for future patches. - - The improvements are the following: - -5% faster to raise one of the modified exception. - -3 times faster to execute Boolean::toString() - - Most of the changes are just about using the new methods - for string literals. - - With the changes, the binary on x86_64 gets 176 bytes smaller. - - * API/JSCallbackObjectFunctions.h: - (JSC::::staticFunctionGetter): - (JSC::::callbackGetter): - * API/JSContextRef.cpp: - (JSContextCreateBacktrace): - * API/JSObjectRef.cpp: - (JSObjectMakeFunctionWithCallback): - * bytecode/CodeBlock.cpp: - (JSC::valueToSourceString): - (JSC::CodeBlock::nameForRegister): - * interpreter/Interpreter.cpp: - (JSC::Interpreter::addStackTraceIfNecessary): - * runtime/ArrayConstructor.cpp: - (JSC::constructArrayWithSizeQuirk): - * runtime/ArrayPrototype.cpp: - (JSC::shift): - (JSC::unshift): - (JSC::arrayProtoFuncPop): - (JSC::arrayProtoFuncReverse): - * runtime/BooleanPrototype.cpp: - (JSC::booleanProtoFuncToString): Instead of instanciating new strings, reuse the - keywords available in SmallStrings. Avoiding the creation of the JSString and StringImpl - makes the method significantly faster. - - * runtime/DateConversion.cpp: - (JSC::formatDateTime): - * runtime/DatePrototype.cpp: - (JSC::formatLocaleDate): - (JSC::formateDateInstance): - (JSC::dateProtoFuncToISOString): - Change the way we use snprintf() for clarity and performance. - - Instead of allocating one extra byte to put a zero "just in case", we use the size returned - by snprintf(). - To prevent any overflow from a programming mistake, we explicitely test for overflow and - return an empty string. - - (JSC::dateProtoFuncToJSON): - * runtime/Error.cpp: - (JSC::createNotEnoughArgumentsError): - (JSC::throwTypeError): - (JSC::throwSyntaxError): - * runtime/Error.h: - (JSC::StrictModeTypeErrorFunction::create): - * runtime/ErrorPrototype.cpp: - (JSC::ErrorPrototype::finishCreation): - (JSC::errorProtoFuncToString): - Using a null String is correct because (8) uses jsString(), (9) tests for a length of 0. - - * runtime/ExceptionHelpers.cpp: - (JSC::InterruptedExecutionError::defaultValue): - (JSC::TerminatedExecutionError::defaultValue): - (JSC::createStackOverflowError): - (JSC::createOutOfMemoryError): - * runtime/Executable.cpp: - (JSC::EvalExecutable::compileInternal): - (JSC::FunctionExecutable::paramString): - * runtime/FunctionConstructor.cpp: - (JSC::constructFunction): - (JSC::constructFunctionSkippingEvalEnabledCheck): - * runtime/FunctionPrototype.h: - (JSC::FunctionPrototype::create): - Using a null String for the name is correct because InternalFunction uses jsString() - to create the name value. - - * runtime/InternalFunction.cpp: - (JSC::InternalFunction::finishCreation): - There is no need to create an empty string for a null string, jsString() handle both - cases as empty JSString. - - * runtime/JSArray.cpp: - (JSC::reject): - (JSC::SparseArrayValueMap::put): - (JSC::JSArray::put): - (JSC::JSArray::putByIndexBeyondVectorLength): - (JSC::JSArray::putDirectIndexBeyondVectorLength): - (JSC::JSArray::setLength): - (JSC::JSArray::pop): - (JSC::JSArray::push): - * runtime/JSFunction.cpp: - (JSC::JSFunction::finishCreation): Same issue as InternalFunction::finishCreation. - - (JSC::JSFunction::callerGetter): - (JSC::JSFunction::defineOwnProperty): - * runtime/JSGlobalData.cpp: - (JSC::enableAssembler): Use CFSTR() instead of CFStringCreateWithCString(). - CFStringCreateWithCString() copy the content and may choose to decode the data. - CFSTR() is much more efficient. - - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::reset): - JSFunction uses jsString() to create the name, we can use null strings instead - of creating empty strings. - - (JSC::JSGlobalObject::createThrowTypeError): ditto. - * runtime/JSGlobalObjectFunctions.cpp: - (JSC::encode): - (JSC::decode): - (JSC::globalFuncEval): - * runtime/JSONObject.cpp: - (JSC::Stringifier::appendStringifiedValue): - (JSC::Stringifier::Holder::appendNextProperty): - (JSC::JSONProtoFuncParse): - (JSC::JSONProtoFuncStringify): - * runtime/JSObject.cpp: - (JSC::JSObject::put): - (JSC::JSObject::defaultValue): - (JSC::JSObject::hasInstance): - (JSC::JSObject::defineOwnProperty): - * runtime/JSString.cpp: - Return an empty JSString to avoid the creation of a temporary empty String. - - (JSC::JSRopeString::getIndexSlowCase): - * runtime/JSString.h: - (JSC): Remove the versions of jsNontrivialString() taking a char*. All the callers - have been replaced by calls using ASCIILiteral. - - * runtime/JSValue.cpp: - (JSC::JSValue::putToPrimitive): - * runtime/LiteralParser.cpp: - (JSC::::Lexer::lex): - (JSC::::Lexer::lexString): - (JSC::::Lexer::lexNumber): - (JSC::::parse): - * runtime/LiteralParser.h: - (JSC::LiteralParser::getErrorMessage): - * runtime/NumberPrototype.cpp: - (JSC::numberProtoFuncToExponential): - (JSC::numberProtoFuncToFixed): - (JSC::numberProtoFuncToPrecision): - (JSC::numberProtoFuncToString): - * runtime/ObjectConstructor.cpp: - (JSC::objectConstructorGetPrototypeOf): - (JSC::objectConstructorGetOwnPropertyDescriptor): - (JSC::objectConstructorGetOwnPropertyNames): - (JSC::objectConstructorKeys): - (JSC::toPropertyDescriptor): - (JSC::objectConstructorDefineProperty): - (JSC::objectConstructorDefineProperties): - (JSC::objectConstructorCreate): - (JSC::objectConstructorSeal): - (JSC::objectConstructorFreeze): - (JSC::objectConstructorPreventExtensions): - (JSC::objectConstructorIsSealed): - (JSC::objectConstructorIsFrozen): - (JSC::objectConstructorIsExtensible): - * runtime/ObjectPrototype.cpp: - (JSC::objectProtoFuncDefineGetter): - (JSC::objectProtoFuncDefineSetter): - (JSC::objectProtoFuncToString): - * runtime/RegExpConstructor.cpp: - (JSC::constructRegExp): - * runtime/RegExpObject.cpp: - (JSC::reject): - (JSC::regExpObjectSource): - * runtime/RegExpPrototype.cpp: - (JSC::regExpProtoFuncCompile): - * runtime/StringObject.cpp: - (JSC::StringObject::defineOwnProperty): - * runtime/StringPrototype.cpp: - (JSC::jsSpliceSubstrings): - (JSC::jsSpliceSubstringsWithSeparators): - -2012-09-04 Filip Pizlo - - DFG GetByVal for JSArrays shouldn't OSR exit every time that the index is out of bound - https://bugs.webkit.org/show_bug.cgi?id=95717 - - Reviewed by Oliver Hunt. - - Make GetByVal for JSArrayOutOfBounds do meaningful things. The profiling was already - there so we should just use it! - - * bytecode/DFGExitProfile.h: - (JSC::DFG::exitKindToString): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::callOperation): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - -2012-09-04 Zoltan Horvath - - Extend the coverage of the Custom Allocation Framework in WTF and in JavaScriptCore - https://bugs.webkit.org/show_bug.cgi?id=95737 - - Reviewed by Eric Seidel. - - Add WTF_MAKE_FAST_ALLOCATED macro to the following class declarations because these are instantiated by operator new. - - * wtf/CryptographicallyRandomNumber.cpp: CryptographicallyRandomNumber is instantiated at wtf/CryptographicallyRandomNumber.cpp:162. - - * heap/MachineStackMarker.cpp: - (MachineThreads::Thread): Thread is instantiated at heap/MachineStackMarker.cpp:196. - * jit/ExecutableAllocatorFixedVMPool.cpp: - (FixedVMPoolExecutableAllocator): FixedVMPoolExecutableAllocator is instantiated at jit/ExecutableAllocatorFixedVMPool.cpp:111 - * parser/SourceProviderCache.h: - (SourceProviderCache): SourceProviderCache is instantiated at parser/SourceProvider.h:49. - * parser/SourceProviderCacheItem.h: - (SourceProviderCacheItem): SourceProviderCacheItem is instantiated at parser/Parser.cpp:843. - * runtime/GCActivityCallback.h: - (GCActivityCallback): GCActivityCallback is instantiated at runtime/GCActivityCallback.h:96. - * tools/CodeProfile.h: - (CodeProfile): CodeProfile is instantiated at JavaScriptCore/tools/CodeProfiling.cpp:140. - -2012-09-04 Mark Hahnenberg - - Remove uses of ClassInfo from SpeculativeJIT::compileObjectOrOtherLogicalNot - https://bugs.webkit.org/show_bug.cgi?id=95510 - - Reviewed by Oliver Hunt. - - More refactoring to get rid of ClassInfo checks in the DFG. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGSpeculativeJIT.h: - (SpeculativeJIT): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot): - (JSC::DFG::SpeculativeJIT::compileLogicalNot): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot): - (JSC::DFG::SpeculativeJIT::compileLogicalNot): - -2012-09-03 Patrick Gansterer - - Unreviewed. Build fix for ENABLE(CLASSIC_INTERPRETER) after r127393. - - * interpreter/Interpreter.h: - -2012-09-02 Geoffrey Garen - - Fixed failures seen on Linux bots. - - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_push_with_scope): - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::emit_op_push_with_scope): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * jit/JITStubs.h: push_*_scope doesn't have a destination operand anymore. - Accordingly, update these places in the baseline JIT, which I missed in my last patch. - -2012-09-02 Geoffrey Garen - - Refactored scope chain opcodes to support optimization for named function expressions - https://bugs.webkit.org/show_bug.cgi?id=95658 - - Reviewed by Sam Weinig. - - Renamed - push_scope => push_with_scope - push_new_scope => push_name_scope - to clarify the difference between them. - - Changed push_with_scope and push_name_scope not to save the new scope in - a temporary register, since doing so made optimization harder. - - (The old behavior was a hold-over from when the scope chain wasn't - a GC object, and wouldn't be marked otherwise. Now, the scope chain is - marked because it is a GC object pointed to by the call frame.) - - Changed push_name_scope to accept an operand specifying the attributes - for the named property, instead of assuming DontDelete, because a named - function expression needs ReadOnly|DontDelete. - - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::highestUsedRegister): Removed this function, - which used to be related to preserving saved scope object temporaries, - because it had no callers. - -2012-09-01 Geoffrey Garen - - Rolled back out a piece of - because it broke inspector tests on Windows. - - Shrink activation objects by half - https://bugs.webkit.org/show_bug.cgi?id=95591 - - Reviewed by Sam Weinig. - -2012-09-01 Mark Lam - - LLInt C loop backend. - https://bugs.webkit.org/show_bug.cgi?id=91052. - - Reviewed by Filip Pizlo. - - * JavaScriptCore.xcodeproj/project.pbxproj: - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - (JSC::CodeBlock::bytecodeOffset): - * interpreter/Interpreter.cpp: - (JSC::Interpreter::execute): - (JSC::Interpreter::executeCall): - (JSC::Interpreter::executeConstruct): - (JSC): - * interpreter/Interpreter.h: - * jit/JITStubs.h: - (JITStackFrame): - (JSC): - * llint/LLIntCLoop.cpp: Added. - (JSC): - (LLInt): - (JSC::LLInt::CLoop::initialize): - (JSC::LLInt::CLoop::catchRoutineFor): - (JSC::LLInt::CLoop::hostCodeEntryFor): - (JSC::LLInt::CLoop::jsCodeEntryWithArityCheckFor): - (JSC::LLInt::CLoop::jsCodeEntryFor): - * llint/LLIntCLoop.h: Added. - (JSC): - (LLInt): - (CLoop): - * llint/LLIntData.cpp: - (JSC::LLInt::initialize): - * llint/LLIntData.h: - (JSC): - * llint/LLIntOfflineAsmConfig.h: - * llint/LLIntOpcode.h: - * llint/LLIntThunks.cpp: - (LLInt): - * llint/LowLevelInterpreter.asm: - * llint/LowLevelInterpreter.cpp: - (LLInt): - (JSC::LLInt::Ints2Double): - (JSC): - (JSC::CLoop::execute): - * llint/LowLevelInterpreter.h: - (JSC): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - * offlineasm/asm.rb: - * offlineasm/backends.rb: - * offlineasm/cloop.rb: Added. - * offlineasm/instructions.rb: - * runtime/Executable.h: - (ExecutableBase): - (JSC::ExecutableBase::hostCodeEntryFor): - (JSC::ExecutableBase::jsCodeEntryFor): - (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor): - (JSC::ExecutableBase::catchRoutineFor): - (NativeExecutable): - * runtime/JSValue.h: - (JSC): - (LLInt): - (JSValue): - * runtime/JSValueInlineMethods.h: - (JSC): - (JSC::JSValue::JSValue): - * runtime/Options.cpp: - (JSC::Options::initialize): - -2012-09-01 Geoffrey Garen - - Rolled back in a piece of . - - Shrink activation objects by half - https://bugs.webkit.org/show_bug.cgi?id=95591 - - Reviewed by Sam Weinig. - - * runtime/JSActivation.h: - (JSActivation): - -2012-09-01 Geoffrey Garen - - Rolled back in a piece of . - - Shrink activation objects by half - https://bugs.webkit.org/show_bug.cgi?id=95591 - - Reviewed by Sam Weinig. - - * runtime/JSActivation.cpp: - (JSC::JSActivation::JSActivation): - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::JSGlobalObject): - (JSC::JSGlobalObject::setGlobalThis): - (JSC): - (JSC::JSGlobalObject::visitChildren): - * runtime/JSGlobalObject.h: - (JSGlobalObject): - (JSC::JSScope::globalThis): - (JSC): - (JSC::JSGlobalObject::globalThis): - * runtime/JSNameScope.h: - (JSC::JSNameScope::JSNameScope): - * runtime/JSScope.cpp: - (JSC::JSScope::visitChildren): - * runtime/JSScope.h: - (JSScope): - (JSC::JSScope::JSScope): - (JSC::JSScope::globalObject): - (JSC::JSScope::globalData): - * runtime/JSSegmentedVariableObject.h: - (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject): - * runtime/JSSymbolTableObject.h: - (JSC::JSSymbolTableObject::JSSymbolTableObject): - * runtime/JSVariableObject.h: - (JSC::JSVariableObject::JSVariableObject): - * runtime/JSWithScope.h: - (JSC::JSWithScope::JSWithScope): - * runtime/StrictEvalActivation.cpp: - (JSC::StrictEvalActivation::StrictEvalActivation): - -2012-09-01 Geoffrey Garen - - Rolled back out a piece of - because it broke Window inspector tests. - - Shrink activation objects by half - https://bugs.webkit.org/show_bug.cgi?id=95591 - - Reviewed by Sam Weinig. - - * runtime/JSActivation.h: - (JSActivation): - -2012-08-31 Filip Pizlo - - Unreviewed, attempt to fix Windows, take two. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - -2012-08-31 Filip Pizlo - - Unreviewed, attempt to fix Windows. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - -2012-08-31 Filip Pizlo - - JSArray::putDirectIndex should by default behave like JSObject::putDirect - https://bugs.webkit.org/show_bug.cgi?id=95630 - - Reviewed by Gavin Barraclough. - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * jsc.cpp: - (GlobalObject::finishCreation): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * runtime/JSArray.cpp: - (JSC::SparseArrayValueMap::putDirect): - (JSC::JSArray::defineOwnNumericProperty): - (JSC::JSArray::putDirectIndexBeyondVectorLength): - * runtime/JSArray.h: - (SparseArrayValueMap): - (JSArray): - (JSC::JSArray::putDirectIndex): - * runtime/JSONObject.cpp: - (JSC::Walker::walk): - * runtime/RegExpMatchesArray.cpp: - (JSC::RegExpMatchesArray::reifyAllProperties): - (JSC::RegExpMatchesArray::reifyMatchProperty): - * runtime/StringPrototype.cpp: - (JSC::splitStringByOneCharacterImpl): - (JSC::stringProtoFuncSplit): - -2012-08-31 Geoffrey Garen - - Rolled back in a piece of . - - Shrink activation objects by half - https://bugs.webkit.org/show_bug.cgi?id=95591 - - Reviewed by Sam Weinig. - - * runtime/JSGlobalData.cpp: - (JSC::JSGlobalData::JSGlobalData): - * runtime/JSGlobalData.h: - (JSGlobalData): - * runtime/JSNameScope.h: - (JSC::JSNameScope::JSNameScope): - * runtime/JSWithScope.h: - (JSC::JSWithScope::JSWithScope): - * runtime/StrictEvalActivation.cpp: - (JSC::StrictEvalActivation::StrictEvalActivation): - -2012-08-31 Geoffrey Garen - - Rolled back in a piece of . - - Shrink activation objects by half - https://bugs.webkit.org/show_bug.cgi?id=95591 - - Reviewed by Sam Weinig. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_resolve_global_dynamic): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - * runtime/JSActivation.cpp: - (JSC::JSActivation::JSActivation): - * runtime/JSGlobalData.cpp: - (JSC::JSGlobalData::JSGlobalData): - * runtime/JSGlobalData.h: - (JSGlobalData): - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::reset): - (JSC::JSGlobalObject::visitChildren): - * runtime/JSGlobalObject.h: - (JSGlobalObject): - (JSC::JSGlobalObject::withScopeStructure): - (JSC::JSGlobalObject::strictEvalActivationStructure): - (JSC::JSGlobalObject::activationStructure): - (JSC::JSGlobalObject::nameScopeStructure): - -2012-08-31 Mark Hahnenberg - - Remove use of ClassInfo in SpeculativeJIT::emitBranch - https://bugs.webkit.org/show_bug.cgi?id=95623 - - Reviewed by Filip Pizlo. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGSpeculativeJIT.h: - (SpeculativeJIT): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch): - (JSC::DFG::SpeculativeJIT::emitBranch): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch): - (JSC::DFG::SpeculativeJIT::emitBranch): - -2012-08-31 Geoffrey Garen - - Rolled back in a piece of . - - Shrink activation objects by half - https://bugs.webkit.org/show_bug.cgi?id=95591 - - Reviewed by Sam Weinig. - - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::MarkedBlock): - * heap/MarkedBlock.h: - (MarkedBlock): - (JSC::MarkedBlock::globalData): - (JSC): - * heap/WeakSet.cpp: - (JSC::WeakSet::addAllocator): - * heap/WeakSet.h: - (WeakSet): - (JSC::WeakSet::WeakSet): - (JSC::WeakSet::globalData): - * runtime/JSGlobalData.h: - (JSC::WeakSet::heap): - (JSC): - -2012-08-31 Mark Lam - - Refactor LLInt and supporting code in preparation for the C Loop backend. - https://bugs.webkit.org/show_bug.cgi?id=95531. - - Reviewed by Filip Pizlo. - - * bytecode/GetByIdStatus.cpp: - (JSC::GetByIdStatus::computeFromLLInt): - * bytecode/PutByIdStatus.cpp: - (JSC::PutByIdStatus::computeFromLLInt): - * jit/JITExceptions.cpp: - (JSC::genericThrow): Use ExecutableBase::catchRoutineFor() to fetch - fetch the catch routine for a thrown exception. This will allow - us to redefine that for the C loop later, and still keep this - code readable. - * llint/LLIntOfflineAsmConfig.h: Moved ASM macros to - LowLevelInterpreter.cpp which is the only place they are used. This - will make it more convenient to redefine them for the C loop later. - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::setUpCall): Use ExecutableBase's hostCodeEntry() - jsCodeEntryFor(), and jsCodeWithArityCheckEntryFor() for computing - the entry points to functions being called. - * llint/LLIntSlowPaths.h: - (SlowPathReturnType): - (JSC::LLInt::encodeResult): - (LLInt): - (JSC::LLInt::decodeResult): Added. Needed by LLInt C Loop later. - * llint/LowLevelInterpreter.asm: - * llint/LowLevelInterpreter.cpp: - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - * offlineasm/asm.rb: Disambiguate between opcodes and other labels. - * offlineasm/config.rb: - * runtime/Executable.h: - (JSC::ExecutableBase::hostCodeEntryFor): Added. - (ExecutableBase): - (JSC::ExecutableBase::jsCodeEntryFor): Added. - (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor): Added. - (JSC::ExecutableBase::catchRoutineFor): Added. - * runtime/JSValueInlineMethods.h: - (JSC): - -2012-08-31 Tony Chang - - Remove ENABLE_CSS3_FLEXBOX compile time flag - https://bugs.webkit.org/show_bug.cgi?id=95382 - - Reviewed by Ojan Vafai. - - Everyone is already enabling this by default and the spec has stablized. - - * Configurations/FeatureDefines.xcconfig: - -2012-08-31 Geoffrey Garen - - Not reviewed. - - Rolled out http://trac.webkit.org/changeset/127293 because it broke - inspector tests on Windows. - - Shrink activation objects by half - https://bugs.webkit.org/show_bug.cgi?id=95591 - - Reviewed by Sam Weinig. - -2012-08-31 Geoffrey Garen - - Shrink activation objects by half - https://bugs.webkit.org/show_bug.cgi?id=95591 - - Reviewed by Sam Weinig. - - Removed the global object, global data, and global this pointers from - JSScope, and changed an int to a bitfield. This gets the JSActivation - class down to 64 bytes, which in practice cuts it in half by getting it - out of the 128 byte size class. - - Now, it's one extra indirection to get these pointers. These pointers - aren't accessed by JIT code, so I thought there would be no cost to the - extra indirection. However, some C++-heavy SunSpider tests regressed a - bit in an early version of the patch, which added even more indirection. - This suggests that calls to exec->globalData() and/or exec->lexicalGlobalObject() - are common and probably duplicated in lots of places, and could stand - further optimization in C++. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): Test against the specific activation - for our global object, since there's no VM-shared activation structure - anymore. This is guaranteed to have the same success rate as the old test - because activation scope is fixed at compile time. - - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::MarkedBlock): - * heap/MarkedBlock.h: - (JSC::MarkedBlock::globalData): - * heap/WeakSet.cpp: - (JSC::WeakSet::addAllocator): - * heap/WeakSet.h: - (WeakSet): - (JSC::WeakSet::WeakSet): - (JSC::WeakSet::globalData): Store a JSGlobalData* instead of a Heap* - because JSGlobalData->Heap is just a constant fold in the addressing - mode, while Heap->JSGlobalData is an extra pointer dereference. (These - objects should eventually just merge.) - - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_resolve_global_dynamic): See DFGAbstractState.cpp. - - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: Load the activation structure from - the code block instead of the global data because the structure is not - VM-shared anymore. (See DFGAbstractState.cpp.) - - * runtime/JSActivation.cpp: - (JSC::JSActivation::JSActivation): - * runtime/JSActivation.h: - (JSActivation): This is the point of the patch: Remove the data. - - * runtime/JSGlobalData.cpp: - (JSC::JSGlobalData::JSGlobalData): - * runtime/JSGlobalData.h: - (JSGlobalData): No longer VM-shared. (See DFGAbstractState.cpp.) - - (JSC::WeakSet::heap): (See WeakSet.h.) - - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::JSGlobalObject): - (JSC::JSGlobalObject::setGlobalThis): - (JSC::JSGlobalObject::reset): - (JSC::JSGlobalObject::visitChildren): - * runtime/JSGlobalObject.h: - (JSGlobalObject): - (JSC::JSGlobalObject::withScopeStructure): - (JSC::JSGlobalObject::strictEvalActivationStructure): - (JSC::JSGlobalObject::activationStructure): - (JSC::JSGlobalObject::nameScopeStructure): - (JSC::JSScope::globalThis): - (JSC::JSGlobalObject::globalThis): Data that used to be in the JSScope - class goes here now, so it's not duplicated across all activations. - - * runtime/JSNameScope.h: - (JSC::JSNameScope::JSNameScope): - * runtime/JSScope.cpp: - (JSC::JSScope::visitChildren): This is the point of the patch: Remove the data. - - * runtime/JSScope.h: - (JSScope): - (JSC::JSScope::JSScope): - (JSC::JSScope::globalObject): - (JSC::JSScope::globalData): - * runtime/JSSegmentedVariableObject.h: - (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject): - * runtime/JSSymbolTableObject.h: - (JSC::JSSymbolTableObject::JSSymbolTableObject): - * runtime/JSVariableObject.h: - (JSC::JSVariableObject::JSVariableObject): - * runtime/JSWithScope.h: - (JSC::JSWithScope::JSWithScope): - * runtime/StrictEvalActivation.cpp: - (JSC::StrictEvalActivation::StrictEvalActivation): Simplified now that - we don't need to pass so much data to JSScope. - -2012-08-31 Patrick Gansterer - - Build fix for WinCE after r127191. - - * bytecode/JumpTable.h: - -2012-08-30 Filip Pizlo - - ASSERTION FAILURE in JSC::JSGlobalData::float32ArrayDescriptor when running fast/js/dfg-float64array.html - https://bugs.webkit.org/show_bug.cgi?id=95398 - - Reviewed by Mark Hahnenberg. - - Trying to get the build failure to be a bit more informative. - - * runtime/JSGlobalData.h: - (JSGlobalData): - -2012-08-30 Geoffrey Garen - - Try to fix the Qt build: add some #includes that, for some reason, only the Qt linker requires. - - * runtime/BooleanObject.cpp: - * runtime/ErrorInstance.cpp: - * runtime/NameInstance.cpp: - -2012-08-30 Geoffrey Garen - - Fix the Qt build: Removed a now-dead variable. - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::execute): - -2012-08-30 Benjamin Poulain - - Ambiguous operator[] after r127191 on some compiler - https://bugs.webkit.org/show_bug.cgi?id=95509 - - Reviewed by Simon Fraser. - - On some compilers, the operator[] conflicts with the Obj-C++ operators. This attempts to solve - the issue. - - * runtime/JSString.h: - (JSC::jsSingleCharacterSubstring): - (JSC::jsString): - (JSC::jsSubstring8): - (JSC::jsSubstring): - (JSC::jsOwnedString): - -2012-08-30 Geoffrey Garen - - Try to fix the Qt build: Remove the inline keyword at the declaration - site. - - The Qt compiler seems to be confused, complaining about these functions - not being defined in a translation unit, even though no generated code - in the unit calls these functions. Maybe removing the keyword at the - declaration site will change its mind. - - This shouldn't change the inlining decision at all: the definition is - still inline. - - * interpreter/CallFrame.h: - (ExecState): - -2012-08-30 Geoffrey Garen - - Undo Qt build fix guess, since it breaks other builds. - - * runtime/JSArray.h: - -2012-08-30 Geoffrey Garen - - Try to fix the Qt build: add an #include to JSArray.h, since - it's included by some of the files Qt complains about, and - some of is functions call the functions Qt complains about. - - * runtime/JSArray.h: - -2012-08-30 Geoffrey Garen - - Second step toward fixing the Windows build: Add new symbols. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - -2012-08-30 Geoffrey Garen - - Try to fix the Qt build: add an #include. - - * bytecode/GetByIdStatus.cpp: - -2012-08-30 Geoffrey Garen - - First step toward fixing the Windows build: Remove old symbols. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - -2012-08-30 Geoffrey Garen - - Use one object instead of two for closures, eliminating ScopeChainNode - https://bugs.webkit.org/show_bug.cgi?id=95501 - - Reviewed by Filip Pizlo. - - This patch removes ScopeChainNode, and moves all the data and related - functions that used to be in ScopeChainNode into JSScope. - - Most of this patch is mechanical changes to use a JSScope* where we used - to use a ScopeChainNode*. I've only specifically commented about items - that were non-mechanical. - - * runtime/Completion.cpp: - (JSC::evaluate): - * runtime/Completion.h: Don't require an explicit scope chain argument - when evaluating code. Clients never wanted anything other than the - global scope, and other arbitrary scopes probably wouldn't work - correctly, anyway. - - * runtime/JSScope.cpp: - * runtime/JSScope.h: - (JSC::JSScope::JSScope): JSScope now requires the data we used to pass to - ScopeChainNode, so it can link itself into the scope chain correctly. - - * runtime/JSWithScope.h: - (JSC::JSWithScope::create): - (JSC::JSWithScope::JSWithScope): JSWithScope gets an extra constructor - for specifically supplying your own scope chain. The DOM needs this - interface for setting up the scope chain for certain event handlers. - Other clients always just push the JSWithScope to the head of the current - scope chain. - -2012-08-30 Mark Lam - - Render unto #ifdef's that which belong to them. - https://bugs.webkit.org/show_bug.cgi?id=95482. - - Reviewed by Filip Pizlo. - - Refining / disambiguating between #ifdefs and adding some. For - example, ENABLE(JIT) is conflated with ENABLE(LLINT) in some places. - Also, we need to add ENABLE(COMPUTED_GOTO_OPCODES) to indicate that we - want interpreted opcodes to use COMPUTED GOTOs apart from ENABLE(LLINT) - and ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER). Also cleaned up #ifdefs - in certain places which were previously incorrect. - - * bytecode/CodeBlock.cpp: - (JSC): - (JSC::CodeBlock::bytecodeOffset): - * bytecode/CodeBlock.h: - (CodeBlock): - * bytecode/Opcode.h: - (JSC::padOpcodeName): - * config.h: - * dfg/DFGOperations.cpp: - * interpreter/AbstractPC.cpp: - (JSC::AbstractPC::AbstractPC): - * interpreter/CallFrame.h: - (ExecState): - * interpreter/Interpreter.cpp: - (JSC::Interpreter::~Interpreter): - (JSC::Interpreter::initialize): - (JSC::Interpreter::isOpcode): - (JSC::Interpreter::unwindCallFrame): - (JSC::getLineNumberForCallFrame): - (JSC::getCallerInfo): - (JSC::Interpreter::execute): - (JSC::Interpreter::executeCall): - (JSC::Interpreter::executeConstruct): - (JSC::Interpreter::privateExecute): - * interpreter/Interpreter.h: - (JSC::Interpreter::getOpcode): - (JSC::Interpreter::getOpcodeID): - (Interpreter): - * jit/HostCallReturnValue.h: - * jit/JITCode.h: - (JITCode): - * jit/JITExceptions.cpp: - * jit/JITExceptions.h: - * jit/JSInterfaceJIT.h: - * llint/LLIntData.h: - (JSC::LLInt::getOpcode): - * llint/LLIntEntrypoints.cpp: - (JSC::LLInt::getFunctionEntrypoint): - (JSC::LLInt::getEvalEntrypoint): - (JSC::LLInt::getProgramEntrypoint): - * llint/LLIntOffsetsExtractor.cpp: - (JSC::LLIntOffsetsExtractor::dummy): - * llint/LLIntSlowPaths.cpp: - (LLInt): - * runtime/JSGlobalData.cpp: - (JSC): - -2012-08-30 JungJik Lee - - [EFL][WK2] Add WebMemorySampler feature. - https://bugs.webkit.org/show_bug.cgi?id=91214 - - Reviewed by Kenneth Rohde Christiansen. - - WebMemorySampler collects Javascript stack and JIT memory usage in globalMemoryStatistics. - - * PlatformEfl.cmake: - -2012-08-30 Benjamin Poulain - - Replace JSC::UString by WTF::String - https://bugs.webkit.org/show_bug.cgi?id=95271 - - Reviewed by Geoffrey Garen. - - Having JSC::UString and WTF::String increase the complexity of working on WebKit, and - add useless conversions in the bindings. It also cause some code bloat. - - The performance advantages of UString have been ported over in previous patches. This patch - is the last step: getting rid of UString. - - In addition to the simplified code, this also reduce the binary size by 15kb on x86_64. - - * API/OpaqueJSString.cpp: - (OpaqueJSString::ustring): - * runtime/Identifier.h: - (JSC::Identifier::ustring): - To avoid changing everything at once, the function named ustring() were kept as is. They - will be renamed in a follow up patch. - - * runtime/JSString.h: - (JSC::JSString::string): - (JSC::JSValue::toWTFString): - (JSC::inlineJSValueNotStringtoString): - (JSC::JSValue::toWTFStringInline): - Since JSValue::toString() already exist (and return the JSString), the direct accessor is renamed - to ::toWTFString(). We may change ::string() to ::jsString() and ::toWTFString() to ::toString() - in the future. - - * runtime/StringPrototype.cpp: - (JSC::substituteBackreferencesSlow): Replace the use of UString::getCharacters<>() by String::getCharactersWithUpconvert<>(). - -2012-08-24 Mark Hahnenberg - - Remove uses of ClassInfo in StrictEq and CompareEq in the DFG - https://bugs.webkit.org/show_bug.cgi?id=93401 - - Reviewed by Filip Pizlo. - - Another incremental step in removing the dependence on ClassInfo pointers in object headers. - - * bytecode/SpeculatedType.h: - (JSC::isCellOrOtherSpeculation): - (JSC): - * dfg/DFGAbstractState.cpp: Updated the CFA to reflect the changes to the backend. - (JSC::DFG::AbstractState::execute): - * dfg/DFGNode.h: - (Node): - (JSC::DFG::Node::shouldSpeculateString): Added this new function since it was conspicuously absent. - (JSC::DFG::Node::shouldSpeculateNonStringCellOrOther): Also add this function for use in the CFA. - * dfg/DFGSpeculativeJIT.cpp: Refactored how we handle CompareEq and CompareStrictEq in the DFG. We now just - check for Strings by comparing the object's Structure to the global Structure for strings. We only - check for MasqueradesAsUndefined if the watchpoint has fired. These changes allow us to remove our - uses of the ClassInfo pointer for compiling these nodes. - (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality): - (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch): - (JSC::DFG::SpeculativeJIT::compare): - (JSC::DFG::SpeculativeJIT::compileStrictEq): - * dfg/DFGSpeculativeJIT.h: - (SpeculativeJIT): - * dfg/DFGSpeculativeJIT32_64.cpp: Same changes for 32 bit as for 64 bit. - (JSC::DFG::SpeculativeJIT::compileObjectEquality): - (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality): - (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compileObjectEquality): - (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality): - (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality): - -2012-08-30 Yong Li - - [BlackBerry] Implement IncrementalSweeper for PLATFORM(BLACKBERRY) - https://bugs.webkit.org/show_bug.cgi?id=95469 - - Reviewed by Rob Buis. - - RIM PR# 200595. - Share most code with USE(CF) and implement timer-related methods - for PLATFORM(BLACKBERRY). - - * heap/IncrementalSweeper.cpp: - (JSC): - (JSC::IncrementalSweeper::IncrementalSweeper): - (JSC::IncrementalSweeper::create): - (JSC::IncrementalSweeper::scheduleTimer): - (JSC::IncrementalSweeper::cancelTimer): - (JSC::IncrementalSweeper::doSweep): - * heap/IncrementalSweeper.h: - (IncrementalSweeper): - -2012-08-30 Mark Lam - - Fix broken classic intrpreter build. - https://bugs.webkit.org/show_bug.cgi?id=95484. - - Reviewed by Filip Pizlo. - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): - -2012-08-30 Byungwoo Lee - - Build warning : -Wsign-compare on DFGByteCodeParser.cpp. - https://bugs.webkit.org/show_bug.cgi?id=95418 - - Reviewed by Filip Pizlo. - - There is a build warning '-Wsign-compare' on - findArgumentPositionForLocal() in DFGByteCodeParser.cpp. - - For removing this warning, casting statement is added explicitly. - - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal): - (JSC::DFG::ByteCodeParser::findArgumentPosition): - -2012-08-30 Yong Li - - [BlackBerry] Set timer client on platform timer used in HeapTimer - https://bugs.webkit.org/show_bug.cgi?id=95464 - - Reviewed by Rob Buis. - - Otherwise the timer won't work. - - * heap/HeapTimer.cpp: - (JSC::HeapTimer::HeapTimer): - -2012-08-30 Julien BRIANCEAU - - [sh4] Add missing implementation for JavaScriptCore JIT - https://bugs.webkit.org/show_bug.cgi?id=95452 - - Reviewed by Oliver Hunt. - - * assembler/MacroAssemblerSH4.h: - (JSC::MacroAssemblerSH4::isCompactPtrAlignedAddressOffset): - (MacroAssemblerSH4): - (JSC::MacroAssemblerSH4::add32): - (JSC::MacroAssemblerSH4::convertibleLoadPtr): - * assembler/SH4Assembler.h: - (JSC::SH4Assembler::labelIgnoringWatchpoints): - (SH4Assembler): - (JSC::SH4Assembler::replaceWithLoad): - (JSC::SH4Assembler::replaceWithAddressComputation): - -2012-08-30 Charles Wei - - [BlackBerry] Eliminate build warnings - https://bugs.webkit.org/show_bug.cgi?id=95338 - - Reviewed by Filip Pizlo. - - static_cast to the same type to eliminate the build time warnings. - - * assembler/AssemblerBufferWithConstantPool.h: - (JSC::AssemblerBufferWithConstantPool::flushWithoutBarrier): - * assembler/MacroAssemblerARM.h: - (JSC::MacroAssemblerARM::branch32): - -2012-08-29 Mark Hahnenberg - - Remove use of ClassInfo from compileGetByValOnArguments and compileGetArgumentsLength - https://bugs.webkit.org/show_bug.cgi?id=95131 - - Reviewed by Filip Pizlo. - - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments): We don't need this speculation check. We can replace it - with an assert to guarantee this. - -2012-08-29 Mark Lam - - Refactoring LLInt::Data. - https://bugs.webkit.org/show_bug.cgi?id=95316. - - Reviewed by Geoff Garen. - - This change allows its opcodeMap to be easily queried from any function - without needing to go through a GlobalData object. It also introduces - the LLInt::getCodePtr() methods that will be used by the LLInt C loop - later to redefine how llint symbols (opcodes and trampoline glue - labels) get resolved. - - * assembler/MacroAssemblerCodeRef.h: - (MacroAssemblerCodePtr): - (JSC::MacroAssemblerCodePtr::createLLIntCodePtr): - (MacroAssemblerCodeRef): - (JSC::MacroAssemblerCodeRef::createLLIntCodeRef): - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::adjustPCIfAtCallSite): - (JSC::CodeBlock::bytecodeOffset): - * bytecode/Opcode.h: - Remove the 'const' to simplify things and avoid having to do - additional casts and #ifdefs in many places. - * bytecode/ResolveGlobalStatus.cpp: - (JSC::computeForLLInt): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::generate): - * interpreter/Interpreter.cpp: - (JSC::Interpreter::initialize): - * interpreter/Interpreter.h: - (Interpreter): - * jit/JITExceptions.cpp: - (JSC::genericThrow): - * llint/LLIntData.cpp: - (LLInt): - (JSC::LLInt::initialize): - * llint/LLIntData.h: - (JSC): - (LLInt): - (Data): - (JSC::LLInt::exceptionInstructions): - (JSC::LLInt::opcodeMap): - (JSC::LLInt::getOpcode): - (JSC::LLInt::getCodePtr): - (JSC::LLInt::Data::performAssertions): - * llint/LLIntExceptions.cpp: - (JSC::LLInt::returnToThrowForThrownException): - (JSC::LLInt::returnToThrow): - (JSC::LLInt::callToThrow): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - (JSC::LLInt::handleHostCall): - * runtime/InitializeThreading.cpp: - (JSC::initializeThreadingOnce): Initialize the singleton LLInt data. - * runtime/JSGlobalData.cpp: - (JSC::JSGlobalData::JSGlobalData): - * runtime/JSGlobalData.h: - (JSGlobalData): Removed the now unneeded LLInt::Data instance in - JSGlobalData. - * runtime/JSValue.h: - (JSValue): - -2012-08-29 Gavin Barraclough - - PutById uses DataLabel32, not DataLabelCompact - https://bugs.webkit.org/show_bug.cgi?id=95245 - - Reviewed by Geoff Garen. - - JIT::resetPatchPutById calls the the wrong thing on x86-64 – this is moot right now, - since they currently both do the same thing, but if we were to ever make compact mean - 8-bit this could be a real problem. Also, relying on the object still being in eax - on entry to the transition stub isn't very robust - added nonArgGPR1 to at least make - this explicit. - - * jit/JITPropertyAccess.cpp: - (JSC::JIT::emitSlow_op_put_by_id): - - copy regT0 to nonArgGPR1 - (JSC::JIT::privateCompilePutByIdTransition): - - DataLabelCompact -> DataLabel32 - (JSC::JIT::resetPatchPutById): - - reload regT0 from nonArgGPR1 - * jit/JSInterfaceJIT.h: - (JSInterfaceJIT): - - added nonArgGPR1 - -2012-08-28 Yong Li - - ExecutableAllocator should be destructed after Heap - https://bugs.webkit.org/show_bug.cgi?id=95244 - - Reviewed by Rob Buis. - - RIM PR# 199364. - Make ExecutableAllocator the first member in JSGlobalData. - Existing Web Worker tests can show the issue. - - * runtime/JSGlobalData.cpp: - (JSC::JSGlobalData::JSGlobalData): - * runtime/JSGlobalData.h: - (JSGlobalData): - -2012-08-29 Geoffrey Garen - - Try to fix the Windows build. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export! - -2012-08-28 Geoffrey Garen - - Introduced JSWithScope, making all scope objects subclasses of JSScope - https://bugs.webkit.org/show_bug.cgi?id=95295 - - Reviewed by Filip Pizlo. - - This is a step toward removing ScopeChainNode. With a uniform representation - for objects in the scope chain, we can move data from ScopeChainNode - into JSScope. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: Build! - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): Use an explicit JSWithScope object - for 'with' statements. Since 'with' can put any object in the scope - chain, we'll need an adapter object to hold the data ScopeChainNode - currently holds. - - (JSGlobalData): Support for JSWithScope. - - * runtime/JSScope.cpp: - (JSC::JSScope::objectAtScope): - * runtime/JSScope.h: Check for and unwrap JSWithScope. - - * runtime/JSType.h: Support for JSWithScope. - - * runtime/StrictEvalActivation.cpp: - (JSC::StrictEvalActivation::StrictEvalActivation): - * runtime/StrictEvalActivation.h: - (StrictEvalActivation): Inherit from JSScope, to make the scope chain uniform. - - * runtime/JSWithScope.cpp: Added. - (JSC::JSWithScope::visitChildren): - * runtime/JSWithScope.h: Added. - (JSWithScope): - (JSC::JSWithScope::create): - (JSC::JSWithScope::object): - (JSC::JSWithScope::createStructure): - (JSC::JSWithScope::JSWithScope): New adapter object. Since this object - is never exposed to scripts, it doesn't need any meaningful implementation - of property access or other callbacks. - -2012-08-29 Patrick Gansterer - - Unreviewed. Build fix for !ENABLE(JIT) after r126962. - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): - -2012-08-28 Geoffrey Garen - - Added JSScope::objectInScope(), and refactored callers to use it - https://bugs.webkit.org/show_bug.cgi?id=95281 - - Reviewed by Gavin Barraclough. - - This is a step toward removing ScopeChainNode. We need a layer of - indirection so that 'with' scopes can proxy for an object. - JSScope::objectInScope() will be that layer. - - * bytecode/EvalCodeCache.h: - (JSC::EvalCodeCache::tryGet): - (JSC::EvalCodeCache::getSlow): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::resolve): - (JSC::BytecodeGenerator::resolveConstDecl): . vs -> - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::unwindCallFrame): - (JSC::Interpreter::execute): - * runtime/JSScope.cpp: - (JSC::JSScope::resolve): - (JSC::JSScope::resolveSkip): - (JSC::JSScope::resolveGlobalDynamic): - (JSC::JSScope::resolveBase): - (JSC::JSScope::resolveWithBase): - (JSC::JSScope::resolveWithThis): Added JSScope::objectAtScope() calls. - - * runtime/JSScope.h: - (JSScope): - (JSC::JSScope::objectAtScope): - (JSC): - (ScopeChainIterator): - (JSC::ScopeChainIterator::ScopeChainIterator): - (JSC::ScopeChainIterator::get): - (JSC::ScopeChainIterator::operator->): - (JSC::ScopeChainIterator::operator++): - (JSC::ScopeChainIterator::operator==): - (JSC::ScopeChainIterator::operator!=): - (JSC::ScopeChainNode::begin): - (JSC::ScopeChainNode::end): I moved ScopeChainIterator to this file - to resolve a circular #include problem. Eventually, I'll probably rename - it to JSScope::iterator, so I think it belongs here. - - * runtime/ScopeChain.cpp: - (JSC::ScopeChainNode::print): - (JSC::ScopeChainNode::localDepth): . vs -> - - * runtime/ScopeChain.h: - (ScopeChainNode): I made the 'object' data member private because it's - no longer safe to access -- you need to call JSScope::objectAtScope() - instead. - - The JITs need to be friends because of the private declaration. - - Subtly, JIT/LLInt code is correct without any changes because JIT/LLInt - code never compiles direct access to a with scope. - -2012-08-28 Mark Lam - - Adding support for adding LLInt opcode extensions. This will be needed - by the LLInt C loop interpreter later. - https://bugs.webkit.org/show_bug.cgi?id=95277. - - Reviewed by Geoffrey Garen. - - * JavaScriptCore.xcodeproj/project.pbxproj: - * bytecode/Opcode.h: - * llint/LLIntOpcode.h: Added. - * llint/LowLevelInterpreter.h: - -2012-08-28 Gavin Barraclough - - Rolled out r126928, this broke stuff :'-( - - * jit/JITPropertyAccess.cpp: - (JSC::JIT::privateCompilePutByIdTransition): - (JSC::JIT::resetPatchPutById): - -2012-08-28 Gavin Barraclough - - PutById uses DataLabel32, not DataLabelCompact - https://bugs.webkit.org/show_bug.cgi?id=95245 - - Reviewed by Geoff Garen. - - JIT::resetPatchPutById calls the the wrong thing on x86-64 – this is moot right now, - since they currently both do the same thing, but if we were to ever make compact mean - 8-bit this could be a real problem. Also, don't rely on the object still being in eax - on entry to the transition stub – this isn't very robust. - - * jit/JITPropertyAccess.cpp: - (JSC::JIT::privateCompilePutByIdTransition): - - DataLabelCompact -> DataLabel32 - (JSC::JIT::resetPatchPutById): - - reload regT0 from the stack - -2012-08-28 Sheriff Bot - - Unreviewed, rolling out r126914. - http://trac.webkit.org/changeset/126914 - https://bugs.webkit.org/show_bug.cgi?id=95239 - - it breaks everything and fixes nothing (Requested by pizlo on - #webkit). - - * API/JSCallbackObject.h: - (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty): - (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty): - (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren): - * API/JSCallbackObjectFunctions.h: - (JSC::::getOwnPropertyNames): - * API/JSClassRef.cpp: - (OpaqueJSClass::~OpaqueJSClass): - (OpaqueJSClassContextData::OpaqueJSClassContextData): - (OpaqueJSClass::contextData): - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - (JSC::EvalCodeCache::visitAggregate): - (JSC::CodeBlock::nameForRegister): - * bytecode/JumpTable.h: - (JSC::StringJumpTable::offsetForValue): - (JSC::StringJumpTable::ctiForValue): - * bytecode/LazyOperandValueProfile.cpp: - (JSC::LazyOperandValueProfileParser::getIfPresent): - * bytecode/SamplingTool.cpp: - (JSC::SamplingTool::dump): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::addVar): - (JSC::BytecodeGenerator::addGlobalVar): - (JSC::BytecodeGenerator::addConstant): - (JSC::BytecodeGenerator::addConstantValue): - (JSC::BytecodeGenerator::emitLoad): - (JSC::BytecodeGenerator::addStringConstant): - (JSC::BytecodeGenerator::emitLazyNewFunction): - * bytecompiler/NodesCodegen.cpp: - (JSC::PropertyListNode::emitBytecode): - * debugger/Debugger.cpp: - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse): - (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse): - (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize): - (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild): - * dfg/DFGAssemblyHelpers.cpp: - (JSC::DFG::AssemblyHelpers::decodedCodeMapFor): - * dfg/DFGByteCodeCache.h: - (JSC::DFG::ByteCodeCache::~ByteCodeCache): - (JSC::DFG::ByteCodeCache::get): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::cellConstant): - (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): - * dfg/DFGStructureCheckHoistingPhase.cpp: - (JSC::DFG::StructureCheckHoistingPhase::run): - (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck): - (JSC::DFG::StructureCheckHoistingPhase::noticeClobber): - * heap/Heap.cpp: - (JSC::Heap::markProtectedObjects): - * heap/Heap.h: - (JSC::Heap::forEachProtectedCell): - * heap/JITStubRoutineSet.cpp: - (JSC::JITStubRoutineSet::markSlow): - (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines): - * heap/MarkStack.cpp: - (JSC::MarkStack::internalAppend): - * heap/Weak.h: - (JSC::weakRemove): - * jit/JIT.cpp: - (JSC::JIT::privateCompile): - * jit/JITStubs.cpp: - (JSC::JITThunks::ctiStub): - * parser/Parser.cpp: - (JSC::::parseStrictObjectLiteral): - * profiler/Profile.cpp: - (JSC::functionNameCountPairComparator): - (JSC::Profile::debugPrintDataSampleStyle): - * runtime/Identifier.cpp: - (JSC::Identifier::add): - * runtime/JSActivation.cpp: - (JSC::JSActivation::getOwnPropertyNames): - (JSC::JSActivation::symbolTablePutWithAttributes): - * runtime/JSArray.cpp: - (JSC::SparseArrayValueMap::put): - (JSC::SparseArrayValueMap::putDirect): - (JSC::SparseArrayValueMap::visitChildren): - (JSC::JSArray::enterDictionaryMode): - (JSC::JSArray::defineOwnNumericProperty): - (JSC::JSArray::getOwnPropertySlotByIndex): - (JSC::JSArray::getOwnPropertyDescriptor): - (JSC::JSArray::putByIndexBeyondVectorLength): - (JSC::JSArray::putDirectIndexBeyondVectorLength): - (JSC::JSArray::deletePropertyByIndex): - (JSC::JSArray::getOwnPropertyNames): - (JSC::JSArray::setLength): - (JSC::JSArray::sort): - (JSC::JSArray::compactForSorting): - (JSC::JSArray::checkConsistency): - * runtime/JSSymbolTableObject.cpp: - (JSC::JSSymbolTableObject::getOwnPropertyNames): - * runtime/JSSymbolTableObject.h: - (JSC::symbolTableGet): - (JSC::symbolTablePut): - (JSC::symbolTablePutWithAttributes): - * runtime/RegExpCache.cpp: - (JSC::RegExpCache::invalidateCode): - * runtime/WeakGCMap.h: - (JSC::WeakGCMap::clear): - (JSC::WeakGCMap::set): - * tools/ProfileTreeNode.h: - (JSC::ProfileTreeNode::sampleChild): - (JSC::ProfileTreeNode::childCount): - (JSC::ProfileTreeNode::dumpInternal): - (JSC::ProfileTreeNode::compareEntries): - -2012-08-28 Filip Pizlo - - LLInt should not rely on ordering of global labels - https://bugs.webkit.org/show_bug.cgi?id=95221 - - Reviewed by Oliver Hunt. - - * llint/LowLevelInterpreter.asm: - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - -2012-08-28 Caio Marcelo de Oliveira Filho - - Rename first/second to key/value in HashMap iterators - https://bugs.webkit.org/show_bug.cgi?id=82784 - - Reviewed by Eric Seidel. - - * API/JSCallbackObject.h: - (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty): - (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty): - (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren): - * API/JSCallbackObjectFunctions.h: - (JSC::::getOwnPropertyNames): - * API/JSClassRef.cpp: - (OpaqueJSClass::~OpaqueJSClass): - (OpaqueJSClassContextData::OpaqueJSClassContextData): - (OpaqueJSClass::contextData): - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - (JSC::EvalCodeCache::visitAggregate): - (JSC::CodeBlock::nameForRegister): - * bytecode/JumpTable.h: - (JSC::StringJumpTable::offsetForValue): - (JSC::StringJumpTable::ctiForValue): - * bytecode/LazyOperandValueProfile.cpp: - (JSC::LazyOperandValueProfileParser::getIfPresent): - * bytecode/SamplingTool.cpp: - (JSC::SamplingTool::dump): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::addVar): - (JSC::BytecodeGenerator::addGlobalVar): - (JSC::BytecodeGenerator::addConstant): - (JSC::BytecodeGenerator::addConstantValue): - (JSC::BytecodeGenerator::emitLoad): - (JSC::BytecodeGenerator::addStringConstant): - (JSC::BytecodeGenerator::emitLazyNewFunction): - * bytecompiler/NodesCodegen.cpp: - (JSC::PropertyListNode::emitBytecode): - * debugger/Debugger.cpp: - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse): - (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse): - (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize): - (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild): - * dfg/DFGAssemblyHelpers.cpp: - (JSC::DFG::AssemblyHelpers::decodedCodeMapFor): - * dfg/DFGByteCodeCache.h: - (JSC::DFG::ByteCodeCache::~ByteCodeCache): - (JSC::DFG::ByteCodeCache::get): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::cellConstant): - (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): - * dfg/DFGStructureCheckHoistingPhase.cpp: - (JSC::DFG::StructureCheckHoistingPhase::run): - (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck): - (JSC::DFG::StructureCheckHoistingPhase::noticeClobber): - * heap/Heap.cpp: - (JSC::Heap::markProtectedObjects): - * heap/Heap.h: - (JSC::Heap::forEachProtectedCell): - * heap/JITStubRoutineSet.cpp: - (JSC::JITStubRoutineSet::markSlow): - (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines): - * heap/MarkStack.cpp: - (JSC::MarkStack::internalAppend): - * heap/Weak.h: - (JSC::weakRemove): - * jit/JIT.cpp: - (JSC::JIT::privateCompile): - * jit/JITStubs.cpp: - (JSC::JITThunks::ctiStub): - * parser/Parser.cpp: - (JSC::::parseStrictObjectLiteral): - * profiler/Profile.cpp: - (JSC::functionNameCountPairComparator): - (JSC::Profile::debugPrintDataSampleStyle): - * runtime/Identifier.cpp: - (JSC::Identifier::add): - * runtime/JSActivation.cpp: - (JSC::JSActivation::getOwnPropertyNames): - (JSC::JSActivation::symbolTablePutWithAttributes): - * runtime/JSArray.cpp: - (JSC::SparseArrayValueMap::put): - (JSC::SparseArrayValueMap::putDirect): - (JSC::SparseArrayValueMap::visitChildren): - (JSC::JSArray::enterDictionaryMode): - (JSC::JSArray::defineOwnNumericProperty): - (JSC::JSArray::getOwnPropertySlotByIndex): - (JSC::JSArray::getOwnPropertyDescriptor): - (JSC::JSArray::putByIndexBeyondVectorLength): - (JSC::JSArray::putDirectIndexBeyondVectorLength): - (JSC::JSArray::deletePropertyByIndex): - (JSC::JSArray::getOwnPropertyNames): - (JSC::JSArray::setLength): - (JSC::JSArray::sort): - (JSC::JSArray::compactForSorting): - (JSC::JSArray::checkConsistency): - * runtime/JSSymbolTableObject.cpp: - (JSC::JSSymbolTableObject::getOwnPropertyNames): - * runtime/JSSymbolTableObject.h: - (JSC::symbolTableGet): - (JSC::symbolTablePut): - (JSC::symbolTablePutWithAttributes): - * runtime/RegExpCache.cpp: - (JSC::RegExpCache::invalidateCode): - * runtime/WeakGCMap.h: - (JSC::WeakGCMap::clear): - (JSC::WeakGCMap::set): - * tools/ProfileTreeNode.h: - (JSC::ProfileTreeNode::sampleChild): - (JSC::ProfileTreeNode::childCount): - (JSC::ProfileTreeNode::dumpInternal): - (JSC::ProfileTreeNode::compareEntries): - -2012-08-28 Geoffrey Garen - - GCC warning in JSActivation is causing Mac EWS errors - https://bugs.webkit.org/show_bug.cgi?id=95103 - - Reviewed by Sam Weinig. - - Try to fix a strict aliasing violation by using bitwise_cast. The - union in the cast should signal to the compiler that aliasing between - types is happening. - - * runtime/JSActivation.cpp: - (JSC::JSActivation::visitChildren): - -2012-08-28 Geoffrey Garen - - Build fix: svn add two files I forgot in my last patch. - -2012-08-27 Geoffrey Garen - - Refactored and consolidated variable resolution functions - https://bugs.webkit.org/show_bug.cgi?id=95166 - - Reviewed by Filip Pizlo. - - This patch does a few things: - - (1) Introduces a new class, JSScope, which is the base class for all - objects that represent a scope in the scope chain. - - (2) Refactors and consolidates duplicate implementations of variable - resolution into the JSScope class. - - (3) Renames JSStaticScopeObject to JSNameScope because, as distinct from - something like a 'let' scope, JSStaticScopeObject only has storage for a - single name. - - These changes makes logical sense to me as-is. I will also use them in an - upcoming optimization. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: Build! - - * bytecode/CodeBlock.cpp: - (JSC): Build fix for LLInt-only builds. - - * bytecode/GlobalResolveInfo.h: - (GlobalResolveInfo): Use PropertyOffset to be consistent with other parts - of the engine. - - * bytecompiler/NodesCodegen.cpp: - * dfg/DFGOperations.cpp: Use the shared code in JSScope instead of rolling - our own. - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::execute): - (JSC::Interpreter::createExceptionScope): - (JSC::Interpreter::privateExecute): - * interpreter/Interpreter.h: Use the shared code in JSScope instead of rolling - our own. - - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): Use the shared code in JSScope instead of rolling - our own. - - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - (LLInt): Use the shared code in JSScope instead of rolling our own. Note - that one of these slow paths calls the wrong helper function. I left it - that way to avoid a behavior change in a refactoring patch. - - * parser/Nodes.cpp: Updated for rename. - - * runtime/CommonSlowPaths.h: - (CommonSlowPaths): Removed resolve slow paths because were duplicative. - - * runtime/JSGlobalData.cpp: - (JSC::JSGlobalData::JSGlobalData): - * runtime/JSGlobalData.h: - (JSGlobalData): Updated for renames. - - * runtime/JSNameScope.cpp: Copied from Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp. - (JSC): - (JSC::JSNameScope::visitChildren): - (JSC::JSNameScope::toThisObject): - (JSC::JSNameScope::put): - (JSC::JSNameScope::getOwnPropertySlot): - * runtime/JSNameScope.h: Copied from Source/JavaScriptCore/runtime/JSStaticScopeObject.h. - (JSC): - (JSC::JSNameScope::create): - (JSC::JSNameScope::createStructure): - (JSNameScope): - (JSC::JSNameScope::JSNameScope): - (JSC::JSNameScope::isDynamicScope): Used do-webcore-rename script here. - It is fabulous! - - * runtime/JSObject.h: - (JSObject): - (JSC::JSObject::isNameScopeObject): More rename. - - * runtime/JSScope.cpp: Added. - (JSC): - (JSC::JSScope::isDynamicScope): - (JSC::JSScope::resolve): - (JSC::JSScope::resolveSkip): - (JSC::JSScope::resolveGlobal): - (JSC::JSScope::resolveGlobalDynamic): - (JSC::JSScope::resolveBase): - (JSC::JSScope::resolveWithBase): - (JSC::JSScope::resolveWithThis): - * runtime/JSScope.h: Added. - (JSC): - (JSScope): - (JSC::JSScope::JSScope): All the code here is a port from the - Interpreter.cpp implementations of this functionality. - - * runtime/JSStaticScopeObject.cpp: Removed. - * runtime/JSStaticScopeObject.h: Removed. - - * runtime/JSSymbolTableObject.cpp: - (JSC): - * runtime/JSSymbolTableObject.h: - (JSSymbolTableObject): - * runtime/JSType.h: Updated for rename. - - * runtime/Operations.h: - (JSC::resolveBase): Removed because it was duplicative. - -2012-08-28 Alban Browaeys - - [GTK] LLint build fails with -g -02 - https://bugs.webkit.org/show_bug.cgi?id=90098 - - Reviewed by Filip Pizlo. - - Avoid duplicate offsets for llint, discarding them. - - * offlineasm/offsets.rb: - -2012-08-27 Sheriff Bot - - Unreviewed, rolling out r126836. - http://trac.webkit.org/changeset/126836 - https://bugs.webkit.org/show_bug.cgi?id=95163 - - Broke all Apple ports, EFL, and Qt. (Requested by tkent on - #webkit). - - * API/JSCallbackObject.h: - (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty): - (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty): - (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren): - * API/JSCallbackObjectFunctions.h: - (JSC::::getOwnPropertyNames): - * API/JSClassRef.cpp: - (OpaqueJSClass::~OpaqueJSClass): - (OpaqueJSClassContextData::OpaqueJSClassContextData): - (OpaqueJSClass::contextData): - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - (JSC::EvalCodeCache::visitAggregate): - (JSC::CodeBlock::nameForRegister): - * bytecode/JumpTable.h: - (JSC::StringJumpTable::offsetForValue): - (JSC::StringJumpTable::ctiForValue): - * bytecode/LazyOperandValueProfile.cpp: - (JSC::LazyOperandValueProfileParser::getIfPresent): - * bytecode/SamplingTool.cpp: - (JSC::SamplingTool::dump): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::addVar): - (JSC::BytecodeGenerator::addGlobalVar): - (JSC::BytecodeGenerator::addConstant): - (JSC::BytecodeGenerator::addConstantValue): - (JSC::BytecodeGenerator::emitLoad): - (JSC::BytecodeGenerator::addStringConstant): - (JSC::BytecodeGenerator::emitLazyNewFunction): - * bytecompiler/NodesCodegen.cpp: - (JSC::PropertyListNode::emitBytecode): - * debugger/Debugger.cpp: - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse): - (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse): - (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize): - (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild): - * dfg/DFGAssemblyHelpers.cpp: - (JSC::DFG::AssemblyHelpers::decodedCodeMapFor): - * dfg/DFGByteCodeCache.h: - (JSC::DFG::ByteCodeCache::~ByteCodeCache): - (JSC::DFG::ByteCodeCache::get): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::cellConstant): - (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): - * dfg/DFGStructureCheckHoistingPhase.cpp: - (JSC::DFG::StructureCheckHoistingPhase::run): - (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck): - (JSC::DFG::StructureCheckHoistingPhase::noticeClobber): - * heap/Heap.cpp: - (JSC::Heap::markProtectedObjects): - * heap/Heap.h: - (JSC::Heap::forEachProtectedCell): - * heap/JITStubRoutineSet.cpp: - (JSC::JITStubRoutineSet::markSlow): - (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines): - * heap/MarkStack.cpp: - (JSC::MarkStack::internalAppend): - * heap/Weak.h: - (JSC::weakRemove): - * jit/JIT.cpp: - (JSC::JIT::privateCompile): - * jit/JITStubs.cpp: - (JSC::JITThunks::ctiStub): - * parser/Parser.cpp: - (JSC::::parseStrictObjectLiteral): - * profiler/Profile.cpp: - (JSC::functionNameCountPairComparator): - (JSC::Profile::debugPrintDataSampleStyle): - * runtime/Identifier.cpp: - (JSC::Identifier::add): - * runtime/JSActivation.cpp: - (JSC::JSActivation::getOwnPropertyNames): - (JSC::JSActivation::symbolTablePutWithAttributes): - * runtime/JSArray.cpp: - (JSC::SparseArrayValueMap::put): - (JSC::SparseArrayValueMap::putDirect): - (JSC::SparseArrayValueMap::visitChildren): - (JSC::JSArray::enterDictionaryMode): - (JSC::JSArray::defineOwnNumericProperty): - (JSC::JSArray::getOwnPropertySlotByIndex): - (JSC::JSArray::getOwnPropertyDescriptor): - (JSC::JSArray::putByIndexBeyondVectorLength): - (JSC::JSArray::putDirectIndexBeyondVectorLength): - (JSC::JSArray::deletePropertyByIndex): - (JSC::JSArray::getOwnPropertyNames): - (JSC::JSArray::setLength): - (JSC::JSArray::sort): - (JSC::JSArray::compactForSorting): - (JSC::JSArray::checkConsistency): - * runtime/JSSymbolTableObject.cpp: - (JSC::JSSymbolTableObject::getOwnPropertyNames): - * runtime/JSSymbolTableObject.h: - (JSC::symbolTableGet): - (JSC::symbolTablePut): - (JSC::symbolTablePutWithAttributes): - * runtime/RegExpCache.cpp: - (JSC::RegExpCache::invalidateCode): - * runtime/WeakGCMap.h: - (JSC::WeakGCMap::clear): - (JSC::WeakGCMap::set): - * tools/ProfileTreeNode.h: - (JSC::ProfileTreeNode::sampleChild): - (JSC::ProfileTreeNode::childCount): - (JSC::ProfileTreeNode::dumpInternal): - (JSC::ProfileTreeNode::compareEntries): - -2012-08-27 Caio Marcelo de Oliveira Filho - - Rename first/second to key/value in HashMap iterators - https://bugs.webkit.org/show_bug.cgi?id=82784 - - Reviewed by Eric Seidel. - - * API/JSCallbackObject.h: - (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty): - (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty): - (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren): - * API/JSCallbackObjectFunctions.h: - (JSC::::getOwnPropertyNames): - * API/JSClassRef.cpp: - (OpaqueJSClass::~OpaqueJSClass): - (OpaqueJSClassContextData::OpaqueJSClassContextData): - (OpaqueJSClass::contextData): - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - (JSC::EvalCodeCache::visitAggregate): - (JSC::CodeBlock::nameForRegister): - * bytecode/JumpTable.h: - (JSC::StringJumpTable::offsetForValue): - (JSC::StringJumpTable::ctiForValue): - * bytecode/LazyOperandValueProfile.cpp: - (JSC::LazyOperandValueProfileParser::getIfPresent): - * bytecode/SamplingTool.cpp: - (JSC::SamplingTool::dump): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::addVar): - (JSC::BytecodeGenerator::addGlobalVar): - (JSC::BytecodeGenerator::addConstant): - (JSC::BytecodeGenerator::addConstantValue): - (JSC::BytecodeGenerator::emitLoad): - (JSC::BytecodeGenerator::addStringConstant): - (JSC::BytecodeGenerator::emitLazyNewFunction): - * bytecompiler/NodesCodegen.cpp: - (JSC::PropertyListNode::emitBytecode): - * debugger/Debugger.cpp: - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse): - (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse): - (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize): - (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild): - * dfg/DFGAssemblyHelpers.cpp: - (JSC::DFG::AssemblyHelpers::decodedCodeMapFor): - * dfg/DFGByteCodeCache.h: - (JSC::DFG::ByteCodeCache::~ByteCodeCache): - (JSC::DFG::ByteCodeCache::get): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::cellConstant): - (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): - * dfg/DFGStructureCheckHoistingPhase.cpp: - (JSC::DFG::StructureCheckHoistingPhase::run): - (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck): - (JSC::DFG::StructureCheckHoistingPhase::noticeClobber): - * heap/Heap.cpp: - (JSC::Heap::markProtectedObjects): - * heap/Heap.h: - (JSC::Heap::forEachProtectedCell): - * heap/JITStubRoutineSet.cpp: - (JSC::JITStubRoutineSet::markSlow): - (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines): - * heap/MarkStack.cpp: - (JSC::MarkStack::internalAppend): - * heap/Weak.h: - (JSC::weakRemove): - * jit/JIT.cpp: - (JSC::JIT::privateCompile): - * jit/JITStubs.cpp: - (JSC::JITThunks::ctiStub): - * parser/Parser.cpp: - (JSC::::parseStrictObjectLiteral): - * profiler/Profile.cpp: - (JSC::functionNameCountPairComparator): - (JSC::Profile::debugPrintDataSampleStyle): - * runtime/Identifier.cpp: - (JSC::Identifier::add): - * runtime/JSActivation.cpp: - (JSC::JSActivation::getOwnPropertyNames): - (JSC::JSActivation::symbolTablePutWithAttributes): - * runtime/JSArray.cpp: - (JSC::SparseArrayValueMap::put): - (JSC::SparseArrayValueMap::putDirect): - (JSC::SparseArrayValueMap::visitChildren): - (JSC::JSArray::enterDictionaryMode): - (JSC::JSArray::defineOwnNumericProperty): - (JSC::JSArray::getOwnPropertySlotByIndex): - (JSC::JSArray::getOwnPropertyDescriptor): - (JSC::JSArray::putByIndexBeyondVectorLength): - (JSC::JSArray::putDirectIndexBeyondVectorLength): - (JSC::JSArray::deletePropertyByIndex): - (JSC::JSArray::getOwnPropertyNames): - (JSC::JSArray::setLength): - (JSC::JSArray::sort): - (JSC::JSArray::compactForSorting): - (JSC::JSArray::checkConsistency): - * runtime/JSSymbolTableObject.cpp: - (JSC::JSSymbolTableObject::getOwnPropertyNames): - * runtime/JSSymbolTableObject.h: - (JSC::symbolTableGet): - (JSC::symbolTablePut): - (JSC::symbolTablePutWithAttributes): - * runtime/RegExpCache.cpp: - (JSC::RegExpCache::invalidateCode): - * runtime/WeakGCMap.h: - (JSC::WeakGCMap::clear): - (JSC::WeakGCMap::set): - * tools/ProfileTreeNode.h: - (JSC::ProfileTreeNode::sampleChild): - (JSC::ProfileTreeNode::childCount): - (JSC::ProfileTreeNode::dumpInternal): - (JSC::ProfileTreeNode::compareEntries): - -2012-08-27 Filip Pizlo - - Structure check hoisting should abstain if the OSR entry's must-handle value for the respective variable has a different structure - https://bugs.webkit.org/show_bug.cgi?id=95141 - - - Reviewed by Mark Hahnenberg. - - * dfg/DFGStructureCheckHoistingPhase.cpp: - (JSC::DFG::StructureCheckHoistingPhase::run): - -2012-08-27 Mark Hahnenberg - - Remove use of ClassInfo from SpeculativeJIT::compileGetByValOnArguments - https://bugs.webkit.org/show_bug.cgi?id=95131 - - Reviewed by Filip Pizlo. - - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments): We don't need this speculation check. We can replace it - with an assert to guarantee this. - -2012-08-27 Oliver Hunt - - Remove opcode definition autogen for now - https://bugs.webkit.org/show_bug.cgi?id=95148 - - Reviewed by Mark Hahnenberg. - - This isn't worth doing at the moment. - - * DerivedSources.make: - * JavaScriptCore.xcodeproj/project.pbxproj: - * bytecode/Opcode.h: - (JSC): - (JSC::padOpcodeName): - * bytecode/OpcodeDefinitions.h: Removed. - * bytecode/opcodes: Removed. - * opcode_definition_generator.py: Removed. - * opcode_generator.py: Removed. - * opcode_parser.py: Removed. - -2012-08-27 Mark Hahnenberg - - Remove uses of TypedArray ClassInfo from SpeculativeJIT::checkArgumentTypes - https://bugs.webkit.org/show_bug.cgi?id=95112 - - Reviewed by Filip Pizlo. - - Removing these checks since we no longer need them. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::initialize): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::checkArgumentTypes): - -2012-08-27 Benjamin Poulain - - Add ECMAScript Number to String conversion to WTF::String - https://bugs.webkit.org/show_bug.cgi?id=95016 - - Reviewed by Geoffrey Garen. - - Rename UString::number(double) to UString::numberToStringECMAScript(double) to - differenciate it from the fixed-width conversion performed by String::number(). - - * parser/ParserArena.h: - (JSC::IdentifierArena::makeNumericIdentifier): - * runtime/JSONObject.cpp: - (JSC::Stringifier::appendStringifiedValue): - * runtime/NumberPrototype.cpp: - (JSC::numberProtoFuncToExponential): - (JSC::numberProtoFuncToFixed): - (JSC::numberProtoFuncToPrecision): - (JSC::numberProtoFuncToString): - * runtime/NumericStrings.h: - (JSC::NumericStrings::add): - * runtime/UString.cpp: - (JSC::UString::numberToStringECMAScript): - * runtime/UString.h: - (UString): - -2012-08-27 Mikhail Pozdnyakov - - Rename RegisterProtocolHandler API to NavigatorContentUtils - https://bugs.webkit.org/show_bug.cgi?id=94920 - - Reviewed by Adam Barth. - - ENABLE_REGISTER_PROTOCOL_HANDLER is renamed to ENABLE_NAVIGATOR_CONTENT_UTILS. - - * Configurations/FeatureDefines.xcconfig: - -2012-08-26 Filip Pizlo - - Unreviewed, fix for builds without VALUE_PROFILING. I had forgotten that shouldEmitProfiling() - is designed to return true if DFG_JIT is disabled. I should be using canBeOptimized() instead. - - * jit/JITCall.cpp: - (JSC::JIT::compileOpCall): - * jit/JITCall32_64.cpp: - (JSC::JIT::compileOpCall): - -2012-08-26 Geoffrey Garen - - Don't allocate space for arguments and call frame if arguments aren't captured - https://bugs.webkit.org/show_bug.cgi?id=95024 - - Reviewed by Phil Pizlo. - - 27% on v8-real-earley. - - * runtime/JSActivation.h: - (JSC::JSActivation::registerOffset): The offset is zero if we're skipping - the arguments and call frame because "offset" means space reserved for - those things. - - (JSC::JSActivation::tearOff): Don't copy the scope chain and callee. We - don't need them for anything, and we're no longer guaranteed to have - space for them. - -2012-08-26 Geoffrey Garen - - Removed the NULL checks from visitChildren functions - https://bugs.webkit.org/show_bug.cgi?id=95021 - - Reviewed by Oliver Hunt. - - As of http://trac.webkit.org/changeset/126624, all values are NULL-checked - during GC, so explicit NULL checks aren't needed anymore. - -2011-08-26 Geoffrey Garen - - Removed a JSC-specific hack from the web inspector - https://bugs.webkit.org/show_bug.cgi?id=95033 - - Reviewed by Filip Pizlo. - - Added support for what the web inspector really wanted instead. - - * runtime/JSActivation.cpp: - (JSC::JSActivation::symbolTableGet): - (JSC::JSActivation::symbolTablePut): Added some explanation for these - checks, which were non-obvious to me. - - (JSC::JSActivation::getOwnPropertySlot): It's impossible to access the - arguments property of an activation after it's been torn off, since the - only way to tear off an activation is to instantiate a new function, - which has its own arguments property in scope. However, the inspector - get special access to activations, and may try to perform this access, - so we need a special guard to maintain coherence and avoid crashing in - case the activation optimized out the arguments property. - - * runtime/JSActivation.cpp: - (JSC::JSActivation::symbolTableGet): - (JSC::JSActivation::symbolTablePut): - (JSC::JSActivation::getOwnPropertyNames): - (JSC::JSActivation::getOwnPropertyDescriptor): Provide getOwnPropertyNames - and getOwnPropertyDescriptor implementations, to meet the web inspector's - needs. (User code can never call these.) - -2012-08-24 Filip Pizlo - - Finally inlining should correctly track the catch context - https://bugs.webkit.org/show_bug.cgi?id=94986 - - - Reviewed by Sam Weinig. - - This fixes two behaviors: - - 1) Throwing from a finally block. Previously, we would seem to reenter the finally - block - though only once. - - 2) Executing a finally block from some nested context, for example due to a - 'continue', 'break', or 'return' in the try. This would execute the finally - block in the context of of the try block, which could lead to either scope depth - mismatches or reexecutions of the finally block on throw, similarly to (1) but - for different reasons. - - * bytecompiler/BytecodeGenerator.cpp: - (JSC): - (JSC::BytecodeGenerator::pushFinallyContext): - (JSC::BytecodeGenerator::emitComplexJumpScopes): - (JSC::BytecodeGenerator::pushTry): - (JSC::BytecodeGenerator::popTryAndEmitCatch): - * bytecompiler/BytecodeGenerator.h: - (FinallyContext): - (TryData): - (JSC): - (TryContext): - (TryRange): - (BytecodeGenerator): - * bytecompiler/NodesCodegen.cpp: - (JSC::TryNode::emitBytecode): - -2012-08-26 Filip Pizlo - - Array type checks and storage accesses should be uniformly represented and available to CSE - https://bugs.webkit.org/show_bug.cgi?id=95013 - - Reviewed by Oliver Hunt. - - This uniformly breaks up all array accesses into up to three parts: - - 1) The type check, using a newly introduced CheckArray node, in addition to possibly - a CheckStructure node. We were already inserting the CheckStructure prior to this - patch. The CheckArray node will be automatically eliminated if the thing it was - checking for had already been checked for, either intentionally (a CheckStructure - inserted based on the array profile of this access) or accidentally (some checks, - typically a CheckStructure, inserted for some unrelated operations). The - CheckArray node may not be inserted if the array type is non-specific (Generic or - ForceExit). - - 2) The storage load using GetIndexedPropertyStorage. Previously, this only worked for - GetByVal. Now it works for all array accesses. The storage load may not be - inserted if the mode of array access does not permit CSE of storage loads (like - non-specific modes or Arguments). - - 3) The access itself: one of GetByVal, PutByVal, PutByValAlias, ArrayPush, ArrayPop, - GetArrayLength, StringCharAt, or StringCharCodeAt. - - This means that the type check can be subjected to CSE even if the CFA isn't smart - enough to reason about it (yet!). It also means that the storage load can always be - subjected to CSE; previously CSE on storage load only worked for array loads and not - other forms of access. Finally, it removes the bizarre behavior that - GetIndexedPropertyStorage previously had: previously, it was responsible for the type - check in some cases, but not others; this made reasoning about the CFA really - confusing. - - This change also disables late refinement of array mode, since I decided that - supporting that feature is both confusing and likely unprofitable. The array modes are - now locked in in the first fixup run after prediction propagation. Of course, - refinements from Generic to something else would not have been a problem; we could - reenable those if we thought we really needed to. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - * dfg/DFGArrayMode.cpp: - (JSC::DFG::fromStructure): - (DFG): - (JSC::DFG::refineArrayMode): - * dfg/DFGArrayMode.h: - (DFG): - (JSC::DFG::modeIsJSArray): - (JSC::DFG::lengthNeedsStorage): - (JSC::DFG::modeIsSpecific): - (JSC::DFG::modeSupportsLength): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::ByteCodeParser): - (JSC::DFG::ByteCodeParser::getArrayMode): - (ByteCodeParser): - (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks): - (JSC::DFG::ByteCodeParser::handleIntrinsic): - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCFGSimplificationPhase.cpp: - (JSC::DFG::CFGSimplificationPhase::mergeBlocks): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::CSEPhase): - (JSC::DFG::CSEPhase::checkStructureElimination): - (CSEPhase): - (JSC::DFG::CSEPhase::checkArrayElimination): - (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination): - (JSC::DFG::CSEPhase::performNodeCSE): - (JSC::DFG::performCSE): - * dfg/DFGCSEPhase.h: - (DFG): - * dfg/DFGCommon.h: - * dfg/DFGConstantFoldingPhase.cpp: - (JSC::DFG::ConstantFoldingPhase::foldConstants): - * dfg/DFGDriver.cpp: - (JSC::DFG::compile): - * dfg/DFGFixupPhase.cpp: - (JSC::DFG::FixupPhase::fixupNode): - (JSC::DFG::FixupPhase::checkArray): - (FixupPhase): - (JSC::DFG::FixupPhase::blessArrayOperation): - * dfg/DFGGraph.cpp: - (JSC::DFG::Graph::Graph): - (DFG): - (JSC::DFG::Graph::dump): - (JSC::DFG::Graph::collectGarbage): - * dfg/DFGGraph.h: - (Graph): - (JSC::DFG::Graph::vote): - (JSC::DFG::Graph::substitute): - * dfg/DFGNode.h: - (JSC::DFG::Node::hasArrayMode): - (JSC::DFG::Node::setArrayMode): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGOperations.cpp: - * dfg/DFGPhase.h: - (DFG): - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - (JSC::DFG::PredictionPropagationPhase::mergeDefaultFlags): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::checkArray): - (JSC::DFG::SpeculativeJIT::useChildren): - (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): - (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray): - (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage): - (JSC::DFG::SpeculativeJIT::compileGetArrayLength): - * dfg/DFGSpeculativeJIT.h: - (SpeculativeJIT): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGStructureCheckHoistingPhase.cpp: - (JSC::DFG::StructureCheckHoistingPhase::run): - -2012-08-26 Filip Pizlo - - DFGGraph.h has a bogus comment about the nature of StorageAccessData - https://bugs.webkit.org/show_bug.cgi?id=95035 - - Reviewed by Oliver Hunt. - - The comment is both wrong (storage access instructions don't reference CheckStructure) - and highly redundant: of course it's the case that two structures may have the same - identifier. Our interference analyses currently don't care about this and make the - conservative assumptions when necessary (same identifier, same object -> must be same - property; same identifier, may be same object -> may be the same property). Better to - remove the bogus comment since the code that operates over this data structure is - fairly self-explanatory already. - - * dfg/DFGGraph.h: - (StorageAccessData): - -2012-08-25 Geoffrey Garen - - Try a little harder to fix the Linux build. - - * runtime/JSActivation.cpp: - * runtime/JSActivation.h: - -2012-08-25 Geoffrey Garen - - Try to fix the Linux build. - - * runtime/JSActivation.cpp: - -2012-08-25 Geoffrey Garen - - Don't use malloc / destructors for activation objects - https://bugs.webkit.org/show_bug.cgi?id=94897 - - Reviewed by Oliver Hunt. - - 65% faster on v8-real-earley. - - Lots of boilerplate here, but the jist is this: - - (1) Use CopiedSpace instead of malloc to allocate the activation's - backing store. - - (2) Use MarkedSpace instead of ref-counting to allocate the symbol table. - - (3) ==> No more destructor. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::CodeBlock): - (JSC::CodeBlock::stronglyVisitStrongReferences): - * bytecode/CodeBlock.h: - (JSC::CodeBlock::symbolTable): - (CodeBlock): - (JSC::GlobalCodeBlock::GlobalCodeBlock): - (JSC::FunctionCodeBlock::FunctionCodeBlock): - (FunctionCodeBlock): SymbolTable is a GC object now, so it gets a write - barrier and visit calls instead of ref-counting. I changed all CodeBlocks - to use shared symbol tables because the distinction between shared and - unshared hurt my head. - - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::resolve): - (JSC::BytecodeGenerator::resolveConstDecl): - (JSC::BytecodeGenerator::emitPutStaticVar): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): Sometimes, a period just wants - to be an arrow. And then C++ is there to accommodate. - - * jit/JITDriver.h: - (JSC::jitCompileFunctionIfAppropriate): - * runtime/Arguments.h: - (ArgumentsData): - (JSC::Arguments::setRegisters): - (Arguments): - (JSC::Arguments::argument): - (JSC::Arguments::finishCreation): - * runtime/Executable.cpp: - (JSC::FunctionExecutable::FunctionExecutable): - (JSC::ProgramExecutable::compileInternal): - (JSC::FunctionExecutable::compileForCallInternal): - (JSC::FunctionExecutable::compileForConstructInternal): - (JSC::FunctionExecutable::visitChildren): - * runtime/Executable.h: - (JSC::FunctionExecutable::symbolTable): - (FunctionExecutable): - * runtime/ExecutionHarness.h: - (JSC::prepareFunctionForExecution): I changed from WriteBarrier to - WriteBarrierBase so activations could reuse StorageBarrier and PropertyStorage. - - * runtime/JSActivation.cpp: - (JSC::JSActivation::JSActivation): - (JSC::JSActivation::finishCreation): Allocate the symbol table here, - after we're fully constructed, to avoid GC during initialization. - - (JSC::JSActivation::visitChildren): - (JSC::JSActivation::symbolTableGet): - (JSC::JSActivation::symbolTablePut): - (JSC::JSActivation::getOwnPropertyNames): - (JSC::JSActivation::symbolTablePutWithAttributes): - * runtime/JSActivation.h: - (JSC::JSActivation::create): - (JSActivation): - (JSC::JSActivation::registerOffset): - (JSC): - (JSC::JSActivation::registerArraySize): - (JSC::JSActivation::registerArraySizeInBytes): - (JSC::JSActivation::tearOff): Tear-off zero-initializes all uncopied - registers. This makes it safe to copyAndAppend the full buffer in - visitChildren, without any extra checks. - - * runtime/JSCell.h: - (JSCell): Moved a shared default set of flags into this base class, so - I could use it in a few places. - - * runtime/JSGlobalData.cpp: - (JSC::JSGlobalData::JSGlobalData): - * runtime/JSGlobalData.h: - (JSGlobalData): New structure for symbol tables. - - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::JSGlobalObject): - (JSC::JSGlobalObject::addStaticGlobals): - * runtime/JSGlobalObject.h: - (JSGlobalObject): - (JSC::JSGlobalObject::symbolTableHasProperty): We don't need an inline - symbol table -- JSSymbolTableObject will GC allocate one for us. - - * runtime/JSObject.h: - (JSObject): - * runtime/JSSegmentedVariableObject.h: - (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject): - * runtime/JSStaticScopeObject.cpp: - (JSC): - (JSC::JSStaticScopeObject::visitChildren): NULL check our register store - because finishCreation allocates an object now, so we may get marked - before we've assigned to our register store. - - * runtime/JSStaticScopeObject.h: - (JSC::JSStaticScopeObject::finishCreation): - (JSC::JSStaticScopeObject::JSStaticScopeObject): - (JSStaticScopeObject): No more destructor for this object, either, since - it no longer embeds a hash table. - - * runtime/JSSymbolTableObject.cpp: - (JSC::JSSymbolTableObject::visitChildren): - (JSC::JSSymbolTableObject::deleteProperty): - (JSC::JSSymbolTableObject::getOwnPropertyNames): - * runtime/JSSymbolTableObject.h: - (JSC::JSSymbolTableObject::symbolTable): - (JSSymbolTableObject): - (JSC::JSSymbolTableObject::JSSymbolTableObject): - (JSC::JSSymbolTableObject::finishCreation): - (JSC::symbolTableGet): - (JSC::symbolTablePut): - (JSC::symbolTablePutWithAttributes): SymbolTableObject allocates a symbol - table automatically if one isn't provided. (Activations provide their - own, which they get from compiled code.) - - * runtime/JSVariableObject.cpp: - (JSC): - * runtime/JSVariableObject.h: - (JSC::JSVariableObject::registerAt): - (JSC::JSVariableObject::addressOfRegisters): - (JSVariableObject): - (JSC::JSVariableObject::JSVariableObject): - (JSC::JSVariableObject::finishCreation): Removed a bunch of obsolete code. - Activations manage their registers directly now. - - * runtime/StorageBarrier.h: - (StorageBarrier): - (JSC::StorageBarrier::operator!): - - * runtime/SymbolTable.cpp: - (JSC): - (JSC::SharedSymbolTable::destroy): - * runtime/SymbolTable.h: - (JSC::SharedSymbolTable::create): - (SharedSymbolTable): - (JSC::SharedSymbolTable::createStructure): - (JSC::SharedSymbolTable::SharedSymbolTable): Boilerplat code to - make shared symbol table GC-allocated. - -2012-08-25 Filip Pizlo - - op_call should have ArrayProfiling for the benefit of array intrinsics - https://bugs.webkit.org/show_bug.cgi?id=95014 - - Reviewed by Sam Weinig. - - This is a performance-neutral change that just adds the profiling but does not - use it, yet. If in the future we wanted to make this kind of profiling cheaper - we could move it into specialized thunks for the relevant array intrinsics, but - I figure that if this much simpler change gives us what we need without any - discernable performance penalty then that's for the best. - - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::emitCall): - * jit/JITCall.cpp: - (JSC::JIT::compileOpCall): - * jit/JITCall32_64.cpp: - (JSC::JIT::compileOpCall): - * llint/LowLevelInterpreter.asm: - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - -2012-08-25 Filip Pizlo - - The redundant phi elimination phase is not used and should be removed - https://bugs.webkit.org/show_bug.cgi?id=95006 - - Reviewed by Dan Bernstein. - - Just removing dead code. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * dfg/DFGDriver.cpp: - * dfg/DFGRedundantPhiEliminationPhase.cpp: Removed. - * dfg/DFGRedundantPhiEliminationPhase.h: Removed. - -2012-08-24 Benjamin Poulain - - Unify Number to StringImpl conversion - https://bugs.webkit.org/show_bug.cgi?id=94879 - - Reviewed by Geoffrey Garen. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - * runtime/UString.cpp: - * runtime/UString.h: - (JSC::UString::number): - Update UString to directly use the common NumberToString implementation. - -2012-08-24 Oliver Hunt - - Always null check cells before marking - https://bugs.webkit.org/show_bug.cgi?id=94968 - - Reviewed by Geoffrey Garen. - - Originally we tried to minimise null checks by only null checking values - that we knew could be null, however given that we can't ever guarantee - when a GC will happen, we're better off just always assuming that a null - check will be necessary. This results in a much less fragile code base - as we can add GC allocations to object initialisers without having to - subsequently worry about whether the object we are initialising will need - to add a bunch of null checks in its visitChildren implementation. - - * heap/MarkStack.cpp: - (JSC::MarkStack::internalAppend): - * heap/MarkStackInlineMethods.h: - (JSC::MarkStack::append): - (JSC::MarkStack::appendUnbarrieredPointer): - * runtime/Structure.h: - (JSC::MarkStack::internalAppend): - -2012-08-23 Oliver Hunt - - Autogenerate Opcode definitions - https://bugs.webkit.org/show_bug.cgi?id=94840 - - Reviewed by Gavin Barraclough. - - Start the process of autogenerating the code emission for the bytecode. - We'll just start with automatic generation of the list of Opcodes as that - requires the actual definition of the opcodes, and the logic for parsing - them. - - Due to some rather annoying dependency cycles, this initial version has - the OpcodeDefinitions.h file checked into the tree, although with some - work I hope to be able to fix that. - - * DerivedSources.make: - * JavaScriptCore.xcodeproj/project.pbxproj: - * bytecode/Opcode.h: - Include OpcodeDefinitions.h as our definitive source of info - about the opcodes. - * bytecode/OpcodeDefinitions.h: Added. - Autogenerated file - * bytecode/opcodes: Added. - The new opcode definition file - * opcode_definition_generator.py: Added. - (generateOpcodeDefinition): - (generate): - Module that generates the content for OpcodeDefinitions.h - * opcode_generator.py: Added. - (printUsage): - (main): - Driver script - * opcode_parser.py: Added. - Simple parser for the opcode definitions. - -2011-08-23 Geoffrey Garen - - Unreviewed, rolling out r126505. - http://trac.webkit.org/changeset/126505 - https://bugs.webkit.org/show_bug.cgi?id=94840 - - Caused testapi to crash on launch - - * DerivedSources.make: - * JavaScriptCore.xcodeproj/project.pbxproj: - * bytecode/Opcode.h: - (JSC): - (JSC::padOpcodeName): - * bytecode/OpcodeDefinitions.h: Removed. - * bytecode/opcodes: Removed. - * opcode_definition_generator.py: Removed. - * opcode_generator.py: Removed. - * opcode_parser.py: Removed. - -2012-08-23 Oliver Hunt - - Autogenerate Opcode definitions - https://bugs.webkit.org/show_bug.cgi?id=94840 - - Reviewed by Gavin Barraclough. - - Start the process of autogenerating the code emission for the bytecode. - We'll just start with automatic generation of the list of Opcodes as that - requires the actual definition of the opcodes, and the logic for parsing - them. - - Due to some rather annoying dependency cycles, this initial version has - the OpcodeDefinitions.h file checked into the tree, although with some - work I hope to be able to fix that. - - * DerivedSources.make: - * JavaScriptCore.xcodeproj/project.pbxproj: - * bytecode/Opcode.h: - Include OpcodeDefinitions.h as our definitive source of info - about the opcodes. - * bytecode/OpcodeDefinitions.h: Added. - Autogenerated file - * bytecode/opcodes: Added. - The new opcode definition file - * opcode_definition_generator.py: Added. - (generateOpcodeDefinition): - (generate): - Module that generates the content for OpcodeDefinitions.h - * opcode_generator.py: Added. - (printUsage): - (main): - Driver script - * opcode_parser.py: Added. - Simple parser for the opcode definitions. - -2012-08-23 Mark Hahnenberg - - Change behavior of MasqueradesAsUndefined to better accommodate DFG changes - https://bugs.webkit.org/show_bug.cgi?id=93884 - - Reviewed by Filip Pizlo. - - With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of - MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines, - we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined - objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject). - For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not - masquerade as undefined within frame B, but it will continue to masquerade in frame A. - - There are two primary changes that are taking place here. One is to thread the ExecState* through - JSValue::toBoolean and JSCell::toBoolean so that JSCell::toBoolean can check the object's - JSGlobalObject to compare it to the lexical JSGlobalObject of the currently running code. If the two - are distinct, then the object cannot MasqueradeAsUndefined. - - The other change is to perform this comparison of JSGlobalObjects everywhere where the MasqueradesAsUndefined - flag in the Structure is checked. For C++ code, this check has been factored into its own function in - Structure::masqueradesAsUndefined. We only perform this check in the DFG if the current JSGlobalObject has - had a MasqueradesAsUndefined object allocated within its context. This conditional compilation is managed - through the use of a WatchpointSet in each JSGlobalObject and alternate create() functions for JS DOM wrappers - that are MasqueradesAsUndefined. - - * API/JSValueRef.cpp: - (JSValueToBoolean): - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - * bytecode/Watchpoint.h: - (WatchpointSet): - * debugger/DebuggerCallFrame.h: - (JSC::DebuggerCallFrame::callFrame): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGCFGSimplificationPhase.cpp: - (JSC::DFG::CFGSimplificationPhase::run): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull): - (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull): - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull): - (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull): - (JSC::DFG::SpeculativeJIT::compile): - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_is_undefined): - (JSC::JIT::emit_op_jeq_null): - (JSC::JIT::emit_op_jneq_null): - (JSC::JIT::emit_op_eq_null): - (JSC::JIT::emit_op_neq_null): - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::emit_op_is_undefined): - (JSC::JIT::emit_op_jeq_null): - (JSC::JIT::emit_op_jneq_null): - (JSC::JIT::emit_op_eq_null): - (JSC::JIT::emit_op_neq_null): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - * runtime/ArrayPrototype.cpp: - (JSC::arrayProtoFuncFilter): - (JSC::arrayProtoFuncEvery): - (JSC::arrayProtoFuncSome): - * runtime/BooleanConstructor.cpp: - (JSC::constructBoolean): - (JSC::callBooleanConstructor): - * runtime/JSCell.h: - (JSCell): - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::JSGlobalObject): - * runtime/JSGlobalObject.h: - (JSGlobalObject): - (JSC::JSGlobalObject::masqueradesAsUndefinedWatchpoint): - * runtime/JSString.h: - (JSC::JSCell::toBoolean): - (JSC::JSValue::toBoolean): - * runtime/JSValue.h: - * runtime/ObjectConstructor.cpp: - (JSC::toPropertyDescriptor): - * runtime/Operations.cpp: - (JSC::jsTypeStringForValue): - (JSC::jsIsObjectType): - * runtime/Operations.h: - (JSC): - (JSC::JSValue::equalSlowCaseInline): - * runtime/RegExpConstructor.cpp: - (JSC::setRegExpConstructorMultiline): - * runtime/RegExpPrototype.cpp: - (JSC::regExpProtoFuncToString): - * runtime/Structure.h: - (Structure): - (JSC::Structure::globalObjectOffset): - (JSC::Structure::masqueradesAsUndefined): - (JSC): - -2012-08-23 Mark Rowe - - Make JavaScriptCore build with the latest version of clang. - - Reviewed by Dan Bernstein. - - * heap/MachineStackMarker.cpp: - (JSC::MachineThreads::MachineThreads): The m_heap member is only used within - assertions, so guard its initialization with !ASSERT_DISABLED. - * heap/MachineStackMarker.h: - (MachineThreads): Ditto for its declaration. - * jit/JITStubCall.h: - (JSC::JITStubCall::JITStubCall): The m_returnType member is only used within - assertions or if we're using JSVALUE32_64, so guard its uses with the appropriate - #if. - (JITStubCall): Ditto. - -2012-08-23 Christophe Dumez - - Serialization of JavaScript values does not appear to respect new HTML5 Structured Clone semantics - https://bugs.webkit.org/show_bug.cgi?id=65292 - - Reviewed by Oliver Hunt. - - Add function to construct a StringObject from a JSValue. - Similar functions already exist for NumberObject and - BooleanObject for example. - - Export several symbols so address linking errors in - WebCore. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - * runtime/BooleanObject.h: - (BooleanObject): - * runtime/NumberObject.h: - (NumberObject): - (JSC): - * runtime/StringObject.cpp: - (JSC::constructString): - (JSC): - * runtime/StringObject.h: - (JSC): - -2012-08-22 Filip Pizlo - - Array accesses should remember what kind of array they are predicted to access - https://bugs.webkit.org/show_bug.cgi?id=94448 - - Reviewed by Gavin Barraclough. - - Introduced the notion of DFG::Array::Mode, stored in node.arrayMode(), which allows nodes - to remember how they decided to access arrays. This permits the bytecode parser to "lock in" - the mode of access if it has profiling at its disposal, and it also allows the prediction - propagator to do a fixup of the array mode later in the optimization fixpoint. - - This patch adds a healthy amount of new capability (specifically the ability of the parser - to lock in an array mode regardless of type predictions) and it also blows away a lot of - messy code. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - * dfg/DFGArrayMode.cpp: Added. - (DFG): - (JSC::DFG::fromObserved): - (JSC::DFG::refineArrayMode): - (JSC::DFG::modeAlreadyChecked): - (JSC::DFG::modeToString): - * dfg/DFGArrayMode.h: Added. - (DFG): - (JSC::DFG::canCSEStorage): - (JSC::DFG::modeForPut): - (JSC::DFG::modesCompatibleForStorageLoad): - (JSC::DFG::modeSupportsLength): - * dfg/DFGByteCodeParser.cpp: - (ByteCodeParser): - (JSC::DFG::ByteCodeParser::getArrayModeWithoutOSRExit): - (JSC::DFG::ByteCodeParser::getArrayMode): - (JSC::DFG::ByteCodeParser::handleIntrinsic): - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::getByValLoadElimination): - (JSC::DFG::CSEPhase::checkStructureLoadElimination): - (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination): - (JSC::DFG::CSEPhase::getByOffsetLoadElimination): - (JSC::DFG::CSEPhase::putByOffsetStoreElimination): - (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGFixupPhase.cpp: - (JSC::DFG::FixupPhase::fixupNode): - * dfg/DFGGraph.cpp: - (JSC::DFG::Graph::dump): - * dfg/DFGGraph.h: - (JSC::DFG::Graph::byValIsPure): - (JSC::DFG::Graph::clobbersWorld): - * dfg/DFGNode.h: - (JSC::DFG::Node::hasArrayMode): - (Node): - (JSC::DFG::Node::arrayMode): - (JSC::DFG::Node::setArrayMode): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::typedArrayDescriptor): - (DFG): - (JSC::DFG::SpeculativeJIT::speculateArray): - (JSC::DFG::SpeculativeJIT::compileGetByValOnString): - (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): - (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): - (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): - (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray): - (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage): - (JSC::DFG::SpeculativeJIT::compileGetArrayLength): - * dfg/DFGSpeculativeJIT.h: - (SpeculativeJIT): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGStructureCheckHoistingPhase.cpp: - (JSC::DFG::StructureCheckHoistingPhase::run): - -2012-08-22 Geoffrey Garen - - ThreadRestrictionVerifier should be opt-in, not opt-out - https://bugs.webkit.org/show_bug.cgi?id=94761 - - Reviewed by Mark Hahnenberg. - - Removed explicit calls to disable the verifier, since it's off by default now. - - * parser/SourceProvider.h: - (JSC::SourceProvider::SourceProvider): - (SourceProvider): - * runtime/SymbolTable.h: - (JSC::SharedSymbolTable::SharedSymbolTable): - -2012-08-22 Mark Hahnenberg - - Separate MarkStackThreadSharedData from MarkStack - https://bugs.webkit.org/show_bug.cgi?id=94294 - - Reviewed by Filip Pizlo. - - MarkStackThreadSharedData is soon going to have data to allow for a parallel copying - mode too, so to separate our concerns we should split it out into its own set of files - and rename it to GCThreadSharedData. For now this is purely a cosmetic refactoring. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * heap/GCThreadSharedData.cpp: Added. - (JSC): - (JSC::GCThreadSharedData::resetChildren): - (JSC::GCThreadSharedData::childVisitCount): - (JSC::GCThreadSharedData::markingThreadMain): - (JSC::GCThreadSharedData::markingThreadStartFunc): - (JSC::GCThreadSharedData::GCThreadSharedData): - (JSC::GCThreadSharedData::~GCThreadSharedData): - (JSC::GCThreadSharedData::reset): - * heap/GCThreadSharedData.h: Added. - (JSC): - (GCThreadSharedData): - * heap/Heap.h: - (Heap): - * heap/ListableHandler.h: - (ListableHandler): - * heap/MarkStack.cpp: - (JSC::MarkStack::MarkStack): - (JSC::MarkStack::~MarkStack): - * heap/MarkStack.h: - (JSC): - (MarkStack): - (JSC::MarkStack::sharedData): - * heap/MarkStackInlineMethods.h: Added. - (JSC): - (JSC::MarkStack::append): - (JSC::MarkStack::appendUnbarrieredPointer): - (JSC::MarkStack::appendUnbarrieredValue): - (JSC::MarkStack::internalAppend): - (JSC::MarkStack::addWeakReferenceHarvester): - (JSC::MarkStack::addUnconditionalFinalizer): - (JSC::MarkStack::addOpaqueRoot): - (JSC::MarkStack::containsOpaqueRoot): - (JSC::MarkStack::opaqueRootCount): - * heap/SlotVisitor.h: - (JSC): - (SlotVisitor): - (JSC::SlotVisitor::SlotVisitor): - -2012-08-22 Gabor Ballabas - - Fix JSC build when DFG-JIT is disabled - https://bugs.webkit.org/show_bug.cgi?id=94694 - - Reviewed by Csaba Osztrogonác. - - Adding an appropriate guard for fixing the build. - - * bytecode/ResolveGlobalStatus.cpp: - (JSC): - -2012-08-21 Mark Lam - - Introducing the VMInspector for VM debugging use. - https://bugs.webkit.org/show_bug.cgi?id=94613. - - Reviewed by Filip Pizlo. - - Adding some utility functions for debugging the VM. This code is - presently #ifdef'd out by default. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * interpreter/CallFrame.h: - (ExecState): - * interpreter/VMInspector.cpp: Added. - (JSC): - (JSC::VMInspector::getTypeName): - (JSC::VMInspector::dumpFrame0): - (JSC::VMInspector::dumpFrame): - (JSC::VMInspector::countFrames): - * interpreter/VMInspector.h: Added. - (JSC): - (VMInspector): - -2012-08-21 Filip Pizlo - - A patchable GetById right after a watchpoint should have the appropriate nop padding - https://bugs.webkit.org/show_bug.cgi?id=94635 - - Reviewed by Mark Hahnenberg. - - * assembler/AbstractMacroAssembler.h: - (JSC::AbstractMacroAssembler::padBeforePatch): - (AbstractMacroAssembler): - * assembler/MacroAssemblerARMv7.h: - (JSC::MacroAssemblerARMv7::load32WithCompactAddressOffsetPatch): - (JSC::MacroAssemblerARMv7::moveWithPatch): - (JSC::MacroAssemblerARMv7::patchableJump): - * assembler/MacroAssemblerX86.h: - (JSC::MacroAssemblerX86::moveWithPatch): - (JSC::MacroAssemblerX86::branchPtrWithPatch): - (JSC::MacroAssemblerX86::storePtrWithPatch): - * assembler/MacroAssemblerX86Common.h: - (JSC::MacroAssemblerX86Common::load32WithAddressOffsetPatch): - (JSC::MacroAssemblerX86Common::load32WithCompactAddressOffsetPatch): - (JSC::MacroAssemblerX86Common::loadCompactWithAddressOffsetPatch): - (JSC::MacroAssemblerX86Common::store32WithAddressOffsetPatch): - * assembler/MacroAssemblerX86_64.h: - (JSC::MacroAssemblerX86_64::loadPtrWithAddressOffsetPatch): - (JSC::MacroAssemblerX86_64::loadPtrWithCompactAddressOffsetPatch): - (JSC::MacroAssemblerX86_64::storePtrWithAddressOffsetPatch): - (JSC::MacroAssemblerX86_64::moveWithPatch): - * jit/JumpReplacementWatchpoint.cpp: - (JSC::JumpReplacementWatchpoint::fireInternal): - -2012-08-20 Mark Lam - - Fix broken non-JIT build. - https://bugs.webkit.org/show_bug.cgi?id=94564. - - Reviewed by Filip Pizlo. - - Added some UNUSED_PARAM() macros to make the compiler happy. - - * runtime/Executable.cpp: - (JSC::EvalExecutable::compileInternal): - (JSC::ProgramExecutable::compileInternal): - (JSC::FunctionExecutable::compileForCallInternal): - (JSC::FunctionExecutable::compileForConstructInternal): - -2012-08-20 Mark Lam - - Fixed erroneous line number for LLint frame when throwing exceptions. - https://bugs.webkit.org/show_bug.cgi?id=94051. - - Reviewed by Filip Pizlo. - - For LLInt frames, before throwing an exception, adjust the PC from the - return PC back to the call PC if we are indeed at a call site. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::adjustPCIfAtCallSite): - (JSC): - (JSC::CodeBlock::bytecodeOffset): - * bytecode/CodeBlock.h: - (CodeBlock): - * llint/LLIntExceptions.cpp: - (JSC::LLInt::fixupPCforExceptionIfNeeded): - (LLInt): - (JSC::LLInt::interpreterThrowInCaller): - (JSC::LLInt::returnToThrow): - (JSC::LLInt::callToThrow): - -2012-08-20 Filip Pizlo - - fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html on 32-bit - https://bugs.webkit.org/show_bug.cgi?id=94538 - - Reviewed by Mark Hahnenberg. - - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality): - -2012-08-20 Filip Pizlo - - fast/js/dfg-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html crashes on 32-bit - https://bugs.webkit.org/show_bug.cgi?id=94026 - - Reviewed by Mark Hahnenberg. - - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality): - -2012-08-19 Filip Pizlo - - The relationship between abstract values and structure transition watchpoints should be rationalized - https://bugs.webkit.org/show_bug.cgi?id=94205 - - Reviewed by Geoffrey Garen. - - This patch does a number of things related to the handling of the abstract values - arrising from values with structures known to be watchpointable: - - - This rationalizes the relationship between the structure that we know an object - to have *right now* based on having executed a check against that structure, and - the structure that we know the object could have *in the future* based on a type - check executed in the past over a structure that was watchpointable. - - - We use the above to assert that structure transition watchpoints are being used - soundly. - - - We use the above to strength reduce CheckStructure into StructureTransitionWatchpoint - whenever possible. - - - This rationalizes the handling of CFA over constants that appeared in the bytecode. - If at compile-time the constant has a watchpointable structure, then we can prove - what structures it may have in the future. The analysis uses this to both assert - that structure transition watchpoints are being used correctly, and to find - opportunities for using them more aggressively. - - The net effect of all of these changes is that OSR entry should work more smoothly. - It may also be a slight win due to strength reductions, though most of those strength - reductions would have already been done by the parser and the structure check hoister. - - * GNUmakefile.list.am: - * JavaScriptCore.xcodeproj/project.pbxproj: - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::beginBasicBlock): - (JSC::DFG::AbstractState::execute): - * dfg/DFGAbstractValue.h: - (DFG): - (JSC::DFG::AbstractValue::clear): - (JSC::DFG::AbstractValue::isClear): - (JSC::DFG::AbstractValue::makeTop): - (JSC::DFG::AbstractValue::clobberStructures): - (JSC::DFG::AbstractValue::isTop): - (JSC::DFG::AbstractValue::setFuturePossibleStructure): - (AbstractValue): - (JSC::DFG::AbstractValue::filterFuturePossibleStructure): - (JSC::DFG::AbstractValue::setMostSpecific): - (JSC::DFG::AbstractValue::set): - (JSC::DFG::AbstractValue::operator==): - (JSC::DFG::AbstractValue::merge): - (JSC::DFG::AbstractValue::filter): - (JSC::DFG::AbstractValue::filterValueByType): - (JSC::DFG::AbstractValue::validateType): - (JSC::DFG::AbstractValue::validate): - (JSC::DFG::AbstractValue::checkConsistency): - (JSC::DFG::AbstractValue::dump): - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::checkStructureLoadElimination): - (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGConstantFoldingPhase.cpp: - (JSC::DFG::ConstantFoldingPhase::foldConstants): - * dfg/DFGNode.h: - (JSC::DFG::Node::convertToStructureTransitionWatchpoint): - (Node): - (JSC::DFG::Node::hasStructure): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGOSREntry.cpp: - (JSC::DFG::prepareOSREntry): - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward): - (JSC::DFG::SpeculativeJIT::forwardSpeculationWatchpoint): - (DFG): - (JSC::DFG::SpeculativeJIT::speculationWatchpointWithConditionalDirection): - (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck): - (JSC::DFG::SpeculativeJIT::speculateArray): - * dfg/DFGSpeculativeJIT.h: - (SpeculativeJIT): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGStructureAbstractValue.h: Added. - (DFG): - (StructureAbstractValue): - (JSC::DFG::StructureAbstractValue::StructureAbstractValue): - (JSC::DFG::StructureAbstractValue::clear): - (JSC::DFG::StructureAbstractValue::makeTop): - (JSC::DFG::StructureAbstractValue::top): - (JSC::DFG::StructureAbstractValue::add): - (JSC::DFG::StructureAbstractValue::addAll): - (JSC::DFG::StructureAbstractValue::contains): - (JSC::DFG::StructureAbstractValue::isSubsetOf): - (JSC::DFG::StructureAbstractValue::doesNotContainAnyOtherThan): - (JSC::DFG::StructureAbstractValue::isSupersetOf): - (JSC::DFG::StructureAbstractValue::filter): - (JSC::DFG::StructureAbstractValue::isClear): - (JSC::DFG::StructureAbstractValue::isTop): - (JSC::DFG::StructureAbstractValue::isClearOrTop): - (JSC::DFG::StructureAbstractValue::isNeitherClearNorTop): - (JSC::DFG::StructureAbstractValue::size): - (JSC::DFG::StructureAbstractValue::at): - (JSC::DFG::StructureAbstractValue::operator[]): - (JSC::DFG::StructureAbstractValue::last): - (JSC::DFG::StructureAbstractValue::speculationFromStructures): - (JSC::DFG::StructureAbstractValue::hasSingleton): - (JSC::DFG::StructureAbstractValue::singleton): - (JSC::DFG::StructureAbstractValue::operator==): - (JSC::DFG::StructureAbstractValue::dump): - (JSC::DFG::StructureAbstractValue::topValue): - * dfg/DFGStructureCheckHoistingPhase.cpp: - (JSC::DFG::StructureCheckHoistingPhase::run): - -2012-08-17 Filip Pizlo - - The current state of the call frame should be taken into account in the DFG for both predictions and proofs - https://bugs.webkit.org/show_bug.cgi?id=94412 - - Reviewed by Geoffrey Garen. - - This ensures that no matter how smart the DFG gets, it'll always know through - which entrypoint OSR will try to enter, and with which values it will attempt - to do so. For prologue OSR, this has no effect other than adding the current - arguments to the argument predictions. For loop OSR, this makes our treatment - of the loop slightly more conservative - just conservative enough to ensure - that OSR succeeds. - - * bytecode/CodeBlock.cpp: - (JSC::ProgramCodeBlock::compileOptimized): - (JSC::EvalCodeBlock::compileOptimized): - (JSC::FunctionCodeBlock::compileOptimized): - * bytecode/CodeBlock.h: - (CodeBlock): - (ProgramCodeBlock): - (EvalCodeBlock): - (FunctionCodeBlock): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::initialize): - * dfg/DFGAbstractValue.h: - (JSC::DFG::AbstractValue::setMostSpecific): - (AbstractValue): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::fixVariableAccessPredictions): - (JSC::DFG::ByteCodeParser::parse): - * dfg/DFGDriver.cpp: - (JSC::DFG::compile): - (JSC::DFG::tryCompile): - (JSC::DFG::tryCompileFunction): - * dfg/DFGDriver.h: - (DFG): - (JSC::DFG::tryCompile): - (JSC::DFG::tryCompileFunction): - * dfg/DFGGraph.h: - (JSC::DFG::Graph::Graph): - (Graph): - * jit/JITDriver.h: - (JSC::jitCompileIfAppropriate): - (JSC::jitCompileFunctionIfAppropriate): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * runtime/Executable.cpp: - (JSC::EvalExecutable::compileOptimized): - (JSC::EvalExecutable::compileInternal): - (JSC::ProgramExecutable::compileOptimized): - (JSC::ProgramExecutable::compileInternal): - (JSC::FunctionExecutable::compileOptimizedForCall): - (JSC::FunctionExecutable::compileOptimizedForConstruct): - (JSC::FunctionExecutable::compileForCallInternal): - (JSC::FunctionExecutable::compileForConstructInternal): - * runtime/Executable.h: - (EvalExecutable): - (ProgramExecutable): - (FunctionExecutable): - (JSC::FunctionExecutable::compileOptimizedFor): - * runtime/ExecutionHarness.h: - (JSC::prepareForExecution): - (JSC::prepareFunctionForExecution): - -2012-08-17 Filip Pizlo - - DFG CSE should be more honest about when it changed the IR - https://bugs.webkit.org/show_bug.cgi?id=94408 - - Reviewed by Geoffrey Garen. - - The CSE phase now always returns true if it changed the IR. - - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::setReplacement): - (JSC::DFG::CSEPhase::eliminate): - (JSC::DFG::CSEPhase::performNodeCSE): - -2012-08-17 Filip Pizlo - - DFG is still too pessimistic about what constitutes a side-effect on array accesses - https://bugs.webkit.org/show_bug.cgi?id=94309 - - Reviewed by Geoffrey Garen. - - This change means that even if structure transition watchpoints are not used for - hoisting of clobbered structure checks, we still retain good performance on the - benchmarks we care about. That's important, since butterflies will likely make - most array structures not watchpointable. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGStructureCheckHoistingPhase.cpp: - (JSC::DFG::StructureCheckHoistingPhase::run): - -2012-08-17 Milian Wolff - - [Qt] QNX build fails due to ctype usage in system headers - https://bugs.webkit.org/show_bug.cgi?id=93849 - - Reviewed by Simon Hausmann. - - Move the check for whether DisallowCType should be active or not - to the DisallowCType.h header. This way, we can update the list - of platforms or OSes which do not work with this header in a - central place. All users can now safely include the header - and do not need to place custom guards around it. - - * config.h: - -2012-08-16 Simon Hausmann - - [Qt] Replace use of internal Weak smart pointer with JSWeakObjectMap - https://bugs.webkit.org/show_bug.cgi?id=93872 - - Reviewed by Kenneth Rohde Christiansen. - - * Target.pri: Add missing JSWeakObjectMap file to build. - -2012-08-16 Filip Pizlo - - Structure check hoisting should be less expensive - https://bugs.webkit.org/show_bug.cgi?id=94201 - - Reviewed by Mark Hahnenberg. - - This appears like a broad win on short-running programs. - - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGDriver.cpp: - (JSC::DFG::compile): - * dfg/DFGGraph.h: - (JSC::DFG::Graph::compareAndSwap): - (Graph): - (JSC::DFG::Graph::substitute): - (JSC::DFG::Graph::substituteGetLocal): - * dfg/DFGStructureCheckHoistingPhase.cpp: - (JSC::DFG::StructureCheckHoistingPhase::run): - -2012-08-16 Filip Pizlo - - All op_resolve_global instructions should end up in the list of global resolve instructions - https://bugs.webkit.org/show_bug.cgi?id=94247 - - - Reviewed by Mark Hahnenberg. - - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::emitResolveWithBase): - -2012-08-15 Bruno de Oliveira Abinader - - [css3-text] Add CSS3 Text decoration compile flag - https://bugs.webkit.org/show_bug.cgi?id=93863 - - Reviewed by Julien Chaffraix. - - This patch handles the compile flag implementation, which will come disabled by - default, thus not exposing the CSS3 text decoration features to the web, unless - when explicitly enabling it with "--css3-text-decoration" build parameter. - - * Configurations/FeatureDefines.xcconfig: - -2012-08-15 Sheriff Bot - - Unreviewed, rolling out r125687. - http://trac.webkit.org/changeset/125687 - https://bugs.webkit.org/show_bug.cgi?id=94147 - - It broke the whole world (Requested by Ossy_night on #webkit). - - * API/JSValueRef.cpp: - (JSValueToBoolean): - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - * bytecode/Watchpoint.h: - (WatchpointSet): - * debugger/DebuggerCallFrame.h: - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGCFGSimplificationPhase.cpp: - (JSC::DFG::CFGSimplificationPhase::run): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull): - (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull): - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull): - (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull): - (JSC::DFG::SpeculativeJIT::compile): - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_is_undefined): - (JSC::JIT::emit_op_jeq_null): - (JSC::JIT::emit_op_jneq_null): - (JSC::JIT::emit_op_eq_null): - (JSC::JIT::emit_op_neq_null): - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::emit_op_is_undefined): - (JSC::JIT::emit_op_jeq_null): - (JSC::JIT::emit_op_jneq_null): - (JSC::JIT::emit_op_eq_null): - (JSC::JIT::emit_op_neq_null): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - * runtime/ArrayPrototype.cpp: - (JSC::arrayProtoFuncFilter): - (JSC::arrayProtoFuncEvery): - (JSC::arrayProtoFuncSome): - * runtime/BooleanConstructor.cpp: - (JSC::constructBoolean): - (JSC::callBooleanConstructor): - * runtime/JSCell.h: - (JSCell): - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::JSGlobalObject): - * runtime/JSGlobalObject.h: - (JSGlobalObject): - * runtime/JSString.h: - (JSC::JSCell::toBoolean): - (JSC::JSValue::toBoolean): - * runtime/JSValue.h: - * runtime/ObjectConstructor.cpp: - (JSC::toPropertyDescriptor): - * runtime/Operations.cpp: - (JSC::jsTypeStringForValue): - (JSC::jsIsObjectType): - * runtime/Operations.h: - (JSC): - (JSC::JSValue::equalSlowCaseInline): - * runtime/RegExpConstructor.cpp: - (JSC::setRegExpConstructorMultiline): - * runtime/RegExpPrototype.cpp: - (JSC::regExpProtoFuncToString): - * runtime/Structure.h: - -2012-08-15 Gabor Ballabas - - Buildfix after r125541 - https://bugs.webkit.org/show_bug.cgi?id=94097 - - Reviewed by Filip Pizlo. - - r125541 has broken the traditional ARM port build of JSC. - - * assembler/MacroAssemblerARM.h: - (JSC::MacroAssemblerARM::neg32): - (JSC::MacroAssemblerARM::xor32): - -2012-08-14 Mark Hahnenberg - - Change behavior of MasqueradesAsUndefined to better accommodate DFG changes - https://bugs.webkit.org/show_bug.cgi?id=93884 - - Reviewed by Geoffrey Garen. - - With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of - MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines, - we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined - objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject). - For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not - masquerade as undefined within frame B, but it will continue to masquerade in frame A. - - There are two primary changes that are taking place here. One is to thread the ExecState* through - JSValue::toBoolean and JSCell::toBoolean so that JSCell::toBoolean can check the object's - JSGlobalObject to compare it to the lexical JSGlobalObject of the currently running code. If the two - are distinct, then the object cannot MasqueradeAsUndefined. - - The other change is to perform this comparison of JSGlobalObjects everywhere where the MasqueradesAsUndefined - flag in the Structure is checked. For C++ code, this check has been factored into its own function in - Structure::masqueradesAsUndefined. We only perform this check in the DFG if the current JSGlobalObject has - had a MasqueradesAsUndefined object allocated within its context. This conditional compilation is managed - through the use of a WatchpointSet in each JSGlobalObject and alternate create() functions for JS DOM wrappers - that are MasqueradesAsUndefined. - - * API/JSValueRef.cpp: - (JSValueToBoolean): - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - * bytecode/Watchpoint.h: - (WatchpointSet): - * debugger/DebuggerCallFrame.h: - (JSC::DebuggerCallFrame::callFrame): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGCFGSimplificationPhase.cpp: - (JSC::DFG::CFGSimplificationPhase::run): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull): - (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull): - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull): - (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull): - (JSC::DFG::SpeculativeJIT::compile): - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_is_undefined): - (JSC::JIT::emit_op_jeq_null): - (JSC::JIT::emit_op_jneq_null): - (JSC::JIT::emit_op_eq_null): - (JSC::JIT::emit_op_neq_null): - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::emit_op_is_undefined): - (JSC::JIT::emit_op_jeq_null): - (JSC::JIT::emit_op_jneq_null): - (JSC::JIT::emit_op_eq_null): - (JSC::JIT::emit_op_neq_null): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - * runtime/ArrayPrototype.cpp: - (JSC::arrayProtoFuncFilter): - (JSC::arrayProtoFuncEvery): - (JSC::arrayProtoFuncSome): - * runtime/BooleanConstructor.cpp: - (JSC::constructBoolean): - (JSC::callBooleanConstructor): - * runtime/JSCell.h: - (JSCell): - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::JSGlobalObject): - * runtime/JSGlobalObject.h: - (JSGlobalObject): - (JSC::JSGlobalObject::masqueradesAsUndefinedWatchpoint): - * runtime/JSString.h: - (JSC::JSCell::toBoolean): - (JSC::JSValue::toBoolean): - * runtime/JSValue.h: - * runtime/ObjectConstructor.cpp: - (JSC::toPropertyDescriptor): - * runtime/Operations.cpp: - (JSC::jsTypeStringForValue): - (JSC::jsIsObjectType): - * runtime/Operations.h: - (JSC): - (JSC::JSValue::equalSlowCaseInline): - * runtime/RegExpConstructor.cpp: - (JSC::setRegExpConstructorMultiline): - * runtime/RegExpPrototype.cpp: - (JSC::regExpProtoFuncToString): - * runtime/Structure.h: - (Structure): - (JSC::Structure::globalObjectOffset): - (JSC::Structure::masqueradesAsUndefined): - (JSC): - -2012-08-14 Filip Pizlo - - Unreviewed, build fix for !ENABLE(DFG_JIT) - - * jit/JITPropertyAccess.cpp: - (JSC::JIT::emit_op_get_by_val): - (JSC::JIT::emit_op_put_by_val): - (JSC::JIT::privateCompilePatchGetArrayLength): - * jit/JITPropertyAccess32_64.cpp: - (JSC::JIT::emit_op_get_by_val): - (JSC::JIT::emit_op_put_by_val): - (JSC::JIT::privateCompilePatchGetArrayLength): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - -2012-08-13 Filip Pizlo - - Array checks should use the structure, not the class info - https://bugs.webkit.org/show_bug.cgi?id=93150 - - Reviewed by Mark Hahnenberg. - - This changes all array checks used in array accesses (get, put, get length, - push, pop) to use the structure, not the class info. Additionally, these - checks in the LLInt and baseline JIT record the structure in an ArrayProfile, - so that the DFG can know exactly what structure to check for. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * bytecode/ArrayProfile.cpp: Added. - (JSC): - (JSC::ArrayProfile::computeUpdatedPrediction): - * bytecode/ArrayProfile.h: Added. - (JSC): - (JSC::arrayModeFromStructure): - (ArrayProfile): - (JSC::ArrayProfile::ArrayProfile): - (JSC::ArrayProfile::bytecodeOffset): - (JSC::ArrayProfile::addressOfLastSeenStructure): - (JSC::ArrayProfile::observeStructure): - (JSC::ArrayProfile::expectedStructure): - (JSC::ArrayProfile::structureIsPolymorphic): - (JSC::ArrayProfile::hasDefiniteStructure): - (JSC::ArrayProfile::observedArrayModes): - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - (JSC::CodeBlock::getArrayProfile): - (JSC): - (JSC::CodeBlock::getOrAddArrayProfile): - (JSC::CodeBlock::updateAllPredictionsAndCountLiveness): - * bytecode/CodeBlock.h: - (JSC::CodeBlock::executionEntryCount): - (JSC::CodeBlock::numberOfArrayProfiles): - (JSC::CodeBlock::arrayProfiles): - (JSC::CodeBlock::addArrayProfile): - (CodeBlock): - * bytecode/Instruction.h: - (JSC): - (JSC::Instruction::Instruction): - * bytecode/Opcode.h: - (JSC): - (JSC::padOpcodeName): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::emitGetArgumentByVal): - (JSC::BytecodeGenerator::emitGetByVal): - (JSC::BytecodeGenerator::emitPutByVal): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::initialize): - (JSC::DFG::AbstractState::execute): - * dfg/DFGAbstractValue.h: - (JSC::DFG::StructureAbstractValue::hasSingleton): - (StructureAbstractValue): - (JSC::DFG::StructureAbstractValue::singleton): - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGFixupPhase.cpp: - (JSC::DFG::FixupPhase::fixupNode): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::speculateArray): - (DFG): - (JSC::DFG::SpeculativeJIT::compile): - (JSC::DFG::SpeculativeJIT::checkArgumentTypes): - (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage): - * dfg/DFGSpeculativeJIT.h: - (SpeculativeJIT): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGStructureCheckHoistingPhase.cpp: - (JSC::DFG::StructureCheckHoistingPhase::run): - * jit/JITPropertyAccess.cpp: - (JSC::JIT::emit_op_get_by_val): - (JSC::JIT::emit_op_put_by_val): - (JSC::JIT::privateCompilePatchGetArrayLength): - * jit/JITPropertyAccess32_64.cpp: - (JSC::JIT::emit_op_get_by_val): - (JSC::JIT::emit_op_put_by_val): - (JSC::JIT::privateCompilePatchGetArrayLength): - * llint/LLIntOffsetsExtractor.cpp: - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - * runtime/Structure.h: - (Structure): - (JSC::Structure::classInfoOffset): - -2012-08-14 Gabor Ballabas - - Rename functions in the ARM port of DFG-JIT for better code readability. - https://bugs.webkit.org/show_bug.cgi?id=93609 - - Reviewed by Zoltan Herczeg. - - Rename functions in the ARM port of DFG-JIT for better code - readability, and for following the WebKit coding style - wherever it is possible. - - * assembler/ARMAssembler.cpp: - (JSC::ARMAssembler::genInt): - (JSC::ARMAssembler::getImm): - (JSC::ARMAssembler::moveImm): - (JSC::ARMAssembler::encodeComplexImm): - (JSC::ARMAssembler::dataTransfer32): - (JSC::ARMAssembler::baseIndexTransfer32): - (JSC::ARMAssembler::dataTransfer16): - (JSC::ARMAssembler::baseIndexTransfer16): - (JSC::ARMAssembler::dataTransferFloat): - (JSC::ARMAssembler::baseIndexTransferFloat): - * assembler/ARMAssembler.h: - (JSC::ARMAssembler::bitAnd): - (JSC::ARMAssembler::bitAnds): - (JSC::ARMAssembler::eor): - (JSC::ARMAssembler::eors): - (JSC::ARMAssembler::sub): - (JSC::ARMAssembler::subs): - (JSC::ARMAssembler::rsb): - (JSC::ARMAssembler::rsbs): - (JSC::ARMAssembler::add): - (JSC::ARMAssembler::adds): - (JSC::ARMAssembler::adc): - (JSC::ARMAssembler::adcs): - (JSC::ARMAssembler::sbc): - (JSC::ARMAssembler::sbcs): - (JSC::ARMAssembler::rsc): - (JSC::ARMAssembler::rscs): - (JSC::ARMAssembler::tst): - (JSC::ARMAssembler::teq): - (JSC::ARMAssembler::cmp): - (JSC::ARMAssembler::cmn): - (JSC::ARMAssembler::orr): - (JSC::ARMAssembler::orrs): - (JSC::ARMAssembler::mov): - (JSC::ARMAssembler::movw): - (JSC::ARMAssembler::movt): - (JSC::ARMAssembler::movs): - (JSC::ARMAssembler::bic): - (JSC::ARMAssembler::bics): - (JSC::ARMAssembler::mvn): - (JSC::ARMAssembler::mvns): - (JSC::ARMAssembler::mul): - (JSC::ARMAssembler::muls): - (JSC::ARMAssembler::mull): - (JSC::ARMAssembler::vmov_f64): - (JSC::ARMAssembler::vadd_f64): - (JSC::ARMAssembler::vdiv_f64): - (JSC::ARMAssembler::vsub_f64): - (JSC::ARMAssembler::vmul_f64): - (JSC::ARMAssembler::vcmp_f64): - (JSC::ARMAssembler::vsqrt_f64): - (JSC::ARMAssembler::vabs_f64): - (JSC::ARMAssembler::vneg_f64): - (JSC::ARMAssembler::ldrImmediate): - (JSC::ARMAssembler::ldrUniqueImmediate): - (JSC::ARMAssembler::dtrUp): - (JSC::ARMAssembler::dtrUpRegister): - (JSC::ARMAssembler::dtrDown): - (JSC::ARMAssembler::dtrDownRegister): - (JSC::ARMAssembler::halfDtrUp): - (JSC::ARMAssembler::halfDtrUpRegister): - (JSC::ARMAssembler::halfDtrDown): - (JSC::ARMAssembler::halfDtrDownRegister): - (JSC::ARMAssembler::doubleDtrUp): - (JSC::ARMAssembler::doubleDtrDown): - (JSC::ARMAssembler::push): - (JSC::ARMAssembler::pop): - (JSC::ARMAssembler::poke): - (JSC::ARMAssembler::peek): - (JSC::ARMAssembler::vmov_vfp64): - (JSC::ARMAssembler::vmov_arm64): - (JSC::ARMAssembler::vmov_vfp32): - (JSC::ARMAssembler::vmov_arm32): - (JSC::ARMAssembler::vcvt_f64_s32): - (JSC::ARMAssembler::vcvt_s32_f64): - (JSC::ARMAssembler::vcvt_u32_f64): - (JSC::ARMAssembler::vcvt_f64_f32): - (JSC::ARMAssembler::vcvt_f32_f64): - (JSC::ARMAssembler::clz): - (JSC::ARMAssembler::lslRegister): - (JSC::ARMAssembler::lsrRegister): - (JSC::ARMAssembler::asrRegister): - (JSC::ARMAssembler::align): - (JSC::ARMAssembler::loadBranchTarget): - (JSC::ARMAssembler::vmov): - * assembler/MacroAssemblerARM.cpp: - (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords): - * assembler/MacroAssemblerARM.h: - (JSC::MacroAssemblerARM::add32): - (JSC::MacroAssemblerARM::and32): - (JSC::MacroAssemblerARM::lshift32): - (JSC::MacroAssemblerARM::mul32): - (JSC::MacroAssemblerARM::or32): - (JSC::MacroAssemblerARM::rshift32): - (JSC::MacroAssemblerARM::urshift32): - (JSC::MacroAssemblerARM::sub32): - (JSC::MacroAssemblerARM::xor32): - (JSC::MacroAssemblerARM::countLeadingZeros32): - (JSC::MacroAssemblerARM::convertibleLoadPtr): - (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch): - (JSC::MacroAssemblerARM::load32WithCompactAddressOffsetPatch): - (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch): - (JSC::MacroAssemblerARM::store32): - (JSC::MacroAssemblerARM::pop): - (JSC::MacroAssemblerARM::push): - (JSC::MacroAssemblerARM::move): - (JSC::MacroAssemblerARM::swap): - (JSC::MacroAssemblerARM::branch32): - (JSC::MacroAssemblerARM::branchTest32): - (JSC::MacroAssemblerARM::mull32): - (JSC::MacroAssemblerARM::branchSub32): - (JSC::MacroAssemblerARM::compare32): - (JSC::MacroAssemblerARM::test32): - (JSC::MacroAssemblerARM::load32): - (JSC::MacroAssemblerARM::relativeTableJump): - (JSC::MacroAssemblerARM::moveWithPatch): - (JSC::MacroAssemblerARM::loadDouble): - (JSC::MacroAssemblerARM::moveDouble): - (JSC::MacroAssemblerARM::addDouble): - (JSC::MacroAssemblerARM::divDouble): - (JSC::MacroAssemblerARM::subDouble): - (JSC::MacroAssemblerARM::mulDouble): - (JSC::MacroAssemblerARM::sqrtDouble): - (JSC::MacroAssemblerARM::absDouble): - (JSC::MacroAssemblerARM::negateDouble): - (JSC::MacroAssemblerARM::convertInt32ToDouble): - (JSC::MacroAssemblerARM::convertFloatToDouble): - (JSC::MacroAssemblerARM::convertDoubleToFloat): - (JSC::MacroAssemblerARM::branchDouble): - (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32): - (JSC::MacroAssemblerARM::branchTruncateDoubleToUint32): - (JSC::MacroAssemblerARM::truncateDoubleToInt32): - (JSC::MacroAssemblerARM::truncateDoubleToUint32): - (JSC::MacroAssemblerARM::branchConvertDoubleToInt32): - (JSC::MacroAssemblerARM::branchDoubleNonZero): - (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN): - -2012-08-13 Simon Hausmann - - Unreviewed, rolling out r125444. - http://trac.webkit.org/changeset/125444 - https://bugs.webkit.org/show_bug.cgi?id=93872 - - Broke some tests - - * Target.pri: - -2012-08-13 Simon Hausmann - - [Qt] Replace use of internal Weak smart pointer with JSWeakObjectMap - https://bugs.webkit.org/show_bug.cgi?id=93872 - - Reviewed by Kenneth Rohde Christiansen. - - * Target.pri: Add missing JSWeakObjectMap file to build. - -2012-08-13 Raphael Kubo da Costa - - [CMake] Remove glib-related Find modules and write single new one instead. - https://bugs.webkit.org/show_bug.cgi?id=93786 - - Reviewed by Rob Buis. - - * shell/PlatformEfl.cmake: Use GLIB_* instead of Glib_*. - -2012-08-12 Allan Sandfeld Jensen - - Doesn't build with ENABLE_JIT=0 - https://bugs.webkit.org/show_bug.cgi?id=85042 - - Reviewed by Eric Seidel. - - Include headers without which CallFrame.h does not build, and - fix gcc warning about comparing unsigned int with 0. - - * dfg/DFGDriver.cpp: - * interpreter/Interpreter.cpp: - (JSC::Interpreter::isOpcode): - -2012-08-10 Yong Li - - [BlackBerry] GCActivityCallback should always schedule GC even allocated bytes is a small number - https://bugs.webkit.org/show_bug.cgi?id=93650 - - Reviewed by Rob Buis. - - Even a small number of allocated JS objects could hold expensive resources. - - * runtime/GCActivityCallbackBlackBerry.cpp: - (JSC::DefaultGCActivityCallback::didAllocate): - -2012-08-09 Yong Li - - [QNX] Implement getCPUTime() for OS(QNX) - https://bugs.webkit.org/show_bug.cgi?id=93516 - - Reviewed by George Staikos. - - Implement getCPUTime() with CLOCK_THREAD_CPUTIME_ID so it will tell - exactly how long the current thread has spent without being impacted - by other things. - - * runtime/TimeoutChecker.cpp: - (JSC::getCPUTime): - -2012-08-08 Shane Stephens - - Compile flag for CSS Hierarchies - https://bugs.webkit.org/show_bug.cgi?id=92433 - - Reviewed by Tony Chang. - - * Configurations/FeatureDefines.xcconfig: - -2012-08-08 Benjamin Poulain - - Use char* instead of LChar* for the public interface of String construction from literals - https://bugs.webkit.org/show_bug.cgi?id=93402 - - Reviewed by Michael Saboff. - - Update JSC' Identifier to use StringImpl::createFromLiteral with a char*. - - * runtime/Identifier.cpp: - (JSC::IdentifierASCIIStringTranslator::translate): - -2012-08-08 Patrick Gansterer - - Remove ce_time.(cpp|h) from list of source files - https://bugs.webkit.org/show_bug.cgi?id=93446 - - Reviewed by Simon Hausmann. - - r125004 removed the last dependency on functions defined in ce_time.cpp. - - * Target.pri: - -2012-08-08 Patrick Gansterer - - [WIN] Use GetTimeZoneInformation() for getting the timezone name - https://bugs.webkit.org/show_bug.cgi?id=91936 - - Reviewed by Ryosuke Niwa. - - The MS CRT implementation of strftime calls the same functions in the background. - Using them directly avoids the overhead of parsing the format string and removes - the dependency on strftime() for WinCE where this function does not exist. - - * runtime/DateConversion.cpp: - (JSC::formatTime): - -2012-08-07 Gabor Ballabas - - Refactor magic numbers in the ARM port of DFG-JIT - https://bugs.webkit.org/show_bug.cgi?id=93348 - - Reviewed by Eric Seidel. - - Introduce new names for hard-coded magic numbers. - Refactor constant with confusing names to more descriptive ones. - - * assembler/ARMAssembler.cpp: - (JSC::ARMAssembler::patchConstantPoolLoad): - (JSC::ARMAssembler::getOp2): - (JSC::ARMAssembler::genInt): - (JSC::ARMAssembler::getImm): - (JSC::ARMAssembler::moveImm): - (JSC::ARMAssembler::encodeComplexImm): - (JSC::ARMAssembler::dataTransfer32): - (JSC::ARMAssembler::dataTransfer16): - (JSC::ARMAssembler::dataTransferFloat): - (JSC::ARMAssembler::executableCopy): - * assembler/ARMAssembler.h: - (JSC::ARMAssembler::emitInstruction): - (JSC::ARMAssembler::ands_r): - (JSC::ARMAssembler::eors_r): - (JSC::ARMAssembler::subs_r): - (JSC::ARMAssembler::rsbs_r): - (JSC::ARMAssembler::adds_r): - (JSC::ARMAssembler::adcs_r): - (JSC::ARMAssembler::sbcs_r): - (JSC::ARMAssembler::rscs_r): - (JSC::ARMAssembler::tst_r): - (JSC::ARMAssembler::teq_r): - (JSC::ARMAssembler::cmp_r): - (JSC::ARMAssembler::cmn_r): - (JSC::ARMAssembler::orrs_r): - (JSC::ARMAssembler::movs_r): - (JSC::ARMAssembler::bics_r): - (JSC::ARMAssembler::mvns_r): - (JSC::ARMAssembler::muls_r): - (JSC::ARMAssembler::ldr_imm): - (JSC::ARMAssembler::ldr_un_imm): - (JSC::ARMAssembler::dtr_u): - (JSC::ARMAssembler::dtr_ur): - (JSC::ARMAssembler::dtr_dr): - (JSC::ARMAssembler::dtrh_u): - (JSC::ARMAssembler::dtrh_ur): - (JSC::ARMAssembler::fdtr_u): - (JSC::ARMAssembler::push_r): - (JSC::ARMAssembler::pop_r): - (JSC::ARMAssembler::getLdrImmAddress): - (JSC::ARMAssembler::getLdrImmAddressOnPool): - (JSC::ARMAssembler::patchConstantPoolLoad): - (JSC::ARMAssembler::repatchCompact): - (JSC::ARMAssembler::replaceWithJump): - (JSC::ARMAssembler::replaceWithLoad): - (JSC::ARMAssembler::replaceWithAddressComputation): - (JSC::ARMAssembler::getOp2Byte): - (JSC::ARMAssembler::getOp2Half): - (JSC::ARMAssembler::getImm16Op2): - (JSC::ARMAssembler::placeConstantPoolBarrier): - (JSC::ARMAssembler::getConditionalField): - * assembler/MacroAssemblerARM.cpp: - (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords): - * assembler/MacroAssemblerARM.h: - (JSC::MacroAssemblerARM::and32): - (JSC::MacroAssemblerARM::branch32): - (JSC::MacroAssemblerARM::branchTest32): - (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32): - -2012-08-07 Benjamin Poulain - - Use the initialization from literal for JSC's Identifiers - https://bugs.webkit.org/show_bug.cgi?id=93193 - - Reviewed by Geoffrey Garen. - - This patches modify Identifier ot take advantage of the new initialization from literal. - - In addition to the memory savings (~600bytes per instance), this gives us a 2% speed - improvement on CommonIdentifiers on average. - - * runtime/CommonIdentifiers.cpp: - (JSC::CommonIdentifiers::CommonIdentifiers): - Null and empty strings are forbidden for literal initialization. Use the most efficient constructors - instead of a literal. - - * runtime/Identifier.cpp: - (IdentifierASCIIStringTranslator): - Rename IdentifierCStringTranslator to IdentifierASCIIStringTranslator to make the text encoding - explicit. - (JSC::IdentifierASCIIStringTranslator::hash): - (JSC::IdentifierASCIIStringTranslator::equal): - (JSC::IdentifierASCIIStringTranslator::translate): Use the fast initialization from literal. - (JSC::Identifier::add): - * runtime/Identifier.h: - (JSC::Identifier::Identifier): - -2012-08-07 Simon Hausmann - - [Qt][Win] Remove pthreads linkage - - Reviewed by Csaba Osztrogonác. - - After r124823 linkage to pthreads is not needed anymore for the Windows - build. - - * JavaScriptCore.pri: - -2012-08-07 Gabor Ballabas - - Refactor emit*Inst functions and introduce toARMWord functions in DFG-JIT's traditional ARM port - https://bugs.webkit.org/show_bug.cgi?id=93266 - - Reviewed by Csaba Osztrogonác. - - First part of a bigger refactoring issue trying to make traditional - ARM DFG-JIT port easier to read and understand. - - - * assembler/ARMAssembler.h: - (JSC::ARMAssembler::emitInstruction): - (JSC::ARMAssembler::emitDoublePrecisionInstruction): - (JSC::ARMAssembler::emitSinglePrecisionInstruction): - (JSC::ARMAssembler::and_r): - (JSC::ARMAssembler::ands_r): - (JSC::ARMAssembler::eor_r): - (JSC::ARMAssembler::eors_r): - (JSC::ARMAssembler::sub_r): - (JSC::ARMAssembler::subs_r): - (JSC::ARMAssembler::rsb_r): - (JSC::ARMAssembler::rsbs_r): - (JSC::ARMAssembler::add_r): - (JSC::ARMAssembler::adds_r): - (JSC::ARMAssembler::adc_r): - (JSC::ARMAssembler::adcs_r): - (JSC::ARMAssembler::sbc_r): - (JSC::ARMAssembler::sbcs_r): - (JSC::ARMAssembler::rsc_r): - (JSC::ARMAssembler::rscs_r): - (JSC::ARMAssembler::tst_r): - (JSC::ARMAssembler::teq_r): - (JSC::ARMAssembler::cmp_r): - (JSC::ARMAssembler::cmn_r): - (JSC::ARMAssembler::orr_r): - (JSC::ARMAssembler::orrs_r): - (JSC::ARMAssembler::mov_r): - (JSC::ARMAssembler::movw_r): - (JSC::ARMAssembler::movt_r): - (JSC::ARMAssembler::movs_r): - (JSC::ARMAssembler::bic_r): - (JSC::ARMAssembler::bics_r): - (JSC::ARMAssembler::mvn_r): - (JSC::ARMAssembler::mvns_r): - (JSC::ARMAssembler::mul_r): - (JSC::ARMAssembler::muls_r): - (JSC::ARMAssembler::mull_r): - (JSC::ARMAssembler::vmov_f64_r): - (JSC::ARMAssembler::vadd_f64_r): - (JSC::ARMAssembler::vdiv_f64_r): - (JSC::ARMAssembler::vsub_f64_r): - (JSC::ARMAssembler::vmul_f64_r): - (JSC::ARMAssembler::vcmp_f64_r): - (JSC::ARMAssembler::vsqrt_f64_r): - (JSC::ARMAssembler::vabs_f64_r): - (JSC::ARMAssembler::vneg_f64_r): - (JSC::ARMAssembler::ldr_imm): - (JSC::ARMAssembler::ldr_un_imm): - (JSC::ARMAssembler::dtr_u): - (JSC::ARMAssembler::dtr_ur): - (JSC::ARMAssembler::dtr_d): - (JSC::ARMAssembler::dtr_dr): - (JSC::ARMAssembler::dtrh_u): - (JSC::ARMAssembler::dtrh_ur): - (JSC::ARMAssembler::dtrh_d): - (JSC::ARMAssembler::dtrh_dr): - (JSC::ARMAssembler::fdtr_u): - (JSC::ARMAssembler::fdtr_d): - (JSC::ARMAssembler::push_r): - (JSC::ARMAssembler::pop_r): - (JSC::ARMAssembler::vmov_vfp64_r): - (JSC::ARMAssembler::vmov_arm64_r): - (JSC::ARMAssembler::vmov_vfp32_r): - (JSC::ARMAssembler::vmov_arm32_r): - (JSC::ARMAssembler::vcvt_f64_s32_r): - (JSC::ARMAssembler::vcvt_s32_f64_r): - (JSC::ARMAssembler::vcvt_u32_f64_r): - (JSC::ARMAssembler::vcvt_f64_f32_r): - (JSC::ARMAssembler::vcvt_f32_f64_r): - (JSC::ARMAssembler::vmrs_apsr): - (JSC::ARMAssembler::clz_r): - (JSC::ARMAssembler::bx): - (JSC::ARMAssembler::blx): - (JSC::ARMAssembler::linkJump): - (JSC::ARMAssembler::toARMWord): - (ARMAssembler): - -2012-08-06 Patrick Gansterer - - [WIN] Remove dependency on pthread from MachineStackMarker - https://bugs.webkit.org/show_bug.cgi?id=68429 - - Reviewed by Geoffrey Garen. - - Windows has no support for calling a destructor for thread specific data. - Since we need more control over creating and deleting thread specific keys - we can not simply extend WTF::ThreadSpecific with this functionality. - - All thread specific keys created via the new API get stored in a list. - After a thread function finished we iterate over this list and call - the registered destructor for every item if needed. - - * heap/MachineStackMarker.cpp: Use the new functions instead of pthread directly. - (JSC::MachineThreads::~MachineThreads): - (JSC::MachineThreads::makeUsableFromMultipleThreads): - (JSC::MachineThreads::addCurrentThread): - * heap/MachineStackMarker.h: - (MachineThreads): - -2012-08-06 Patrick Gansterer - - Unify JSC date and time formating functions - https://bugs.webkit.org/show_bug.cgi?id=92282 - - Reviewed by Geoffrey Garen. - - Replace the existing functions for formating GregorianDateTime - with one single function. This removes some code duplications - in DatePrototype and is a preperation to fix encoding issues, - since we can add UChar* values to the resulting string now. - - * runtime/DateConstructor.cpp: - (JSC::callDate): - * runtime/DateConversion.cpp: - (JSC::formatDateTime): - * runtime/DateConversion.h: - (JSC): - * runtime/DatePrototype.cpp: - (JSC::formateDateInstance): - (JSC::dateProtoFuncToString): - (JSC::dateProtoFuncToUTCString): - (JSC::dateProtoFuncToDateString): - (JSC::dateProtoFuncToTimeString): - (JSC::dateProtoFuncToGMTString): - -2012-08-06 Carlos Garcia Campos - - Unreviewed. Fix make distcheck. - - * GNUmakefile.list.am: Add missing header file. - -2012-08-05 Peter Wang - - Web Inspector: [JSC] implement setting breakpoints by line:column - https://bugs.webkit.org/show_bug.cgi?id=53003 - - Reviewed by Geoffrey Garen. - - Add a counter to Lexer to record the column info of each Token. Add a column parameter to - op_debug, cti_op_debug, and _llint_op_debug byte-code command. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - * bytecode/Opcode.h: - (JSC): - (JSC::padOpcodeName): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::resolve): - (JSC::BytecodeGenerator::emitDebugHook): - * bytecompiler/BytecodeGenerator.h: - (BytecodeGenerator): - * bytecompiler/NodesCodegen.cpp: - (JSC::ArrayNode::toArgumentList): - (JSC::ApplyFunctionCallDotNode::emitBytecode): - (JSC::ConstStatementNode::emitBytecode): - (JSC::EmptyStatementNode::emitBytecode): - (JSC::DebuggerStatementNode::emitBytecode): - (JSC::ExprStatementNode::emitBytecode): - (JSC::VarStatementNode::emitBytecode): - (JSC::IfNode::emitBytecode): - (JSC::IfElseNode::emitBytecode): - (JSC::DoWhileNode::emitBytecode): - (JSC::WhileNode::emitBytecode): - (JSC::ForNode::emitBytecode): - (JSC::ForInNode::emitBytecode): - (JSC::ContinueNode::emitBytecode): - (JSC::BreakNode::emitBytecode): - (JSC::ReturnNode::emitBytecode): - (JSC::WithNode::emitBytecode): - (JSC::SwitchNode::emitBytecode): - (JSC::LabelNode::emitBytecode): - (JSC::ThrowNode::emitBytecode): - (JSC::TryNode::emitBytecode): - (JSC::ProgramNode::emitBytecode): - (JSC::EvalNode::emitBytecode): - (JSC::FunctionBodyNode::emitBytecode): - * debugger/Debugger.h: - * interpreter/Interpreter.cpp: - (JSC::Interpreter::unwindCallFrame): - (JSC::Interpreter::throwException): - (JSC::Interpreter::debug): - (JSC::Interpreter::privateExecute): - * interpreter/Interpreter.h: - (Interpreter): - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_debug): - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::emit_op_debug): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * llint/LowLevelInterpreter.asm: - * parser/ASTBuilder.h: - (ASTBuilder): - (JSC::ASTBuilder::createCommaExpr): - (JSC::ASTBuilder::createLogicalNot): - (JSC::ASTBuilder::createUnaryPlus): - (JSC::ASTBuilder::createVoid): - (JSC::ASTBuilder::thisExpr): - (JSC::ASTBuilder::createResolve): - (JSC::ASTBuilder::createObjectLiteral): - (JSC::ASTBuilder::createArray): - (JSC::ASTBuilder::createNumberExpr): - (JSC::ASTBuilder::createString): - (JSC::ASTBuilder::createBoolean): - (JSC::ASTBuilder::createNull): - (JSC::ASTBuilder::createBracketAccess): - (JSC::ASTBuilder::createDotAccess): - (JSC::ASTBuilder::createRegExp): - (JSC::ASTBuilder::createNewExpr): - (JSC::ASTBuilder::createConditionalExpr): - (JSC::ASTBuilder::createAssignResolve): - (JSC::ASTBuilder::createFunctionExpr): - (JSC::ASTBuilder::createFunctionBody): - (JSC::ASTBuilder::createGetterOrSetterProperty): - (JSC::ASTBuilder::createArgumentsList): - (JSC::ASTBuilder::createPropertyList): - (JSC::ASTBuilder::createFuncDeclStatement): - (JSC::ASTBuilder::createBlockStatement): - (JSC::ASTBuilder::createExprStatement): - (JSC::ASTBuilder::createIfStatement): - (JSC::ASTBuilder::createForLoop): - (JSC::ASTBuilder::createForInLoop): - (JSC::ASTBuilder::createEmptyStatement): - (JSC::ASTBuilder::createVarStatement): - (JSC::ASTBuilder::createReturnStatement): - (JSC::ASTBuilder::createBreakStatement): - (JSC::ASTBuilder::createContinueStatement): - (JSC::ASTBuilder::createTryStatement): - (JSC::ASTBuilder::createSwitchStatement): - (JSC::ASTBuilder::createWhileStatement): - (JSC::ASTBuilder::createDoWhileStatement): - (JSC::ASTBuilder::createLabelStatement): - (JSC::ASTBuilder::createWithStatement): - (JSC::ASTBuilder::createThrowStatement): - (JSC::ASTBuilder::createDebugger): - (JSC::ASTBuilder::createConstStatement): - (JSC::ASTBuilder::appendConstDecl): - (JSC::ASTBuilder::combineCommaNodes): - (JSC::ASTBuilder::appendBinaryOperation): - (JSC::ASTBuilder::createAssignment): - (JSC::ASTBuilder::createNumber): - (JSC::ASTBuilder::makeTypeOfNode): - (JSC::ASTBuilder::makeDeleteNode): - (JSC::ASTBuilder::makeNegateNode): - (JSC::ASTBuilder::makeBitwiseNotNode): - (JSC::ASTBuilder::makeMultNode): - (JSC::ASTBuilder::makeDivNode): - (JSC::ASTBuilder::makeModNode): - (JSC::ASTBuilder::makeAddNode): - (JSC::ASTBuilder::makeSubNode): - (JSC::ASTBuilder::makeLeftShiftNode): - (JSC::ASTBuilder::makeRightShiftNode): - (JSC::ASTBuilder::makeURightShiftNode): - (JSC::ASTBuilder::makeBitOrNode): - (JSC::ASTBuilder::makeBitAndNode): - (JSC::ASTBuilder::makeBitXOrNode): - (JSC::ASTBuilder::makeFunctionCallNode): - (JSC::ASTBuilder::makeBinaryNode): - (JSC::ASTBuilder::makeAssignNode): - (JSC::ASTBuilder::makePrefixNode): - (JSC::ASTBuilder::makePostfixNode): - * parser/Lexer.cpp: - (JSC::::setCode): - (JSC::::internalShift): - (JSC::::shift): - (JSC::::lex): - * parser/Lexer.h: - (Lexer): - (JSC::Lexer::currentColumnNumber): - (JSC::::lexExpectIdentifier): - * parser/NodeConstructors.h: - (JSC::Node::Node): - (JSC::ExpressionNode::ExpressionNode): - (JSC::StatementNode::StatementNode): - (JSC::NullNode::NullNode): - (JSC::BooleanNode::BooleanNode): - (JSC::NumberNode::NumberNode): - (JSC::StringNode::StringNode): - (JSC::RegExpNode::RegExpNode): - (JSC::ThisNode::ThisNode): - (JSC::ResolveNode::ResolveNode): - (JSC::ArrayNode::ArrayNode): - (JSC::PropertyListNode::PropertyListNode): - (JSC::ObjectLiteralNode::ObjectLiteralNode): - (JSC::BracketAccessorNode::BracketAccessorNode): - (JSC::DotAccessorNode::DotAccessorNode): - (JSC::ArgumentListNode::ArgumentListNode): - (JSC::NewExprNode::NewExprNode): - (JSC::EvalFunctionCallNode::EvalFunctionCallNode): - (JSC::FunctionCallValueNode::FunctionCallValueNode): - (JSC::FunctionCallResolveNode::FunctionCallResolveNode): - (JSC::FunctionCallBracketNode::FunctionCallBracketNode): - (JSC::FunctionCallDotNode::FunctionCallDotNode): - (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode): - (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode): - (JSC::PrePostResolveNode::PrePostResolveNode): - (JSC::PostfixResolveNode::PostfixResolveNode): - (JSC::PostfixBracketNode::PostfixBracketNode): - (JSC::PostfixDotNode::PostfixDotNode): - (JSC::PostfixErrorNode::PostfixErrorNode): - (JSC::DeleteResolveNode::DeleteResolveNode): - (JSC::DeleteBracketNode::DeleteBracketNode): - (JSC::DeleteDotNode::DeleteDotNode): - (JSC::DeleteValueNode::DeleteValueNode): - (JSC::VoidNode::VoidNode): - (JSC::TypeOfResolveNode::TypeOfResolveNode): - (JSC::TypeOfValueNode::TypeOfValueNode): - (JSC::PrefixResolveNode::PrefixResolveNode): - (JSC::PrefixBracketNode::PrefixBracketNode): - (JSC::PrefixDotNode::PrefixDotNode): - (JSC::PrefixErrorNode::PrefixErrorNode): - (JSC::UnaryOpNode::UnaryOpNode): - (JSC::UnaryPlusNode::UnaryPlusNode): - (JSC::NegateNode::NegateNode): - (JSC::BitwiseNotNode::BitwiseNotNode): - (JSC::LogicalNotNode::LogicalNotNode): - (JSC::BinaryOpNode::BinaryOpNode): - (JSC::MultNode::MultNode): - (JSC::DivNode::DivNode): - (JSC::ModNode::ModNode): - (JSC::AddNode::AddNode): - (JSC::SubNode::SubNode): - (JSC::LeftShiftNode::LeftShiftNode): - (JSC::RightShiftNode::RightShiftNode): - (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode): - (JSC::LessNode::LessNode): - (JSC::GreaterNode::GreaterNode): - (JSC::LessEqNode::LessEqNode): - (JSC::GreaterEqNode::GreaterEqNode): - (JSC::ThrowableBinaryOpNode::ThrowableBinaryOpNode): - (JSC::InstanceOfNode::InstanceOfNode): - (JSC::InNode::InNode): - (JSC::EqualNode::EqualNode): - (JSC::NotEqualNode::NotEqualNode): - (JSC::StrictEqualNode::StrictEqualNode): - (JSC::NotStrictEqualNode::NotStrictEqualNode): - (JSC::BitAndNode::BitAndNode): - (JSC::BitOrNode::BitOrNode): - (JSC::BitXOrNode::BitXOrNode): - (JSC::LogicalOpNode::LogicalOpNode): - (JSC::ConditionalNode::ConditionalNode): - (JSC::ReadModifyResolveNode::ReadModifyResolveNode): - (JSC::AssignResolveNode::AssignResolveNode): - (JSC::ReadModifyBracketNode::ReadModifyBracketNode): - (JSC::AssignBracketNode::AssignBracketNode): - (JSC::AssignDotNode::AssignDotNode): - (JSC::ReadModifyDotNode::ReadModifyDotNode): - (JSC::AssignErrorNode::AssignErrorNode): - (JSC::CommaNode::CommaNode): - (JSC::ConstStatementNode::ConstStatementNode): - (JSC::EmptyStatementNode::EmptyStatementNode): - (JSC::DebuggerStatementNode::DebuggerStatementNode): - (JSC::ExprStatementNode::ExprStatementNode): - (JSC::VarStatementNode::VarStatementNode): - (JSC::IfNode::IfNode): - (JSC::IfElseNode::IfElseNode): - (JSC::DoWhileNode::DoWhileNode): - (JSC::WhileNode::WhileNode): - (JSC::ForNode::ForNode): - (JSC::ContinueNode::ContinueNode): - (JSC::BreakNode::BreakNode): - (JSC::ReturnNode::ReturnNode): - (JSC::WithNode::WithNode): - (JSC::LabelNode::LabelNode): - (JSC::ThrowNode::ThrowNode): - (JSC::TryNode::TryNode): - (JSC::FuncExprNode::FuncExprNode): - (JSC::FuncDeclNode::FuncDeclNode): - (JSC::SwitchNode::SwitchNode): - (JSC::ConstDeclNode::ConstDeclNode): - (JSC::BlockNode::BlockNode): - (JSC::ForInNode::ForInNode): - * parser/Nodes.cpp: - (JSC::StatementNode::setLoc): - (JSC): - (JSC::ScopeNode::ScopeNode): - (JSC::ProgramNode::ProgramNode): - (JSC::ProgramNode::create): - (JSC::EvalNode::EvalNode): - (JSC::EvalNode::create): - (JSC::FunctionBodyNode::FunctionBodyNode): - (JSC::FunctionBodyNode::create): - * parser/Nodes.h: - (Node): - (JSC::Node::columnNo): - (ExpressionNode): - (StatementNode): - (JSC::StatementNode::column): - (NullNode): - (BooleanNode): - (NumberNode): - (StringNode): - (RegExpNode): - (ThisNode): - (ResolveNode): - (ArrayNode): - (PropertyListNode): - (ObjectLiteralNode): - (BracketAccessorNode): - (DotAccessorNode): - (ArgumentListNode): - (NewExprNode): - (EvalFunctionCallNode): - (FunctionCallValueNode): - (FunctionCallResolveNode): - (FunctionCallBracketNode): - (FunctionCallDotNode): - (CallFunctionCallDotNode): - (ApplyFunctionCallDotNode): - (PrePostResolveNode): - (PostfixResolveNode): - (PostfixBracketNode): - (PostfixDotNode): - (PostfixErrorNode): - (DeleteResolveNode): - (DeleteBracketNode): - (DeleteDotNode): - (DeleteValueNode): - (VoidNode): - (TypeOfResolveNode): - (TypeOfValueNode): - (PrefixResolveNode): - (PrefixBracketNode): - (PrefixDotNode): - (PrefixErrorNode): - (UnaryOpNode): - (UnaryPlusNode): - (NegateNode): - (BitwiseNotNode): - (LogicalNotNode): - (BinaryOpNode): - (MultNode): - (DivNode): - (ModNode): - (AddNode): - (SubNode): - (LeftShiftNode): - (RightShiftNode): - (UnsignedRightShiftNode): - (LessNode): - (GreaterNode): - (LessEqNode): - (GreaterEqNode): - (ThrowableBinaryOpNode): - (InstanceOfNode): - (InNode): - (EqualNode): - (NotEqualNode): - (StrictEqualNode): - (NotStrictEqualNode): - (BitAndNode): - (BitOrNode): - (BitXOrNode): - (LogicalOpNode): - (ConditionalNode): - (ReadModifyResolveNode): - (AssignResolveNode): - (ReadModifyBracketNode): - (AssignBracketNode): - (AssignDotNode): - (ReadModifyDotNode): - (AssignErrorNode): - (CommaNode): - (ConstDeclNode): - (ConstStatementNode): - (BlockNode): - (EmptyStatementNode): - (DebuggerStatementNode): - (ExprStatementNode): - (VarStatementNode): - (IfNode): - (IfElseNode): - (DoWhileNode): - (WhileNode): - (ForNode): - (ForInNode): - (ContinueNode): - (BreakNode): - (ReturnNode): - (WithNode): - (LabelNode): - (ThrowNode): - (TryNode): - (ScopeNode): - (ProgramNode): - (EvalNode): - (FunctionBodyNode): - (FuncExprNode): - (FuncDeclNode): - (SwitchNode): - * parser/Parser.cpp: - (JSC::::parseSourceElements): - (JSC::::parseVarDeclaration): - (JSC::::parseConstDeclaration): - (JSC::::parseDoWhileStatement): - (JSC::::parseWhileStatement): - (JSC::::parseVarDeclarationList): - (JSC::::parseConstDeclarationList): - (JSC::::parseForStatement): - (JSC::::parseBreakStatement): - (JSC::::parseContinueStatement): - (JSC::::parseReturnStatement): - (JSC::::parseThrowStatement): - (JSC::::parseWithStatement): - (JSC::::parseSwitchStatement): - (JSC::::parseTryStatement): - (JSC::::parseDebuggerStatement): - (JSC::::parseBlockStatement): - (JSC::::parseStatement): - (JSC::::parseFunctionBody): - (JSC::::parseFunctionInfo): - (JSC::::parseFunctionDeclaration): - (JSC::::parseExpressionOrLabelStatement): - (JSC::::parseExpressionStatement): - (JSC::::parseIfStatement): - (JSC::::parseExpression): - (JSC::::parseAssignmentExpression): - (JSC::::parseConditionalExpression): - (JSC::::parseBinaryExpression): - (JSC::::parseProperty): - (JSC::::parseObjectLiteral): - (JSC::::parseStrictObjectLiteral): - (JSC::::parseArrayLiteral): - (JSC::::parsePrimaryExpression): - (JSC::::parseArguments): - (JSC::::parseMemberExpression): - (JSC::::parseUnaryExpression): - * parser/Parser.h: - (JSC::Parser::next): - (JSC::Parser::nextExpectIdentifier): - (JSC::Parser::tokenStart): - (JSC::Parser::tokenLine): - (JSC::Parser::tokenEnd): - (JSC::Parser::tokenLocation): - (Parser): - (JSC::Parser::getTokenName): - (JSC::::parse): - * parser/ParserTokens.h: - (JSC::JSTokenLocation::JSTokenLocation): - (JSTokenLocation): - (JSToken): - * parser/SourceProviderCacheItem.h: - (JSC::SourceProviderCacheItem::closeBraceToken): - * parser/SyntaxChecker.h: - (JSC::SyntaxChecker::makeFunctionCallNode): - (JSC::SyntaxChecker::createCommaExpr): - (JSC::SyntaxChecker::makeAssignNode): - (JSC::SyntaxChecker::makePrefixNode): - (JSC::SyntaxChecker::makePostfixNode): - (JSC::SyntaxChecker::makeTypeOfNode): - (JSC::SyntaxChecker::makeDeleteNode): - (JSC::SyntaxChecker::makeNegateNode): - (JSC::SyntaxChecker::makeBitwiseNotNode): - (JSC::SyntaxChecker::createLogicalNot): - (JSC::SyntaxChecker::createUnaryPlus): - (JSC::SyntaxChecker::createVoid): - (JSC::SyntaxChecker::thisExpr): - (JSC::SyntaxChecker::createResolve): - (JSC::SyntaxChecker::createObjectLiteral): - (JSC::SyntaxChecker::createArray): - (JSC::SyntaxChecker::createNumberExpr): - (JSC::SyntaxChecker::createString): - (JSC::SyntaxChecker::createBoolean): - (JSC::SyntaxChecker::createNull): - (JSC::SyntaxChecker::createBracketAccess): - (JSC::SyntaxChecker::createDotAccess): - (JSC::SyntaxChecker::createRegExp): - (JSC::SyntaxChecker::createNewExpr): - (JSC::SyntaxChecker::createConditionalExpr): - (JSC::SyntaxChecker::createAssignResolve): - (JSC::SyntaxChecker::createFunctionExpr): - (JSC::SyntaxChecker::createFunctionBody): - (JSC::SyntaxChecker::createArgumentsList): - (JSC::SyntaxChecker::createPropertyList): - (JSC::SyntaxChecker::createFuncDeclStatement): - (JSC::SyntaxChecker::createBlockStatement): - (JSC::SyntaxChecker::createExprStatement): - (JSC::SyntaxChecker::createIfStatement): - (JSC::SyntaxChecker::createForLoop): - (JSC::SyntaxChecker::createForInLoop): - (JSC::SyntaxChecker::createEmptyStatement): - (JSC::SyntaxChecker::createVarStatement): - (JSC::SyntaxChecker::createReturnStatement): - (JSC::SyntaxChecker::createBreakStatement): - (JSC::SyntaxChecker::createContinueStatement): - (JSC::SyntaxChecker::createTryStatement): - (JSC::SyntaxChecker::createSwitchStatement): - (JSC::SyntaxChecker::createWhileStatement): - (JSC::SyntaxChecker::createWithStatement): - (JSC::SyntaxChecker::createDoWhileStatement): - (JSC::SyntaxChecker::createLabelStatement): - (JSC::SyntaxChecker::createThrowStatement): - (JSC::SyntaxChecker::createDebugger): - (JSC::SyntaxChecker::createConstStatement): - (JSC::SyntaxChecker::appendConstDecl): - (JSC::SyntaxChecker::createGetterOrSetterProperty): - (JSC::SyntaxChecker::combineCommaNodes): - (JSC::SyntaxChecker::operatorStackPop): - -2012-08-03 Filip Pizlo - - Crashes in dfgBuildPutByIdList when clicking on just about anything on Google Maps - https://bugs.webkit.org/show_bug.cgi?id=92691 - - Reviewed by Mark Hahnenberg. - - The state of the stubs was changing after we determined the type (by virtue of the slow path - function that was called), since the get or put (in this case put) could cause arbitrary - side effects. Perhaps a full-blown fix would be to eliminate our reliance of the slow path - function to determine what to do, but an easier fix for now is to have the slow path give up - if its assumptions were invalidated by a side effect. - - * dfg/DFGOperations.cpp: - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - -2012-08-03 Filip Pizlo - - DFG handling of get_by_id should always inject a ForceOSRExit node if there is no prediction - https://bugs.webkit.org/show_bug.cgi?id=93162 - - Reviewed by Mark Hahnenberg. - - This simplifies the DFG IR by ensuring that all nodes that use value profiles will be preceded - by a ForceOSRExit if the value profile had no data. - - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): - -2012-08-03 Filip Pizlo - - DFG::StructureCheckHoistingPhase keeps a Node& around for too long - https://bugs.webkit.org/show_bug.cgi?id=93157 - - Reviewed by Mark Hahnenberg. - - * dfg/DFGStructureCheckHoistingPhase.cpp: - (JSC::DFG::StructureCheckHoistingPhase::run): - -2012-08-02 Patrick Gansterer - - Move getLocalTime() as static inline function to DateMath - https://bugs.webkit.org/show_bug.cgi?id=92955 - - Reviewed by Ryosuke Niwa. - - getCurrentLocalTime() and getLocalTime() has been superseded with the - GregorianDateTime class. So we can move it into DateMath.cpp as an static inline - function. This allows us to remove the dependecy on time() and localtime() - for Windows CE, where this functions require the ce_time library to work. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - -2012-08-02 Filip Pizlo - - ASSERTION FAILED: at(m_compileIndex).canExit() || m_isCheckingArgumentTypes - https://bugs.webkit.org/show_bug.cgi?id=91074 - - Reviewed by Mark Hahnenberg. - - Fixes a bug where the speculative JIT was performing an unnecessary speculation that the - CFA had proven shouldn't be performed, leading to asserts that a node should not have - exit sites. This is a debug-only assert with no release symptom - we were just emitting - a check that was not reachable. - - Also found, and fixed, a bug where structure check hoisting was slightly confusing the - CFA by inserting GetLocal's into the graph. CSE would clean the GetLocal's up, which - would make the backend happy - but the CFA would produce subtly wrong results. - - * bytecode/SpeculatedType.h: - (JSC::isOtherOrEmptySpeculation): - (JSC): - * dfg/DFGDriver.cpp: - (JSC::DFG::compile): - * dfg/DFGGraph.cpp: - (JSC::DFG::Graph::dump): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality): - (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality): - -2012-08-02 Filip Pizlo - - Unreviewed, build fix for DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE). - - * dfg/DFGStructureCheckHoistingPhase.cpp: - (JSC::DFG::StructureCheckHoistingPhase::run): - -2012-08-01 Mark Hahnenberg - - Remove all uses of ClassInfo for JSStrings in JIT code - https://bugs.webkit.org/show_bug.cgi?id=92935 - - Reviewed by Geoffrey Garen. - - This is the first step in removing our dependence on in-object ClassInfo pointers - in JIT code. Most of the changes are to check the Structure, which is unique for - JSString primitives. - - * bytecode/SpeculatedType.cpp: - (JSC::speculationFromClassInfo): - (JSC::speculationFromStructure): Changed to check the TypeInfo in the Structure - since there wasn't a JSGlobalData immediately available to grab the JSString - Structure out of. - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * jit/JITInlineMethods.h: - (JSC::JIT::emitLoadCharacterString): - * jit/JITOpcodes.cpp: - (JSC::JIT::privateCompileCTIMachineTrampolines): - (JSC::JIT::emit_op_to_primitive): - (JSC::JIT::emit_op_convert_this): - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::privateCompileCTIMachineTrampolines): - (JSC::JIT::emit_op_to_primitive): - (JSC::JIT::emitSlow_op_eq): - (JSC::JIT::emitSlow_op_neq): - (JSC::JIT::compileOpStrictEq): - (JSC::JIT::emit_op_convert_this): - * jit/JITPropertyAccess.cpp: - (JSC::JIT::stringGetByValStubGenerator): - (JSC::JIT::emitSlow_op_get_by_val): - * jit/JITPropertyAccess32_64.cpp: - (JSC::JIT::stringGetByValStubGenerator): - (JSC::JIT::emitSlow_op_get_by_val): - * jit/SpecializedThunkJIT.h: - (JSC::SpecializedThunkJIT::loadJSStringArgument): - * jit/ThunkGenerators.cpp: - (JSC::stringCharLoad): - (JSC::charCodeAtThunkGenerator): - (JSC::charAtThunkGenerator): - -2012-08-02 Filip Pizlo - - Unreviewed, missed a style goof in the previous patch: "NodeIndex nodeIndex" - in a method signature is painfully redundant. - - * dfg/DFGSpeculativeJIT.h: - (SpeculativeJIT): - -2012-08-02 Filip Pizlo - - DFGSpeculativeJIT.h has too many inline method bodies - https://bugs.webkit.org/show_bug.cgi?id=92957 - - Reviewed by Antti Koivisto. - - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::speculationCheck): - (DFG): - (JSC::DFG::SpeculativeJIT::speculationWatchpoint): - (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck): - (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection): - (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution): - (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection): - * dfg/DFGSpeculativeJIT.h: - (SpeculativeJIT): - -2012-08-01 Sheriff Bot - - Unreviewed, rolling out r124406. - http://trac.webkit.org/changeset/124406 - https://bugs.webkit.org/show_bug.cgi?id=92951 - - it set the Mac bots on fire (Requested by pizlo on #webkit). - - * bytecode/Opcode.h: - (JSC): - (JSC::padOpcodeName): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::emitDebugHook): - * bytecompiler/BytecodeGenerator.h: - (BytecodeGenerator): - * bytecompiler/NodesCodegen.cpp: - (JSC::ArrayNode::toArgumentList): - (JSC::ApplyFunctionCallDotNode::emitBytecode): - (JSC::ConditionalNode::emitBytecode): - (JSC::ConstStatementNode::emitBytecode): - (JSC::EmptyStatementNode::emitBytecode): - (JSC::DebuggerStatementNode::emitBytecode): - (JSC::ExprStatementNode::emitBytecode): - (JSC::VarStatementNode::emitBytecode): - (JSC::IfNode::emitBytecode): - (JSC::IfElseNode::emitBytecode): - (JSC::DoWhileNode::emitBytecode): - (JSC::WhileNode::emitBytecode): - (JSC::ForNode::emitBytecode): - (JSC::ForInNode::emitBytecode): - (JSC::ContinueNode::emitBytecode): - (JSC::BreakNode::emitBytecode): - (JSC::ReturnNode::emitBytecode): - (JSC::WithNode::emitBytecode): - (JSC::SwitchNode::emitBytecode): - (JSC::LabelNode::emitBytecode): - (JSC::ThrowNode::emitBytecode): - (JSC::TryNode::emitBytecode): - (JSC::ProgramNode::emitBytecode): - (JSC::EvalNode::emitBytecode): - (JSC::FunctionBodyNode::emitBytecode): - * debugger/Debugger.h: - * interpreter/Interpreter.cpp: - (JSC::Interpreter::unwindCallFrame): - (JSC::Interpreter::throwException): - (JSC::Interpreter::debug): - * interpreter/Interpreter.h: - (Interpreter): - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_debug): - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::emit_op_debug): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * parser/ASTBuilder.h: - (ASTBuilder): - (JSC::ASTBuilder::createCommaExpr): - (JSC::ASTBuilder::createLogicalNot): - (JSC::ASTBuilder::createUnaryPlus): - (JSC::ASTBuilder::createVoid): - (JSC::ASTBuilder::thisExpr): - (JSC::ASTBuilder::createResolve): - (JSC::ASTBuilder::createObjectLiteral): - (JSC::ASTBuilder::createArray): - (JSC::ASTBuilder::createNumberExpr): - (JSC::ASTBuilder::createString): - (JSC::ASTBuilder::createBoolean): - (JSC::ASTBuilder::createNull): - (JSC::ASTBuilder::createBracketAccess): - (JSC::ASTBuilder::createDotAccess): - (JSC::ASTBuilder::createRegExp): - (JSC::ASTBuilder::createNewExpr): - (JSC::ASTBuilder::createConditionalExpr): - (JSC::ASTBuilder::createAssignResolve): - (JSC::ASTBuilder::createFunctionExpr): - (JSC::ASTBuilder::createFunctionBody): - (JSC::ASTBuilder::createGetterOrSetterProperty): - (JSC::ASTBuilder::createArgumentsList): - (JSC::ASTBuilder::createPropertyList): - (JSC::ASTBuilder::createFuncDeclStatement): - (JSC::ASTBuilder::createBlockStatement): - (JSC::ASTBuilder::createExprStatement): - (JSC::ASTBuilder::createIfStatement): - (JSC::ASTBuilder::createForLoop): - (JSC::ASTBuilder::createForInLoop): - (JSC::ASTBuilder::createEmptyStatement): - (JSC::ASTBuilder::createVarStatement): - (JSC::ASTBuilder::createReturnStatement): - (JSC::ASTBuilder::createBreakStatement): - (JSC::ASTBuilder::createContinueStatement): - (JSC::ASTBuilder::createTryStatement): - (JSC::ASTBuilder::createSwitchStatement): - (JSC::ASTBuilder::createWhileStatement): - (JSC::ASTBuilder::createDoWhileStatement): - (JSC::ASTBuilder::createLabelStatement): - (JSC::ASTBuilder::createWithStatement): - (JSC::ASTBuilder::createThrowStatement): - (JSC::ASTBuilder::createDebugger): - (JSC::ASTBuilder::createConstStatement): - (JSC::ASTBuilder::appendConstDecl): - (JSC::ASTBuilder::combineCommaNodes): - (JSC::ASTBuilder::appendBinaryOperation): - (JSC::ASTBuilder::createAssignment): - (JSC::ASTBuilder::createNumber): - (JSC::ASTBuilder::makeTypeOfNode): - (JSC::ASTBuilder::makeDeleteNode): - (JSC::ASTBuilder::makeNegateNode): - (JSC::ASTBuilder::makeBitwiseNotNode): - (JSC::ASTBuilder::makeMultNode): - (JSC::ASTBuilder::makeDivNode): - (JSC::ASTBuilder::makeModNode): - (JSC::ASTBuilder::makeAddNode): - (JSC::ASTBuilder::makeSubNode): - (JSC::ASTBuilder::makeLeftShiftNode): - (JSC::ASTBuilder::makeRightShiftNode): - (JSC::ASTBuilder::makeURightShiftNode): - (JSC::ASTBuilder::makeBitOrNode): - (JSC::ASTBuilder::makeBitAndNode): - (JSC::ASTBuilder::makeBitXOrNode): - (JSC::ASTBuilder::makeFunctionCallNode): - (JSC::ASTBuilder::makeBinaryNode): - (JSC::ASTBuilder::makeAssignNode): - (JSC::ASTBuilder::makePrefixNode): - (JSC::ASTBuilder::makePostfixNode): - * parser/Lexer.cpp: - (JSC::::setCode): - (JSC::::internalShift): - (JSC::::shift): - (JSC::::lex): - * parser/Lexer.h: - (Lexer): - (JSC::::lexExpectIdentifier): - * parser/NodeConstructors.h: - (JSC::Node::Node): - (JSC::ExpressionNode::ExpressionNode): - (JSC::StatementNode::StatementNode): - (JSC::NullNode::NullNode): - (JSC::BooleanNode::BooleanNode): - (JSC::NumberNode::NumberNode): - (JSC::StringNode::StringNode): - (JSC::RegExpNode::RegExpNode): - (JSC::ThisNode::ThisNode): - (JSC::ResolveNode::ResolveNode): - (JSC::ArrayNode::ArrayNode): - (JSC::PropertyListNode::PropertyListNode): - (JSC::ObjectLiteralNode::ObjectLiteralNode): - (JSC::BracketAccessorNode::BracketAccessorNode): - (JSC::DotAccessorNode::DotAccessorNode): - (JSC::ArgumentListNode::ArgumentListNode): - (JSC::NewExprNode::NewExprNode): - (JSC::EvalFunctionCallNode::EvalFunctionCallNode): - (JSC::FunctionCallValueNode::FunctionCallValueNode): - (JSC::FunctionCallResolveNode::FunctionCallResolveNode): - (JSC::FunctionCallBracketNode::FunctionCallBracketNode): - (JSC::FunctionCallDotNode::FunctionCallDotNode): - (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode): - (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode): - (JSC::PrePostResolveNode::PrePostResolveNode): - (JSC::PostfixResolveNode::PostfixResolveNode): - (JSC::PostfixBracketNode::PostfixBracketNode): - (JSC::PostfixDotNode::PostfixDotNode): - (JSC::PostfixErrorNode::PostfixErrorNode): - (JSC::DeleteResolveNode::DeleteResolveNode): - (JSC::DeleteBracketNode::DeleteBracketNode): - (JSC::DeleteDotNode::DeleteDotNode): - (JSC::DeleteValueNode::DeleteValueNode): - (JSC::VoidNode::VoidNode): - (JSC::TypeOfResolveNode::TypeOfResolveNode): - (JSC::TypeOfValueNode::TypeOfValueNode): - (JSC::PrefixResolveNode::PrefixResolveNode): - (JSC::PrefixBracketNode::PrefixBracketNode): - (JSC::PrefixDotNode::PrefixDotNode): - (JSC::PrefixErrorNode::PrefixErrorNode): - (JSC::UnaryOpNode::UnaryOpNode): - (JSC::UnaryPlusNode::UnaryPlusNode): - (JSC::NegateNode::NegateNode): - (JSC::BitwiseNotNode::BitwiseNotNode): - (JSC::LogicalNotNode::LogicalNotNode): - (JSC::BinaryOpNode::BinaryOpNode): - (JSC::MultNode::MultNode): - (JSC::DivNode::DivNode): - (JSC::ModNode::ModNode): - (JSC::AddNode::AddNode): - (JSC::SubNode::SubNode): - (JSC::LeftShiftNode::LeftShiftNode): - (JSC::RightShiftNode::RightShiftNode): - (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode): - (JSC::LessNode::LessNode): - (JSC::GreaterNode::GreaterNode): - (JSC::LessEqNode::LessEqNode): - (JSC::GreaterEqNode::GreaterEqNode): - (JSC::ThrowableBinaryOpNode::ThrowableBinaryOpNode): - (JSC::InstanceOfNode::InstanceOfNode): - (JSC::InNode::InNode): - (JSC::EqualNode::EqualNode): - (JSC::NotEqualNode::NotEqualNode): - (JSC::StrictEqualNode::StrictEqualNode): - (JSC::NotStrictEqualNode::NotStrictEqualNode): - (JSC::BitAndNode::BitAndNode): - (JSC::BitOrNode::BitOrNode): - (JSC::BitXOrNode::BitXOrNode): - (JSC::LogicalOpNode::LogicalOpNode): - (JSC::ConditionalNode::ConditionalNode): - (JSC::ReadModifyResolveNode::ReadModifyResolveNode): - (JSC::AssignResolveNode::AssignResolveNode): - (JSC::ReadModifyBracketNode::ReadModifyBracketNode): - (JSC::AssignBracketNode::AssignBracketNode): - (JSC::AssignDotNode::AssignDotNode): - (JSC::ReadModifyDotNode::ReadModifyDotNode): - (JSC::AssignErrorNode::AssignErrorNode): - (JSC::CommaNode::CommaNode): - (JSC::ConstStatementNode::ConstStatementNode): - (JSC::EmptyStatementNode::EmptyStatementNode): - (JSC::DebuggerStatementNode::DebuggerStatementNode): - (JSC::ExprStatementNode::ExprStatementNode): - (JSC::VarStatementNode::VarStatementNode): - (JSC::IfNode::IfNode): - (JSC::IfElseNode::IfElseNode): - (JSC::DoWhileNode::DoWhileNode): - (JSC::WhileNode::WhileNode): - (JSC::ForNode::ForNode): - (JSC::ContinueNode::ContinueNode): - (JSC::BreakNode::BreakNode): - (JSC::ReturnNode::ReturnNode): - (JSC::WithNode::WithNode): - (JSC::LabelNode::LabelNode): - (JSC::ThrowNode::ThrowNode): - (JSC::TryNode::TryNode): - (JSC::FuncExprNode::FuncExprNode): - (JSC::FuncDeclNode::FuncDeclNode): - (JSC::SwitchNode::SwitchNode): - (JSC::ConstDeclNode::ConstDeclNode): - (JSC::BlockNode::BlockNode): - (JSC::ForInNode::ForInNode): - * parser/Nodes.cpp: - (JSC): - (JSC::StatementNode::setLoc): - (JSC::ScopeNode::ScopeNode): - (JSC::ProgramNode::ProgramNode): - (JSC::ProgramNode::create): - (JSC::EvalNode::EvalNode): - (JSC::EvalNode::create): - (JSC::FunctionBodyNode::FunctionBodyNode): - (JSC::FunctionBodyNode::create): - * parser/Nodes.h: - (Node): - (ExpressionNode): - (StatementNode): - (NullNode): - (BooleanNode): - (NumberNode): - (StringNode): - (RegExpNode): - (ThisNode): - (ResolveNode): - (ArrayNode): - (PropertyListNode): - (ObjectLiteralNode): - (BracketAccessorNode): - (DotAccessorNode): - (ArgumentListNode): - (NewExprNode): - (EvalFunctionCallNode): - (FunctionCallValueNode): - (FunctionCallResolveNode): - (FunctionCallBracketNode): - (FunctionCallDotNode): - (CallFunctionCallDotNode): - (ApplyFunctionCallDotNode): - (PrePostResolveNode): - (PostfixResolveNode): - (PostfixBracketNode): - (PostfixDotNode): - (PostfixErrorNode): - (DeleteResolveNode): - (DeleteBracketNode): - (DeleteDotNode): - (DeleteValueNode): - (VoidNode): - (TypeOfResolveNode): - (TypeOfValueNode): - (PrefixResolveNode): - (PrefixBracketNode): - (PrefixDotNode): - (PrefixErrorNode): - (UnaryOpNode): - (UnaryPlusNode): - (NegateNode): - (BitwiseNotNode): - (LogicalNotNode): - (BinaryOpNode): - (MultNode): - (DivNode): - (ModNode): - (AddNode): - (SubNode): - (LeftShiftNode): - (RightShiftNode): - (UnsignedRightShiftNode): - (LessNode): - (GreaterNode): - (LessEqNode): - (GreaterEqNode): - (ThrowableBinaryOpNode): - (InstanceOfNode): - (InNode): - (EqualNode): - (NotEqualNode): - (StrictEqualNode): - (NotStrictEqualNode): - (BitAndNode): - (BitOrNode): - (BitXOrNode): - (LogicalOpNode): - (ConditionalNode): - (ReadModifyResolveNode): - (AssignResolveNode): - (ReadModifyBracketNode): - (AssignBracketNode): - (AssignDotNode): - (ReadModifyDotNode): - (AssignErrorNode): - (CommaNode): - (ConstDeclNode): - (ConstStatementNode): - (BlockNode): - (EmptyStatementNode): - (DebuggerStatementNode): - (ExprStatementNode): - (VarStatementNode): - (IfNode): - (IfElseNode): - (DoWhileNode): - (WhileNode): - (ForNode): - (ForInNode): - (ContinueNode): - (BreakNode): - (ReturnNode): - (WithNode): - (LabelNode): - (ThrowNode): - (TryNode): - (ScopeNode): - (ProgramNode): - (EvalNode): - (FunctionBodyNode): - (FuncExprNode): - (FuncDeclNode): - (SwitchNode): - * parser/Parser.cpp: - (JSC::::parseSourceElements): - (JSC::::parseVarDeclaration): - (JSC::::parseConstDeclaration): - (JSC::::parseDoWhileStatement): - (JSC::::parseWhileStatement): - (JSC::::parseVarDeclarationList): - (JSC::::parseConstDeclarationList): - (JSC::::parseForStatement): - (JSC::::parseBreakStatement): - (JSC::::parseContinueStatement): - (JSC::::parseReturnStatement): - (JSC::::parseThrowStatement): - (JSC::::parseWithStatement): - (JSC::::parseSwitchStatement): - (JSC::::parseTryStatement): - (JSC::::parseDebuggerStatement): - (JSC::::parseBlockStatement): - (JSC::::parseStatement): - (JSC::::parseFunctionBody): - (JSC::::parseFunctionInfo): - (JSC::::parseFunctionDeclaration): - (JSC::::parseExpressionOrLabelStatement): - (JSC::::parseExpressionStatement): - (JSC::::parseIfStatement): - (JSC::::parseExpression): - (JSC::::parseAssignmentExpression): - (JSC::::parseConditionalExpression): - (JSC::::parseBinaryExpression): - (JSC::::parseProperty): - (JSC::::parseObjectLiteral): - (JSC::::parseStrictObjectLiteral): - (JSC::::parseArrayLiteral): - (JSC::::parsePrimaryExpression): - (JSC::::parseArguments): - (JSC::::parseMemberExpression): - (JSC::::parseUnaryExpression): - * parser/Parser.h: - (JSC::Parser::next): - (JSC::Parser::nextExpectIdentifier): - (JSC::Parser::tokenStart): - (JSC::Parser::tokenLine): - (JSC::Parser::tokenEnd): - (JSC::Parser::getTokenName): - (JSC::::parse): - * parser/ParserTokens.h: - (JSC::JSTokenInfo::JSTokenInfo): - (JSTokenInfo): - (JSToken): - * parser/SourceProviderCacheItem.h: - (JSC::SourceProviderCacheItem::closeBraceToken): - * parser/SyntaxChecker.h: - (JSC::SyntaxChecker::makeFunctionCallNode): - (JSC::SyntaxChecker::createCommaExpr): - (JSC::SyntaxChecker::makeAssignNode): - (JSC::SyntaxChecker::makePrefixNode): - (JSC::SyntaxChecker::makePostfixNode): - (JSC::SyntaxChecker::makeTypeOfNode): - (JSC::SyntaxChecker::makeDeleteNode): - (JSC::SyntaxChecker::makeNegateNode): - (JSC::SyntaxChecker::makeBitwiseNotNode): - (JSC::SyntaxChecker::createLogicalNot): - (JSC::SyntaxChecker::createUnaryPlus): - (JSC::SyntaxChecker::createVoid): - (JSC::SyntaxChecker::thisExpr): - (JSC::SyntaxChecker::createResolve): - (JSC::SyntaxChecker::createObjectLiteral): - (JSC::SyntaxChecker::createArray): - (JSC::SyntaxChecker::createNumberExpr): - (JSC::SyntaxChecker::createString): - (JSC::SyntaxChecker::createBoolean): - (JSC::SyntaxChecker::createNull): - (JSC::SyntaxChecker::createBracketAccess): - (JSC::SyntaxChecker::createDotAccess): - (JSC::SyntaxChecker::createRegExp): - (JSC::SyntaxChecker::createNewExpr): - (JSC::SyntaxChecker::createConditionalExpr): - (JSC::SyntaxChecker::createAssignResolve): - (JSC::SyntaxChecker::createFunctionExpr): - (JSC::SyntaxChecker::createFunctionBody): - (JSC::SyntaxChecker::createArgumentsList): - (JSC::SyntaxChecker::createPropertyList): - (JSC::SyntaxChecker::createFuncDeclStatement): - (JSC::SyntaxChecker::createBlockStatement): - (JSC::SyntaxChecker::createExprStatement): - (JSC::SyntaxChecker::createIfStatement): - (JSC::SyntaxChecker::createForLoop): - (JSC::SyntaxChecker::createForInLoop): - (JSC::SyntaxChecker::createEmptyStatement): - (JSC::SyntaxChecker::createVarStatement): - (JSC::SyntaxChecker::createReturnStatement): - (JSC::SyntaxChecker::createBreakStatement): - (JSC::SyntaxChecker::createContinueStatement): - (JSC::SyntaxChecker::createTryStatement): - (JSC::SyntaxChecker::createSwitchStatement): - (JSC::SyntaxChecker::createWhileStatement): - (JSC::SyntaxChecker::createWithStatement): - (JSC::SyntaxChecker::createDoWhileStatement): - (JSC::SyntaxChecker::createLabelStatement): - (JSC::SyntaxChecker::createThrowStatement): - (JSC::SyntaxChecker::createDebugger): - (JSC::SyntaxChecker::createConstStatement): - (JSC::SyntaxChecker::appendConstDecl): - (JSC::SyntaxChecker::createGetterOrSetterProperty): - (JSC::SyntaxChecker::combineCommaNodes): - (JSC::SyntaxChecker::operatorStackPop): - -2012-08-01 Peter Wang - - Web Inspector: [JSC] implement setting breakpoints by line:column - https://bugs.webkit.org/show_bug.cgi?id=53003 - - Reviewed by Geoffrey Garen. - - Add a counter in lexer to record the column of each token. Debugger will use column info - in "Pretty Print" debug mode of Inspector. - - * bytecode/Opcode.h: - (JSC): - (JSC::padOpcodeName): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::emitDebugHook): - * bytecompiler/BytecodeGenerator.h: - (BytecodeGenerator): - * bytecompiler/NodesCodegen.cpp: - (JSC::ArrayNode::toArgumentList): - (JSC::ApplyFunctionCallDotNode::emitBytecode): - (JSC::ConditionalNode::emitBytecode): - (JSC::ConstStatementNode::emitBytecode): - (JSC::EmptyStatementNode::emitBytecode): - (JSC::DebuggerStatementNode::emitBytecode): - (JSC::ExprStatementNode::emitBytecode): - (JSC::VarStatementNode::emitBytecode): - (JSC::IfNode::emitBytecode): - (JSC::IfElseNode::emitBytecode): - (JSC::DoWhileNode::emitBytecode): - (JSC::WhileNode::emitBytecode): - (JSC::ForNode::emitBytecode): - (JSC::ForInNode::emitBytecode): - (JSC::ContinueNode::emitBytecode): - (JSC::BreakNode::emitBytecode): - (JSC::ReturnNode::emitBytecode): - (JSC::WithNode::emitBytecode): - (JSC::SwitchNode::emitBytecode): - (JSC::LabelNode::emitBytecode): - (JSC::ThrowNode::emitBytecode): - (JSC::TryNode::emitBytecode): - (JSC::ProgramNode::emitBytecode): - (JSC::EvalNode::emitBytecode): - (JSC::FunctionBodyNode::emitBytecode): - * debugger/Debugger.h: - * interpreter/Interpreter.cpp: - (JSC::Interpreter::unwindCallFrame): - (JSC::Interpreter::throwException): - (JSC::Interpreter::debug): - * interpreter/Interpreter.h: - (Interpreter): - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_debug): - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::emit_op_debug): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * parser/ASTBuilder.h: - (ASTBuilder): - (JSC::ASTBuilder::createCommaExpr): - (JSC::ASTBuilder::createLogicalNot): - (JSC::ASTBuilder::createUnaryPlus): - (JSC::ASTBuilder::createVoid): - (JSC::ASTBuilder::thisExpr): - (JSC::ASTBuilder::createResolve): - (JSC::ASTBuilder::createObjectLiteral): - (JSC::ASTBuilder::createArray): - (JSC::ASTBuilder::createNumberExpr): - (JSC::ASTBuilder::createString): - (JSC::ASTBuilder::createBoolean): - (JSC::ASTBuilder::createNull): - (JSC::ASTBuilder::createBracketAccess): - (JSC::ASTBuilder::createDotAccess): - (JSC::ASTBuilder::createRegExp): - (JSC::ASTBuilder::createNewExpr): - (JSC::ASTBuilder::createConditionalExpr): - (JSC::ASTBuilder::createAssignResolve): - (JSC::ASTBuilder::createFunctionExpr): - (JSC::ASTBuilder::createFunctionBody): - (JSC::ASTBuilder::createGetterOrSetterProperty): - (JSC::ASTBuilder::createArgumentsList): - (JSC::ASTBuilder::createPropertyList): - (JSC::ASTBuilder::createFuncDeclStatement): - (JSC::ASTBuilder::createBlockStatement): - (JSC::ASTBuilder::createExprStatement): - (JSC::ASTBuilder::createIfStatement): - (JSC::ASTBuilder::createForLoop): - (JSC::ASTBuilder::createForInLoop): - (JSC::ASTBuilder::createEmptyStatement): - (JSC::ASTBuilder::createVarStatement): - (JSC::ASTBuilder::createReturnStatement): - (JSC::ASTBuilder::createBreakStatement): - (JSC::ASTBuilder::createContinueStatement): - (JSC::ASTBuilder::createTryStatement): - (JSC::ASTBuilder::createSwitchStatement): - (JSC::ASTBuilder::createWhileStatement): - (JSC::ASTBuilder::createDoWhileStatement): - (JSC::ASTBuilder::createLabelStatement): - (JSC::ASTBuilder::createWithStatement): - (JSC::ASTBuilder::createThrowStatement): - (JSC::ASTBuilder::createDebugger): - (JSC::ASTBuilder::createConstStatement): - (JSC::ASTBuilder::appendConstDecl): - (JSC::ASTBuilder::combineCommaNodes): - (JSC::ASTBuilder::appendBinaryOperation): - (JSC::ASTBuilder::createAssignment): - (JSC::ASTBuilder::createNumber): - (JSC::ASTBuilder::makeTypeOfNode): - (JSC::ASTBuilder::makeDeleteNode): - (JSC::ASTBuilder::makeNegateNode): - (JSC::ASTBuilder::makeBitwiseNotNode): - (JSC::ASTBuilder::makeMultNode): - (JSC::ASTBuilder::makeDivNode): - (JSC::ASTBuilder::makeModNode): - (JSC::ASTBuilder::makeAddNode): - (JSC::ASTBuilder::makeSubNode): - (JSC::ASTBuilder::makeLeftShiftNode): - (JSC::ASTBuilder::makeRightShiftNode): - (JSC::ASTBuilder::makeURightShiftNode): - (JSC::ASTBuilder::makeBitOrNode): - (JSC::ASTBuilder::makeBitAndNode): - (JSC::ASTBuilder::makeBitXOrNode): - (JSC::ASTBuilder::makeFunctionCallNode): - (JSC::ASTBuilder::makeBinaryNode): - (JSC::ASTBuilder::makeAssignNode): - (JSC::ASTBuilder::makePrefixNode): - (JSC::ASTBuilder::makePostfixNode): - * parser/Lexer.cpp: - (JSC::::setCode): - (JSC::::internalShift): - (JSC::::shift): - (JSC::::lex): - * parser/Lexer.h: - (Lexer): - (JSC::Lexer::currentColumnNumber): - (JSC::::lexExpectIdentifier): - * parser/NodeConstructors.h: - (JSC::Node::Node): - (JSC::ExpressionNode::ExpressionNode): - (JSC::StatementNode::StatementNode): - (JSC::NullNode::NullNode): - (JSC::BooleanNode::BooleanNode): - (JSC::NumberNode::NumberNode): - (JSC::StringNode::StringNode): - (JSC::RegExpNode::RegExpNode): - (JSC::ThisNode::ThisNode): - (JSC::ResolveNode::ResolveNode): - (JSC::ArrayNode::ArrayNode): - (JSC::PropertyListNode::PropertyListNode): - (JSC::ObjectLiteralNode::ObjectLiteralNode): - (JSC::BracketAccessorNode::BracketAccessorNode): - (JSC::DotAccessorNode::DotAccessorNode): - (JSC::ArgumentListNode::ArgumentListNode): - (JSC::NewExprNode::NewExprNode): - (JSC::EvalFunctionCallNode::EvalFunctionCallNode): - (JSC::FunctionCallValueNode::FunctionCallValueNode): - (JSC::FunctionCallResolveNode::FunctionCallResolveNode): - (JSC::FunctionCallBracketNode::FunctionCallBracketNode): - (JSC::FunctionCallDotNode::FunctionCallDotNode): - (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode): - (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode): - (JSC::PrePostResolveNode::PrePostResolveNode): - (JSC::PostfixResolveNode::PostfixResolveNode): - (JSC::PostfixBracketNode::PostfixBracketNode): - (JSC::PostfixDotNode::PostfixDotNode): - (JSC::PostfixErrorNode::PostfixErrorNode): - (JSC::DeleteResolveNode::DeleteResolveNode): - (JSC::DeleteBracketNode::DeleteBracketNode): - (JSC::DeleteDotNode::DeleteDotNode): - (JSC::DeleteValueNode::DeleteValueNode): - (JSC::VoidNode::VoidNode): - (JSC::TypeOfResolveNode::TypeOfResolveNode): - (JSC::TypeOfValueNode::TypeOfValueNode): - (JSC::PrefixResolveNode::PrefixResolveNode): - (JSC::PrefixBracketNode::PrefixBracketNode): - (JSC::PrefixDotNode::PrefixDotNode): - (JSC::PrefixErrorNode::PrefixErrorNode): - (JSC::UnaryOpNode::UnaryOpNode): - (JSC::UnaryPlusNode::UnaryPlusNode): - (JSC::NegateNode::NegateNode): - (JSC::BitwiseNotNode::BitwiseNotNode): - (JSC::LogicalNotNode::LogicalNotNode): - (JSC::BinaryOpNode::BinaryOpNode): - (JSC::MultNode::MultNode): - (JSC::DivNode::DivNode): - (JSC::ModNode::ModNode): - (JSC::AddNode::AddNode): - (JSC::SubNode::SubNode): - (JSC::LeftShiftNode::LeftShiftNode): - (JSC::RightShiftNode::RightShiftNode): - (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode): - (JSC::LessNode::LessNode): - (JSC::GreaterNode::GreaterNode): - (JSC::LessEqNode::LessEqNode): - (JSC::GreaterEqNode::GreaterEqNode): - (JSC::ThrowableBinaryOpNode::ThrowableBinaryOpNode): - (JSC::InstanceOfNode::InstanceOfNode): - (JSC::InNode::InNode): - (JSC::EqualNode::EqualNode): - (JSC::NotEqualNode::NotEqualNode): - (JSC::StrictEqualNode::StrictEqualNode): - (JSC::NotStrictEqualNode::NotStrictEqualNode): - (JSC::BitAndNode::BitAndNode): - (JSC::BitOrNode::BitOrNode): - (JSC::BitXOrNode::BitXOrNode): - (JSC::LogicalOpNode::LogicalOpNode): - (JSC::ConditionalNode::ConditionalNode): - (JSC::ReadModifyResolveNode::ReadModifyResolveNode): - (JSC::AssignResolveNode::AssignResolveNode): - (JSC::ReadModifyBracketNode::ReadModifyBracketNode): - (JSC::AssignBracketNode::AssignBracketNode): - (JSC::AssignDotNode::AssignDotNode): - (JSC::ReadModifyDotNode::ReadModifyDotNode): - (JSC::AssignErrorNode::AssignErrorNode): - (JSC::CommaNode::CommaNode): - (JSC::ConstStatementNode::ConstStatementNode): - (JSC::EmptyStatementNode::EmptyStatementNode): - (JSC::DebuggerStatementNode::DebuggerStatementNode): - (JSC::ExprStatementNode::ExprStatementNode): - (JSC::VarStatementNode::VarStatementNode): - (JSC::IfNode::IfNode): - (JSC::IfElseNode::IfElseNode): - (JSC::DoWhileNode::DoWhileNode): - (JSC::WhileNode::WhileNode): - (JSC::ForNode::ForNode): - (JSC::ContinueNode::ContinueNode): - (JSC::BreakNode::BreakNode): - (JSC::ReturnNode::ReturnNode): - (JSC::WithNode::WithNode): - (JSC::LabelNode::LabelNode): - (JSC::ThrowNode::ThrowNode): - (JSC::TryNode::TryNode): - (JSC::FuncExprNode::FuncExprNode): - (JSC::FuncDeclNode::FuncDeclNode): - (JSC::SwitchNode::SwitchNode): - (JSC::ConstDeclNode::ConstDeclNode): - (JSC::BlockNode::BlockNode): - (JSC::ForInNode::ForInNode): - * parser/Nodes.cpp: - (JSC::StatementNode::setLoc): - (JSC): - (JSC::ScopeNode::ScopeNode): - (JSC::ProgramNode::ProgramNode): - (JSC::ProgramNode::create): - (JSC::EvalNode::EvalNode): - (JSC::EvalNode::create): - (JSC::FunctionBodyNode::FunctionBodyNode): - (JSC::FunctionBodyNode::create): - * parser/Nodes.h: - (Node): - (JSC::Node::columnNo): - (ExpressionNode): - (StatementNode): - (JSC::StatementNode::column): - (NullNode): - (BooleanNode): - (NumberNode): - (StringNode): - (RegExpNode): - (ThisNode): - (ResolveNode): - (ArrayNode): - (PropertyListNode): - (ObjectLiteralNode): - (BracketAccessorNode): - (DotAccessorNode): - (ArgumentListNode): - (NewExprNode): - (EvalFunctionCallNode): - (FunctionCallValueNode): - (FunctionCallResolveNode): - (FunctionCallBracketNode): - (FunctionCallDotNode): - (CallFunctionCallDotNode): - (ApplyFunctionCallDotNode): - (PrePostResolveNode): - (PostfixResolveNode): - (PostfixBracketNode): - (PostfixDotNode): - (PostfixErrorNode): - (DeleteResolveNode): - (DeleteBracketNode): - (DeleteDotNode): - (DeleteValueNode): - (VoidNode): - (TypeOfResolveNode): - (TypeOfValueNode): - (PrefixResolveNode): - (PrefixBracketNode): - (PrefixDotNode): - (PrefixErrorNode): - (UnaryOpNode): - (UnaryPlusNode): - (NegateNode): - (BitwiseNotNode): - (LogicalNotNode): - (BinaryOpNode): - (MultNode): - (DivNode): - (ModNode): - (AddNode): - (SubNode): - (LeftShiftNode): - (RightShiftNode): - (UnsignedRightShiftNode): - (LessNode): - (GreaterNode): - (LessEqNode): - (GreaterEqNode): - (ThrowableBinaryOpNode): - (InstanceOfNode): - (InNode): - (EqualNode): - (NotEqualNode): - (StrictEqualNode): - (NotStrictEqualNode): - (BitAndNode): - (BitOrNode): - (BitXOrNode): - (LogicalOpNode): - (ConditionalNode): - (ReadModifyResolveNode): - (AssignResolveNode): - (ReadModifyBracketNode): - (AssignBracketNode): - (AssignDotNode): - (ReadModifyDotNode): - (AssignErrorNode): - (CommaNode): - (ConstDeclNode): - (ConstStatementNode): - (BlockNode): - (EmptyStatementNode): - (DebuggerStatementNode): - (ExprStatementNode): - (VarStatementNode): - (IfNode): - (IfElseNode): - (DoWhileNode): - (WhileNode): - (ForNode): - (ForInNode): - (ContinueNode): - (BreakNode): - (ReturnNode): - (WithNode): - (LabelNode): - (ThrowNode): - (TryNode): - (ScopeNode): - (ProgramNode): - (EvalNode): - (FunctionBodyNode): - (FuncExprNode): - (FuncDeclNode): - (SwitchNode): - * parser/Parser.cpp: - (JSC::::parseSourceElements): - (JSC::::parseVarDeclaration): - (JSC::::parseConstDeclaration): - (JSC::::parseDoWhileStatement): - (JSC::::parseWhileStatement): - (JSC::::parseVarDeclarationList): - (JSC::::parseConstDeclarationList): - (JSC::::parseForStatement): - (JSC::::parseBreakStatement): - (JSC::::parseContinueStatement): - (JSC::::parseReturnStatement): - (JSC::::parseThrowStatement): - (JSC::::parseWithStatement): - (JSC::::parseSwitchStatement): - (JSC::::parseTryStatement): - (JSC::::parseDebuggerStatement): - (JSC::::parseBlockStatement): - (JSC::::parseStatement): - (JSC::::parseFunctionBody): - (JSC::::parseFunctionInfo): - (JSC::::parseFunctionDeclaration): - (JSC::::parseExpressionOrLabelStatement): - (JSC::::parseExpressionStatement): - (JSC::::parseIfStatement): - (JSC::::parseExpression): - (JSC::::parseAssignmentExpression): - (JSC::::parseConditionalExpression): - (JSC::::parseBinaryExpression): - (JSC::::parseProperty): - (JSC::::parseObjectLiteral): - (JSC::::parseStrictObjectLiteral): - (JSC::::parseArrayLiteral): - (JSC::::parsePrimaryExpression): - (JSC::::parseArguments): - (JSC::::parseMemberExpression): - (JSC::::parseUnaryExpression): - * parser/Parser.h: - (JSC::Parser::next): - (JSC::Parser::nextExpectIdentifier): - (JSC::Parser::tokenStart): - (JSC::Parser::tokenLine): - (JSC::Parser::tokenEnd): - (JSC::Parser::tokenLocation): - (Parser): - (JSC::Parser::getTokenName): - (JSC::::parse): - * parser/ParserTokens.h: - (JSC::JSTokenLocation::JSTokenLocation): - (JSTokenLocation): - (JSToken): - * parser/SourceProviderCacheItem.h: - (JSC::SourceProviderCacheItem::closeBraceToken): - * parser/SyntaxChecker.h: - (JSC::SyntaxChecker::makeFunctionCallNode): - (JSC::SyntaxChecker::createCommaExpr): - (JSC::SyntaxChecker::makeAssignNode): - (JSC::SyntaxChecker::makePrefixNode): - (JSC::SyntaxChecker::makePostfixNode): - (JSC::SyntaxChecker::makeTypeOfNode): - (JSC::SyntaxChecker::makeDeleteNode): - (JSC::SyntaxChecker::makeNegateNode): - (JSC::SyntaxChecker::makeBitwiseNotNode): - (JSC::SyntaxChecker::createLogicalNot): - (JSC::SyntaxChecker::createUnaryPlus): - (JSC::SyntaxChecker::createVoid): - (JSC::SyntaxChecker::thisExpr): - (JSC::SyntaxChecker::createResolve): - (JSC::SyntaxChecker::createObjectLiteral): - (JSC::SyntaxChecker::createArray): - (JSC::SyntaxChecker::createNumberExpr): - (JSC::SyntaxChecker::createString): - (JSC::SyntaxChecker::createBoolean): - (JSC::SyntaxChecker::createNull): - (JSC::SyntaxChecker::createBracketAccess): - (JSC::SyntaxChecker::createDotAccess): - (JSC::SyntaxChecker::createRegExp): - (JSC::SyntaxChecker::createNewExpr): - (JSC::SyntaxChecker::createConditionalExpr): - (JSC::SyntaxChecker::createAssignResolve): - (JSC::SyntaxChecker::createFunctionExpr): - (JSC::SyntaxChecker::createFunctionBody): - (JSC::SyntaxChecker::createArgumentsList): - (JSC::SyntaxChecker::createPropertyList): - (JSC::SyntaxChecker::createFuncDeclStatement): - (JSC::SyntaxChecker::createBlockStatement): - (JSC::SyntaxChecker::createExprStatement): - (JSC::SyntaxChecker::createIfStatement): - (JSC::SyntaxChecker::createForLoop): - (JSC::SyntaxChecker::createForInLoop): - (JSC::SyntaxChecker::createEmptyStatement): - (JSC::SyntaxChecker::createVarStatement): - (JSC::SyntaxChecker::createReturnStatement): - (JSC::SyntaxChecker::createBreakStatement): - (JSC::SyntaxChecker::createContinueStatement): - (JSC::SyntaxChecker::createTryStatement): - (JSC::SyntaxChecker::createSwitchStatement): - (JSC::SyntaxChecker::createWhileStatement): - (JSC::SyntaxChecker::createWithStatement): - (JSC::SyntaxChecker::createDoWhileStatement): - (JSC::SyntaxChecker::createLabelStatement): - (JSC::SyntaxChecker::createThrowStatement): - (JSC::SyntaxChecker::createDebugger): - (JSC::SyntaxChecker::createConstStatement): - (JSC::SyntaxChecker::appendConstDecl): - (JSC::SyntaxChecker::createGetterOrSetterProperty): - (JSC::SyntaxChecker::combineCommaNodes): - (JSC::SyntaxChecker::operatorStackPop): - -2012-08-01 Filip Pizlo - - DFG should hoist structure checks - https://bugs.webkit.org/show_bug.cgi?id=92696 - - Reviewed by Gavin Barraclough. - - This hoists structure checks in the same way that we would hoist array checks, but with added - complexity to cope with the fact that the structure of an object may change. This is handled - by performing a side effects analysis over the region in which the respective variable is - live. If a structure clobbering side effect may happen then we either hoist the structure - checks and fall back on structure transition watchpoints (if the watchpoint set is still - valid), or we avoid hoisting altogether. - - Doing this required teaching the CFA that we may have an expectation that an object has a - particular structure even after structure clobbering happens, in the sense that structure - proofs that were cobbered can be revived using watchpoints. CFA must know about this so that - OSR entry may know about it, since we cannot allow entry to happen if the variable has a - clobbered structure proof, will have a watchpoint to revive the proof, and the variable in - the baseline JIT has a completely unrelated structure. - - This is mostly performance neutral. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * bytecode/ValueRecovery.h: - (JSC::ValueRecovery::isSet): - (JSC::ValueRecovery::operator!): - (ValueRecovery): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - (JSC::DFG::AbstractState::clobberWorld): - (DFG): - (JSC::DFG::AbstractState::clobberCapturedVars): - * dfg/DFGAbstractState.h: - (AbstractState): - * dfg/DFGAbstractValue.h: - (JSC::DFG::AbstractValue::clear): - (JSC::DFG::AbstractValue::isClear): - (JSC::DFG::AbstractValue::makeTop): - (JSC::DFG::AbstractValue::isTop): - (JSC::DFG::AbstractValue::set): - (JSC::DFG::AbstractValue::operator==): - (JSC::DFG::AbstractValue::merge): - (JSC::DFG::AbstractValue::filter): - (JSC::DFG::AbstractValue::validate): - (JSC::DFG::AbstractValue::validateForEntry): - (AbstractValue): - (JSC::DFG::AbstractValue::checkConsistency): - (JSC::DFG::AbstractValue::dump): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::setLocal): - (JSC::DFG::ByteCodeParser::getArgument): - (JSC::DFG::ByteCodeParser::setArgument): - (JSC::DFG::ByteCodeParser::parseBlock): - (JSC::DFG::ByteCodeParser::fixVariableAccessSpeculations): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::checkStructureLoadElimination): - (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination): - (JSC::DFG::CSEPhase::putStructureStoreElimination): - (JSC::DFG::CSEPhase::getLocalLoadElimination): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGDriver.cpp: - (JSC::DFG::compile): - * dfg/DFGGraph.cpp: - (JSC::DFG::Graph::dump): - * dfg/DFGGraph.h: - (JSC::DFG::Graph::vote): - (Graph): - * dfg/DFGNode.h: - (JSC::DFG::Node::convertToStructureTransitionWatchpoint): - (Node): - (JSC::DFG::Node::hasStructureSet): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGOSREntry.cpp: - (JSC::DFG::prepareOSREntry): - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - (PredictionPropagationPhase): - (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting): - * dfg/DFGSpeculativeJIT.h: - (SpeculativeJIT): - (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck): - (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection): - (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection): - (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand): - (JSC::DFG::SpeculateCellOperand::gpr): - (SpeculateCellOperand): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::fillSpeculateCell): - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::fillSpeculateCell): - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGStructureCheckHoistingPhase.cpp: Added. - (DFG): - (StructureCheckHoistingPhase): - (JSC::DFG::StructureCheckHoistingPhase::StructureCheckHoistingPhase): - (JSC::DFG::StructureCheckHoistingPhase::run): - (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck): - (JSC::DFG::StructureCheckHoistingPhase::noticeClobber): - (JSC::DFG::StructureCheckHoistingPhase::clobber): - (CheckData): - (JSC::DFG::StructureCheckHoistingPhase::CheckData::CheckData): - (JSC::DFG::performStructureCheckHoisting): - * dfg/DFGStructureCheckHoistingPhase.h: Added. - (DFG): - * dfg/DFGVariableAccessData.h: - (VariableAccessData): - (JSC::DFG::VariableAccessData::VariableAccessData): - (JSC::DFG::VariableAccessData::mergeStructureCheckHoistingFailed): - (JSC::DFG::VariableAccessData::structureCheckHoistingFailed): - (JSC::DFG::VariableAccessData::clearVotes): - (JSC::DFG::VariableAccessData::vote): - (JSC::DFG::VariableAccessData::voteRatio): - (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote): - * runtime/Options.h: - (JSC): - -2012-08-01 Filip Pizlo - - DFG should distinguish between PutByVal's that clobber the world and ones that don't - https://bugs.webkit.org/show_bug.cgi?id=92923 - - Reviewed by Mark Hahnenberg. - - This is performance-neutral. I also confirmed that it's neutral if we make the - clobbering variant (PutByValSafe) clobber all knowledge of what is an array, - which should feed nicely into work on removing uses of ClassInfo. - - * bytecode/DFGExitProfile.h: - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::getByValLoadElimination): - (JSC::DFG::CSEPhase::checkStructureLoadElimination): - (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination): - (JSC::DFG::CSEPhase::getByOffsetLoadElimination): - (JSC::DFG::CSEPhase::putByOffsetStoreElimination): - (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination): - (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGFixupPhase.cpp: - (JSC::DFG::FixupPhase::fixupNode): - * dfg/DFGGraph.h: - (JSC::DFG::Graph::byValIsPure): - (JSC::DFG::Graph::clobbersWorld): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - -2012-08-01 Jian Li - - Add new CSS property "-webkit-widget-region" to expose dashboard region support for other port - https://bugs.webkit.org/show_bug.cgi?id=90298 - - Reviewed by Adam Barth. - - * Configurations/FeatureDefines.xcconfig: Add ENABLE_WIDGET_REGION define. - -2012-08-01 Patrick Gansterer - - Replace WTF::getCurrentLocalTime() with GregorianDateTime::setToCurrentLocalTime() - https://bugs.webkit.org/show_bug.cgi?id=92286 - - Reviewed by Geoffrey Garen. - - Add a method to GregorianDateTime to set its values to the current locale time. - Replacing all occurrences of getCurrentLocalTime with the new function allows - us to remove getCurrentLocalTime in a next step. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - -2012-08-01 Mark Hahnenberg - - C++ code should get ClassInfo from the Structure - https://bugs.webkit.org/show_bug.cgi?id=92892 - - Reviewed by Geoffrey Garen. - - In our march to remove ClassInfo from our JSCell object headers, we can switch - C++ code over to grabbing the ClassInfo from the Structure since it is finally - safe to do so now that Structure access is safe during finalization/destruction. - The remaining JIT code changes can be done in a separate patch. - - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::callDestructor): We don't want to clear the Structure any more - since the Structure should still be valid at this point. - * heap/WeakSetInlines.h: - (JSC::WeakBlock::finalize): Ditto. - * runtime/JSCell.h: - (JSC): - * runtime/Structure.h: - (JSC::JSCell::classInfo): Move JSCell's classInfo() to Structure.h so it can be - inline. Use a different method of getting the JSCell's Structure based on - whether we're in GC_VALIDATION mode or not, since always using get() will cause - infinite recursion in GC_VALIDATION mode. - (JSC): - -2012-07-31 Mark Hahnenberg - - MarkedBlock::sweep() should sweep another block if it can't sweep a Structure block - https://bugs.webkit.org/show_bug.cgi?id=92819 - - Reviewed by Geoffrey Garen. - - If we are forced to allocate a new block for Structures because we are unable to safely - sweep our pre-existing Structure blocks, we should sweep another random block so that we - can start sweeping Structure blocks sooner. - - * heap/IncrementalSweeper.cpp: - (JSC::IncrementalSweeper::doSweep): Change to use sweepNextBlock. - (JSC): - (JSC::IncrementalSweeper::sweepNextBlock): - * heap/IncrementalSweeper.h: - (IncrementalSweeper): - * heap/MarkedAllocator.cpp: - (JSC::MarkedAllocator::tryAllocateHelper): When we can't safely sweep - our Structure blocks, call sweepNextBlock instead. - -2012-07-31 Sam Weinig - - Fix the Windows build. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - -2012-07-31 Geoffrey Garen - - Maybe fix the GCC build. - - * heap/HeapBlock.h: - (HeapBlock): Accommodate incorrect parsing in GCC. - -2012-07-31 Sam Weinig - - Stop masking 8 bits off of the visited link hash. We need all the bits! - https://bugs.webkit.org/show_bug.cgi?id=92799 - - Reviewed by Anders Carlsson. - - * runtime/Identifier.cpp: - (JSC::IdentifierCStringTranslator::hash): - (JSC::IdentifierLCharFromUCharTranslator::hash): - * runtime/Identifier.h: - (JSC::IdentifierCharBufferTranslator::hash): - Update for new function names. - -2012-07-31 Geoffrey Garen - - Maybe break the Windows build. - - Reviewed by Anders Carlsson. - - Formally objected to by Sam Weinig. - - * heap/HeapBlock.h: - (HeapBlock): Try to slightly improve this because we don't want Windows to control our lives. - -2012-07-30 Mark Hahnenberg - - Structures should be swept after all other objects - https://bugs.webkit.org/show_bug.cgi?id=92679 - - Reviewed by Filip Pizlo. - - In order to get rid of ClassInfo from our objects, we need to be able to safely get the - ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the - Structure, but currently it is not safe to do so because the order of destruction of objects - is not guaranteed to sweep objects before their corresponding Structure. We can fix this by - sweeping Structures after everything else. - - * heap/Heap.cpp: - (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures. - If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is - safe to sweep structures since we'll always do Structures last anyways due to the ordering of - MarkedSpace::forEachBlock. - (JSC): - (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now - calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out - these pointers after it has invalidated them to prevent accidental use-after-free in the sweep() - calls during lastChanceToFinalize(). - * heap/Heap.h: - (Heap): - * heap/HeapTimer.h: - (HeapTimer): - * heap/IncrementalSweeper.cpp: - (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures. - This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping - the first time. - (JSC): - (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we - make our first pass. We now null out the slots as we sweep them so that we can quickly find the - Structures during the second pass. - (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index. - (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify - the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can - assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock - iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds. - (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index. - * heap/IncrementalSweeper.h: Add declarations for new stuff. - (IncrementalSweeper): - * heap/MarkedAllocator.cpp: - (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and - if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing - the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that - will sweep some number of other blocks in place of the current block to mitigate the cost of the floating - Structure garbage. - (JSC::MarkedAllocator::addBlock): - * heap/MarkedAllocator.h: - (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no - longer valid to allocate from, so we set the current block to null. - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures - at an unsafe time. - * heap/MarkedSpace.cpp: - (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping. - (JSC): - * heap/MarkedSpace.h: - (JSC): - * runtime/JSGlobalData.cpp: - (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown. - -2012-07-31 Geoffrey Garen - - Fix all the other builds I just broke. Maybe fix the Windows build. - - * heap/HeapBlock.h: - (HeapBlock): WTF? - -2012-07-31 Geoffrey Garen - - Maybe fix the Windows build. - - * heap/HeapBlock.h: - (HeapBlock): WTF? - -2012-07-31 Geoffrey Garen - - Maybe fix the Windows build. - - * heap/HeapBlock.h: - (HeapBlock): WTF? - -2012-07-31 Geoffrey Garen - - Removed some public data and casting from the Heap - https://bugs.webkit.org/show_bug.cgi?id=92777 - - Reviewed by Oliver Hunt. - - * heap/BlockAllocator.cpp: - (JSC::BlockAllocator::releaseFreeBlocks): - (JSC::BlockAllocator::blockFreeingThreadMain): Use the DeadBlock class - since HeapBlock is a template, and not a class, now. Call destroy() - instead of monkeying around with DeadBlock's internal data because - encapsulation is good. - - * heap/BlockAllocator.h: - (DeadBlock): Added a class to represent a dead block, since HeapBlock is - a template now, and can't be instantiated directly. - - (JSC::DeadBlock::DeadBlock): - (JSC::DeadBlock::create): - (BlockAllocator): - (JSC::BlockAllocator::allocate): - (JSC::BlockAllocator::deallocate): Use the DeadBlock class because - encapsulation is good. - - * heap/CopiedBlock.h: - (CopiedBlock::destroy): No need for a destroy() function, since we - inherit one now. - - (JSC::CopiedBlock::CopiedBlock): - (JSC::CopiedBlock::payloadEnd): - (JSC::CopiedBlock::capacity): Updated for some encapsulation inside - HeapBlock. - - * heap/CopiedSpace.cpp: - (JSC::CopiedSpace::~CopiedSpace): - (JSC::CopiedSpace::doneCopying): - (JSC::CopiedSpace::size): - (JSC::CopiedSpace::capacity): - (JSC::isBlockListPagedOut): Removed a bunch of casting. This is no longer - necessary, now that our list and its nodes have the right type. - - * heap/CopiedSpace.h: Use the right type in our data structures because - it improves clarity. - - * heap/CopiedSpaceInlineMethods.h: - (JSC::CopiedSpace::startedCopying): Use swap to avoid duplicating it. - - * heap/HeapBlock.h: - (HeapBlock): Made this a class template so we can return the right type - in linked list operations. Made our data private because encapsulation - is good. - - (JSC::HeapBlock::destroy): Since we know our type, we can also eliminate - duplicate destroy() functions in our subclasses. - - (JSC::HeapBlock::allocation): Added an accessor so we can hide our data. - By using const, this accessor prevents clients from accidentally deleting - our allocation. - - * heap/MarkedAllocator.cpp: - (JSC::MarkedAllocator::isPagedOut): - (JSC::MarkedAllocator::tryAllocateHelper): - (JSC::MarkedAllocator::removeBlock): Removed a bunch of casting. This is - no longer necessary, now that our list and its nodes have the right type. - - * heap/MarkedAllocator.h: - (MarkedAllocator): - (JSC::MarkedAllocator::reset): - (JSC::MarkedAllocator::forEachBlock): Use the right type, do less casting. - - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::destroy): Removed this function because our parent - class provides it for us now. - - (JSC::MarkedBlock::MarkedBlock): - * heap/MarkedBlock.h: - (MarkedBlock): - (JSC::MarkedBlock::capacity): Updated for encapsulation. - -2012-07-31 Filip Pizlo - - DFG OSR exit profiling has unusual oversights - https://bugs.webkit.org/show_bug.cgi?id=92728 - - Reviewed by Geoffrey Garen. - - * dfg/DFGOSRExit.cpp: - (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow): - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::speculationWatchpoint): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - -2012-07-31 Chao-ying Fu - - Add MIPS add32 function - https://bugs.webkit.org/show_bug.cgi?id=91522 - - Reviewed by Oliver Hunt. - - Add isCompactPtrAlignedAddressOffset. - Add a new version of add32 that accepts AbsoluteAddress as inputs. - - * assembler/MacroAssemblerMIPS.h: - (JSC::MacroAssemblerMIPS::isCompactPtrAlignedAddressOffset): New. - (MacroAssemblerMIPS): - (JSC::MacroAssemblerMIPS::add32): Support AbsoluteAddress as inputs. - -2012-07-30 Sheriff Bot - - Unreviewed, rolling out r124123. - http://trac.webkit.org/changeset/124123 - https://bugs.webkit.org/show_bug.cgi?id=92700 - - ASSERT crashes terminate webkit Layout tests (Requested by - msaboff on #webkit). - - * heap/Heap.cpp: - * heap/Heap.h: - (Heap): - * heap/IncrementalSweeper.cpp: - (JSC::IncrementalSweeper::doSweep): - (JSC::IncrementalSweeper::startSweeping): - (JSC::IncrementalSweeper::IncrementalSweeper): - (JSC): - * heap/IncrementalSweeper.h: - (IncrementalSweeper): - * heap/MarkedAllocator.cpp: - (JSC::MarkedAllocator::tryAllocateHelper): - (JSC::MarkedAllocator::addBlock): - * heap/MarkedAllocator.h: - (JSC::MarkedAllocator::zapFreeList): - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::sweepHelper): - * heap/MarkedSpace.cpp: - * heap/MarkedSpace.h: - (JSC::MarkedSpace::sweep): - (JSC): - * runtime/JSGlobalData.cpp: - (JSC::JSGlobalData::~JSGlobalData): - -2012-07-30 Mark Hahnenberg - - Structures should be swept after all other objects - https://bugs.webkit.org/show_bug.cgi?id=92679 - - Reviewed by Filip Pizlo. - - In order to get rid of ClassInfo from our objects, we need to be able to safely get the - ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the - Structure, but currently it is not safe to do so because the order of destruction of objects - is not guaranteed to sweep objects before their corresponding Structure. We can fix this by - sweeping Structures after everything else. - - * heap/Heap.cpp: - (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures. - If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is - safe to sweep structures since we'll always do Structures last anyways due to the ordering of - MarkedSpace::forEachBlock. - (JSC): - (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now - calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out - these pointers after it has invalidated them to prevent accidental use-after-free in the sweep() - calls during lastChanceToFinalize(). - * heap/Heap.h: - (Heap): - * heap/HeapTimer.h: - (HeapTimer): - * heap/IncrementalSweeper.cpp: - (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures. - This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping - the first time. - (JSC): - (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we - make our first pass. We now null out the slots as we sweep them so that we can quickly find the - Structures during the second pass. - (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index. - (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify - the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can - assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock - iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds. - (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index. - * heap/IncrementalSweeper.h: Add declarations for new stuff. - (IncrementalSweeper): - * heap/MarkedAllocator.cpp: - (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and - if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing - the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that - will sweep some number of other blocks in place of the current block to mitigate the cost of the floating - Structure garbage. - (JSC::MarkedAllocator::addBlock): - * heap/MarkedAllocator.h: - (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no - longer valid to allocate from, so we set the current block to null. - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures - at an unsafe time. - * heap/MarkedSpace.cpp: - (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping. - (JSC): - * heap/MarkedSpace.h: - (JSC): - * runtime/JSGlobalData.cpp: - (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown. - -2012-07-29 Filip Pizlo - - PropertyNameArray::m_shouldCache is only assigned and never used - https://bugs.webkit.org/show_bug.cgi?id=92598 - - Reviewed by Dan Bernstein. - - * runtime/PropertyNameArray.h: - (JSC::PropertyNameArray::PropertyNameArray): - (PropertyNameArray): - -2012-07-29 Rik Cabanier - - Add ENABLE_CSS_COMPOSITING flag - https://bugs.webkit.org/show_bug.cgi?id=92553 - - Reviewed by Dirk Schulze. - - Adds compiler flag CSS_COMPOSITING to build systems to enable CSS blending and compositing. See spec https://dvcs.w3.org/hg/FXTF/rawfile/tip/compositing/index.html - - * Configurations/FeatureDefines.xcconfig: - -2012-07-27 Mark Hahnenberg - - Split functionality of MarkedAllocator::m_currentBlock - https://bugs.webkit.org/show_bug.cgi?id=92550 - - Reviewed by Filip Pizlo. - - MarkedAllocator::m_currentBlock serves two purposes right now; it indicates the block that is currently - being used for allocation and the beginning of the list of blocks that need to be swept. We should split - these two functionalities into two separate fields. - - * heap/MarkedAllocator.cpp: - (JSC::MarkedAllocator::tryAllocateHelper): Use m_blocksToSweep instead of m_currentBlock as the - initializer/reference of the loop. Only change m_currentBlock when we know what the result will be. - (JSC::MarkedAllocator::addBlock): When we add a new block we know that both m_blocksToSweep and - m_currentBlock are null. In order to preserve the invariant that m_currentBlock <= m_blocksToSweep, - we assign both of them to point to the new block. - (JSC::MarkedAllocator::removeBlock): We need a separate check to see if the block we're removing is - m_blocksToSweep and if so, advance it to the next block in the list. - * heap/MarkedAllocator.h: - (MarkedAllocator): Initialize m_blocksToSweep. - (JSC::MarkedAllocator::MarkedAllocator): - (JSC::MarkedAllocator::reset): We set m_blocksToSweep to be the head of our list. This function is called - at the end of a collection, so all of the blocks in our allocator need to be swept. We need to sweep a - block before we can start allocating, so m_currentBlock is set to null. We also set the freeList to - the empty FreeList to emphasize the fact that we can't start allocating until we do some sweeping. - -2012-07-27 Mark Hahnenberg - - Increase inline storage for JSFinalObjects by one - https://bugs.webkit.org/show_bug.cgi?id=92526 - - Reviewed by Geoffrey Garen. - - Now that we've removed the inheritorID from objects, we can increase our inline storage for JSFinalObjects on - 64-bit platforms by 1. - - * llint/LowLevelInterpreter.asm: Change the constant. - * runtime/PropertyOffset.h: Change the constant. - (JSC): - -2012-07-27 Jer Noble - - Support a rational time class for use by media elements. - https://bugs.webkit.org/show_bug.cgi?id=88787 - - Re-export WTF::MediaTime from JavaScriptCore. - - Reviewed by Eric Carlson. - - * JavaScriptCore.order: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - -2012-07-26 Filip Pizlo - - JSObject::reallocateStorageIfNecessary is neither used nor defined - https://bugs.webkit.org/show_bug.cgi?id=92417 - - Reviewed by Mark Rowe. - - * runtime/JSObject.h: - (JSObject): - -2012-07-26 Mark Hahnenberg - - Allocate Structures in a separate part of the Heap - https://bugs.webkit.org/show_bug.cgi?id=92420 - - Reviewed by Filip Pizlo. - - To fix our issue with destruction/finalization of Structures before their objects, we can move Structures to a separate - part of the Heap that will be swept after all other objects. This first patch will just be separating Structures - out into their own separate MarkedAllocator. Everything else will behave identically. - - * heap/Heap.h: New function to allocate Structures in the Heap. - (Heap): - (JSC): - (JSC::Heap::allocateStructure): - * heap/MarkedAllocator.cpp: Pass whether or not we're allocated Structures to the MarkedBlock. - (JSC::MarkedAllocator::allocateBlock): - * heap/MarkedAllocator.h: Add tracking for whether or not we're allocating only Structures. - (JSC::MarkedAllocator::onlyContainsStructures): - (MarkedAllocator): - (JSC::MarkedAllocator::MarkedAllocator): - (JSC::MarkedAllocator::init): - * heap/MarkedBlock.cpp: Add tracking for whether or not we're allocating only Structures. We need this to be able to - distinguish the various MarkedBlock types in MarkedSpace::allocatorFor(MarkedBlock*). - (JSC::MarkedBlock::create): - (JSC::MarkedBlock::MarkedBlock): - * heap/MarkedBlock.h: - (MarkedBlock): - (JSC::MarkedBlock::onlyContainsStructures): - (JSC): - * heap/MarkedSpace.cpp: Include the new Structure allocator in all the places that all the other allocators are used/modified. - (JSC::MarkedSpace::MarkedSpace): - (JSC::MarkedSpace::resetAllocators): - (JSC::MarkedSpace::canonicalizeCellLivenessData): - (JSC::MarkedSpace::isPagedOut): - * heap/MarkedSpace.h: Add new MarkedAllocator just for Structures. - (MarkedSpace): - (JSC::MarkedSpace::allocatorFor): - (JSC::MarkedSpace::allocateStructure): - (JSC): - (JSC::MarkedSpace::forEachBlock): - * runtime/Structure.h: Move all of the functions that call allocateCell down below the explicit template specialization - for allocateCell. The new inline specialization for allocateCell directly calls the allocateStructure() function in the - Heap. - (Structure): - (JSC::Structure): - (JSC): - (JSC::Structure::create): - (JSC::Structure::createStructure): - -2012-07-26 Filip Pizlo - - JSArray has methods that are neither used nor defined - https://bugs.webkit.org/show_bug.cgi?id=92416 - - Reviewed by Simon Fraser. - - * runtime/JSArray.h: - (JSArray): - -2012-07-26 Zoltan Herczeg - - [Qt][ARM]ARMAssembler needs buildfix afert r123417 - https://bugs.webkit.org/show_bug.cgi?id=92086 - - Reviewed by Csaba Osztrogonác. - - The ARM implementation of this should be optimized code path - is covered by a non-optimized code path. This patch fixes this, - and adds a new function which returns with the offset range. - - * assembler/ARMAssembler.h: - (JSC::ARMAssembler::readPointer): - (ARMAssembler): - (JSC::ARMAssembler::repatchInt32): - (JSC::ARMAssembler::repatchCompact): - * assembler/MacroAssemblerARM.h: - (MacroAssemblerARM): - (JSC::MacroAssemblerARM::isCompactPtrAlignedAddressOffset): - (JSC::MacroAssemblerARM::load32WithCompactAddressOffsetPatch): - -2012-07-25 Mark Hahnenberg - - Build fix for 32-bit after r123682 - - * runtime/JSObject.h: Need to pad out JSObjects on 32-bit so that they're the correct size since - we only removed one 4-byte word and we need to be 8-byte aligned. - (JSObject): - -2012-07-25 Filip Pizlo - - JSC GC object copying APIs should allow for greater flexibility - https://bugs.webkit.org/show_bug.cgi?id=92316 - - Reviewed by Mark Hahnenberg. - - It's now the case that visitChildren() methods can directly pin and allocate in new space during copying. - They can also do the copying and marking themselves. This new API is only used for JSObjects for now. - - * JavaScriptCore.xcodeproj/project.pbxproj: - * heap/MarkStack.cpp: - (JSC::SlotVisitor::allocateNewSpaceSlow): - (JSC::SlotVisitor::allocateNewSpaceOrPin): - (JSC): - (JSC::SlotVisitor::copyAndAppend): - * heap/MarkStack.h: - (MarkStack): - (JSC::MarkStack::appendUnbarrieredValue): - (JSC): - * heap/SlotVisitor.h: - * heap/SlotVisitorInlineMethods.h: Added. - (JSC): - (JSC::SlotVisitor::checkIfShouldCopyAndPinOtherwise): - (JSC::SlotVisitor::allocateNewSpace): - * runtime/JSObject.cpp: - (JSC::JSObject::visitOutOfLineStorage): - (JSC): - (JSC::JSObject::visitChildren): - (JSC::JSFinalObject::visitChildren): - * runtime/JSObject.h: - (JSObject): - -2012-07-25 Mark Hahnenberg - - Remove JSObject::m_inheritorID - https://bugs.webkit.org/show_bug.cgi?id=88378 - - Reviewed by Filip Pizlo. - - This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction), - and most objects don't need an inheritorID (this value is only used if the object is used as a prototype). - Instead use a private named value in the object's property storage. - - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): No need m_inheritorID to initialize! - * jit/JITInlineMethods.h: - (JSC::JIT::emitAllocateBasicJSObject): No need m_inheritorID to initialize! - * llint/LowLevelInterpreter.asm: No need m_inheritorID to initialize! - * runtime/JSGlobalData.h: - (JSGlobalData): Added private name 'm_inheritorIDKey'. - * runtime/JSGlobalThis.cpp: - (JSC::JSGlobalThis::setUnwrappedObject): resetInheritorID is now passed a JSGlobalData&. - * runtime/JSObject.cpp: - (JSC::JSObject::visitChildren): No m_inheritorID to be marked. - (JSC::JSFinalObject::visitChildren): No m_inheritorID to be marked. - (JSC::JSObject::createInheritorID): Store the newly created inheritorID in the property map. Make sure - it's got the DontEnum attribute!! - * runtime/JSObject.h: - (JSObject): - (JSC::JSObject::resetInheritorID): Remove the inheritorID from property storage. - (JSC): - (JSC::JSObject::inheritorID): Read the inheritorID from property storage. - -2012-07-25 Caio Marcelo de Oliveira Filho - - Create a specialized pair for use in HashMap iterators - https://bugs.webkit.org/show_bug.cgi?id=92137 - - Reviewed by Ryosuke Niwa. - - Update a couple of sites that relied on the fact that "contents" of iterators were - std::pairs. - - * profiler/Profile.cpp: - (JSC): This code kept a vector of the pairs that were the "contents" of the iterators. This - is changed to use a KeyValuePair. We make use HashCount's ValueType (which represents only - the key) to get the proper key parameter for KeyValuePair. - * tools/ProfileTreeNode.h: - (ProfileTreeNode): Use HashMap::ValueType to declare the type of the contents of the hash - instead of declaring it manually. This will make use of the new KeyValuePair. - -2012-07-25 Patrick Gansterer - - REGRESSION(r123505): Date.getYear() returns the same as Date.getFullYear() - https://bugs.webkit.org/show_bug.cgi?id=92218 - - Reviewed by Csaba Osztrogonác. - - * runtime/DatePrototype.cpp: - (JSC::dateProtoFuncGetYear): Added the missing offset of 1900 to the return value. - -2012-07-24 Filip Pizlo - - REGRESSION(r123417): It made tests assert/crash on 32 bit - https://bugs.webkit.org/show_bug.cgi?id=92088 - - Reviewed by Mark Hahnenberg. - - The pointer arithmetic was wrong, because negative numbers are hard to think about. - - * dfg/DFGRepatch.cpp: - (JSC::DFG::emitPutTransitionStub): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage): - -2012-07-24 Patrick Gansterer - - Store the full year in GregorianDateTime - https://bugs.webkit.org/show_bug.cgi?id=92067 - - Reviewed by Geoffrey Garen. - - Use the full year instead of the offset from year 1900 - for the year member variable of GregorianDateTime. - - * runtime/DateConstructor.cpp: - (JSC::constructDate): - (JSC::dateUTC): - * runtime/DateConversion.cpp: - (JSC::formatDate): - (JSC::formatDateUTCVariant): - * runtime/DatePrototype.cpp: - (JSC::formatLocaleDate): - (JSC::fillStructuresUsingDateArgs): - (JSC::dateProtoFuncToISOString): - (JSC::dateProtoFuncGetFullYear): - (JSC::dateProtoFuncGetUTCFullYear): - (JSC::dateProtoFuncSetYear): - * runtime/JSDateMath.cpp: - (JSC::gregorianDateTimeToMS): - (JSC::msToGregorianDateTime): - -2012-07-24 Patrick Gansterer - - [WIN] Build fix after r123417. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - -2012-07-23 Patrick Gansterer - - Move GregorianDateTime from JSC to WTF namespace - https://bugs.webkit.org/show_bug.cgi?id=91948 - - Reviewed by Geoffrey Garen. - - Moving GregorianDateTime into the WTF namespace allows us to us to - use it in WebCore too. The new class has the same behaviour as the - old struct. Only the unused timeZone member has been removed. - - * runtime/DateConstructor.cpp: - * runtime/DateConversion.cpp: - * runtime/DateConversion.h: - * runtime/DateInstance.h: - * runtime/DatePrototype.cpp: - * runtime/JSDateMath.cpp: - * runtime/JSDateMath.h: - -2012-07-23 Filip Pizlo - - Property storage should grow in reverse address direction, to support butterflies - https://bugs.webkit.org/show_bug.cgi?id=91788 - - Reviewed by Geoffrey Garen. - - Changes property storage to grow to the left, and changes the property storage pointer to point - one 8-byte word (i.e. JSValue) to the right of the first value in the storage. - - Also improved debug support somewhat, by adding a describe() function to the jsc command-line, - and a slow mode of object access in LLInt. - - * assembler/ARMv7Assembler.h: - (JSC::ARMv7Assembler::repatchCompact): - * assembler/MacroAssemblerARMv7.h: - (MacroAssemblerARMv7): - (JSC::MacroAssemblerARMv7::isCompactPtrAlignedAddressOffset): - (JSC::MacroAssemblerARMv7::load32WithCompactAddressOffsetPatch): - * assembler/MacroAssemblerX86Common.h: - (JSC::MacroAssemblerX86Common::isCompactPtrAlignedAddressOffset): - (JSC::MacroAssemblerX86Common::repatchCompact): - * assembler/X86Assembler.h: - (JSC::X86Assembler::repatchCompact): - * bytecode/CodeBlock.cpp: - (JSC::dumpStructure): - * bytecode/GetByIdStatus.h: - (JSC::GetByIdStatus::GetByIdStatus): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGRepatch.cpp: - (JSC::DFG::tryCacheGetByID): - (JSC::DFG::emitPutTransitionStub): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage): - (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage): - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::callOperation): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * heap/ConservativeRoots.cpp: - (JSC::ConservativeRoots::genericAddPointer): - * heap/CopiedSpace.h: - (CopiedSpace): - * heap/CopiedSpaceInlineMethods.h: - (JSC::CopiedSpace::pinIfNecessary): - (JSC): - * jit/JITPropertyAccess.cpp: - (JSC::JIT::compileGetDirectOffset): - * jit/JITPropertyAccess32_64.cpp: - (JSC::JIT::compileGetDirectOffset): - * jit/JITStubs.cpp: - (JSC::JITThunks::tryCacheGetByID): - * jsc.cpp: - (GlobalObject::finishCreation): - (functionDescribe): - * llint/LLIntCommon.h: - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - * runtime/JSObject.cpp: - (JSC::JSObject::visitChildren): - (JSC::JSFinalObject::visitChildren): - (JSC::JSObject::growOutOfLineStorage): - * runtime/JSObject.h: - (JSC::JSObject::getDirectLocation): - (JSC::JSObject::offsetForLocation): - * runtime/JSValue.h: - (JSValue): - * runtime/PropertyOffset.h: - (JSC::offsetInOutOfLineStorage): - -2012-07-23 Filip Pizlo - - DFG is too aggressive in performing the specific value optimization on loads - https://bugs.webkit.org/show_bug.cgi?id=92034 - - Reviewed by Mark Hahnenberg. - - This ensures that we don't do optimizations based on a structure having a specific - value, if there is no way to detect that the value is despecified. This is the - case for dictionaries, since despecifying a value in a dictionary does not lead to - a transition and so cannot be caught by either structure checks or structure - transition watchpoints. - - * bytecode/GetByIdStatus.cpp: - (JSC::GetByIdStatus::computeFromLLInt): - (JSC::GetByIdStatus::computeForChain): - (JSC::GetByIdStatus::computeFor): - * bytecode/ResolveGlobalStatus.cpp: - (JSC::computeForStructure): - -2012-07-23 Filip Pizlo - - REGRESSION(r123169): It made fast/js/dfg-inline-arguments-use-from-uninlined-code.html fail on 32 bit platforms - https://bugs.webkit.org/show_bug.cgi?id=92002 - - Reviewed by Mark Hahnenberg. - - In the process of changing the nature of local variable typing, I forgot to modify one of the places where - we glue the DFG's notion of variable prediction to the runtime's notion of variable tagging. - - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compile): - -2012-07-23 Simon Fraser - - Part 2 of: Implement sticky positioning - https://bugs.webkit.org/show_bug.cgi?id=90046 - - Reviewed by Ojan Vafai. - - Turn on ENABLE_CSS_STICKY_POSITION. - - * Configurations/FeatureDefines.xcconfig: - -2012-07-23 Patrick Gansterer - - Move JSC::parseDate() from DateConversion to JSDateMath - https://bugs.webkit.org/show_bug.cgi?id=91982 - - Reviewed by Geoffrey Garen. - - Moveing this function into the other files removes the dependency - on JSC spcific classes in DateConversion.{cpp|h}. - - * runtime/DateConversion.cpp: - * runtime/DateConversion.h: - (JSC): - * runtime/JSDateMath.cpp: - (JSC::parseDate): - (JSC): - * runtime/JSDateMath.h: - (JSC): - -2012-07-23 Simon Fraser - - Part 1 of: Implement sticky positioning - https://bugs.webkit.org/show_bug.cgi?id=90046 - - Reviewed by Ojan Vafai. - - Add ENABLE_CSS_STICKY_POSITION, defaulting to off initially. - - Sort the ENABLE_CSS lines in the file. Make sure all the flags - are in FEATURE_DEFINES. - - * Configurations/FeatureDefines.xcconfig: - -2012-07-23 Yong Li - - [BlackBerry] Implement GCActivityCallback with platform timer - https://bugs.webkit.org/show_bug.cgi?id=90175 - - Reviewed by Rob Buis. - - Use JSLock when performing GC to avoid assertions. - - * runtime/GCActivityCallbackBlackBerry.cpp: - (JSC::DefaultGCActivityCallback::doWork): - -2012-07-23 Kent Tamura - - Rename ENABLE_METER_TAG and ENABLE_PROGRESS_TAG to ENABLE_METER_ELEMENT and ENABLE_PROGRESS_ELEMENT respectively - https://bugs.webkit.org/show_bug.cgi?id=91941 - - Reviewed by Kentaro Hara. - - A flag name for an elmement should be ENABLE_*_ELEMENT. - - * Configurations/FeatureDefines.xcconfig: - -2012-07-22 Kent Tamura - - Rename ENABLE_DETAILS to ENABLE_DETAILS_ELEMENT - https://bugs.webkit.org/show_bug.cgi?id=91928 - - Reviewed by Kentaro Hara. - - A flag name for an elmement should be ENABLE_*_ELEMENT. - - * Configurations/FeatureDefines.xcconfig: - -2012-07-21 Patrick Gansterer - - [WIN] Use GetDateFormat and GetTimeFormat instead of strftime - https://bugs.webkit.org/show_bug.cgi?id=83436 - - Reviewed by Brent Fulgham. - - The MS CRT implementation of strftime calls the same two functions. - Using them directly avoids the overhead of parsing the format string and removes - the dependency on strftime() for WinCE where this function does not exist. - - * runtime/DatePrototype.cpp: - (JSC::formatLocaleDate): - -2012-07-20 Kent Tamura - - Rename ENABLE_DATALIST to ENABLE_DATALIST_ELEMENT - https://bugs.webkit.org/show_bug.cgi?id=91846 - - Reviewed by Kentaro Hara. - - A flag name for an elmement should be ENABLE_*_ELEMENT. - - * Configurations/FeatureDefines.xcconfig: - -2012-07-20 Han Shen - - [Chromium] Compilation fails under gcc 4.7 - https://bugs.webkit.org/show_bug.cgi?id=90227 - - Reviewed by Tony Chang. - - Disable warnings about c++0x compatibility in gcc newer than 4.6. - - * JavaScriptCore.gyp/JavaScriptCore.gyp: - -2012-07-18 Filip Pizlo - - DFG cell checks should be hoisted - https://bugs.webkit.org/show_bug.cgi?id=91717 - - Reviewed by Geoffrey Garen. - - The DFG has always had the policy of hoisting array and integer checks to - the point of variable assignment. Eventually, we added doubles and booleans - to the mix. But cells should really be part of this as well, particularly - for 32-bit where accessing a known-type variable is dramatically cheaper - than accessing a variable whose types is only predicted but otherwise - unproven. - - This appears to be a definite speed-up for V8 on 32-bit, a possible speed-up - for Kraken, and a possible slow-down for V8 on 64-bit (around 0.2% if at - all). Any slow-downs can, and should, be addressed by making the hoisting - logic cognizant of variables that are never used in a manner that requires - type checks, and by sinking argument checks to the point(s) of first use. - - To make this work I had to change some OSR machinery, and special-case the - type predictions of the 'this' argument for constructors. OSR exit normally - assumes that arguments are boxed, which happens to be true because the - type prediction used for check hoisting is LUB'd with the type of the - argument that was passed in - so either the arguments are always stored to - with the full tag+payload, or if only the payload is stored then the tag - matches whatever the caller would have set. But not so with the 'this' - argument for constructors, which is not initialized by the caller. We - could make this more precise by having argument types for OSR be inferred - using similar machinery to other locals, but I figured that for this patch - I should use the surgical fix. - - * assembler/MacroAssemblerX86_64.h: - (JSC::MacroAssemblerX86_64::branchTestPtr): - (MacroAssemblerX86_64): - * assembler/X86Assembler.h: - (JSC::X86Assembler::testq_rm): - (X86Assembler): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::initialize): - (JSC::DFG::AbstractState::execute): - * dfg/DFGDriver.cpp: - (JSC::DFG::compile): - * dfg/DFGGraph.h: - (JSC::DFG::Graph::isCreatedThisArgument): - (Graph): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::checkArgumentTypes): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGValueSource.h: - (JSC::DFG::ValueSource::forSpeculation): - -2012-07-19 Filip Pizlo - - Fast path of storage resize should be removed from property storage reallocation, since it is only useful for arrays - https://bugs.webkit.org/show_bug.cgi?id=91796 - - Reviewed by Geoffrey Garen. - - * dfg/DFGRepatch.cpp: - (JSC::DFG::emitPutTransitionStub): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage): - * runtime/JSObject.cpp: - (JSC::JSObject::growOutOfLineStorage): - -2012-07-19 Mark Lam - - Bug fixes and enhancements for OfflineASM annotation system. - https://bugs.webkit.org/show_bug.cgi?id=91690 - - Reviewed by Filip Pizlo. - - * offlineasm/armv7.rb: added default handling of Instruction lower(). - * offlineasm/asm.rb: added more support for annotations and more pretty printing. - * offlineasm/ast.rb: added more support for annotations. - * offlineasm/config.rb: added $preferredCommentStartColumn, simplified $enableInstrAnnotations. - * offlineasm/parser.rb: added more support for annotations. - * offlineasm/transform.rb: added more support for annotations. - * offlineasm/x86.rb: added default handling of Instruction lower(). - -2012-07-19 Patrick Gansterer - - [WIN] Fix compilation of JSGlobalData.h with ENABLE(DFG_JIT) - https://bugs.webkit.org/show_bug.cgi?id=91243 - - Reviewed by Geoffrey Garen. - - Disable MSVC warning 4200 "zero-sized array in struct/union" for JSC::ScratchBuffer. - - * runtime/JSGlobalData.h: - (JSC): - -2012-07-19 Mark Lam - - Fixed broken ENABLE_JIT=0 build. - https://bugs.webkit.org/show_bug.cgi?id=91725 - - Reviewed by Oliver Hunt. - - * bytecode/Watchpoint.cpp: - * heap/JITStubRoutineSet.h: - (JSC): - (JITStubRoutineSet): - (JSC::JITStubRoutineSet::JITStubRoutineSet): - (JSC::JITStubRoutineSet::~JITStubRoutineSet): - (JSC::JITStubRoutineSet::add): - (JSC::JITStubRoutineSet::clearMarks): - (JSC::JITStubRoutineSet::mark): - (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines): - (JSC::JITStubRoutineSet::traceMarkedStubRoutines): - -2012-07-19 Kristóf Kosztyó - - [Qt] Unreviewed buildfix after r123042. - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::dumpRegisters): - -2012-07-18 Filip Pizlo - - DFG should emit inline code for property storage (re)allocation - https://bugs.webkit.org/show_bug.cgi?id=91597 - - Reviewed by Oliver Hunt. - - This adds two new ops to the DFG IR: AllocatePropertyStorage and - ReallocatePropertyStorage. It enables these to interact properly with - CSE so that a GetPropertyStorage on something for which we have - obviously done a (Re)AllocatePropertyStorage will result in the - GetPropertyStorage being eliminated. Other than that, the code - emitted for these ops is identical to the code we were emitting in - the corresponding PutById stub. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::putStructureStoreElimination): - (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination): - * dfg/DFGNode.h: - (JSC::DFG::Node::hasStructureTransitionData): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage): - (DFG): - (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage): - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::callOperation): - (SpeculativeJIT): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * runtime/Structure.cpp: - (JSC::nextOutOfLineStorageCapacity): - * runtime/Structure.h: - (JSC): - -2012-07-16 Oliver Hunt - - dumpCallFrame is broken in ToT - https://bugs.webkit.org/show_bug.cgi?id=91444 - - Reviewed by Gavin Barraclough. - - Various changes have been made to the SF calling convention, but - dumpCallFrame has not been updated to reflect these changes. - That resulted in both bogus information, as well as numerous - assertions of sadness. - - This patch makes dumpCallFrame actually work again and adds the - wonderful feature of telling you the name of the variable that a - register reflects, or what value it contains. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::nameForRegister): - A really innefficient mechanism for finding the name of a local register. - This should only ever be used by debug code so this should be okay. - * bytecode/CodeBlock.h: - (CodeBlock): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::generate): - Debug builds no longer throw away a functions symbol table, this allows - us to actually perform a register# to name mapping - * dfg/DFGJITCompiler.cpp: - (JSC::DFG::JITCompiler::link): - We weren't propogating the bytecode offset here leading to assertions - in debug builds when dumping bytecode of DFG compiled code. - * interpreter/Interpreter.cpp: - (JSC): - (JSC::Interpreter::dumpRegisters): - Rework to actually be correct. - (JSC::getCallerInfo): - Return the byteocde offset as well now, given we have to determine it - anyway. - (JSC::Interpreter::getStackTrace): - (JSC::Interpreter::retrieveCallerFromVMCode): - * interpreter/Interpreter.h: - (Interpreter): - * jsc.cpp: - (GlobalObject::finishCreation): - (functionDumpCallFrame): - Give debug builds of JSC a method for calling dumpCallFrame so we can - inspect a callframe without requiring us to break in a debugger. - -2012-07-18 Filip Pizlo - - DFG 32-bit PutById transition stub storage reallocation case copies the first pointer of each JSValue instead of the whole JSValue - https://bugs.webkit.org/show_bug.cgi?id=91599 - - Reviewed by Geoffrey Garen. - - * dfg/DFGRepatch.cpp: - (JSC::DFG::emitPutTransitionStub): - -2012-07-17 Filip Pizlo - - DFG 32-bit PutById transition stub passes the payload/tag arguments to a DFG operation in the wrong order - https://bugs.webkit.org/show_bug.cgi?id=91576 - - Reviewed by Gavin Barraclough. - - * dfg/DFGRepatch.cpp: - (JSC::DFG::emitPutTransitionStub): - -2012-07-17 Filip Pizlo - - [Qt] REGRESSION(r122768, r122771): They broke jquery/data.html and inspector/elements/edit-dom-actions.html - https://bugs.webkit.org/show_bug.cgi?id=91476 - - Reviewed by Mark Hahnenberg. - - The 32-bit repatching code was not correctly adapted to the new world where there may not always - be an available scratch register. Fixed it by ensuring that the scratch register we select does - not overlap with the value tag. - - * dfg/DFGRepatch.cpp: - (JSC::DFG::generateProtoChainAccessStub): - (JSC::DFG::tryCacheGetByID): - (JSC::DFG::tryBuildGetByIDList): - (JSC::DFG::emitPutReplaceStub): - -2012-07-17 Gabor Rapcsanyi - - Unreviewed buildfix from Zoltan Herczeg after 122768. - - * dfg/DFGCCallHelpers.h: - (JSC::DFG::CCallHelpers::setupArgumentsWithExecState): - (CCallHelpers): - -2012-07-17 David Barr - - Introduce ENABLE_CSS_IMAGE_ORIENTATION compile flag - https://bugs.webkit.org/show_bug.cgi?id=89055 - - Reviewed by Kent Tamura. - - The css3-images module is at candidate recommendation. - http://www.w3.org/TR/2012/CR-css3-images-20120417/#the-image-orientation - - Add a configuration option for CSS image-orientation support, disabling it by default. - - * Configurations/FeatureDefines.xcconfig: - -2012-07-16 Filip Pizlo - - Unreviewed, roll out 122790 because it broke the Windows build. I'm not - sure what to do with exported symbols that are predicated on NDEBUG. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - * bytecode/CodeBlock.cpp: - (JSC): - * bytecode/CodeBlock.h: - (CodeBlock): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::generate): - * dfg/DFGJITCompiler.cpp: - (JSC::DFG::JITCompiler::link): - * interpreter/Interpreter.cpp: - (JSC): - (JSC::Interpreter::dumpRegisters): - (JSC::getCallerInfo): - (JSC::Interpreter::getStackTrace): - (JSC::Interpreter::retrieveCallerFromVMCode): - * interpreter/Interpreter.h: - (Interpreter): - * jsc.cpp: - (GlobalObject::finishCreation): - -2012-07-16 Oliver Hunt - - dumpCallFrame is broken in ToT - https://bugs.webkit.org/show_bug.cgi?id=91444 - - Reviewed by Gavin Barraclough. - - Various changes have been made to the SF calling convention, but - dumpCallFrame has not been updated to reflect these changes. - That resulted in both bogus information, as well as numerous - assertions of sadness. - - This patch makes dumpCallFrame actually work again and adds the - wonderful feature of telling you the name of the variable that a - register reflects, or what value it contains. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::nameForRegister): - A really innefficient mechanism for finding the name of a local register. - This should only ever be used by debug code so this should be okay. - * bytecode/CodeBlock.h: - (CodeBlock): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::generate): - Debug builds no longer throw away a functions symbol table, this allows - us to actually perform a register# to name mapping - * dfg/DFGJITCompiler.cpp: - (JSC::DFG::JITCompiler::link): - We weren't propogating the bytecode offset here leading to assertions - in debug builds when dumping bytecode of DFG compiled code. - * interpreter/Interpreter.cpp: - (JSC): - (JSC::Interpreter::dumpRegisters): - Rework to actually be correct. - (JSC::getCallerInfo): - Return the byteocde offset as well now, given we have to determine it - anyway. - (JSC::Interpreter::getStackTrace): - (JSC::Interpreter::retrieveCallerFromVMCode): - * interpreter/Interpreter.h: - (Interpreter): - * jsc.cpp: - (GlobalObject::finishCreation): - (functionDumpCallFrame): - Give debug builds of JSC a method for calling dumpCallFrame so we can - inspect a callframe without requiring us to break in a debugger. - -2012-07-16 Filip Pizlo - - Unreviewed, adding forgotten files. - - * dfg/DFGRegisterSet.h: Added. - (DFG): - (RegisterSet): - (JSC::DFG::RegisterSet::RegisterSet): - (JSC::DFG::RegisterSet::asPOD): - (JSC::DFG::RegisterSet::copyInfo): - (JSC::DFG::RegisterSet::set): - (JSC::DFG::RegisterSet::setGPRByIndex): - (JSC::DFG::RegisterSet::clear): - (JSC::DFG::RegisterSet::get): - (JSC::DFG::RegisterSet::getGPRByIndex): - (JSC::DFG::RegisterSet::getFreeGPR): - (JSC::DFG::RegisterSet::setFPRByIndex): - (JSC::DFG::RegisterSet::getFPRByIndex): - (JSC::DFG::RegisterSet::setByIndex): - (JSC::DFG::RegisterSet::getByIndex): - (JSC::DFG::RegisterSet::numberOfSetGPRs): - (JSC::DFG::RegisterSet::numberOfSetFPRs): - (JSC::DFG::RegisterSet::numberOfSetRegisters): - (JSC::DFG::RegisterSet::setBit): - (JSC::DFG::RegisterSet::clearBit): - (JSC::DFG::RegisterSet::getBit): - * dfg/DFGScratchRegisterAllocator.h: Added. - (DFG): - (ScratchRegisterAllocator): - (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator): - (JSC::DFG::ScratchRegisterAllocator::lock): - (JSC::DFG::ScratchRegisterAllocator::allocateScratch): - (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR): - (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR): - (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters): - (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing): - (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping): - (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize): - (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer): - (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer): - -2012-07-15 Filip Pizlo - - DFG PutById transition should handle storage allocation, and inline it - https://bugs.webkit.org/show_bug.cgi?id=91337 - - Reviewed by Oliver Hunt. - - This enables the patching of DFG PutById to handle the out-of-line storage - allocation case. Furthermore, it inlines out-of-line storage allocation (and - reallocation) into the generated stubs. - - To do this, this patch adds the ability to store the relevant register - allocation state (i.e. the set of in-use registers) in the structure stub - info so that the stub generation code can more flexibly select scratch - registers: sometimes it needs none, sometimes one - or sometimes up to - three. Moreover, to make the stub generation register allocation simple and - maintainable, this patch introduces a reusable scratch register allocator - class. This register allocator understands that some registers are in use by - the main path code and so must be spilled as necessary, other registers are - locked for use in the stub itself and so cannot even be spilled, while still - others may be allocated for scratch purposes. A scratch register that is - used must be spilled. If a register is locked, it cannot be used as a - scratch register. If a register is used, it can be used as a scratch - register so long as it is spilled. - - This is a sub-1% speed-up on V8 and neutral elsewhere. - - * GNUmakefile.list.am: - * JavaScriptCore.xcodeproj/project.pbxproj: - * assembler/MacroAssemblerCodeRef.h: - (FunctionPtr): - (JSC::FunctionPtr::FunctionPtr): - * bytecode/StructureStubInfo.h: - * dfg/DFGCCallHelpers.h: - (JSC::DFG::CCallHelpers::setupArgumentsWithExecState): - (CCallHelpers): - * dfg/DFGGPRInfo.h: - * dfg/DFGJITCompiler.cpp: - (JSC::DFG::JITCompiler::link): - * dfg/DFGJITCompiler.h: - (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord): - (PropertyAccessRecord): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGRegisterBank.h: - (JSC::DFG::RegisterBank::isInUse): - (RegisterBank): - * dfg/DFGRegisterSet.h: Added. - (DFG): - (RegisterSet): - (JSC::DFG::RegisterSet::RegisterSet): - (JSC::DFG::RegisterSet::asPOD): - (JSC::DFG::RegisterSet::copyInfo): - (JSC::DFG::RegisterSet::set): - (JSC::DFG::RegisterSet::setGPRByIndex): - (JSC::DFG::RegisterSet::clear): - (JSC::DFG::RegisterSet::get): - (JSC::DFG::RegisterSet::getGPRByIndex): - (JSC::DFG::RegisterSet::getFreeGPR): - (JSC::DFG::RegisterSet::setFPRByIndex): - (JSC::DFG::RegisterSet::getFPRByIndex): - (JSC::DFG::RegisterSet::setByIndex): - (JSC::DFG::RegisterSet::getByIndex): - (JSC::DFG::RegisterSet::numberOfSetGPRs): - (JSC::DFG::RegisterSet::numberOfSetFPRs): - (JSC::DFG::RegisterSet::numberOfSetRegisters): - (JSC::DFG::RegisterSet::setBit): - (JSC::DFG::RegisterSet::clearBit): - (JSC::DFG::RegisterSet::getBit): - * dfg/DFGRepatch.cpp: - (JSC::DFG::generateProtoChainAccessStub): - (JSC::DFG::tryCacheGetByID): - (JSC::DFG::tryBuildGetByIDList): - (JSC::DFG::emitPutReplaceStub): - (JSC::DFG::emitPutTransitionStub): - (JSC::DFG::tryCachePutByID): - (JSC::DFG::tryBuildPutByIdList): - * dfg/DFGScratchRegisterAllocator.h: Added. - (DFG): - (ScratchRegisterAllocator): - (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator): - (JSC::DFG::ScratchRegisterAllocator::lock): - (JSC::DFG::ScratchRegisterAllocator::allocateScratch): - (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR): - (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR): - (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters): - (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing): - (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping): - (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize): - (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer): - (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer): - * dfg/DFGSpeculativeJIT.h: - (SpeculativeJIT): - (JSC::DFG::SpeculativeJIT::usedRegisters): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::cachedGetById): - (JSC::DFG::SpeculativeJIT::cachedPutById): - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::cachedGetById): - (JSC::DFG::SpeculativeJIT::cachedPutById): - (JSC::DFG::SpeculativeJIT::compile): - * heap/CopiedAllocator.h: - (CopiedAllocator): - (JSC::CopiedAllocator::fastPathShouldSucceed): - (JSC): - -2012-07-16 Patrick Gansterer - - Add dfg switch to create_jit_stubs script - https://bugs.webkit.org/show_bug.cgi?id=91256 - - Reviewed by Geoffrey Garen. - - * create_jit_stubs: Add a switch to enable or disable the generation of - stub functions in #if ENABLE(DFG_JIT) conditions. - -2012-07-16 Gabor Rapcsanyi - - Unreviewed buildfix after r122729. Typo fix. - - * assembler/MacroAssemblerARM.h: - (JSC::MacroAssemblerARM::add32): - -2012-07-16 Gabor Rapcsanyi - - Unreviewed buildfix from Zoltan Herczeg after r122677. - Implement missing add32 function to MacroAssemblerARM. - - * assembler/MacroAssemblerARM.h: - (JSC::MacroAssemblerARM::add32): - (MacroAssemblerARM): - -2012-07-14 Filip Pizlo - - DFG PutByVal opcodes should accept more than 3 operands - https://bugs.webkit.org/show_bug.cgi?id=91332 - - Reviewed by Oliver Hunt. - - Turned PutByVal/PutByValAlias into var-arg nodes, so that we can give them - 4 or more operands in the future. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::getByValLoadElimination): - (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGFixupPhase.cpp: - (JSC::DFG::FixupPhase::fixupNode): - (JSC::DFG::FixupPhase::fixDoubleEdge): - * dfg/DFGGraph.h: - (JSC::DFG::Graph::byValIsPure): - (JSC::DFG::Graph::varArgNumChildren): - (Graph): - (JSC::DFG::Graph::numChildren): - (JSC::DFG::Graph::varArgChild): - (JSC::DFG::Graph::child): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): - (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - -2012-07-14 Filip Pizlo - - Rationalize and optimize storage allocation - https://bugs.webkit.org/show_bug.cgi?id=91303 - - Reviewed by Oliver Hunt. - - This implements a backwards bump allocator for copied space storage - allocation, shown in pseudo-code below: - - pointer bump(size) { - pointer tmp = allocator->remaining; - tmp -= size; - if (tmp < 0) - fail; - allocator->remaining = tmp; - return allocator->payloadEnd - tmp - size; - } - - The advantage of this allocator is that it: - - - Only requires one comparison in the common case where size is known to - not be huge, and this comparison can be done by checking the sign bit - of the subtraction. - - - Can be implemented even when only one register is available. This - register is reused for both temporary storage during allocation and - for the result. - - - Preserves the behavior that memory in a block is filled in from lowest - address to highest address, which allows for a cheap reallocation fast - path. - - - Is resilient against the block used for allocation being the last one - in virtual memory, thereby otherwise leading to the risk of overflow - in the bump pointer, despite only doing one branch. - - In order to implement this allocator using the smallest possible chunk - of code, I refactored the copied space code so that all of the allocation - logic is in CopiedAllocator, and all of the state is in either - CopiedBlock or CopiedAllocator. This should make changing the allocation - fast path easier in the future. - - In order to do this, I needed to add some new assembler support, - particularly for various forms of add(address, register) and negPtr(). - - This is performance neutral. The purpose of this change is to facilitate - further inlining of storage allocation without having to reserve - additional registers or emit too much code. - - * assembler/MacroAssembler.h: - (JSC::MacroAssembler::addPtr): - (MacroAssembler): - (JSC::MacroAssembler::negPtr): - * assembler/MacroAssemblerARMv7.h: - (MacroAssemblerARMv7): - (JSC::MacroAssemblerARMv7::add32): - * assembler/MacroAssemblerX86.h: - (JSC::MacroAssemblerX86::add32): - (MacroAssemblerX86): - * assembler/MacroAssemblerX86_64.h: - (MacroAssemblerX86_64): - (JSC::MacroAssemblerX86_64::addPtr): - (JSC::MacroAssemblerX86_64::negPtr): - * assembler/X86Assembler.h: - (X86Assembler): - (JSC::X86Assembler::addl_mr): - (JSC::X86Assembler::addq_mr): - (JSC::X86Assembler::negq_r): - * heap/CopiedAllocator.h: - (CopiedAllocator): - (JSC::CopiedAllocator::isValid): - (JSC::CopiedAllocator::CopiedAllocator): - (JSC::CopiedAllocator::tryAllocate): - (JSC): - (JSC::CopiedAllocator::tryReallocate): - (JSC::CopiedAllocator::forceAllocate): - (JSC::CopiedAllocator::resetCurrentBlock): - (JSC::CopiedAllocator::setCurrentBlock): - (JSC::CopiedAllocator::currentCapacity): - * heap/CopiedBlock.h: - (CopiedBlock): - (JSC::CopiedBlock::create): - (JSC::CopiedBlock::zeroFillWilderness): - (JSC::CopiedBlock::CopiedBlock): - (JSC::CopiedBlock::payloadEnd): - (JSC): - (JSC::CopiedBlock::payloadCapacity): - (JSC::CopiedBlock::data): - (JSC::CopiedBlock::dataEnd): - (JSC::CopiedBlock::dataSize): - (JSC::CopiedBlock::wilderness): - (JSC::CopiedBlock::wildernessEnd): - (JSC::CopiedBlock::wildernessSize): - (JSC::CopiedBlock::size): - * heap/CopiedSpace.cpp: - (JSC::CopiedSpace::tryAllocateSlowCase): - (JSC::CopiedSpace::tryAllocateOversize): - (JSC::CopiedSpace::tryReallocate): - (JSC::CopiedSpace::doneFillingBlock): - (JSC::CopiedSpace::doneCopying): - * heap/CopiedSpace.h: - (CopiedSpace): - * heap/CopiedSpaceInlineMethods.h: - (JSC::CopiedSpace::startedCopying): - (JSC::CopiedSpace::allocateBlockForCopyingPhase): - (JSC::CopiedSpace::allocateBlock): - (JSC::CopiedSpace::tryAllocate): - (JSC): - * heap/MarkStack.cpp: - (JSC::SlotVisitor::startCopying): - (JSC::SlotVisitor::allocateNewSpace): - (JSC::SlotVisitor::doneCopying): - * heap/SlotVisitor.h: - (JSC::SlotVisitor::SlotVisitor): - * jit/JIT.h: - * jit/JITInlineMethods.h: - (JSC::JIT::emitAllocateBasicStorage): - (JSC::JIT::emitAllocateJSArray): - -2012-07-13 Mark Lam - - OfflineASM Pretty printing and commenting enhancements. - https://bugs.webkit.org/show_bug.cgi?id=91281 - - Reviewed by Filip Pizlo. - - Added some minor pretty printing in the OfflineASM. - Also added infrastruture for adding multiple types of comments and - annotations with the ability to enable/disable them in the generated - output as desired. - - * GNUmakefile.list.am: add new file config.rb. - * llint/LLIntOfflineAsmConfig.h: - Added OFFLINE_ASM_BEGIN, OFFLINE_ASM_END, and OFFLINE_ASM_LOCAL_LABEL macros. - This will allow us to redefine these for other backends later. - * llint/LowLevelInterpreter32_64.asm: - Add a small example of instruction annotations for now. - * llint/LowLevelInterpreter64.asm: - Add a small example of instruction annotations for now. - * offlineasm/armv7.rb: Added handling of annotations. - * offlineasm/asm.rb: - Added machinery to dump the new comments and annotations. - Also added some indentations to make the output a little prettier. - * offlineasm/ast.rb: Added annotation field in class Instruction. - * offlineasm/backends.rb: - * offlineasm/config.rb: Added. - Currently only contains commenting options. This file is meant to be - a centralized place for build config values much like config.h for - JavaScriptCore. - * offlineasm/generate_offset_extractor.rb: - * offlineasm/instructions.rb: - * offlineasm/offsets.rb: - * offlineasm/opt.rb: - * offlineasm/parser.rb: Parse and record annotations. - * offlineasm/registers.rb: - * offlineasm/self_hash.rb: - * offlineasm/settings.rb: - * offlineasm/transform.rb: - * offlineasm/x86.rb: Added handling of annotations. - -2012-07-13 Filip Pizlo - - ASSERTION FAILED: use.useKind() != DoubleUse - https://bugs.webkit.org/show_bug.cgi?id=91082 - - Reviewed by Geoffrey Garen. - - The implementation of Branch() was unwisely relying on register allocation state - to decide what speculations to perform. That's never correct. - - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - -2012-07-13 Sheriff Bot - - Unreviewed, rolling out r122640. - http://trac.webkit.org/changeset/122640 - https://bugs.webkit.org/show_bug.cgi?id=91298 - - LLInt apparently does not expect to mark these (Requested by - olliej on #webkit). - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::visitStructures): - (JSC::CodeBlock::stronglyVisitStrongReferences): - -2012-07-13 Oliver Hunt - - LLInt fails to mark structures stored in the bytecode - https://bugs.webkit.org/show_bug.cgi?id=91296 - - Reviewed by Geoffrey Garen. - - LLInt stores structures in the bytecode, so we need to visit the appropriate - instructions as we would if we were running in the classic interpreter. - This requires adding additional checks for the LLInt specific opcodes, and - the lint specific variants of operand ordering. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::visitStructures): - (JSC::CodeBlock::stronglyVisitStrongReferences): - -2012-07-13 Yong Li - - [BlackBerry] Implement GCActivityCallback with platform timer - https://bugs.webkit.org/show_bug.cgi?id=90175 - - Reviewed by Rob Buis. - - Implement GCActivityCallback and HeapTimer for BlackBerry port. - - * heap/HeapTimer.cpp: - (JSC): - (JSC::HeapTimer::HeapTimer): - (JSC::HeapTimer::~HeapTimer): - (JSC::HeapTimer::timerDidFire): - (JSC::HeapTimer::synchronize): - (JSC::HeapTimer::invalidate): - (JSC::HeapTimer::didStartVMShutdown): - * heap/HeapTimer.h: - (HeapTimer): - * runtime/GCActivityCallbackBlackBerry.cpp: - (JSC): - (JSC::DefaultGCActivityCallback::doWork): - (JSC::DefaultGCActivityCallback::didAllocate): - (JSC::DefaultGCActivityCallback::willCollect): - (JSC::DefaultGCActivityCallback::cancel): - -2012-07-13 Patrick Gansterer - - [WIN] Fix compilation of DFGRepatch.cpp - https://bugs.webkit.org/show_bug.cgi?id=91241 - - Reviewed by Geoffrey Garen. - - Use intptr_t instead of uintptr_t when calling CodeLocationCommon::dataLabelPtrAtOffset(int) - to fix MSVC "unary minus operator applied to unsigned type, result still unsigned" warning. - - * dfg/DFGRepatch.cpp: - (JSC::DFG::dfgResetGetByID): - (JSC::DFG::dfgResetPutByID): - -2012-07-13 Patrick Gansterer - - Fix ARM_TRADITIONAL JIT for COMPILER(MSVC) and COMPILER(RVCT) after r121885 - https://bugs.webkit.org/show_bug.cgi?id=91238 - - Reviewed by Zoltan Herczeg. - - r121885 changed the assembler instruction only for COMPILER(GCC). - Use the same instructions for the other compilers too. - - * jit/JITStubs.cpp: - (JSC::ctiTrampoline): - (JSC::ctiTrampolineEnd): - (JSC::ctiVMThrowTrampoline): - -2012-07-12 Filip Pizlo - - DFG property access stubs should use structure transition watchpoints - https://bugs.webkit.org/show_bug.cgi?id=91135 - - Reviewed by Geoffrey Garen. - - This adds a Watchpoint subclass that will clear a structure stub (i.e. - a property access stub) when fired. The DFG stub generation code now - uses this optimization. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * bytecode/CodeBlock.cpp: - (JSC): - (JSC::CodeBlock::finalizeUnconditionally): - (JSC::CodeBlock::resetStub): - (JSC::CodeBlock::resetStubInternal): - * bytecode/CodeBlock.h: - (JSC): - (CodeBlock): - * bytecode/StructureStubClearingWatchpoint.cpp: Added. - (JSC): - (JSC::StructureStubClearingWatchpoint::~StructureStubClearingWatchpoint): - (JSC::StructureStubClearingWatchpoint::push): - (JSC::StructureStubClearingWatchpoint::fireInternal): - (JSC::WatchpointsOnStructureStubInfo::~WatchpointsOnStructureStubInfo): - (JSC::WatchpointsOnStructureStubInfo::addWatchpoint): - (JSC::WatchpointsOnStructureStubInfo::ensureReferenceAndAddWatchpoint): - * bytecode/StructureStubClearingWatchpoint.h: Added. - (JSC): - (StructureStubClearingWatchpoint): - (JSC::StructureStubClearingWatchpoint::StructureStubClearingWatchpoint): - (WatchpointsOnStructureStubInfo): - (JSC::WatchpointsOnStructureStubInfo::WatchpointsOnStructureStubInfo): - (JSC::WatchpointsOnStructureStubInfo::codeBlock): - (JSC::WatchpointsOnStructureStubInfo::stubInfo): - * bytecode/StructureStubInfo.h: - (JSC::StructureStubInfo::reset): - (JSC::StructureStubInfo::addWatchpoint): - (StructureStubInfo): - * dfg/DFGRepatch.cpp: - (JSC::DFG::addStructureTransitionCheck): - (DFG): - (JSC::DFG::generateProtoChainAccessStub): - (JSC::DFG::emitPutTransitionStub): - * jit/JumpReplacementWatchpoint.h: - -2012-07-12 Filip Pizlo - - DFG CFA may get overzealous in loops that have code that must exit - https://bugs.webkit.org/show_bug.cgi?id=91188 - - Reviewed by Gavin Barraclough. - - Ensure that if the CFA assumes that an operation must exit, then it will always exit - no matter what happens after. That's necessary to preserve soundness. - - Remove a broken fixup done by the DFG simplifier, where it was trying to say that the - variable-at-head was the first access in the second block in the merge, if the first - block did not read the variable. That's totally wrong, if the first block was in fact - doing a phantom read. I removed that fixup and instead hardened the rest of the - compiler. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::endBasicBlock): - * dfg/DFGBasicBlock.h: - (JSC::DFG::BasicBlock::BasicBlock): - (BasicBlock): - * dfg/DFGCFAPhase.cpp: - (JSC::DFG::CFAPhase::performBlockCFA): - * dfg/DFGCFGSimplificationPhase.cpp: - (JSC::DFG::CFGSimplificationPhase::mergeBlocks): - * dfg/DFGConstantFoldingPhase.cpp: - (JSC::DFG::ConstantFoldingPhase::ConstantFoldingPhase): - (JSC::DFG::ConstantFoldingPhase::run): - (ConstantFoldingPhase): - (JSC::DFG::ConstantFoldingPhase::foldConstants): - (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode): - * dfg/DFGVariableEventStream.cpp: - (JSC::DFG::VariableEventStream::reconstruct): - -2012-07-12 Allan Sandfeld Jensen - - [Qt] Implement MemoryUsageSupport - https://bugs.webkit.org/show_bug.cgi?id=91094 - - Reviewed by Adam Barth. - - Compile in MemoryStatistics so we can make use of the interface. - - * Target.pri: - -2012-07-12 Csaba Osztrogonác - - Remove dead code after r122392. - https://bugs.webkit.org/show_bug.cgi?id=91049 - - Reviewed by Filip Pizlo. - - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::emitCall): - -2012-07-11 Adenilson Cavalcanti - - Build fix + remove dead code - https://bugs.webkit.org/show_bug.cgi?id=91039 - - Reviewed by Filip Pizlo. - - An unused variable was breaking compilation (thanks to warnings being treated as errors). - - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::emitCall): - -2012-07-11 Mark Rowe - - Build against the latest SDK when targeting older OS X versions. - - Reviewed by Dan Bernstein. - - The deployment target is already set to the version that we're targeting, and it's that setting - which determines which functionality from the SDK is available to us. - - * Configurations/Base.xcconfig: - -2012-07-11 Filip Pizlo - - DFG should have fast virtual calls - https://bugs.webkit.org/show_bug.cgi?id=90924 - - Reviewed by Gavin Barraclough. - - Implements virtual call support in the style of the old JIT, with the - caveat that we still use the same slow path for both InternalFunction - calls and JSFunction calls. Also rationalized the way that our - CodeOrigin indices tie into exception checks (previously it was a - strange one-to-one mapping with fairly limited assertions; now it's a - one-to-many mapping for CodeOrigins to exception checks, respectively). - I also took the opportunity to clean up - CallLinkInfo::callReturnLocation, which previously was either a Call or - a NearCall. Now it's just a NearCall. As well, exceptions during slow - path call resolution are now handled by returning an exception throwing - thunk rather than returning null. And finally, I made a few things - public that were previously private-with-lots-of-friends, because I - truly despise the thought of listing each thunk generating function as - a friend of JSValue and friends. - - * bytecode/CallLinkInfo.cpp: - (JSC::CallLinkInfo::unlink): - * bytecode/CallLinkInfo.h: - (CallLinkInfo): - * bytecode/CodeOrigin.h: - (JSC::CodeOrigin::CodeOrigin): - (JSC::CodeOrigin::isSet): - * dfg/DFGAssemblyHelpers.h: - (JSC::DFG::AssemblyHelpers::AssemblyHelpers): - * dfg/DFGCCallHelpers.h: - (JSC::DFG::CCallHelpers::CCallHelpers): - * dfg/DFGGPRInfo.h: - (GPRInfo): - * dfg/DFGJITCompiler.cpp: - (JSC::DFG::JITCompiler::link): - (JSC::DFG::JITCompiler::compileFunction): - * dfg/DFGJITCompiler.h: - (JSC::DFG::CallBeginToken::CallBeginToken): - (JSC::DFG::CallBeginToken::~CallBeginToken): - (CallBeginToken): - (JSC::DFG::CallBeginToken::set): - (JSC::DFG::CallBeginToken::registerWithExceptionCheck): - (JSC::DFG::CallBeginToken::codeOrigin): - (JSC::DFG::CallExceptionRecord::CallExceptionRecord): - (CallExceptionRecord): - (JSC::DFG::JITCompiler::currentCodeOriginIndex): - (JITCompiler): - (JSC::DFG::JITCompiler::beginCall): - (JSC::DFG::JITCompiler::notifyCall): - (JSC::DFG::JITCompiler::prepareForExceptionCheck): - (JSC::DFG::JITCompiler::addExceptionCheck): - (JSC::DFG::JITCompiler::addFastExceptionCheck): - * dfg/DFGOperations.cpp: - * dfg/DFGRepatch.cpp: - (JSC::DFG::dfgLinkFor): - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::emitCall): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::emitCall): - * dfg/DFGThunks.cpp: - (JSC::DFG::emitPointerValidation): - (DFG): - (JSC::DFG::throwExceptionFromCallSlowPathGenerator): - (JSC::DFG::slowPathFor): - (JSC::DFG::linkForThunkGenerator): - (JSC::DFG::linkCallThunkGenerator): - (JSC::DFG::linkConstructThunkGenerator): - (JSC::DFG::virtualForThunkGenerator): - (JSC::DFG::virtualCallThunkGenerator): - (JSC::DFG::virtualConstructThunkGenerator): - * dfg/DFGThunks.h: - (DFG): - * jit/JIT.cpp: - (JSC::JIT::privateCompile): - (JSC::JIT::linkFor): - * runtime/Executable.h: - (ExecutableBase): - (JSC::ExecutableBase::offsetOfJITCodeFor): - (JSC::ExecutableBase::offsetOfNumParametersFor): - * runtime/JSValue.h: - (JSValue): - -2012-07-11 Filip Pizlo - - Accidentally used the wrong license (3-clause instead of 2-clause) in some - files I just committed. - - Rubber stamped by Oliver Hunt. - - * bytecode/Watchpoint.cpp: - * bytecode/Watchpoint.h: - * jit/JumpReplacementWatchpoint.cpp: - * jit/JumpReplacementWatchpoint.h: - -2012-07-11 Filip Pizlo - - Watchpoints and jump replacement should be decoupled - https://bugs.webkit.org/show_bug.cgi?id=91016 - - Reviewed by Oliver Hunt. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * assembler/AbstractMacroAssembler.h: - (JSC): - (Label): - * bytecode/CodeBlock.h: - (JSC::CodeBlock::appendWatchpoint): - (JSC::CodeBlock::watchpoint): - (DFGData): - * bytecode/Watchpoint.cpp: - (JSC): - * bytecode/Watchpoint.h: - (JSC::Watchpoint::Watchpoint): - (Watchpoint): - (JSC::Watchpoint::fire): - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::speculationWatchpoint): - * jit/JumpReplacementWatchpoint.cpp: Added. - (JSC): - (JSC::JumpReplacementWatchpoint::correctLabels): - (JSC::JumpReplacementWatchpoint::fireInternal): - * jit/JumpReplacementWatchpoint.h: Added. - (JSC): - (JumpReplacementWatchpoint): - (JSC::JumpReplacementWatchpoint::JumpReplacementWatchpoint): - (JSC::JumpReplacementWatchpoint::setDestination): - -2012-07-11 Kevin Ollivier - - [wx] Unreviewed build fix. Don't try to build udis86_itab.c since it's included by - another file. - - * wscript: - -2012-07-11 Chao-ying Fu - - Add MIPS convertibleLoadPtr and other functions - https://bugs.webkit.org/show_bug.cgi?id=90714 - - Reviewed by Oliver Hunt. - - * assembler/MIPSAssembler.h: - (JSC::MIPSAssembler::labelIgnoringWatchpoints): - (MIPSAssembler): - (JSC::MIPSAssembler::replaceWithLoad): - (JSC::MIPSAssembler::replaceWithAddressComputation): - * assembler/MacroAssemblerMIPS.h: - (JSC::MacroAssemblerMIPS::convertibleLoadPtr): - (MacroAssemblerMIPS): - -2012-07-11 Anders Carlsson - - Add -Wtautological-compare and -Wsign-compare warning flags - https://bugs.webkit.org/show_bug.cgi?id=90994 - - Reviewed by Mark Rowe. - - * Configurations/Base.xcconfig: - -2012-07-11 Benjamin Poulain - - Simplify the copying of JSC ARMv7's LinkRecord - https://bugs.webkit.org/show_bug.cgi?id=90930 - - Reviewed by Filip Pizlo. - - The class LinkRecord is used by value everywhere in ARMv7Assembler. The compiler uses - memmove() to move the objects. - - The problem is memmove() is overkill for this object, moving the value can be done with - 3 load-store. This patch adds an operator= to the class doing more efficient copying. - This reduces the link time by 19%. - - * assembler/ARMv7Assembler.h: - (JSC::ARMv7Assembler::LinkRecord::LinkRecord): - (JSC::ARMv7Assembler::LinkRecord::operator=): - (JSC::ARMv7Assembler::LinkRecord::from): - (JSC::ARMv7Assembler::LinkRecord::setFrom): - (JSC::ARMv7Assembler::LinkRecord::to): - (JSC::ARMv7Assembler::LinkRecord::type): - (JSC::ARMv7Assembler::LinkRecord::linkType): - (JSC::ARMv7Assembler::LinkRecord::setLinkType): - (JSC::ARMv7Assembler::LinkRecord::condition): - -2012-07-11 Andy Wingo - - jsc: Parse options before creating global data - https://bugs.webkit.org/show_bug.cgi?id=90975 - - Reviewed by Filip Pizlo. - - This patch moves the options parsing in "jsc" before the creation - of the JSGlobalData, so that --useJIT=no has a chance to take - effect. - - * jsc.cpp: - (CommandLine::parseArguments): Refactor to be a class, and take - argc and argv as constructor arguments. - (jscmain): Move arg parsing before JSGlobalData creation. - -2012-07-10 Filip Pizlo - - REGRESSION(r122166): It made 170 tests crash on 32 bit platforms - https://bugs.webkit.org/show_bug.cgi?id=90852 - - Reviewed by Zoltan Herczeg. - - If we can't use the range filter, we should still make sure that the - address is remotely sane, otherwise the hashtables will assert. - - * jit/JITStubRoutine.h: - (JSC::JITStubRoutine::passesFilter): - -2012-07-10 Filip Pizlo - - DFG recompilation heuristics should be based on count, not rate - https://bugs.webkit.org/show_bug.cgi?id=90146 - - Reviewed by Oliver Hunt. - - Rolling r121511 back in after fixing the DFG's interpretation of op_div - profiling, with Gavin's rubber stamp. - - This removes a bunch of code that was previously trying to prevent spurious - reoptimizations if a large enough majority of executions of a code block did - not result in OSR exit. It turns out that this code was purely harmful. This - patch removes all of that logic and replaces it with a dead-simple - heuristic: if you exit more than N times (where N is an exponential function - of the number of times the code block has already been recompiled) then we - will recompile. - - This appears to be a broad ~1% win on many benchmarks large and small. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::CodeBlock): - * bytecode/CodeBlock.h: - (JSC::CodeBlock::couldTakeSpecialFastCase): - (CodeBlock): - (JSC::CodeBlock::osrExitCounter): - (JSC::CodeBlock::countOSRExit): - (JSC::CodeBlock::addressOfOSRExitCounter): - (JSC::CodeBlock::offsetOfOSRExitCounter): - (JSC::CodeBlock::adjustedExitCountThreshold): - (JSC::CodeBlock::exitCountThresholdForReoptimization): - (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop): - (JSC::CodeBlock::shouldReoptimizeNow): - (JSC::CodeBlock::shouldReoptimizeFromLoopNow): - * bytecode/ExecutionCounter.cpp: - (JSC::ExecutionCounter::setThreshold): - * bytecode/ExecutionCounter.h: - (ExecutionCounter): - (JSC::ExecutionCounter::clippedThreshold): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::makeDivSafe): - * dfg/DFGJITCompiler.cpp: - (JSC::DFG::JITCompiler::compileBody): - * dfg/DFGOSRExit.cpp: - (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow): - * dfg/DFGOSRExitCompiler.cpp: - (JSC::DFG::OSRExitCompiler::handleExitCounts): - * dfg/DFGOperations.cpp: - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * runtime/Options.h: - (JSC): - -2012-07-09 Matt Falkenhagen - - Add ENABLE_DIALOG_ELEMENT and skeleton files - https://bugs.webkit.org/show_bug.cgi?id=90521 - - Reviewed by Kent Tamura. - - * Configurations/FeatureDefines.xcconfig: - -2012-07-09 Filip Pizlo - - Unreviewed, roll out http://trac.webkit.org/changeset/121511 - It made in-browser V8v7 10% slower. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::CodeBlock): - * bytecode/CodeBlock.h: - (CodeBlock): - (JSC::CodeBlock::countSpeculationSuccess): - (JSC::CodeBlock::countSpeculationFailure): - (JSC::CodeBlock::speculativeSuccessCounter): - (JSC::CodeBlock::speculativeFailCounter): - (JSC::CodeBlock::forcedOSRExitCounter): - (JSC::CodeBlock::addressOfSpeculativeSuccessCounter): - (JSC::CodeBlock::addressOfSpeculativeFailCounter): - (JSC::CodeBlock::addressOfForcedOSRExitCounter): - (JSC::CodeBlock::offsetOfSpeculativeSuccessCounter): - (JSC::CodeBlock::offsetOfSpeculativeFailCounter): - (JSC::CodeBlock::offsetOfForcedOSRExitCounter): - (JSC::CodeBlock::largeFailCountThreshold): - (JSC::CodeBlock::largeFailCountThresholdForLoop): - (JSC::CodeBlock::shouldReoptimizeNow): - (JSC::CodeBlock::shouldReoptimizeFromLoopNow): - * bytecode/ExecutionCounter.cpp: - (JSC::ExecutionCounter::setThreshold): - * bytecode/ExecutionCounter.h: - (ExecutionCounter): - * dfg/DFGJITCompiler.cpp: - (JSC::DFG::JITCompiler::compileBody): - * dfg/DFGOSRExit.cpp: - (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow): - * dfg/DFGOSRExitCompiler.cpp: - (JSC::DFG::OSRExitCompiler::handleExitCounts): - * dfg/DFGOperations.cpp: - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * runtime/Options.h: - (JSC): - -2012-07-09 Filip Pizlo - - DFG may get stuck in an infinite fix point if it constant folds a mispredicted node - https://bugs.webkit.org/show_bug.cgi?id=90829 - - - Reviewed by Oliver Hunt. - - If a node is shown to have been mispredicted during CFA, then don't allow constant - folding to make the graph even more degenerate. Instead, pull back on constant folding - and allow the normal OSR machinery to fix our profiling so that a future recompilation - doesn't see the same mistake. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGAbstractState.h: - (JSC::DFG::AbstractState::trySetConstant): - (AbstractState): - * dfg/DFGPhase.h: - (JSC::DFG::Phase::name): - (Phase): - (JSC::DFG::runAndLog): - (DFG): - (JSC::DFG::runPhase): - -2012-07-09 Filip Pizlo - - It should be possible to jettison JIT stub routines even if they are currently running - https://bugs.webkit.org/show_bug.cgi?id=90731 - - Reviewed by Gavin Barraclough. - - This gives the GC awareness of all JIT-generated stubs for inline caches. That - means that if you want to delete a JIT-generated stub, you don't have to worry - about whether or not it is currently running: if there is a chance that it might - be, the GC will kindly defer deletion until non-running-ness is proved. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * bytecode/Instruction.h: - (JSC): - (PolymorphicStubInfo): - (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set): - (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList): - * bytecode/PolymorphicPutByIdList.cpp: - (JSC::PutByIdAccess::fromStructureStubInfo): - * bytecode/PolymorphicPutByIdList.h: - (JSC::PutByIdAccess::transition): - (JSC::PutByIdAccess::replace): - (JSC::PutByIdAccess::stubRoutine): - (PutByIdAccess): - (JSC::PolymorphicPutByIdList::currentSlowPathTarget): - * bytecode/StructureStubInfo.h: - (JSC::StructureStubInfo::reset): - * dfg/DFGRepatch.cpp: - (JSC::DFG::generateProtoChainAccessStub): - (JSC::DFG::tryCacheGetByID): - (JSC::DFG::tryBuildGetByIDList): - (JSC::DFG::tryBuildGetByIDProtoList): - (JSC::DFG::emitPutReplaceStub): - (JSC::DFG::emitPutTransitionStub): - (JSC::DFG::tryCachePutByID): - (JSC::DFG::tryBuildPutByIdList): - * heap/ConservativeRoots.cpp: - (JSC): - (DummyMarkHook): - (JSC::DummyMarkHook::mark): - (JSC::ConservativeRoots::add): - (CompositeMarkHook): - (JSC::CompositeMarkHook::CompositeMarkHook): - (JSC::CompositeMarkHook::mark): - * heap/ConservativeRoots.h: - (JSC): - (ConservativeRoots): - * heap/Heap.cpp: - (JSC::Heap::markRoots): - (JSC::Heap::deleteUnmarkedCompiledCode): - * heap/Heap.h: - (JSC): - (Heap): - * heap/JITStubRoutineSet.cpp: Added. - (JSC): - (JSC::JITStubRoutineSet::JITStubRoutineSet): - (JSC::JITStubRoutineSet::~JITStubRoutineSet): - (JSC::JITStubRoutineSet::add): - (JSC::JITStubRoutineSet::clearMarks): - (JSC::JITStubRoutineSet::markSlow): - (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines): - (JSC::JITStubRoutineSet::traceMarkedStubRoutines): - * heap/JITStubRoutineSet.h: Added. - (JSC): - (JITStubRoutineSet): - (JSC::JITStubRoutineSet::mark): - * heap/MachineStackMarker.h: - (JSC): - * interpreter/RegisterFile.cpp: - (JSC::RegisterFile::gatherConservativeRoots): - * interpreter/RegisterFile.h: - (JSC): - * jit/ExecutableAllocator.cpp: - (JSC::DemandExecutableAllocator::DemandExecutableAllocator): - * jit/ExecutableAllocator.h: - (JSC): - * jit/ExecutableAllocatorFixedVMPool.cpp: - (JSC): - (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator): - * jit/GCAwareJITStubRoutine.cpp: Added. - (JSC): - (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine): - (JSC::GCAwareJITStubRoutine::~GCAwareJITStubRoutine): - (JSC::GCAwareJITStubRoutine::observeZeroRefCount): - (JSC::GCAwareJITStubRoutine::deleteFromGC): - (JSC::GCAwareJITStubRoutine::markRequiredObjectsInternal): - (JSC::MarkingGCAwareJITStubRoutineWithOneObject::MarkingGCAwareJITStubRoutineWithOneObject): - (JSC::MarkingGCAwareJITStubRoutineWithOneObject::~MarkingGCAwareJITStubRoutineWithOneObject): - (JSC::MarkingGCAwareJITStubRoutineWithOneObject::markRequiredObjectsInternal): - (JSC::createJITStubRoutine): - * jit/GCAwareJITStubRoutine.h: Added. - (JSC): - (GCAwareJITStubRoutine): - (JSC::GCAwareJITStubRoutine::markRequiredObjects): - (MarkingGCAwareJITStubRoutineWithOneObject): - * jit/JITPropertyAccess.cpp: - (JSC::JIT::privateCompilePutByIdTransition): - (JSC::JIT::privateCompilePatchGetArrayLength): - (JSC::JIT::privateCompileGetByIdProto): - (JSC::JIT::privateCompileGetByIdSelfList): - (JSC::JIT::privateCompileGetByIdProtoList): - (JSC::JIT::privateCompileGetByIdChainList): - (JSC::JIT::privateCompileGetByIdChain): - * jit/JITPropertyAccess32_64.cpp: - (JSC::JIT::privateCompilePutByIdTransition): - (JSC::JIT::privateCompilePatchGetArrayLength): - (JSC::JIT::privateCompileGetByIdProto): - (JSC::JIT::privateCompileGetByIdSelfList): - (JSC::JIT::privateCompileGetByIdProtoList): - (JSC::JIT::privateCompileGetByIdChainList): - (JSC::JIT::privateCompileGetByIdChain): - * jit/JITStubRoutine.cpp: Added. - (JSC): - (JSC::JITStubRoutine::~JITStubRoutine): - (JSC::JITStubRoutine::observeZeroRefCount): - * jit/JITStubRoutine.h: Added. - (JSC): - (JITStubRoutine): - (JSC::JITStubRoutine::JITStubRoutine): - (JSC::JITStubRoutine::createSelfManagedRoutine): - (JSC::JITStubRoutine::code): - (JSC::JITStubRoutine::asCodePtr): - (JSC::JITStubRoutine::ref): - (JSC::JITStubRoutine::deref): - (JSC::JITStubRoutine::startAddress): - (JSC::JITStubRoutine::endAddress): - (JSC::JITStubRoutine::addressStep): - (JSC::JITStubRoutine::canPerformRangeFilter): - (JSC::JITStubRoutine::filteringStartAddress): - (JSC::JITStubRoutine::filteringExtentSize): - (JSC::JITStubRoutine::passesFilter): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - (JSC::getPolymorphicAccessStructureListSlot): - -2012-07-09 Sheriff Bot - - Unreviewed, rolling out r122107. - http://trac.webkit.org/changeset/122107 - https://bugs.webkit.org/show_bug.cgi?id=90794 - - Build failure on Mac debug bots (Requested by falken_ on - #webkit). - - * Configurations/FeatureDefines.xcconfig: - -2012-07-09 Matt Falkenhagen - - Add ENABLE_DIALOG_ELEMENT and skeleton files - https://bugs.webkit.org/show_bug.cgi?id=90521 - - Reviewed by Kent Tamura. - - * Configurations/FeatureDefines.xcconfig: - -2012-07-08 Ryosuke Niwa - - gcc build fix after r121925. - - * runtime/JSObject.h: - (JSC::JSFinalObject::finishCreation): - -2012-07-08 Zoltan Herczeg - - [Qt][ARM] Implementing missing macro assembler instructions after r121925 - https://bugs.webkit.org/show_bug.cgi?id=90657 - - Reviewed by Csaba Osztrogonác. - - Implementing convertibleLoadPtr, replaceWithLoad and - replaceWithAddressComputation. - - * assembler/ARMAssembler.h: - (JSC::ARMAssembler::replaceWithLoad): - (ARMAssembler): - (JSC::ARMAssembler::replaceWithAddressComputation): - * assembler/MacroAssemblerARM.h: - (JSC::MacroAssemblerARM::convertibleLoadPtr): - (MacroAssemblerARM): - -2012-07-06 Filip Pizlo - - WebKit Version 5.1.7 (6534.57.2, r121935): Double-click no longer works on OpenStreetMap - https://bugs.webkit.org/show_bug.cgi?id=90703 - - Reviewed by Michael Saboff. - - It turns out that in my object model refactoring, I managed to fix get_by_pname in all - execution engines except 64-bit baseline JIT. - - * jit/JITPropertyAccess.cpp: - (JSC::JIT::emit_op_get_by_pname): - -2012-07-06 Pravin D - - Build Error on Qt Linux build - https://bugs.webkit.org/show_bug.cgi?id=90699 - - Reviewed by Laszlo Gombos. - - * parser/Parser.cpp: - (JSC::::parseForStatement): - Removed unused boolean variable as this was causing build error on Qt Linux. - -2012-07-06 Nuno Lopes - - Fix build with recent clang. - https://bugs.webkit.org/show_bug.cgi?id=90634 - - Reviewed by Oliver Hunt. - - * jit/SpecializedThunkJIT.h: - (JSC::SpecializedThunkJIT::SpecializedThunkJIT): - (SpecializedThunkJIT): - * jit/ThunkGenerators.cpp: - (JSC::charCodeAtThunkGenerator): - (JSC::charAtThunkGenerator): - (JSC::fromCharCodeThunkGenerator): - (JSC::sqrtThunkGenerator): - (JSC::floorThunkGenerator): - (JSC::ceilThunkGenerator): - (JSC::roundThunkGenerator): - (JSC::expThunkGenerator): - (JSC::logThunkGenerator): - (JSC::absThunkGenerator): - (JSC::powThunkGenerator): - * parser/ASTBuilder.h: - (JSC::ASTBuilder::createAssignResolve): - (JSC::ASTBuilder::createForLoop): - (JSC::ASTBuilder::createForInLoop): - (JSC::ASTBuilder::makeAssignNode): - (JSC::ASTBuilder::makePrefixNode): - (JSC::ASTBuilder::makePostfixNode): - * parser/NodeConstructors.h: - (JSC::PostfixErrorNode::PostfixErrorNode): - (JSC::PrefixErrorNode::PrefixErrorNode): - (JSC::AssignResolveNode::AssignResolveNode): - (JSC::AssignErrorNode::AssignErrorNode): - (JSC::ForNode::ForNode): - (JSC::ForInNode::ForInNode): - * parser/Nodes.h: - (FunctionCallResolveNode): - (PostfixErrorNode): - (PrefixErrorNode): - (ReadModifyResolveNode): - (AssignResolveNode): - (AssignErrorNode): - (ForNode): - (ForInNode): - * parser/Parser.cpp: - (JSC::::parseVarDeclarationList): - (JSC::::parseForStatement): - * parser/SyntaxChecker.h: - (JSC::SyntaxChecker::createAssignResolve): - (JSC::SyntaxChecker::createForLoop): - -2012-07-06 Zoltan Herczeg - - [Qt][ARM] REGRESSION(r121885): It broke 30 jsc tests, 500+ layout tests - https://bugs.webkit.org/show_bug.cgi?id=90656 - - Reviewed by Csaba Osztrogonác. - - Typo fixes. - - * assembler/MacroAssemblerARM.cpp: - (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords): - Rename getOp2Byte() -> getOp2Half() - * assembler/MacroAssemblerARMv7.h: - (JSC::MacroAssemblerARMv7::convertibleLoadPtr): - Add a necessary space. - * jit/JITStubs.cpp: - (JSC): - Revert INLINE_ARM_FUNCTION macro. - -2012-07-05 Filip Pizlo - - REGRESSION(r121925): It broke 5 sputnik tests on x86 platforms - https://bugs.webkit.org/show_bug.cgi?id=90658 - - Reviewed by Zoltan Herczeg. - - Under the new object model, out-of-line property accesses such as those - in ResolveGlobal must account for the fact that the offset to the Kth - property is represented by K + inlineStorageCapacity. Hence, the property - loads in ResolveGlobal must have an additional -inlineStorageCapacity * - sizeof(JSValue) offset. - - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - -2012-07-05 Csaba Osztrogonác - - [Qt] Unreviewed 64 bit buildfix after r121925. - - * bytecode/PutByIdStatus.cpp: - (JSC::PutByIdStatus::computeFromLLInt): - -2012-07-05 Michael Saboff - - JSString::tryHashConstLock() fails to get exclusive lock - https://bugs.webkit.org/show_bug.cgi?id=90639 - - Reviewed by Oliver Hunt. - - Added check that the string is already locked even before compare and swap. - - * heap/MarkStack.cpp: - (JSC::JSString::tryHashConstLock): - -2012-07-04 Filip Pizlo - - Inline property storage should not be wasted when it is exhausted - https://bugs.webkit.org/show_bug.cgi?id=90347 - - Reviewed by Gavin Barraclough. - - Previously, if we switched an object from using inline storage to out-of-line - storage, we would abandon the inline storage. This would have two main implications: - (i) all accesses to the object, even for properties that were previously in inline - storage, must now take an extra indirection; and (ii) we waste a non-trivial amount - of space since we must allocate additional out-of-line storage to hold properties - that would have fit in the inline storage. There's also the copying cost when - switching to out-of-line storage - we must copy all inline properties into ouf-of-line - storage. - - This patch changes the way that object property storage works so that we can use both - inline and out-of-line storage concurrently. This is accomplished by introducing a - new notion of property offset. This PropertyOffset is a 32-bit signed integer and it - behaves as follows: - - offset == -1: invalid offset, indicating a property that does not exist. - - 0 <= offset <= inlineStorageCapacity: offset into inline storage. - - inlineStorageCapacity < offset: offset into out-of-line storage. - - Because non-final objects don't have inline storage, the only valid PropertyOffsets - for those objects' properties are -1 or > inlineStorageCapacity. - - This now means that the decision to use inline or out-of-line storage for an access is - made based on the offset, rather than the structure. It also means that any access - where the offset is a variable must have an extra branch, unless the type of the - object is also known (if it's known to be a non-final object then we can just assert - that the offset is >= inlineStorageCapacity). - - This looks like a big Kraken speed-up and a slight V8 speed-up. - - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * assembler/ARMv7Assembler.h: - (ARMv7Assembler): - (JSC::ARMv7Assembler::ldrWide8BitImmediate): - (JSC::ARMv7Assembler::replaceWithLoad): - (JSC::ARMv7Assembler::replaceWithAddressComputation): - * assembler/AbstractMacroAssembler.h: - (AbstractMacroAssembler): - (ConvertibleLoadLabel): - (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::ConvertibleLoadLabel): - (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::isSet): - (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints): - (JSC::AbstractMacroAssembler::replaceWithLoad): - (JSC::AbstractMacroAssembler::replaceWithAddressComputation): - * assembler/CodeLocation.h: - (JSC): - (CodeLocationCommon): - (CodeLocationConvertibleLoad): - (JSC::CodeLocationConvertibleLoad::CodeLocationConvertibleLoad): - (JSC::CodeLocationCommon::convertibleLoadAtOffset): - * assembler/LinkBuffer.cpp: - (JSC::LinkBuffer::finalizeCodeWithDisassembly): - * assembler/LinkBuffer.h: - (LinkBuffer): - (JSC::LinkBuffer::locationOf): - * assembler/MacroAssemblerARMv7.h: - (MacroAssemblerARMv7): - (JSC::MacroAssemblerARMv7::convertibleLoadPtr): - * assembler/MacroAssemblerX86.h: - (JSC::MacroAssemblerX86::convertibleLoadPtr): - (MacroAssemblerX86): - * assembler/MacroAssemblerX86_64.h: - (JSC::MacroAssemblerX86_64::convertibleLoadPtr): - (MacroAssemblerX86_64): - * assembler/RepatchBuffer.h: - (RepatchBuffer): - (JSC::RepatchBuffer::replaceWithLoad): - (JSC::RepatchBuffer::replaceWithAddressComputation): - (JSC::RepatchBuffer::setLoadInstructionIsActive): - * assembler/X86Assembler.h: - (JSC::X86Assembler::replaceWithLoad): - (X86Assembler): - (JSC::X86Assembler::replaceWithAddressComputation): - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::printGetByIdOp): - (JSC::CodeBlock::dump): - (JSC::CodeBlock::finalizeUnconditionally): - * bytecode/GetByIdStatus.cpp: - (JSC::GetByIdStatus::computeFromLLInt): - (JSC::GetByIdStatus::computeForChain): - (JSC::GetByIdStatus::computeFor): - * bytecode/GetByIdStatus.h: - (JSC::GetByIdStatus::GetByIdStatus): - (JSC::GetByIdStatus::offset): - (GetByIdStatus): - * bytecode/Opcode.h: - (JSC): - (JSC::padOpcodeName): - * bytecode/PutByIdStatus.cpp: - (JSC::PutByIdStatus::computeFromLLInt): - (JSC::PutByIdStatus::computeFor): - * bytecode/PutByIdStatus.h: - (JSC::PutByIdStatus::PutByIdStatus): - (JSC::PutByIdStatus::offset): - (PutByIdStatus): - * bytecode/ResolveGlobalStatus.cpp: - (JSC): - (JSC::computeForStructure): - * bytecode/ResolveGlobalStatus.h: - (JSC::ResolveGlobalStatus::ResolveGlobalStatus): - (JSC::ResolveGlobalStatus::offset): - (ResolveGlobalStatus): - * bytecode/StructureSet.h: - (StructureSet): - * bytecode/StructureStubInfo.h: - * dfg/DFGByteCodeParser.cpp: - (ByteCodeParser): - (JSC::DFG::ByteCodeParser::handleGetByOffset): - (JSC::DFG::ByteCodeParser::handleGetById): - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCapabilities.h: - (JSC::DFG::canCompileOpcode): - * dfg/DFGJITCompiler.cpp: - (JSC::DFG::JITCompiler::link): - * dfg/DFGJITCompiler.h: - (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord): - (PropertyAccessRecord): - * dfg/DFGRepatch.cpp: - (JSC::DFG::dfgRepatchByIdSelfAccess): - (JSC::DFG::generateProtoChainAccessStub): - (JSC::DFG::tryCacheGetByID): - (JSC::DFG::tryBuildGetByIDList): - (JSC::DFG::tryBuildGetByIDProtoList): - (JSC::DFG::emitPutReplaceStub): - (JSC::DFG::emitPutTransitionStub): - (JSC::DFG::tryCachePutByID): - (JSC::DFG::tryBuildPutByIdList): - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::cachedGetById): - (JSC::DFG::SpeculativeJIT::cachedPutById): - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::cachedGetById): - (JSC::DFG::SpeculativeJIT::cachedPutById): - (JSC::DFG::SpeculativeJIT::compile): - * heap/MarkStack.cpp: - (JSC::visitChildren): - * interpreter/Interpreter.cpp: - (JSC::Interpreter::tryCacheGetByID): - (JSC::Interpreter::privateExecute): - * jit/JIT.cpp: - (JSC::JIT::privateCompileMainPass): - (JSC::JIT::privateCompileSlowCases): - (JSC::PropertyStubCompilationInfo::copyToStubInfo): - * jit/JIT.h: - (JSC::PropertyStubCompilationInfo::PropertyStubCompilationInfo): - (JSC::JIT::compileGetByIdProto): - (JSC::JIT::compileGetByIdSelfList): - (JSC::JIT::compileGetByIdProtoList): - (JSC::JIT::compileGetByIdChainList): - (JSC::JIT::compileGetByIdChain): - (JSC::JIT::compilePutByIdTransition): - (JIT): - * jit/JITInlineMethods.h: - (JSC::JIT::emitAllocateBasicJSObject): - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_resolve_global): - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::emit_op_resolve_global): - * jit/JITPropertyAccess.cpp: - (JSC::JIT::compileGetDirectOffset): - (JSC::JIT::emit_op_method_check): - (JSC::JIT::compileGetByIdHotPath): - (JSC::JIT::emit_op_put_by_id): - (JSC::JIT::compilePutDirectOffset): - (JSC::JIT::privateCompilePutByIdTransition): - (JSC::JIT::patchGetByIdSelf): - (JSC::JIT::patchPutByIdReplace): - (JSC::JIT::privateCompileGetByIdProto): - (JSC::JIT::privateCompileGetByIdSelfList): - (JSC::JIT::privateCompileGetByIdProtoList): - (JSC::JIT::privateCompileGetByIdChainList): - (JSC::JIT::privateCompileGetByIdChain): - * jit/JITPropertyAccess32_64.cpp: - (JSC::JIT::emit_op_method_check): - (JSC::JIT::compileGetByIdHotPath): - (JSC::JIT::emit_op_put_by_id): - (JSC::JIT::compilePutDirectOffset): - (JSC::JIT::compileGetDirectOffset): - (JSC::JIT::privateCompilePutByIdTransition): - (JSC::JIT::patchGetByIdSelf): - (JSC::JIT::patchPutByIdReplace): - (JSC::JIT::privateCompileGetByIdProto): - (JSC::JIT::privateCompileGetByIdSelfList): - (JSC::JIT::privateCompileGetByIdProtoList): - (JSC::JIT::privateCompileGetByIdChainList): - (JSC::JIT::privateCompileGetByIdChain): - (JSC::JIT::emit_op_get_by_pname): - * jit/JITStubs.cpp: - (JSC::JITThunks::tryCacheGetByID): - (JSC::DEFINE_STUB_FUNCTION): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * llint/LowLevelInterpreter.asm: - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - * offlineasm/x86.rb: - * runtime/JSGlobalObject.h: - (JSGlobalObject): - (JSC::JSGlobalObject::functionNameOffset): - * runtime/JSObject.cpp: - (JSC::JSObject::visitChildren): - (JSC): - (JSC::JSFinalObject::visitChildren): - (JSC::JSObject::put): - (JSC::JSObject::deleteProperty): - (JSC::JSObject::getPropertySpecificValue): - (JSC::JSObject::removeDirect): - (JSC::JSObject::growOutOfLineStorage): - (JSC::JSObject::getOwnPropertyDescriptor): - * runtime/JSObject.h: - (JSObject): - (JSC::JSObject::getDirect): - (JSC::JSObject::getDirectLocation): - (JSC::JSObject::hasInlineStorage): - (JSC::JSObject::inlineStorageUnsafe): - (JSC::JSObject::inlineStorage): - (JSC::JSObject::outOfLineStorage): - (JSC::JSObject::locationForOffset): - (JSC::JSObject::offsetForLocation): - (JSC::JSObject::getDirectOffset): - (JSC::JSObject::putDirectOffset): - (JSC::JSObject::putUndefinedAtDirectOffset): - (JSC::JSObject::addressOfOutOfLineStorage): - (JSC::JSObject::finishCreation): - (JSC::JSNonFinalObject::JSNonFinalObject): - (JSC::JSNonFinalObject::finishCreation): - (JSFinalObject): - (JSC::JSFinalObject::finishCreation): - (JSC::JSFinalObject::JSFinalObject): - (JSC::JSObject::offsetOfOutOfLineStorage): - (JSC::JSObject::setOutOfLineStorage): - (JSC::JSObject::JSObject): - (JSC): - (JSC::JSCell::fastGetOwnProperty): - (JSC::JSObject::putDirectInternal): - (JSC::JSObject::setStructureAndReallocateStorageIfNecessary): - (JSC::JSObject::putDirectWithoutTransition): - (JSC::offsetRelativeToPatchedStorage): - (JSC::indexRelativeToBase): - (JSC::offsetRelativeToBase): - * runtime/JSPropertyNameIterator.cpp: - (JSC::JSPropertyNameIterator::create): - * runtime/JSPropertyNameIterator.h: - (JSPropertyNameIterator): - (JSC::JSPropertyNameIterator::getOffset): - (JSC::JSPropertyNameIterator::finishCreation): - * runtime/JSValue.cpp: - (JSC::JSValue::putToPrimitive): - * runtime/Operations.h: - (JSC::normalizePrototypeChain): - * runtime/Options.cpp: - (JSC): - (JSC::Options::initialize): - * runtime/PropertyMapHashTable.h: - (PropertyMapEntry): - (JSC::PropertyMapEntry::PropertyMapEntry): - (PropertyTable): - (JSC::PropertyTable::PropertyTable): - (JSC::PropertyTable::getDeletedOffset): - (JSC::PropertyTable::addDeletedOffset): - (JSC::PropertyTable::nextOffset): - (JSC): - (JSC::PropertyTable::sizeInMemory): - * runtime/PropertyOffset.h: Added. - (JSC): - (JSC::checkOffset): - (JSC::validateOffset): - (JSC::isValidOffset): - (JSC::isInlineOffset): - (JSC::isOutOfLineOffset): - (JSC::offsetInInlineStorage): - (JSC::offsetInOutOfLineStorage): - (JSC::offsetInRespectiveStorage): - (JSC::numberOfOutOfLineSlotsForLastOffset): - (JSC::numberOfSlotsForLastOffset): - (JSC::nextPropertyOffsetFor): - (JSC::firstPropertyOffsetFor): - * runtime/PropertySlot.h: - (JSC::PropertySlot::cachedOffset): - (JSC::PropertySlot::setValue): - (JSC::PropertySlot::setCacheableGetterSlot): - (JSC::PropertySlot::clearOffset): - * runtime/PutPropertySlot.h: - (JSC::PutPropertySlot::setExistingProperty): - (JSC::PutPropertySlot::setNewProperty): - (JSC::PutPropertySlot::cachedOffset): - (PutPropertySlot): - * runtime/Structure.cpp: - (JSC::Structure::Structure): - (JSC::Structure::materializePropertyMap): - (JSC::nextOutOfLineStorageCapacity): - (JSC::Structure::growOutOfLineCapacity): - (JSC::Structure::suggestedNewOutOfLineStorageCapacity): - (JSC::Structure::addPropertyTransitionToExistingStructure): - (JSC::Structure::addPropertyTransition): - (JSC::Structure::removePropertyTransition): - (JSC::Structure::flattenDictionaryStructure): - (JSC::Structure::addPropertyWithoutTransition): - (JSC::Structure::removePropertyWithoutTransition): - (JSC::Structure::copyPropertyTableForPinning): - (JSC::Structure::get): - (JSC::Structure::putSpecificValue): - (JSC::Structure::remove): - * runtime/Structure.h: - (Structure): - (JSC::Structure::putWillGrowOutOfLineStorage): - (JSC::Structure::previousID): - (JSC::Structure::outOfLineCapacity): - (JSC::Structure::outOfLineSizeForKnownFinalObject): - (JSC::Structure::outOfLineSizeForKnownNonFinalObject): - (JSC::Structure::outOfLineSize): - (JSC::Structure::hasInlineStorage): - (JSC::Structure::inlineCapacity): - (JSC::Structure::inlineSizeForKnownFinalObject): - (JSC::Structure::inlineSize): - (JSC::Structure::totalStorageSize): - (JSC::Structure::totalStorageCapacity): - (JSC::Structure::firstValidOffset): - (JSC::Structure::lastValidOffset): - (JSC::Structure::isValidOffset): - (JSC::Structure::isEmpty): - (JSC::Structure::transitionCount): - (JSC::Structure::get): - -2012-07-05 Oliver Hunt - - JSObjectCallAsFunction should thisConvert the provided thisObject - https://bugs.webkit.org/show_bug.cgi?id=90628 - - Reviewed by Gavin Barraclough. - - Perform this conversion on the provided this object. - - * API/JSObjectRef.cpp: - (JSObjectCallAsFunction): - -2012-07-05 Zoltan Herczeg - - [Qt] Unreviewed buildfix after r121886. Typo fix. - - * assembler/MacroAssemblerARM.cpp: - (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords): - -2012-07-05 Zoltan Herczeg - - Port DFG JIT to traditional ARM - https://bugs.webkit.org/show_bug.cgi?id=90198 - - Reviewed by Filip Pizlo. - - This patch contains the macro assembler part of the - DFG JIT support on ARM systems with fixed 32 bit instruction - width. A large amount of old code was refactored, and the ARMv4 - or lower support is removed from the macro assembler. - - Sunspider is improved by 8%, and V8 is 92%. - - * assembler/ARMAssembler.cpp: - (JSC::ARMAssembler::dataTransfer32): - (JSC::ARMAssembler::baseIndexTransfer32): - (JSC): - (JSC::ARMAssembler::dataTransfer16): - (JSC::ARMAssembler::baseIndexTransfer16): - (JSC::ARMAssembler::dataTransferFloat): - (JSC::ARMAssembler::baseIndexTransferFloat): - (JSC::ARMAssembler::executableCopy): - * assembler/ARMAssembler.h: - (JSC::ARMAssembler::ARMAssembler): - (JSC::ARMAssembler::emitInst): - (JSC::ARMAssembler::vmov_f64_r): - (ARMAssembler): - (JSC::ARMAssembler::vabs_f64_r): - (JSC::ARMAssembler::vneg_f64_r): - (JSC::ARMAssembler::ldr_imm): - (JSC::ARMAssembler::ldr_un_imm): - (JSC::ARMAssembler::dtr_u): - (JSC::ARMAssembler::dtr_ur): - (JSC::ARMAssembler::dtr_d): - (JSC::ARMAssembler::dtr_dr): - (JSC::ARMAssembler::dtrh_u): - (JSC::ARMAssembler::dtrh_ur): - (JSC::ARMAssembler::dtrh_d): - (JSC::ARMAssembler::dtrh_dr): - (JSC::ARMAssembler::fdtr_u): - (JSC::ARMAssembler::fdtr_d): - (JSC::ARMAssembler::push_r): - (JSC::ARMAssembler::pop_r): - (JSC::ARMAssembler::poke_r): - (JSC::ARMAssembler::peek_r): - (JSC::ARMAssembler::vmov_vfp64_r): - (JSC::ARMAssembler::vmov_arm64_r): - (JSC::ARMAssembler::vmov_vfp32_r): - (JSC::ARMAssembler::vmov_arm32_r): - (JSC::ARMAssembler::vcvt_u32_f64_r): - (JSC::ARMAssembler::vcvt_f64_f32_r): - (JSC::ARMAssembler::vcvt_f32_f64_r): - (JSC::ARMAssembler::clz_r): - (JSC::ARMAssembler::bkpt): - (JSC::ARMAssembler::bx): - (JSC::ARMAssembler::blx): - (JSC::ARMAssembler::labelIgnoringWatchpoints): - (JSC::ARMAssembler::labelForWatchpoint): - (JSC::ARMAssembler::label): - (JSC::ARMAssembler::getLdrImmAddress): - (JSC::ARMAssembler::replaceWithJump): - (JSC::ARMAssembler::maxJumpReplacementSize): - (JSC::ARMAssembler::getOp2Byte): - (JSC::ARMAssembler::getOp2Half): - (JSC::ARMAssembler::RM): - (JSC::ARMAssembler::RS): - (JSC::ARMAssembler::RD): - (JSC::ARMAssembler::RN): - * assembler/AssemblerBufferWithConstantPool.h: - (JSC::AssemblerBufferWithConstantPool::ensureSpaceForAnyInstruction): - * assembler/MacroAssemblerARM.cpp: - (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords): - * assembler/MacroAssemblerARM.h: - (JSC::MacroAssemblerARM::add32): - (MacroAssemblerARM): - (JSC::MacroAssemblerARM::and32): - (JSC::MacroAssemblerARM::lshift32): - (JSC::MacroAssemblerARM::mul32): - (JSC::MacroAssemblerARM::neg32): - (JSC::MacroAssemblerARM::rshift32): - (JSC::MacroAssemblerARM::urshift32): - (JSC::MacroAssemblerARM::xor32): - (JSC::MacroAssemblerARM::load8): - (JSC::MacroAssemblerARM::load8Signed): - (JSC::MacroAssemblerARM::load16): - (JSC::MacroAssemblerARM::load16Signed): - (JSC::MacroAssemblerARM::load32): - (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch): - (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch): - (JSC::MacroAssemblerARM::store8): - (JSC::MacroAssemblerARM::store16): - (JSC::MacroAssemblerARM::store32): - (JSC::MacroAssemblerARM::move): - (JSC::MacroAssemblerARM::jump): - (JSC::MacroAssemblerARM::branchAdd32): - (JSC::MacroAssemblerARM::mull32): - (JSC::MacroAssemblerARM::branchMul32): - (JSC::MacroAssemblerARM::nearCall): - (JSC::MacroAssemblerARM::compare32): - (JSC::MacroAssemblerARM::test32): - (JSC::MacroAssemblerARM::sub32): - (JSC::MacroAssemblerARM::call): - (JSC::MacroAssemblerARM::loadFloat): - (JSC::MacroAssemblerARM::loadDouble): - (JSC::MacroAssemblerARM::storeFloat): - (JSC::MacroAssemblerARM::storeDouble): - (JSC::MacroAssemblerARM::moveDouble): - (JSC::MacroAssemblerARM::addDouble): - (JSC::MacroAssemblerARM::divDouble): - (JSC::MacroAssemblerARM::subDouble): - (JSC::MacroAssemblerARM::mulDouble): - (JSC::MacroAssemblerARM::absDouble): - (JSC::MacroAssemblerARM::negateDouble): - (JSC::MacroAssemblerARM::convertInt32ToDouble): - (JSC::MacroAssemblerARM::convertFloatToDouble): - (JSC::MacroAssemblerARM::convertDoubleToFloat): - (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32): - (JSC::MacroAssemblerARM::branchTruncateDoubleToUint32): - (JSC::MacroAssemblerARM::truncateDoubleToInt32): - (JSC::MacroAssemblerARM::truncateDoubleToUint32): - (JSC::MacroAssemblerARM::branchConvertDoubleToInt32): - (JSC::MacroAssemblerARM::branchDoubleNonZero): - (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN): - (JSC::MacroAssemblerARM::invert): - (JSC::MacroAssemblerARM::replaceWithJump): - (JSC::MacroAssemblerARM::maxJumpReplacementSize): - (JSC::MacroAssemblerARM::call32): - * assembler/SH4Assembler.h: - (JSC::SH4Assembler::label): - * dfg/DFGAssemblyHelpers.h: - (JSC::DFG::AssemblyHelpers::debugCall): - (JSC::DFG::AssemblyHelpers::boxDouble): - (JSC::DFG::AssemblyHelpers::unboxDouble): - * dfg/DFGCCallHelpers.h: - (CCallHelpers): - (JSC::DFG::CCallHelpers::setupArguments): - * dfg/DFGFPRInfo.h: - (DFG): - * dfg/DFGGPRInfo.h: - (DFG): - (GPRInfo): - * dfg/DFGOperations.cpp: - (JSC): - * dfg/DFGSpeculativeJIT.h: - (SpeculativeJIT): - (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult): - (JSC::DFG::SpeculativeJIT::appendCallSetResult): - * jit/JITStubs.cpp: - (JSC): - * jit/JITStubs.h: - (JITStackFrame): - * jit/JSInterfaceJIT.h: - (JSInterfaceJIT): - -2012-07-04 Anthony Scian - - Web Inspector [JSC]: Implement ScriptCallStack::stackTrace - https://bugs.webkit.org/show_bug.cgi?id=40118 - - Reviewed by Yong Li. - - Added member functions to expose function name, urlString, and line #. - Refactored toString to make use of these member functions to reduce - duplicated code for future maintenance. - - Manually tested refactoring of toString by tracing thrown exceptions. - - * interpreter/Interpreter.h: - (JSC::StackFrame::toString): - (JSC::StackFrame::friendlySourceURL): - (JSC::StackFrame::friendlyFunctionName): - (JSC::StackFrame::friendlyLineNumber): - -2012-07-04 Andy Wingo - - [GTK] Enable parallel GC - https://bugs.webkit.org/show_bug.cgi?id=90568 - - Reviewed by Martin Robinson. - - * runtime/Options.cpp: Include for std::min. - -2012-07-04 John Mellor - - Text Autosizing: Add compile flag and runtime setting - https://bugs.webkit.org/show_bug.cgi?id=87394 - - This patch renames Font Boosting to Text Autosizing. - - Reviewed by Adam Barth. - - * Configurations/FeatureDefines.xcconfig: - -2012-07-03 Michael Saboff - - Enh: Hash Const JSString in Backing Stores to Save Memory - https://bugs.webkit.org/show_bug.cgi?id=86024 - - Reviewed by Oliver Hunt. - - During garbage collection, each marking thread keeps a HashMap of - strings. While visiting via MarkStack::copyAndAppend(), we check to - see if the string we are visiting is already in the HashMap. If not - we add it. If so, we change the reference to the current string we're - visiting to the prior string. - - To reduce the performance impact of this change, two throttles have - ben added. 1) We only try hash consting if a significant number of new - strings have been created since the last hash const. Currently this is - set at 100 strings. 2) If a string is unique at the end of a marking - it will not be checked during further GC phases. In some cases this - won't catch all duplicates, but we are trying to catch the growth of - duplicate strings. - - * heap/Heap.cpp: - (JSC::Heap::markRoots): - * heap/MarkStack.cpp: - (JSC::MarkStackThreadSharedData::resetChildren): - (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData): - (JSC::MarkStackThreadSharedData::reset): - (JSC::MarkStack::setup): Check to see if enough strings have been created - to hash const. - (JSC::MarkStack::reset): Added call to clear m_uniqueStrings. - (JSC::JSString::tryHashConstLock): New method to lock JSString for - hash consting. - (JSC::JSString::releaseHashConstLock): New unlock method. - (JSC::JSString::shouldTryHashConst): Set of checks to see if we should - try to hash const the string. - (JSC::MarkStack::internalAppend): New method that performs the hash consting. - (JSC::SlotVisitor::copyAndAppend): Changed to call the new hash - consting internalAppend(). - * heap/MarkStack.h: - (MarkStackThreadSharedData): - (MarkStack): - * runtime/JSGlobalData.cpp: - (JSC::JSGlobalData::JSGlobalData): - * runtime/JSGlobalData.h: - (JSGlobalData): - (JSC::JSGlobalData::haveEnoughNewStringsToHashConst): - (JSC::JSGlobalData::resetNewStringsSinceLastHashConst): - * runtime/JSString.h: - (JSString): Changed from using bool flags to using an unsigned - m_flags field. This works better with the weakCompareAndSwap in - JSString::tryHashConstLock(). Changed the 8bitness setting and - checking to use new accessors. - (JSC::JSString::JSString): - (JSC::JSString::finishCreation): - (JSC::JSString::is8Bit): Updated for new m_flags. - (JSC::JSString::setIs8Bit): New setter. - New hash const flags accessors: - (JSC::JSString::isHashConstSingleton): - (JSC::JSString::clearHashConstSingleton): - (JSC::JSString::setHashConstSingleton): - (JSC::JSRopeString::finishCreation): - (JSC::JSRopeString::append): - -2012-07-03 Tony Chang - - [chromium] Unreviewed, update .gitignore to handle VS2010 files. - - * JavaScriptCore.gyp/.gitignore: - -2012-07-03 Mark Lam - - Add ability to symbolically set and dump JSC VM options. - See comments in runtime/Options.h for details on how the options work. - https://bugs.webkit.org/show_bug.cgi?id=90420 - - Reviewed by Filip Pizlo. - - * assembler/LinkBuffer.cpp: - (JSC::LinkBuffer::finalizeCodeWithDisassembly): - * assembler/LinkBuffer.h: - (JSC): - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::shouldOptimizeNow): - * bytecode/CodeBlock.h: - (JSC::CodeBlock::likelyToTakeSlowCase): - (JSC::CodeBlock::couldTakeSlowCase): - (JSC::CodeBlock::likelyToTakeSpecialFastCase): - (JSC::CodeBlock::likelyToTakeDeepestSlowCase): - (JSC::CodeBlock::likelyToTakeAnySlowCase): - (JSC::CodeBlock::jitAfterWarmUp): - (JSC::CodeBlock::jitSoon): - (JSC::CodeBlock::reoptimizationRetryCounter): - (JSC::CodeBlock::countReoptimization): - (JSC::CodeBlock::counterValueForOptimizeAfterWarmUp): - (JSC::CodeBlock::counterValueForOptimizeAfterLongWarmUp): - (JSC::CodeBlock::optimizeSoon): - (JSC::CodeBlock::exitCountThresholdForReoptimization): - (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop): - * bytecode/ExecutionCounter.h: - (JSC::ExecutionCounter::clippedThreshold): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::handleInlining): - * dfg/DFGCapabilities.h: - (JSC::DFG::mightCompileEval): - (JSC::DFG::mightCompileProgram): - (JSC::DFG::mightCompileFunctionForCall): - (JSC::DFG::mightCompileFunctionForConstruct): - (JSC::DFG::mightInlineFunctionForCall): - (JSC::DFG::mightInlineFunctionForConstruct): - * dfg/DFGCommon.h: - (JSC::DFG::shouldShowDisassembly): - * dfg/DFGDriver.cpp: - (JSC::DFG::compile): - * dfg/DFGOSRExit.cpp: - (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow): - * dfg/DFGVariableAccessData.h: - (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote): - * heap/MarkStack.cpp: - (JSC::MarkStackSegmentAllocator::allocate): - (JSC::MarkStackSegmentAllocator::shrinkReserve): - (JSC::MarkStackArray::MarkStackArray): - (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData): - (JSC::SlotVisitor::donateKnownParallel): - (JSC::SlotVisitor::drain): - (JSC::SlotVisitor::drainFromShared): - * heap/MarkStack.h: - (JSC::MarkStack::mergeOpaqueRootsIfProfitable): - (JSC::MarkStack::addOpaqueRoot): - * heap/SlotVisitor.h: - (JSC::SlotVisitor::donate): - * jit/JIT.cpp: - (JSC::JIT::emitOptimizationCheck): - * jsc.cpp: - (printUsageStatement): - (parseArguments): - * runtime/InitializeThreading.cpp: - (JSC::initializeThreadingOnce): - * runtime/JSGlobalData.cpp: - (JSC::enableAssembler): - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::JSGlobalObject): - * runtime/Options.cpp: - (JSC): - (JSC::overrideOptionWithHeuristic): - (JSC::Options::initialize): - (JSC::Options::setOption): - (JSC::Options::dumpAllOptions): - (JSC::Options::dumpOption): - * runtime/Options.h: - (JSC): - (Options): - (EntryInfo): - -2012-07-03 Jocelyn Turcotte Joel Dillon - - [Qt][Win] Fix broken QtWebKit5.lib linking - https://bugs.webkit.org/show_bug.cgi?id=88321 - - Reviewed by Kenneth Rohde Christiansen. - - The goal is to have different ports build systems define STATICALLY_LINKED_WITH_WTF - when building JavaScriptCore, if both are packaged in the same DLL, instead - of relying on the code to handle this. - The effects of BUILDING_* and STATICALLY_LINKED_WITH_* are currently the same - except for a check in Source/JavaScriptCore/config.h. - - Keeping the old way for the WX port as requested by the port's contributors. - For non-Windows ports there is no difference between IMPORT and EXPORT, no - change is needed. - - * API/JSBase.h: - JS symbols shouldn't be included by WTF objects anymore. Remove the export when BUILDING_WTF. - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: - Make sure that JavaScriptCore uses import symbols of WTF for the Win port. - * runtime/JSExportMacros.h: - -2012-07-02 Filip Pizlo - - DFG OSR exit value recoveries should be computed lazily - https://bugs.webkit.org/show_bug.cgi?id=82155 - - Reviewed by Gavin Barraclough. - - This change aims to reduce one aspect of DFG compile times: the fact - that we currently compute the value recoveries for each local and - argument on every speculation check. We compile many speculation checks, - so this can add up quick. The strategy that this change takes is to - have the DFG save just enough information about how the compiler is - choosing to represent state, that the DFG::OSRExitCompiler can reify - the value recoveries lazily. - - This appears to be an 0.3% SunSpider speed-up and is neutral elsewhere. - - I also took the opportunity to fix the sampling regions profiler (it - was missing an export macro) and to put in more sampling regions in - the DFG (which are disabled so long as ENABLE(SAMPLING_REGIONS) is - false). - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * bytecode/CodeBlock.cpp: - (JSC): - (JSC::CodeBlock::shrinkDFGDataToFit): - * bytecode/CodeBlock.h: - (CodeBlock): - (JSC::CodeBlock::minifiedDFG): - (JSC::CodeBlock::variableEventStream): - (DFGData): - * bytecode/Operands.h: - (JSC::Operands::hasOperand): - (Operands): - (JSC::Operands::size): - (JSC::Operands::at): - (JSC::Operands::operator[]): - (JSC::Operands::isArgument): - (JSC::Operands::isVariable): - (JSC::Operands::argumentForIndex): - (JSC::Operands::variableForIndex): - (JSC::Operands::operandForIndex): - (JSC): - (JSC::dumpOperands): - * bytecode/SamplingTool.h: - (SamplingRegion): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::parse): - * dfg/DFGCFAPhase.cpp: - (JSC::DFG::performCFA): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::performCSE): - * dfg/DFGFixupPhase.cpp: - (JSC::DFG::performFixup): - * dfg/DFGGenerationInfo.h: - (JSC::DFG::GenerationInfo::GenerationInfo): - (JSC::DFG::GenerationInfo::initConstant): - (JSC::DFG::GenerationInfo::initInteger): - (JSC::DFG::GenerationInfo::initJSValue): - (JSC::DFG::GenerationInfo::initCell): - (JSC::DFG::GenerationInfo::initBoolean): - (JSC::DFG::GenerationInfo::initDouble): - (JSC::DFG::GenerationInfo::initStorage): - (GenerationInfo): - (JSC::DFG::GenerationInfo::noticeOSRBirth): - (JSC::DFG::GenerationInfo::use): - (JSC::DFG::GenerationInfo::spill): - (JSC::DFG::GenerationInfo::setSpilled): - (JSC::DFG::GenerationInfo::fillJSValue): - (JSC::DFG::GenerationInfo::fillCell): - (JSC::DFG::GenerationInfo::fillInteger): - (JSC::DFG::GenerationInfo::fillBoolean): - (JSC::DFG::GenerationInfo::fillDouble): - (JSC::DFG::GenerationInfo::fillStorage): - (JSC::DFG::GenerationInfo::appendFill): - (JSC::DFG::GenerationInfo::appendSpill): - * dfg/DFGJITCompiler.cpp: - (JSC::DFG::JITCompiler::link): - (JSC::DFG::JITCompiler::compile): - (JSC::DFG::JITCompiler::compileFunction): - * dfg/DFGMinifiedGraph.h: Added. - (DFG): - (MinifiedGraph): - (JSC::DFG::MinifiedGraph::MinifiedGraph): - (JSC::DFG::MinifiedGraph::at): - (JSC::DFG::MinifiedGraph::append): - (JSC::DFG::MinifiedGraph::prepareAndShrink): - (JSC::DFG::MinifiedGraph::setOriginalGraphSize): - (JSC::DFG::MinifiedGraph::originalGraphSize): - * dfg/DFGMinifiedNode.cpp: Added. - (DFG): - (JSC::DFG::MinifiedNode::fromNode): - * dfg/DFGMinifiedNode.h: Added. - (DFG): - (JSC::DFG::belongsInMinifiedGraph): - (MinifiedNode): - (JSC::DFG::MinifiedNode::MinifiedNode): - (JSC::DFG::MinifiedNode::index): - (JSC::DFG::MinifiedNode::op): - (JSC::DFG::MinifiedNode::hasChild1): - (JSC::DFG::MinifiedNode::child1): - (JSC::DFG::MinifiedNode::hasConstant): - (JSC::DFG::MinifiedNode::hasConstantNumber): - (JSC::DFG::MinifiedNode::constantNumber): - (JSC::DFG::MinifiedNode::hasWeakConstant): - (JSC::DFG::MinifiedNode::weakConstant): - (JSC::DFG::MinifiedNode::getIndex): - (JSC::DFG::MinifiedNode::compareByNodeIndex): - (JSC::DFG::MinifiedNode::hasChild): - * dfg/DFGNode.h: - (Node): - * dfg/DFGOSRExit.cpp: - (JSC::DFG::OSRExit::OSRExit): - * dfg/DFGOSRExit.h: - (OSRExit): - * dfg/DFGOSRExitCompiler.cpp: - * dfg/DFGOSRExitCompiler.h: - (OSRExitCompiler): - * dfg/DFGOSRExitCompiler32_64.cpp: - (JSC::DFG::OSRExitCompiler::compileExit): - * dfg/DFGOSRExitCompiler64.cpp: - (JSC::DFG::OSRExitCompiler::compileExit): - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::performPredictionPropagation): - * dfg/DFGRedundantPhiEliminationPhase.cpp: - (JSC::DFG::performRedundantPhiElimination): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::SpeculativeJIT): - (DFG): - (JSC::DFG::SpeculativeJIT::fillStorage): - (JSC::DFG::SpeculativeJIT::noticeOSRBirth): - (JSC::DFG::SpeculativeJIT::compileMovHint): - (JSC::DFG::SpeculativeJIT::compile): - (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor): - * dfg/DFGSpeculativeJIT.h: - (DFG): - (JSC::DFG::SpeculativeJIT::use): - (SpeculativeJIT): - (JSC::DFG::SpeculativeJIT::spill): - (JSC::DFG::SpeculativeJIT::speculationCheck): - (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck): - (JSC::DFG::SpeculativeJIT::recordSetLocal): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::fillInteger): - (JSC::DFG::SpeculativeJIT::fillDouble): - (JSC::DFG::SpeculativeJIT::fillJSValue): - (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): - (JSC::DFG::SpeculativeJIT::fillSpeculateDouble): - (JSC::DFG::SpeculativeJIT::fillSpeculateCell): - (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::fillInteger): - (JSC::DFG::SpeculativeJIT::fillDouble): - (JSC::DFG::SpeculativeJIT::fillJSValue): - (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): - (JSC::DFG::SpeculativeJIT::fillSpeculateDouble): - (JSC::DFG::SpeculativeJIT::fillSpeculateCell): - (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGValueRecoveryOverride.h: Added. - (DFG): - (ValueRecoveryOverride): - (JSC::DFG::ValueRecoveryOverride::ValueRecoveryOverride): - * dfg/DFGValueSource.cpp: Added. - (DFG): - (JSC::DFG::ValueSource::dump): - * dfg/DFGValueSource.h: Added. - (DFG): - (JSC::DFG::dataFormatToValueSourceKind): - (JSC::DFG::valueSourceKindToDataFormat): - (JSC::DFG::isInRegisterFile): - (ValueSource): - (JSC::DFG::ValueSource::ValueSource): - (JSC::DFG::ValueSource::forPrediction): - (JSC::DFG::ValueSource::forDataFormat): - (JSC::DFG::ValueSource::isSet): - (JSC::DFG::ValueSource::kind): - (JSC::DFG::ValueSource::isInRegisterFile): - (JSC::DFG::ValueSource::dataFormat): - (JSC::DFG::ValueSource::valueRecovery): - (JSC::DFG::ValueSource::nodeIndex): - (JSC::DFG::ValueSource::nodeIndexFromKind): - (JSC::DFG::ValueSource::kindFromNodeIndex): - * dfg/DFGVariableEvent.cpp: Added. - (DFG): - (JSC::DFG::VariableEvent::dump): - (JSC::DFG::VariableEvent::dumpFillInfo): - (JSC::DFG::VariableEvent::dumpSpillInfo): - * dfg/DFGVariableEvent.h: Added. - (DFG): - (VariableEvent): - (JSC::DFG::VariableEvent::VariableEvent): - (JSC::DFG::VariableEvent::reset): - (JSC::DFG::VariableEvent::fillGPR): - (JSC::DFG::VariableEvent::fillPair): - (JSC::DFG::VariableEvent::fillFPR): - (JSC::DFG::VariableEvent::spill): - (JSC::DFG::VariableEvent::death): - (JSC::DFG::VariableEvent::setLocal): - (JSC::DFG::VariableEvent::movHint): - (JSC::DFG::VariableEvent::kind): - (JSC::DFG::VariableEvent::nodeIndex): - (JSC::DFG::VariableEvent::dataFormat): - (JSC::DFG::VariableEvent::gpr): - (JSC::DFG::VariableEvent::tagGPR): - (JSC::DFG::VariableEvent::payloadGPR): - (JSC::DFG::VariableEvent::fpr): - (JSC::DFG::VariableEvent::virtualRegister): - (JSC::DFG::VariableEvent::operand): - (JSC::DFG::VariableEvent::variableRepresentation): - * dfg/DFGVariableEventStream.cpp: Added. - (DFG): - (JSC::DFG::VariableEventStream::logEvent): - (MinifiedGenerationInfo): - (JSC::DFG::MinifiedGenerationInfo::MinifiedGenerationInfo): - (JSC::DFG::MinifiedGenerationInfo::update): - (JSC::DFG::VariableEventStream::reconstruct): - * dfg/DFGVariableEventStream.h: Added. - (DFG): - (VariableEventStream): - (JSC::DFG::VariableEventStream::appendAndLog): - * dfg/DFGVirtualRegisterAllocationPhase.cpp: - (JSC::DFG::performVirtualRegisterAllocation): - -2012-07-02 Filip Pizlo - - DFG::ArgumentsSimplificationPhase should assert that the PhantomArguments nodes it creates are not shouldGenerate() - https://bugs.webkit.org/show_bug.cgi?id=90407 - - Reviewed by Mark Hahnenberg. - - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - -2012-07-02 Gavin Barraclough - - Array.prototype.pop should throw if property is not configurable - https://bugs.webkit.org/show_bug.cgi?id=75788 - - Rubber Stamped by Oliver Hunt. - - No real bug here any more, but the error we throw sometimes has a misleading message. - - * runtime/JSArray.cpp: - (JSC::JSArray::pop): - -2012-06-29 Filip Pizlo - - JSObject wastes too much memory on unused property slots - https://bugs.webkit.org/show_bug.cgi?id=90255 - - Reviewed by Mark Hahnenberg. - - Rolling back in after applying a simple fix: it appears that - JSObject::setStructureAndReallocateStorageIfNecessary() was allocating more - property storage than necessary. Fixing this appears to resolve the crash. - - This does a few things: - - - JSNonFinalObject no longer has inline property storage. - - - Initial out-of-line property storage size is 4 slots for JSNonFinalObject, - or 2x the inline storage for JSFinalObject. - - - Property storage is only reallocated if it needs to be. Previously, we - would reallocate the property storage on any transition where the original - structure said shouldGrowProperyStorage(), but this led to spurious - reallocations when doing transitionless property adds and there are - deleted property slots available. That in turn led to crashes, because we - would switch to out-of-line storage even if the capacity matched the - criteria for inline storage. - - - Inline JSFunction allocation is killed off because we don't have a good - way of inlining property storage allocation. This didn't hurt performance. - Killing off code is better than fixing it if that code wasn't doing any - good. - - This looks like a 1% progression on V8. - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): - * jit/JIT.cpp: - (JSC::JIT::privateCompileSlowCases): - * jit/JIT.h: - * jit/JITInlineMethods.h: - (JSC::JIT::emitAllocateBasicJSObject): - (JSC): - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_new_func): - (JSC): - (JSC::JIT::emit_op_new_func_exp): - * runtime/JSFunction.cpp: - (JSC::JSFunction::finishCreation): - * runtime/JSObject.h: - (JSC::JSObject::isUsingInlineStorage): - (JSObject): - (JSC::JSObject::finishCreation): - (JSC): - (JSC::JSNonFinalObject::hasInlineStorage): - (JSNonFinalObject): - (JSC::JSNonFinalObject::JSNonFinalObject): - (JSC::JSNonFinalObject::finishCreation): - (JSC::JSFinalObject::hasInlineStorage): - (JSC::JSFinalObject::finishCreation): - (JSC::JSObject::offsetOfInlineStorage): - (JSC::JSObject::setPropertyStorage): - (JSC::Structure::inlineStorageCapacity): - (JSC::Structure::isUsingInlineStorage): - (JSC::JSObject::putDirectInternal): - (JSC::JSObject::setStructureAndReallocateStorageIfNecessary): - (JSC::JSObject::putDirectWithoutTransition): - * runtime/Structure.cpp: - (JSC::Structure::Structure): - (JSC::nextPropertyStorageCapacity): - (JSC): - (JSC::Structure::growPropertyStorageCapacity): - (JSC::Structure::suggestedNewPropertyStorageSize): - * runtime/Structure.h: - (JSC::Structure::putWillGrowPropertyStorage): - (Structure): - -2012-06-29 Filip Pizlo - - Webkit crashes in DFG on Google Docs when creating a new document - https://bugs.webkit.org/show_bug.cgi?id=90209 - - Reviewed by Gavin Barraclough. - - Don't attempt to short-circuit Phantom(GetLocal) if the GetLocal is for a - captured variable. - - * dfg/DFGCFGSimplificationPhase.cpp: - (JSC::DFG::CFGSimplificationPhase::mergeBlocks): - -2012-06-30 Zan Dobersek - - Unreviewed, rolling out r121605. - http://trac.webkit.org/changeset/121605 - https://bugs.webkit.org/show_bug.cgi?id=90336 - - Changes caused flaky crashes in sputnik/Unicode tests on Apple - WK1 and GTK Linux builders - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): - * jit/JIT.cpp: - (JSC::JIT::privateCompileSlowCases): - * jit/JIT.h: - * jit/JITInlineMethods.h: - (JSC::JIT::emitAllocateBasicJSObject): - (JSC::JIT::emitAllocateJSFinalObject): - (JSC): - (JSC::JIT::emitAllocateJSFunction): - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_new_func): - (JSC::JIT::emitSlow_op_new_func): - (JSC): - (JSC::JIT::emit_op_new_func_exp): - (JSC::JIT::emitSlow_op_new_func_exp): - * runtime/JSFunction.cpp: - (JSC::JSFunction::finishCreation): - * runtime/JSObject.h: - (JSC::JSObject::isUsingInlineStorage): - (JSObject): - (JSC::JSObject::finishCreation): - (JSC): - (JSNonFinalObject): - (JSC::JSNonFinalObject::JSNonFinalObject): - (JSC::JSNonFinalObject::finishCreation): - (JSFinalObject): - (JSC::JSFinalObject::finishCreation): - (JSC::JSObject::offsetOfInlineStorage): - (JSC::JSObject::setPropertyStorage): - (JSC::Structure::isUsingInlineStorage): - (JSC::JSObject::putDirectInternal): - (JSC::JSObject::putDirectWithoutTransition): - (JSC::JSObject::transitionTo): - * runtime/Structure.cpp: - (JSC::Structure::Structure): - (JSC): - (JSC::Structure::growPropertyStorageCapacity): - (JSC::Structure::suggestedNewPropertyStorageSize): - * runtime/Structure.h: - (JSC::Structure::shouldGrowPropertyStorage): - (JSC::Structure::propertyStorageSize): - -2012-06-29 Mark Hahnenberg - - Remove warning about protected values when the Heap is being destroyed - https://bugs.webkit.org/show_bug.cgi?id=90302 - - Reviewed by Geoffrey Garen. - - Having to do book-keeping about whether values allocated from a certain - VM are or are not protected makes the JSC API much more difficult to use - correctly. Clients should be able to throw an entire VM away and not have - to worry about unprotecting all of the values that they protected earlier. - - * heap/Heap.cpp: - (JSC::Heap::lastChanceToFinalize): - -2012-06-29 Filip Pizlo - - JSObject wastes too much memory on unused property slots - https://bugs.webkit.org/show_bug.cgi?id=90255 - - Reviewed by Mark Hahnenberg. - - This does a few things: - - - JSNonFinalObject no longer has inline property storage. - - - Initial out-of-line property storage size is 4 slots for JSNonFinalObject, - or 2x the inline storage for JSFinalObject. - - - Property storage is only reallocated if it needs to be. Previously, we - would reallocate the property storage on any transition where the original - structure said shouldGrowProperyStorage(), but this led to spurious - reallocations when doing transitionless property adds and there are - deleted property slots available. That in turn led to crashes, because we - would switch to out-of-line storage even if the capacity matched the - criteria for inline storage. - - - Inline JSFunction allocation is killed off because we don't have a good - way of inlining property storage allocation. This didn't hurt performance. - Killing off code is better than fixing it if that code wasn't doing any - good. - - This looks like a 1% progression on V8. - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): - * jit/JIT.cpp: - (JSC::JIT::privateCompileSlowCases): - * jit/JIT.h: - * jit/JITInlineMethods.h: - (JSC::JIT::emitAllocateBasicJSObject): - (JSC): - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_new_func): - (JSC): - (JSC::JIT::emit_op_new_func_exp): - * runtime/JSFunction.cpp: - (JSC::JSFunction::finishCreation): - * runtime/JSObject.h: - (JSC::JSObject::isUsingInlineStorage): - (JSObject): - (JSC::JSObject::finishCreation): - (JSC): - (JSC::JSNonFinalObject::hasInlineStorage): - (JSNonFinalObject): - (JSC::JSNonFinalObject::JSNonFinalObject): - (JSC::JSNonFinalObject::finishCreation): - (JSC::JSFinalObject::hasInlineStorage): - (JSC::JSFinalObject::finishCreation): - (JSC::JSObject::offsetOfInlineStorage): - (JSC::JSObject::setPropertyStorage): - (JSC::Structure::inlineStorageCapacity): - (JSC::Structure::isUsingInlineStorage): - (JSC::JSObject::putDirectInternal): - (JSC::JSObject::setStructureAndReallocateStorageIfNecessary): - (JSC::JSObject::putDirectWithoutTransition): - * runtime/Structure.cpp: - (JSC::Structure::Structure): - (JSC::nextPropertyStorageCapacity): - (JSC): - (JSC::Structure::growPropertyStorageCapacity): - (JSC::Structure::suggestedNewPropertyStorageSize): - * runtime/Structure.h: - (JSC::Structure::putWillGrowPropertyStorage): - (Structure): - -2012-06-28 Filip Pizlo - - DFG recompilation heuristics should be based on count, not rate - https://bugs.webkit.org/show_bug.cgi?id=90146 - - Reviewed by Oliver Hunt. - - This removes a bunch of code that was previously trying to prevent spurious - reoptimizations if a large enough majority of executions of a code block did - not result in OSR exit. It turns out that this code was purely harmful. This - patch removes all of that logic and replaces it with a dead-simple - heuristic: if you exit more than N times (where N is an exponential function - of the number of times the code block has already been recompiled) then we - will recompile. - - This appears to be a broad ~1% win on many benchmarks large and small. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::CodeBlock): - * bytecode/CodeBlock.h: - (JSC::CodeBlock::osrExitCounter): - (JSC::CodeBlock::countOSRExit): - (CodeBlock): - (JSC::CodeBlock::addressOfOSRExitCounter): - (JSC::CodeBlock::offsetOfOSRExitCounter): - (JSC::CodeBlock::adjustedExitCountThreshold): - (JSC::CodeBlock::exitCountThresholdForReoptimization): - (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop): - (JSC::CodeBlock::shouldReoptimizeNow): - (JSC::CodeBlock::shouldReoptimizeFromLoopNow): - * bytecode/ExecutionCounter.cpp: - (JSC::ExecutionCounter::setThreshold): - * bytecode/ExecutionCounter.h: - (ExecutionCounter): - (JSC::ExecutionCounter::clippedThreshold): - * dfg/DFGJITCompiler.cpp: - (JSC::DFG::JITCompiler::compileBody): - * dfg/DFGOSRExit.cpp: - (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow): - * dfg/DFGOSRExitCompiler.cpp: - (JSC::DFG::OSRExitCompiler::handleExitCounts): - * dfg/DFGOperations.cpp: - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * runtime/Options.cpp: - (Options): - (JSC::Options::initializeOptions): - * runtime/Options.h: - (Options): - -2012-06-28 Mark Lam - - Adding a commenting utility to record BytecodeGenerator comments - with opcodes that are emitted. Presently, the comments can only - be constant strings. Adding comments for opcodes is optional. - If a comment is added, the comment will be printed following the - opcode when CodeBlock::dump() is called. - - This utility is disabled by default, and is only meant for VM - development purposes. It should not be enabled for product builds. - - To enable this utility, set ENABLE_BYTECODE_COMMENTS in CodeBlock.h - to 1. - - https://bugs.webkit.org/show_bug.cgi?id=90095 - - Reviewed by Geoffrey Garen. - - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dumpBytecodeCommentAndNewLine): Dumps the comment. - (JSC): - (JSC::CodeBlock::printUnaryOp): Add comment dumps. - (JSC::CodeBlock::printBinaryOp): Add comment dumps. - (JSC::CodeBlock::printConditionalJump): Add comment dumps. - (JSC::CodeBlock::printCallOp): Add comment dumps. - (JSC::CodeBlock::printPutByIdOp): Add comment dumps. - (JSC::CodeBlock::dump): Add comment dumps. - (JSC::CodeBlock::CodeBlock): - (JSC::CodeBlock::commentForBytecodeOffset): - Finds the comment for an opcode if available. - (JSC::CodeBlock::dumpBytecodeComments): - For debugging whether comments are collected. - It is not being called anywhere. - * bytecode/CodeBlock.h: - (CodeBlock): - (JSC::CodeBlock::bytecodeComments): - * bytecode/Comment.h: Added. - (JSC): - (Comment): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::BytecodeGenerator): - (JSC::BytecodeGenerator::emitOpcode): Calls emitComment(). - (JSC): - (JSC::BytecodeGenerator::emitComment): Adds comment to CodeBlock. - (JSC::BytecodeGenerator::prependComment): - Registers a comment for emitComemnt() to use later. - * bytecompiler/BytecodeGenerator.h: - (BytecodeGenerator): - (JSC::BytecodeGenerator::emitComment): - (JSC::BytecodeGenerator::prependComment): - These are inlined versions of these functions that nullify them - when ENABLE_BYTECODE_COMMENTS is 0. - (JSC::BytecodeGenerator::comments): - -2012-06-28 Oliver Hunt - - 32bit DFG incorrectly claims an fpr is fillable even if it has not been proven double - https://bugs.webkit.org/show_bug.cgi?id=90127 - - Reviewed by Filip Pizlo. - - The 32-bit version of fillSpeculateDouble doesn't handle Number->fpr loads - correctly. This patch fixes this by killing the fill info in the GenerationInfo - when the spillFormat doesn't guarantee the value is a double. - - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::fillSpeculateDouble): - -2012-06-28 Kent Tamura - - Classify form control states by their owner forms - https://bugs.webkit.org/show_bug.cgi?id=89950 - - Reviewed by Hajime Morita. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - Expose WTF::StringBuilder::canShrink() - -2012-06-27 Michael Saboff - - [Win] jscore-tests flakey - https://bugs.webkit.org/show_bug.cgi?id=88118 - - Reviewed by Jessie Berlin. - - jsDriver.pl on windows intermittently doesn't get the returned value from jsc, - instead it gets 126. Added a new option to jsc (-x) which prints the exit - code before exiting. jsDriver.pl uses this option on Windows and parses the - exit code output for the exit code, removing it before comparing the actual - and expected outputs. Filed a follow on "FIXME" defect: - [WIN] Intermittent failure for jsc return value to propagate through jsDriver.pl - https://bugs.webkit.org/show_bug.cgi?id=90119 - - * jsc.cpp: - (CommandLine::CommandLine): - (CommandLine): - (printUsageStatement): - (parseArguments): - (jscmain): - * tests/mozilla/jsDriver.pl: - (execute_tests): - -2012-06-27 Sheriff Bot - - Unreviewed, rolling out r121359. - http://trac.webkit.org/changeset/121359 - https://bugs.webkit.org/show_bug.cgi?id=90115 - - Broke many inspector tests (Requested by jpfau on #webkit). - - * interpreter/Interpreter.h: - (JSC::StackFrame::toString): - -2012-06-27 Filip Pizlo - - Javascript SHA-512 gives wrong hash on second and subsequent runs unless Web Inspector Javascript Debugging is on - https://bugs.webkit.org/show_bug.cgi?id=90053 - - - Reviewed by Mark Hahnenberg. - - The problem is that the code was assuming that the recovery should be Undefined if the source of - the SetLocal was !shouldGenerate(). But that's wrong, since the DFG optimizer may skip around a - UInt32ToNumber node (hence making it !shouldGenerate()) and keep the source of that node alive. - In that case we should base the recovery on the source of the UInt32ToNumber. The logic for this - was already in place but the fast check for !shouldGenerate() broke it. - - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor): - -2012-06-27 Filip Pizlo - - DFG disassembly should be easier to read - https://bugs.webkit.org/show_bug.cgi?id=90106 - - Reviewed by Mark Hahnenberg. - - Did a few things: - - - Options::showDFGDisassembly now shows OSR exit disassembly as well. - - - Phi node dumping doesn't attempt to do line wrapping since it just made the dump harder - to read. - - - DFG graph disassembly view shows a few additional node types that turn out to be - essential for understanding OSR exits. - - Put together, these changes reinforce the philosophy that anything needed for computing - OSR exit is just as important as the machine code itself. Of course, we still don't take - that philosophy to its full extreme - for example Phantom nodes are not dumped. We may - revisit that in the future. - - * assembler/LinkBuffer.cpp: - (JSC::LinkBuffer::finalizeCodeWithDisassembly): - * assembler/LinkBuffer.h: - (JSC): - * dfg/DFGDisassembler.cpp: - (JSC::DFG::Disassembler::dump): - * dfg/DFGGraph.cpp: - (JSC::DFG::Graph::dumpBlockHeader): - * dfg/DFGNode.h: - (JSC::DFG::Node::willHaveCodeGenOrOSR): - * dfg/DFGOSRExitCompiler.cpp: - * jit/JIT.cpp: - (JSC::JIT::privateCompile): - -2012-06-25 Mark Hahnenberg - - JSLock should be per-JSGlobalData - https://bugs.webkit.org/show_bug.cgi?id=89123 - - Reviewed by Geoffrey Garen. - - * API/APIShims.h: - (APIEntryShimWithoutLock): - (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to - determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the - HeapTimer class because timerDidFire could run after somebody has started to tear down that particular - JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after - its destruction has begun. - (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock): - (JSC::APIEntryShim::APIEntryShim): - (APIEntryShim): - (JSC::APIEntryShim::~APIEntryShim): - (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors. - Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock - and before we've released it, which can only done in APIEntryShim. - (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here. - * API/JSContextRef.cpp: - (JSGlobalContextCreate): - (JSGlobalContextCreateInGroup): - (JSGlobalContextRelease): - (JSContextCreateBacktrace): - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - * heap/CopiedSpace.cpp: - (JSC::CopiedSpace::tryAllocateSlowCase): - * heap/Heap.cpp: - (JSC::Heap::protect): - (JSC::Heap::unprotect): - (JSC::Heap::collect): - (JSC::Heap::setActivityCallback): - (JSC::Heap::activityCallback): - (JSC::Heap::sweeper): - * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they - are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback - and the IncrementalSweeper to make sure they're the last things that get initialized during construction to - prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about. - (Heap): - * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown. - (JSC::HeapTimer::~HeapTimer): - (JSC::HeapTimer::invalidate): - (JSC): - (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread - that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the - HeapTimer and schedule it to fire immediately so that it can notice and kill itself. - (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed - out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim, - but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case - we were interrupted between releasing our mutex and trying to grab the APILock. - * heap/HeapTimer.h: - (HeapTimer): - * heap/IncrementalSweeper.cpp: - (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles - all of that for us. - (JSC::IncrementalSweeper::create): - * heap/IncrementalSweeper.h: - (IncrementalSweeper): - * heap/MarkedAllocator.cpp: - (JSC::MarkedAllocator::allocateSlowCase): - * heap/WeakBlock.cpp: - (JSC::WeakBlock::reap): - * jsc.cpp: - (functionGC): - (functionReleaseExecutableMemory): - (jscmain): - * runtime/Completion.cpp: - (JSC::checkSyntax): - (JSC::evaluate): - * runtime/GCActivityCallback.h: - (DefaultGCActivityCallback): - (JSC::DefaultGCActivityCallback::create): - * runtime/JSGlobalData.cpp: - (JSC::JSGlobalData::JSGlobalData): - (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper) - that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity - it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the - APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes. - (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock. - (JSC::JSGlobalData::sharedInstanceInternal): - * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and - de-refing JSGlobalDatas on separate threads since we don't do it that often anyways. - (JSGlobalData): - (JSC::JSGlobalData::apiLock): - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::~JSGlobalObject): - (JSC::JSGlobalObject::init): - * runtime/JSLock.cpp: - (JSC): - (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance. - (JSC::GlobalJSLock::~GlobalJSLock): - (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that - it can successfully unlock it later without it disappearing from underneath it. - (JSC::JSLockHolder::~JSLockHolder): - (JSC::JSLock::JSLock): - (JSC::JSLock::~JSLock): - (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for - actually waiting for long periods. - (JSC::JSLock::unlock): - (JSC::JSLock::currentThreadIsHoldingLock): - (JSC::JSLock::dropAllLocks): - (JSC::JSLock::dropAllLocksUnconditionally): - (JSC::JSLock::grabAllLocks): - (JSC::JSLock::DropAllLocks::DropAllLocks): - (JSC::JSLock::DropAllLocks::~DropAllLocks): - * runtime/JSLock.h: - (JSC): - (GlobalJSLock): - (JSLockHolder): - (JSLock): - (DropAllLocks): - * runtime/WeakGCMap.h: - (JSC::WeakGCMap::set): - * testRegExp.cpp: - (realMain): - -2012-06-27 Filip Pizlo - - x86 disassembler confuses immediates with addresses - https://bugs.webkit.org/show_bug.cgi?id=90099 - - Reviewed by Mark Hahnenberg. - - Prepend "$" to immediates to disambiguate between immediates and addresses. This is in - accordance with the gas and AT&T syntax. - - * disassembler/udis86/udis86_syn-att.c: - (gen_operand): - -2012-06-27 Filip Pizlo - - Add a comment clarifying Options::showDisassembly versus Options::showDFGDisassembly. - - Rubber stamped by Mark Hahnenberg. - - * runtime/Options.cpp: - (JSC::Options::initializeOptions): - -2012-06-27 Anthony Scian - - Web Inspector [JSC]: Implement ScriptCallStack::stackTrace - https://bugs.webkit.org/show_bug.cgi?id=40118 - - Reviewed by Yong Li. - - Added member functions to expose function name, urlString, and line #. - Refactored toString to make use of these member functions to reduce - duplicated code for future maintenance. - - Manually tested refactoring of toString by tracing thrown exceptions. - - * interpreter/Interpreter.h: - (StackFrame): - (JSC::StackFrame::toString): - (JSC::StackFrame::friendlySourceURL): - (JSC::StackFrame::friendlyFunctionName): - (JSC::StackFrame::friendlyLineNumber): - -2012-06-27 Oswald Buddenhagen - - [Qt] Remove redundant c++11 warning suppression code - - This is already handled in default_post. - - Reviewed by Tor Arne Vestbø. - - * Target.pri: - -2012-06-26 Tor Arne Vestbø - - [Qt] Add missing heades to HEADERS - - For JavaScriptCore there aren't any Qt specific files, so we include all - headers for easy editing in Qt Creator. - - Reviewed by Simon Hausmann. - - * Target.pri: - -2012-06-26 Dominic Cooney - - [Chromium] Remove unused build scripts and empty folders for JavaScriptCore w/ gyp - https://bugs.webkit.org/show_bug.cgi?id=90029 - - Reviewed by Adam Barth. - - * gyp: Removed. - * gyp/generate-derived-sources.sh: Removed. - * gyp/generate-dtrace-header.sh: Removed. - * gyp/run-if-exists.sh: Removed. - * gyp/update-info-plist.sh: Removed. - -2012-06-26 Geoffrey Garen - - Reduced (but did not eliminate) use of "berzerker GC" - https://bugs.webkit.org/show_bug.cgi?id=89237 - - Reviewed by Gavin Barraclough. - - (PART 2) - - This part turns off "berzerker GC" and turns on incremental shrinking. - - * heap/IncrementalSweeper.cpp: - (JSC::IncrementalSweeper::doSweep): Free or shrink after sweeping to - maintain the behavior we used to get from the occasional berzerker GC, - which would run all finalizers and then free or shrink all blocks - synchronously. - - * heap/MarkedBlock.h: - (JSC::MarkedBlock::needsSweeping): Sweep zapped blocks, too. It's always - safe to sweep a zapped block (that's the point of zapping), and it's - sometimes profitable. For example, consider this case: Block A does some - allocation (transitioning Block A from Marked to FreeListed), then GC - happens (transitioning Block A to Zapped), then all objects in Block A - are free, then the incremental sweeper visits Block A. If we skipped - Zapped blocks, we'd skip Block A, even though it would be profitable to - run its destructors and free its memory. - - * runtime/GCActivityCallback.cpp: - (JSC::DefaultGCActivityCallback::doWork): Don't sweep eagerly; we'll do - this incrementally. - -2012-06-26 Filip Pizlo - - DFG PutByValAlias is too aggressive - https://bugs.webkit.org/show_bug.cgi?id=90026 - - - Reviewed by Gavin Barraclough. - - For CSE on normal arrays, we now treat PutByVal as impure. This does not appear to affect - performance by much. - - For CSE on typed arrays, we fix PutByValAlias by making GetByVal speculate that the access - is within bounds. This also has the effect of making our out-of-bounds handling consistent - with WebCore. - - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGGraph.h: - (JSC::DFG::Graph::byValIsPure): - (JSC::DFG::Graph::clobbersWorld): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): - (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): - -2012-06-26 Yong Li - - [BlackBerry] Add JSC statistics into about:memory - https://bugs.webkit.org/show_bug.cgi?id=89779 - - Reviewed by Rob Buis. - - Fix non-JIT build on BlackBerry broken by r121196. - - * runtime/MemoryStatistics.cpp: - (JSC::globalMemoryStatistics): - -2012-06-25 Filip Pizlo - - DFG::operationNewArray is unnecessarily slow, and may use the wrong array - prototype when inlined - https://bugs.webkit.org/show_bug.cgi?id=89821 - - Reviewed by Geoffrey Garen. - - Fixes all array allocations to use the right structure, and hence the right prototype. Adds - inlining of new Array(...) with a non-zero number of arguments. Optimizes allocations of - empty arrays. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::handleConstantInternalFunction): - * dfg/DFGCCallHelpers.h: - (JSC::DFG::CCallHelpers::setupArgumentsWithExecState): - (CCallHelpers): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::callOperation): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * runtime/JSArray.h: - (JSC): - (JSC::constructArray): - * runtime/JSGlobalObject.h: - (JSC): - (JSC::constructArray): - -2012-06-26 Filip Pizlo - - New fast/js/dfg-store-unexpected-value-into-argument-and-osr-exit.html fails on 32 bit - https://bugs.webkit.org/show_bug.cgi?id=89953 - - Reviewed by Zoltan Herczeg. - - DFG 32-bit JIT was confused about the difference between a predicted type and a - proven type. This is easy to get confused about, since a local that is predicted int32 - almost always means that the local must be an int32 since speculations are hoisted to - stores to locals. But that is less likely to be the case for arguments, where there is - an additional least-upper-bounding step: any store to an argument with a weird type - may force the argument to be any type. - - This patch basically duplicates the functionality in DFGSpeculativeJIT64.cpp for - GetLocal: the decision of whether to load a local as an int32 (or as an array, or as - a boolean) is made based on the AbstractValue::m_type, which is a type proof, rather - than the VariableAccessData::prediction(), which is a predicted type. - - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - -2012-06-25 Filip Pizlo - - JSC should try to make profiling deterministic because otherwise reproducing failures is - nearly impossible - https://bugs.webkit.org/show_bug.cgi?id=89940 - - Rubber stamped by Gavin Barraclough. - - This rolls out the part of http://trac.webkit.org/changeset/121215 that introduced randomness - into the system. Now, instead of randomizing the tier-up threshold, we always set it to an - artificially low (and statically predetermined!) value. This gives most of the benefit of - threshold randomization without actually making the system behave completely differently on - each invocation. - - * bytecode/ExecutionCounter.cpp: - (JSC::ExecutionCounter::setThreshold): - * runtime/Options.cpp: - (Options): - (JSC::Options::initializeOptions): - * runtime/Options.h: - (Options): - -2012-06-22 Filip Pizlo - - Value profiling should use tier-up threshold randomization to get more coverage - https://bugs.webkit.org/show_bug.cgi?id=89802 - - Reviewed by Gavin Barraclough. - - This patch causes both LLInt and Baseline JIT code to take the OSR slow path several - times before actually doing OSR. If we take the OSR slow path before the execution - count threshold is reached, then we just call CodeBlock::updateAllPredictions() to - compute the current latest least-upper-bound SpecType of all values seen in each - ValueProfile. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::stronglyVisitStrongReferences): - (JSC::CodeBlock::updateAllPredictionsAndCountLiveness): - (JSC): - (JSC::CodeBlock::updateAllPredictions): - (JSC::CodeBlock::shouldOptimizeNow): - * bytecode/CodeBlock.h: - (JSC::CodeBlock::llintExecuteCounter): - (JSC::CodeBlock::jitExecuteCounter): - (CodeBlock): - (JSC::CodeBlock::updateAllPredictions): - * bytecode/ExecutionCounter.cpp: - (JSC::ExecutionCounter::setThreshold): - (JSC::ExecutionCounter::status): - (JSC): - * bytecode/ExecutionCounter.h: - (JSC::ExecutionCounter::count): - (ExecutionCounter): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGOperations.cpp: - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::jitCompileAndSetHeuristics): - (JSC::LLInt::entryOSR): - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::JSGlobalObject): - (JSC): - * runtime/JSGlobalObject.h: - (JSGlobalObject): - (JSC::JSGlobalObject::weakRandomInteger): - * runtime/Options.cpp: - (Options): - (JSC::Options::initializeOptions): - * runtime/Options.h: - (Options): - * runtime/WeakRandom.h: - (WeakRandom): - (JSC::WeakRandom::seedUnsafe): - -2012-06-25 Yong Li - - [BlackBerry] Add JSC statistics into about:memory - https://bugs.webkit.org/show_bug.cgi?id=89779 - - Reviewed by Rob Buis. - - Add MemoryStatistics.cpp into build, and fill JITBytes for BlackBerry port. - - * PlatformBlackBerry.cmake: - * runtime/MemoryStatistics.cpp: - (JSC::globalMemoryStatistics): - -2012-06-23 Sheriff Bot - - Unreviewed, rolling out r121058. - http://trac.webkit.org/changeset/121058 - https://bugs.webkit.org/show_bug.cgi?id=89809 - - Patch causes plugins tests to crash in GTK debug builds - (Requested by zdobersek on #webkit). - - * API/APIShims.h: - (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): - (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock): - (APIEntryShimWithoutLock): - (JSC::APIEntryShim::APIEntryShim): - (APIEntryShim): - (JSC::APICallbackShim::~APICallbackShim): - * API/JSContextRef.cpp: - (JSGlobalContextCreate): - (JSGlobalContextCreateInGroup): - (JSGlobalContextRelease): - (JSContextCreateBacktrace): - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - * heap/CopiedSpace.cpp: - (JSC::CopiedSpace::tryAllocateSlowCase): - * heap/Heap.cpp: - (JSC::Heap::protect): - (JSC::Heap::unprotect): - (JSC::Heap::collect): - (JSC::Heap::setActivityCallback): - (JSC::Heap::activityCallback): - (JSC::Heap::sweeper): - * heap/Heap.h: - (Heap): - * heap/HeapTimer.cpp: - (JSC::HeapTimer::~HeapTimer): - (JSC::HeapTimer::invalidate): - (JSC::HeapTimer::timerDidFire): - (JSC): - * heap/HeapTimer.h: - (HeapTimer): - * heap/IncrementalSweeper.cpp: - (JSC::IncrementalSweeper::doWork): - (JSC::IncrementalSweeper::create): - * heap/IncrementalSweeper.h: - (IncrementalSweeper): - * heap/MarkedAllocator.cpp: - (JSC::MarkedAllocator::allocateSlowCase): - * heap/WeakBlock.cpp: - (JSC::WeakBlock::reap): - * jsc.cpp: - (functionGC): - (functionReleaseExecutableMemory): - (jscmain): - * runtime/Completion.cpp: - (JSC::checkSyntax): - (JSC::evaluate): - * runtime/GCActivityCallback.h: - (DefaultGCActivityCallback): - (JSC::DefaultGCActivityCallback::create): - * runtime/JSGlobalData.cpp: - (JSC::JSGlobalData::JSGlobalData): - (JSC::JSGlobalData::~JSGlobalData): - (JSC::JSGlobalData::sharedInstance): - (JSC::JSGlobalData::sharedInstanceInternal): - * runtime/JSGlobalData.h: - (JSGlobalData): - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::~JSGlobalObject): - (JSC::JSGlobalObject::init): - * runtime/JSLock.cpp: - (JSC): - (JSC::createJSLockCount): - (JSC::JSLock::lockCount): - (JSC::setLockCount): - (JSC::JSLock::JSLock): - (JSC::JSLock::lock): - (JSC::JSLock::unlock): - (JSC::JSLock::currentThreadIsHoldingLock): - (JSC::JSLock::DropAllLocks::DropAllLocks): - (JSC::JSLock::DropAllLocks::~DropAllLocks): - * runtime/JSLock.h: - (JSC): - (JSLock): - (JSC::JSLock::JSLock): - (JSC::JSLock::~JSLock): - (DropAllLocks): - * runtime/WeakGCMap.h: - (JSC::WeakGCMap::set): - * testRegExp.cpp: - (realMain): - -2012-06-22 Alexandru Chiculita - - [CSS Shaders] Re-enable the CSS Shaders compile time flag on Safari Mac - https://bugs.webkit.org/show_bug.cgi?id=89781 - - Reviewed by Dean Jackson. - - Added ENABLE_CSS_SHADERS flag as enabled by default on Safari for Mac. - - * Configurations/FeatureDefines.xcconfig: - -2012-06-22 Filip Pizlo - - DFG tier-up should happen in prologues, not epilogues - https://bugs.webkit.org/show_bug.cgi?id=89752 - - Reviewed by Geoffrey Garen. - - This change has two outcomes: - - 1) Slightly reduces the likelihood that a function will be optimized both - standalone and via inlining. Previously, if you had a call sequence like foo() - calls bar() exactly once, and nobody else calls bar(), then bar() would get - optimized first (because it returns first) and then foo() gets optimized. If foo() - can inline bar() then that means that bar() gets optimized twice. But now, if we - optimize in prologues, then foo() will be optimized first. If it inlines bar(), - that means that there will no longer be any calls to bar(). - - 2) It lets us kill some code in JITStubs. Epilogue tier-up was very different from - loop tier-up, since epilogue tier-up should not attempt OSR. But prologue tier-up - requires OSR (albeit really easy OSR since it's the top of the compilation unit), - so it becomes just like loop tier-up. As a result, we now have one optimization - hook (cti_optimize) instead of two (cti_optimize_from_loop and - cti_optimize_from_ret). - - As a consequence of not having an optimization check in epilogues, the OSR exit - code must now trigger reoptimization itself instead of just signaling the epilogue - check to fire. - - This also adds the ability to count the number of DFG compilations, which was - useful for debugging this patch and might be useful for other things in the future. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::reoptimize): - (JSC): - * bytecode/CodeBlock.h: - (CodeBlock): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseCodeBlock): - * dfg/DFGDriver.cpp: - (DFG): - (JSC::DFG::getNumCompilations): - (JSC::DFG::compile): - * dfg/DFGDriver.h: - (DFG): - * dfg/DFGOSRExitCompiler.cpp: - (JSC::DFG::OSRExitCompiler::handleExitCounts): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * jit/JIT.cpp: - (JSC::JIT::emitOptimizationCheck): - * jit/JIT.h: - * jit/JITCall32_64.cpp: - (JSC::JIT::emit_op_ret): - (JSC::JIT::emit_op_ret_object_or_this): - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_ret): - (JSC::JIT::emit_op_ret_object_or_this): - (JSC::JIT::emit_op_enter): - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::emit_op_enter): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - * jit/JITStubs.h: - -2012-06-20 Mark Hahnenberg - - JSLock should be per-JSGlobalData - https://bugs.webkit.org/show_bug.cgi?id=89123 - - Reviewed by Gavin Barraclough. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - * API/APIShims.h: - (APIEntryShimWithoutLock): - (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to - determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the - HeapTimer class because timerDidFire could run after somebody has started to tear down that particular - JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after - its destruction has begun. - (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock): Now derefs if it also refed. - (JSC::APIEntryShim::APIEntryShim): - (APIEntryShim): - (JSC::APIEntryShim::~APIEntryShim): - (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors. - Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock - and before we've released it, which can only done in APIEntryShim. - (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here. - * API/JSContextRef.cpp: - (JSGlobalContextCreate): - (JSGlobalContextCreateInGroup): - (JSGlobalContextRelease): - (JSContextCreateBacktrace): - * heap/CopiedSpace.cpp: - (JSC::CopiedSpace::tryAllocateSlowCase): - * heap/Heap.cpp: - (JSC::Heap::protect): - (JSC::Heap::unprotect): - (JSC::Heap::collect): - (JSC::Heap::setActivityCallback): - (JSC::Heap::activityCallback): - (JSC::Heap::sweeper): - * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they - are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback - and the IncrementalSweeper to make sure they're the last things that get initialized during construction to - prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about. - (Heap): - * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown. - (JSC::HeapTimer::~HeapTimer): - (JSC::HeapTimer::invalidate): - (JSC): - (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread - that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the - HeapTimer and schedule it to fire immediately so that it can notice and kill itself. - (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed - out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim, - but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case - we were interrupted between releasing our mutex and trying to grab the APILock. - * heap/HeapTimer.h: - (HeapTimer): - * heap/IncrementalSweeper.cpp: - (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles - all of that for us. - (JSC::IncrementalSweeper::create): - * heap/IncrementalSweeper.h: - (IncrementalSweeper): - * heap/MarkedAllocator.cpp: - (JSC::MarkedAllocator::allocateSlowCase): - * heap/WeakBlock.cpp: - (JSC::WeakBlock::reap): - * jsc.cpp: - (functionGC): - (functionReleaseExecutableMemory): - (jscmain): - * runtime/Completion.cpp: - (JSC::checkSyntax): - (JSC::evaluate): - * runtime/GCActivityCallback.h: - (DefaultGCActivityCallback): - (JSC::DefaultGCActivityCallback::create): - * runtime/JSGlobalData.cpp: - (JSC::JSGlobalData::JSGlobalData): - (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper) - that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity - it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the - APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes. - (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock. - (JSC::JSGlobalData::sharedInstanceInternal): - * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and - de-refing JSGlobalDatas on separate threads since we don't do it that often anyways. - (JSGlobalData): - (JSC::JSGlobalData::apiLock): - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::~JSGlobalObject): - (JSC::JSGlobalObject::init): - * runtime/JSLock.cpp: - (JSC): - (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance. - (JSC::GlobalJSLock::~GlobalJSLock): - (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that - it can successfully unlock it later without it disappearing from underneath it. - (JSC::JSLockHolder::~JSLockHolder): - (JSC::JSLock::JSLock): - (JSC::JSLock::~JSLock): - (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for - actually waiting for long periods. - (JSC::JSLock::unlock): - (JSC::JSLock::currentThreadIsHoldingLock): - (JSC::JSLock::dropAllLocks): - (JSC::JSLock::dropAllLocksUnconditionally): - (JSC::JSLock::grabAllLocks): - (JSC::JSLock::DropAllLocks::DropAllLocks): - (JSC::JSLock::DropAllLocks::~DropAllLocks): - * runtime/JSLock.h: - (JSC): - (GlobalJSLock): - (JSLockHolder): - (JSLock): - (DropAllLocks): - * runtime/WeakGCMap.h: - (JSC::WeakGCMap::set): - * testRegExp.cpp: - (realMain): - -2012-06-22 Peter Beverloo - - [Chromium] Disable c++0x compatibility warnings in JavaScriptCore.gyp when building for Android - https://bugs.webkit.org/show_bug.cgi?id=88853 - - Reviewed by Steve Block. - - The Android exclusions were necessary to fix a gyp generation error, as - the gcc_version variable wasn't being defined for Android. Remove these - exceptions when Chromium is able to define the gcc_version variable. - - * JavaScriptCore.gyp/JavaScriptCore.gyp: - -2012-06-21 Filip Pizlo - - op_resolve_global should not prevent DFG inlining - https://bugs.webkit.org/show_bug.cgi?id=89726 - - Reviewed by Gavin Barraclough. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::CodeBlock): - (JSC::CodeBlock::shrinkToFit): - * bytecode/GlobalResolveInfo.h: - (JSC::GlobalResolveInfo::GlobalResolveInfo): - (GlobalResolveInfo): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): - * dfg/DFGCapabilities.h: - (JSC::DFG::canInlineOpcode): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::callOperation): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - -2012-06-20 Filip Pizlo - - DFG should inline 'new Array()' - https://bugs.webkit.org/show_bug.cgi?id=89632 - - Reviewed by Geoffrey Garen. - - This adds support for treating InternalFunction like intrinsics. The code - to do so is actually quite clean, so I don't feel bad about perpetuating - the InternalFunction vs. JSFunction-with-NativeExecutable dichotomy. - - Currently this newfound power is only used to inline 'new Array()'. - - * dfg/DFGByteCodeParser.cpp: - (ByteCodeParser): - (JSC::DFG::ByteCodeParser::handleCall): - (JSC::DFG::ByteCodeParser::handleConstantInternalFunction): - (DFG): - * dfg/DFGGraph.h: - (JSC::DFG::Graph::isInternalFunctionConstant): - (JSC::DFG::Graph::valueOfInternalFunctionConstant): - -2012-06-21 Mark Hahnenberg - - Adding copyrights to new files. - - * heap/HeapTimer.cpp: - * heap/HeapTimer.h: - * heap/IncrementalSweeper.cpp: - * heap/IncrementalSweeper.h: - -2012-06-21 Arnaud Renevier - - make sure headers are included only once per file - https://bugs.webkit.org/show_bug.cgi?id=88922 - - Reviewed by Alexey Proskuryakov. - - * bytecode/CodeBlock.h: - * heap/MachineStackMarker.cpp: - * runtime/JSVariableObject.h: - -2012-06-21 Ryuan Choi - - [EFL][WK2] Make WebKit2/Efl headers and resources installable. - https://bugs.webkit.org/show_bug.cgi?id=88207 - - Reviewed by Chang Shu. - - * shell/CMakeLists.txt: Use ${EXEC_INSTALL_DIR} instead of hardcoding "bin" - -2012-06-20 Geoffrey Garen - - Reduced (but did not eliminate) use of "berzerker GC" - https://bugs.webkit.org/show_bug.cgi?id=89237 - - Reviewed by Gavin Barraclough. - - (PART 1) - - This patch turned out to be crashy, so I'm landing the non-crashy bits - first. - - This part is pre-requisite refactoring. I didn't actually turn off - "berzerker GC" or turn on incremental shrinking. - - * heap/MarkedAllocator.cpp: - (JSC::MarkedAllocator::removeBlock): Make sure to clear the free list when - we throw away the block we're currently allocating out of. Otherwise, we'll - allocate out of a stale free list. - - * heap/MarkedSpace.cpp: - (JSC::Free::Free): - (JSC::Free::operator()): - (JSC::Free::returnValue): Refactored this functor to use a shared helper - function, so we can share our implementation with the incremental sweeper. - - Also changed to freeing individual blocks immediately instead of linking - them into a list for later freeing. This makes the programming interface - simpler, and it's slightly more efficient to boot. - - (JSC::MarkedSpace::~MarkedSpace): Updated for rename. - - (JSC::MarkedSpace::freeBlock): - (JSC::MarkedSpace::freeOrShrinkBlock): New helper functions to share behavior - with the incremental sweeper. - - (JSC::MarkedSpace::shrink): Updated for new functor behavior. - - * heap/MarkedSpace.h: Statically typed languages are awesome. - -2012-06-20 Filip Pizlo - - DFG should optimize ResolveGlobal - https://bugs.webkit.org/show_bug.cgi?id=89617 - - Reviewed by Oliver Hunt. - - This adds inlining of ResolveGlobal accesses that are known monomorphic. It also - adds the specific function optimization to ResolveGlobal, when it is inlined. And, - it makes internal functions act like specific functions, since that will be the - most common use-case of this optimization. - - This is only a slighy speed-up (sub 1%), since we don't yet do the obvious thing - with this optimization, which is to completely inline common "globally resolved" - function and constructor calls, like "new Array()". - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::globalResolveInfoForBytecodeOffset): - * bytecode/CodeBlock.h: - (CodeBlock): - (JSC::CodeBlock::numberOfGlobalResolveInfos): - * bytecode/GlobalResolveInfo.h: - (JSC::getGlobalResolveInfoBytecodeOffset): - (JSC): - * bytecode/ResolveGlobalStatus.cpp: Added. - (JSC): - (JSC::computeForStructure): - (JSC::computeForLLInt): - (JSC::ResolveGlobalStatus::computeFor): - * bytecode/ResolveGlobalStatus.h: Added. - (JSC): - (ResolveGlobalStatus): - (JSC::ResolveGlobalStatus::ResolveGlobalStatus): - (JSC::ResolveGlobalStatus::state): - (JSC::ResolveGlobalStatus::isSet): - (JSC::ResolveGlobalStatus::operator!): - (JSC::ResolveGlobalStatus::isSimple): - (JSC::ResolveGlobalStatus::takesSlowPath): - (JSC::ResolveGlobalStatus::structure): - (JSC::ResolveGlobalStatus::offset): - (JSC::ResolveGlobalStatus::specificValue): - * dfg/DFGByteCodeParser.cpp: - (ByteCodeParser): - (JSC::DFG::ByteCodeParser::handleGetByOffset): - (DFG): - (JSC::DFG::ByteCodeParser::handleGetById): - (JSC::DFG::ByteCodeParser::parseBlock): - * runtime/JSObject.cpp: - (JSC::getCallableObjectSlow): - (JSC): - (JSC::JSObject::put): - (JSC::JSObject::putDirectVirtual): - (JSC::JSObject::putDirectAccessor): - * runtime/JSObject.h: - (JSC): - (JSC::getCallableObject): - (JSC::JSObject::putOwnDataProperty): - (JSC::JSObject::putDirect): - (JSC::JSObject::putDirectWithoutTransition): - -2012-06-20 Filip Pizlo - - Functions on global objects should be specializable - https://bugs.webkit.org/show_bug.cgi?id=89615 - - Reviewed by Oliver Hunt. - - I tested to see if this brought back the bug in https://bugs.webkit.org/show_bug.cgi?id=33343, - and it didn't. Bug 33343 was the reason why we disabled global object function specialization - to begin with. So I'm guessing this is safe. - - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::init): - -2012-06-20 Filip Pizlo - - build-webkit failure due to illegal 32-bit integer constants in code - generated by offlineasm - https://bugs.webkit.org/show_bug.cgi?id=89347 - - Reviewed by Geoffrey Garen. - - The offending constants are the magic numbers used by offlineasm to find - offsets in the generated machine code. Added code to turn them into what - the C++ compiler will believe to be valid 32-bit values. - - * offlineasm/offsets.rb: - -2012-06-19 Geoffrey Garen - - Made the incremental sweeper more aggressive - https://bugs.webkit.org/show_bug.cgi?id=89527 - - Reviewed by Oliver Hunt. - - This is a pre-requisite to getting rid of "berzerker GC" because we need - the sweeper to reclaim memory in a timely fashion, or we'll see a memory - footprint regression. - - * heap/IncrementalSweeper.h: - * heap/IncrementalSweeper.cpp: - (JSC::IncrementalSweeper::scheduleTimer): Since the time slice is predictable, - no need to use a data member to record it. - - (JSC::IncrementalSweeper::doSweep): Sweep as many blocks as we can in a - small time slice. This is better than sweeping only one block per timer - fire because that strategy has a heavy timer overhead, and artificially - delays memory reclamation. - -2012-06-20 Filip Pizlo - - DFG should be able to print disassembly interleaved with the IR - https://bugs.webkit.org/show_bug.cgi?id=89551 - - Reviewed by Geoffrey Garen. - - This change also removes running Dominators unconditionally on every DFG - compile. Dominators are designed to be computed on-demand, and currently - the only demand is graph dumps. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * assembler/ARMv7Assembler.h: - (JSC::ARMv7Assembler::labelIgnoringWatchpoints): - (ARMv7Assembler): - * assembler/AbstractMacroAssembler.h: - (AbstractMacroAssembler): - (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints): - * assembler/X86Assembler.h: - (X86Assembler): - (JSC::X86Assembler::labelIgnoringWatchpoints): - * dfg/DFGCommon.h: - (JSC::DFG::shouldShowDisassembly): - (DFG): - * dfg/DFGDisassembler.cpp: Added. - (DFG): - (JSC::DFG::Disassembler::Disassembler): - (JSC::DFG::Disassembler::dump): - (JSC::DFG::Disassembler::dumpDisassembly): - * dfg/DFGDisassembler.h: Added. - (DFG): - (Disassembler): - (JSC::DFG::Disassembler::setStartOfCode): - (JSC::DFG::Disassembler::setForBlock): - (JSC::DFG::Disassembler::setForNode): - (JSC::DFG::Disassembler::setEndOfMainPath): - (JSC::DFG::Disassembler::setEndOfCode): - * dfg/DFGDriver.cpp: - (JSC::DFG::compile): - * dfg/DFGGraph.cpp: - (JSC::DFG::Graph::dumpCodeOrigin): - (JSC::DFG::Graph::amountOfNodeWhiteSpace): - (DFG): - (JSC::DFG::Graph::printNodeWhiteSpace): - (JSC::DFG::Graph::dump): - (JSC::DFG::Graph::dumpBlockHeader): - * dfg/DFGGraph.h: - * dfg/DFGJITCompiler.cpp: - (JSC::DFG::JITCompiler::JITCompiler): - (DFG): - (JSC::DFG::JITCompiler::compile): - (JSC::DFG::JITCompiler::compileFunction): - * dfg/DFGJITCompiler.h: - (JITCompiler): - (JSC::DFG::JITCompiler::setStartOfCode): - (JSC::DFG::JITCompiler::setForBlock): - (JSC::DFG::JITCompiler::setForNode): - (JSC::DFG::JITCompiler::setEndOfMainPath): - (JSC::DFG::JITCompiler::setEndOfCode): - * dfg/DFGNode.h: - (Node): - (JSC::DFG::Node::willHaveCodeGen): - * dfg/DFGNodeFlags.cpp: - (JSC::DFG::nodeFlagsAsString): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT.h: - (SpeculativeJIT): - * runtime/Options.cpp: - (Options): - (JSC::Options::initializeOptions): - * runtime/Options.h: - (Options): - -2012-06-19 Filip Pizlo - - JSC should be able to show disassembly for all generated JIT code - https://bugs.webkit.org/show_bug.cgi?id=89536 - - Reviewed by Gavin Barraclough. - - Now instead of doing linkBuffer.finalizeCode(), you do - FINALIZE_CODE(linkBuffer, (... explanation ...)). FINALIZE_CODE() then - prints your explanation and the disassembled code, if - Options::showDisassembly is set to true. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * assembler/LinkBuffer.cpp: Added. - (JSC): - (JSC::LinkBuffer::finalizeCodeWithoutDisassembly): - (JSC::LinkBuffer::finalizeCodeWithDisassembly): - (JSC::LinkBuffer::linkCode): - (JSC::LinkBuffer::performFinalization): - (JSC::LinkBuffer::dumpLinkStatistics): - (JSC::LinkBuffer::dumpCode): - * assembler/LinkBuffer.h: - (LinkBuffer): - (JSC): - * assembler/MacroAssemblerCodeRef.h: - (JSC::MacroAssemblerCodeRef::tryToDisassemble): - (MacroAssemblerCodeRef): - * dfg/DFGJITCompiler.cpp: - (JSC::DFG::JITCompiler::compile): - (JSC::DFG::JITCompiler::compileFunction): - * dfg/DFGOSRExitCompiler.cpp: - * dfg/DFGRepatch.cpp: - (JSC::DFG::generateProtoChainAccessStub): - (JSC::DFG::tryCacheGetByID): - (JSC::DFG::tryBuildGetByIDList): - (JSC::DFG::emitPutReplaceStub): - (JSC::DFG::emitPutTransitionStub): - * dfg/DFGThunks.cpp: - (JSC::DFG::osrExitGenerationThunkGenerator): - * disassembler/Disassembler.h: - (JSC): - (JSC::tryToDisassemble): - * disassembler/UDis86Disassembler.cpp: - (JSC::tryToDisassemble): - * jit/JIT.cpp: - (JSC::JIT::privateCompile): - * jit/JITCode.h: - (JSC::JITCode::tryToDisassemble): - * jit/JITOpcodes.cpp: - (JSC::JIT::privateCompileCTIMachineTrampolines): - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::privateCompileCTIMachineTrampolines): - (JSC::JIT::privateCompileCTINativeCall): - * jit/JITPropertyAccess.cpp: - (JSC::JIT::stringGetByValStubGenerator): - (JSC::JIT::privateCompilePutByIdTransition): - (JSC::JIT::privateCompilePatchGetArrayLength): - (JSC::JIT::privateCompileGetByIdProto): - (JSC::JIT::privateCompileGetByIdSelfList): - (JSC::JIT::privateCompileGetByIdProtoList): - (JSC::JIT::privateCompileGetByIdChainList): - (JSC::JIT::privateCompileGetByIdChain): - * jit/JITPropertyAccess32_64.cpp: - (JSC::JIT::stringGetByValStubGenerator): - (JSC::JIT::privateCompilePutByIdTransition): - (JSC::JIT::privateCompilePatchGetArrayLength): - (JSC::JIT::privateCompileGetByIdProto): - (JSC::JIT::privateCompileGetByIdSelfList): - (JSC::JIT::privateCompileGetByIdProtoList): - (JSC::JIT::privateCompileGetByIdChainList): - (JSC::JIT::privateCompileGetByIdChain): - * jit/SpecializedThunkJIT.h: - (JSC::SpecializedThunkJIT::finalize): - * jit/ThunkGenerators.cpp: - (JSC::charCodeAtThunkGenerator): - (JSC::charAtThunkGenerator): - (JSC::fromCharCodeThunkGenerator): - (JSC::sqrtThunkGenerator): - (JSC::floorThunkGenerator): - (JSC::ceilThunkGenerator): - (JSC::roundThunkGenerator): - (JSC::expThunkGenerator): - (JSC::logThunkGenerator): - (JSC::absThunkGenerator): - (JSC::powThunkGenerator): - * llint/LLIntThunks.cpp: - (JSC::LLInt::generateThunkWithJumpTo): - (JSC::LLInt::functionForCallEntryThunkGenerator): - (JSC::LLInt::functionForConstructEntryThunkGenerator): - (JSC::LLInt::functionForCallArityCheckThunkGenerator): - (JSC::LLInt::functionForConstructArityCheckThunkGenerator): - (JSC::LLInt::evalEntryThunkGenerator): - (JSC::LLInt::programEntryThunkGenerator): - * runtime/Options.cpp: - (Options): - (JSC::Options::initializeOptions): - * runtime/Options.h: - (Options): - * yarr/YarrJIT.cpp: - (JSC::Yarr::YarrGenerator::compile): - -2012-06-19 Mark Hahnenberg - - [Qt][Mac] REGRESSION(r120742): It broke the build - https://bugs.webkit.org/show_bug.cgi?id=89516 - - Reviewed by Geoffrey Garen. - - Removing GCActivityCallbackCF.cpp because it doesn't mesh well with cross-platform - code on Darwin (e.g. Qt). We now use plain ol' vanilla ifdefs to handle platforms - without CF support. These if-defs will probably disappear in the future when we - use cross-platform timers in HeapTimer. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * runtime/GCActivityCallback.cpp: - (JSC): - (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback): - (JSC::DefaultGCActivityCallback::doWork): - (JSC::DefaultGCActivityCallback::scheduleTimer): - (JSC::DefaultGCActivityCallback::cancelTimer): - (JSC::DefaultGCActivityCallback::didAllocate): - (JSC::DefaultGCActivityCallback::willCollect): - (JSC::DefaultGCActivityCallback::cancel): - * runtime/GCActivityCallbackCF.cpp: Removed. - -2012-06-19 Filip Pizlo - - DFG CFA forgets to notify subsequent phases of found constants if it proves LogicalNot to be a constant - https://bugs.webkit.org/show_bug.cgi?id=89511 - - - Reviewed by Geoffrey Garen. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - -2012-06-19 Mark Lam - - CodeBlock::needsCallReturnIndices() is no longer needed. - https://bugs.webkit.org/show_bug.cgi?id=89490 - - Reviewed by Geoffrey Garen. - - * bytecode/CodeBlock.h: - (JSC::CodeBlock::needsCallReturnIndices): removed. - * dfg/DFGJITCompiler.cpp: - (JSC::DFG::JITCompiler::link): - * jit/JIT.cpp: - (JSC::JIT::privateCompile): - -2012-06-19 Filip Pizlo - - Unreviewed, try to fix Windows build. - - * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd: - -2012-06-17 Filip Pizlo - - It should be possible to look at disassembly - https://bugs.webkit.org/show_bug.cgi?id=89319 - - Reviewed by Sam Weinig. - - This imports the udis86 disassembler library. The library is placed - behind an abstraction in disassembler/Disassembler.h, so that we can - in the future use other disassemblers (for other platforms) whenever - appropriate. As a first step, the disassembler is being invoked for - DFG verbose dumps. - - If we ever want to merge a new version of udis86 in the future, I've - made notes about changes I made to the library in - disassembler/udis86/differences.txt. - - * CMakeLists.txt: - * DerivedSources.make: - * GNUmakefile.list.am: - * JavaScriptCore.pri: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: - * JavaScriptCore.xcodeproj/project.pbxproj: - * dfg/DFGJITCompiler.cpp: - (JSC::DFG::JITCompiler::compile): - (JSC::DFG::JITCompiler::compileFunction): - * disassembler: Added. - * disassembler/Disassembler.h: Added. - (JSC): - (JSC::tryToDisassemble): - * disassembler/UDis86Disassembler.cpp: Added. - (JSC): - (JSC::tryToDisassemble): - * disassembler/udis86: Added. - * disassembler/udis86/differences.txt: Added. - * disassembler/udis86/itab.py: Added. - (UdItabGenerator): - (UdItabGenerator.__init__): - (UdItabGenerator.toGroupId): - (UdItabGenerator.genLookupTable): - (UdItabGenerator.genLookupTableList): - (UdItabGenerator.genInsnTable): - (genItabH): - (genItabH.UD_ITAB_H): - (genItabC): - (genItab): - (main): - * disassembler/udis86/optable.xml: Added. - * disassembler/udis86/ud_opcode.py: Added. - (UdOpcodeTables): - (UdOpcodeTables.sizeOfTable): - (UdOpcodeTables.nameOfTable): - (UdOpcodeTables.updateTable): - (UdOpcodeTables.Insn): - (UdOpcodeTables.Insn.__init__): - (UdOpcodeTables.Insn.__init__.opcode): - (UdOpcodeTables.parse): - (UdOpcodeTables.addInsnDef): - (UdOpcodeTables.print_table): - (UdOpcodeTables.print_tree): - * disassembler/udis86/ud_optable.py: Added. - (UdOptableXmlParser): - (UdOptableXmlParser.parseDef): - (UdOptableXmlParser.parse): - (printFn): - (parse): - (main): - * disassembler/udis86/udis86.c: Added. - (ud_init): - (ud_disassemble): - (ud_set_mode): - (ud_set_vendor): - (ud_set_pc): - (ud): - (ud_insn_asm): - (ud_insn_off): - (ud_insn_hex): - (ud_insn_ptr): - (ud_insn_len): - * disassembler/udis86/udis86.h: Added. - * disassembler/udis86/udis86_decode.c: Added. - (eff_adr_mode): - (ud_lookup_mnemonic): - (decode_prefixes): - (modrm): - (resolve_operand_size): - (resolve_mnemonic): - (decode_a): - (decode_gpr): - (resolve_gpr64): - (resolve_gpr32): - (resolve_reg): - (decode_imm): - (decode_modrm_reg): - (decode_modrm_rm): - (decode_o): - (decode_operand): - (decode_operands): - (clear_insn): - (resolve_mode): - (gen_hex): - (decode_insn): - (decode_3dnow): - (decode_ssepfx): - (decode_ext): - (decode_opcode): - (ud_decode): - * disassembler/udis86/udis86_decode.h: Added. - (ud_itab_entry_operand): - (ud_itab_entry): - (ud_lookup_table_list_entry): - (sse_pfx_idx): - (mode_idx): - (modrm_mod_idx): - (vendor_idx): - (is_group_ptr): - (group_idx): - * disassembler/udis86/udis86_extern.h: Added. - * disassembler/udis86/udis86_input.c: Added. - (inp_buff_hook): - (inp_file_hook): - (ud): - (ud_set_user_opaque_data): - (ud_get_user_opaque_data): - (ud_set_input_buffer): - (ud_set_input_file): - (ud_input_skip): - (ud_input_end): - (ud_inp_next): - (ud_inp_back): - (ud_inp_peek): - (ud_inp_move): - (ud_inp_uint8): - (ud_inp_uint16): - (ud_inp_uint32): - (ud_inp_uint64): - * disassembler/udis86/udis86_input.h: Added. - * disassembler/udis86/udis86_itab_holder.c: Added. - * disassembler/udis86/udis86_syn-att.c: Added. - (opr_cast): - (gen_operand): - (ud_translate_att): - * disassembler/udis86/udis86_syn-intel.c: Added. - (opr_cast): - (gen_operand): - (ud_translate_intel): - * disassembler/udis86/udis86_syn.c: Added. - * disassembler/udis86/udis86_syn.h: Added. - (mkasm): - * disassembler/udis86/udis86_types.h: Added. - (ud_operand): - (ud): - * jit/JITCode.h: - (JITCode): - (JSC::JITCode::tryToDisassemble): - -2012-06-19 Mark Hahnenberg - - GCActivityCallback and IncrementalSweeper should share code - https://bugs.webkit.org/show_bug.cgi?id=89400 - - Reviewed by Geoffrey Garen. - - A lot of functionality is duplicated between GCActivityCallback and IncrementalSweeper. - We should extract the common functionality out into a separate class that both of them - can inherit from. This refactoring will be an even greater boon when we add the ability - to shut these two agents down in a thread-safe fashion - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * heap/Heap.cpp: - (JSC::Heap::Heap): Move initialization down so that the JSGlobalData has a valid Heap when - we're initializing the GCActivityCallback and the IncrementalSweeper. - * heap/Heap.h: - (Heap): - * heap/HeapTimer.cpp: Added. - (JSC): - (JSC::HeapTimer::HeapTimer): Initialize the various base class data that - DefaultGCActivityCallback::commonConstructor() used to do. - (JSC::HeapTimer::~HeapTimer): Call to invalidate(). - (JSC::HeapTimer::synchronize): Same functionality as the old DefaultGCActivityCallback::synchronize(). - Virtual so that non-CF subclasses can override. - (JSC::HeapTimer::invalidate): Tears down the runloop timer to prevent any future firing. - (JSC::HeapTimer::timerDidFire): Callback to pass to the timer function. Casts and calls the virtual doWork(). - * heap/HeapTimer.h: Added. This is the class that serves as the common base class for - both GCActivityCallback and IncrementalSweeper. It handles setting up and tearing down run loops and synchronizing - across threads for its subclasses. - (JSC): - (HeapTimer): - * heap/IncrementalSweeper.cpp: Changes to accomodate the extraction of common functionality - between IncrementalSweeper and GCActivityCallback into a common ancestor. - (JSC): - (JSC::IncrementalSweeper::doWork): - (JSC::IncrementalSweeper::IncrementalSweeper): - (JSC::IncrementalSweeper::cancelTimer): - (JSC::IncrementalSweeper::create): - * heap/IncrementalSweeper.h: - (IncrementalSweeper): - * runtime/GCActivityCallback.cpp: - (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback): - (JSC::DefaultGCActivityCallback::doWork): - * runtime/GCActivityCallback.h: - (GCActivityCallback): - (JSC::GCActivityCallback::willCollect): - (JSC::GCActivityCallback::GCActivityCallback): - (JSC): - (DefaultGCActivityCallback): Remove the platform data struct. The platform data should be kept in - the class itself so as to be accessible by doWork(). Most of the platform data for CF is kept in - HeapTimer anyways, so we only need the m_delay field now. - * runtime/GCActivityCallbackBlackBerry.cpp: - (JSC): - (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback): - (JSC::DefaultGCActivityCallback::doWork): - (JSC::DefaultGCActivityCallback::didAllocate): - * runtime/GCActivityCallbackCF.cpp: - (JSC): - (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback): - (JSC::DefaultGCActivityCallback::doWork): - (JSC::DefaultGCActivityCallback::scheduleTimer): - (JSC::DefaultGCActivityCallback::cancelTimer): - (JSC::DefaultGCActivityCallback::didAllocate): - (JSC::DefaultGCActivityCallback::willCollect): - (JSC::DefaultGCActivityCallback::cancel): - - -2012-06-19 Mike West - - Introduce ENABLE_CSP_NEXT configuration flag. - https://bugs.webkit.org/show_bug.cgi?id=89300 - - Reviewed by Adam Barth. - - The 1.0 draft of the Content Security Policy spec is just about to - move to Last Call. We'll hide work on the upcoming 1.1 spec behind - this ENABLE flag, disabled by default. - - Spec: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html - - * Configurations/FeatureDefines.xcconfig: - -2012-06-18 Mark Lam - - Changed JSC to always record line number information so that error.stack - and window.onerror() can report proper line numbers. - https://bugs.webkit.org/show_bug.cgi?id=89410 - - Reviewed by Geoffrey Garen. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::CodeBlock): - (JSC::CodeBlock::lineNumberForBytecodeOffset): - (JSC::CodeBlock::shrinkToFit): m_lineInfo is now available unconditionally. - - * bytecode/CodeBlock.h: - (JSC::CodeBlock::addLineInfo): - (JSC::CodeBlock::hasLineInfo): Unused. Now removed. - (JSC::CodeBlock::needsCallReturnIndices): - (CodeBlock): - (RareData): Hoisted m_lineInfo out of m_rareData. m_lineInfo is now - filled in unconditionally. - - * bytecompiler/BytecodeGenerator.h: - (JSC::BytecodeGenerator::addLineInfo): - -2012-06-18 Andy Estes - - Fix r120663, which didn't land the change that was reviewed. - -2012-06-18 Andy Estes - - [JSC] In JSGlobalData.cpp, enableAssembler() sometimes leaks two CF objects - https://bugs.webkit.org/show_bug.cgi?id=89415 - - Reviewed by Sam Weinig. - - In the case where canUseJIT was a non-NULL CFBooleanRef, - enableAssembler() would leak both canUseJITKey and canUseJIT by - returning before calling CFRelease. Fix this by using RetainPtr. - - * runtime/JSGlobalData.cpp: - (JSC::enableAssembler): - -2012-06-17 Geoffrey Garen - - GC copy phase spends needless cycles zero-filling blocks - https://bugs.webkit.org/show_bug.cgi?id=89128 - - Reviewed by Gavin Barraclough. - - We only need to zero-fill when we're allocating memory that might not - get fully initialized before GC. - - * heap/CopiedBlock.h: - (JSC::CopiedBlock::createNoZeroFill): - (JSC::CopiedBlock::create): Added a way to create without zero-filling. - This is our optimization. - - (JSC::CopiedBlock::zeroFillToEnd): - (JSC::CopiedBlock::CopiedBlock): Split zero-filling out from creation, - so we can sometimes create without zero-filling. - - * heap/CopiedSpace.cpp: - (JSC::CopiedSpace::init): - (JSC::CopiedSpace::tryAllocateSlowCase): - (JSC::CopiedSpace::doneCopying): Renamed addNewBlock to allocateBlock() - to clarify that the new block is always newly-allocated. - - (JSC::CopiedSpace::doneFillingBlock): Make sure to zero-fill to the end - of a block that might be used in the future for allocation. (Most of the - time, this is a no-op, since we've already filled the block completely.) - - (JSC::CopiedSpace::getFreshBlock): Removed this function because the - abstraction of "allocation must succeed" is no longer useful. - - * heap/CopiedSpace.h: Updated declarations to match. - - * heap/CopiedSpaceInlineMethods.h: - (JSC::CopiedSpace::allocateBlockForCopyingPhase): New function, which - knows that it can skip zero-filling. - - Added tighter scoping to our lock, to improve parallelism. - - (JSC::CopiedSpace::allocateBlock): Folded getFreshBlock functionality - into this function, for simplicity. - - * heap/MarkStack.cpp: - (JSC::SlotVisitor::startCopying): - (JSC::SlotVisitor::allocateNewSpace): Use our new zero-fill-free helper - function for great good. - -2012-06-17 Filip Pizlo - - DFG should attempt to use structure watchpoints for all inlined get_by_id's and put_by_id's - https://bugs.webkit.org/show_bug.cgi?id=89316 - - Reviewed by Oliver Hunt. - - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::addStructureTransitionCheck): - (ByteCodeParser): - (JSC::DFG::ByteCodeParser::handleGetById): - (JSC::DFG::ByteCodeParser::parseBlock): - -2012-06-15 Yong Li - - [BlackBerry] Put platform-specific GC policy in GCActivityCallback - https://bugs.webkit.org/show_bug.cgi?id=89236 - - Reviewed by Rob Buis. - - Add GCActivityCallbackBlackBerry.cpp and implement platform-specific - low memory GC policy there. - - * PlatformBlackBerry.cmake: - * heap/Heap.h: - (JSC::Heap::isSafeToCollect): Added. - * runtime/GCActivityCallbackBlackBerry.cpp: Added. - (JSC): - (JSC::DefaultGCActivityCallbackPlatformData::DefaultGCActivityCallbackPlatformData): - (DefaultGCActivityCallbackPlatformData): - (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback): - (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback): - (JSC::DefaultGCActivityCallback::didAllocate): - (JSC::DefaultGCActivityCallback::willCollect): - (JSC::DefaultGCActivityCallback::synchronize): - (JSC::DefaultGCActivityCallback::cancel): - -2012-06-15 Filip Pizlo - - DFG should be able to set watchpoints on structure transitions in the - method check prototype chain - https://bugs.webkit.org/show_bug.cgi?id=89058 - - Adding the same assertion to 32-bit that I added to 64-bit. This change - does not affect correctness but it's a good thing for assertion coverage. - - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - -2012-06-13 Filip Pizlo - - DFG should be able to set watchpoints on structure transitions in the - method check prototype chain - https://bugs.webkit.org/show_bug.cgi?id=89058 - - Reviewed by Gavin Barraclough. - - This adds the ability to set watchpoints on Structures, and then does - the most modest thing we can do with this ability: the DFG now sets - watchpoints on structure transitions in the prototype chain of method - checks. - - This appears to be a >1% speed-up on V8. - - * bytecode/PutByIdStatus.cpp: - (JSC::PutByIdStatus::computeFromLLInt): - (JSC::PutByIdStatus::computeFor): - * bytecode/StructureSet.h: - (JSC::StructureSet::containsOnly): - (StructureSet): - * bytecode/Watchpoint.cpp: - (JSC::WatchpointSet::WatchpointSet): - (JSC::InlineWatchpointSet::add): - (JSC): - (JSC::InlineWatchpointSet::inflateSlow): - (JSC::InlineWatchpointSet::freeFat): - * bytecode/Watchpoint.h: - (WatchpointSet): - (JSC): - (InlineWatchpointSet): - (JSC::InlineWatchpointSet::InlineWatchpointSet): - (JSC::InlineWatchpointSet::~InlineWatchpointSet): - (JSC::InlineWatchpointSet::hasBeenInvalidated): - (JSC::InlineWatchpointSet::isStillValid): - (JSC::InlineWatchpointSet::startWatching): - (JSC::InlineWatchpointSet::notifyWrite): - (JSC::InlineWatchpointSet::isFat): - (JSC::InlineWatchpointSet::fat): - (JSC::InlineWatchpointSet::inflate): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::addStructureTransitionCheck): - (ByteCodeParser): - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination): - (CSEPhase): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGCommon.h: - * dfg/DFGGraph.cpp: - (JSC::DFG::Graph::dump): - * dfg/DFGGraph.h: - (JSC::DFG::Graph::isCellConstant): - * dfg/DFGJITCompiler.h: - (JSC::DFG::JITCompiler::addWeakReferences): - (JITCompiler): - * dfg/DFGNode.h: - (JSC::DFG::Node::hasStructure): - (Node): - (JSC::DFG::Node::structure): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - * dfg/DFGRepatch.cpp: - (JSC::DFG::emitPutTransitionStub): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * jit/JITStubs.cpp: - (JSC::JITThunks::tryCachePutByID): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * runtime/Structure.cpp: - (JSC::Structure::Structure): - * runtime/Structure.h: - (JSC::Structure::transitionWatchpointSetHasBeenInvalidated): - (Structure): - (JSC::Structure::transitionWatchpointSetIsStillValid): - (JSC::Structure::addTransitionWatchpoint): - (JSC::Structure::notifyTransitionFromThisStructure): - (JSC::JSCell::setStructure): - * runtime/SymbolTable.cpp: - (JSC::SymbolTableEntry::attemptToWatch): - -2012-06-13 Filip Pizlo - - DFG should be able to set watchpoints on global variables - https://bugs.webkit.org/show_bug.cgi?id=88692 - - Reviewed by Geoffrey Garen. - - Rolling back in after fixing Windows build issues, and implementing - branchTest8 for the Qt port's strange assemblers. - - This implements global variable constant folding by allowing the optimizing - compiler to set a "watchpoint" on globals that it wishes to constant fold. - If the watchpoint fires, then an OSR exit is forced by overwriting the - machine code that the optimizing compiler generated with a jump. - - As such, this patch is adding quite a bit of stuff: - - - Jump replacement on those hardware targets supported by the optimizing - JIT. It is now possible to patch in a jump instruction over any recorded - watchpoint label. The jump must be "local" in the sense that it must be - within the range of the largest jump distance supported by a one - instruction jump. - - - WatchpointSets and Watchpoints. A Watchpoint is a doubly-linked list node - that records the location where a jump must be inserted and the - destination to which it should jump. Watchpoints can be added to a - WatchpointSet. The WatchpointSet can be fired all at once, which plants - all jumps. WatchpointSet also remembers if it had ever been invalidated, - which allows for monotonicity: we typically don't want to optimize using - watchpoints on something for which watchpoints had previously fired. The - act of notifying a WatchpointSet has a trivial fast path in case no - Watchpoints are registered (one-byte load+branch). - - - SpeculativeJIT::speculationWatchpoint(). It's like speculationCheck(), - except that you don't have to emit branches. But, you need to know what - WatchpointSet to add the resulting Watchpoint to. Not everything that - you could write a speculationCheck() for will have a WatchpointSet that - would get notified if the condition you were speculating against became - invalid. - - - SymbolTableEntry now has the ability to refer to a WatchpointSet. It can - do so without incurring any space overhead for those entries that don't - have WatchpointSets. - - - The bytecode generator infers all global function variables to be - watchable, and makes all stores perform the WatchpointSet's write check, - and marks all loads as being potentially watchable (i.e. you can compile - them to a watchpoint and a constant). - - Put together, this allows for fully sleazy inlining of calls to globally - declared functions. The inline prologue will no longer contain the load of - the function, or any checks of the function you're calling. I.e. it's - pretty much like the kind of inlining you would see in Java or C++. - Furthermore, the watchpointing functionality is built to be fairly general, - and should allow setting watchpoints on all sorts of interesting things - in the future. - - The sleazy inlining means that we will now sometimes inline in code paths - that have never executed. Previously, to inline we would have either had - to have executed the call (to read the call's inline cache) or have - executed the method check (to read the method check's inline cache). Now, - we might inline when the callee is a watched global variable. This - revealed some humorous bugs. First, constant folding disagreed with CFA - over what kinds of operations can clobber (example: code path A is dead - but stores a String into variable X, all other code paths store 0 into - X, and then you do CompareEq(X, 0) - CFA will say that this is a non- - clobbering constant, but constant folding thought it was clobbering - because it saw the String prediction). Second, inlining would crash if - the inline callee had not been compiled. This patch fixes both bugs, - since otherwise run-javascriptcore-tests would report regressions. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * assembler/ARMv7Assembler.h: - (ARMv7Assembler): - (JSC::ARMv7Assembler::ARMv7Assembler): - (JSC::ARMv7Assembler::labelForWatchpoint): - (JSC::ARMv7Assembler::label): - (JSC::ARMv7Assembler::replaceWithJump): - (JSC::ARMv7Assembler::maxJumpReplacementSize): - * assembler/AbstractMacroAssembler.h: - (JSC): - (AbstractMacroAssembler): - (Label): - (JSC::AbstractMacroAssembler::watchpointLabel): - (JSC::AbstractMacroAssembler::readPointer): - * assembler/AssemblerBuffer.h: - * assembler/MacroAssemblerARM.h: - (JSC::MacroAssemblerARM::branchTest8): - (MacroAssemblerARM): - (JSC::MacroAssemblerARM::replaceWithJump): - (JSC::MacroAssemblerARM::maxJumpReplacementSize): - * assembler/MacroAssemblerARMv7.h: - (JSC::MacroAssemblerARMv7::load8Signed): - (JSC::MacroAssemblerARMv7::load16Signed): - (MacroAssemblerARMv7): - (JSC::MacroAssemblerARMv7::replaceWithJump): - (JSC::MacroAssemblerARMv7::maxJumpReplacementSize): - (JSC::MacroAssemblerARMv7::branchTest8): - (JSC::MacroAssemblerARMv7::jump): - (JSC::MacroAssemblerARMv7::makeBranch): - * assembler/MacroAssemblerMIPS.h: - (JSC::MacroAssemblerMIPS::branchTest8): - (MacroAssemblerMIPS): - (JSC::MacroAssemblerMIPS::replaceWithJump): - (JSC::MacroAssemblerMIPS::maxJumpReplacementSize): - * assembler/MacroAssemblerSH4.h: - (JSC::MacroAssemblerSH4::branchTest8): - (MacroAssemblerSH4): - (JSC::MacroAssemblerSH4::replaceWithJump): - (JSC::MacroAssemblerSH4::maxJumpReplacementSize): - * assembler/MacroAssemblerX86.h: - (MacroAssemblerX86): - (JSC::MacroAssemblerX86::branchTest8): - * assembler/MacroAssemblerX86Common.h: - (JSC::MacroAssemblerX86Common::replaceWithJump): - (MacroAssemblerX86Common): - (JSC::MacroAssemblerX86Common::maxJumpReplacementSize): - * assembler/MacroAssemblerX86_64.h: - (MacroAssemblerX86_64): - (JSC::MacroAssemblerX86_64::branchTest8): - * assembler/X86Assembler.h: - (JSC::X86Assembler::X86Assembler): - (X86Assembler): - (JSC::X86Assembler::cmpb_im): - (JSC::X86Assembler::testb_im): - (JSC::X86Assembler::labelForWatchpoint): - (JSC::X86Assembler::label): - (JSC::X86Assembler::replaceWithJump): - (JSC::X86Assembler::maxJumpReplacementSize): - (JSC::X86Assembler::X86InstructionFormatter::memoryModRM): - * bytecode/CodeBlock.cpp: - (JSC): - (JSC::CodeBlock::printGetByIdCacheStatus): - (JSC::CodeBlock::dump): - * bytecode/CodeBlock.h: - (JSC::CodeBlock::appendOSRExit): - (JSC::CodeBlock::appendSpeculationRecovery): - (CodeBlock): - (JSC::CodeBlock::appendWatchpoint): - (JSC::CodeBlock::numberOfWatchpoints): - (JSC::CodeBlock::watchpoint): - (DFGData): - * bytecode/DFGExitProfile.h: - (JSC::DFG::exitKindToString): - (JSC::DFG::exitKindIsCountable): - * bytecode/GetByIdStatus.cpp: - (JSC::GetByIdStatus::computeForChain): - * bytecode/Instruction.h: - (Instruction): - (JSC::Instruction::Instruction): - * bytecode/Opcode.h: - (JSC): - (JSC::padOpcodeName): - * bytecode/Watchpoint.cpp: Added. - (JSC): - (JSC::Watchpoint::~Watchpoint): - (JSC::Watchpoint::correctLabels): - (JSC::Watchpoint::fire): - (JSC::WatchpointSet::WatchpointSet): - (JSC::WatchpointSet::~WatchpointSet): - (JSC::WatchpointSet::add): - (JSC::WatchpointSet::notifyWriteSlow): - (JSC::WatchpointSet::fireAllWatchpoints): - * bytecode/Watchpoint.h: Added. - (JSC): - (Watchpoint): - (JSC::Watchpoint::Watchpoint): - (JSC::Watchpoint::setDestination): - (WatchpointSet): - (JSC::WatchpointSet::isStillValid): - (JSC::WatchpointSet::hasBeenInvalidated): - (JSC::WatchpointSet::startWatching): - (JSC::WatchpointSet::notifyWrite): - (JSC::WatchpointSet::addressOfIsWatched): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::ResolveResult::checkValidity): - (JSC::BytecodeGenerator::addGlobalVar): - (JSC::BytecodeGenerator::BytecodeGenerator): - (JSC::BytecodeGenerator::resolve): - (JSC::BytecodeGenerator::emitResolve): - (JSC::BytecodeGenerator::emitResolveWithBase): - (JSC::BytecodeGenerator::emitResolveWithThis): - (JSC::BytecodeGenerator::emitGetStaticVar): - (JSC::BytecodeGenerator::emitPutStaticVar): - * bytecompiler/BytecodeGenerator.h: - (BytecodeGenerator): - * bytecompiler/NodesCodegen.cpp: - (JSC::FunctionCallResolveNode::emitBytecode): - (JSC::PostfixResolveNode::emitBytecode): - (JSC::PrefixResolveNode::emitBytecode): - (JSC::ReadModifyResolveNode::emitBytecode): - (JSC::AssignResolveNode::emitBytecode): - (JSC::ConstDeclNode::emitCodeSingle): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - (JSC::DFG::AbstractState::clobberStructures): - * dfg/DFGAbstractState.h: - (AbstractState): - (JSC::DFG::AbstractState::didClobber): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::handleInlining): - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCCallHelpers.h: - (CCallHelpers): - (JSC::DFG::CCallHelpers::setupArguments): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::globalVarWatchpointElimination): - (CSEPhase): - (JSC::DFG::CSEPhase::globalVarStoreElimination): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGCapabilities.h: - (JSC::DFG::canCompileOpcode): - * dfg/DFGConstantFoldingPhase.cpp: - (JSC::DFG::ConstantFoldingPhase::run): - * dfg/DFGCorrectableJumpPoint.h: - (JSC::DFG::CorrectableJumpPoint::isSet): - (CorrectableJumpPoint): - * dfg/DFGJITCompiler.cpp: - (JSC::DFG::JITCompiler::linkOSRExits): - (JSC::DFG::JITCompiler::link): - * dfg/DFGNode.h: - (JSC::DFG::Node::hasIdentifierNumberForCheck): - (Node): - (JSC::DFG::Node::identifierNumberForCheck): - (JSC::DFG::Node::hasRegisterPointer): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGOSRExit.cpp: - (JSC::DFG::OSRExit::OSRExit): - * dfg/DFGOSRExit.h: - (OSRExit): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::callOperation): - (JSC::DFG::SpeculativeJIT::appendCall): - (SpeculativeJIT): - (JSC::DFG::SpeculativeJIT::speculationWatchpoint): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): - * jit/JIT.cpp: - (JSC::JIT::privateCompileMainPass): - (JSC::JIT::privateCompileSlowCases): - * jit/JIT.h: - * jit/JITPropertyAccess.cpp: - (JSC::JIT::emit_op_put_global_var_check): - (JSC): - (JSC::JIT::emitSlow_op_put_global_var_check): - * jit/JITPropertyAccess32_64.cpp: - (JSC::JIT::emit_op_put_global_var_check): - (JSC): - (JSC::JIT::emitSlow_op_put_global_var_check): - * jit/JITStubs.cpp: - (JSC::DEFINE_STUB_FUNCTION): - (JSC): - * jit/JITStubs.h: - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - (LLInt): - * llint/LLIntSlowPaths.h: - (LLInt): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - * runtime/JSObject.cpp: - (JSC::JSObject::removeDirect): - * runtime/JSObject.h: - (JSObject): - * runtime/JSSymbolTableObject.h: - (JSC::symbolTableGet): - (JSC::symbolTablePut): - (JSC::symbolTablePutWithAttributes): - * runtime/SymbolTable.cpp: Added. - (JSC): - (JSC::SymbolTableEntry::copySlow): - (JSC::SymbolTableEntry::freeFatEntrySlow): - (JSC::SymbolTableEntry::couldBeWatched): - (JSC::SymbolTableEntry::attemptToWatch): - (JSC::SymbolTableEntry::addressOfIsWatched): - (JSC::SymbolTableEntry::addWatchpoint): - (JSC::SymbolTableEntry::notifyWriteSlow): - (JSC::SymbolTableEntry::inflateSlow): - * runtime/SymbolTable.h: - (JSC): - (SymbolTableEntry): - (Fast): - (JSC::SymbolTableEntry::Fast::Fast): - (JSC::SymbolTableEntry::Fast::isNull): - (JSC::SymbolTableEntry::Fast::getIndex): - (JSC::SymbolTableEntry::Fast::isReadOnly): - (JSC::SymbolTableEntry::Fast::getAttributes): - (JSC::SymbolTableEntry::Fast::isFat): - (JSC::SymbolTableEntry::SymbolTableEntry): - (JSC::SymbolTableEntry::~SymbolTableEntry): - (JSC::SymbolTableEntry::operator=): - (JSC::SymbolTableEntry::isNull): - (JSC::SymbolTableEntry::getIndex): - (JSC::SymbolTableEntry::getFast): - (JSC::SymbolTableEntry::getAttributes): - (JSC::SymbolTableEntry::isReadOnly): - (JSC::SymbolTableEntry::watchpointSet): - (JSC::SymbolTableEntry::notifyWrite): - (FatEntry): - (JSC::SymbolTableEntry::FatEntry::FatEntry): - (JSC::SymbolTableEntry::isFat): - (JSC::SymbolTableEntry::fatEntry): - (JSC::SymbolTableEntry::inflate): - (JSC::SymbolTableEntry::bits): - (JSC::SymbolTableEntry::freeFatEntry): - (JSC::SymbolTableEntry::pack): - (JSC::SymbolTableEntry::isValidIndex): - -2012-06-13 Sheriff Bot - - Unreviewed, rolling out r120172. - http://trac.webkit.org/changeset/120172 - https://bugs.webkit.org/show_bug.cgi?id=88976 - - The patch causes compilation failures on Gtk, Qt and Apple Win - bots (Requested by zdobersek on #webkit). - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * assembler/ARMv7Assembler.h: - (JSC::ARMv7Assembler::nop): - (JSC::ARMv7Assembler::label): - (JSC::ARMv7Assembler::readPointer): - (ARMv7Assembler): - * assembler/AbstractMacroAssembler.h: - (JSC): - (AbstractMacroAssembler): - (Label): - * assembler/AssemblerBuffer.h: - * assembler/MacroAssemblerARM.h: - * assembler/MacroAssemblerARMv7.h: - (JSC::MacroAssemblerARMv7::nop): - (JSC::MacroAssemblerARMv7::jump): - (JSC::MacroAssemblerARMv7::makeBranch): - * assembler/MacroAssemblerMIPS.h: - * assembler/MacroAssemblerSH4.h: - * assembler/MacroAssemblerX86.h: - (MacroAssemblerX86): - (JSC::MacroAssemblerX86::moveWithPatch): - * assembler/MacroAssemblerX86Common.h: - * assembler/MacroAssemblerX86_64.h: - (JSC::MacroAssemblerX86_64::branchTest8): - * assembler/X86Assembler.h: - (JSC::X86Assembler::cmpb_im): - (JSC::X86Assembler::codeSize): - (JSC::X86Assembler::label): - (JSC::X86Assembler::X86InstructionFormatter::memoryModRM): - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - * bytecode/CodeBlock.h: - (JSC::CodeBlock::appendOSRExit): - (JSC::CodeBlock::appendSpeculationRecovery): - (DFGData): - * bytecode/DFGExitProfile.h: - (JSC::DFG::exitKindToString): - (JSC::DFG::exitKindIsCountable): - * bytecode/Instruction.h: - * bytecode/Opcode.h: - (JSC): - (JSC::padOpcodeName): - * bytecode/Watchpoint.cpp: Removed. - * bytecode/Watchpoint.h: Removed. - * bytecompiler/BytecodeGenerator.cpp: - (JSC::ResolveResult::checkValidity): - (JSC::BytecodeGenerator::addGlobalVar): - (JSC::BytecodeGenerator::BytecodeGenerator): - (JSC::BytecodeGenerator::resolve): - (JSC::BytecodeGenerator::emitResolve): - (JSC::BytecodeGenerator::emitResolveWithBase): - (JSC::BytecodeGenerator::emitResolveWithThis): - (JSC::BytecodeGenerator::emitGetStaticVar): - (JSC::BytecodeGenerator::emitPutStaticVar): - * bytecompiler/BytecodeGenerator.h: - (BytecodeGenerator): - * bytecompiler/NodesCodegen.cpp: - (JSC::FunctionCallResolveNode::emitBytecode): - (JSC::PostfixResolveNode::emitBytecode): - (JSC::PrefixResolveNode::emitBytecode): - (JSC::ReadModifyResolveNode::emitBytecode): - (JSC::AssignResolveNode::emitBytecode): - (JSC::ConstDeclNode::emitCodeSingle): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - (JSC::DFG::AbstractState::clobberStructures): - * dfg/DFGAbstractState.h: - (AbstractState): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::handleInlining): - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCCallHelpers.h: - (JSC::DFG::CCallHelpers::setupArguments): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::globalVarStoreElimination): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGCapabilities.h: - (JSC::DFG::canCompileOpcode): - * dfg/DFGConstantFoldingPhase.cpp: - (JSC::DFG::ConstantFoldingPhase::run): - * dfg/DFGCorrectableJumpPoint.h: - * dfg/DFGJITCompiler.cpp: - (JSC::DFG::JITCompiler::linkOSRExits): - (JSC::DFG::JITCompiler::link): - * dfg/DFGNode.h: - (JSC::DFG::Node::hasRegisterPointer): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGOSRExit.cpp: - (JSC::DFG::OSRExit::OSRExit): - * dfg/DFGOSRExit.h: - (OSRExit): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::callOperation): - (JSC::DFG::SpeculativeJIT::appendCallSetResult): - (JSC::DFG::SpeculativeJIT::speculationCheck): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * jit/JIT.cpp: - (JSC::JIT::privateCompileMainPass): - (JSC::JIT::privateCompileSlowCases): - * jit/JIT.h: - * jit/JITPropertyAccess.cpp: - * jit/JITPropertyAccess32_64.cpp: - * jit/JITStubs.cpp: - * jit/JITStubs.h: - * llint/LLIntSlowPaths.cpp: - * llint/LLIntSlowPaths.h: - (LLInt): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - * runtime/JSObject.cpp: - (JSC::JSObject::removeDirect): - * runtime/JSObject.h: - (JSObject): - * runtime/JSSymbolTableObject.h: - (JSC::symbolTableGet): - (JSC::symbolTablePut): - (JSC::symbolTablePutWithAttributes): - * runtime/SymbolTable.cpp: Removed. - * runtime/SymbolTable.h: - (JSC): - (JSC::SymbolTableEntry::isNull): - (JSC::SymbolTableEntry::getIndex): - (SymbolTableEntry): - (JSC::SymbolTableEntry::getAttributes): - (JSC::SymbolTableEntry::isReadOnly): - (JSC::SymbolTableEntry::pack): - (JSC::SymbolTableEntry::isValidIndex): - -2012-06-12 Filip Pizlo - - DFG should be able to set watchpoints on global variables - https://bugs.webkit.org/show_bug.cgi?id=88692 - - Reviewed by Geoffrey Garen. - - This implements global variable constant folding by allowing the optimizing - compiler to set a "watchpoint" on globals that it wishes to constant fold. - If the watchpoint fires, then an OSR exit is forced by overwriting the - machine code that the optimizing compiler generated with a jump. - - As such, this patch is adding quite a bit of stuff: - - - Jump replacement on those hardware targets supported by the optimizing - JIT. It is now possible to patch in a jump instruction over any recorded - watchpoint label. The jump must be "local" in the sense that it must be - within the range of the largest jump distance supported by a one - instruction jump. - - - WatchpointSets and Watchpoints. A Watchpoint is a doubly-linked list node - that records the location where a jump must be inserted and the - destination to which it should jump. Watchpoints can be added to a - WatchpointSet. The WatchpointSet can be fired all at once, which plants - all jumps. WatchpointSet also remembers if it had ever been invalidated, - which allows for monotonicity: we typically don't want to optimize using - watchpoints on something for which watchpoints had previously fired. The - act of notifying a WatchpointSet has a trivial fast path in case no - Watchpoints are registered (one-byte load+branch). - - - SpeculativeJIT::speculationWatchpoint(). It's like speculationCheck(), - except that you don't have to emit branches. But, you need to know what - WatchpointSet to add the resulting Watchpoint to. Not everything that - you could write a speculationCheck() for will have a WatchpointSet that - would get notified if the condition you were speculating against became - invalid. - - - SymbolTableEntry now has the ability to refer to a WatchpointSet. It can - do so without incurring any space overhead for those entries that don't - have WatchpointSets. - - - The bytecode generator infers all global function variables to be - watchable, and makes all stores perform the WatchpointSet's write check, - and marks all loads as being potentially watchable (i.e. you can compile - them to a watchpoint and a constant). - - Put together, this allows for fully sleazy inlining of calls to globally - declared functions. The inline prologue will no longer contain the load of - the function, or any checks of the function you're calling. I.e. it's - pretty much like the kind of inlining you would see in Java or C++. - Furthermore, the watchpointing functionality is built to be fairly general, - and should allow setting watchpoints on all sorts of interesting things - in the future. - - The sleazy inlining means that we will now sometimes inline in code paths - that have never executed. Previously, to inline we would have either had - to have executed the call (to read the call's inline cache) or have - executed the method check (to read the method check's inline cache). Now, - we might inline when the callee is a watched global variable. This - revealed some humorous bugs. First, constant folding disagreed with CFA - over what kinds of operations can clobber (example: code path A is dead - but stores a String into variable X, all other code paths store 0 into - X, and then you do CompareEq(X, 0) - CFA will say that this is a non- - clobbering constant, but constant folding thought it was clobbering - because it saw the String prediction). Second, inlining would crash if - the inline callee had not been compiled. This patch fixes both bugs, - since otherwise run-javascriptcore-tests would report regressions. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * assembler/ARMv7Assembler.h: - (ARMv7Assembler): - (JSC::ARMv7Assembler::ARMv7Assembler): - (JSC::ARMv7Assembler::labelForWatchpoint): - (JSC::ARMv7Assembler::label): - (JSC::ARMv7Assembler::replaceWithJump): - (JSC::ARMv7Assembler::maxJumpReplacementSize): - * assembler/AbstractMacroAssembler.h: - (JSC): - (AbstractMacroAssembler): - (Label): - (JSC::AbstractMacroAssembler::watchpointLabel): - * assembler/AssemblerBuffer.h: - * assembler/MacroAssemblerARM.h: - (JSC::MacroAssemblerARM::replaceWithJump): - (MacroAssemblerARM): - (JSC::MacroAssemblerARM::maxJumpReplacementSize): - * assembler/MacroAssemblerARMv7.h: - (MacroAssemblerARMv7): - (JSC::MacroAssemblerARMv7::replaceWithJump): - (JSC::MacroAssemblerARMv7::maxJumpReplacementSize): - (JSC::MacroAssemblerARMv7::branchTest8): - (JSC::MacroAssemblerARMv7::jump): - (JSC::MacroAssemblerARMv7::makeBranch): - * assembler/MacroAssemblerMIPS.h: - (JSC::MacroAssemblerMIPS::replaceWithJump): - (MacroAssemblerMIPS): - (JSC::MacroAssemblerMIPS::maxJumpReplacementSize): - * assembler/MacroAssemblerSH4.h: - (JSC::MacroAssemblerSH4::replaceWithJump): - (MacroAssemblerSH4): - (JSC::MacroAssemblerSH4::maxJumpReplacementSize): - * assembler/MacroAssemblerX86.h: - (MacroAssemblerX86): - (JSC::MacroAssemblerX86::branchTest8): - * assembler/MacroAssemblerX86Common.h: - (JSC::MacroAssemblerX86Common::replaceWithJump): - (MacroAssemblerX86Common): - (JSC::MacroAssemblerX86Common::maxJumpReplacementSize): - * assembler/MacroAssemblerX86_64.h: - (MacroAssemblerX86_64): - (JSC::MacroAssemblerX86_64::branchTest8): - * assembler/X86Assembler.h: - (JSC::X86Assembler::X86Assembler): - (X86Assembler): - (JSC::X86Assembler::cmpb_im): - (JSC::X86Assembler::testb_im): - (JSC::X86Assembler::labelForWatchpoint): - (JSC::X86Assembler::label): - (JSC::X86Assembler::replaceWithJump): - (JSC::X86Assembler::maxJumpReplacementSize): - (JSC::X86Assembler::X86InstructionFormatter::memoryModRM): - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - * bytecode/CodeBlock.h: - (JSC::CodeBlock::appendOSRExit): - (JSC::CodeBlock::appendSpeculationRecovery): - (CodeBlock): - (JSC::CodeBlock::appendWatchpoint): - (JSC::CodeBlock::numberOfWatchpoints): - (JSC::CodeBlock::watchpoint): - (DFGData): - * bytecode/DFGExitProfile.h: - (JSC::DFG::exitKindToString): - (JSC::DFG::exitKindIsCountable): - * bytecode/Instruction.h: - (Instruction): - (JSC::Instruction::Instruction): - * bytecode/Opcode.h: - (JSC): - (JSC::padOpcodeName): - * bytecode/Watchpoint.cpp: Added. - (JSC): - (JSC::Watchpoint::~Watchpoint): - (JSC::Watchpoint::correctLabels): - (JSC::Watchpoint::fire): - (JSC::WatchpointSet::WatchpointSet): - (JSC::WatchpointSet::~WatchpointSet): - (JSC::WatchpointSet::add): - (JSC::WatchpointSet::notifyWriteSlow): - (JSC::WatchpointSet::fireAllWatchpoints): - * bytecode/Watchpoint.h: Added. - (JSC): - (Watchpoint): - (JSC::Watchpoint::Watchpoint): - (JSC::Watchpoint::setDestination): - (WatchpointSet): - (JSC::WatchpointSet::isStillValid): - (JSC::WatchpointSet::hasBeenInvalidated): - (JSC::WatchpointSet::startWatching): - (JSC::WatchpointSet::notifyWrite): - (JSC::WatchpointSet::addressOfIsWatched): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::ResolveResult::checkValidity): - (JSC::BytecodeGenerator::addGlobalVar): - (JSC::BytecodeGenerator::BytecodeGenerator): - (JSC::BytecodeGenerator::resolve): - (JSC::BytecodeGenerator::emitResolve): - (JSC::BytecodeGenerator::emitResolveWithBase): - (JSC::BytecodeGenerator::emitResolveWithThis): - (JSC::BytecodeGenerator::emitGetStaticVar): - (JSC::BytecodeGenerator::emitPutStaticVar): - * bytecompiler/BytecodeGenerator.h: - (BytecodeGenerator): - * bytecompiler/NodesCodegen.cpp: - (JSC::FunctionCallResolveNode::emitBytecode): - (JSC::PostfixResolveNode::emitBytecode): - (JSC::PrefixResolveNode::emitBytecode): - (JSC::ReadModifyResolveNode::emitBytecode): - (JSC::AssignResolveNode::emitBytecode): - (JSC::ConstDeclNode::emitCodeSingle): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - (JSC::DFG::AbstractState::clobberStructures): - * dfg/DFGAbstractState.h: - (AbstractState): - (JSC::DFG::AbstractState::didClobber): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::handleInlining): - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCCallHelpers.h: - (CCallHelpers): - (JSC::DFG::CCallHelpers::setupArguments): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::globalVarWatchpointElimination): - (CSEPhase): - (JSC::DFG::CSEPhase::globalVarStoreElimination): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGCapabilities.h: - (JSC::DFG::canCompileOpcode): - * dfg/DFGConstantFoldingPhase.cpp: - (JSC::DFG::ConstantFoldingPhase::run): - * dfg/DFGCorrectableJumpPoint.h: - (JSC::DFG::CorrectableJumpPoint::isSet): - (CorrectableJumpPoint): - * dfg/DFGJITCompiler.cpp: - (JSC::DFG::JITCompiler::linkOSRExits): - (JSC::DFG::JITCompiler::link): - * dfg/DFGNode.h: - (JSC::DFG::Node::hasIdentifierNumberForCheck): - (Node): - (JSC::DFG::Node::identifierNumberForCheck): - (JSC::DFG::Node::hasRegisterPointer): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGOSRExit.cpp: - (JSC::DFG::OSRExit::OSRExit): - * dfg/DFGOSRExit.h: - (OSRExit): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::callOperation): - (JSC::DFG::SpeculativeJIT::appendCall): - (SpeculativeJIT): - (JSC::DFG::SpeculativeJIT::speculationWatchpoint): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * jit/JIT.cpp: - (JSC::JIT::privateCompileMainPass): - (JSC::JIT::privateCompileSlowCases): - * jit/JIT.h: - * jit/JITPropertyAccess.cpp: - (JSC::JIT::emit_op_put_global_var_check): - (JSC): - (JSC::JIT::emitSlow_op_put_global_var_check): - * jit/JITPropertyAccess32_64.cpp: - (JSC::JIT::emit_op_put_global_var_check): - (JSC): - (JSC::JIT::emitSlow_op_put_global_var_check): - * jit/JITStubs.cpp: - (JSC::JITThunks::JITThunks): - (JSC::DEFINE_STUB_FUNCTION): - (JSC): - * jit/JITStubs.h: - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - (LLInt): - * llint/LLIntSlowPaths.h: - (LLInt): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - * runtime/JSObject.cpp: - (JSC::JSObject::removeDirect): - * runtime/JSObject.h: - (JSObject): - * runtime/JSSymbolTableObject.h: - (JSC::symbolTableGet): - (JSC::symbolTablePut): - (JSC::symbolTablePutWithAttributes): - * runtime/SymbolTable.cpp: Added. - (JSC): - (JSC::SymbolTableEntry::copySlow): - (JSC::SymbolTableEntry::freeFatEntrySlow): - (JSC::SymbolTableEntry::couldBeWatched): - (JSC::SymbolTableEntry::attemptToWatch): - (JSC::SymbolTableEntry::addressOfIsWatched): - (JSC::SymbolTableEntry::addWatchpoint): - (JSC::SymbolTableEntry::notifyWriteSlow): - (JSC::SymbolTableEntry::inflateSlow): - * runtime/SymbolTable.h: - (JSC): - (SymbolTableEntry): - (Fast): - (JSC::SymbolTableEntry::Fast::Fast): - (JSC::SymbolTableEntry::Fast::isNull): - (JSC::SymbolTableEntry::Fast::getIndex): - (JSC::SymbolTableEntry::Fast::isReadOnly): - (JSC::SymbolTableEntry::Fast::getAttributes): - (JSC::SymbolTableEntry::Fast::isFat): - (JSC::SymbolTableEntry::SymbolTableEntry): - (JSC::SymbolTableEntry::~SymbolTableEntry): - (JSC::SymbolTableEntry::operator=): - (JSC::SymbolTableEntry::isNull): - (JSC::SymbolTableEntry::getIndex): - (JSC::SymbolTableEntry::getFast): - (JSC::SymbolTableEntry::getAttributes): - (JSC::SymbolTableEntry::isReadOnly): - (JSC::SymbolTableEntry::watchpointSet): - (JSC::SymbolTableEntry::notifyWrite): - (FatEntry): - (JSC::SymbolTableEntry::FatEntry::FatEntry): - (JSC::SymbolTableEntry::isFat): - (JSC::SymbolTableEntry::fatEntry): - (JSC::SymbolTableEntry::inflate): - (JSC::SymbolTableEntry::bits): - (JSC::SymbolTableEntry::freeFatEntry): - (JSC::SymbolTableEntry::pack): - (JSC::SymbolTableEntry::isValidIndex): - -2012-06-12 Filip Pizlo - - Unreviewed build fix for ARMv7 debug builds. - - * jit/JITStubs.cpp: - (JSC::JITThunks::JITThunks): - -2012-06-12 Geoffrey Garen - - Build fix for case-sensitive file systems: use the right case. - - * heap/ListableHandler.h: - -2012-06-11 Geoffrey Garen - - GC should be 1.7X faster - https://bugs.webkit.org/show_bug.cgi?id=88840 - - Reviewed by Oliver Hunt. - - I profiled, and removed anything that showed up as a concurrency - bottleneck. Then, I added 3 threads to our max thread count, since we - can scale up to more threads now. - - * heap/BlockAllocator.cpp: - (JSC::BlockAllocator::BlockAllocator): - (JSC::BlockAllocator::~BlockAllocator): - (JSC::BlockAllocator::releaseFreeBlocks): - (JSC::BlockAllocator::waitForRelativeTimeWhileHoldingLock): - (JSC::BlockAllocator::waitForRelativeTime): - (JSC::BlockAllocator::blockFreeingThreadMain): - * heap/BlockAllocator.h: - (BlockAllocator): - (JSC::BlockAllocator::allocate): - (JSC::BlockAllocator::deallocate): Use a spin lock for the common case - where we're just popping a linked list. (A pthread mutex would sleep our - thread even if the lock were only contended for a microsecond.) - - Scope the lock to avoid holding it while allocating VM, since that's a - slow activity and it doesn't modify any of our data structures. - - We still use a pthread mutex to handle our condition variable since we - have to, and it's not a hot path. - - * heap/CopiedSpace.cpp: - (JSC::CopiedSpace::CopiedSpace): - (JSC::CopiedSpace::doneFillingBlock): - * heap/CopiedSpace.h: - (JSC::CopiedSpace::CopiedSpace): Use a spin lock for the to space lock, - since it just guards linked list and hash table manipulation. - - * heap/MarkStack.cpp: - (JSC::MarkStackSegmentAllocator::MarkStackSegmentAllocator): - (JSC::MarkStackSegmentAllocator::allocate): - (JSC::MarkStackSegmentAllocator::release): - (JSC::MarkStackSegmentAllocator::shrinkReserve): Use a spin lock, since - we're just managing a linked list. - - (JSC::MarkStackArray::donateSomeCellsTo): Changed donation to be proportional - to our current stack size. This fixes cases where we used to donate too - much. Interestingly, donating too much was starving the donor (when it - ran out of work later) *and* the recipient (since it had to wait on a - long donation operation to complete before it could acquire the lock). - - In the worst case, we're still guaranteed to donate N cells in roughly log N time. - - This change also fixes cases where we used to donate too little, since - we would always keep a fixed minimum number of cells. In the worst case, - with N marking threads, would could have N large object graph roots in - our stack for the duration of GC, and scale to only 1 thread. - - It's an interesting observation that a single object in the mark stack - might represent an arbitrarily large object graph -- and only the act - of marking can find out. - - (JSC::MarkStackArray::stealSomeCellsFrom): Steal in proportion to idle - threads. Once again, this fixes cases where constants could cause us - to steal too much or too little. - - (JSC::SlotVisitor::donateKnownParallel): Always wake up other threads - if they're idle. We can afford to do this because we're conservative - about when we donate. - - (JSC::SlotVisitor::drainFromShared): - * heap/MarkStack.h: - (MarkStackSegmentAllocator): - (MarkStackArray): - (JSC): - * heap/SlotVisitor.h: Merged the "should I donate?" decision into a - single function, for simplicity. - - * runtime/Options.cpp: - (minimumNumberOfScansBetweenRebalance): Reduced the delay before donation - a lot. We can afford to do this because, in the common case, donation is - a single branch that decides not to donate. - - (cpusToUse): Use more CPUs now, since we scale better now. - - * runtime/Options.h: - (Options): Removed now-unused variables. - -2012-06-12 Filip Pizlo - - REGRESSION(120121): inspector tests crash in DFG - https://bugs.webkit.org/show_bug.cgi?id=88941 - - Reviewed by Geoffrey Garen. - - The CFG simplifier has two different ways of fixing up GetLocal, Phantom, and Flush. If we've - already fixed up the node one way, we shouldn't try the other way. The reason why we shouldn't - is that the second way depends on the node referring to other nodes in the to-be-jettisoned - block. After fixup they potentially will refer to nodes in the block being merged to. - - * dfg/DFGCFGSimplificationPhase.cpp: - (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal): - (JSC::DFG::CFGSimplificationPhase::mergeBlocks): - -2012-06-12 Leo Yang - - Dynamic hash table in DOMObjectHashTableMap is wrong in multiple threads - https://bugs.webkit.org/show_bug.cgi?id=87334 - - Reviewed by Geoffrey Garen. - - Add a copy member function to JSC::HasTable. This function will copy all data - members except for *table* which contains thread specific data that prevents - up copying it. When you want to copy a JSC::HashTable that was constructed - on another thread you should call JSC::HashTable::copy(). - - * runtime/Lookup.h: - (JSC::HashTable::copy): - (HashTable): - -2012-06-12 Filip Pizlo - - DFG should not ASSERT if you have a double use of a variable that is not revealed to be a double - until after CFG simplification - https://bugs.webkit.org/show_bug.cgi?id=88927 - - - Reviewed by Geoffrey Garen. - - Speculation fixup needs to run if simplification did things, because simplification can change - predictions - particularly if you had a control flow path that stored weird things into a - variable, but that path got axed by the simplifier. - - Running fixup in the fixpoint requires making it idempotent, which it previously wasn't. Only - one place needed to be changed, namely the un-MustGenerate-ion of ValueToInt32. - - * dfg/DFGDriver.cpp: - (JSC::DFG::compile): - * dfg/DFGFixupPhase.cpp: - (JSC::DFG::FixupPhase::fixupNode): - -2012-06-12 Filip Pizlo - - REGRESSION (r119779): Javascript TypeError: 'undefined' is not an object - https://bugs.webkit.org/show_bug.cgi?id=88783 - - - Reviewed by Geoffrey Garen. - - If you don't keep alive the base of an object access over the various checks - you do for the prototype chain, you're going to have a bad time. - - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::handleGetById): - -2012-06-12 Hojong Han - - Property names of the built-in object cannot be retrieved - after trying to delete one of its properties - https://bugs.webkit.org/show_bug.cgi?id=86461 - - Reviewed by Gavin Barraclough. - - * runtime/JSObject.cpp: - (JSC::getClassPropertyNames): - (JSC::JSObject::getOwnPropertyNames): - -2012-06-11 Gyuyoung Kim - - [CMAKE][EFL] Remove duplicated executable output path - https://bugs.webkit.org/show_bug.cgi?id=88765 - - Reviewed by Daniel Bates. - - CMake files for EFL port have redefined executable output path. However, EFL port doesn't - need to define again because it is already defined in top-level CMake file. - - * shell/CMakeLists.txt: - -2012-06-11 Carlos Garcia Campos - - Unreviewed. Fix make distcheck issues. - - * GNUmakefile.list.am: Remove non existent header file. - -2012-06-10 Patrick Gansterer - - Unreviewed. Build fix for !ENABLE(JIT) after r119844 and r119925. - - * runtime/Executable.h: - (ExecutableBase): - (JSC::ExecutableBase::clearCodeVirtual): - -2012-06-10 Patrick Gansterer - - Unreviewed. Build fix for !ENABLE(JIT) after r119844. - - * runtime/Executable.h: - (ExecutableBase): - (JSC): - -2012-06-09 Dominic Cooney - - [Chromium] Remove JavaScriptCore dependencies from gyp - https://bugs.webkit.org/show_bug.cgi?id=88510 - - Reviewed by Adam Barth. - - Chromium doesn't support JSC any more and there doesn't seem to be - a strong interest in using GYP as the common build system in other - ports. - - * JavaScriptCore.gyp/JavaScriptCore.gyp: WebCore still depends on YARR interpreter. - * JavaScriptCore.gypi: Only include YARR source. - * gyp/JavaScriptCore.gyp: Removed. - * gyp/gtk.gyp: Removed. - -2012-06-09 Geoffrey Garen - - Unreviewed, rolling back in part2 of r118646. - - This patch removes eager finalization. - - Weak pointer finalization should be lazy - https://bugs.webkit.org/show_bug.cgi?id=87599 - - Reviewed by Sam Weinig. - - * heap/Heap.cpp: - (JSC::Heap::collect): Don't finalize eagerly -- we'll do it lazily. - - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::sweep): Do sweep weak sets when sweeping a block, - since we won't get another chance. - - * heap/MarkedBlock.h: - (JSC::MarkedBlock::sweepWeakSet): - * heap/MarkedSpace.cpp: - (MarkedSpace::WeakSetSweep): - * heap/MarkedSpace.h: - (JSC::MarkedSpace::sweepWeakSets): Removed now-unused code. - -2012-06-09 Sukolsak Sakshuwong - - Add UNDO_MANAGER flag - https://bugs.webkit.org/show_bug.cgi?id=87908 - - Reviewed by Tony Chang. - - * Configurations/FeatureDefines.xcconfig: - -2012-06-08 Geoffrey Garen - - Unreviewed, rolling back in part1 of r118646. - - This patch includes everything necessary for lazy finalization, but - keeps eager finalization enabled for the time being. - - Weak pointer finalization should be lazy - https://bugs.webkit.org/show_bug.cgi?id=87599 - - Reviewed by Sam Weinig. - - * heap/MarkedBlock.cpp: - * heap/MarkedBlock.h: - (JSC::MarkedBlock::resetAllocator): - * heap/MarkedSpace.cpp: - (JSC::MarkedSpace::resetAllocators): - * heap/MarkedSpace.h: - (JSC::MarkedSpace::resetAllocators): Don't force allocator reset anymore. - It will happen automatically when a weak set is swept. It's simpler to - have only one canonical way for this to happen, and it wasn't buying - us anything to do it eagerly. - * heap/WeakBlock.cpp: - (JSC::WeakBlock::sweep): Don't short-circuit a sweep unless we know - the sweep would be a no-op. If even one finalizer is pending, we need to - run it, since we won't get another chance. - * heap/WeakSet.cpp: - (JSC::WeakSet::sweep): This loop can be simpler now that - WeakBlock::sweep() does what we mean. - Reset our allocator after a sweep because this is the optimal time to - start trying to recycle old weak pointers. - (JSC::WeakSet::tryFindAllocator): Don't sweep when searching for an - allocator because we've swept already, and forcing a new sweep would be - wasteful. - * heap/WeakSet.h: - (JSC::WeakSet::shrink): Be sure to reset our allocator after a shrink - because the shrink may have removed the block the allocator was going to - allocate out of. - -2012-06-08 Gavin Barraclough - - Unreviewed roll out r119795. - - This broke jquery/core.html - - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): - * jit/JITInlineMethods.h: - (JSC::JIT::emitAllocateBasicJSObject): - * llint/LowLevelInterpreter.asm: - * runtime/JSGlobalData.h: - (JSGlobalData): - * runtime/JSGlobalThis.cpp: - (JSC::JSGlobalThis::setUnwrappedObject): - * runtime/JSObject.cpp: - (JSC::JSObject::visitChildren): - (JSC::JSObject::createInheritorID): - * runtime/JSObject.h: - (JSObject): - (JSC::JSObject::resetInheritorID): - (JSC): - (JSC::JSObject::offsetOfInheritorID): - (JSC::JSObject::inheritorID): - -2012-06-08 Filip Pizlo - - PredictedType should be called SpeculatedType - https://bugs.webkit.org/show_bug.cgi?id=88477 - - Unreviewed, fix a renaming goof from http://trac.webkit.org/changeset/119660. - I accidentally renamed ByteCodeParser::getPrediction to - ByteCodeParser::getSpeculation. That was not the intent. This changes it - back. - - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::addCall): - (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit): - (JSC::DFG::ByteCodeParser::getPrediction): - (JSC::DFG::ByteCodeParser::handleCall): - (JSC::DFG::ByteCodeParser::parseBlock): - -2012-06-08 Andy Wingo - - Explictly mark stubs called by JIT as being internal - https://bugs.webkit.org/show_bug.cgi?id=88552 - - Reviewed by Filip Pizlo. - - * dfg/DFGOSRExitCompiler.h: - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * jit/HostCallReturnValue.h: - * jit/JITStubs.cpp: - * jit/JITStubs.h: - * jit/ThunkGenerators.cpp: - * llint/LLIntSlowPaths.h: Mark a bunch of stubs as being - WTF_INTERNAL. Change most calls to SYMBOL_STRING_RELOCATION to - LOCAL_REFERENCE, or GLOBAL_REFERENCE in the case of the wrappers - to truly global symbols. - * offlineasm/asm.rb: Generate LOCAL_REFERENCE instead of - SYMBOL_STRING_RELOCATION. - -2012-06-08 Geoffrey Garen - - Don't rely on weak pointers for eager CodeBlock finalization - https://bugs.webkit.org/show_bug.cgi?id=88465 - - Reviewed by Gavin Barraclough. - - This is incompatible with lazy weak pointer finalization. - - I considered just making CodeBlock finalization lazy-friendly, but it - turns out that the heap is already way up in CodeBlock's business when - it comes to finalization, so I decided to finish the job and move full - responsibility for CodeBlock finalization into the heap. - - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Maybe this - will build. - - * debugger/Debugger.cpp: Updated for rename. - - * heap/Heap.cpp: - (JSC::Heap::deleteAllCompiledCode): Renamed for consistency. Fixed a bug - where we would not delete code for a code block that had been previously - jettisoned. I don't know if this happens in practice -- I mostly did - this to improve consistency with deleteUnmarkedCompiledCode. - - (JSC::Heap::deleteUnmarkedCompiledCode): New function, responsible for - eager finalization of unmarked code blocks. - - (JSC::Heap::collect): Updated for rename. Updated to call - deleteUnmarkedCompiledCode(), which takes care of jettisoned DFG code - blocks too. - - (JSC::Heap::addCompiledCode): Renamed, since this points to all code - now, not just functions. - - * heap/Heap.h: - (Heap): Keep track of all user code, not just functions. This is a - negligible additional overhead, since most code is function code. - - * runtime/Executable.cpp: - (JSC::*::finalize): Removed these functions, since we don't rely on - weak pointer finalization anymore. - - (JSC::FunctionExecutable::FunctionExecutable): Moved linked-list stuff - into base class so all executables can be in the list. - - (JSC::EvalExecutable::clearCode): - (JSC::ProgramExecutable::clearCode): - (JSC::FunctionExecutable::clearCode): All we need to do is delete our - CodeBlock -- that will delete all of its internal data structures. - - (JSC::FunctionExecutable::clearCodeIfNotCompiling): Factored out a helper - function to improve clarity. - - * runtime/Executable.h: - (JSC::ExecutableBase): Moved linked-list stuff - into base class so all executables can be in the list. - - (JSC::NativeExecutable::create): - (NativeExecutable): - (ScriptExecutable): - (JSC::ScriptExecutable::finishCreation): - (JSC::EvalExecutable::create): - (EvalExecutable): - (JSC::ProgramExecutable::create): - (ProgramExecutable): - (FunctionExecutable): - (JSC::FunctionExecutable::create): Don't use a finalizer -- the heap - will call us back to destroy our code block. - - (JSC::FunctionExecutable::discardCode): Renamed to clearCodeIfNotCompiling() - for clarity. - - (JSC::FunctionExecutable::isCompiling): New helper function, for clarity. - - (JSC::ScriptExecutable::clearCodeVirtual): New helper function, since - the heap needs to make polymorphic calls to clear code. - - * runtime/JSGlobalData.cpp: - (JSC::StackPreservingRecompiler::operator()): - * runtime/JSGlobalObject.cpp: - (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Updated for - renames. - -2012-06-07 Filip Pizlo - - DFG should inline prototype chain accesses, and do the right things if the - specific function optimization is available - https://bugs.webkit.org/show_bug.cgi?id=88594 - - Reviewed by Gavin Barraclough. - - Looks like a 3% win on V8. - - * bytecode/CodeBlock.h: - (JSC::Structure::prototypeForLookup): - (JSC): - * bytecode/GetByIdStatus.cpp: - (JSC::GetByIdStatus::computeFromLLInt): - (JSC): - (JSC::GetByIdStatus::computeForChain): - (JSC::GetByIdStatus::computeFor): - * bytecode/GetByIdStatus.h: - (JSC::GetByIdStatus::GetByIdStatus): - (JSC::GetByIdStatus::isSimple): - (JSC::GetByIdStatus::chain): - (JSC::GetByIdStatus::specificValue): - (GetByIdStatus): - * bytecode/StructureSet.h: - (StructureSet): - (JSC::StructureSet::singletonStructure): - * bytecode/StructureStubInfo.h: - (JSC::StructureStubInfo::initGetByIdProto): - (JSC::StructureStubInfo::initGetByIdChain): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::handleGetById): - * dfg/DFGRepatch.cpp: - (JSC::DFG::tryCacheGetByID): - * jit/JITStubs.cpp: - (JSC::JITThunks::tryCacheGetByID): - * runtime/JSGlobalObject.h: - (JSC::Structure::prototypeForLookup): - (JSC): - * runtime/Structure.h: - (Structure): - -2012-06-07 Gavin Barraclough - - Remove JSObject::m_inheritorID - https://bugs.webkit.org/show_bug.cgi?id=88378 - - Reviewed by Geoff Garen. - - This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction), - and most objects don't need an inheritorID (this value is only used if the object is used as a prototype). - Instead use a private named value in the object's property storage. - - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): - - No need m_inheritorID to initialize! - * jit/JITInlineMethods.h: - (JSC::JIT::emitAllocateBasicJSObject): - - No need m_inheritorID to initialize! - * llint/LowLevelInterpreter.asm: - - No need m_inheritorID to initialize! - * runtime/JSGlobalData.h: - (JSGlobalData): - - Added private name 'm_inheritorIDKey'. - * runtime/JSGlobalThis.cpp: - (JSC::JSGlobalThis::setUnwrappedObject): - - resetInheritorID is now passed a JSGlobalData&. - * runtime/JSObject.cpp: - (JSC::JSObject::visitChildren): - - No m_inheritorID to be marked. - (JSC::JSObject::createInheritorID): - - Store the newly created inheritorID in the property map. - * runtime/JSObject.h: - (JSC::JSObject::resetInheritorID): - - Remove the inheritorID from property storage. - (JSC::JSObject::inheritorID): - - Read the inheritorID from property storage. - -2012-06-07 Gavin Barraclough - - Math.pow on iOS does not support denormal numbers. - https://bugs.webkit.org/show_bug.cgi?id=88592 - - Reviewed by Filip Pizlo. - - Import an implementation from fdlibm, detect cases where it is safe to use the system - implementation & where we should fall back to fdlibm. - - * runtime/MathObject.cpp: - (JSC::isDenormal): - (JSC::isEdgeCase): - (JSC::mathPow): - - On iOS, detect cases where denormal support may be required & use fdlibm in these cases. - (JSC::mathProtoFuncPow): - - Changed to use mathPow. - (JSC::fdlibmScalbn): - (JSC::fdlibmPow): - - These functions imported from fdlibm; original style retained to ease future merging. - -2012-06-07 Patrick Gansterer - - Unreviewed. Build fix for !ENABLE(JIT) after r119441. - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::privateExecute): + It caused zillion different problem on different platforms -2012-06-07 Andy Wingo - - Unreviewed build fix after r119593. - - * llint/LLIntOfflineAsmConfig.h (OFFLINE_ASM_GLOBAL_LABEL): Fix - uses of "name" to be "label", the macro's parameter. Otherwise we - serialize mentions of the literal symbol "name" into the objcode. - Causes a build error using GNU ld (not gold). - -2012-06-06 Ryosuke Niwa - - Chromium build fix attempt. Why do we need to list these files in gyp!? - - * JavaScriptCore.gypi: - -2012-06-06 Filip Pizlo - - PredictedType should be called SpeculatedType - https://bugs.webkit.org/show_bug.cgi?id=88477 - - Rubber stamped by Gavin Barraclough. - - * CMakeLists.txt: * GNUmakefile.list.am: * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::shouldOptimizeNow): - (JSC::CodeBlock::dumpValueProfiles): - * bytecode/CodeBlock.h: - (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset): - * bytecode/LazyOperandValueProfile.cpp: - (JSC::LazyOperandValueProfileParser::prediction): - * bytecode/LazyOperandValueProfile.h: - (LazyOperandValueProfileParser): - * bytecode/PredictedType.cpp: Removed. - * bytecode/PredictedType.h: Removed. - * bytecode/SpeculatedType.cpp: Copied from Source/JavaScriptCore/bytecode/PredictedType.cpp. - (JSC::speculationToString): - (JSC::speculationToAbbreviatedString): - (JSC::speculationFromClassInfo): - (JSC::speculationFromStructure): - (JSC::speculationFromCell): - (JSC::speculationFromValue): - * bytecode/SpeculatedType.h: Copied from Source/JavaScriptCore/bytecode/PredictedType.h. (JSC): - (JSC::isAnySpeculation): - (JSC::isCellSpeculation): - (JSC::isObjectSpeculation): - (JSC::isFinalObjectSpeculation): - (JSC::isFinalObjectOrOtherSpeculation): - (JSC::isFixedIndexedStorageObjectSpeculation): - (JSC::isStringSpeculation): - (JSC::isArraySpeculation): - (JSC::isFunctionSpeculation): - (JSC::isInt8ArraySpeculation): - (JSC::isInt16ArraySpeculation): - (JSC::isInt32ArraySpeculation): - (JSC::isUint8ArraySpeculation): - (JSC::isUint8ClampedArraySpeculation): - (JSC::isUint16ArraySpeculation): - (JSC::isUint32ArraySpeculation): - (JSC::isFloat32ArraySpeculation): - (JSC::isFloat64ArraySpeculation): - (JSC::isArgumentsSpeculation): - (JSC::isActionableIntMutableArraySpeculation): - (JSC::isActionableFloatMutableArraySpeculation): - (JSC::isActionableTypedMutableArraySpeculation): - (JSC::isActionableMutableArraySpeculation): - (JSC::isActionableArraySpeculation): - (JSC::isArrayOrOtherSpeculation): - (JSC::isMyArgumentsSpeculation): - (JSC::isInt32Speculation): - (JSC::isDoubleRealSpeculation): - (JSC::isDoubleSpeculation): - (JSC::isNumberSpeculation): - (JSC::isBooleanSpeculation): - (JSC::isOtherSpeculation): - (JSC::isEmptySpeculation): - (JSC::mergeSpeculations): - (JSC::mergeSpeculation): - * bytecode/StructureSet.h: - (JSC::StructureSet::speculationFromStructures): - * bytecode/ValueProfile.h: - (JSC::ValueProfileBase::ValueProfileBase): - (JSC::ValueProfileBase::dump): - (JSC::ValueProfileBase::computeUpdatedPrediction): - (ValueProfileBase): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::initialize): - (JSC::DFG::AbstractState::execute): - (JSC::DFG::AbstractState::mergeStateAtTail): - * dfg/DFGAbstractState.h: - (JSC::DFG::AbstractState::speculateInt32Unary): - (JSC::DFG::AbstractState::speculateNumberUnary): - (JSC::DFG::AbstractState::speculateBooleanUnary): - (JSC::DFG::AbstractState::speculateInt32Binary): - (JSC::DFG::AbstractState::speculateNumberBinary): - * dfg/DFGAbstractValue.h: - (JSC::DFG::StructureAbstractValue::filter): - (JSC::DFG::StructureAbstractValue::speculationFromStructures): - (JSC::DFG::AbstractValue::AbstractValue): - (JSC::DFG::AbstractValue::clear): - (JSC::DFG::AbstractValue::isClear): - (JSC::DFG::AbstractValue::makeTop): - (JSC::DFG::AbstractValue::clobberStructures): - (JSC::DFG::AbstractValue::isTop): - (JSC::DFG::AbstractValue::set): - (JSC::DFG::AbstractValue::merge): - (JSC::DFG::AbstractValue::filter): - (JSC::DFG::AbstractValue::validateIgnoringValue): - (JSC::DFG::AbstractValue::validate): - (JSC::DFG::AbstractValue::checkConsistency): - (JSC::DFG::AbstractValue::dump): - (AbstractValue): - * dfg/DFGArgumentPosition.h: - (JSC::DFG::ArgumentPosition::ArgumentPosition): - (JSC::DFG::ArgumentPosition::mergeArgumentAwareness): - (JSC::DFG::ArgumentPosition::prediction): - (ArgumentPosition): - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - * dfg/DFGByteCodeParser.cpp: - (ByteCodeParser): - (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation): - (JSC::DFG::ByteCodeParser::getLocal): - (JSC::DFG::ByteCodeParser::getArgument): - (JSC::DFG::ByteCodeParser::addCall): - (JSC::DFG::ByteCodeParser::getSpeculationWithoutOSRExit): - (JSC::DFG::ByteCodeParser::getSpeculation): - (InlineStackEntry): - (JSC::DFG::ByteCodeParser::handleCall): - (JSC::DFG::ByteCodeParser::handleIntrinsic): - (JSC::DFG::ByteCodeParser::handleGetById): - (JSC::DFG::ByteCodeParser::parseBlock): - (JSC::DFG::ByteCodeParser::fixVariableAccessSpeculations): - (JSC::DFG::ByteCodeParser::parse): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGConstantFoldingPhase.cpp: - (JSC::DFG::ConstantFoldingPhase::run): - * dfg/DFGFixupPhase.cpp: - (JSC::DFG::FixupPhase::fixupNode): - (JSC::DFG::FixupPhase::fixDoubleEdge): - * dfg/DFGGraph.cpp: - (JSC::DFG::Graph::nameOfVariableAccessData): - (JSC::DFG::Graph::dump): - (JSC::DFG::Graph::predictArgumentTypes): - * dfg/DFGGraph.h: - (JSC::DFG::Graph::getJSConstantSpeculation): - (JSC::DFG::Graph::isPredictedNumerical): - (JSC::DFG::Graph::byValIsPure): - * dfg/DFGJITCompiler.h: - (JSC::DFG::JITCompiler::getSpeculation): - * dfg/DFGNode.h: - (JSC::DFG::Node::Node): - (JSC::DFG::Node::getHeapPrediction): - (JSC::DFG::Node::predictHeap): - (JSC::DFG::Node::prediction): - (JSC::DFG::Node::predict): - (JSC::DFG::Node::shouldSpeculateInteger): - (JSC::DFG::Node::shouldSpeculateDouble): - (JSC::DFG::Node::shouldSpeculateNumber): - (JSC::DFG::Node::shouldSpeculateBoolean): - (JSC::DFG::Node::shouldSpeculateFinalObject): - (JSC::DFG::Node::shouldSpeculateFinalObjectOrOther): - (JSC::DFG::Node::shouldSpeculateArray): - (JSC::DFG::Node::shouldSpeculateArguments): - (JSC::DFG::Node::shouldSpeculateInt8Array): - (JSC::DFG::Node::shouldSpeculateInt16Array): - (JSC::DFG::Node::shouldSpeculateInt32Array): - (JSC::DFG::Node::shouldSpeculateUint8Array): - (JSC::DFG::Node::shouldSpeculateUint8ClampedArray): - (JSC::DFG::Node::shouldSpeculateUint16Array): - (JSC::DFG::Node::shouldSpeculateUint32Array): - (JSC::DFG::Node::shouldSpeculateFloat32Array): - (JSC::DFG::Node::shouldSpeculateFloat64Array): - (JSC::DFG::Node::shouldSpeculateArrayOrOther): - (JSC::DFG::Node::shouldSpeculateObject): - (JSC::DFG::Node::shouldSpeculateCell): - (Node): - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::setPrediction): - (JSC::DFG::PredictionPropagationPhase::mergePrediction): - (JSC::DFG::PredictionPropagationPhase::propagate): - (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::fillStorage): - (JSC::DFG::SpeculativeJIT::writeBarrier): - (JSC::DFG::GPRTemporary::GPRTemporary): - (JSC::DFG::FPRTemporary::FPRTemporary): - (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch): - (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality): - (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch): - (JSC::DFG::SpeculativeJIT::compile): - (JSC::DFG::SpeculativeJIT::checkArgumentTypes): - (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt): - (JSC::DFG::SpeculativeJIT::compileGetByValOnString): - (JSC::DFG::SpeculativeJIT::compileValueToInt32): - (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32): - (JSC::DFG::SpeculativeJIT::compileInt32ToDouble): - (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLength): - (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): - (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): - (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): - (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray): - (JSC::DFG::SpeculativeJIT::compileInstanceOf): - (JSC::DFG::SpeculativeJIT::compileAdd): - (JSC::DFG::SpeculativeJIT::compileArithSub): - (JSC::DFG::SpeculativeJIT::compileArithNegate): - (JSC::DFG::SpeculativeJIT::compileArithMul): - (JSC::DFG::SpeculativeJIT::compileArithMod): - (JSC::DFG::SpeculativeJIT::compare): - (JSC::DFG::SpeculativeJIT::compileStrictEq): - (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage): - (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments): - (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength): - (JSC::DFG::SpeculativeJIT::compileRegExpExec): - * dfg/DFGSpeculativeJIT.h: - (DFG): - (JSC::DFG::ValueSource::forSpeculation): - (SpeculativeJIT): - (GPRTemporary): - (FPRTemporary): - (JSC::DFG::SpecDoubleOperand::SpecDoubleOperand): - (JSC::DFG::SpecDoubleOperand::~SpecDoubleOperand): - (JSC::DFG::SpecDoubleOperand::fpr): - (JSC::DFG::SpecCellOperand::SpecCellOperand): - (JSC::DFG::SpecCellOperand::~SpecCellOperand): - (JSC::DFG::SpecCellOperand::gpr): - (JSC::DFG::SpecBooleanOperand::SpecBooleanOperand): - (JSC::DFG::SpecBooleanOperand::~SpecBooleanOperand): - (JSC::DFG::SpecBooleanOperand::gpr): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): - (JSC::DFG::SpeculativeJIT::fillSpecDouble): - (JSC::DFG::SpeculativeJIT::fillSpecCell): - (JSC::DFG::SpeculativeJIT::fillSpecBoolean): - (JSC::DFG::SpeculativeJIT::compileObjectEquality): - (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality): - (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality): - (JSC::DFG::SpeculativeJIT::compileDoubleCompare): - (JSC::DFG::SpeculativeJIT::compileLogicalNot): - (JSC::DFG::SpeculativeJIT::emitBranch): - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): - (JSC::DFG::SpeculativeJIT::fillSpecDouble): - (JSC::DFG::SpeculativeJIT::fillSpecCell): - (JSC::DFG::SpeculativeJIT::fillSpecBoolean): - (JSC::DFG::SpeculativeJIT::compileObjectEquality): - (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality): - (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality): - (JSC::DFG::SpeculativeJIT::compileDoubleCompare): - (JSC::DFG::SpeculativeJIT::compileLogicalNot): - (JSC::DFG::SpeculativeJIT::emitBranch): - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGVariableAccessData.h: - (JSC::DFG::VariableAccessData::VariableAccessData): - (JSC::DFG::VariableAccessData::predict): - (JSC::DFG::VariableAccessData::nonUnifiedPrediction): - (JSC::DFG::VariableAccessData::prediction): - (JSC::DFG::VariableAccessData::argumentAwarePrediction): - (JSC::DFG::VariableAccessData::mergeArgumentAwarePrediction): - (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote): - (JSC::DFG::VariableAccessData::makePredictionForDoubleFormat): - (VariableAccessData): - -2012-06-06 Filip Pizlo - - Global object variable accesses should not require an extra load - https://bugs.webkit.org/show_bug.cgi?id=88385 - - Reviewed by Gavin Barraclough and Geoffrey Garen. - - Previously, if you wanted to access a global variable, you'd first have - to load the register array from the appropriate global object and then - either load or store at an offset to the register array. This is because - JSGlobalObject inherited from JSVariableObject, and JSVariableObject is - designed with the pessimistic assumption that its register array may - point into the call stack. This is never the case for global objects. - Hence, even though the global object may add more registers at any time, - it does not need to store them in a contiguous array. It can use a - SegmentedVector or similar. - - This patch refactors global objects and variable objects as follows: - - - The functionality to track variables in an indexable array using a - SymbolTable to map names to indices is moved into JSSymbolTableObject, - which is now a supertype of JSVariableObject. JSVariableObject is now - just a holder for a registers array and implements the registerAt() - method that is left abstract in JSSymbolTableObject. Because all users - of JSVariableObject know whether they are a JSStaticScopeObject, - JSActivation, or JSGlobalObject, this "abstract" method is not virtual; - instead the utility methods that would call registerAt() are now - template functions that require you to know statically what subtype of - JSSymbolTableObject you're using (JSVariableObject or something else), - so that registerAt() can be statically bound. - - - A new class is added called JSSegmentedVariableObject, which only - differs from JSVariableObject in how it allocates registers. It uses a - SegmentedVector instead of manually managing a pointer to a contiguous - slab of registers. This changes the interface somewhat; for example - with JSVariableObject if you wanted to add a register you had to do - it yourself since the JSVariableObject didn't know how the registers - array ought to be allocated. With JSSegmentedVariableObject you can - just call addRegisters(). JSSegmentedVariableObject preserves the - invariant that once you get a pointer into a register, that pointer - will continue to be valid so long as the JSSegmentedVariableObject is - alive. This allows the JITs and interpreters to skip the extra load. - - - JSGlobalObject now inherits from JSSegmentedVariableObject. For now - (and possibly forever) it is the only subtype of this new class. - - - The bytecode format is changed so that get_global_var and - put_global_var have a pointer to the register directly rather than - having an index. A convenience method is provided in - JSSegmentedVariableObject to get the index given a a pointer, which is - used for assertions and debug dumps. - - This appears to be a 1% across the board win. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * bytecode/CodeBlock.cpp: + (JSC::isGlobalResolve): + (JSC::instructionOffsetForNth): + (JSC::printGlobalResolveInfo): + (JSC::CodeBlock::printStructures): (JSC::CodeBlock::dump): - * bytecode/Instruction.h: - (Instruction): - (JSC::Instruction::Instruction): + (JSC::CodeBlock::CodeBlock): + (JSC::CodeBlock::visitStructures): + (JSC::CodeBlock::finalizeUnconditionally): + (JSC::CodeBlock::hasGlobalResolveInfoAtBytecodeOffset): + (JSC::CodeBlock::globalResolveInfoForBytecodeOffset): + (JSC::CodeBlock::shrinkToFit): + * bytecode/CodeBlock.h: + (CodeBlock): + (JSC::CodeBlock::addGlobalResolveInstruction): + (JSC::CodeBlock::addGlobalResolveInfo): + (JSC::CodeBlock::globalResolveInfo): + (JSC::CodeBlock::numberOfGlobalResolveInfos): + (JSC::CodeBlock::globalResolveInfoCount): + * bytecode/GlobalResolveInfo.h: Copied from Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp. + (JSC): + (JSC::GlobalResolveInfo::GlobalResolveInfo): + (GlobalResolveInfo): + (JSC::getGlobalResolveInfoBytecodeOffset): + * bytecode/Opcode.h: + (JSC): + (JSC::padOpcodeName): + * bytecode/ResolveGlobalStatus.cpp: + (JSC): + (JSC::computeForStructure): + (JSC::computeForLLInt): + (JSC::ResolveGlobalStatus::computeFor): + * bytecode/ResolveGlobalStatus.h: + (JSC): + (ResolveGlobalStatus): + * bytecode/ResolveOperation.h: Removed. * bytecompiler/BytecodeGenerator.cpp: + (JSC::ResolveResult::checkValidity): (JSC::ResolveResult::registerPointer): (JSC): (JSC::BytecodeGenerator::BytecodeGenerator): - (JSC::BytecodeGenerator::retrieveLastUnaryOp): (JSC::BytecodeGenerator::resolve): (JSC::BytecodeGenerator::resolveConstDecl): + (JSC::BytecodeGenerator::shouldAvoidResolveGlobal): + (JSC::BytecodeGenerator::emitResolve): + (JSC::BytecodeGenerator::emitResolveBase): + (JSC::BytecodeGenerator::emitResolveBaseForPut): + (JSC::BytecodeGenerator::emitResolveWithBase): + (JSC::BytecodeGenerator::emitResolveWithThis): (JSC::BytecodeGenerator::emitGetStaticVar): + (JSC::BytecodeGenerator::emitInitGlobalConst): (JSC::BytecodeGenerator::emitPutStaticVar): * bytecompiler/BytecodeGenerator.h: + (JSC::ResolveResult::registerResolve): + (JSC::ResolveResult::dynamicResolve): + (JSC::ResolveResult::lexicalResolve): + (JSC::ResolveResult::indexedGlobalResolve): + (JSC::ResolveResult::dynamicIndexedGlobalResolve): + (JSC::ResolveResult::globalResolve): + (JSC::ResolveResult::dynamicGlobalResolve): + (JSC::ResolveResult::type): + (JSC::ResolveResult::index): + (JSC::ResolveResult::depth): + (JSC::ResolveResult::globalObject): (ResolveResult): + (JSC::ResolveResult::isStatic): + (JSC::ResolveResult::isIndexed): + (JSC::ResolveResult::isScoped): + (JSC::ResolveResult::isGlobal): + (JSC::ResolveResult::ResolveResult): (BytecodeGenerator): - * dfg/DFGAssemblyHelpers.h: - (AssemblyHelpers): + * bytecompiler/NodesCodegen.cpp: + (JSC::ResolveNode::isPure): + (JSC::FunctionCallResolveNode::emitBytecode): + (JSC::PostfixNode::emitResolve): + (JSC::PrefixNode::emitResolve): + (JSC::ReadModifyResolveNode::emitBytecode): + (JSC::AssignResolveNode::emitBytecode): + (JSC::ConstDeclNode::emitCodeSingle): + (JSC::ForInNode::emitBytecode): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): * dfg/DFGByteCodeParser.cpp: + (ByteCodeParser): + (InlineStackEntry): + (JSC::DFG::ByteCodeParser::handleGetByOffset): (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::globalVarLoadElimination): - (JSC::DFG::CSEPhase::globalVarStoreElimination): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGGraph.cpp: - (JSC::DFG::Graph::dump): + (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): + * dfg/DFGCapabilities.h: + (JSC::DFG::canCompileOpcode): + (JSC::DFG::canInlineOpcode): * dfg/DFGGraph.h: - (JSC::DFG::Graph::globalObjectFor): + (ResolveGlobalData): + (DFG): (Graph): * dfg/DFGNode.h: - (JSC::DFG::Node::hasVarNumber): - (Node): - (JSC::DFG::Node::hasRegisterPointer): - (JSC::DFG::Node::registerPointer): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * heap/Heap.h: - (Heap): - (JSC::Heap::isWriteBarrierEnabled): - (JSC): - * interpreter/Interpreter.cpp: - (JSC::Interpreter::execute): - (JSC::Interpreter::privateExecute): - * jit/JITPropertyAccess.cpp: - (JSC::JIT::emit_op_get_global_var): - (JSC::JIT::emit_op_put_global_var): - * jit/JITPropertyAccess32_64.cpp: - (JSC::JIT::emit_op_get_global_var): - (JSC::JIT::emit_op_put_global_var): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - * runtime/JSGlobalObject.cpp: - (JSC): - (JSC::JSGlobalObject::put): - (JSC::JSGlobalObject::putDirectVirtual): - (JSC::JSGlobalObject::defineOwnProperty): - (JSC::JSGlobalObject::visitChildren): - (JSC::JSGlobalObject::addStaticGlobals): - (JSC::JSGlobalObject::getOwnPropertySlot): - (JSC::JSGlobalObject::getOwnPropertyDescriptor): - * runtime/JSGlobalObject.h: - (JSGlobalObject): - (JSC::JSGlobalObject::JSGlobalObject): - (JSC): - (JSC::JSGlobalObject::hasOwnPropertyForWrite): - * runtime/JSSegmentedVariableObject.cpp: Added. - (JSC): - (JSC::JSSegmentedVariableObject::findRegisterIndex): - (JSC::JSSegmentedVariableObject::addRegisters): - (JSC::JSSegmentedVariableObject::visitChildren): - * runtime/JSSegmentedVariableObject.h: Added. - (JSC): - (JSSegmentedVariableObject): - (JSC::JSSegmentedVariableObject::registerAt): - (JSC::JSSegmentedVariableObject::assertRegisterIsInThisObject): - (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject): - (JSC::JSSegmentedVariableObject::finishCreation): - * runtime/JSStaticScopeObject.cpp: - (JSC::JSStaticScopeObject::put): - (JSC::JSStaticScopeObject::putDirectVirtual): - (JSC::JSStaticScopeObject::getOwnPropertySlot): - * runtime/JSSymbolTableObject.cpp: Added. - (JSC): - (JSC::JSSymbolTableObject::destroy): - (JSC::JSSymbolTableObject::deleteProperty): - (JSC::JSSymbolTableObject::getOwnPropertyNames): - (JSC::JSSymbolTableObject::putDirectVirtual): - (JSC::JSSymbolTableObject::isDynamicScope): - * runtime/JSSymbolTableObject.h: Added. - (JSC): - (JSSymbolTableObject): - (JSC::JSSymbolTableObject::symbolTable): - (JSC::JSSymbolTableObject::JSSymbolTableObject): - (JSC::JSSymbolTableObject::finishCreation): - (JSC::symbolTableGet): - (JSC::symbolTablePut): - (JSC::symbolTablePutWithAttributes): - * runtime/JSVariableObject.cpp: - (JSC): - * runtime/JSVariableObject.h: - (JSVariableObject): - (JSC::JSVariableObject::JSVariableObject): - (JSC::JSVariableObject::finishCreation): - (JSC): - * runtime/WriteBarrier.h: - -2012-06-06 Filip Pizlo - - DFG arguments access slow path should not crash if the arguments haven't been created - https://bugs.webkit.org/show_bug.cgi?id=88471 - - Reviewed by Gavin Barraclough. - - * dfg/DFGCCallHelpers.h: - (JSC::DFG::CCallHelpers::setupArgumentsWithExecState): - (CCallHelpers): + (JSC::DFG::Node::hasIdentifier): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGOSRExit.cpp: + (JSC::DFG::OSRExit::OSRExit): + * dfg/DFGOSRExit.h: + (OSRExit): + * dfg/DFGOSRExitCompiler.cpp: + * dfg/DFGOSRExitCompiler32_64.cpp: + (JSC::DFG::OSRExitCompiler::compileExit): + * dfg/DFGOSRExitCompiler64.cpp: + (JSC::DFG::OSRExitCompiler::compileExit): * dfg/DFGOperations.cpp: * dfg/DFGOperations.h: + (JSC): + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGRepatch.cpp: + (JSC::DFG::tryCacheGetByID): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward): * dfg/DFGSpeculativeJIT.h: (JSC::DFG::SpeculativeJIT::callOperation): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): - -2012-06-06 Michael Saboff - - ENH: Add Logging to GC Marking Phase - https://bugs.webkit.org/show_bug.cgi?id=88364 - - Reviewed by Filip Pizlo. - - Log GC marking to stderr or a file. The logging in controlled - with the define ENABLE_OBJECT_MARK_LOGGING in wtf/Platform.h. - If DATA_LOG_TO_FILE in wtf/DataLog.cpp is set to 1, output is - logged to a file otherwise it is logged to stderr. - - When logging is enabled, the GC is built single threaded since the - log output from the various threads isn't buffered and output in a - thread safe manner. - - * heap/Heap.cpp: - (JSC::Heap::markRoots): - * heap/MarkStack.cpp: - (JSC::MarkStackThreadSharedData::resetChildren): - (JSC::MarkStackThreadSharedData::childVisitCount): - (JSC::MarkStackThreadSharedData::markingThreadMain): - (JSC::MarkStackThreadSharedData::markingThreadStartFunc): - (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData): - (JSC::MarkStackThreadSharedData::reset): - * heap/MarkStack.h: - (MarkStackThreadSharedData): - (MarkStack): - (JSC::MarkStack::sharedData): - (JSC::MarkStack::resetChildCount): - (JSC::MarkStack::childCount): - (JSC::MarkStack::incrementChildCount): - * runtime/JSArray.cpp: - (JSC::JSArray::visitChildren): - * runtime/JSCell.cpp: - (JSC::JSCell::className): - * runtime/JSCell.h: - (JSCell): - (JSC::JSCell::visitChildren): - * runtime/JSString.cpp: - (JSC::JSString::visitChildren): - * runtime/JSString.h: - (JSString): - * runtime/Structure.h: - (JSC::MarkStack::internalAppend): - -2012-06-06 Gavin Barraclough - - Assigning to a static property should not change iteration order - https://bugs.webkit.org/show_bug.cgi?id=88401 - - Reviewed by Geoff Garen. - - A specific iteration order is not defined by the spec, but test-262 somewhat tenuously - requires that it is at least stable, e.g. ch10/10.4/10.4.2/S10.4.2_A1.1_T1.js - - Whilst it is not clear that this behavior really arises from the specification, it - would seem like common sense to conform to this. - - The problem here is that we allow properties in the structure to shadow those in the - static table, and we iterate the properties in the structure first - which means that - as values of existing properties are modified, their iteration order changes too. - - The easy fix is to iterate the properties from the static table first. This has a - further benefit, since it will mean that user added properties will come after those - present in the static table (respected the expected insertion-order). - - * runtime/JSObject.cpp: - (JSC::JSObject::getOwnPropertyNames): - - Iterate static properties first. - -2012-06-06 Andy Wingo - - Ensure consistent order of evaluation in LLInt slow paths - https://bugs.webkit.org/show_bug.cgi?id=88409 - - Reviewed by Geoffrey Garen. - - * llint/LLIntSlowPaths.cpp: - (slow_path_mul) - (slow_path_sub) - (slow_path_div) - (slow_path_mod) - (slow_path_lshift) - (slow_path_rshift) - (slow_path_urshift) - (slow_path_bitand) - (slow_path_bitor) - (slow_path_bitxor): Avoid calling toNumber, toInt32, or toUInt32 - multiple times without intervening sequence points. Fixes - fast/js/exception-sequencing-binops.html with GCC 4.7 on x86-64 - Linux, which reordered evaluation of the arguments to fmod. - -2012-06-06 Andy Wingo - - [GTK] Enable the LLInt - https://bugs.webkit.org/show_bug.cgi?id=88315 - - Reviewed by Filip Pizlo. - - * GNUmakefile.am: Add rules to generate LLIntDesiredOffsets.h and - LLIntAssembly.h. - * GNUmakefile.list.am: Add offlineasm and llint files to the - dist. Add LLInt source files to the build. - * llint/LowLevelInterpreter.asm (crash): Generate a store of - 0xbbadbeef to a register, not to a constant. Otherwise, gas was - failing to assemble result. - * offlineasm/asm.rb (labelReference): Generate a - SYMBOL_STRING_RELOCATION instead of a SYMBOL_STRING, so that we go - through the PLT on ELF systems. - -2012-06-06 Andy Wingo - - REGRESSION (r106478): None of the Paper.js JavaScript examples work - https://bugs.webkit.org/show_bug.cgi?id=87158 - - Reviewed by Michael Saboff. - - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::resolve): If we have to bail out to - dynamicResolve(), only skip static scopes from the head of the - scope chain. Before, we were also skipping activations with - direct eval as well, which was incorrect. - -2012-06-06 Dan Bernstein - - Reverted r119567, the fix for , because it broke the 32-bit build. - - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): - * jit/JITInlineMethods.h: - (JSC::JIT::emitAllocateBasicJSObject): - * llint/LowLevelInterpreter.asm: - * runtime/JSGlobalData.h: - (JSGlobalData): - * runtime/JSGlobalThis.cpp: - (JSC::JSGlobalThis::setUnwrappedObject): - * runtime/JSObject.cpp: - (JSC::JSObject::visitChildren): - (JSC::JSObject::createInheritorID): - * runtime/JSObject.h: - (JSObject): - (JSC::JSObject::resetInheritorID): + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + * jit/JIT.cpp: + (JSC::JIT::privateCompileMainPass): + (JSC::JIT::privateCompileSlowCases): + * jit/JIT.h: + (JIT): + (JSC::JIT::emit_op_get_global_var_watchable): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_resolve): (JSC): - (JSC::JSObject::offsetOfInheritorID): - (JSC::JSObject::inheritorID): - -2012-06-05 Yuqiang Xian - - Improve Math.round and Math.floor intrinsic - https://bugs.webkit.org/show_bug.cgi?id=88314 - - Reviewed by Filip Pizlo. - - Currently we call a native function from the JIT code to complete the - "round" and "floor" operations. We could inline some fast paths - especially for those positive values on the platforms where floating - point truncation is supported. - This brings 3% gain on Kraken, especially 32% on audio-oscillator, - and slight win on SunSpider, measured on IA32. - - * jit/ThunkGenerators.cpp: - (JSC::floorThunkGenerator): + (JSC::JIT::emit_op_resolve_base): + (JSC::JIT::emit_op_resolve_skip): + (JSC::JIT::emit_op_resolve_global): + (JSC::JIT::emitSlow_op_resolve_global): + (JSC::JIT::emit_op_resolve_with_base): + (JSC::JIT::emit_op_resolve_with_this): + (JSC::JIT::emit_op_resolve_global_dynamic): + (JSC::JIT::emitSlow_op_resolve_global_dynamic): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_resolve): (JSC): - (JSC::roundThunkGenerator): - -2012-06-05 Gavin Barraclough - - Remove JSObject::m_inheritorID - https://bugs.webkit.org/show_bug.cgi?id=88378 - - Reviewed by Geoff Garen. - - This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction), - and most objects don't need an inheritorID (this value is only used if the object is used as a prototype). - Instead use a private named value in the object's property storage. - - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): - - No need m_inheritorID to initialize! - * jit/JITInlineMethods.h: - (JSC::JIT::emitAllocateBasicJSObject): - - No need m_inheritorID to initialize! - * llint/LowLevelInterpreter.asm: - - No need m_inheritorID to initialize! - * runtime/JSGlobalData.h: - (JSGlobalData): - - Added private name 'm_inheritorIDKey'. - * runtime/JSGlobalThis.cpp: - (JSC::JSGlobalThis::setUnwrappedObject): - - resetInheritorID is now passed a JSGlobalData&. - * runtime/JSObject.cpp: - (JSC::JSObject::visitChildren): - - No m_inheritorID to be marked. - (JSC::JSObject::createInheritorID): - - Store the newly created inheritorID in the property map. - * runtime/JSObject.h: - (JSC::JSObject::resetInheritorID): - - Remove the inheritorID from property storage. - (JSC::JSObject::inheritorID): - - Read the inheritorID from property storage. - -2012-06-05 Filip Pizlo - - DFG CFG simplification should not attempt to deref nodes inside of an unreachable subgraph - https://bugs.webkit.org/show_bug.cgi?id=88362 - - Reviewed by Gavin Barraclough. - - * dfg/DFGCFGSimplificationPhase.cpp: - (JSC::DFG::CFGSimplificationPhase::fixPhis): - (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference): - -2012-06-05 Mark Hahnenberg - - Entry into JSC should CRASH() if the Heap is busy - https://bugs.webkit.org/show_bug.cgi?id=88355 - - Reviewed by Geoffrey Garen. - - Interpreter::execute() returns jsNull() right now if we try to enter it while - the Heap is busy (e.g. with a collection), which is okay, but some code paths - that call Interpreter::execute() allocate objects before checking if the Heap - is busy. Attempting to execute JS code while the Heap is busy should not be - allowed and should be enforced by a release-mode CRASH() to prevent vague, - unhelpful backtraces later on if somebody makes a mistake. Normally, recursively - executing JS code is okay, e.g. for evals, but it should not occur during a - Heap allocation or collection because the Heap is not guaranteed to be in a - consistent state (especially during collections). We are protected from - executing JS on the same Heap concurrently on two separate threads because - they must each take a JSLock first. However, we are not protected from reentrant - execution of JS on the same thread because JSLock allows reentrancy. Therefore, - we should fail early if we detect an entrance into JS code while the Heap is busy. - - * heap/Heap.cpp: Changed Heap::collect so that it sets the m_operationInProgress field - at the beginning of collection and then unsets it at the end so that it is set at all - times throughout the duration of a collection rather than sporadically during various - phases. There is no reason to unset during a collection because our collector does - not currently support running additional JS between the phases of a collection. - (JSC::Heap::getConservativeRegisterRoots): - (JSC::Heap::markRoots): - (JSC::Heap::collect): - * interpreter/Interpreter.cpp: - (JSC::Interpreter::execute): Crash if the Heap is busy. - * runtime/Completion.cpp: Crash if the Heap is busy. We do it here before we call - Interpreter::execute() because we do some allocation prior to calling execute() which - could cause Heap corruption if, for example, that allocation caused a collection. - (JSC::evaluate): - -2012-06-05 Dongwoo Im - - Add 'isProtocolHandlerRegistered' and 'unregisterProtocolHandler'. - https://bugs.webkit.org/show_bug.cgi?id=73176 - - Reviewed by Adam Barth. - - Two more APIs are added in Custom Scheme Handler specification. - http://dev.w3.org/html5/spec/Overview.html#custom-handlers - One is 'isProtocolHandlerRegistered' to query whether the specific URL - is registered or not. - The other is 'unregisterProtocolHandler' to remove the registered URL. - - * Configurations/FeatureDefines.xcconfig: Add a macro 'ENABLE_CUSTOM_SCHEME_HANDLER'. - -2012-06-04 Filip Pizlo - - DFG CFG simplification should correct the variables at the head of the predecessor block - https://bugs.webkit.org/show_bug.cgi?id=88284 - - Reviewed by Geoffrey Garen. - - * dfg/DFGCFGSimplificationPhase.cpp: - (JSC::DFG::CFGSimplificationPhase::mergeBlocks): - -2012-06-04 Geoffrey Garen - - Unreviewed. - - Rolled out r119364 because it's still causing crashes (when running - v8-earley in release builds of DRT) - - This time for sure! - - * heap/Heap.cpp: - (JSC::Heap::collect): - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::sweep): - * heap/MarkedBlock.h: - (JSC::MarkedBlock::resetAllocator): + (JSC::JIT::emit_op_resolve_base): + (JSC::JIT::emit_op_resolve_skip): + (JSC::JIT::emit_op_resolve_global): + (JSC::JIT::emitSlow_op_resolve_global): + (JSC::JIT::emit_op_resolve_with_base): + (JSC::JIT::emit_op_resolve_with_this): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::emit_op_get_scoped_var): (JSC): - * heap/MarkedSpace.cpp: - (JSC::ResetAllocator::operator()): + (JSC::JIT::emit_op_put_scoped_var): + (JSC::JIT::emit_op_get_global_var): + (JSC::JIT::emit_op_put_global_var): + (JSC::JIT::emit_op_put_global_var_check): + (JSC::JIT::emitSlow_op_put_global_var_check): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::emit_op_get_scoped_var): (JSC): - (JSC::MarkedSpace::resetAllocators): - (JSC::MarkedSpace::sweepWeakSets): - * heap/MarkedSpace.h: - (MarkedSpace): - * heap/WeakBlock.cpp: - (JSC::WeakBlock::sweep): - * heap/WeakSet.cpp: - (JSC::WeakSet::sweep): - (JSC::WeakSet::tryFindAllocator): - * heap/WeakSet.h: - (JSC::WeakSet::shrink): - -2012-06-04 Filip Pizlo - - DFG arguments simplification should have rationalized handling of TearOffArguments - https://bugs.webkit.org/show_bug.cgi?id=88206 - - Reviewed by Geoffrey Garen. - - - Accesses to the unmodified arguments register ought to have the same effect on - alias/escape analysis of arguments as accesses to the mutable arguments register. - - - The existence of TearOffArguments should not get in the way of arguments aliasing. - - - TearOffArguments should be eliminated if CreateArguments is eliminated. - - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse): - -2012-06-04 Gavin Barraclough - - Remove enabledProfilerReference - https://bugs.webkit.org/show_bug.cgi?id=88258 - - Reviewed by Michael Saboff. - - Make the enabled profiler a member of JSGlobalData, and switch code that accesses it to do so directly - via the JSGlobalData, rather than holding a Profiler** reference to it. Do not pass the Profiler** - reference to JIT code. This patch does not change the stack layout on entry into JIT code (passing an - unused void* instead), since this is an intrusive change better handled in a separate patch. - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::throwException): - (JSC::Interpreter::execute): - (JSC::Interpreter::executeCall): - (JSC::Interpreter::executeConstruct): - (JSC::Interpreter::privateExecute): - * jit/JITCode.h: - (JSC::JITCode::execute): - - Don't pass Profiler** to JIT code. - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_profile_will_call): - (JSC::JIT::emit_op_profile_did_call): - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::emit_op_profile_will_call): - (JSC::JIT::emit_op_profile_did_call): + (JSC::JIT::emit_op_put_scoped_var): + (JSC::JIT::emit_op_get_global_var): + (JSC::JIT::emit_op_put_global_var): + (JSC::JIT::emit_op_put_global_var_check): + (JSC::JIT::emitSlow_op_put_global_var_check): * jit/JITStubs.cpp: - (JSC): - (JSC::ctiTrampoline): - (JSC::ctiVMThrowTrampoline): - (JSC::ctiOpThrowNotCaught): - (JSC::JITThunks::JITThunks): (JSC::DEFINE_STUB_FUNCTION): - - For ARM_THUMB2, rename ENABLE_PROFILER_REFERENCE_OFFSET to FIRST_STACK_ARGUMENT (which is how it is being used). - - For MIPS, remove ENABLE_PROFILER_REFERENCE_OFFSET. - * jit/JITStubs.h: - (JITStackFrame): (JSC): - - Renamed enabledProfilerReference to unusedX. + * jit/JITStubs.h: * llint/LLIntSlowPaths.cpp: + (LLInt): (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * llint/LLIntSlowPaths.h: + (LLInt): * llint/LowLevelInterpreter.asm: - * profiler/Profiler.cpp: - (JSC): - (JSC::Profiler::startProfiling): - (JSC::Profiler::stopProfiling): - * profiler/Profiler.h: - (Profiler): - - Removed s_sharedEnabledProfilerReference, enabledProfilerReference(). - * runtime/JSGlobalData.cpp: - (JSC::JSGlobalData::JSGlobalData): - * runtime/JSGlobalData.h: - (JSC): - (JSC::JSGlobalData::enabledProfiler): - (JSGlobalData): - - Added m_enabledProfiler, enabledProfiler(). - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::~JSGlobalObject): - -2012-06-04 Filip Pizlo - - get_argument_by_val should be profiled everywhere - https://bugs.webkit.org/show_bug.cgi?id=88205 - - Reviewed by Geoffrey Garen. - - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::emitSlow_op_get_argument_by_val): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/JSScope.cpp: + (JSC::JSScope::resolve): + (JSC::JSScope::resolveSkip): + (JSC::JSScope::resolveGlobal): + (JSC::JSScope::resolveGlobalDynamic): + (JSC::JSScope::resolveBase): + (JSC::JSScope::resolveWithBase): + (JSC::JSScope::resolveWithThis): + * runtime/JSScope.h: + (JSScope): + * runtime/JSVariableObject.cpp: + * runtime/JSVariableObject.h: + * runtime/Structure.h: -2012-06-04 Filip Pizlo +2012-10-16 Dongwoo Joshua Im - DFG arguments simplification takes unkindly to direct accesses to the arguments register - https://bugs.webkit.org/show_bug.cgi?id=88261 + [GTK] Fix build break - ResolveOperations.h is not in WebKit. + https://bugs.webkit.org/show_bug.cgi?id=99538 - Reviewed by Geoffrey Garen. - - Fixed arguments simplification for direct accesses to the arguments register, which may - arise if CSE had not run. Fixed CSE so that it does run prior to arguments simplification, - by making it a full-fledged member of the fixpoint. Fixed other issues in arguments - simplification, like realizing that it needs to bail if there is a direct assignment to - the arguments register, and failing to turn CreateArguments into PhantomArguments. Also - fixed CSE's handling of store elimination of captured locals in the presence of a - GetMyArgumentByVal (or one of its friends), and fixed CSE to correctly fixup variables at - tail if the Flush it removes is the last operation on a local in a basic block. + Unreviewed build fix. - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::run): - (JSC::DFG::CSEPhase::setLocalStoreElimination): - (JSC::DFG::CSEPhase::performNodeCSE): - (CSEPhase): - * dfg/DFGDriver.cpp: - (JSC::DFG::compile): + There are some files including ResolveOperations.h which is not exist at all. -2012-06-04 Anders Carlsson + * GNUmakefile.list.am: s/ResolveOperations.h/ResolveOperation.h/ + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: s/ResolveOperations.h/ResolveOperation.h/ - Fix a struct/class mismatch. +2012-10-16 Jian Li - * heap/Handle.h: - (Handle): + Rename feature define ENABLE_WIDGET_REGION to ENABLE_DRAGGBALE_REGION + https://bugs.webkit.org/show_bug.cgi?id=98975 -2012-06-04 David Kilzer + Reviewed by Adam Barth. - BUILD FIX: FeatureDefines.xcconfig should match across projects + Renaming is needed to better match with the draggable region code. * Configurations/FeatureDefines.xcconfig: - - Add missing ENABLE_LEGACY_CSS_VENDOR_PREFIXES. - -2012-06-02 Geoffrey Garen - - Weak pointer finalization should be lazy - https://bugs.webkit.org/show_bug.cgi?id=87599 - - Reviewed by Sam Weinig. - - This time for sure! - - * heap/Heap.cpp: - (JSC::Heap::collect): Don't sweep eagerly -- we'll sweep lazily instead. - - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::sweep): Sweep our weak set before we sweep our other - destructors -- this is our last chance to run weak set finalizers before - we recycle our memory. - - * heap/MarkedBlock.h: - (JSC::MarkedBlock::resetAllocator): - * heap/MarkedSpace.cpp: - (JSC::MarkedSpace::resetAllocators): - * heap/MarkedSpace.h: - (JSC::MarkedSpace::resetAllocators): Don't force allocator reset anymore. - It will happen automatically when a weak set is swept. It's simpler to - have only one canonical way for this to happen, and it wasn't buying - us anything to do it eagerly. - - * heap/WeakBlock.cpp: - (JSC::WeakBlock::sweep): Don't short-circuit a sweep unless we know - the sweep would be a no-op. If even one finalizer is pending, we need to - run it, since we won't get another chance. - - * heap/WeakSet.cpp: - (JSC::WeakSet::sweep): This loop can be simpler now that - WeakBlock::sweep() does what we mean. - - Reset our allocator after a sweep because this is the optimal time to - start trying to recycle old weak pointers. - - (JSC::WeakSet::tryFindAllocator): Don't sweep when searching for an - allocator because we've swept already, and forcing a new sweep would be - wasteful. - - * heap/WeakSet.h: - (JSC::WeakSet::shrink): Be sure to reset our allocator after a shrink - because the shrink may have removed the block the allocator was going to - allocate out of. - -2012-06-02 Filip Pizlo - - If the DFG bytecode parser detects that op_method_check has gone polymorphic, it - shouldn't revert all the way to GetById/GetByIdFlush - https://bugs.webkit.org/show_bug.cgi?id=88176 - - Reviewed by Geoffrey Garen. - - Refactored the code so that the op_method_check case of the parser gracefully falls - through to all of the goodness of the normal op_get_by_id case. - - * dfg/DFGByteCodeParser.cpp: - (ByteCodeParser): - (JSC::DFG::ByteCodeParser::handleGetById): - (DFG): - (JSC::DFG::ByteCodeParser::parseBlock): -2012-06-02 Filip Pizlo +2012-10-15 Oliver Hunt - DFG CSE should be able to eliminate unnecessary flushes of arguments and captured variables - https://bugs.webkit.org/show_bug.cgi?id=87929 + Bytecode should not have responsibility for determining how to perform non-local resolves + https://bugs.webkit.org/show_bug.cgi?id=99349 - Reviewed by Geoffrey Garen. - - Slight speed-up on V8. Big win (up to 50%) on programs that inline very small functions. - - This required a bunch of changes: - - - The obvious change is making CSE essentially ignore whether or not the set of - operations between the Flush and the SetLocal can exit, and instead focus on whether or - not that set of operations can clobber the world or access local variables. This code - is now refactored to return a set of flags indicating any of these events, and the CSE - decides what to do based on those flags. If the set of operations is non-clobbering - and non-accessing, then the Flush is turned into a Phantom on the child of the - SetLocal. This expands the liveness of the relevant variable but virtually guarantees - that it will be register allocated and not flushed to the stack. So, yeah, this patch - is a lot of work to save a few stores to the stack. - - - Previously, CheckArgumentsNotCreated was optimized "lazily" in that you only knew if - it was a no-op if you were holding onto a CFA abstract state. But this would make the - CSE act pessimistically, since it doesn't use the CFA. Hence, this patch changes the - constant folding phase into something more broad; it now fixes up - CheckArgumentsNotCreated nodes by turning them into phantoms if it knows that they are - no-ops. - - - Arguments simplification was previously relying on this very strange PhantomArguments - node, which had two different meanings: for normal execution it meant the empty value - but for OSR exit it meant that the arguments should be reified. This produces problems - when set SetLocals to the captured arguments registers are CSE'd away, since we'd be - triggering reification of arguments without having initialized the arguments registers - to empty. The cleanest solution was to fix PhantomArguments to have one meaning: - namely, arguments reification on OSR exit. Hence, this patch changes arguments - simplification to change SetLocal of CreateArguments on the arguments registers to be - a SetLocal of Empty. - - - Argument value recoveries were previously derived from the value source of the - arguments at the InlineStart. But that relies on all SetLocals to arguments having - been flushed. It's possible that we could have elided the SetLocal to the arguments - at the callsite because there were subsequent SetLocals to the arguments inside of the - callee, in which case the InlineStart would get the wrong information. Hence, this - patch changes argument value recovery computation to operate over the ArgumentPositions - directly. - - - But that doesn't actually work, because previously, there was no way to link an - InlineStart back to the corresponding ArgumentPositions, at least not without some - ugliness. So this patch instates the rule that the m_argumentPositions vector consists - of disjoint subsequences such that each subsequence corresponds to an inline callsite - and can be identified by its first index, and within each subsequence are the - ArgumentPositions of all of the arguments ordered by argument index. This required - flipping the order in which ArgumentPositions are added to the vector, and giving - InlineStart an operand that indicates the start of that inline callsite's - ArgumentPosition subsequence. - - - This patch also revealed a nasty bug in the reification of arguments in inline call - frames on OSR exit. Since the reification was happening after the values of virtual - registers were recovered, the value recoveries of the inline arguments were wrong. - Hence using operationCreateInlinedArguments is wrong. For example a value recovery - might say that you have to box a double, but if we had already boxed it then boxing - it a second time will result in garbage. The specific case of this bug was this patch - uncovered was that now it is possible for an inline call frame to not have any valid - value recoveries for any inline arguments, if the optimization elides all argument - flushes, while at the same time optimizing away arguments creation. Then OSR exit - would try to recover the arguments using the inline call frame, which had bogus - information, and humorous crashes would ensue. This patch fixes this issue by moving - arguments reification to after call frame reification, so that arguments reification - can always use operationCreateArguments instead of operationCreateInlinedArguments. - - - This patch may turn a Flush into a Phantom. That's kind of the whole point. But that - broke forward speculation checks, which knew to look for a Flush prior to a SetLocal - but didn't know that there could alternatively be a Phantom in place of the Flush. - This patch fixes that by augmenting the forward speculation check logic. - - - Finally, in the process of having fun with all of the above, I realized that my DFG - validation was not actually running on every phase like I had originally designed it - to. In fact it was only running just after bytecode parsing. I initially tried to - make it run in every phase but found that this causes some tests to timeout - (specifically the evil fuzzing ones), so I decided on a compromise where: (i) in - release mode validation never runs, (ii) in debug mode validation will run just - after parsing and just before the backend, and (iii) it's possible with a simple - switch to enable validation to run on every phase. - - Luckily all of the above issues were already covered by the 77 or so DFG-specific - layout tests. Hence, this patch does not introduce any new tests despite being so - meaty. + Reviewed by Gavin Barraclough. + + This patch removes lexical analysis from the bytecode generation. This allows + us to delay lookup of a non-local variables until the lookup is actually necessary, + and simplifies a lot of the resolve logic in BytecodeGenerator. + + Once a lookup is performed we cache the lookup information in a set of out-of-line + buffers in CodeBlock. This allows subsequent lookups to avoid unnecessary hashing, + etc, and allows the respective JITs to recreated optimal lookup code. + + This is currently still a performance regression in LLInt, but most of the remaining + regression is caused by a lot of indirection that I'll remove in future work, as well + as some work necessary to allow LLInt to perform in line instruction repatching. + We will also want to improve the behaviour of the baseline JIT for some of the lookup + operations, however this patch was getting quite large already so I'm landing it now + that we've reached the bar of "performance-neutral". + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::printStructures): + (JSC::CodeBlock::dump): + (JSC::CodeBlock::CodeBlock): + (JSC::CodeBlock::visitStructures): + (JSC): + (JSC::CodeBlock::finalizeUnconditionally): + (JSC::CodeBlock::shrinkToFit): + * bytecode/CodeBlock.h: + (JSC::CodeBlock::addResolve): + (JSC::CodeBlock::addPutToBase): + (CodeBlock): + (JSC::CodeBlock::resolveOperations): + (JSC::CodeBlock::putToBaseOperation): + (JSC::CodeBlock::numberOfResolveOperations): + (JSC::CodeBlock::numberOfPutToBaseOperations): + (JSC::CodeBlock::addPropertyAccessInstruction): + (JSC::CodeBlock::globalObjectConstant): + (JSC::CodeBlock::setGlobalObjectConstant): + * bytecode/GlobalResolveInfo.h: Removed. + * bytecode/Opcode.h: + (JSC): + (JSC::padOpcodeName): + * bytecode/ResolveGlobalStatus.cpp: + (JSC::computeForStructure): + (JSC::ResolveGlobalStatus::computeFor): + * bytecode/ResolveGlobalStatus.h: + (JSC): + (ResolveGlobalStatus): + * bytecode/ResolveOperation.h: Added. + The new types and logic we use to perform the cached lookups. + (JSC): + (ResolveOperation): + (JSC::ResolveOperation::getAndReturnScopedVar): + (JSC::ResolveOperation::checkForDynamicEntriesBeforeGlobalScope): + (JSC::ResolveOperation::getAndReturnGlobalVar): + (JSC::ResolveOperation::getAndReturnGlobalProperty): + (JSC::ResolveOperation::resolveFail): + (JSC::ResolveOperation::skipTopScopeNode): + (JSC::ResolveOperation::skipScopes): + (JSC::ResolveOperation::returnGlobalObjectAsBase): + (JSC::ResolveOperation::setBaseToGlobal): + (JSC::ResolveOperation::setBaseToUndefined): + (JSC::ResolveOperation::setBaseToScope): + (JSC::ResolveOperation::returnScopeAsBase): + (JSC::PutToBaseOperation::PutToBaseOperation): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::ResolveResult::checkValidity): + (JSC): + (JSC::BytecodeGenerator::BytecodeGenerator): + (JSC::BytecodeGenerator::resolve): + (JSC::BytecodeGenerator::resolveConstDecl): + (JSC::BytecodeGenerator::shouldAvoidResolveGlobal): + (JSC::BytecodeGenerator::emitResolve): + (JSC::BytecodeGenerator::emitResolveBase): + (JSC::BytecodeGenerator::emitResolveBaseForPut): + (JSC::BytecodeGenerator::emitResolveWithBaseForPut): + (JSC::BytecodeGenerator::emitResolveWithThis): + (JSC::BytecodeGenerator::emitGetLocalVar): + (JSC::BytecodeGenerator::emitInitGlobalConst): + (JSC::BytecodeGenerator::emitPutToBase): + * bytecompiler/BytecodeGenerator.h: + (JSC::ResolveResult::registerResolve): + (JSC::ResolveResult::dynamicResolve): + (ResolveResult): + (JSC::ResolveResult::ResolveResult): + (JSC): + (NonlocalResolveInfo): + (JSC::NonlocalResolveInfo::NonlocalResolveInfo): + (JSC::NonlocalResolveInfo::~NonlocalResolveInfo): + (JSC::NonlocalResolveInfo::resolved): + (JSC::NonlocalResolveInfo::put): + (BytecodeGenerator): + (JSC::BytecodeGenerator::getResolveOperations): + (JSC::BytecodeGenerator::getResolveWithThisOperations): + (JSC::BytecodeGenerator::getResolveBaseOperations): + (JSC::BytecodeGenerator::getResolveBaseForPutOperations): + (JSC::BytecodeGenerator::getResolveWithBaseForPutOperations): + (JSC::BytecodeGenerator::getPutToBaseOperation): + * bytecompiler/NodesCodegen.cpp: + (JSC::ResolveNode::isPure): + (JSC::FunctionCallResolveNode::emitBytecode): + (JSC::PostfixNode::emitResolve): + (JSC::PrefixNode::emitResolve): + (JSC::ReadModifyResolveNode::emitBytecode): + (JSC::AssignResolveNode::emitBytecode): + (JSC::ConstDeclNode::emitCodeSingle): + (JSC::ForInNode::emitBytecode): * dfg/DFGAbstractState.cpp: (JSC::DFG::AbstractState::execute): - * dfg/DFGArgumentPosition.h: - (JSC::DFG::ArgumentPosition::prediction): - (JSC::DFG::ArgumentPosition::doubleFormatState): - (JSC::DFG::ArgumentPosition::shouldUseDoubleFormat): - (ArgumentPosition): - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::handleInlining): + (ByteCodeParser): + (InlineStackEntry): + (JSC::DFG::ByteCodeParser::handleGetByOffset): + (DFG): + (JSC::DFG::ByteCodeParser::parseResolveOperations): + (JSC::DFG::ByteCodeParser::parseBlock): (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::SetLocalStoreEliminationResult::SetLocalStoreEliminationResult): - (SetLocalStoreEliminationResult): - (JSC::DFG::CSEPhase::setLocalStoreElimination): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGCommon.h: - * dfg/DFGConstantFoldingPhase.cpp: - (JSC::DFG::ConstantFoldingPhase::run): - * dfg/DFGDriver.cpp: - (JSC::DFG::compile): + * dfg/DFGCapabilities.h: + (JSC::DFG::canCompileResolveOperations): + (DFG): + (JSC::DFG::canCompilePutToBaseOperation): + (JSC::DFG::canCompileOpcode): + (JSC::DFG::canInlineOpcode): + * dfg/DFGGraph.h: + (ResolveGlobalData): + (ResolveOperationData): + (DFG): + (PutToBaseOperationData): + (Graph): * dfg/DFGNode.h: + (JSC::DFG::Node::hasIdentifier): + (JSC::DFG::Node::resolveOperationsDataIndex): (Node): - (JSC::DFG::Node::hasArgumentPositionStart): - (JSC::DFG::Node::argumentPositionStart): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGOSRExit.cpp: + (JSC::DFG::OSRExit::OSRExit): + * dfg/DFGOSRExit.h: + (OSRExit): + * dfg/DFGOSRExitCompiler.cpp: * dfg/DFGOSRExitCompiler32_64.cpp: (JSC::DFG::OSRExitCompiler::compileExit): * dfg/DFGOSRExitCompiler64.cpp: (JSC::DFG::OSRExitCompiler::compileExit): - * dfg/DFGPhase.cpp: - (DFG): - * dfg/DFGPhase.h: - (Phase): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGRepatch.cpp: + (JSC::DFG::tryCacheGetByID): * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compile): + (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward): * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck): + (JSC::DFG::SpeculativeJIT::resolveOperations): + (SpeculativeJIT): + (JSC::DFG::SpeculativeJIT::putToBaseOperation): + (JSC::DFG::SpeculativeJIT::callOperation): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + * jit/JIT.cpp: + (JSC::JIT::privateCompileMainPass): + (JSC::JIT::privateCompileSlowCases): + * jit/JIT.h: + (JIT): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_put_to_base): + (JSC): + (JSC::JIT::emit_resolve_operations): + (JSC::JIT::emitSlow_link_resolve_operations): + (JSC::JIT::emit_op_resolve): + (JSC::JIT::emitSlow_op_resolve): + (JSC::JIT::emit_op_resolve_base): + (JSC::JIT::emitSlow_op_resolve_base): + (JSC::JIT::emit_op_resolve_with_base): + (JSC::JIT::emitSlow_op_resolve_with_base): + (JSC::JIT::emit_op_resolve_with_this): + (JSC::JIT::emitSlow_op_resolve_with_this): + (JSC::JIT::emitSlow_op_put_to_base): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_put_to_base): + (JSC): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::emit_op_init_global_const): + (JSC::JIT::emit_op_init_global_const_check): + (JSC::JIT::emitSlow_op_init_global_const_check): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::emit_op_init_global_const): + (JSC::JIT::emit_op_init_global_const_check): + (JSC::JIT::emitSlow_op_init_global_const_check): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + (JSC): + * jit/JITStubs.h: + * llint/LLIntSlowPaths.cpp: + (LLInt): + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * llint/LLIntSlowPaths.h: + (LLInt): + * llint/LowLevelInterpreter.asm: + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/JSScope.cpp: + (JSC::LookupResult::base): + (JSC::LookupResult::value): + (JSC::LookupResult::setBase): + (JSC::LookupResult::setValue): + (LookupResult): + (JSC): + (JSC::setPutPropertyAccessOffset): + (JSC::executeResolveOperations): + (JSC::JSScope::resolveContainingScopeInternal): + (JSC::JSScope::resolveContainingScope): + (JSC::JSScope::resolve): + (JSC::JSScope::resolveBase): + (JSC::JSScope::resolveWithBase): + (JSC::JSScope::resolveWithThis): + (JSC::JSScope::resolvePut): + (JSC::JSScope::resolveGlobal): + * runtime/JSScope.h: + (JSScope): + * runtime/JSVariableObject.cpp: + (JSC): + * runtime/JSVariableObject.h: + (JSVariableObject): + * runtime/Structure.h: + (JSC::Structure::propertyAccessesAreCacheable): + (Structure): -2012-06-02 Geoffrey Garen - - DOM string cache should hash pointers, not characters - https://bugs.webkit.org/show_bug.cgi?id=88175 - - Reviewed by Phil Pizlo and Sam Weinig. - - * heap/Weak.h: - (JSC::weakAdd): - (JSC::weakRemove): Made these function templates slightly more generic - to accommodate new client types. - -2012-06-01 Filip Pizlo - - DFG CFA should know that PutByVal can clobber the world - https://bugs.webkit.org/show_bug.cgi?id=88155 - - Reviewed by Gavin Barraclough. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - -2012-06-01 Filip Pizlo - - DFG CFA should mark basic blocks as having constants if local accesses yield constants - https://bugs.webkit.org/show_bug.cgi?id=88153 - - Reviewed by Gavin Barraclough. - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - -2012-06-01 Filip Pizlo - - DFG arguments simplification phase uses a node.codeOrigin after appending a node - https://bugs.webkit.org/show_bug.cgi?id=88151 - - Reviewed by Geoffrey Garen. - - The right thing to do is to save the CodeOrigin before appending to the graph. - - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - -2012-06-01 Filip Pizlo - - DFG should not emit unnecessary speculation checks when performing an int32 to double conversion on - a value that is proved to be a number, predicted to be an int32, but not proved to be an int32 - https://bugs.webkit.org/show_bug.cgi?id=88146 - - Reviewed by Gavin Barraclough. - - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compileInt32ToDouble): - -2012-06-01 Filip Pizlo +2012-10-16 Filip Pizlo - DFG constant folding search for the last local access skips the immediately previous local access - https://bugs.webkit.org/show_bug.cgi?id=88141 + Accidental switch fall-through in DFG::FixupPhase + https://bugs.webkit.org/show_bug.cgi?id=96956 + - Reviewed by Michael Saboff. - - If you use a loop in the style of: + Reviewed by Mark Hahnenberg. - for (i = start; i--;) + * dfg/DFGFixupPhase.cpp: + (JSC::DFG::FixupPhase::fixupNode): - then you need to remember that the first value of 'i' that the loop body will see is 'start - 1'. - Hence the following is probably wrong: - - for (i = start - 1; i--;) +2012-10-16 Filip Pizlo - * dfg/DFGConstantFoldingPhase.cpp: - (JSC::DFG::ConstantFoldingPhase::run): + GetScopedVar CSE matches dead GetScopedVar's leading to IR corruption + https://bugs.webkit.org/show_bug.cgi?id=99470 + -2012-06-01 Filip Pizlo + Reviewed by Mark Hahnenberg. - DFG constant folding should be OK with GetLocal of captured variables having a constant - https://bugs.webkit.org/show_bug.cgi?id=88137 + All it takes is to follow the "if (!shouldGenerate) continue" idiom and everything will be OK. - Reviewed by Gavin Barraclough. + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::globalVarLoadElimination): + (JSC::DFG::CSEPhase::scopedVarLoadElimination): + (JSC::DFG::CSEPhase::globalVarWatchpointElimination): + (JSC::DFG::CSEPhase::getByValLoadElimination): + (JSC::DFG::CSEPhase::checkStructureElimination): + (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination): + (JSC::DFG::CSEPhase::getByOffsetLoadElimination): - * dfg/DFGConstantFoldingPhase.cpp: - (JSC::DFG::ConstantFoldingPhase::run): +2012-10-16 Dima Gorbik -2012-05-31 Mark Hahnenberg + Remove Platform.h include from the header files. + https://bugs.webkit.org/show_bug.cgi?id=98665 - JSGlobalObject does not mark m_privateNameStructure - https://bugs.webkit.org/show_bug.cgi?id=88023 + Reviewed by Eric Seidel. - Rubber stamped by Gavin Barraclough. + We don't want other clients that include WebKit headers to know about Platform.h. - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::visitChildren): We need to mark this so it doesn't get - inadvertently garbage collected. + * API/tests/minidom.c: + * API/tests/testapi.c: -2012-05-31 Erik Arvidsson +2012-10-16 Balazs Kilvady - Make DOM Exceptions Errors - https://bugs.webkit.org/show_bug.cgi?id=85078 + Add missing MIPS functions to assembler. + https://bugs.webkit.org/show_bug.cgi?id=98856 Reviewed by Oliver Hunt. - WebIDL mandates that exceptions should have Error.prototype on its prototype chain. - - For JSC we have access to the Error.prototype from the binding code. - - For V8 we set a field in the WrapperTypeInfo and when the constructor function is created we - set the prototype as needed. - - Updated test: fast/dom/DOMException/prototype-object.html - - * JavaScriptCore.xcodeproj/project.pbxproj: - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::reset): - * runtime/JSGlobalObject.h: - (JSC): - (JSGlobalObject): - (JSC::JSGlobalObject::errorPrototype): - -2012-05-31 Andy Wingo - - Fix reference to unset variable in debug mode - https://bugs.webkit.org/show_bug.cgi?id=87981 - - Reviewed by Geoffrey Garen. - - * runtime/JSONObject.cpp (Stringifier::Holder::Holder): - Initialize m_size in debug mode, as we check it later in an assert. - -2012-05-30 Mark Hahnenberg - - Heap should sweep incrementally - https://bugs.webkit.org/show_bug.cgi?id=85429 + Implement missing functions in MacroAssemblerMIPS and MIPSAssembler. - We shouldn't have to wait for the opportunistic GC timer to fire in order - to call object destructors. Instead, we should incrementally sweep some - subset of the blocks requiring sweeping periodically. We tie this sweeping - to a timer rather than to collections because we want to reclaim this memory - even if we stop allocating. This way, our memory usage scales smoothly with - actual use, regardless of whether we've recently done an opportunistic GC or not. - - Reviewed by Geoffrey Garen. - - * CMakeLists.txt: - * GNUmakefile.list.am: - * JavaScriptCore.gypi: - * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: - * JavaScriptCore.xcodeproj/project.pbxproj: - * Target.pri: - * heap/Heap.cpp: - (JSC::Heap::Heap): - (JSC::Heap::collect): We no longer sweep during a full sweep. We only shrink now, - which we will switch over to being done during incremental sweeping too as soon as - all finalizers can be run lazily (and, by extension, incrementally). - (JSC::Heap::sweeper): - (JSC): - * heap/Heap.h: - (JSC): - (Heap): - * heap/IncrementalSweeper.cpp: Added. - (JSC): - (JSC::IncrementalSweeper::timerDidFire): The IncrementalSweeper works very similarly to - GCActivityCallback. It is tied to a run-loop based timer that fires periodically based - on how long the previous sweep increment took to run. The IncrementalSweeper doesn't do - anything if the platform doesn't support CoreFoundation. - (JSC::IncrementalSweeper::IncrementalSweeper): - (JSC::IncrementalSweeper::~IncrementalSweeper): - (JSC::IncrementalSweeper::create): - (JSC::IncrementalSweeper::scheduleTimer): - (JSC::IncrementalSweeper::cancelTimer): - (JSC::IncrementalSweeper::doSweep): Iterates over the snapshot of the MarkedSpace taken - during the last collection, checking to see which blocks need sweeping. If it successfully - gets to the end of the blocks that need sweeping then it cancels the timer. - (JSC::IncrementalSweeper::startSweeping): We take a snapshot of the Heap and store it in - a Vector that the incremental sweep will iterate over. We also reset our index into this Vector. - * heap/IncrementalSweeper.h: Added. - (JSC): - (IncrementalSweeper): - * heap/MarkedBlock.h: - (JSC::MarkedBlock::needsSweeping): If a block is in the Marked state it needs sweeping - to be usable and to run any destructors that need to be run. + * assembler/MIPSAssembler.h: + (JSC::MIPSAssembler::lb): + (MIPSAssembler): + (JSC::MIPSAssembler::lh): + (JSC::MIPSAssembler::cvtds): + (JSC::MIPSAssembler::cvtsd): + (JSC::MIPSAssembler::vmov): + * assembler/MacroAssemblerMIPS.h: + (MacroAssemblerMIPS): + (JSC::MacroAssemblerMIPS::load8Signed): + (JSC::MacroAssemblerMIPS::load16Signed): + (JSC::MacroAssemblerMIPS::moveDoubleToInts): + (JSC::MacroAssemblerMIPS::moveIntsToDouble): + (JSC::MacroAssemblerMIPS::loadFloat): + (JSC::MacroAssemblerMIPS::loadDouble): + (JSC::MacroAssemblerMIPS::storeFloat): + (JSC::MacroAssemblerMIPS::storeDouble): + (JSC::MacroAssemblerMIPS::addDouble): + (JSC::MacroAssemblerMIPS::convertFloatToDouble): + (JSC::MacroAssemblerMIPS::convertDoubleToFloat): -2012-05-30 Patrick Gansterer +2012-10-16 Balazs Kilvady - [WINCE] Fix JSString after r115516. - https://bugs.webkit.org/show_bug.cgi?id=87892 + MIPS assembler coding-style fix. + https://bugs.webkit.org/show_bug.cgi?id=99359 - Reviewed by Geoffrey Garen. + Reviewed by Oliver Hunt. - r115516 splitted JSString into two classes, with addition nested classes. - Add a workaround for the WinCE compiler since it can't resolve the friend class - declerations corretly and denies the access to protected members of JSString. + Coding style fix of existing MIPS assembler header files. - * runtime/JSString.h: - (JSC::JSRopeString::RopeBuilder::append): - (JSC::JSRopeString::append): - (JSRopeString): + * assembler/MIPSAssembler.h: + (JSC::MIPSAssembler::addiu): + (JSC::MIPSAssembler::addu): + (JSC::MIPSAssembler::subu): + (JSC::MIPSAssembler::mul): + (JSC::MIPSAssembler::andInsn): + (JSC::MIPSAssembler::andi): + (JSC::MIPSAssembler::nor): + (JSC::MIPSAssembler::orInsn): + (JSC::MIPSAssembler::ori): + (JSC::MIPSAssembler::xorInsn): + (JSC::MIPSAssembler::xori): + (JSC::MIPSAssembler::slt): + (JSC::MIPSAssembler::sltu): + (JSC::MIPSAssembler::sltiu): + (JSC::MIPSAssembler::sll): + (JSC::MIPSAssembler::sllv): + (JSC::MIPSAssembler::sra): + (JSC::MIPSAssembler::srav): + (JSC::MIPSAssembler::srl): + (JSC::MIPSAssembler::srlv): + (JSC::MIPSAssembler::lbu): + (JSC::MIPSAssembler::lw): + (JSC::MIPSAssembler::lwl): + (JSC::MIPSAssembler::lwr): + (JSC::MIPSAssembler::lhu): + (JSC::MIPSAssembler::sb): + (JSC::MIPSAssembler::sh): + (JSC::MIPSAssembler::sw): + (JSC::MIPSAssembler::addd): + (JSC::MIPSAssembler::subd): + (JSC::MIPSAssembler::muld): + (JSC::MIPSAssembler::divd): + (JSC::MIPSAssembler::lwc1): + (JSC::MIPSAssembler::ldc1): + (JSC::MIPSAssembler::swc1): + (JSC::MIPSAssembler::sdc1): + (MIPSAssembler): + (JSC::MIPSAssembler::relocateJumps): + (JSC::MIPSAssembler::linkWithOffset): + * assembler/MacroAssemblerMIPS.h: + (JSC::MacroAssemblerMIPS::add32): + (JSC::MacroAssemblerMIPS::and32): + (JSC::MacroAssemblerMIPS::sub32): + (MacroAssemblerMIPS): + (JSC::MacroAssemblerMIPS::load8): + (JSC::MacroAssemblerMIPS::load32): + (JSC::MacroAssemblerMIPS::load32WithUnalignedHalfWords): + (JSC::MacroAssemblerMIPS::load16): + (JSC::MacroAssemblerMIPS::store8): + (JSC::MacroAssemblerMIPS::store16): + (JSC::MacroAssemblerMIPS::store32): + (JSC::MacroAssemblerMIPS::nearCall): + (JSC::MacroAssemblerMIPS::test8): + (JSC::MacroAssemblerMIPS::test32): + +2012-10-16 Yuqiang Xian + + Refactor MacroAssembler interfaces to differentiate the pointer operands from the 64-bit integer operands + https://bugs.webkit.org/show_bug.cgi?id=99154 -2012-05-30 Oliver Hunt + Reviewed by Gavin Barraclough. - Really provide error information with the inspector disabled - https://bugs.webkit.org/show_bug.cgi?id=87910 + In current JavaScriptCore implementation for JSVALUE64 platform (i.e., + the X64 platform), we assume that the JSValue size is same to the + pointer size, and thus EncodedJSValue is simply type defined as a + "void*". In the JIT compiler, we also take this assumption and invoke + the same macro assembler interfaces for both JSValue and pointer + operands. We need to differentiate the operations on pointers from the + operations on JSValues, and let them invoking different macro + assembler interfaces. For example, we now use the interface of + "loadPtr" to load either a pointer or a JSValue, and we need to switch + to using "loadPtr" to load a pointer and some new "load64" interface + to load a JSValue. This would help us supporting other JSVALUE64 + platforms where pointer size is not necessarily 64-bits, for example + x32 (bug #99153). + + The major modification I made is to introduce the "*64" interfaces in + the MacroAssembler for those operations on JSValues, keep the "*Ptr" + interfaces for those operations on real pointers, and go through all + the JIT compiler code to correct the usage. + + This is the first part of the work, i.e, to add the *64 interfaces to + the MacroAssembler. + + * assembler/AbstractMacroAssembler.h: Add the Imm64 interfaces. + (AbstractMacroAssembler): + (JSC::AbstractMacroAssembler::TrustedImm64::TrustedImm64): + (TrustedImm64): + (JSC::AbstractMacroAssembler::Imm64::Imm64): + (Imm64): + (JSC::AbstractMacroAssembler::Imm64::asTrustedImm64): + * assembler/MacroAssembler.h: map Ptr methods to 64 for X86_64. + (MacroAssembler): + (JSC::MacroAssembler::peek64): + (JSC::MacroAssembler::poke): + (JSC::MacroAssembler::poke64): + (JSC::MacroAssembler::addPtr): + (JSC::MacroAssembler::andPtr): + (JSC::MacroAssembler::negPtr): + (JSC::MacroAssembler::orPtr): + (JSC::MacroAssembler::rotateRightPtr): + (JSC::MacroAssembler::subPtr): + (JSC::MacroAssembler::xorPtr): + (JSC::MacroAssembler::loadPtr): + (JSC::MacroAssembler::loadPtrWithAddressOffsetPatch): + (JSC::MacroAssembler::loadPtrWithCompactAddressOffsetPatch): + (JSC::MacroAssembler::storePtr): + (JSC::MacroAssembler::storePtrWithAddressOffsetPatch): + (JSC::MacroAssembler::movePtrToDouble): + (JSC::MacroAssembler::moveDoubleToPtr): + (JSC::MacroAssembler::comparePtr): + (JSC::MacroAssembler::testPtr): + (JSC::MacroAssembler::branchPtr): + (JSC::MacroAssembler::branchTestPtr): + (JSC::MacroAssembler::branchAddPtr): + (JSC::MacroAssembler::branchSubPtr): + (JSC::MacroAssembler::shouldBlindDouble): + (JSC::MacroAssembler::shouldBlind): + (JSC::MacroAssembler::RotatedImm64::RotatedImm64): + (RotatedImm64): + (JSC::MacroAssembler::rotationBlindConstant): + (JSC::MacroAssembler::loadRotationBlindedConstant): + (JSC::MacroAssembler::move): + (JSC::MacroAssembler::and64): + (JSC::MacroAssembler::store64): + * assembler/MacroAssemblerX86Common.h: + (JSC::MacroAssemblerX86Common::shouldBlindForSpecificArch): + (MacroAssemblerX86Common): + (JSC::MacroAssemblerX86Common::move): + * assembler/MacroAssemblerX86_64.h: Add the 64 methods for X86_64. + (JSC::MacroAssemblerX86_64::branchAdd32): + (JSC::MacroAssemblerX86_64::add64): + (MacroAssemblerX86_64): + (JSC::MacroAssemblerX86_64::and64): + (JSC::MacroAssemblerX86_64::neg64): + (JSC::MacroAssemblerX86_64::or64): + (JSC::MacroAssemblerX86_64::rotateRight64): + (JSC::MacroAssemblerX86_64::sub64): + (JSC::MacroAssemblerX86_64::xor64): + (JSC::MacroAssemblerX86_64::load64): + (JSC::MacroAssemblerX86_64::load64WithAddressOffsetPatch): + (JSC::MacroAssemblerX86_64::load64WithCompactAddressOffsetPatch): + (JSC::MacroAssemblerX86_64::store64): + (JSC::MacroAssemblerX86_64::store64WithAddressOffsetPatch): + (JSC::MacroAssemblerX86_64::move64ToDouble): + (JSC::MacroAssemblerX86_64::moveDoubleTo64): + (JSC::MacroAssemblerX86_64::compare64): + (JSC::MacroAssemblerX86_64::branch64): + (JSC::MacroAssemblerX86_64::branchTest64): + (JSC::MacroAssemblerX86_64::test64): + (JSC::MacroAssemblerX86_64::branchAdd64): + (JSC::MacroAssemblerX86_64::branchSub64): + (JSC::MacroAssemblerX86_64::branchPtrWithPatch): + (JSC::MacroAssemblerX86_64::storePtrWithPatch): + +2012-10-15 Mark Hahnenberg + + Make CopiedSpace and MarkedSpace regions independent + https://bugs.webkit.org/show_bug.cgi?id=99222 Reviewed by Filip Pizlo. - Don't bother checking for anything other than pre-existing error info. - In the absence of complete line number information you'll only get the - line a function starts on, but at least it's something. - - * interpreter/Interpreter.cpp: - (JSC::Interpreter::throwException): - -2012-05-30 Filip Pizlo - - LLInt broken on x86-32 with JIT turned off - https://bugs.webkit.org/show_bug.cgi?id=87906 + Right now CopiedSpace and MarkedSpace have the same block size and share the same regions, + but there's no reason that they can't have different block sizes while still sharing the + same underlying regions. We should factor the two "used" lists of regions apart so that + MarkedBlocks and CopiedBlocks can be different sizes. Regions will still be a uniform size + so that when they become empty they may be shared between the CopiedSpace and the MarkedSpace, + since benchmarks indicate that sharing is a boon for performance. - Reviewed by Geoffrey Garen. - - Fixed the code to not clobber registers that contain important things, like the call frame. + * heap/BlockAllocator.cpp: + (JSC::BlockAllocator::BlockAllocator): + * heap/BlockAllocator.h: + (JSC): + (Region): + (JSC::Region::create): We now have a fixed size for Regions so that empty regions can continue to + be shared between the MarkedSpace and CopiedSpace. Once they are used for a specific type of block, + however, they can only be used for that type of block until they become empty again. + (JSC::Region::createCustomSize): + (JSC::Region::Region): + (JSC::Region::~Region): + (JSC::Region::reset): + (BlockAllocator): + (JSC::BlockAllocator::RegionSet::RegionSet): + (RegionSet): + (JSC::BlockAllocator::tryAllocateFromRegion): We change this function so that it correctly + moves blocks between empty, partial, and full lists. + (JSC::BlockAllocator::allocate): + (JSC::BlockAllocator::allocateCustomSize): + (JSC::BlockAllocator::deallocate): Ditto. + (JSC::CopiedBlock): + (JSC::MarkedBlock): + (JSC::BlockAllocator::regionSetFor): We use this so that we can use the same allocate/deallocate + functions with different RegionSets. We specialize the function for each type of block that we + want to allocate. + * heap/CopiedBlock.h: + (CopiedBlock): + * heap/CopiedSpace.h: + (CopiedSpace): + * heap/HeapBlock.h: + (HeapBlock): + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::MarkedBlock): For oversize MarkedBlocks, if the block size gets too big we can + underflow the endAtom, which will cause us to segfault when we try to sweep a block. If we're a + custom size MarkedBlock we need to calculate endAtom so it doesn't underflow. - * llint/LowLevelInterpreter32_64.asm: +2012-10-14 Filip Pizlo -2012-05-30 Filip Pizlo + JIT::JIT fails to initialize all of its fields + https://bugs.webkit.org/show_bug.cgi?id=99283 - ScriptDebugServer wants sourceIDs that are non-zero because that's what HashMaps want, so JSC should placate it - https://bugs.webkit.org/show_bug.cgi?id=87887 + Reviewed by Andreas Kling. - Reviewed by Darin Adler. + There were two groups of such fields, all of which are eventually initialized + prior to use inside of privateCompile(). But it's safer to make sure that they + are initialized in the constructor as well, since we may use the JIT to do a + stub compile without calling into privateCompile(). + + Unsigned index fields for dynamic repatching meta-data: this change + initializes them to UINT_MAX, so we should crash if we try to use those + indices without initializing them. - Better fix - we now never call SourceProvider::asID() if SourceProvider* is 0. + Boolean flags for value profiling: this change initializes them to false, so + we at worst turn off value profiling. - * parser/Nodes.h: - (JSC::ScopeNode::sourceID): - * parser/SourceCode.h: - (JSC::SourceCode::providerID): - (SourceCode): - * parser/SourceProvider.h: - (SourceProvider): - (JSC::SourceProvider::asID): - * runtime/Executable.h: - (JSC::ScriptExecutable::sourceID): + * jit/JIT.cpp: + (JSC::JIT::JIT): -2012-05-30 Filip Pizlo +2012-10-15 Mark Hahnenberg - ScriptDebugServer wants sourceIDs that are non-zero because that's what HashMaps want, so JSC should placate it - https://bugs.webkit.org/show_bug.cgi?id=87887 + We should avoid weakCompareAndSwap when parallel GC is disabled + https://bugs.webkit.org/show_bug.cgi?id=99331 - Reviewed by Geoffrey Garen. + Reviewed by Filip Pizlo. - * parser/SourceProvider.h: - (JSC::SourceProvider::asID): + CopiedBlock::reportLiveBytes and didEvacuateBytes uses weakCompareAndSwap, which some platforms + don't support. For platforms that don't have parallel GC enabled, we should just use a normal store. -2012-05-30 Oliver Hunt + * heap/CopiedBlock.h: + (JSC::CopiedBlock::reportLiveBytes): + (JSC::CopiedBlock::didEvacuateBytes): - DFG does not correctly handle exceptions caught in the LLInt - https://bugs.webkit.org/show_bug.cgi?id=87885 +2012-10-15 Carlos Garcia Campos - Reviewed by Filip Pizlo. + Unreviewed. Fix make distcheck. - Make the DFG use genericThrow, rather than reimplementing a small portion of it. - Also make the LLInt slow paths validate that their PC is correct. + * GNUmakefile.list.am: Add missing header file. - * dfg/DFGOperations.cpp: - * llint/LLIntSlowPaths.cpp: - (LLInt): +2012-10-14 Filip Pizlo -2012-05-29 Filip Pizlo + DFG should handle polymorphic array modes by eagerly transforming arrays into the most general applicable form + https://bugs.webkit.org/show_bug.cgi?id=99269 - DFG CFA should infer types and values of captured variables - https://bugs.webkit.org/show_bug.cgi?id=87813 + Reviewed by Geoffrey Garen. - Reviewed by Gavin Barraclough. - - Slight speed-up in V8/earley-boyer (~1%). + This kills off a bunch of code for "polymorphic" array modes in the DFG. It should + also be a performance win for code that uses a lot of array storage arrays. - * bytecode/CodeBlock.h: - (JSC::CodeBlock::argumentsAreCaptured): - (JSC::CodeBlock::argumentIsCaptured): - (CodeBlock): * dfg/DFGAbstractState.cpp: - (DFG): - (JSC::DFG::AbstractState::beginBasicBlock): - (JSC::DFG::AbstractState::initialize): - (JSC::DFG::AbstractState::endBasicBlock): (JSC::DFG::AbstractState::execute): - (JSC::DFG::AbstractState::clobberWorld): - (JSC::DFG::AbstractState::clobberStructures): - (JSC::DFG::AbstractState::mergeStateAtTail): - (JSC::DFG::AbstractState::merge): - (JSC::DFG::AbstractState::mergeToSuccessors): - * dfg/DFGAbstractState.h: - (JSC::DFG::AbstractState::variables): - (AbstractState): + * dfg/DFGArrayMode.cpp: + (JSC::DFG::fromObserved): + (JSC::DFG::modeAlreadyChecked): + (JSC::DFG::modeToString): + * dfg/DFGArrayMode.h: + (DFG): + (JSC::DFG::modeUsesButterfly): + (JSC::DFG::modeIsJSArray): + (JSC::DFG::mayStoreToTail): + (JSC::DFG::mayStoreToHole): + (JSC::DFG::canCSEStorage): + (JSC::DFG::modeSupportsLength): + (JSC::DFG::benefitsFromStructureCheck): + * dfg/DFGFixupPhase.cpp: + (JSC::DFG::FixupPhase::checkArray): + (JSC::DFG::FixupPhase::blessArrayOperation): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::byValIsPure): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode): + (JSC::DFG::SpeculativeJIT::checkArray): + (JSC::DFG::SpeculativeJIT::arrayify): + (DFG): + (JSC::DFG::SpeculativeJIT::compileGetArrayLength): + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::putByValWillNeedExtraRegister): + (SpeculativeJIT): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): -2012-05-30 Patrick Gansterer - - Unreviewed. Build fix for !ENABLE(JIT) after r117823. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - -2012-05-30 Sheriff Bot - - Unreviewed, rolling out r118868. - http://trac.webkit.org/changeset/118868 - https://bugs.webkit.org/show_bug.cgi?id=87828 +2012-10-14 Filip Pizlo - introduced ~20 crashes on Mac and Qt bots (Requested by pizlo_ - on #webkit). - - * heap/Heap.cpp: - (JSC::Heap::collect): - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::sweep): - * heap/MarkedBlock.h: - (JSC::MarkedBlock::sweepWeakSet): - (JSC): - * heap/MarkedSpace.cpp: - (JSC::SweepWeakSet::operator()): - (JSC): - (JSC::MarkedSpace::sweepWeakSets): - * heap/MarkedSpace.h: - (MarkedSpace): + REGRESSION(126886): Fat binary builds don't know how to handle architecture variants to which the LLInt is agnostic + https://bugs.webkit.org/show_bug.cgi?id=99270 -2012-05-29 Geoffrey Garen + Reviewed by Geoffrey Garen. - Rolled back in r118646, now that - https://bugs.webkit.org/show_bug.cgi?id=87784 is fixed. + The fix is to hash cons the offsets based on configuration index, not the offsets + themselves. - http://trac.webkit.org/changeset/118646 - https://bugs.webkit.org/show_bug.cgi?id=87599 + * offlineasm/offsets.rb: - * heap/Heap.cpp: - (JSC::Heap::collect): - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::sweep): - * heap/MarkedBlock.h: - (JSC): - * heap/MarkedSpace.cpp: - (JSC): - * heap/MarkedSpace.h: - (MarkedSpace): +2012-10-13 Filip Pizlo -2012-05-29 Filip Pizlo + IndexingType should not have a bit for each type + https://bugs.webkit.org/show_bug.cgi?id=98997 - DFG should keep captured variables alive until the (inline) return. - https://bugs.webkit.org/show_bug.cgi?id=87205 + Reviewed by Oliver Hunt. - Reviewed by Gavin Barraclough. + Somewhat incidentally, the introduction of butterflies led to each indexing + type being represented by a unique bit. This is superficially nice since it + allows you to test if a structure corresponds to a particular indexing type + by saying !!(structure->indexingType() & TheType). But the downside is that + given the 8 bits we have for the m_indexingType field, that leaves only a + small number of possible indexing types if we have one per bit. + + This changeset changes the indexing type to be: - Changes the way we do flushing for captured variables and arguments. Instead of flushing - each SetLocal immediately, we flush at kill points. So a SetLocal will cause a Flush of - whatever was live in the variable previously, and a return will cause a Flush of all - captured variables and all arguments. + Bit #1: Tells you if you're an array. + + Bits #2 - #5: 16 possible indexing types, including the blank type for + objects that don't have indexed properties. + + Bits #6-8: Auxiliary bits that we could use for other things. Currently we + just use one of those bits, for MayHaveIndexedAccessors. + + This is performance-neutral, and is primarily intended to give us more + breathing room for introducing new inferred array modes. - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::setDirect): - (JSC::DFG::ByteCodeParser::set): - (JSC::DFG::ByteCodeParser::setLocal): - (JSC::DFG::ByteCodeParser::getArgument): - (JSC::DFG::ByteCodeParser::setArgument): - (JSC::DFG::ByteCodeParser::findArgumentPositionForArgument): - (ByteCodeParser): - (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal): - (JSC::DFG::ByteCodeParser::findArgumentPosition): - (JSC::DFG::ByteCodeParser::flush): - (JSC::DFG::ByteCodeParser::flushDirect): - (JSC::DFG::ByteCodeParser::flushArgumentsAndCapturedVariables): - (JSC::DFG::ByteCodeParser::handleInlining): - (JSC::DFG::ByteCodeParser::parseBlock): - (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::setLocalStoreElimination): - (JSC::DFG::CSEPhase::performNodeCSE): + * assembler/AbstractMacroAssembler.h: + (JSC::AbstractMacroAssembler::JumpList::jumps): + * assembler/MacroAssembler.h: + (MacroAssembler): + (JSC::MacroAssembler::patchableBranch32): + * assembler/MacroAssemblerARMv7.h: + (JSC::MacroAssemblerARMv7::patchableBranch32): + (MacroAssemblerARMv7): + * dfg/DFGArrayMode.cpp: + (JSC::DFG::modeAlreadyChecked): + * dfg/DFGRepatch.cpp: + (JSC::DFG::tryCacheGetByID): * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::speculationCheck): (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck): - -2012-05-29 Geoffrey Garen - - WeakGCMap should be lazy-finalization-safe - https://bugs.webkit.org/show_bug.cgi?id=87784 - - Reviewed by Darin Adler. - - * runtime/WeakGCMap.h: - (JSC::WeakGCMap::get): Since this is a map of raw WeakImpl pointers, and - not Weak, we need to verify manually that the WeakImpl is live before - we return its payload. - -2012-05-29 Mark Hahnenberg - - CopiedSpace::doneCopying could start another collection - https://bugs.webkit.org/show_bug.cgi?id=86538 - - Reviewed by Geoffrey Garen. - - It's possible that if we don't have anything at the head of to-space - after a collection and the BlockAllocator doesn't have any fresh blocks - to give us right now we could start another collection while still in - the middle of the first collection when we call CopiedSpace::addNewBlock(). - - One way to resolve this would be to have Heap::shouldCollect() check that - m_operationInProgress is NoOperation. This would prevent the path in - getFreshBlock() that starts the collection if we're already in the middle of one. - - I could not come up with a test case to reproduce this crash on ToT. - - * heap/Heap.h: - (JSC::Heap::shouldCollect): We shouldn't collect if we're already in the middle - of a collection, i.e. the current operation should be NoOperation. - -2012-05-29 David Barr - - Introduce ENABLE_CSS_IMAGE_RESOLUTION compile flag - https://bugs.webkit.org/show_bug.cgi?id=87685 - - Reviewed by Eric Seidel. - - Add a configuration option for CSS image-resolution support, disabling it by default. - - * Configurations/FeatureDefines.xcconfig: - -2012-05-28 Sheriff Bot - - Unreviewed, rolling out r118646. - http://trac.webkit.org/changeset/118646 - https://bugs.webkit.org/show_bug.cgi?id=87691 - - broke V8 raytrace benchmark (Requested by pizlo_ on #webkit). - - * heap/Heap.cpp: - (JSC::Heap::collect): - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::sweep): - * heap/MarkedBlock.h: - (JSC::MarkedBlock::sweepWeakSet): + (JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode): + (DFG): + (JSC::DFG::SpeculativeJIT::checkArray): + (JSC::DFG::SpeculativeJIT::arrayify): + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateJSArray): + (JSC::JIT::chooseArrayMode): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::emit_op_get_by_val): + (JSC::JIT::emitContiguousGetByVal): + (JSC::JIT::emitArrayStorageGetByVal): + (JSC::JIT::emit_op_put_by_val): + (JSC::JIT::emitContiguousPutByVal): + (JSC::JIT::emitArrayStoragePutByVal): + (JSC::JIT::privateCompilePatchGetArrayLength): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::emit_op_get_by_val): + (JSC::JIT::emitContiguousGetByVal): + (JSC::JIT::emitArrayStorageGetByVal): + (JSC::JIT::emit_op_put_by_val): + (JSC::JIT::emitContiguousPutByVal): + (JSC::JIT::emitArrayStoragePutByVal): + (JSC::JIT::privateCompilePatchGetArrayLength): + * llint/LowLevelInterpreter.asm: + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/IndexingType.h: (JSC): - * heap/MarkedSpace.cpp: - (JSC::SweepWeakSet::operator()): + (JSC::hasIndexedProperties): + (JSC::hasContiguous): + (JSC::hasFastArrayStorage): + (JSC::hasArrayStorage): + (JSC::shouldUseSlowPut): + * runtime/JSGlobalObject.cpp: (JSC): - (JSC::MarkedSpace::sweepWeakSets): - * heap/MarkedSpace.h: - (MarkedSpace): + * runtime/StructureTransitionTable.h: + (JSC::newIndexingType): -2012-05-28 Filip Pizlo +2012-10-14 Filip Pizlo - DFG should not generate code for code that the CFA proves to be unreachable - https://bugs.webkit.org/show_bug.cgi?id=87682 + DFG structure check hoisting should attempt to ignore side effects and make transformations that are sound even in their presence + https://bugs.webkit.org/show_bug.cgi?id=99262 - Reviewed by Sam Weinig. - - This also fixes a small performance bug where CFA was not marking blocks - as having constants (and hence not triggering constant folding) if the only - constants were on GetLocals. + Reviewed by Oliver Hunt. + + This hugely simplifies the structure check hoisting phase. It will no longer be necessary + to modify it when the effectfulness of operations changes. This also enables the hoister + to hoist effectful things in the future. - And fixing that bug revealed another bug: constant folding was assuming that - a GetLocal must be the first access to a local in a basic block. This isn't - true. The first access may be a Flush. This patch fixes that issue using the - safest approach possible, since we don't need to be clever for something that - only happens in one of our benchmarks. + The downside is that the hoister may end up adding strictly more checks than were present + in the original code, if the code truly has a lot of side-effects. I don't see evidence + of this happening. This patch does have some speed-ups and some slow-downs, but is + neutral in the average, and the slow-downs do not appear to have more structure checks + than ToT. - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGConstantFoldingPhase.cpp: - (JSC::DFG::ConstantFoldingPhase::run): - * dfg/DFGJITCompiler.h: - (JSC::DFG::JITCompiler::noticeOSREntry): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck): + (StructureCheckHoistingPhase): + (CheckData): + (JSC::DFG::StructureCheckHoistingPhase::CheckData::CheckData): -2012-05-28 Carlos Garcia Campos +2012-10-14 Filip Pizlo - Unreviewed. Fix make distcheck. + Fix the build of universal binary with ARMv7s of JavaScriptCore - * GNUmakefile.list.am: Add missing header file. + * llint/LLIntOfflineAsmConfig.h: + * llint/LowLevelInterpreter.asm: -2012-05-27 Geoffrey Garen +2012-10-13 Filip Pizlo - Weak pointer finalization should be lazy - https://bugs.webkit.org/show_bug.cgi?id=87599 + Array length array profiling is broken in the baseline JIT + https://bugs.webkit.org/show_bug.cgi?id=99258 - Reviewed by Darin Adler. + Reviewed by Oliver Hunt. - * heap/Heap.cpp: - (JSC::Heap::collect): Don't force immediate finalization -- it will - happen lazily. + The code generator for array length stubs calls into + emitArrayProfilingSiteForBytecodeIndex(), which emits profiling only if + canBeOptimized() returns true. But m_canBeOptimized is only initialized during + full method compiles, so in a stub compile it may (or may not) be false, meaning + that we may, or may not, get meaningful profiling info. + + This appeared to not affect too many programs since the LLInt has good array + length array profiling. - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::sweep): Sweep a block's weak set when sweeping the - block. The weak set may not have been swept yet, and this is our last - chance to run weak finalizers before we recycle the memory they reference. + * jit/JIT.h: + (JSC::JIT::compilePatchGetArrayLength): - * heap/MarkedBlock.h: - * heap/MarkedSpace.cpp: - (JSC::MarkedBlock::sweepWeakSets): - * heap/MarkedSpace.h: - (JSC::MarkedSpace::sweepWeakSets): Nixed sweepWeakSets because it's unused - now. +2012-10-14 Patrick Gansterer -2012-05-26 Geoffrey Garen + Build fix for WinCE after r131089. - WebKit should be lazy-finalization-safe (esp. the DOM) v2 - https://bugs.webkit.org/show_bug.cgi?id=87581 + WinCE does not support getenv(). - Reviewed by Oliver Hunt. + * runtime/Options.cpp: + (JSC::overrideOptionWithHeuristic): - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::callDestructor): - * heap/WeakBlock.h: - * heap/WeakSetInlines.h: - (JSC::WeakBlock::finalize): Since we don't guarantee destruction order, - it's not valid to access GC pointers like the Structure pointer during - finalization. We NULL out the structure pointer in debug builds to try - to make this programming mistake more obvious. - - * API/JSCallbackConstructor.cpp: - (JSC::JSCallbackConstructor::destroy): - * API/JSCallbackObject.cpp: - (JSC::::destroy): - (JSC::JSCallbackObjectData::finalize): - * runtime/Arguments.cpp: - (JSC::Arguments::destroy): - * runtime/DateInstance.cpp: - (JSC::DateInstance::destroy): - * runtime/Error.cpp: - (JSC::StrictModeTypeErrorFunction::destroy): - * runtime/Executable.cpp: - (JSC::ExecutableBase::destroy): - (JSC::NativeExecutable::destroy): - (JSC::ScriptExecutable::destroy): - (JSC::EvalExecutable::destroy): - (JSC::ProgramExecutable::destroy): - (JSC::FunctionExecutable::destroy): - * runtime/JSGlobalObject.cpp: - (JSC::JSGlobalObject::destroy): - * runtime/JSPropertyNameIterator.cpp: - (JSC::JSPropertyNameIterator::destroy): - * runtime/JSStaticScopeObject.cpp: - (JSC::JSStaticScopeObject::destroy): - * runtime/JSString.cpp: - (JSC::JSString::destroy): - * runtime/JSVariableObject.cpp: - (JSC::JSVariableObject::destroy): - * runtime/NameInstance.cpp: - (JSC::NameInstance::destroy): - * runtime/RegExp.cpp: - (JSC::RegExp::destroy): - * runtime/RegExpConstructor.cpp: - (JSC::RegExpConstructor::destroy): - * runtime/Structure.cpp: - (JSC::Structure::destroy): - * runtime/StructureChain.cpp: - (JSC::StructureChain::destroy): Use static_cast instead of jsCast because - jsCast does Structure-based validation, and our Structure is not guaranteed - to be alive when we get finalized. +2012-10-12 Kangil Han -2012-05-22 Filip Pizlo + Fix build error on DFGSpeculativeJIT32_64.cpp + https://bugs.webkit.org/show_bug.cgi?id=99234 - DFG CSE should eliminate redundant WeakJSConstants - https://bugs.webkit.org/show_bug.cgi?id=87179 + Reviewed by Anders Carlsson. - Reviewed by Gavin Barraclough. - - Merged r118141 from dfgopt. + Seems BUG 98608 causes build error on 32bit machine so fix it. - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::weakConstantCSE): - (CSEPhase): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGNode.h: - (JSC::DFG::Node::weakConstant): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): -2012-05-22 Filip Pizlo +2012-10-12 Filip Pizlo - DFG CSE should do redundant store elimination - https://bugs.webkit.org/show_bug.cgi?id=87161 + Contiguous array allocation should always be inlined + https://bugs.webkit.org/show_bug.cgi?id=98608 - Reviewed by Oliver Hunt. - - Merge r118138 from dfgopt. - - This patch adds redundant store elimination. For example, consider this - code: - - o.x = 42; - o.x = 84; - - If o.x is speculated to be a well-behaved field, the first assignment is - unnecessary, since the second just overwrites it. We would like to - eliminate the first assignment in these cases. The need for this - optimization arises mostly from stores that our runtime requires. For - example: - - o = {f:1, g:2, h:3}; - - This will have four assignments to the structure for the newly created - object - one assignment for the empty structure, one for {f}, one for - {f, g}, and one for {f, g, h}. We would like to only have the last of - those assigments in this case. - - Intriguingly, doing so for captured variables breaks the way arguments - simplification used to work. Consider that prior to either arguments - simplification or store elimination we will have IR that looks like: - - a: SetLocal(r0, Empty) - b: SetLocal(r1, Empty) - c: GetLocal(r0) - d: CreateArguments(@c) - e: SetLocal(r0, @d) - f: SetLocal(r1, @d) - - Then redundant store elimination will eliminate the stores that - initialize the arguments registers to Empty, but then arguments - simplification eliminates the stores that initialize the arguments to - the newly created arguments - and at this point we no longer have any - stores to the arguments register, leading to hilarious crashes. This - patch therefore changes arguments simplification to replace - CreateArguments with JSConstant(Empty) rather than eliminating the - SetLocals. But this revealed bugs where arguments simplification was - being overzealous, so I fixed those bugs. - - This is a minor speed-up on V8/early and a handful of other tests. + Reviewed by Oliver Hunt and Mark Hahnenberg. - * bytecode/CodeBlock.h: - (JSC::CodeBlock::uncheckedActivationRegister): + This inlines contiguous array allocation in the most obvious way possible. + + * JavaScriptCore.xcodeproj/project.pbxproj: + * assembler/MacroAssembler.h: + (JSC::MacroAssembler::branchSubPtr): + (MacroAssembler): + * assembler/MacroAssemblerX86_64.h: + (JSC::MacroAssemblerX86_64::branchSubPtr): + (MacroAssemblerX86_64): * dfg/DFGAbstractState.cpp: (JSC::DFG::AbstractState::execute): - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse): - (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses): - (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::globalVarStoreElimination): - (CSEPhase): - (JSC::DFG::CSEPhase::putStructureStoreElimination): - (JSC::DFG::CSEPhase::putByOffsetStoreElimination): - (JSC::DFG::CSEPhase::setLocalStoreElimination): - (JSC::DFG::CSEPhase::setReplacement): - (JSC::DFG::CSEPhase::eliminate): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGGraph.h: - (JSC::DFG::Graph::uncheckedActivationRegisterFor): - (Graph): - * dfg/DFGNode.h: - (JSC::DFG::Node::isPhantomArguments): - (Node): - (JSC::DFG::Node::hasConstant): - (JSC::DFG::Node::valueOfJSConstant): - (JSC::DFG::Node::hasStructureTransitionData): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGCCallHelpers.h: + (JSC::DFG::CCallHelpers::setupArgumentsWithExecState): + (CCallHelpers): + * dfg/DFGCallArrayAllocatorSlowPathGenerator.h: Added. + (DFG): + (CallArrayAllocatorSlowPathGenerator): + (JSC::DFG::CallArrayAllocatorSlowPathGenerator::CallArrayAllocatorSlowPathGenerator): + (JSC::DFG::CallArrayAllocatorSlowPathGenerator::generateInternal): + (CallArrayAllocatorWithVariableSizeSlowPathGenerator): + (JSC::DFG::CallArrayAllocatorWithVariableSizeSlowPathGenerator::CallArrayAllocatorWithVariableSizeSlowPathGenerator): + (JSC::DFG::CallArrayAllocatorWithVariableSizeSlowPathGenerator::generateInternal): * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor): + (JSC::DFG::SpeculativeJIT::emitAllocateJSArray): + (DFG): + (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage): + (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage): + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + (SpeculativeJIT): + (JSC::DFG::SpeculativeJIT::emitAllocateBasicStorage): + (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): + (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): -2012-05-21 Filip Pizlo +2012-10-12 Mark Hahnenberg + + Race condition during CopyingPhase can lead to deadlock + https://bugs.webkit.org/show_bug.cgi?id=99226 + + Reviewed by Filip Pizlo. + + The main thread calls startCopying() for each of the GCThreads at the beginning of the copy phase. + It then proceeds to start copying. If copying completes before one of the GCThreads wakes up, the + main thread will set m_currentPhase back to NoPhase, the GCThread will wake up, see that there's + nothing to do, and then it will go back to sleep without ever calling CopyVisitor::doneCopying() + to return its borrowed block to the CopiedSpace. CopiedSpace::doneCopying() will then sleep forever + waiting on the block. - DFG ConvertThis should just be a CheckStructure if the structure is known - https://bugs.webkit.org/show_bug.cgi?id=87057 + The fix for this is to make sure we call CopiedSpace::doneCopying() on the main thread before we + call GCThreadSharedData::didFinishCopying(), which sets the m_currentPhase flag to NoPhase. This + way we will wait until all threads have woken up and given back their borrowed blocks before + clearing the flag. - Reviewed by Gavin Barraclough. - - Merged r118021 from dfgopt. - - This gives ValueProfile the ability to track singleton values - i.e. profiling - sites that always see the same value. - - That is then used to profile the structure in op_convert_this. - - This is then used to optimize op_convert_this into a CheckStructure if the - structure is always the same. - - That then results in better CSE in inlined code that uses 'this', since - previously we couldn't CSE accesses on 'this' from different inline call frames. - - Also fixed a bug where we were unnecessarily flushing 'this'. + * heap/Heap.cpp: + (JSC::Heap::copyBackingStores): - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::dump): - (JSC::CodeBlock::stronglyVisitStrongReferences): - * bytecode/LazyOperandValueProfile.cpp: - (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions): - * bytecode/LazyOperandValueProfile.h: - (CompressedLazyOperandValueProfileHolder): - * bytecode/Opcode.h: - (JSC): - (JSC::padOpcodeName): - * bytecode/ValueProfile.h: - (JSC::ValueProfileBase::ValueProfileBase): - (JSC::ValueProfileBase::dump): - (JSC::ValueProfileBase::computeUpdatedPrediction): - (ValueProfileBase): - * bytecompiler/BytecodeGenerator.cpp: - (JSC::BytecodeGenerator::BytecodeGenerator): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::setArgument): - (JSC::DFG::ByteCodeParser::parseBlock): - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_convert_this): - (JSC::JIT::emitSlow_op_convert_this): - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::emit_op_convert_this): - (JSC::JIT::emitSlow_op_convert_this): - * llint/LLIntSlowPaths.cpp: - (JSC::LLInt::LLINT_SLOW_PATH_DECL): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: - * runtime/JSValue.h: - (JSValue): - * runtime/Structure.h: - (JSC::JSValue::structureOrUndefined): - (JSC): +2012-10-12 Anders Carlsson -2012-05-24 Tim Horton + Move macros from Parser.h to Parser.cpp + https://bugs.webkit.org/show_bug.cgi?id=99217 - Add feature defines for web-facing parts of CSS Regions and Exclusions - https://bugs.webkit.org/show_bug.cgi?id=87442 - + Reviewed by Andreas Kling. - Reviewed by Dan Bernstein. + There are a bunch of macros in Parser.h that are only used in Parser.cpp. Move them to Parser.cpp + so they won't pollute the global namespace. + * parser/Parser.cpp: + * parser/Parser.h: + (JSC): - * Configurations/FeatureDefines.xcconfig: +2012-10-12 Mark Hahnenberg -2012-05-24 Geoffrey Garen + Another build fix after r131213 - WebKit should be lazy-finalization-safe (esp. the DOM) - https://bugs.webkit.org/show_bug.cgi?id=87456 + Added some symbol magic to placate the linker on some platforms. - Reviewed by Filip Pizlo. + * JavaScriptCore.order: - Lazy finalization adds one twist to weak pointer use: +2012-10-12 Mark Hahnenberg - A HashMap of weak pointers may contain logically null entries. - (Weak pointers behave as-if null once their payloads die.) - Insertion must not assume that a pre-existing entry is - necessarily valid, and iteration must not assume that all - entries can be dereferenced. + Build fix after r131213 - (Previously, I thought that it also added a second twist: + Removed an unused variable that was making compilers unhappy. - A demand-allocated weak pointer may replace a dead payload - before the payload's finalizer runs. In that case, when the - payload's finalizer runs, the payload has already been - overwritten, and the finalizer should not clear the payload, - which now points to something new. + * heap/GCThread.cpp: + (JSC::GCThread::GCThread): + * heap/GCThread.h: + (GCThread): + * heap/GCThreadSharedData.cpp: + (JSC::GCThreadSharedData::GCThreadSharedData): - But that's not the case here, since we cancel the old payload's - finalizer when we over-write it. I've added ASSERTs to verify this - assumption, in case it ever changes.) +2012-10-09 Mark Hahnenberg - * API/JSClassRef.cpp: - (OpaqueJSClass::prototype): No need to specify null; that's the default. + Copying collection shouldn't require O(live bytes) memory overhead + https://bugs.webkit.org/show_bug.cgi?id=98792 - * API/JSWeakObjectMapRefPrivate.cpp: Use remove, since take() is gone. + Reviewed by Filip Pizlo. - * heap/PassWeak.h: - (WeakImplAccessor::was): This is no longer a debug-only function, since - it's required to reason about lazily finalized pointers. + Currently our copying collection occurs simultaneously with the marking phase. We'd like + to be able to reuse CopiedBlocks as soon as they become fully evacuated, but this is not + currently possible because we don't know the liveness statistics of each old CopiedBlock + until marking/copying has already finished. Instead, we have to allocate additional memory + from the OS to use as our working set of CopiedBlocks while copying. We then return the + fully evacuated old CopiedBlocks back to the block allocator, thus giving our copying phase + an O(live bytes) overhead. + + To fix this, we should instead split the copying phase apart from the marking phase. This + way we have full liveness data for each CopiedBlock during the copying phase so that we + can reuse them the instant they become fully evacuated. With the additional liveness data + that each CopiedBlock accumulates, we can add some additional heuristics to the collector. + For example, we can calculate our global Heap fragmentation and only choose to do a copying + phase if that fragmentation exceeds some limit. As another example, we can skip copying + blocks that are already above a particular fragmentation limit, which allows older objects + to coalesce into blocks that are rarely copied. - * heap/Weak.h: - (JSC::weakAdd): - (JSC::weakRemove): - (JSC::weakClear): Added these helper functions for the common idioms of - what clients want to do in their weak pointer finalizers. + * JavaScriptCore.xcodeproj/project.pbxproj: + * heap/CopiedBlock.h: + (CopiedBlock): + (JSC::CopiedBlock::CopiedBlock): Added support for tracking live bytes in a CopiedBlock in a + thread-safe fashion. + (JSC::CopiedBlock::reportLiveBytes): Adds a number of live bytes to the block in a thread-safe + fashion using compare and swap. + (JSC): + (JSC::CopiedBlock::didSurviveGC): Called when a block survives a single GC without being + evacuated. This could be called for a couple reasons: (a) the block was pinned or (b) we + decided not to do any copying. A block can become pinned for a few reasons: (1) a pointer into + the block was found during the conservative scan. (2) the block was deemed full enough to + not warrant any copying. (3) The block is oversize and was found to be live. + (JSC::CopiedBlock::didEvacuateBytes): Called when some number of bytes are copied from this + block. If the number of live bytes ever hits zero, the block will return itself to the + BlockAllocator to be recycled. + (JSC::CopiedBlock::canBeRecycled): Indicates that a block has no live bytes and can be + immediately recycled. This is used for blocks that are found to have zero live bytes at the + beginning of the copying phase. + (JSC::CopiedBlock::shouldEvacuate): This function returns true if the current fragmentation + of the block is above our fragmentation threshold, and false otherwise. + (JSC::CopiedBlock::isPinned): Added an accessor for the pinned flag + (JSC::CopiedBlock::liveBytes): + * heap/CopiedSpace.cpp: + (JSC::CopiedSpace::CopiedSpace): + (JSC::CopiedSpace::doneFillingBlock): Changed so that we can exchange our filled block for a + fresh block. This avoids the situation where a thread returns its borrowed block, it's the last + borrowed block, so CopiedSpace thinks that copying has completed, and it starts doing all of the + copying phase cleanup. In actuality, the thread wanted another block after returning the current + block. So we allow the thread to atomically exchange its block for another block. + (JSC::CopiedSpace::startedCopying): Added the calculation of global Heap fragmentation to + determine if the copying phase should commence. We include the MarkedSpace in our fragmentation + calculation by assuming that the MarkedSpace is 0% fragmented since we can reuse any currently + free memory in it (i.e. we ignore any internal fragmentation in the MarkedSpace). While we're + calculating the fragmentation of CopiedSpace, we also return any free blocks we find along the + way (meaning liveBytes() == 0). + (JSC): + (JSC::CopiedSpace::doneCopying): We still have to iterate over all the blocks, regardless of + whether the copying phase took place or not so that we can reset all of the live bytes counters + and un-pin any pinned blocks. + * heap/CopiedSpace.h: + (CopiedSpace): + (JSC::CopiedSpace::shouldDoCopyPhase): + * heap/CopiedSpaceInlineMethods.h: + (JSC::CopiedSpace::recycleEvacuatedBlock): This function is distinct from recycling a borrowed block + because a borrowed block hasn't been added to the CopiedSpace yet, but an evacuated block is still + currently in CopiedSpace, so we have to make sure we properly remove all traces of the block from + CopiedSpace before returning it to BlockAllocator. + (JSC::CopiedSpace::recycleBorrowedBlock): Renamed to indicate the distinction mentioned above. + * heap/CopyVisitor.cpp: Added. + (JSC): + (JSC::CopyVisitor::CopyVisitor): + (JSC::CopyVisitor::copyFromShared): Main function for any thread participating in the copying phase. + Grabs chunks of MarkedBlocks from the shared list and copies the backing store of anybody who needs + it until there are no more chunks to copy. + * heap/CopyVisitor.h: Added. + (JSC): + (CopyVisitor): + * heap/CopyVisitorInlineMethods.h: Added. + (JSC): + (GCCopyPhaseFunctor): + (JSC::GCCopyPhaseFunctor::GCCopyPhaseFunctor): + (JSC::GCCopyPhaseFunctor::operator()): + (JSC::CopyVisitor::checkIfShouldCopy): We don't have to check shouldEvacuate() because all of those + checks are done during the marking phase. + (JSC::CopyVisitor::allocateNewSpace): + (JSC::CopyVisitor::allocateNewSpaceSlow): + (JSC::CopyVisitor::startCopying): Initialization function for a thread that is about to start copying. + (JSC::CopyVisitor::doneCopying): + (JSC::CopyVisitor::didCopy): This callback is called by an object that has just successfully copied its + backing store. It indicates to the CopiedBlock that somebody has just finished evacuating some number of + bytes from it, and, if the CopiedBlock now has no more live bytes, can be recycled immediately. + * heap/GCThread.cpp: Added. + (JSC): + (JSC::GCThread::GCThread): This is a new class that encapsulates a single thread responsible for participating + in a specific set of GC phases. Currently, that set of phases includes Mark, Copy, and Exit. Each thread + monitors a shared variable in its associated GCThreadSharedData. The main thread updates this m_currentPhase + variable as collection progresses through the various phases. Parallel marking still works exactly like it + has. In other words, the "run loop" for each of the GC threads sits above any individual phase, thus keeping + the separate phases of the collector orthogonal. + (JSC::GCThread::threadID): + (JSC::GCThread::initializeThreadID): + (JSC::GCThread::slotVisitor): + (JSC::GCThread::copyVisitor): + (JSC::GCThread::waitForNextPhase): + (JSC::GCThread::gcThreadMain): + (JSC::GCThread::gcThreadStartFunc): + * heap/GCThread.h: Added. + (JSC): + (GCThread): + * heap/GCThreadSharedData.cpp: The GCThreadSharedData now has a list of GCThread objects rather than raw + ThreadIdentifiers. + (JSC::GCThreadSharedData::resetChildren): + (JSC::GCThreadSharedData::childVisitCount): + (JSC::GCThreadSharedData::GCThreadSharedData): + (JSC::GCThreadSharedData::~GCThreadSharedData): + (JSC::GCThreadSharedData::reset): + (JSC::GCThreadSharedData::didStartMarking): Callback to let the GCThreadSharedData know that marking has + started and updates the m_currentPhase variable and notifies the GCThreads accordingly. + (JSC::GCThreadSharedData::didFinishMarking): Ditto for finishing marking. + (JSC::GCThreadSharedData::didStartCopying): Ditto for starting the copying phase. + (JSC::GCThreadSharedData::didFinishCopying): Ditto for finishing copying. + * heap/GCThreadSharedData.h: + (JSC): + (GCThreadSharedData): + (JSC::GCThreadSharedData::getNextBlocksToCopy): Atomically gets the next chunk of work for a copying thread. + * heap/Heap.cpp: + (JSC::Heap::Heap): + (JSC::Heap::markRoots): + (JSC): + (JSC::Heap::copyBackingStores): Responsible for setting up the copying phase, notifying the copying threads, + and doing any copying work if necessary. + (JSC::Heap::collect): + * heap/Heap.h: + (Heap): + (JSC): + (JSC::CopyFunctor::CopyFunctor): + (CopyFunctor): + (JSC::CopyFunctor::operator()): + * heap/IncrementalSweeper.cpp: Changed the incremental sweeper to have a reference to the list of MarkedBlocks + that need sweeping, since this now resides in the Heap so that it can be easily shared by the GCThreads. + (JSC::IncrementalSweeper::IncrementalSweeper): + (JSC::IncrementalSweeper::startSweeping): + * heap/IncrementalSweeper.h: + (JSC): + (IncrementalSweeper): + * heap/SlotVisitor.cpp: + (JSC::SlotVisitor::setup): + (JSC::SlotVisitor::drainFromShared): We no longer do any copying-related work here. + (JSC): + * heap/SlotVisitor.h: + (SlotVisitor): + * heap/SlotVisitorInlineMethods.h: + (JSC): + (JSC::SlotVisitor::copyLater): Notifies the CopiedBlock that there are some live bytes that may need + to be copied. + * runtime/Butterfly.h: + (JSC): + (Butterfly): + * runtime/ButterflyInlineMethods.h: + (JSC::Butterfly::createUninitializedDuringCollection): Uses the new CopyVisitor. + * runtime/ClassInfo.h: + (MethodTable): Added new "virtual" function copyBackingStore to method table. + (JSC): + * runtime/JSCell.cpp: + (JSC::JSCell::copyBackingStore): Default implementation that does nothing. + (JSC): + * runtime/JSCell.h: + (JSC): + (JSCell): + * runtime/JSObject.cpp: + (JSC::JSObject::copyButterfly): Does the actual copying of the butterfly. + (JSC): + (JSC::JSObject::visitButterfly): Calls copyLater for the butterfly. + (JSC::JSObject::copyBackingStore): + * runtime/JSObject.h: + (JSObject): + (JSC::JSCell::methodTable): + (JSC::JSCell::inherits): + * runtime/Options.h: Added two new constants, minHeapUtilization and minCopiedBlockUtilization, + to govern the amount of fragmentation we allow before doing copying. + (JSC): - * jit/JITStubs.cpp: - (JSC::JITThunks::hostFunctionStub): Use the new idioms. Otherwise, we - would return NULL for a "zombie" executable weak pointer that was waiting - for finalization (item (2)), and finalizing a dead executable weak pointer - would potentially destroy a new, live one (item (1)). +2012-10-12 Filip Pizlo - * runtime/RegExpCache.cpp: - (JSC::RegExpCache::lookupOrCreate): - (JSC::RegExpCache::finalize): Ditto. + DFG array allocation calls should not return an encoded JSValue + https://bugs.webkit.org/show_bug.cgi?id=99196 - (JSC::RegExpCache::invalidateCode): Check for null while iterating. (See - item (2).) + Reviewed by Mark Hahnenberg. - * runtime/Structure.cpp: - (JSC::StructureTransitionTable::contains): - (JSC::StructureTransitionTable::add): Use get and set instead of add and - contains, since add and contains are not compatible with lazy finalization. + The array allocation operations now return a pointer instead. This makes it + easier to share code between 32-bit and 64-bit. - * runtime/WeakGCMap.h: - (WeakGCMap): - (JSC::WeakGCMap::clear): - (JSC::WeakGCMap::remove): Removed a bunch of code that was incompatible with - lazy finalization because I didn't feel like making it compatible, and I had - no way to test it. + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): -2012-05-24 Filip Pizlo +2012-10-01 Jer Noble - REGRESSION (r118013-r118031): Loops/Reloads under www.yahoo.com, quits after three tries with error - https://bugs.webkit.org/show_bug.cgi?id=87327 + Enable ENCRYPTED_MEDIA support on Mac. + https://bugs.webkit.org/show_bug.cgi?id=98044 - Reviewed by Geoffrey Garen. - - If you use AbstractValue::filter(StructureSet) to test subset relationships between TOP and a - set containing >=2 elements, you're going to have a bad time. - - That's because AbstractValue considers a set with >=2 elements to be equivalent to TOP, in order - to save space and speed up convergence. So filtering has no effect in this case, which made - the code think that the abstract value was proving that the structure check was unnecessary. - The correct thing to do is to use isSubsetOf() on the StructureAbstractValue, which does the - right thingies for TOP and >=2 elements. + Reviewed by Anders Carlsson. - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): + Enable the ENCRYPTED_MEDIA flag. -2012-05-24 Filip Pizlo + * Configurations/FeatureDefines.xcconfig: - new test fast/js/dfg-arguments-mixed-alias.html fails on JSVALUE32_64 - https://bugs.webkit.org/show_bug.cgi?id=87378 +2012-10-12 Filip Pizlo - Reviewed by Gavin Barraclough. - - - Captured variable tracking forgot did not consistently handle arguments, leading to OSR - badness. - - - Nodes capable of exiting were tracked in a non-monotonic way, leading to compiler errors. + Unreviewed. It should be possible to build JSC on ARMv7. - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::CSEPhase): - (CSEPhase): - (JSC::DFG::performCSE): - * dfg/DFGCSEPhase.h: - (DFG): - * dfg/DFGCommon.h: - * dfg/DFGDriver.cpp: - (JSC::DFG::compile): - * dfg/DFGGraph.cpp: - (JSC::DFG::Graph::resetExitStates): - (DFG): - * dfg/DFGGraph.h: - (Graph): - * dfg/DFGPhase.h: - (DFG): - (JSC::DFG::runPhase): + * assembler/MacroAssemblerARMv7.h: + (JSC::MacroAssemblerARMv7::patchableBranchPtr): -2012-05-24 Geoffrey Garen +2012-10-11 Mark Hahnenberg - Made WeakSet per-block instead of per-heap - https://bugs.webkit.org/show_bug.cgi?id=87401 + BlockAllocator should use regions as its VM allocation abstraction + https://bugs.webkit.org/show_bug.cgi?id=99107 - Reviewed by Oliver Hunt. + Reviewed by Geoffrey Garen. - This allows us fast access to the set of all weak pointers for a block, - which is a step toward lazy finalization. + Currently the BlockAllocator allocates a single block at a time directly from the OS. Our block + allocations are on the large-ish side (64 KB) to amortize across many allocations the expense of + mapping new virtual memory from the OS. These large blocks are then shared between the MarkedSpace + and the CopiedSpace. This design makes it difficult to vary the size of the blocks in different + parts of the Heap while still allowing us to amortize the VM allocation costs. - No performance change. + We should redesign the BlockAllocator so that it has a layer of indirection between blocks that are + used by the allocator/collector and our primary unit of VM allocation from the OS. In particular, + the BlockAllocator should allocate Regions of virtual memory from the OS, which are then subdivided + into one or more Blocks to be used in our custom allocators. This design has the following nice properties: - * heap/Heap.cpp: - (JSC::Heap::Heap): - (JSC::Heap::lastChanceToFinalize): Removed the per-heap weak set, since - it's per-block now. + 1) We can remove the knowledge of PageAllocationAligned from HeapBlocks. Each HeapBlock will now + only know what Region it belongs to. The Region maintains all the metadata for how to allocate + and deallocate virtual memory from the OS. - (JSC::Heap::markRoots): Delegate weak set visiting to the marked space, - since it knows how to iterate all blocks. + 2) We can easily allocate in larger chunks than we need to satisfy a particular request for a Block. + We can then continue to amortize our VM allocation costs while allowing for smaller block sizes, + which should increase locality in the mutator when allocating, lazy sweeping, etc. - (JSC::Heap::collect): Moved the reaping outside of markRoots, since it - doesn't mark anything. + 3) By encapsulating the logic of where our memory comes from inside of the Region class, we can more + easily transition over to allocating VM from a specific range of pre-reserved address space. This + will be a necessary step along the way to 32-bit pointers. - Make sure to reset allocators after shrinking, since shrinking may - deallocate the current allocator. + This particular patch will not change the size of MarkedBlocks or CopiedBlocks, nor will it change how + much VM we allocate per failed Block request. It only sets up the data structures that we need to make + these changes in future patches. - * heap/Heap.h: - (Heap): No more per-heap weak set, since it's per-block now. + Most of the changes in this patch relate to the addition of the Region class to be used by the + BlockAllocator and the threading of changes made to BlockAllocator's interface through to the call sites. + * heap/BlockAllocator.cpp: The BlockAllocator now has three lists that track the three disjoint sets of + Regions that it cares about: empty regions, partially full regions, and completely full regions. + Empty regions have no blocks currently in use and can be freed immediately if the freeing thread + determines they should be. Partial regions have some blocks used, but aren't completely in use yet. + These regions are preferred for recycling before empty regions to mitigate fragmentation within regions. + Completely full regions are no longer able to be used for allocations. Regions move between these + three lists as they are created and their constituent blocks are allocated and deallocated. + (JSC::BlockAllocator::BlockAllocator): + (JSC::BlockAllocator::~BlockAllocator): + (JSC::BlockAllocator::releaseFreeRegions): + (JSC::BlockAllocator::waitForRelativeTimeWhileHoldingLock): + (JSC::BlockAllocator::waitForRelativeTime): + (JSC::BlockAllocator::blockFreeingThreadMain): + * heap/BlockAllocator.h: + (JSC): + (DeadBlock): + (JSC::DeadBlock::DeadBlock): + (Region): + (JSC::Region::blockSize): + (JSC::Region::isFull): + (JSC::Region::isEmpty): + (JSC::Region::create): This function is responsible for doing the actual VM allocation. This should be the + only function in the entire JSC object runtime that calls out the OS for virtual memory allocation. + (JSC::Region::Region): + (JSC::Region::~Region): + (JSC::Region::allocate): + (JSC::Region::deallocate): + (BlockAllocator): + (JSC::BlockAllocator::tryAllocateFromRegion): Helper function that encapsulates checking a particular list + of regions for a free block. + (JSC::BlockAllocator::allocate): + (JSC::BlockAllocator::allocateCustomSize): This function is responsible for allocating one-off custom size + regions for use in oversize allocations in both the MarkedSpace and the CopiedSpace. These regions are not + tracked by the BlockAllocator. The only pointer to them is in the HeapBlock that is returned. These regions + contain exactly one block. + (JSC::BlockAllocator::deallocate): + (JSC::BlockAllocator::deallocateCustomSize): This function is responsible for deallocating one-off custom size + regions. The regions are deallocated back to the OS eagerly. + * heap/CopiedBlock.h: Re-worked CopiedBlocks to use Regions instead of PageAllocationAligned. + (CopiedBlock): + (JSC::CopiedBlock::createNoZeroFill): + (JSC::CopiedBlock::create): + (JSC::CopiedBlock::CopiedBlock): + (JSC::CopiedBlock::payloadEnd): + (JSC::CopiedBlock::capacity): + * heap/CopiedSpace.cpp: + (JSC::CopiedSpace::~CopiedSpace): + (JSC::CopiedSpace::tryAllocateOversize): + (JSC::CopiedSpace::tryReallocateOversize): + (JSC::CopiedSpace::doneCopying): + * heap/CopiedSpaceInlineMethods.h: + (JSC::CopiedSpace::allocateBlockForCopyingPhase): + (JSC::CopiedSpace::allocateBlock): + * heap/HeapBlock.h: + (JSC::HeapBlock::destroy): + (JSC::HeapBlock::HeapBlock): + (JSC::HeapBlock::region): + (HeapBlock): + * heap/MarkedAllocator.cpp: + (JSC::MarkedAllocator::allocateBlock): * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::create): (JSC::MarkedBlock::MarkedBlock): * heap/MarkedBlock.h: - (MarkedBlock): - (JSC::MarkedBlock::lastChanceToFinalize): Migrated finalization logic - here from the heap, so the heap doesn't need to know about our internal - data structures like our weak set. - - (JSC::MarkedBlock::heap): - (JSC::MarkedBlock::weakSet): - (JSC::MarkedBlock::shrink): - (JSC::MarkedBlock::resetAllocator): - (JSC::MarkedBlock::visitWeakSet): - (JSC::MarkedBlock::reapWeakSet): - (JSC::MarkedBlock::sweepWeakSet): + (JSC::MarkedBlock::capacity): * heap/MarkedSpace.cpp: - (JSC::VisitWeakSet::VisitWeakSet): - (JSC::VisitWeakSet::operator()): - (VisitWeakSet): - (JSC): - (JSC::ReapWeakSet::operator()): - (JSC::SweepWeakSet::operator()): - (JSC::LastChanceToFinalize::operator()): - (JSC::MarkedSpace::lastChanceToFinalize): - (JSC::ResetAllocator::operator()): - (JSC::MarkedSpace::resetAllocators): - (JSC::MarkedSpace::visitWeakSets): - (JSC::MarkedSpace::reapWeakSets): - (JSC::MarkedSpace::sweepWeakSets): - (JSC::Shrink::operator()): - (JSC::MarkedSpace::shrink): - * heap/MarkedSpace.h: - (MarkedSpace): Make sure to account for our weak sets when sweeping, - shrinking, etc. + (JSC::MarkedSpace::freeBlock): - * heap/WeakSet.cpp: - (JSC): - * heap/WeakSet.h: - (WeakSet): - (JSC::WeakSet::heap): - (JSC): - (JSC::WeakSet::lastChanceToFinalize): - (JSC::WeakSet::visit): - (JSC::WeakSet::reap): - (JSC::WeakSet::shrink): - (JSC::WeakSet::resetAllocator): Inlined some things since they're called - once per block now instead of once per heap. +2012-10-11 Filip Pizlo - * heap/WeakSetInlines.h: - (JSC::WeakSet::allocate): Use the per-block weak set since there is no - per-heap weak set anymore. + UInt32ToNumber and OSR exit should be aware of copy propagation and correctly recover both versions of a variable that was subject to a UInt32ToNumber cast + https://bugs.webkit.org/show_bug.cgi?id=99100 + -2012-05-24 Gavin Barraclough + Reviewed by Michael Saboff and Mark Hahnenberg. - Fix arm build + Fixed by forcing UInt32ToNumber to use a different register. This "undoes" the copy propagation that we + would have been doing, since it has no performance effect in this case and has the benefit of making the + OSR exit compiler a lot simpler. - Rubber stamped by Geoff Garen + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compileUInt32ToNumber): - * dfg/DFGGPRInfo.h: - (GPRInfo): +2012-10-11 Geoffrey Garen -2012-05-24 Gavin Barraclough + Removed some more static assumptions about inline object capacity + https://bugs.webkit.org/show_bug.cgi?id=98603 - Move cacheFlush from ExecutableAllocator to Assembler classes - https://bugs.webkit.org/show_bug.cgi?id=87420 + Reviewed by Filip Pizlo. - Reviewed by Oliver Hunt. + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): Use JSObject::allocationSize() + for a little more flexibility. We still pass it a constant inline capacity + because the JIT doesn't have a strategy for selecting a size class based + on non-constant capacity yet. "INLINE_STORAGE_CAPACITY" is a marker for + code that makes static assumptions about object size. - Makes more sense there, & remove a pile of #ifdefs. + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateBasicJSObject): + * llint/LLIntData.cpp: + (JSC::LLInt::Data::performAssertions): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: Ditto for the rest of our many execution engines. - * assembler/ARMAssembler.cpp: - (JSC): - (JSC::ARMAssembler::cacheFlush): - * assembler/ARMAssembler.h: - (ARMAssembler): - (JSC::ARMAssembler::cacheFlush): - * assembler/ARMv7Assembler.h: - (JSC::ARMv7Assembler::relinkJump): - (JSC::ARMv7Assembler::cacheFlush): - (ARMv7Assembler): - (JSC::ARMv7Assembler::setInt32): - (JSC::ARMv7Assembler::setUInt7ForLoad): - * assembler/AbstractMacroAssembler.h: - (JSC::AbstractMacroAssembler::cacheFlush): - * assembler/LinkBuffer.h: - (JSC::LinkBuffer::performFinalization): - * assembler/MIPSAssembler.h: - (JSC::MIPSAssembler::relinkJump): - (JSC::MIPSAssembler::relinkCall): - (JSC::MIPSAssembler::repatchInt32): - (JSC::MIPSAssembler::cacheFlush): - (MIPSAssembler): - * assembler/SH4Assembler.h: - (JSC::SH4Assembler::repatchCompact): - (JSC::SH4Assembler::cacheFlush): - (SH4Assembler): - * assembler/X86Assembler.h: - (X86Assembler): - (JSC::X86Assembler::cacheFlush): - * jit/ExecutableAllocator.cpp: - (JSC): - * jit/ExecutableAllocator.h: - (ExecutableAllocator): + * runtime/JSObject.h: + (JSC::JSObject::allocationSize): + (JSC::JSFinalObject::finishCreation): + (JSC::JSFinalObject::create): New helper function for computing object + size dynamically, since we plan to have objects of different sizes. -2012-05-24 John Mellor + (JSC::JSFinalObject::JSFinalObject): Note that our m_inlineStorage used + to auto-generate an implicit C++ constructor with default null initialization. + This memory is not observed in its uninitialized state, and our LLInt and + JIT allocators do not initialize it, so I did not add any explicit code + to do so, now that the implicit code is gone. - Font Boosting: Add compile flag and runtime setting - https://bugs.webkit.org/show_bug.cgi?id=87394 + (JSC::JSObject::offsetOfInlineStorage): Changed the math here to match + inlineStorageUnsafe(), since we can rely on an explicit data member anymore. - Reviewed by Adam Barth. +2012-10-11 Geoffrey Garen - Add ENABLE_FONT_BOOSTING. + Enable RUNTIME_HEURISTICS all the time, for easier testing + https://bugs.webkit.org/show_bug.cgi?id=99090 - * Configurations/FeatureDefines.xcconfig: + Reviewed by Filip Pizlo. + + I find myself using this a lot, and there doesn't seem to be an obvious + reason to compile it out, since it only runs once at startup. + + * runtime/Options.cpp: + (JSC::overrideOptionWithHeuristic): + (JSC::Options::initialize): + * runtime/Options.h: Removed the #ifdef. + +2012-10-11 Geoffrey Garen + + Removed ASSERT_CLASS_FITS_IN_CELL + https://bugs.webkit.org/show_bug.cgi?id=97634 + + Reviewed by Mark Hahnenberg. + + Our collector now supports arbitrarily sized objects, so the ASSERT is not needed. + + * API/JSCallbackFunction.cpp: + * API/JSCallbackObject.cpp: + * heap/MarkedSpace.h: + * jsc.cpp: + * runtime/Arguments.cpp: + * runtime/ArrayConstructor.cpp: + * runtime/ArrayPrototype.cpp: + * runtime/BooleanConstructor.cpp: + * runtime/BooleanObject.cpp: + * runtime/BooleanPrototype.cpp: + * runtime/DateConstructor.cpp: + * runtime/DatePrototype.cpp: + * runtime/Error.cpp: + * runtime/ErrorConstructor.cpp: + * runtime/ErrorPrototype.cpp: + * runtime/FunctionConstructor.cpp: + * runtime/FunctionPrototype.cpp: + * runtime/InternalFunction.cpp: + * runtime/JSActivation.cpp: + * runtime/JSArray.cpp: + * runtime/JSBoundFunction.cpp: + * runtime/JSFunction.cpp: + * runtime/JSGlobalObject.cpp: + * runtime/JSGlobalThis.cpp: + * runtime/JSNameScope.cpp: + * runtime/JSNotAnObject.cpp: + * runtime/JSONObject.cpp: + * runtime/JSObject.cpp: + * runtime/JSPropertyNameIterator.cpp: + * runtime/JSScope.cpp: + * runtime/JSWithScope.cpp: + * runtime/JSWrapperObject.cpp: + * runtime/MathObject.cpp: + * runtime/NameConstructor.cpp: + * runtime/NamePrototype.cpp: + * runtime/NativeErrorConstructor.cpp: + * runtime/NativeErrorPrototype.cpp: + * runtime/NumberConstructor.cpp: + * runtime/NumberObject.cpp: + * runtime/NumberPrototype.cpp: + * runtime/ObjectConstructor.cpp: + * runtime/ObjectPrototype.cpp: + * runtime/RegExpConstructor.cpp: + * runtime/RegExpMatchesArray.cpp: + * runtime/RegExpObject.cpp: + * runtime/RegExpPrototype.cpp: + * runtime/StringConstructor.cpp: + * runtime/StringObject.cpp: + * runtime/StringPrototype.cpp: + * testRegExp.cpp: Removed the ASSERT. + +2012-10-11 Filip Pizlo + + DFG should inline code blocks that use new_array_buffer + https://bugs.webkit.org/show_bug.cgi?id=98996 + + Reviewed by Geoffrey Garen. + + This adds plumbing to drop in constant buffers from the inlinees to the inliner. + It's smart about not duplicating buffers needlessly but doesn't try to completely + hash-cons them, either. + + * bytecode/CodeBlock.h: + (JSC::CodeBlock::numberOfConstantBuffers): + (JSC::CodeBlock::addConstantBuffer): + (JSC::CodeBlock::constantBufferAsVector): + (JSC::CodeBlock::constantBuffer): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGByteCodeParser.cpp: + (ConstantBufferKey): + (JSC::DFG::ConstantBufferKey::ConstantBufferKey): + (JSC::DFG::ConstantBufferKey::operator==): + (JSC::DFG::ConstantBufferKey::hash): + (JSC::DFG::ConstantBufferKey::isHashTableDeletedValue): + (JSC::DFG::ConstantBufferKey::codeBlock): + (JSC::DFG::ConstantBufferKey::index): + (DFG): + (JSC::DFG::ConstantBufferKeyHash::hash): + (JSC::DFG::ConstantBufferKeyHash::equal): + (ConstantBufferKeyHash): + (WTF): + (ByteCodeParser): + (InlineStackEntry): + (JSC::DFG::ByteCodeParser::parseBlock): + (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): + * dfg/DFGCapabilities.h: + (JSC::DFG::canInlineOpcode): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-10-10 Zoltan Horvath -2012-05-24 Allan Sandfeld Jensen + Pageload tests should measure memory usage + https://bugs.webkit.org/show_bug.cgi?id=93958 - cti_vm_throw gets kicked out by gcc 4.6 -flto - https://bugs.webkit.org/show_bug.cgi?id=56088 + Reviewed by Ryosuke Niwa. + + Add JS Heap and Heap memory measurement to PageLoad tests. + + * heap/HeapStatistics.cpp: + (JSC::HeapStatistics::usedJSHeap): Add new private function to expose the used JS Heap size. + (JSC): + * heap/HeapStatistics.h: + (HeapStatistics): Add new private function to expose the used JS Heap size. - Reviewed by Darin Adler. +2012-10-10 Balazs Kilvady - Add REFERENCED_FROM_ASM to functions only referenced from assembler. + RegisterFile to JSStack rename fix for a struct member. - * dfg/DFGOperations.cpp: - * jit/HostCallReturnValue.h: - * jit/JITStubs.h: - * jit/ThunkGenerators.cpp: + Compilation problem in debug build on MIPS + https://bugs.webkit.org/show_bug.cgi?id=98808 -2012-05-24 Filip Pizlo + Reviewed by Alexey Proskuryakov. - Incorrect merge of r117542 from dfg opt branch in r118323 is leading to fast/js/dfg-arguments-osr-exit.html failing - https://bugs.webkit.org/show_bug.cgi?id=87350 + In ASSERT conditions structure field name "registerFile" was replaced + with type name "JSStack" and it should be "stack". - Reviewed by Maciej Stachowiak. - - The dfgopt branch introduced the notion of a local variable being killed because it was aliased - to the Arguments object as in cases like: - - var a = arguments; - return a.length; - - This required changes to OSR exit handling - if the variable is dead but aliased to arguments, then - OSR exit should reify the arguments. But meanwhile, in tip of tree we introduced special handling for - dead variables on OSR exit. When the two were merged in r118323, the structure of the if/else branches - ended up being such that we would treat dead arguments variables as totally dead as opposed to treating - them as variables that need arguments reification. - - This fixes the structure of the relevant if/else block so that variables that are dead-but-arguments - end up being treated as reified arguments objects, while variables that are dead but not aliased to - arguments are treated as tip of tree would have treated them (initialize to Undefined). + * jit/JITStubs.cpp: + (JSC::JITThunks::JITThunks): structure member name fix. - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compile): +2012-10-10 Michael Saboff -2012-05-24 Csaba Osztrogonác + After r130344, OpaqueJSString::string() shouldn't directly return the wrapped String + https://bugs.webkit.org/show_bug.cgi?id=98801 - Unreviewed 32 bit buildfix after r118325. + Reviewed by Geoffrey Garen. - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): Use ASSERT_UNUSED instead ASSERT. + Return a copy of the wrapped String so that the wrapped string cannot be turned into + an Identifier. -2012-05-23 Filip Pizlo + * API/OpaqueJSString.cpp: + (OpaqueJSString::string): + * API/OpaqueJSString.h: + (OpaqueJSString): - DFG operationTearOffActivation should return after handling the null activation case - https://bugs.webkit.org/show_bug.cgi?id=87348 - +2012-10-10 Peter Gal - Reviewed by Oliver Hunt. + Add moveDoubleToInts and moveIntsToDouble to MacroAssemblerARM + https://bugs.webkit.org/show_bug.cgi?id=98855 - * dfg/DFGOperations.cpp: + Reviewed by Filip Pizlo. -2012-05-23 Filip Pizlo + Implement the missing moveDoubleToInts and moveIntsToDouble + methods in the MacroAssemblerARM after r130839. - Unreviewed, merge the arguments fix in r118138 to get bots green. + * assembler/MacroAssemblerARM.h: + (JSC::MacroAssemblerARM::moveDoubleToInts): + (MacroAssemblerARM): + (JSC::MacroAssemblerARM::moveIntsToDouble): - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse): +2012-10-09 Filip Pizlo -2012-05-20 Filip Pizlo + Typed arrays should not be 20x slower in the baseline JIT than in the DFG JIT + https://bugs.webkit.org/show_bug.cgi?id=98605 - DFG CFA should record if a node can OSR exit - https://bugs.webkit.org/show_bug.cgi?id=86905 + Reviewed by Oliver Hunt and Gavin Barraclough. - Reviewed by Oliver Hunt. - - Merged r117931 from dfgopt. - - Adds a NodeFlag that denotes nodes that are known to not have OSR exits. - This ought to aid any backwards analyses that need to know when a - backward flow merge might happen due to a side exit. - - Also added assertions into speculationCheck() that ensure that we did not - mark a node as non-exiting and then promptly compile in an exit. This - helped catch some minor bugs where we were doing unnecessary speculation - checks. - - This is a perf-neutral change. The speculation checks that this removes - were not on hot paths of major benchmarks. + This adds typed array get_by_val/put_by_val patching to the baseline JIT. It's + a big (~40%) win on benchmarks that have trouble staying in the DFG JIT. Even + if we fix those benchmarks, this functionality gives us the insurance that we + typically desire with all speculative optimizations: even if we bail to + baseline, we're still reasonably performant. - * bytecode/PredictedType.h: + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * assembler/MacroAssembler.cpp: Added. (JSC): - (JSC::isAnyPrediction): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGAbstractState.h: - (JSC::DFG::AbstractState::speculateInt32Unary): - (AbstractState): - (JSC::DFG::AbstractState::speculateNumberUnary): - (JSC::DFG::AbstractState::speculateBooleanUnary): - (JSC::DFG::AbstractState::speculateInt32Binary): - (JSC::DFG::AbstractState::speculateNumberBinary): - * dfg/DFGNode.h: - (JSC::DFG::Node::mergeFlags): - (JSC::DFG::Node::filterFlags): - (Node): - (JSC::DFG::Node::setCanExit): - (JSC::DFG::Node::canExit): - * dfg/DFGNodeFlags.cpp: - (JSC::DFG::nodeFlagsAsString): - * dfg/DFGNodeFlags.h: + * assembler/MacroAssembler.h: + (MacroAssembler): + (JSC::MacroAssembler::patchableBranchPtr): + * assembler/MacroAssemblerARMv7.h: + (MacroAssemblerARMv7): + (JSC::MacroAssemblerARMv7::moveDoubleToInts): + (JSC::MacroAssemblerARMv7::moveIntsToDouble): + (JSC::MacroAssemblerARMv7::patchableBranchPtr): + * assembler/MacroAssemblerX86.h: + (MacroAssemblerX86): + (JSC::MacroAssemblerX86::moveDoubleToInts): + (JSC::MacroAssemblerX86::moveIntsToDouble): + * bytecode/ByValInfo.h: + (JSC::hasOptimizableIndexingForClassInfo): + (JSC): + (JSC::hasOptimizableIndexing): + (JSC::jitArrayModeForClassInfo): + (JSC::jitArrayModeForStructure): + (JSC::ByValInfo::ByValInfo): + (ByValInfo): + * dfg/DFGAssemblyHelpers.cpp: (DFG): + * dfg/DFGAssemblyHelpers.h: + (AssemblyHelpers): + (JSC::DFG::AssemblyHelpers::boxDouble): + (JSC::DFG::AssemblyHelpers::unboxDouble): * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::SpeculativeJIT): - (JSC::DFG::SpeculativeJIT::checkArgumentTypes): - (JSC::DFG::SpeculativeJIT::compileValueToInt32): + (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): + (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::speculationCheck): - (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck): - (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution): (SpeculativeJIT): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): - (JSC::DFG::SpeculativeJIT::fillSpeculateDouble): - (JSC::DFG::SpeculativeJIT::fillSpeculateCell): - (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): - (JSC::DFG::SpeculativeJIT::fillSpeculateDouble): - (JSC::DFG::SpeculativeJIT::fillSpeculateCell): - (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): - (JSC::DFG::SpeculativeJIT::compile): + * jit/JIT.h: + (JIT): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::emit_op_get_by_val): + (JSC::JIT::emit_op_put_by_val): + (JSC::JIT::privateCompileGetByVal): + (JSC::JIT::privateCompilePutByVal): + (JSC::JIT::emitIntTypedArrayGetByVal): + (JSC): + (JSC::JIT::emitFloatTypedArrayGetByVal): + (JSC::JIT::emitIntTypedArrayPutByVal): + (JSC::JIT::emitFloatTypedArrayPutByVal): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::emit_op_get_by_val): + (JSC::JIT::emit_op_put_by_val): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * runtime/JSCell.h: + * runtime/JSGlobalData.h: + (JSGlobalData): + (JSC::JSGlobalData::typedArrayDescriptor): + * runtime/TypedArrayDescriptor.h: Added. + (JSC): + (JSC::TypedArrayDescriptor::TypedArrayDescriptor): + (TypedArrayDescriptor): -2012-05-20 Filip Pizlo +2012-10-09 Michael Saboff - DFG should not do unnecessary indirections when storing to objects - https://bugs.webkit.org/show_bug.cgi?id=86959 + Add tests to testapi for null OpaqueJSStrings + https://bugs.webkit.org/show_bug.cgi?id=98805 - Reviewed by Oliver Hunt. - - Merged r117819 from dfgopt. + Reviewed by Geoffrey Garen. - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::getByOffsetLoadElimination): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): + Added tests that check that OpaqueJSString, which is wrapped via JSStringRef, properly returns + null strings and that a null string in a JSStringRef will return a NULL JSChar* and 0 length + via the JSStringGetCharactersPtr() and JSStringGetLength() APIs respectively. Added a check that + JSValueMakeFromJSONString() properly handles a null string as well. + + * API/tests/testapi.c: + (main): + +2012-10-09 Jian Li + + Update the CSS property used to support draggable regions. + https://bugs.webkit.org/show_bug.cgi?id=97156 + + Reviewed by Adam Barth. + + The CSS property to support draggable regions, guarded under + WIDGET_REGION is now disabled from Mac WebKit, in order not to cause + confusion with DASHBOARD_SUPPORT feature. + + * Configurations/FeatureDefines.xcconfig: Disable WIDGET_REGION feature. + +2012-10-09 Filip Pizlo + + Unreviewed, adding forgotten files. + + * bytecode/ByValInfo.h: Added. + (JSC): + (JSC::isOptimizableIndexingType): + (JSC::jitArrayModeForIndexingType): + (JSC::ByValInfo::ByValInfo): + (ByValInfo): + (JSC::getByValInfoBytecodeIndex): + * runtime/IndexingType.cpp: Added. + (JSC): + (JSC::indexingTypeToString): -2012-05-17 Filip Pizlo +2012-10-08 Filip Pizlo - DFG should optimize aliased uses of the Arguments object of the current call frame - https://bugs.webkit.org/show_bug.cgi?id=86552 + JSC should infer when indexed storage is contiguous, and optimize for it + https://bugs.webkit.org/show_bug.cgi?id=97288 - Reviewed by Geoff Garen. + Reviewed by Mark Hahnenberg. + + This introduces a new kind of indexed property storage called Contiguous, + which has the following properties: + + - No header bits beyond IndexedHeader. This results in a 16 byte reduction + in memory usage per array versus an ArrayStorage array. It also means + that the total memory usage for an empty array is now just 3 * 8 on both + 32-bit and 64-bit. Of that, only 8 bytes are array-specific; the rest is + our standard object header overhead. + + - No need for hole checks on store. This results in a ~4% speed-up on + Kraken and a ~1% speed-up on V8v7. - Merged r117542 and r117543 from dfgopt. + - publicLength <= vectorLength. This means that doing new Array(blah) + immediately allocates room for blah elements. - Performs must-alias and escape analysis on uses of CreateArguments, and if - a variable is must-aliased to CreateArguments and does not escape, then we - turn all uses of that variable into direct arguments accesses. + - No sparse map or index bias. - 36% speed-up on V8/earley leading to a 2.3% speed-up overall in V8. + If you ever do things to an array that would require publicLength > + vectorLength, a sparse map, or index bias, then we switch to ArrayStorage + mode. This seems to never happen in any benchmark we track, and is unlikely + to happen very frequently on any website. + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * assembler/AbstractMacroAssembler.h: + (JSC::AbstractMacroAssembler::JumpList::append): + * assembler/MacroAssembler.h: + (MacroAssembler): + (JSC::MacroAssembler::patchableBranchTest32): + * bytecode/ByValInfo.h: Added. + (JSC): + (JSC::isOptimizableIndexingType): + (JSC::jitArrayModeForIndexingType): + (JSC::ByValInfo::ByValInfo): + (ByValInfo): + (JSC::getByValInfoBytecodeIndex): * bytecode/CodeBlock.h: - (JSC::CodeBlock::uncheckedArgumentsRegister): - * bytecode/ValueRecovery.h: - (JSC::ValueRecovery::argumentsThatWereNotCreated): - (ValueRecovery): - (JSC::ValueRecovery::dump): + (CodeBlock): + (JSC::CodeBlock::getByValInfo): + (JSC::CodeBlock::setNumberOfByValInfos): + (JSC::CodeBlock::numberOfByValInfos): + (JSC::CodeBlock::byValInfo): + * bytecode/SamplingTool.h: * dfg/DFGAbstractState.cpp: (JSC::DFG::AbstractState::execute): - * dfg/DFGAdjacencyList.h: - (AdjacencyList): - (JSC::DFG::AdjacencyList::removeEdgeFromBag): - * dfg/DFGArgumentsSimplificationPhase.cpp: - (JSC::DFG::ArgumentsSimplificationPhase::run): - (ArgumentsSimplificationPhase): - (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse): - (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses): - (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse): - (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize): - (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild): - * dfg/DFGAssemblyHelpers.h: - (JSC::DFG::AssemblyHelpers::argumentsRegisterFor): - (AssemblyHelpers): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCFGSimplificationPhase.cpp: - (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference): - * dfg/DFGGPRInfo.h: - (GPRInfo): - * dfg/DFGGraph.cpp: - (JSC::DFG::Graph::collectGarbage): + * dfg/DFGArrayMode.cpp: + (JSC::DFG::fromObserved): + (JSC::DFG::modeAlreadyChecked): + (JSC::DFG::modeToString): + * dfg/DFGArrayMode.h: (DFG): + (JSC::DFG::modeUsesButterfly): + (JSC::DFG::modeIsJSArray): + (JSC::DFG::isInBoundsAccess): + (JSC::DFG::mayStoreToTail): + (JSC::DFG::mayStoreToHole): + (JSC::DFG::modeIsPolymorphic): + (JSC::DFG::polymorphicIncludesContiguous): + (JSC::DFG::polymorphicIncludesArrayStorage): + (JSC::DFG::canCSEStorage): + (JSC::DFG::modeSupportsLength): + (JSC::DFG::benefitsFromStructureCheck): + (JSC::DFG::isEffectful): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::handleIntrinsic): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::getArrayLengthElimination): + (JSC::DFG::CSEPhase::getByValLoadElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGFixupPhase.cpp: + (JSC::DFG::FixupPhase::fixupNode): + (JSC::DFG::FixupPhase::checkArray): + (JSC::DFG::FixupPhase::blessArrayOperation): * dfg/DFGGraph.h: - (Graph): - (JSC::DFG::Graph::executableFor): - (JSC::DFG::Graph::argumentsRegisterFor): - (JSC::DFG::Graph::uncheckedArgumentsRegisterFor): - (JSC::DFG::Graph::clobbersWorld): - * dfg/DFGNode.h: - (JSC::DFG::Node::hasHeapPrediction): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGOSRExitCompiler.cpp: - * dfg/DFGOSRExitCompiler.h: - (JSC::DFG::OSRExitCompiler::OSRExitCompiler): - (OSRExitCompiler): - * dfg/DFGOSRExitCompiler32_64.cpp: - (JSC::DFG::OSRExitCompiler::compileExit): - * dfg/DFGOSRExitCompiler64.cpp: - (JSC::DFG::OSRExitCompiler::compileExit): + (JSC::DFG::Graph::byValIsPure): * dfg/DFGOperations.cpp: - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGOperations.h: + * dfg/DFGRepatch.cpp: + (JSC::DFG::tryCacheGetByID): * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::ValueSource::dump): - (JSC::DFG::SpeculativeJIT::compile): - (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor): + (JSC::DFG::SpeculativeJIT::checkArray): + (JSC::DFG::SpeculativeJIT::arrayify): + (JSC::DFG::SpeculativeJIT::compileGetArrayLength): + (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal): + (DFG): * dfg/DFGSpeculativeJIT.h: + (DFG): + (JSC::DFG::SpeculativeJIT::callOperation): + (SpeculativeJIT): + (JSC::DFG::SpeculativeJIT::putByValWillNeedExtraRegister): + (JSC::DFG::SpeculativeJIT::temporaryRegisterForPutByVal): * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compileContiguousGetByVal): + (DFG): + (JSC::DFG::SpeculativeJIT::compileArrayStorageGetByVal): + (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal): + (JSC::DFG::SpeculativeJIT::compileArrayStoragePutByVal): (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compileContiguousGetByVal): + (DFG): + (JSC::DFG::SpeculativeJIT::compileArrayStorageGetByVal): + (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal): + (JSC::DFG::SpeculativeJIT::compileArrayStoragePutByVal): (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGVariableAccessData.h: - (JSC::DFG::VariableAccessData::VariableAccessData): - (JSC::DFG::VariableAccessData::mergeIsArgumentsAlias): - (VariableAccessData): - (JSC::DFG::VariableAccessData::isArgumentsAlias): + * interpreter/Interpreter.cpp: + (SamplingScope): + (JSC::SamplingScope::SamplingScope): + (JSC::SamplingScope::~SamplingScope): + (JSC): + (JSC::Interpreter::execute): + * jit/JIT.cpp: + (JSC::JIT::privateCompileSlowCases): + (JSC::JIT::privateCompile): + * jit/JIT.h: + (JSC::ByValCompilationInfo::ByValCompilationInfo): + (ByValCompilationInfo): + (JSC): + (JIT): + (JSC::JIT::compileGetByVal): + (JSC::JIT::compilePutByVal): + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateJSArray): + (JSC::JIT::emitArrayProfileStoreToHoleSpecialCase): + (JSC): + (JSC::arrayProfileSaw): + (JSC::JIT::chooseArrayMode): * jit/JITOpcodes.cpp: (JSC::JIT::emitSlow_op_get_argument_by_val): + (JSC::JIT::emit_op_new_array): + (JSC::JIT::emitSlow_op_new_array): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emitSlow_op_get_argument_by_val): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::emit_op_get_by_val): + (JSC): + (JSC::JIT::emitContiguousGetByVal): + (JSC::JIT::emitArrayStorageGetByVal): + (JSC::JIT::emitSlow_op_get_by_val): + (JSC::JIT::emit_op_put_by_val): + (JSC::JIT::emitContiguousPutByVal): + (JSC::JIT::emitArrayStoragePutByVal): + (JSC::JIT::emitSlow_op_put_by_val): + (JSC::JIT::privateCompilePatchGetArrayLength): + (JSC::JIT::privateCompileGetByVal): + (JSC::JIT::privateCompilePutByVal): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::emit_op_get_by_val): + (JSC): + (JSC::JIT::emitContiguousGetByVal): + (JSC::JIT::emitArrayStorageGetByVal): + (JSC::JIT::emitSlow_op_get_by_val): + (JSC::JIT::emit_op_put_by_val): + (JSC::JIT::emitContiguousPutByVal): + (JSC::JIT::emitArrayStoragePutByVal): + (JSC::JIT::emitSlow_op_put_by_val): + * jit/JITStubs.cpp: + (JSC::getByVal): + (JSC): + (JSC::DEFINE_STUB_FUNCTION): + (JSC::putByVal): + * jit/JITStubs.h: + * llint/LowLevelInterpreter.asm: + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/ArrayConventions.h: + (JSC::isDenseEnoughForVector): + * runtime/ArrayPrototype.cpp: + (JSC): + (JSC::shift): + (JSC::unshift): + (JSC::arrayProtoFuncPush): + (JSC::arrayProtoFuncShift): + (JSC::arrayProtoFuncSplice): + (JSC::arrayProtoFuncUnShift): + * runtime/Butterfly.h: + (Butterfly): + (JSC::Butterfly::fromPointer): + (JSC::Butterfly::pointer): + (JSC::Butterfly::publicLength): + (JSC::Butterfly::vectorLength): + (JSC::Butterfly::setPublicLength): + (JSC::Butterfly::setVectorLength): + (JSC::Butterfly::contiguous): + (JSC::Butterfly::fromContiguous): + * runtime/ButterflyInlineMethods.h: + (JSC::Butterfly::unshift): + (JSC::Butterfly::shift): + * runtime/IndexingHeaderInlineMethods.h: + (JSC::IndexingHeader::indexingPayloadSizeInBytes): + * runtime/IndexingType.cpp: Added. + (JSC): + (JSC::indexingTypeToString): + * runtime/IndexingType.h: + (JSC): + (JSC::hasContiguous): + * runtime/JSArray.cpp: + (JSC::JSArray::setLengthWithArrayStorage): + (JSC::JSArray::setLength): + (JSC): + (JSC::JSArray::pop): + (JSC::JSArray::push): + (JSC::JSArray::shiftCountWithArrayStorage): + (JSC::JSArray::shiftCountWithAnyIndexingType): + (JSC::JSArray::unshiftCountWithArrayStorage): + (JSC::JSArray::unshiftCountWithAnyIndexingType): + (JSC::JSArray::sortNumericVector): + (JSC::JSArray::sortNumeric): + (JSC::JSArray::sortCompactedVector): + (JSC::JSArray::sort): + (JSC::JSArray::sortVector): + (JSC::JSArray::fillArgList): + (JSC::JSArray::copyToArguments): + (JSC::JSArray::compactForSorting): + * runtime/JSArray.h: + (JSC::JSArray::shiftCountForShift): + (JSC::JSArray::shiftCountForSplice): + (JSArray): + (JSC::JSArray::shiftCount): + (JSC::JSArray::unshiftCountForShift): + (JSC::JSArray::unshiftCountForSplice): + (JSC::JSArray::unshiftCount): + (JSC::JSArray::isLengthWritable): + (JSC::createContiguousArrayButterfly): + (JSC): + (JSC::JSArray::create): + (JSC::JSArray::tryCreateUninitialized): + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::reset): + (JSC): + (JSC::JSGlobalObject::haveABadTime): + (JSC::JSGlobalObject::visitChildren): + * runtime/JSGlobalObject.h: + (JSGlobalObject): + (JSC::JSGlobalObject::arrayStructureWithArrayStorage): + (JSC::JSGlobalObject::addressOfArrayStructureWithArrayStorage): + (JSC::constructEmptyArray): + * runtime/JSObject.cpp: + (JSC::JSObject::visitButterfly): + (JSC::JSObject::getOwnPropertySlotByIndex): + (JSC::JSObject::putByIndex): + (JSC::JSObject::enterDictionaryIndexingMode): + (JSC::JSObject::createInitialContiguous): + (JSC): + (JSC::JSObject::createArrayStorage): + (JSC::JSObject::convertContiguousToArrayStorage): + (JSC::JSObject::ensureContiguousSlow): + (JSC::JSObject::ensureArrayStorageSlow): + (JSC::JSObject::ensureIndexedStorageSlow): + (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode): + (JSC::JSObject::switchToSlowPutArrayStorage): + (JSC::JSObject::setPrototype): + (JSC::JSObject::deletePropertyByIndex): + (JSC::JSObject::getOwnPropertyNames): + (JSC::JSObject::defineOwnIndexedProperty): + (JSC::JSObject::putByIndexBeyondVectorLengthContiguousWithoutAttributes): + (JSC::JSObject::putByIndexBeyondVectorLength): + (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage): + (JSC::JSObject::putDirectIndexBeyondVectorLength): + (JSC::JSObject::getNewVectorLength): + (JSC::JSObject::countElementsInContiguous): + (JSC::JSObject::increaseVectorLength): + (JSC::JSObject::ensureContiguousLengthSlow): + (JSC::JSObject::getOwnPropertyDescriptor): + * runtime/JSObject.h: + (JSC::JSObject::getArrayLength): + (JSC::JSObject::getVectorLength): + (JSC::JSObject::canGetIndexQuickly): + (JSC::JSObject::getIndexQuickly): + (JSC::JSObject::tryGetIndexQuickly): + (JSC::JSObject::canSetIndexQuickly): + (JSC::JSObject::canSetIndexQuicklyForPutDirect): + (JSC::JSObject::setIndexQuickly): + (JSC::JSObject::initializeIndex): + (JSC::JSObject::hasSparseMap): + (JSC::JSObject::inSparseIndexingMode): + (JSObject): + (JSC::JSObject::ensureContiguous): + (JSC::JSObject::ensureIndexedStorage): + (JSC::JSObject::ensureContiguousLength): + (JSC::JSObject::indexingData): + (JSC::JSObject::relevantLength): + * runtime/JSValue.cpp: + (JSC::JSValue::description): + * runtime/Options.cpp: + (JSC::Options::initialize): + * runtime/Structure.cpp: + (JSC::Structure::needsSlowPutIndexing): + (JSC): + (JSC::Structure::suggestedArrayStorageTransition): + * runtime/Structure.h: + (Structure): + * runtime/StructureTransitionTable.h: + (JSC::newIndexingType): -2012-05-23 Filip Pizlo - - DFGCapabilities should not try to get an arguments register from code blocks that don't have one - https://bugs.webkit.org/show_bug.cgi?id=87332 - - Reviewed by Andy Estes. - - * dfg/DFGCapabilities.h: - (JSC::DFG::canInlineOpcode): - -2012-05-23 Filip Pizlo - - DFG should have sparse conditional constant propagation - https://bugs.webkit.org/show_bug.cgi?id=86580 - - Reviewed by Oliver Hunt. - - Merged r117370 from dfgopt. - - This enhances CFA so that if it suspects at any point during the fixpoint that a - branch will only go one way, then it only propagates in that one way. - - This vastly increases the opportunities for CFG simplification. For example, it - enables us to evaporate this loop: - - for (var i = 0; i < 1; ++i) doThings(i); - - As a result, it uncovered loads of bugs in the CFG simplifier. In particular: - - - Phi fixup was assuming that all Phis worth fixing up are shouldGenerate(). - That's not true; we also fixup Phis that are dead. - - - GetLocal fixup was assuming that it's only necessary to rewire links to a - GetLocal, and that the GetLocal's own links don't need to be rewired. Untrue, - because the GetLocal may not be rewirable (first block has no GetLocal for r42 - but second block does have a GetLocal), in which case it will refer to a Phi - in the second block. We need it to refer to a Phi from the first block to - ensure that subsequent transformations work. - - - Tail operand fixup was ignoring the fact that Phis in successors may contain - references to the children of our tail variables. Hence, successor Phi child - substitution needs to use the original second block variable table as its - prior, rather than trying to reconstruct the prior later (since by that point - the children of the second block's tail variables will have been fixed up, so - we will not know what the prior would have been). - - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::beginBasicBlock): - (JSC::DFG::AbstractState::endBasicBlock): - (JSC::DFG::AbstractState::reset): - (JSC::DFG::AbstractState::execute): - (JSC::DFG::AbstractState::mergeToSuccessors): - * dfg/DFGAbstractState.h: - (JSC::DFG::AbstractState::branchDirectionToString): - (AbstractState): - * dfg/DFGCFGSimplificationPhase.cpp: - (JSC::DFG::CFGSimplificationPhase::run): - (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference): - (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::OperandSubstitution): - (OperandSubstitution): - (JSC::DFG::CFGSimplificationPhase::skipGetLocal): - (JSC::DFG::CFGSimplificationPhase::recordPossibleIncomingReference): - (CFGSimplificationPhase): - (JSC::DFG::CFGSimplificationPhase::fixTailOperand): - (JSC::DFG::CFGSimplificationPhase::mergeBlocks): - * dfg/DFGGraph.h: - (JSC::DFG::Graph::changeEdge): - -2012-05-23 Ojan Vafai - - add back the ability to disable flexbox - https://bugs.webkit.org/show_bug.cgi?id=87147 - - Reviewed by Tony Chang. +2012-10-09 Michael Saboff - * Configurations/FeatureDefines.xcconfig: + After r130344, OpaqueJSString::identifier() adds wrapped String to identifier table + https://bugs.webkit.org/show_bug.cgi?id=98693 + REGRESSION (r130344): Install failed in Install Environment + -2012-05-23 Filip Pizlo + Reviewed by Mark Rowe. - Unreviewed, fix Windows build. + Use Identifier(LChar*, length) or Identifier(UChar*, length) constructors so that we don't + add the String instance in the OpaqueJSString to any identifier tables. - * bytecode/CodeBlock.h: - * dfg/DFGCapabilities.h: - (JSC::DFG::canCompileOpcode): - (JSC::DFG::canCompileOpcodes): - * dfg/DFGCommon.h: - (DFG): + * API/OpaqueJSString.cpp: + (OpaqueJSString::identifier): -2012-05-23 Filip Pizlo +2012-10-08 Mark Lam - DFG should optimize inlined uses of arguments.length and arguments[i] - https://bugs.webkit.org/show_bug.cgi?id=86327 + Renamed RegisterFile to JSStack, and removed prototype of the + previously deleted Interpreter::privateExecute(). + https://bugs.webkit.org/show_bug.cgi?id=98717. - Reviewed by Gavin Barraclough. - - Merged r117017 from dfgopt. - - Turns inlined uses of arguments.length into a constant. - - Turns inlined uses of arguments[constant] into a direct reference to the - argument. - - Big win on micro-benchmarks. Not yet a win on V8 because the hot uses of - arguments.length and arguments[i] are aliased. I'll leave the aliasing - optimizations to a later patch. + Reviewed by Filip Pizlo. * CMakeLists.txt: * GNUmakefile.list.am: + * JavaScriptCore.order: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: * JavaScriptCore.xcodeproj/project.pbxproj: * Target.pri: - * bytecode/DFGExitProfile.h: - (FrequentExitSite): - (JSC::DFG::FrequentExitSite::FrequentExitSite): - (JSC::DFG::QueryableExitProfile::hasExitSite): - (QueryableExitProfile): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGArgumentsSimplificationPhase.cpp: Added. - (DFG): - (ArgumentsSimplificationPhase): - (JSC::DFG::ArgumentsSimplificationPhase::ArgumentsSimplificationPhase): - (JSC::DFG::ArgumentsSimplificationPhase::run): - (JSC::DFG::performArgumentsSimplification): - * dfg/DFGArgumentsSimplificationPhase.h: Added. - (DFG): - * dfg/DFGAssemblyHelpers.cpp: - (JSC::DFG::AssemblyHelpers::executableFor): - (DFG): + * bytecode/BytecodeConventions.h: + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::nameForRegister): + * bytecode/CodeBlock.h: + (CodeBlock): + * bytecode/ValueRecovery.h: + (JSC::ValueRecovery::alreadyInJSStack): + (JSC::ValueRecovery::alreadyInJSStackAsUnboxedInt32): + (JSC::ValueRecovery::alreadyInJSStackAsUnboxedCell): + (JSC::ValueRecovery::alreadyInJSStackAsUnboxedBoolean): + (JSC::ValueRecovery::alreadyInJSStackAsUnboxedDouble): + (JSC::ValueRecovery::displacedInJSStack): + (JSC::ValueRecovery::isAlreadyInJSStack): + (JSC::ValueRecovery::virtualRegister): + (JSC::ValueRecovery::dump): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::resolveCallee): + (JSC::BytecodeGenerator::emitCall): + (JSC::BytecodeGenerator::emitConstruct): + * bytecompiler/BytecodeGenerator.h: + (JSC::BytecodeGenerator::registerFor): + * dfg/DFGAbstractState.h: + (AbstractState): * dfg/DFGAssemblyHelpers.h: - (AssemblyHelpers): + (JSC::DFG::AssemblyHelpers::emitGetFromCallFrameHeaderPtr): + (JSC::DFG::AssemblyHelpers::emitPutToCallFrameHeader): + (JSC::DFG::AssemblyHelpers::emitPutImmediateToCallFrameHeader): * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::getDirect): + (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal): + (JSC::DFG::ByteCodeParser::addCall): + (JSC::DFG::ByteCodeParser::InlineStackEntry::remapOperand): + (JSC::DFG::ByteCodeParser::handleInlining): (JSC::DFG::ByteCodeParser::parseBlock): (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::getLocalLoadElimination): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGDriver.cpp: - (JSC::DFG::compile): + * dfg/DFGGenerationInfo.h: + (GenerationInfo): + (JSC::DFG::GenerationInfo::needsSpill): * dfg/DFGGraph.h: - (JSC::DFG::Graph::Graph): - (JSC::DFG::Graph::executableFor): - (Graph): - (JSC::DFG::Graph::clobbersWorld): - * dfg/DFGNode.h: - (JSC::DFG::Node::convertToConstant): - (JSC::DFG::Node::convertToGetLocalUnlinked): - (Node): - (JSC::DFG::Node::unlinkedLocal): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGOSRExit.cpp: - (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow): - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::compileEntry): + (JSC::DFG::JITCompiler::compileFunction): + * dfg/DFGJITCompiler.h: + (JSC::DFG::JITCompiler::beginCall): + * dfg/DFGOSREntry.cpp: + (JSC::DFG::prepareOSREntry): + * dfg/DFGOSRExitCompiler32_64.cpp: + (JSC::DFG::OSRExitCompiler::compileExit): + * dfg/DFGOSRExitCompiler64.cpp: + (JSC::DFG::OSRExitCompiler::compileExit): + * dfg/DFGRepatch.cpp: + (JSC::DFG::tryBuildGetByIDList): + * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compile): - -2012-05-13 Filip Pizlo - - DFG should be able to optimize foo.apply(bar, arguments) - https://bugs.webkit.org/show_bug.cgi?id=86306 - - Reviewed by Gavin Barraclough. - - Merge r116912 from dfgopt. - - Enables compilation of op_jneq_ptr and some forms of op_call_varargs. - - Also includes a bunch of bug fixes that were made necessary by the increased - pressure on the CFG simplifier. - - This is a 1-2% win on V8. - - * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::printCallOp): - (JSC::CodeBlock::CodeBlock): - (JSC::ProgramCodeBlock::canCompileWithDFGInternal): - (JSC::EvalCodeBlock::canCompileWithDFGInternal): - (JSC::FunctionCodeBlock::canCompileWithDFGInternal): - * bytecode/CodeBlock.h: - (CodeBlock): - (JSC::CodeBlock::canCompileWithDFG): - (JSC::CodeBlock::canCompileWithDFGState): - (ProgramCodeBlock): - (EvalCodeBlock): - (FunctionCodeBlock): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): - (JSC::DFG::ByteCodeParser::processPhiStack): - (JSC::DFG::ByteCodeParser::parse): - * dfg/DFGCFGSimplificationPhase.cpp: - (JSC::DFG::CFGSimplificationPhase::run): - (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal): - (JSC::DFG::CFGSimplificationPhase::fixTailOperand): - (JSC::DFG::CFGSimplificationPhase::mergeBlocks): - * dfg/DFGCSEPhase.cpp: - (JSC::DFG::CSEPhase::getLocalLoadElimination): - (CSEPhase): - (JSC::DFG::CSEPhase::setReplacement): - (JSC::DFG::CSEPhase::performNodeCSE): - * dfg/DFGCapabilities.cpp: - (JSC::DFG::debugFail): - (DFG): - (JSC::DFG::canHandleOpcodes): - (JSC::DFG::canCompileOpcodes): - (JSC::DFG::canInlineOpcodes): - * dfg/DFGCapabilities.h: - (JSC::DFG::canCompileOpcode): - (JSC::DFG::canInlineOpcode): - (DFG): - (JSC::DFG::canCompileOpcodes): - (JSC::DFG::canCompileEval): - (JSC::DFG::canCompileProgram): - (JSC::DFG::canCompileFunctionForCall): - (JSC::DFG::canCompileFunctionForConstruct): - * dfg/DFGCommon.h: - * dfg/DFGGraph.cpp: - (JSC::DFG::Graph::dump): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): + (JSC::DFG::SpeculativeJIT::checkArgumentTypes): + (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor): + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + (JSC::DFG::SpeculativeJIT::spill): * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::emitCall): (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::fillInteger): (JSC::DFG::SpeculativeJIT::emitCall): (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGValidate.cpp: - (Validate): - (JSC::DFG::Validate::validate): - (JSC::DFG::Validate::checkOperand): - (JSC::DFG::Validate::reportValidationContext): + * dfg/DFGThunks.cpp: + (JSC::DFG::throwExceptionFromCallSlowPathGenerator): + (JSC::DFG::slowPathFor): + (JSC::DFG::virtualForThunkGenerator): + * dfg/DFGValueSource.cpp: + (JSC::DFG::ValueSource::dump): + * dfg/DFGValueSource.h: + (JSC::DFG::dataFormatToValueSourceKind): + (JSC::DFG::valueSourceKindToDataFormat): + (JSC::DFG::isInJSStack): + (JSC::DFG::ValueSource::forSpeculation): + (JSC::DFG::ValueSource::isInJSStack): + (JSC::DFG::ValueSource::valueRecovery): + * dfg/DFGVariableEventStream.cpp: + (JSC::DFG::VariableEventStream::reconstruct): + * heap/Heap.cpp: + (JSC::Heap::stack): + (JSC::Heap::getConservativeRegisterRoots): + (JSC::Heap::markRoots): + * heap/Heap.h: + (JSC): + (Heap): + * interpreter/CallFrame.cpp: + (JSC::CallFrame::stack): + * interpreter/CallFrame.h: + (JSC::ExecState::calleeAsValue): + (JSC::ExecState::callee): + (JSC::ExecState::codeBlock): + (JSC::ExecState::scope): + (JSC::ExecState::callerFrame): + (JSC::ExecState::returnPC): + (JSC::ExecState::hasReturnPC): + (JSC::ExecState::clearReturnPC): + (JSC::ExecState::bytecodeOffsetForNonDFGCode): + (JSC::ExecState::setBytecodeOffsetForNonDFGCode): + (JSC::ExecState::inlineCallFrame): + (JSC::ExecState::codeOriginIndexForDFG): + (JSC::ExecState::currentVPC): + (JSC::ExecState::setCurrentVPC): + (JSC::ExecState::setCallerFrame): + (JSC::ExecState::setScope): + (JSC::ExecState::init): + (JSC::ExecState::argumentCountIncludingThis): + (JSC::ExecState::offsetFor): + (JSC::ExecState::setArgumentCountIncludingThis): + (JSC::ExecState::setCallee): + (JSC::ExecState::setCodeBlock): + (JSC::ExecState::setReturnPC): + (JSC::ExecState::setInlineCallFrame): + (ExecState): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::slideRegisterWindowForCall): + (JSC::eval): + (JSC::loadVarargs): + (JSC::Interpreter::dumpRegisters): + (JSC::Interpreter::throwException): + (JSC::Interpreter::execute): + (JSC::Interpreter::executeCall): + (JSC::Interpreter::executeConstruct): + (JSC::Interpreter::prepareForRepeatCall): + (JSC::Interpreter::endRepeatCall): + * interpreter/Interpreter.h: + (JSC::Interpreter::stack): + (Interpreter): + (JSC::Interpreter::execute): + (JSC): + * interpreter/JSStack.cpp: Copied from Source/JavaScriptCore/interpreter/RegisterFile.cpp. + (JSC::stackStatisticsMutex): + (JSC::JSStack::~JSStack): + (JSC::JSStack::growSlowCase): + (JSC::JSStack::gatherConservativeRoots): + (JSC::JSStack::releaseExcessCapacity): + (JSC::JSStack::initializeThreading): + (JSC::JSStack::committedByteCount): + (JSC::JSStack::addToCommittedByteCount): + * interpreter/JSStack.h: Copied from Source/JavaScriptCore/interpreter/RegisterFile.h. + (JSStack): + (JSC::JSStack::JSStack): + (JSC::JSStack::shrink): + (JSC::JSStack::grow): + * interpreter/RegisterFile.cpp: Removed. + * interpreter/RegisterFile.h: Removed. + * interpreter/VMInspector.cpp: + (JSC::VMInspector::dumpFrame): * jit/JIT.cpp: - (JSC::JIT::emitOptimizationCheck): - (JSC::JIT::privateCompileSlowCases): + (JSC::JIT::JIT): (JSC::JIT::privateCompile): * jit/JIT.h: - * jit/JITArithmetic.cpp: - (JSC::JIT::compileBinaryArithOp): + (JSC): + (JIT): + * jit/JITCall.cpp: + (JSC::JIT::compileLoadVarargs): + (JSC::JIT::compileCallEval): + (JSC::JIT::compileCallEvalSlowCase): + (JSC::JIT::compileOpCall): + * jit/JITCall32_64.cpp: + (JSC::JIT::emit_op_ret): + (JSC::JIT::emit_op_ret_object_or_this): + (JSC::JIT::compileLoadVarargs): + (JSC::JIT::compileCallEval): + (JSC::JIT::compileCallEvalSlowCase): + (JSC::JIT::compileOpCall): + * jit/JITCode.h: + (JSC): + (JSC::JITCode::execute): + * jit/JITInlineMethods.h: + (JSC::JIT::emitPutToCallFrameHeader): + (JSC::JIT::emitPutCellToCallFrameHeader): + (JSC::JIT::emitPutIntToCallFrameHeader): + (JSC::JIT::emitPutImmediateToCallFrameHeader): + (JSC::JIT::emitGetFromCallFrameHeaderPtr): + (JSC::JIT::emitGetFromCallFrameHeader32): + (JSC::JIT::updateTopCallFrame): + (JSC::JIT::unmap): + * jit/JITOpcodes.cpp: + (JSC::JIT::privateCompileCTIMachineTrampolines): + (JSC::JIT::privateCompileCTINativeCall): + (JSC::JIT::emit_op_end): + (JSC::JIT::emit_op_ret): + (JSC::JIT::emit_op_ret_object_or_this): + (JSC::JIT::emit_op_create_this): + (JSC::JIT::emit_op_get_arguments_length): + (JSC::JIT::emit_op_get_argument_by_val): + (JSC::JIT::emit_op_resolve_global_dynamic): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::privateCompileCTIMachineTrampolines): + (JSC::JIT::privateCompileCTINativeCall): + (JSC::JIT::emit_op_end): + (JSC::JIT::emit_op_create_this): + (JSC::JIT::emit_op_get_arguments_length): + (JSC::JIT::emit_op_get_argument_by_val): * jit/JITPropertyAccess.cpp: - (JSC::JIT::privateCompilePutByIdTransition): + (JSC::JIT::emit_op_get_scoped_var): + (JSC::JIT::emit_op_put_scoped_var): * jit/JITPropertyAccess32_64.cpp: - (JSC::JIT::privateCompilePutByIdTransition): - * tools/CodeProfile.cpp: - (JSC::CodeProfile::sample): - -2012-05-23 Geoffrey Garen - - Refactored WeakBlock to use malloc, clarify behavior - https://bugs.webkit.org/show_bug.cgi?id=87318 - - Reviewed by Filip Pizlo. - - We want to use malloc so we can make these smaller than 4KB, - since an individual MarkedBlock will usually have fewer than - 4KB worth of weak pointers. - - * heap/Heap.cpp: - (JSC::Heap::markRoots): Renamed visitLiveWeakImpls to visit, since - we no longer need to distinguish from "visitDeadWeakImpls". - - Renamed "visitDeadWeakImpls" to "reap" because we're not actually - doing any visiting -- we're just tagging things as dead. - - * heap/WeakBlock.cpp: - (JSC::WeakBlock::create): - (JSC::WeakBlock::destroy): - (JSC::WeakBlock::WeakBlock): Malloc! - - (JSC::WeakBlock::visit): - (JSC::WeakBlock::reap): Renamed as above. + (JSC::JIT::emit_op_get_scoped_var): + (JSC::JIT::emit_op_put_scoped_var): + * jit/JITStubs.cpp: + (JSC::ctiTrampoline): + (JSC::JITThunks::JITThunks): + (JSC): + (JSC::DEFINE_STUB_FUNCTION): + * jit/JITStubs.h: + (JSC): + (JITStackFrame): + * jit/JSInterfaceJIT.h: + * jit/SpecializedThunkJIT.h: + (JSC::SpecializedThunkJIT::SpecializedThunkJIT): + (JSC::SpecializedThunkJIT::returnJSValue): + (JSC::SpecializedThunkJIT::returnDouble): + (JSC::SpecializedThunkJIT::returnInt32): + (JSC::SpecializedThunkJIT::returnJSCell): + * llint/LLIntData.cpp: + (JSC::LLInt::Data::performAssertions): + * llint/LLIntOffsetsExtractor.cpp: + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + (JSC::LLInt::genericCall): + * llint/LLIntSlowPaths.h: + (LLInt): + * llint/LowLevelInterpreter.asm: + * runtime/Arguments.cpp: + (JSC::Arguments::tearOffForInlineCallFrame): + * runtime/CommonSlowPaths.h: + (JSC::CommonSlowPaths::arityCheckFor): + * runtime/InitializeThreading.cpp: + (JSC::initializeThreadingOnce): + * runtime/JSActivation.cpp: + (JSC::JSActivation::visitChildren): + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::globalExec): + * runtime/JSGlobalObject.h: + (JSC): + (JSGlobalObject): + * runtime/JSLock.cpp: + (JSC): + * runtime/JSVariableObject.h: + (JSVariableObject): + * runtime/MemoryStatistics.cpp: + (JSC::globalMemoryStatistics): - * heap/WeakBlock.h: - (WeakBlock): Reduced to 3KB, as explained above. +2012-10-08 Kiran Muppala - * heap/WeakSet.cpp: - (JSC::WeakSet::visit): - (JSC::WeakSet::reap): - * heap/WeakSet.h: - (WeakSet): Updated for renames, and to match WebKit style. + Throttle DOM timers on hidden pages. + https://bugs.webkit.org/show_bug.cgi?id=98474 -2012-05-23 Filip Pizlo + Reviewed by Maciej Stachowiak. - Use after free in JSC::DFG::ByteCodeParser::processPhiStack - https://bugs.webkit.org/show_bug.cgi?id=87312 - + Add HIDDEN_PAGE_DOM_TIMER_THROTTLING feature define. - Reviewed by Oliver Hunt. + * Configurations/FeatureDefines.xcconfig: - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::processPhiStack): - (JSC::DFG::ByteCodeParser::parse): +2012-10-08 Michael Saboff -2012-05-23 Filip Pizlo + After r130344, OpaqueJSString() creates an empty string which should be a null string + https://bugs.webkit.org/show_bug.cgi?id=98417 - It should be possible to make C function calls from DFG code on ARM in debug mode - https://bugs.webkit.org/show_bug.cgi?id=87313 + Reviewed by Sam Weinig. - Reviewed by Gavin Barraclough. + Changed create() of a null string to return 0. This is the same behavior as before r130344. - * dfg/DFGSpeculativeJIT.h: - (SpeculativeJIT): + * API/OpaqueJSString.cpp: + (OpaqueJSString::create): -2012-05-11 Filip Pizlo +2012-10-07 Caio Marcelo de Oliveira Filho - DFG should be able to inline functions that use arguments reflectively - https://bugs.webkit.org/show_bug.cgi?id=86132 + Rename first/second to key/value in HashMap iterators + https://bugs.webkit.org/show_bug.cgi?id=82784 - Reviewed by Oliver Hunt. - - Merged r116838 from dfgopt. - - This turns on inlining of functions that use arguments reflectively, but it - does not do any of the obvious optimizations that this exposes. I'll save that - for another patch - the important thing for now is that this contains all of - the plumbing necessary to make this kind of inlining sound even in bizarro - cases like an inline callee escaping the arguments object to parts of the - inline caller where the arguments are otherwise dead. Or even more fun cases - like where you've inlined to an inline stack that is three-deep, and the - function on top of the inline stack reflectively accesses the arguments of a - function that is in the middle of the inline stack. Any subsequent - optimizations that we do for the obvious cases of arguments usage in inline - functions will have to take care not to break the baseline functionality that - this patch plumbs together. + Reviewed by Eric Seidel. + * API/JSCallbackObject.h: + (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty): + (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty): + (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren): + * API/JSCallbackObjectFunctions.h: + (JSC::::getOwnNonIndexPropertyNames): + * API/JSClassRef.cpp: + (OpaqueJSClass::~OpaqueJSClass): + (OpaqueJSClassContextData::OpaqueJSClassContextData): + (OpaqueJSClass::contextData): * bytecode/CodeBlock.cpp: - (JSC::CodeBlock::printCallOp): (JSC::CodeBlock::dump): - * bytecode/CodeBlock.h: - * dfg/DFGAssemblyHelpers.h: - (JSC::DFG::AssemblyHelpers::argumentsRegisterFor): - (AssemblyHelpers): + (JSC::EvalCodeCache::visitAggregate): + (JSC::CodeBlock::nameForRegister): + * bytecode/JumpTable.h: + (JSC::StringJumpTable::offsetForValue): + (JSC::StringJumpTable::ctiForValue): + * bytecode/LazyOperandValueProfile.cpp: + (JSC::LazyOperandValueProfileParser::getIfPresent): + * bytecode/SamplingTool.cpp: + (JSC::SamplingTool::dump): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::addVar): + (JSC::BytecodeGenerator::addGlobalVar): + (JSC::BytecodeGenerator::addConstant): + (JSC::BytecodeGenerator::addConstantValue): + (JSC::BytecodeGenerator::emitLoad): + (JSC::BytecodeGenerator::addStringConstant): + (JSC::BytecodeGenerator::emitLazyNewFunction): + * bytecompiler/NodesCodegen.cpp: + (JSC::PropertyListNode::emitBytecode): + * debugger/Debugger.cpp: + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse): + (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse): + (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize): + (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild): + * dfg/DFGAssemblyHelpers.cpp: + (JSC::DFG::AssemblyHelpers::decodedCodeMapFor): + * dfg/DFGByteCodeCache.h: + (JSC::DFG::ByteCodeCache::~ByteCodeCache): + (JSC::DFG::ByteCodeCache::get): * dfg/DFGByteCodeParser.cpp: - (InlineStackEntry): - (JSC::DFG::ByteCodeParser::handleCall): - (JSC::DFG::ByteCodeParser::handleInlining): + (JSC::DFG::ByteCodeParser::cellConstant): (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): - (JSC::DFG::ByteCodeParser::parse): - * dfg/DFGCCallHelpers.h: - (JSC::DFG::CCallHelpers::setupArgumentsWithExecState): - (CCallHelpers): - * dfg/DFGCapabilities.h: - (JSC::DFG::canInlineOpcode): - * dfg/DFGDriver.cpp: - (JSC::DFG::compile): - * dfg/DFGFixupPhase.cpp: - (JSC::DFG::FixupPhase::fixupNode): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::callOperation): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * interpreter/CallFrame.cpp: - (JSC): - (JSC::CallFrame::someCodeBlockForPossiblyInlinedCode): - * interpreter/CallFrame.h: - (ExecState): - (JSC::ExecState::someCodeBlockForPossiblyInlinedCode): - * interpreter/Interpreter.cpp: - (JSC::Interpreter::retrieveArgumentsFromVMCode): - * runtime/Arguments.cpp: - (JSC::Arguments::tearOff): - (JSC): - (JSC::Arguments::tearOffForInlineCallFrame): - * runtime/Arguments.h: - (Arguments): - (JSC::Arguments::create): - (JSC::Arguments::finishCreation): - (JSC): + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck): + (JSC::DFG::StructureCheckHoistingPhase::noticeClobber): + * heap/Heap.cpp: + (JSC::Heap::markProtectedObjects): + * heap/Heap.h: + (JSC::Heap::forEachProtectedCell): + * heap/JITStubRoutineSet.cpp: + (JSC::JITStubRoutineSet::markSlow): + (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines): + * heap/SlotVisitor.cpp: + (JSC::SlotVisitor::internalAppend): + * heap/Weak.h: + (JSC::weakRemove): + * jit/JIT.cpp: + (JSC::JIT::privateCompile): + * jit/JITStubs.cpp: + (JSC::JITThunks::ctiStub): + * parser/Parser.cpp: + (JSC::::parseStrictObjectLiteral): + * profiler/Profile.cpp: + (JSC::functionNameCountPairComparator): + (JSC::Profile::debugPrintDataSampleStyle): + * runtime/Identifier.cpp: + (JSC::Identifier::add): + * runtime/JSActivation.cpp: + (JSC::JSActivation::getOwnNonIndexPropertyNames): + (JSC::JSActivation::symbolTablePutWithAttributes): + * runtime/JSArray.cpp: + (JSC::JSArray::setLength): + * runtime/JSObject.cpp: + (JSC::JSObject::getOwnPropertySlotByIndex): + (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists): + (JSC::JSObject::deletePropertyByIndex): + (JSC::JSObject::getOwnPropertyNames): + (JSC::JSObject::defineOwnIndexedProperty): + (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype): + (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage): + (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage): + (JSC::JSObject::getOwnPropertyDescriptor): + * runtime/JSSymbolTableObject.cpp: + (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames): + * runtime/JSSymbolTableObject.h: + (JSC::symbolTableGet): + (JSC::symbolTablePut): + (JSC::symbolTablePutWithAttributes): + * runtime/RegExpCache.cpp: + (JSC::RegExpCache::invalidateCode): + * runtime/SparseArrayValueMap.cpp: + (JSC::SparseArrayValueMap::putEntry): + (JSC::SparseArrayValueMap::putDirect): + (JSC::SparseArrayValueMap::visitChildren): + * runtime/WeakGCMap.h: + (JSC::WeakGCMap::clear): + (JSC::WeakGCMap::set): + * tools/ProfileTreeNode.h: + (JSC::ProfileTreeNode::sampleChild): + (JSC::ProfileTreeNode::childCount): + (JSC::ProfileTreeNode::dumpInternal): + (JSC::ProfileTreeNode::compareEntries): -2012-05-23 Filip Pizlo +2012-10-05 Mark Hahnenberg - Every OSR exit on ARM results in a crash - https://bugs.webkit.org/show_bug.cgi?id=87307 + JSC should have a way to gather and log Heap memory use and pause times + https://bugs.webkit.org/show_bug.cgi?id=98431 Reviewed by Geoffrey Garen. - * dfg/DFGThunks.cpp: - (JSC::DFG::osrExitGenerationThunkGenerator): + In order to improve our infrastructure for benchmark-driven development, we should + have a centralized method of gathering and logging various statistics about the state + of the JS heap. This would allow us to create and to use other tools to analyze the + output of the VM after running various workloads. -2012-05-23 Geoffrey Garen + The first two statistics that might be interesting is memory use by JSC and GC pause + times. We can control whether this recording happens through the use of the Options + class, allowing us to either use environment variables or command line flags. - Refactored heap tear-down to use normal value semantics (i.e., destructors) - https://bugs.webkit.org/show_bug.cgi?id=87302 + * JavaScriptCore.xcodeproj/project.pbxproj: + * heap/Heap.cpp: + (JSC::Heap::collect): If we finish a collection and are still over our set GC heap size, + we end the program immediately and report an error. Also added recording of pause times. + * heap/Heap.h: + (Heap): + (JSC::Heap::shouldCollect): When we set a specific GC heap size through Options, we + ignore all other heuristics on when we should collect and instead only ask if we're + greater than the amount specified in the Option value. This allows us to view time/memory + tradeoffs more clearly. + * heap/HeapStatistics.cpp: Added. + (JSC): + (JSC::HeapStatistics::initialize): + (JSC::HeapStatistics::recordGCPauseTime): + (JSC::HeapStatistics::logStatistics): + (JSC::HeapStatistics::exitWithFailure): + (JSC::HeapStatistics::reportSuccess): + (JSC::HeapStatistics::parseMemoryAmount): + (StorageStatistics): + (JSC::StorageStatistics::StorageStatistics): + (JSC::StorageStatistics::operator()): + (JSC::StorageStatistics::objectWithOutOfLineStorageCount): + (JSC::StorageStatistics::objectCount): + (JSC::StorageStatistics::storageSize): + (JSC::StorageStatistics::storageCapacity): + (JSC::HeapStatistics::showObjectStatistics): Moved the old showHeapStatistics (renamed to showObjectStatistics) + to try to start collecting our various memory statistics gathering/reporting mechanisms scattered throughout the + codebase into one place. + * heap/HeapStatistics.h: Added. + (JSC): + (HeapStatistics): + * jsc.cpp: + (main): + * runtime/InitializeThreading.cpp: + (JSC::initializeThreadingOnce): We need to initialize our data structures for recording + statistics if necessary. + * runtime/Options.cpp: Add new Options for the various types of statistics we'll be gathering. + (JSC::parse): + (JSC): + (JSC::Options::initialize): Initialize the various new options using environment variables. + (JSC::Options::dumpOption): + * runtime/Options.h: + (JSC): - Reviewed by Oliver Hunt. +2012-10-04 Rik Cabanier - This is a step toward incremental DOM finalization. + Turn Compositing on by default in WebKit build + https://bugs.webkit.org/show_bug.cgi?id=98315 - * heap/CopiedSpace.cpp: - (JSC::CopiedSpace::~CopiedSpace): - * heap/CopiedSpace.h: - (CopiedSpace): Just use our destructor, instead of relying on the heap - to send us a special message at a special time. + Reviewed by Simon Fraser. - * heap/Heap.cpp: - (JSC::Heap::Heap): Use OwnPtr for m_markListSet because this is not Sparta. + enable -webkit-blend-mode on trunk. - (JSC::Heap::~Heap): No need for delete or freeAllBlocks because normal - destructors do this work automatically now. + * Configurations/FeatureDefines.xcconfig: - (JSC::Heap::lastChanceToFinalize): Just call lastChanceToFinalize on our - sub-objects, and assume it does the right thing. This improves encapsulation, - so we can add items requiring finalization to our sub-objects. +2012-10-04 Michael Saboff - * heap/Heap.h: Moved m_blockAllocator to get the right destruction order. + Crash in Safari at com.apple.JavaScriptCore: WTF::StringImpl::is8Bit const + 12 + https://bugs.webkit.org/show_bug.cgi?id=98433 - * heap/MarkedSpace.cpp: - (Take): - (JSC): - (JSC::Take::Take): - (JSC::Take::operator()): - (JSC::Take::returnValue): Moved to the top of the file so it can be used - in another function. + Reviewed by Jessie Berlin. - (JSC::MarkedSpace::~MarkedSpace): Delete all outstanding memory, like a good - destructor should. + The problem is due to a String with a null StringImpl (i.e. a null string). + Added a length check before the is8Bit() check since length() checks for a null StringImpl. Changed the + characters16() call to characters() since it can handle a null StringImpl as well. - (JSC::MarkedSpace::lastChanceToFinalize): Moved some code here from the heap, - since it pertains to our internal implementation details. + * API/JSValueRef.cpp: + (JSValueMakeFromJSONString): - * heap/MarkedSpace.h: - (MarkedSpace): - * heap/WeakBlock.cpp: - (JSC::WeakBlock::lastChanceToFinalize): - * heap/WeakBlock.h: - (WeakBlock): - * heap/WeakSet.cpp: - (JSC::WeakSet::lastChanceToFinalize): - * heap/WeakSet.h: - (WeakSet): Stop using a special freeAllBlocks() callback and just implement - lastChanceToFinalize. +2012-10-04 Benjamin Poulain -2011-05-22 Geoffrey Garen + Use copyLCharsFromUCharSource() for IdentifierLCharFromUCharTranslator translation + https://bugs.webkit.org/show_bug.cgi?id=98335 - Encapsulated some calculations for whether portions of the heap are empty - https://bugs.webkit.org/show_bug.cgi?id=87210 + Reviewed by Michael Saboff. - Reviewed by Gavin Barraclough. + Michael Saboff added an optimized version of UChar->LChar conversion in r125846. + Use this function in JSC::Identifier. - This is a step toward incremental DOM finalization. + * runtime/Identifier.cpp: + (JSC::IdentifierLCharFromUCharTranslator::translate): - * heap/Heap.cpp: - (JSC::Heap::~Heap): Explicitly call freeAllBlocks() instead of relying - implicitly on all blocks thinking they're empty. In future, we may - choose to tear down the heap without first setting all data structures - to "empty". +2012-10-04 Michael Saboff - * heap/MarkedBlock.h: - (JSC::MarkedBlock::isEmpty): - (JSC::MarkedBlock::gatherDirtyCells): Renamed markCountIsZero to isEmpty, - in preparation for making it check for outstanding finalizers in addition - to marked cells. + After r130344, OpaqueJSString() creates a empty string which should be a null string + https://bugs.webkit.org/show_bug.cgi?id=98417 - * heap/MarkedSpace.cpp: - (Take): - (JSC::Take::Take): - (JSC::Take::operator()): - (JSC::Take::returnValue): - (JSC::MarkedSpace::shrink): - (JSC::MarkedSpace::freeAllBlocks): Refactored the "Take" functor to support - a conditional isEmpty check, so it dould be shared by shrink() and freeAllBlocks(). - - * heap/WeakBlock.cpp: - (JSC::WeakBlock::WeakBlock): - (JSC::WeakBlock::visitLiveWeakImpls): - (JSC::WeakBlock::visitDeadWeakImpls): - * heap/WeakBlock.h: - (WeakBlock): - (JSC::WeakBlock::isEmpty): - * heap/WeakSet.cpp: - (JSC::WeakSet::sweep): - (JSC::WeakSet::shrink): Use isEmpty(), in preparation for changes in - its implementation. - -2012-05-23 Oswald Buddenhagen - - [Qt] Remove references to $$QT_SOURCE_TREE - - With a modularized Qt, it's ambigious. What we really want is qtbase, - which qtcore is a proxy for (we assume it will always live in qtbase). - - Reviewed by Tor Arne Vestbø. - - * JavaScriptCore.pri: - * Target.pri: + Reviewed by Alexey Proskuryakov. -2012-05-09 Filip Pizlo + Removed the setting of enclosed string to an empty string from default constructor. + Before changeset r130344, the semantic was the default constructor produced a null + string. - DFG should allow inlining in case of certain arity mismatches - https://bugs.webkit.org/show_bug.cgi?id=86059 + * API/OpaqueJSString.h: + (OpaqueJSString::OpaqueJSString): - Reviewed by Geoff Garen. - - Merge r116620 from dfgopt. +2012-10-04 Csaba Osztrogonác - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::handleInlining): + [Qt] Add missing LLInt dependencies to the build system + https://bugs.webkit.org/show_bug.cgi?id=98394 -2012-05-08 Filip Pizlo + Reviewed by Geoffrey Garen. - DFG variable capture analysis should work even if the variables arose through inlining - https://bugs.webkit.org/show_bug.cgi?id=85945 + * DerivedSources.pri: + * LLIntOffsetsExtractor.pro: - Reviewed by Oliver Hunt. - - Merged r116555 from dfgopt. - - This just changes how the DFG queries whether a variable is captured. It does not - change any user-visible behavior. - - As part of this change, I further solidified the policy that the CFA behaves in an - undefined way for captured locals and queries about their values will not yield - reliable results. This will likely be changed in the future, but for now it makes - sense. - - One fun part about this change is that it recognizes that the same variable may - be both captured and not, at the same time, because their live interval spans - inlining boundaries. This only happens in the case of arguments to functions that - capture their arguments, and this change treats them with just the right touch of - conservatism: they will be treated as if captured by the caller as well as the - callee. - - Finally, this also adds captured variable reasoning to the InlineCallFrame, which - I thought might be useful for later tooling. - - This is perf-neutral, since it does it does not make the DFG take advantage of this - new functionality in any way. In particular, it is still the case that the DFG will - not inline functions that use arguments reflectively or that create activations. +2012-10-03 Geoffrey Garen - * bytecode/CodeBlock.h: - (CodeBlock): - (JSC::CodeBlock::needsActivation): - (JSC::CodeBlock::argumentIsCaptured): - (JSC::CodeBlock::localIsCaptured): - (JSC::CodeBlock::isCaptured): - * bytecode/CodeOrigin.h: - (InlineCallFrame): - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::initialize): - (JSC::DFG::AbstractState::endBasicBlock): - (JSC::DFG::AbstractState::execute): - (JSC::DFG::AbstractState::merge): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::newVariableAccessData): - (JSC::DFG::ByteCodeParser::getLocal): - (JSC::DFG::ByteCodeParser::setLocal): - (JSC::DFG::ByteCodeParser::getArgument): - (JSC::DFG::ByteCodeParser::setArgument): - (JSC::DFG::ByteCodeParser::flushArgument): - (JSC::DFG::ByteCodeParser::parseBlock): - (JSC::DFG::ByteCodeParser::processPhiStack): - (JSC::DFG::ByteCodeParser::fixVariableAccessPredictions): - (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): - * dfg/DFGCFGSimplificationPhase.cpp: - (CFGSimplificationPhase): - (JSC::DFG::CFGSimplificationPhase::keepOperandAlive): - (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal): - (JSC::DFG::CFGSimplificationPhase::fixTailOperand): - * dfg/DFGCommon.h: - * dfg/DFGFixupPhase.cpp: - (JSC::DFG::FixupPhase::fixupNode): - * dfg/DFGGraph.cpp: - (JSC::DFG::Graph::nameOfVariableAccessData): - * dfg/DFGGraph.h: - (JSC::DFG::Graph::needsActivation): - (JSC::DFG::Graph::usesArguments): - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting): - * dfg/DFGSpeculativeJIT.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGVariableAccessData.h: - (JSC::DFG::VariableAccessData::VariableAccessData): - (JSC::DFG::VariableAccessData::mergeIsCaptured): - (VariableAccessData): - (JSC::DFG::VariableAccessData::isCaptured): + Next step toward fixing Windows: add new symbol. -2012-05-08 Filip Pizlo + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: - DFG should support op_get_argument_by_val and op_get_arguments_length - https://bugs.webkit.org/show_bug.cgi?id=85911 +2012-10-03 Geoffrey Garen - Reviewed by Oliver Hunt. - - Merged r116467 from dfgopt. - - This adds a simple and relatively conservative implementation of op_get_argument_by_val - and op_get_arguments_length. We can optimize these later. For now it's great to have - the additional coverage. - - This patch appears to be perf-neutral. + First step toward fixing Windows: remove old symbol. - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGAssemblyHelpers.h: - (JSC::DFG::AssemblyHelpers::addressFor): - (JSC::DFG::AssemblyHelpers::tagFor): - (JSC::DFG::AssemblyHelpers::payloadFor): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCapabilities.h: - (JSC::DFG::canCompileOpcode): - (JSC::DFG::canInlineOpcode): - * dfg/DFGNode.h: - (JSC::DFG::Node::hasHeapPrediction): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - * dfg/DFGSpeculativeJIT.h: - (JSC::DFG::SpeculativeJIT::callOperation): - (SpeculativeJIT): - * dfg/DFGSpeculativeJIT32_64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * dfg/DFGSpeculativeJIT64.cpp: - (JSC::DFG::SpeculativeJIT::compile): - * jit/JITOpcodes.cpp: - (JSC::JIT::emit_op_get_argument_by_val): - * jit/JITOpcodes32_64.cpp: - (JSC::JIT::emit_op_get_argument_by_val): - * llint/LowLevelInterpreter32_64.asm: - * llint/LowLevelInterpreter64.asm: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: -2012-05-07 Filip Pizlo +2012-10-03 Geoffrey Garen - DFG should support op_tear_off_arguments - https://bugs.webkit.org/show_bug.cgi?id=85847 + Removed the assumption that "final" objects have a fixed number of inline slots + https://bugs.webkit.org/show_bug.cgi?id=98332 - Reviewed by Michael Saboff. - - Merged r116378 from dfgopt. + Reviewed by Filip Pizlo. + + This is a step toward object size inference. + + I replaced the inline storage capacity constant with a data member per + structure, set the the maximum supported value for the constant to 100, + then fixed what broke. (Note that even though this patch increases the + theoretical maximum inline capacity, it doesn't change any actual inline + capacity.) - * dfg/DFGAbstractState.cpp: - (JSC::DFG::AbstractState::execute): - * dfg/DFGByteCodeParser.cpp: - (JSC::DFG::ByteCodeParser::parseBlock): - * dfg/DFGCapabilities.h: - (JSC::DFG::canCompileOpcode): - (JSC::DFG::canInlineOpcode): - * dfg/DFGNodeType.h: - (DFG): - * dfg/DFGOperations.cpp: - * dfg/DFGOperations.h: - * dfg/DFGPredictionPropagationPhase.cpp: - (JSC::DFG::PredictionPropagationPhase::propagate): - * dfg/DFGSpeculativeJIT.h: - (SpeculativeJIT): - (JSC::DFG::SpeculativeJIT::callOperation): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::compileGetDirectOffset): These functions just get a rename: + the constant they need is the first out of line offset along the offset + number line, which is not necessarily the same thing (and is, in this + patch, never the same thing) as the inline capacity of any given object. -2012-05-22 Mark Hahnenberg + (JSC::JIT::emit_op_get_by_pname): + * jit/JITPropertyAccess32_64.cpp: This function changes functionality, + since it needs to convert from the abstract offset number line to an + actual offset in memory, and it can't assume that inline and out-of-line + offsets are contiguous on the number line. - CopiedSpace::contains doesn't check for oversize blocks - https://bugs.webkit.org/show_bug.cgi?id=87180 + (JSC::JIT::compileGetDirectOffset): Updated for rename. - Reviewed by Geoffrey Garen. + (JSC::JIT::emit_op_get_by_pname): Same as emit_op_get_by_pname above. - When doing a conservative scan we use CopiedSpace::contains to determine if a particular - address points into the CopiedSpace. Currently contains() only checks if the address - points to a block in to-space, which means that pointers to oversize blocks may not get scanned. + * llint/LowLevelInterpreter.asm: Updated to mirror changes in PropertyOffset.h, + since we duplicate values from there. - * heap/CopiedSpace.cpp: - (JSC::CopiedSpace::tryAllocateOversize): - (JSC::CopiedSpace::tryReallocateOversize): - (JSC::CopiedSpace::doneFillingBlock): - (JSC::CopiedSpace::doneCopying): - * heap/CopiedSpace.h: Refactored CopiedSpace so that all blocks (oversize and to-space) are - in a single hash set and bloom filter for membership testing. - (CopiedSpace): - * heap/CopiedSpaceInlineMethods.h: - (JSC::CopiedSpace::contains): We check for the normal block first. Since the oversize blocks are - only page aligned, rather than block aligned, we have to re-mask the ptr to check if it's in - CopiedSpace. Also added a helper function of the same name that takes a CopiedBlock* and checks - if it's in CopiedSpace so that check isn't typed out twice. + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: Just like the JIT, most things are just + renames, and get_by_pname changes to do more math. I also standardized + offset calculations to use a hard-coded "-2", to match the JIT. This + isn't really better, but it makes global search and replace easier, + should we choose to refactor this code not to hard-code constants. + + I also renamed loadPropertyAtVariableOffsetKnownNotFinal to + loadPropertyAtVariableOffsetKnownNotInline in order to sever the assumption + that inline capacity is tied to object type, and I changed the 64bit LLInt + to use this -- not using this previously seems to have been an oversight. + + * runtime/JSObject.cpp: + (JSC::JSObject::visitChildren): + (JSC::JSFinalObject::visitChildren): + * runtime/JSObject.h: + (JSC::JSObject::offsetForLocation): + (JSNonFinalObject): + (JSC::JSFinalObject::createStructure): + (JSFinalObject): + (JSC::JSFinalObject::finishCreation): Updated for above changes. + + * runtime/JSPropertyNameIterator.h: + (JSPropertyNameIterator): + (JSC::JSPropertyNameIterator::finishCreation): Store the inline capacity + of our object, since it's not a constant. + + (JSC::JSPropertyNameIterator::getOffset): Removed. This function was + wrong. Luckily, it was also unused, since the C++ interpreter is gone. + + * runtime/PropertyMapHashTable.h: + (PropertyTable): Use a helper function instead of hard-coding assumptions + about object types. + + (JSC::PropertyTable::nextOffset): + * runtime/PropertyOffset.h: (JSC): - (JSC::CopiedSpace::startedCopying): - (JSC::CopiedSpace::addNewBlock): + (JSC::checkOffset): + (JSC::validateOffset): + (JSC::isInlineOffset): + (JSC::numberOfSlotsForLastOffset): + (JSC::propertyOffsetFor): Refactored these functions to take inline capacity + as an argument, since it's not fixed at compile time anymore. + + * runtime/Structure.cpp: + (JSC::Structure::Structure): + (JSC::Structure::flattenDictionaryStructure): + (JSC::Structure::putSpecificValue): + * runtime/Structure.h: + (Structure): + (JSC::Structure::outOfLineCapacity): + (JSC::Structure::hasInlineStorage): + (JSC::Structure::inlineCapacity): + (JSC::Structure::inlineSize): + (JSC::Structure::firstValidOffset): + (JSC::Structure::lastValidOffset): + (JSC::Structure::create): Removed some hard-coded assumptions about inline + capacity and object type, and replaced with more liberal use of helper functions. -2012-05-22 Geoffrey Garen +2012-10-03 Michael Saboff - CopiedBlock and MarkedBlock should have proper value semantics (i.e., destructors) - https://bugs.webkit.org/show_bug.cgi?id=87172 + OpaqueJSString doesn't optimally handle 8 bit strings + https://bugs.webkit.org/show_bug.cgi?id=98300 - Reviewed by Oliver Hunt and Phil Pizlo. + Reviewed by Geoffrey Garen. - This enables MarkedBlock to own non-trivial sub-objects that require - destruction. It also fixes a FIXME about casting a CopiedBlock to a - MarkedBlock at destroy time. + Change OpaqueJSString to store and manage a String instead of a UChar buffer. + The member string is a copy of any string used during creation. - CopiedBlock and MarkedBlock now accept an allocation chunk at create - time and return it at destroy time. Their client is expected to - allocate, recycle, and destroy these chunks. + * API/OpaqueJSString.cpp: + (OpaqueJSString::create): + (OpaqueJSString::identifier): + * API/OpaqueJSString.h: + (OpaqueJSString::characters): + (OpaqueJSString::length): + (OpaqueJSString::string): + (OpaqueJSString::OpaqueJSString): + (OpaqueJSString): - * heap/BlockAllocator.cpp: - (JSC::BlockAllocator::releaseFreeBlocks): - (JSC::BlockAllocator::blockFreeingThreadMain): Don't call MarkedBlock::destroy - because we expect that to be called before a block is put on our free - list now. Do manually deallocate our allocation chunk because that's - our job now. +2012-10-03 Filip Pizlo - * heap/BlockAllocator.h: - (BlockAllocator): - (JSC::BlockAllocator::allocate): Allocate never fails now. This is a - cleaner abstraction because only one object does all the VM allocation - and deallocation. Caching is an implementation detail. + Array.splice should be fast when it is used to remove elements other than the very first + https://bugs.webkit.org/show_bug.cgi?id=98236 - (JSC::BlockAllocator::deallocate): We take an allocation chunk argument - instead of a block because we now expect the block to have been destroyed - before we recycle its memory. For convenience, we still use the HeapBlock - class as our linked list node. This is OK because HeapBlock is a POD type. + Reviewed by Michael Saboff. - * heap/CopiedBlock.h: - (CopiedBlock): - (JSC::CopiedBlock::create): - (JSC::CopiedBlock::destroy): - (JSC::CopiedBlock::CopiedBlock): Added proper create and destroy functions, - to match MarkedBlock. + Applied the same technique that was used to optimize the unshift case of splice in + http://trac.webkit.org/changeset/129676. This is a >20x speed-up on programs that + use splice for element removal. - * heap/CopiedSpace.cpp: - (JSC::CopiedSpace::tryAllocateOversize): - (JSC::CopiedSpace::tryReallocateOversize): - (JSC::CopiedSpace::doneCopying): - (JSC::CopiedSpace::getFreshBlock): - (JSC::CopiedSpace::freeAllBlocks): - * heap/CopiedSpaceInlineMethods.h: - (JSC::CopiedSpace::recycleBlock): Make sure to call destroy before - returning a block to the BlockAllocator. Otherwise, our destructors - won't run. (If we get this wrong now, we'll get a compile error.) + * runtime/ArrayPrototype.cpp: + (JSC::shift): + * runtime/JSArray.cpp: + (JSC::JSArray::shiftCount): + * runtime/JSArray.h: + (JSArray): - * heap/HeapBlock.h: - (JSC::HeapBlock::HeapBlock): const! +2012-09-16 Mark Hahnenberg - * heap/MarkedAllocator.cpp: - (JSC::MarkedAllocator::allocateBlock): No need to distinguish between - create and recycle -- MarkedBlock always accepts memory allocated by - its client now. + Delayed structure sweep can leak structures without bound + https://bugs.webkit.org/show_bug.cgi?id=96546 - * heap/MarkedBlock.cpp: - (JSC::MarkedBlock::create): Don't allocate memory -- we assume that we're - passed already-allocated memory, to clarify the responsibility for VM - recycling. + Reviewed by Geoffrey Garen. - (JSC::MarkedBlock::destroy): Do run our destructor before giving back - our VM -- that is the whole point of this patch. + This patch gets rid of the separate Structure allocator in the MarkedSpace and adds two new destructor-only + allocators. We now have separate allocators for our three types of objects: those objects with no destructors, + those objects with destructors and with immortal structures, and those objects with destructors that don't have + immortal structures. All of the objects of the third type (destructors without immortal structures) now + inherit from a new class named JSDestructibleObject (which in turn is a subclass of JSNonFinalObject), which stores + the ClassInfo for these classes at a fixed offset for safe retrieval during sweeping/destruction. + * API/JSCallbackConstructor.cpp: Use JSDestructibleObject for JSCallbackConstructor. + (JSC): + (JSC::JSCallbackConstructor::JSCallbackConstructor): + * API/JSCallbackConstructor.h: + (JSCallbackConstructor): + * API/JSCallbackObject.cpp: Inherit from JSDestructibleObject for normal JSCallbackObjects and use a finalizer for + JSCallbackObject, since JSGlobalObject also uses a finalizer. + (JSC): + (JSC::::create): We need to move the create function for JSCallbackObject out of line so we can add + the finalizer for it. We don't want to add the finalizer is something like finishCreation in case somebody decides + to subclass this. We use this same technique for many other subclasses of JSGlobalObject. + (JSC::::createStructure): + * API/JSCallbackObject.h: + (JSCallbackObject): + (JSC): + * API/JSClassRef.cpp: Change all the JSCallbackObject to use JSDestructibleObject instead. + (OpaqueJSClass::prototype): + * API/JSObjectRef.cpp: Ditto. + (JSObjectMake): + (JSObjectGetPrivate): + (JSObjectSetPrivate): + (JSObjectGetPrivateProperty): + (JSObjectSetPrivateProperty): + (JSObjectDeletePrivateProperty): + * API/JSValueRef.cpp: Ditto. + (JSValueIsObjectOfClass): + * API/JSWeakObjectMapRefPrivate.cpp: Ditto. + * JSCTypedArrayStubs.h: + (JSC): + * JavaScriptCore.xcodeproj/project.pbxproj: + * dfg/DFGSpeculativeJIT.h: Use the proper allocator type when doing inline allocation in the DFG. + (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): + (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject): + * heap/Heap.cpp: + (JSC): + * heap/Heap.h: Add accessors for the various types of allocators now. Also remove the isSafeToSweepStructures function + since it's always safe to sweep Structures now. + (JSC::Heap::allocatorForObjectWithNormalDestructor): + (JSC::Heap::allocatorForObjectWithImmortalStructureDestructor): + (Heap): + (JSC::Heap::allocateWithNormalDestructor): + (JSC): + (JSC::Heap::allocateWithImmortalStructureDestructor): + * heap/IncrementalSweeper.cpp: Remove all the logic to detect when it's safe to sweep Structures from the + IncrementalSweeper since it's always safe to sweep Structures now. + (JSC::IncrementalSweeper::IncrementalSweeper): + (JSC::IncrementalSweeper::sweepNextBlock): + (JSC::IncrementalSweeper::startSweeping): + (JSC::IncrementalSweeper::willFinishSweeping): + (JSC): + * heap/IncrementalSweeper.h: + (IncrementalSweeper): + * heap/MarkedAllocator.cpp: Remove the logic that was preventing us from sweeping Structures if it wasn't safe. Add + tracking of the specific destructor type of allocator. + (JSC::MarkedAllocator::tryAllocateHelper): + (JSC::MarkedAllocator::allocateBlock): + * heap/MarkedAllocator.h: + (JSC::MarkedAllocator::destructorType): + (MarkedAllocator): + (JSC::MarkedAllocator::MarkedAllocator): + (JSC::MarkedAllocator::init): + * heap/MarkedBlock.cpp: Add all the destructor type stuff to MarkedBlocks so that we do the right thing when sweeping. + We also use the stored destructor type to determine the right thing to do in all JSCell::classInfo() calls. + (JSC::MarkedBlock::create): (JSC::MarkedBlock::MarkedBlock): + (JSC): + (JSC::MarkedBlock::specializedSweep): + (JSC::MarkedBlock::sweep): + (JSC::MarkedBlock::sweepHelper): * heap/MarkedBlock.h: - (MarkedBlock): - * heap/MarkedSpace.cpp: const! - - (JSC::MarkedSpace::freeBlocks): Make sure to call destroy before - returning a block to the BlockAllocator. Otherwise, our destructors - won't run. (If we get this wrong now, we'll get a compile error.) + (JSC): + (JSC::MarkedBlock::allocator): + (JSC::MarkedBlock::destructorType): + * heap/MarkedSpace.cpp: Add the new destructor allocators to MarkedSpace. + (JSC::MarkedSpace::MarkedSpace): + (JSC::MarkedSpace::resetAllocators): + (JSC::MarkedSpace::canonicalizeCellLivenessData): + (JSC::MarkedSpace::isPagedOut): + (JSC::MarkedSpace::freeBlock): + * heap/MarkedSpace.h: + (MarkedSpace): + (JSC::MarkedSpace::immortalStructureDestructorAllocatorFor): + (JSC::MarkedSpace::normalDestructorAllocatorFor): + (JSC::MarkedSpace::allocateWithImmortalStructureDestructor): + (JSC::MarkedSpace::allocateWithNormalDestructor): + (JSC::MarkedSpace::forEachBlock): + * heap/SlotVisitor.cpp: Add include because the symbol was needed in an inlined function. + * jit/JIT.h: Make sure we use the correct allocator when doing inline allocations in the baseline JIT. + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateBasicJSObject): + (JSC::JIT::emitAllocateJSFinalObject): + (JSC::JIT::emitAllocateJSArray): + * jsc.cpp: + (GlobalObject::create): Add finalizer here since JSGlobalObject needs to use a finalizer instead of inheriting from + JSDestructibleObject. + * runtime/Arguments.cpp: Inherit from JSDestructibleObject. + (JSC): + * runtime/Arguments.h: + (Arguments): + (JSC::Arguments::Arguments): + * runtime/ErrorPrototype.cpp: Added an assert to make sure we have a trivial destructor. + (JSC): + * runtime/Executable.h: Indicate that all of the Executable* classes have immortal Structures. + (JSC): + * runtime/InternalFunction.cpp: Inherit from JSDestructibleObject. + (JSC): + (JSC::InternalFunction::InternalFunction): + * runtime/InternalFunction.h: + (InternalFunction): + * runtime/JSCell.h: Added two static bools, needsDestruction and hasImmortalStructure, that classes can override + to indicate at compile time which part of the heap they should be allocated in. + (JSC::allocateCell): Use the appropriate allocator depending on the destructor type. + * runtime/JSDestructibleObject.h: Added. New class that stores the ClassInfo of any subclass so that it can be + accessed safely when the object is being destroyed. + (JSC): + (JSDestructibleObject): + (JSC::JSDestructibleObject::classInfo): + (JSC::JSDestructibleObject::JSDestructibleObject): + (JSC::JSCell::classInfo): Checks the current MarkedBlock to see where it should get the ClassInfo from so that it's always safe. + * runtime/JSGlobalObject.cpp: JSGlobalObject now uses a finalizer instead of a destructor so that it can avoid forcing all + of its relatives in the inheritance hierarchy (e.g. JSScope) to use destructors as well. + (JSC::JSGlobalObject::reset): + * runtime/JSGlobalObject.h: + (JSGlobalObject): + (JSC::JSGlobalObject::createRareDataIfNeeded): Since we always create a finalizer now, we don't have to worry about adding one + for the m_rareData field when it's created. + (JSC::JSGlobalObject::create): + (JSC): + * runtime/JSGlobalThis.h: Inherit from JSDestructibleObject. + (JSGlobalThis): + (JSC::JSGlobalThis::JSGlobalThis): + * runtime/JSPropertyNameIterator.h: Has an immortal Structure. + (JSC): + * runtime/JSScope.cpp: + (JSC): + * runtime/JSString.h: Has an immortal Structure. + (JSC): + * runtime/JSWrapperObject.h: Inherit from JSDestructibleObject. + (JSWrapperObject): + (JSC::JSWrapperObject::JSWrapperObject): + * runtime/MathObject.cpp: Cleaning up some of the inheritance stuff. + (JSC): + * runtime/NameInstance.h: Inherit from JSDestructibleObject. + (NameInstance): + * runtime/RegExp.h: Has immortal Structure. + (JSC): + * runtime/RegExpObject.cpp: Inheritance cleanup. + (JSC): + * runtime/SparseArrayValueMap.h: Has immortal Structure. + (JSC): + * runtime/Structure.h: Has immortal Structure. + (JSC): + * runtime/StructureChain.h: Ditto. + (JSC): + * runtime/SymbolTable.h: Ditto. + (SharedSymbolTable): + (JSC): -== Rolled over to ChangeLog-2012-05-22 == +== Rolled over to ChangeLog-2012-10-02 == diff --git a/Source/JavaScriptCore/ChangeLog-2012-10-02 b/Source/JavaScriptCore/ChangeLog-2012-10-02 new file mode 100644 index 000000000..ded22e693 --- /dev/null +++ b/Source/JavaScriptCore/ChangeLog-2012-10-02 @@ -0,0 +1,20888 @@ +2012-10-02 Filip Pizlo + + REGRESSION(r128400): ASSERT (crash in release) @ app.asana.com + https://bugs.webkit.org/show_bug.cgi?id=98175 + + Reviewed by Oliver Hunt. + + It's bad karma to create a new structure while stealing another structure's property table + while leaving the m_offset unset. Eventually someone will then steal your property table, and + then you won't know how many properties you have anymore. + + * runtime/Structure.cpp: + (JSC::Structure::nonPropertyTransition): + +2012-10-02 Michael Saboff + + Comment additions after r130109 + + Rubber stamped by Geoffrey Garen. + + Updated comments to how array storage works. + + * runtime/ArrayStorage.h: + * runtime/JSArray.cpp: + +2012-10-01 Mark Hahnenberg + + Block freeing thread should sleep indefinitely when there's no work to do + https://bugs.webkit.org/show_bug.cgi?id=98084 + + Reviewed by Geoffrey Garen. + + Currently the block freeing thread wakes up once a second to check if there are any blocks + for it to release back to the OS. This is wasteful. We should change it to sleep when it + realizes there are no more blocks to free. Any thread that returns a block to the BlockAllocator + should then notify the block freeing thread that there is more work to do now. + + * heap/BlockAllocator.cpp: + (JSC::BlockAllocator::BlockAllocator): + (JSC::BlockAllocator::blockFreeingThreadMain): + * heap/BlockAllocator.h: + (BlockAllocator): + (JSC::BlockAllocator::deallocate): + +2012-10-01 Michael Saboff + + JSArray::unshiftCountSlowCase needs to clear array slots when adding space to end of array + https://bugs.webkit.org/show_bug.cgi?id=98101 + + Reviewed by Filip Pizlo. + + Cleared new array entries when adding to end due to shifting contents to lower memory. Also + checnaged the order of moving array contents and metadata in the shift left case to avoid + clobbering the metadata with array contents. Optimized the to only make a memmove if the + count is non-zero. + + * runtime/JSArray.cpp: + (JSC::JSArray::unshiftCountSlowCase): + (JSC::JSArray::unshiftCount): + +2012-10-01 Filip Pizlo + + Address a FIXME in JSArray::sort + https://bugs.webkit.org/show_bug.cgi?id=98080 + + + Reviewed by Oliver Hunt. + + Get rid of fast sorting of sparse maps. I don't know that it's broken but I do know that we don't + have coverage for it. Then also address the FIXME in JSArray::sort regarding side-effecting + compare functions. + + * runtime/ArrayPrototype.cpp: + (JSC::arrayProtoFuncSort): + * runtime/JSArray.cpp: + (JSC::JSArray::sortNumeric): + (JSC::JSArray::sort): + (JSC::JSArray::compactForSorting): + * runtime/JSArray.h: + (JSArray): + * runtime/JSObject.h: + (JSC::JSObject::hasSparseMap): + (JSObject): + +2012-10-01 Jonathan Liu + + Remove unused sys/mman.h include + https://bugs.webkit.org/show_bug.cgi?id=97995 + + Reviewed by Kentaro Hara. + + The sys/mman.h is not used and removing it improves portability as not + all systems have sys/mman.h. + + * jit/ExecutableAllocatorFixedVMPool.cpp: + +2012-09-28 Filip Pizlo + + ASSERTION in m_graph[tailNodeIndex].op() == Flush || m_graph[tailNodeIndex].op() == SetLocal on plus.google.com + https://bugs.webkit.org/show_bug.cgi?id=97656 + + Reviewed by Mark Hahnenberg. + + There were two bugs here: + + 1) In case of multiple GetLocals to the same captured variable, the bytecode parser would linke the first, + rather than the last, of the GetLocals into the vars-at-tail table. + + 2) The constant folding phase was asserting that any GetLocal it eliminates must be linked into the + vars-at-tail table, when for captured variables only the last of those should be. + + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::getLocal): + * dfg/DFGConstantFoldingPhase.cpp: + (JSC::DFG::ConstantFoldingPhase::foldConstants): + +2012-09-28 Filip Pizlo + + DFGStructureHoistingPhase SetLocal assumes StructureTransitionWatchpoint has a structure set + https://bugs.webkit.org/show_bug.cgi?id=97810 + + Reviewed by Mark Hahnenberg. + + No tests because this can't happen in ToT: the structure check hoisting phase runs before any + CFA or folding, so the only StructureTransitionWatchpoints it will see are the ones inserted + by the parser. But the parser will only insert StructureTransitinWatchpoints on constants, which + will not be subject to SetLocals. + + Still, it would be good to fix this in case things changed. + + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + +2012-09-27 Mark Lam + + Put initializeHostCallReturnValue() behind #if ENABLE(JIT). + Fixes non JIT builds. + https://bugs.webkit.org/show_bug.cgi?id=97838. + + Reviewed by John Sullivan. + + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::JSGlobalData): + +2012-09-27 Mark Lam + + Fixed CallFrameClosure::resetCallFrame() to use the valid + range of argument index values. + https://bugs.webkit.org/show_bug.cgi?id=97836. + + Reviewed by Gavin Barraclough. + + * interpreter/CallFrame.h: + (ExecState): + * interpreter/CallFrameClosure.h: + (JSC::CallFrameClosure::resetCallFrame): + +2012-09-27 Patrick Gansterer + + Fix usage of COMPILER() macros + https://bugs.webkit.org/show_bug.cgi?id=97642 + + Reviewed by Geoffrey Garen. + + Add COMPILER(GCC) around compiler specific code and remove it from generic code. + This allows us to implement the DFG code for other compilers to in a next step. + + * dfg/DFGOperations.cpp: + * jit/HostCallReturnValue.h: + +2012-09-27 Andreas Kling + + 3.20MB below FunctionParameters::create() on Membuster3. + + + Reviewed by Anders Carlsson. + + Figure out the exact space needed for parameter identifiers and use reserveInitialCapacity(). + Reduces memory consumption on Membuster3 by ~1.60 MB. + + * parser/Nodes.cpp: + (JSC::FunctionParameters::FunctionParameters): + +2012-09-27 Csaba Osztrogonác , Tor Arne Vestbø + + [Qt] Enable the LLInt on Linux + https://bugs.webkit.org/show_bug.cgi?id=95749 + + Reviewed by Simon Hausmann. + + * DerivedSources.pri: + * JavaScriptCore.pro: + * LLIntOffsetsExtractor.pro: Added. + * Target.pri: + +2012-09-27 Patrick Gansterer + + [CMake] Fix build with static JavaScriptCore library + + * shell/CMakeLists.txt: Define STATICALLY_LINKED_WITH_JavaScriptCore if + JavaScriptCore_LIBRARY_TYPE is set to STATIC. + +2012-09-26 Gavin Barraclough + + Proxy the global this in JSC + https://bugs.webkit.org/show_bug.cgi?id=97734 + + Reviewed by Filip Pizlo. + + Eeep – fix a bug - was leaving the global this proxy's structure's globalObject as 0, + and setting the proxy's prototype as the global object, rather than its prototype. + + * jsc.cpp: + (GlobalObject::create): + * runtime/JSProxy.h: + (JSC::JSProxy::createStructure): + +2012-09-26 Gavin Barraclough + + Speculative Windows build fix. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + +2012-09-26 Filip Pizlo + + Unreviewed, 32-bit build fix. + + * llint/LowLevelInterpreter32_64.asm: + +2012-09-26 Filip Pizlo + + jneq_ptr shouldn't have a pointer + https://bugs.webkit.org/show_bug.cgi?id=97739 + + Reviewed by Oliver Hunt. + + Slamming pointers directly into bytecode is sometimes cool, but in this case it's + unwieldy and confusing. Switched the instruction to use an enum instead. This has + zero effect on code gen behavior in the JITs. In the LLInt, there is now more + indirection, but that doesn't affect benchmarks. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * bytecode/Instruction.h: + (JSC::Instruction::Instruction): + (Instruction): + * bytecode/SpecialPointer.cpp: Added. + (JSC): + (JSC::actualPointerFor): + * bytecode/SpecialPointer.h: Added. + (JSC): + (JSC::pointerIsFunction): + (JSC::pointerIsCell): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall): + (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_jneq_ptr): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_jneq_ptr): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::reset): + (JSC): + * runtime/JSGlobalObject.h: + (JSGlobalObject): + (JSC::JSGlobalObject::actualPointerFor): + +2012-09-26 Gavin Barraclough + + REGRESSION (r129456): http/tests/security/xss-eval.html is failing on JSC platforms + https://bugs.webkit.org/show_bug.cgi?id=97529 + + Reviewed by Filip Pizlo. + + A recent patch changed JSC's EvalError behaviour; bring this more into line with other browsers. + + JSC currently throws an EvalError if you try to call eval with a this object that doesn't + match the given eval function. This does not match other browsers, which generally just + ignore the this value that was passed, and eval the string in the eval function's environment. + + * runtime/JSGlobalObjectFunctions.cpp: + (JSC::globalFuncEval): + - Remove EvalError, ignore passed this value. + +2012-09-26 Gavin Barraclough + + Proxy the global this in JSC + https://bugs.webkit.org/show_bug.cgi?id=97734 + + Reviewed by Oliver Hunt. + + Having jsc diverge from WebCore here is not beneficial; it potentially masks bugs and/or performance + problems from command line testing. + + * jsc.cpp: + (GlobalObject::create): + - Create a this value proxy for the global object. + * runtime/JSGlobalObject.h: + (JSGlobalObject): + - Make setGlobalThis protected. + * runtime/JSProxy.h: + (JSC::JSProxy::create): + (JSC::JSProxy::target): + (JSC::JSProxy::finishCreation): + (JSProxy): + - Allow proxy target to be a JSObject, add target to create method. + +2012-09-26 Gavin Barraclough + + Speculative Windows build fix. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + +2012-09-26 Filip Pizlo + + JSObject::ensureArrayStorage() ignores the possibility that extensions have been prevented + https://bugs.webkit.org/show_bug.cgi?id=97719 + + Reviewed by Gavin Barraclough. + + * runtime/JSObject.cpp: + (JSC::JSObject::ensureArrayStorageSlow): + (JSC): + * runtime/JSObject.h: + (JSC::JSObject::ensureArrayStorage): + (JSObject): + +2012-09-26 Gavin Barraclough + + Generalize JSGlobalThis as JSProxy + https://bugs.webkit.org/show_bug.cgi?id=97716 + + Reviewed by Oliver Hunt. + + Generalize JSGlobalThis as JSProxy and move proxying functionality up from the window shell into JSProxy. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::toThisObject): + - Hoist toThisObject from WebCore. + (JSC): + * runtime/JSGlobalObject.h: + - removed include. + (JSC::JSGlobalObject::finishCreation): + - JSGlobalThis -> JSObject + (JSGlobalObject): + - Hoist toThisObject from WebCore. + * runtime/JSGlobalThis.cpp: Removed. + * runtime/JSGlobalThis.h: Removed. + * runtime/JSObject.cpp: + - removed include. + * runtime/JSObject.h: + (JSObject): + (JSC::JSObject::isProxy): + - isGlobalThis -> isProxy + - GlobalThisType -> ProxyType + * runtime/JSProxy.cpp: Copied from Source/JavaScriptCore/runtime/JSGlobalThis.cpp. + (JSC): + (JSC::JSProxy::visitChildren): + (JSC::JSProxy::setTarget): + (JSC::JSProxy::className): + (JSC::JSProxy::getOwnPropertySlot): + (JSC::JSProxy::getOwnPropertySlotByIndex): + (JSC::JSProxy::getOwnPropertyDescriptor): + (JSC::JSProxy::put): + (JSC::JSProxy::putByIndex): + (JSC::JSProxy::putDirectVirtual): + (JSC::JSProxy::defineOwnProperty): + (JSC::JSProxy::deleteProperty): + (JSC::JSProxy::deletePropertyByIndex): + (JSC::JSProxy::getPropertyNames): + (JSC::JSProxy::getOwnPropertyNames): + - Class cretaed from JSGlobalThis, JSDOMWindowShell. + * runtime/JSProxy.h: Copied from Source/JavaScriptCore/runtime/JSGlobalThis.h. + (JSC::JSProxy::create): + (JSC::JSProxy::createStructure): + (JSProxy): + (JSC::JSProxy::target): + (JSC::JSProxy::JSProxy): + - Class cretaed from JSGlobalThis, JSDOMWindowShell. + * runtime/JSType.h: + - GlobalThisType -> ProxyType + +2012-09-26 Michael Saboff + + Add ability for JSArray::unshiftCount to unshift in middle of an array + https://bugs.webkit.org/show_bug.cgi?id=97691 + + Reviewed by Filip Pizlo. + + Changed JSArray::unshiftCount and unshiftCountSlowCase to handle unshifting from the middle of an + array. Depending on where the unshift point is, either the front part of the array will be moved + "left" or the back part will be moved right. Given that unshiftCount only works on contiguous + arrays it is safe to use memmove for the moves. + + This change is worth 25% performance improvement on pdfjs. It doesn't seem to have any impact on + any other benchmarks. + + * runtime/ArrayPrototype.cpp: + (JSC::unshift): + * runtime/JSArray.cpp: + (JSC::JSArray::unshiftCountSlowCase): + (JSC::JSArray::unshiftCount): + * runtime/JSArray.h: + (JSArray): + +2012-09-26 Sheriff Bot + + Unreviewed, rolling out r129592. + http://trac.webkit.org/changeset/129592 + https://bugs.webkit.org/show_bug.cgi?id=97670 + + Failures in Chromium security tests (Requested by schenney on + #webkit). + + * runtime/JSGlobalObjectFunctions.cpp: + (JSC::globalFuncEval): + +2012-09-25 Gavin Barraclough + + REGRESSION (r129456): http/tests/security/xss-eval.html is failing on JSC platforms + https://bugs.webkit.org/show_bug.cgi?id=97529 + + Reviewed by Filip Pizlo. + + A recent patch changed JSC's EvalError behaviour; bring this more into line with other browsers. + + JSC currently throws an EvalError if you try to call eval with a this object that doesn't + match the given eval function. This does not match other browsers, which generally just + ignore the this value that was passed, and eval the string in the eval function's environment. + + * runtime/JSGlobalObjectFunctions.cpp: + (JSC::globalFuncEval): + - Remove EvalError, ignore passed this value. + +2012-09-25 Filip Pizlo + + DFG ArrayPush, ArrayPop don't handle clobbering or having a bad time correctly + https://bugs.webkit.org/show_bug.cgi?id=97535 + + Reviewed by Oliver Hunt. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::handleIntrinsic): + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + +2012-09-25 Geoffrey Garen + + JSC should dump object size inference statistics + https://bugs.webkit.org/show_bug.cgi?id=97618 + + Reviewed by Filip Pizlo. + + Added an option to dump object size inference statistics. + + To see statistics on live objects: + + jsc --showHeapStatistics=1 + + To see cumulative statistics on all objects ever allocated: + + jsc --showHeapStatistics=1 --objectsAreImmortal=1 + + (This is useful for showing GC churn caused by over-allocation.) + + To support this second mode, I refactored Zombies to separate out their + immortality feature so I could reuse it. + + * heap/Heap.cpp: + (JSC::MarkObject): Helper for making things immortal. We have to checked + for being zapped because blocks start out in this state. + + (JSC::StorageStatistics): Gather statistics by walking the heap. Ignore + arrays and hash tables for now because they're not our focus. (We'll + remove these exceptions in future.) + + (JSC::Heap::collect): Moved zombify to the end so it wouldn't interfere + with statistics gathering. + + (JSC::Heap::showStatistics): + (JSC::Heap::markAllObjects): Factored out helper, so statistics could + take advantage of immortal objects. + + (Zombify): Don't mark immortal objects -- that's another class's job now. + + (JSC::Zombify::operator()): + (JSC::Heap::zombifyDeadObjects): Take advantage of forEachDeadCell instead + of rolling our own. + + * heap/Heap.h: + (Heap): + * heap/MarkedSpace.h: + (MarkedSpace): + (JSC::MarkedSpace::forEachDeadCell): Added, so clients don't have to do + the iteration logic themselves. + + * runtime/Options.cpp: + (JSC::Options::initialize): + * runtime/Options.h: New options, listed above. Make sure to initialize + based on environment variable first, so we can override with specific settings. + +2012-09-25 Filip Pizlo + + We shouldn't use the optimized versions of shift/unshift if the user is doing crazy things to the array + https://bugs.webkit.org/show_bug.cgi?id=97603 + + + Reviewed by Gavin Barraclough. + + You changed the length behind our backs? No optimizations for you then! + + * runtime/ArrayPrototype.cpp: + (JSC::shift): + (JSC::unshift): + * runtime/JSArray.cpp: + (JSC::JSArray::shiftCount): + +2012-09-25 Filip Pizlo + + JSC bindings appear to sometimes ignore the possibility of arrays being in sparse mode + https://bugs.webkit.org/show_bug.cgi?id=95610 + + Reviewed by Oliver Hunt. + + Add better support for quickly accessing the indexed storage from bindings. + + * runtime/JSObject.h: + (JSC::JSObject::tryGetIndexQuickly): + (JSObject): + (JSC::JSObject::getDirectIndex): + (JSC::JSObject::getIndex): + +2012-09-25 Filip Pizlo + + Structure check hoisting phase doesn't know about the side-effecting nature of Arrayify + https://bugs.webkit.org/show_bug.cgi?id=97537 + + Reviewed by Mark Hahnenberg. + + No tests because if we use Arrayify then we also use PutByVal(BlankToXYZ), and the latter is + already known to be side-effecting. So this bug shouldn't have had any symptoms, as far as I + can tell. + + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + +2012-09-25 Gavin Barraclough + + Regression: put beyond vector length prefers prototype setters to sparse properties + https://bugs.webkit.org/show_bug.cgi?id=97593 + + Reviewed by Geoff Garen & Filip Pizlo. + + * runtime/JSObject.cpp: + (JSC::JSObject::putByIndexBeyondVectorLength): + - Check for self properties in the sparse map - if present, don't examine the protochain. + +2012-09-24 Gavin Barraclough + + https://bugs.webkit.org/show_bug.cgi?id=97530 + Regression, freeze applied to numeric properties of non-array objects + + Reviewed by Filip Pizlo. + + Object.freeze has a fast implementation in JSObject, but this hasn't been updated to take into account numeric properties in butterflies. + For now, just fall back to the generic implementation if the object has numeric properties. + + * runtime/ObjectConstructor.cpp: + (JSC::objectConstructorFreeze): + - fallback if the object has a non-zero indexed property vector length. + +2012-09-24 Gavin Barraclough + + Bug in numeric accessors on global environment + https://bugs.webkit.org/show_bug.cgi?id=97526 + + Reviewed by Geoff Garen. + + I've hit this assert in test262 in browser, but haven't yet worked out how to repro in a test case :-/ + The sparsemap is failing to map back from the global object to the window shell. + A test case would need to resolve a numeric property name against the global environment. + + (JSC::SparseArrayEntry::get): + (JSC::SparseArrayEntry::put): + - Add missing toThisObject calls. + +2012-09-24 Filip Pizlo + + SerializedScriptValue isn't aware of indexed storage, but should be + https://bugs.webkit.org/show_bug.cgi?id=97515 + + + Reviewed by Sam Weinig. + + Export a method that WebCore now uses. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + * runtime/JSObject.h: + (JSObject): + +2012-09-24 Gavin Barraclough + + Remove JSObject::unwrappedGlobalObject(), JSObject::unwrappedObject() + https://bugs.webkit.org/show_bug.cgi?id=97519 + + Reviewed by Geoff Garen. + + unwrappedGlobalObject() was only needed because globalObject() doesn't always return a helpful result - + specifically for WebCore's window shell the structure's globalObject is set to null. We can fix this by + simply keeping the structure up to date as the window navigates, obviating the need for this function. + + The only other use of unwrappedObject() came from globalFuncEval(), and this can be trivially removed + by flipping the way we perform this globalObject check (which we may also be able to remove!) - instead + of getting the globalObject from the provided this value & comparing to the expected globalObject, we + can get the this value from the expected globalObject, and compare to that provided. + + * runtime/JSGlobalObject.cpp: + - Call globalObject() instead of unwrappedGlobalObject(). + * runtime/JSGlobalObjectFunctions.cpp: + (JSC::globalFuncEval): + - Changed to compare this object values, instead of globalObjects - + this means we only need to be able to map globalObject -> this, + and not vice versa. + * runtime/JSObject.cpp: + (JSC::JSObject::allowsAccessFrom): + (JSC::JSObject::createInheritorID): + - Call globalObject() instead of unwrappedGlobalObject(). + * runtime/JSObject.h: + (JSObject): + - Removed unwrappedGlobalObject(), unwrappedObject(). + +2012-09-24 Mark Lam + + Deleting the classic interpreter and cleaning up some build options. + https://bugs.webkit.org/show_bug.cgi?id=96969. + + Reviewed by Geoffrey Garen. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + (JSC::CodeBlock::finalizeUnconditionally): + (JSC::CodeBlock::stronglyVisitStrongReferences): + (JSC): + * bytecode/Instruction.h: + (JSC::Instruction::Instruction): + * interpreter/AbstractPC.cpp: + (JSC::AbstractPC::AbstractPC): + * interpreter/AbstractPC.h: + (AbstractPC): + * interpreter/CallFrame.h: + (ExecState): + * interpreter/Interpreter.cpp: + (JSC): + (JSC::Interpreter::Interpreter): + (JSC::Interpreter::~Interpreter): + (JSC::Interpreter::initialize): + (JSC::Interpreter::isOpcode): + (JSC::Interpreter::unwindCallFrame): + (JSC::getLineNumberForCallFrame): + (JSC::getCallerInfo): + (JSC::getSourceURLFromCallFrame): + (JSC::Interpreter::execute): + (JSC::Interpreter::executeCall): + (JSC::Interpreter::executeConstruct): + (JSC::Interpreter::retrieveArgumentsFromVMCode): + (JSC::Interpreter::retrieveCallerFromVMCode): + (JSC::Interpreter::retrieveLastCaller): + * interpreter/Interpreter.h: + (JSC::Interpreter::getOpcodeID): + (Interpreter): + * jit/ExecutableAllocatorFixedVMPool.cpp: + (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator): + * offlineasm/asm.rb: + * offlineasm/offsets.rb: + * runtime/Executable.cpp: + (JSC::EvalExecutable::compileInternal): + (JSC::ProgramExecutable::compileInternal): + (JSC::FunctionExecutable::compileForCallInternal): + (JSC::FunctionExecutable::compileForConstructInternal): + * runtime/Executable.h: + (JSC::NativeExecutable::create): + (NativeExecutable): + (JSC::NativeExecutable::finishCreation): + * runtime/JSGlobalData.cpp: + (JSC): + (JSC::JSGlobalData::JSGlobalData): + (JSC::JSGlobalData::getHostFunction): + * runtime/JSGlobalData.h: + (JSGlobalData): + (JSC::JSGlobalData::canUseJIT): + (JSC::JSGlobalData::canUseRegExpJIT): + * runtime/Options.cpp: + (JSC::Options::initialize): + +2012-09-24 Filip Pizlo + + Nested try/finally should not confuse the finally unpopper in BytecodeGenerator::emitComplexJumpScopes + https://bugs.webkit.org/show_bug.cgi?id=97508 + + + Reviewed by Sam Weinig. + + We're reusing some vector for multiple iterations of a loop, but we were forgetting to clear its + contents from one iteration to the next. Hence if you did multiple iterations of finally unpopping + (like in a nested try/finally and a jump out of both of them) then you'd get a corrupted try + context stack afterwards. + + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::emitComplexJumpScopes): + +2012-09-24 Filip Pizlo + + ValueToInt32 bool case does bad things to registers + https://bugs.webkit.org/show_bug.cgi?id=97505 + + + Reviewed by Mark Hahnenberg. + + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compileValueToInt32): + +2012-09-24 Mark Lam + + Add cloopDo instruction for debugging the llint C++ backend. + https://bugs.webkit.org/show_bug.cgi?id=97502. + + Reviewed by Geoffrey Garen. + + * offlineasm/cloop.rb: + * offlineasm/instructions.rb: + * offlineasm/parser.rb: + +2012-09-24 Filip Pizlo + + JSArray::putByIndex asserts with readonly property on prototype + https://bugs.webkit.org/show_bug.cgi?id=97435 + + + Reviewed by Geoffrey Garen. + + Boy, there were some problems: + + - putDirectIndex() should know that it can set the index quickly even if it's a hole and we're + in SlowPut mode, since that's the whole point of PutDirect. + + - We should have a fast path for putByIndex(). + + - The LiteralParser should not use push(), since that may throw if we're having a bad time. + + * interpreter/Interpreter.cpp: + (JSC::eval): + * runtime/JSObject.h: + (JSC::JSObject::putByIndexInline): + (JSObject): + (JSC::JSObject::putDirectIndex): + * runtime/LiteralParser.cpp: + (JSC::::parse): + +2012-09-24 Mark Lam + + Added a missing "if VALUE_PROFILER" around an access to ArrayProfile record. + https://bugs.webkit.org/show_bug.cgi?id=97496. + + Reviewed by Filip Pizlo. + + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + +2012-09-24 Geoffrey Garen + + Inlined activation tear-off in the DFG + https://bugs.webkit.org/show_bug.cgi?id=97487 + + Reviewed by Filip Pizlo. + + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: Activation tear-off is always inlined now, so I + removed its out-of-line implementation. + + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): Inlined the variable copy and update + of JSVariableObject::m_registers. This usually turns into < 10 instructions, + which is close to pure win as compared to the operation function call. + + * runtime/JSActivation.h: + (JSActivation): + (JSC::JSActivation::registersOffset): + (JSC::JSActivation::tearOff): + (JSC::JSActivation::isTornOff): + (JSC): + (JSC::JSActivation::storageOffset): + (JSC::JSActivation::storage): Tiny bit of refactoring so the JIT can + share the pointer math helper functions we use internally. + +2012-09-24 Balazs Kilvady + + MIPS: store8 functions added to MacroAssembler. + + MIPS store8 functions + https://bugs.webkit.org/show_bug.cgi?id=97243 + + Reviewed by Oliver Hunt. + + Add MIPS store8 functions. + + * assembler/MIPSAssembler.h: + (JSC::MIPSAssembler::lhu): New function. + (MIPSAssembler): + (JSC::MIPSAssembler::sb): New function. + (JSC::MIPSAssembler::sh): New function. + * assembler/MacroAssemblerMIPS.h: + (JSC::MacroAssemblerMIPS::store8): New function. + (MacroAssemblerMIPS): + (JSC::MacroAssemblerMIPS::store16): New function. + +2012-09-23 Geoffrey Garen + + PutScopedVar should not be marked as clobbering the world + https://bugs.webkit.org/show_bug.cgi?id=97416 + + Reviewed by Filip Pizlo. + + No performance change. + + PutScopedVar doesn't have arbitrary side-effects, so it shouldn't be marked + as such. + + * dfg/DFGNodeType.h: + (DFG): + +2012-09-23 Geoffrey Garen + + I accidentally the whole 32-bit :(. + + Unbreak the DFG in 32-bit with the 32-bit path I forgot in my last patch. + + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-09-23 Byungwoo Lee + + Fix build warnings : -Wunused-parameter, -Wparentheses, -Wuninitialized. + https://bugs.webkit.org/show_bug.cgi?id=97306 + + Reviewed by Benjamin Poulain. + + Fix build warning about -Wunused-parameter on MachineStackMarker.cpp, + LLIntSlowPaths.cpp, DatePrototype.cpp, Options.cpp by using + UNUSED_PARAM() macro or remove parameter name. + + * heap/MachineStackMarker.cpp: + (JSC::pthreadSignalHandlerSuspendResume): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::entryOSR): + * runtime/DatePrototype.cpp: + (JSC::formatLocaleDate): + * runtime/Options.cpp: + (JSC::computeNumberOfGCMarkers): + +2012-09-23 Gavin Barraclough + + Sorting a non-array creates propreties (spec-violation) + https://bugs.webkit.org/show_bug.cgi?id=25477 + + Reviewed by Oliver Hunt. + + We're just calling get() to get properties, which is converting missing properties to + undefined. Hole values should be retained, and moved to the end of the array. + + * runtime/ArrayPrototype.cpp: + (JSC::getOrHole): + - Helper function, returns JSValue() instead of undefined for missing properties. + (JSC::arrayProtoFuncSort): + - Implemented per 15.4.4.11, see comments above. + +2012-09-23 Geoffrey Garen + + CSE for access to closure variables (get_/put_scoped_var) + https://bugs.webkit.org/show_bug.cgi?id=97414 + + Reviewed by Oliver Hunt. + + I separated loading a scope from loading its storage pointer, so we can + CSE the storage pointer load. Then, I copied the global var CSE and adjusted + it for closure vars. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): Renamed GetScopeChain => GetScope to + reflect renames from a few weeks ago. + + Added a case for the storage pointer load, similar to object storage pointer load. + + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): Added an independent node for + the storage pointer. + + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::scopedVarLoadElimination): + (CSEPhase): + (JSC::DFG::CSEPhase::scopedVarStoreElimination): + (JSC::DFG::CSEPhase::getScopeLoadElimination): + (JSC::DFG::CSEPhase::getScopeRegistersLoadElimination): + (JSC::DFG::CSEPhase::setLocalStoreElimination): + (JSC::DFG::CSEPhase::performNodeCSE): Copied globalVarLoad/StoreElimination + and adapted the same logic to closure vars. + + * dfg/DFGNode.h: + (JSC::DFG::Node::hasScopeChainDepth): + (JSC::DFG::Node::scope): + (Node): + * dfg/DFGNodeType.h: + (DFG): GetScopedVar and GetGlobalVar are no longer MustGenerate. I'm not + sure why they ever were. But these are simple load operations so, if they're + unused, they're truly dead. + + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): Updated for renames and split-out + node for getting the storage pointer. + +2012-09-21 Geoffrey Garen + + Unreviewed, rolled out a line I committed by accident. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::execute): + +2012-09-21 Geoffrey Garen + + Optimized closures that capture arguments + https://bugs.webkit.org/show_bug.cgi?id=97358 + + Reviewed by Oliver Hunt. + + Previously, the activation object was responsible for capturing all + arguments in a way that was convenient for the arguments object. Now, + we move all captured variables into a contiguous region in the stack, + allocate an activation for exactly that size, and make the arguments + object responsible for knowing all the places to which arguments could + have moved. + + This seems like the right tradeoff because + + (a) Closures are common and long-lived, so we want them to be small. + + (b) Our primary strategy for optimizing the arguments object is to make + it go away. If you're allocating arguments objects, you're already having + a bad time. + + (c) It's common to use either the arguments object or named argument + closure, but not both. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + (JSC::CodeBlock::CodeBlock): + * bytecode/CodeBlock.h: + (JSC::CodeBlock::argumentsRegister): + (JSC::CodeBlock::activationRegister): + (JSC::CodeBlock::isCaptured): + (JSC::CodeBlock::argumentIndexAfterCapture): m_numCapturedVars is gone + now -- we have an explicit range instead. + + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::BytecodeGenerator): Move captured arguments + into the captured region of local variables for space efficiency. Record + precise data about where they moved for the sake of the arguments object. + + Some of this data was previously wrong, but it didn't cause any problems + because the arguments weren't actually moving. + + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::flushArgumentsAndCapturedVariables): Don't + assume that captured vars are in any particular location -- always ask + the CodeBlock. This is better encapsulation. + + (JSC::DFG::ByteCodeParser::parseCodeBlock): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): I rename things sometimes. + + * runtime/Arguments.cpp: + (JSC::Arguments::tearOff): Account for a particularly nasty edge case. + + (JSC::Arguments::didTearOffActivation): Don't allocate our slow arguments + data on tear-off. We need to allocate it eagerly instead, since we need + to know about displaced, captured arguments during access before tear-off. + + * runtime/Arguments.h: + (JSC::Arguments::allocateSlowArguments): + (JSC::Arguments::argument): Tell our slow arguments array where all arguments + are, even if they are not captured. This simplifies some things, so we don't + have to account explicitly for the full matrix of (not torn off, torn off) + * (captured, not captured). + + (JSC::Arguments::finishCreation): Allocate our slow arguments array eagerly + because we need to know about displaced, captured arguments during access + before tear-off. + + * runtime/Executable.cpp: + (JSC::FunctionExecutable::FunctionExecutable): + (JSC::FunctionExecutable::compileForCallInternal): + (JSC::FunctionExecutable::compileForConstructInternal): + * runtime/Executable.h: + (JSC::FunctionExecutable::parameterCount): + (FunctionExecutable): + * runtime/JSActivation.cpp: + (JSC::JSActivation::visitChildren): + * runtime/JSActivation.h: + (JSActivation): + (JSC::JSActivation::create): + (JSC::JSActivation::JSActivation): + (JSC::JSActivation::registerOffset): + (JSC::JSActivation::tearOff): + (JSC::JSActivation::allocationSize): + (JSC::JSActivation::isValid): This is really the point of the patch. All + the pointer math in Activations basically boils away, since we always + copy a contiguous region of captured variables now. + + * runtime/SymbolTable.h: + (JSC::SlowArgument::SlowArgument): + (SlowArgument): + (SharedSymbolTable): + (JSC::SharedSymbolTable::captureCount): + (JSC::SharedSymbolTable::SharedSymbolTable): AllOfTheThings capture mode + is gone now -- that's the point of the patch. indexIfCaptured gets renamed + to index because we always have an index, even if not captured. (The only + time when the index is meaningless is when we're Deleted.) + +2012-09-21 Gavin Barraclough + + Eeeep - broke early boyer in bug#97382 + https://bugs.webkit.org/show_bug.cgi?id=97383 + + Rubber stamped by Sam Weinig. + + missed a child3 -> child2! + + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compileInstanceOf): + +2012-09-21 Gavin Barraclough + + Unreviewed windows build fix. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + +2012-09-21 Gavin Barraclough + + Pedantic test in Mozilla's JavaScript test suite fails. function-001.js function-001-n.js + https://bugs.webkit.org/show_bug.cgi?id=27219 + + Reviewed by Sam Weinig. + + These tests are just wrong. + See ECMA 262 A.5, FunctionDelcaration does not require a semicolon. + + * tests/mozilla/expected.html: + * tests/mozilla/js1_2/function/function-001-n.js: + * tests/mozilla/js1_3/Script/function-001-n.js: + * tests/mozilla/js1_3/regress/function-001-n.js: + +2012-09-21 Gavin Barraclough + + Remove redundant argument to op_instanceof + https://bugs.webkit.org/show_bug.cgi?id=97382 + + Reviewed by Geoff Garen. + + No longer needed after my last change. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + * bytecode/Opcode.h: + (JSC): + (JSC::padOpcodeName): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::emitInstanceOf): + * bytecompiler/BytecodeGenerator.h: + (BytecodeGenerator): + * bytecompiler/NodesCodegen.cpp: + (JSC::InstanceOfNode::emitBytecode): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compileInstanceOf): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_instanceof): + (JSC::JIT::emitSlow_op_instanceof): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_instanceof): + (JSC::JIT::emitSlow_op_instanceof): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + +2012-09-21 Gavin Barraclough + + Unreviewed windows build fix. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + +2012-09-21 Gavin Barraclough + + instanceof should not get the prototype for non-default HasInstance + https://bugs.webkit.org/show_bug.cgi?id=68656 + + Reviewed by Oliver Hunt. + + Instanceof is currently implemented as a sequance of three opcodes: + check_has_instance + get_by_id(prototype) + op_instanceof + There are three interesting types of base value that instanceof can be applied to: + (A) Objects supporting default instanceof behaviour (functions, other than those created with bind) + (B) Objects overriding the default instancecof behaviour with a custom one (API objects, bound functions) + (C) Values that do not respond to the [[HasInstance]] trap. + Currently check_has_instance handles case (C), leaving the op_instanceof opcode to handle (A) & (B). There are + two problems with this apporach. Firstly, this is suboptimal for case (A), since we have to check for + hasInstance support twice (once in check_has_instance, then for default behaviour in op_instanceof). Secondly, + this means that in cases (B) we also perform the get_by_id, which is both suboptimal and an observable spec + violation. + + The fix here is to move handing of non-default instanceof (cases (B)) to the check_has_instance op, leaving + op_instanceof to handle only cases (A). + + * API/JSCallbackObject.h: + (JSCallbackObject): + * API/JSCallbackObjectFunctions.h: + (JSC::::customHasInstance): + * API/JSValueRef.cpp: + (JSValueIsInstanceOfConstructor): + - renamed hasInstance to customHasInstance + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + - added additional parameters to check_has_instance opcode + * bytecode/Opcode.h: + (JSC): + (JSC::padOpcodeName): + - added additional parameters to check_has_instance opcode + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::emitCheckHasInstance): + - added additional parameters to check_has_instance opcode + * bytecompiler/BytecodeGenerator.h: + (BytecodeGenerator): + - added additional parameters to check_has_instance opcode + * bytecompiler/NodesCodegen.cpp: + (JSC::InstanceOfNode::emitBytecode): + - added additional parameters to check_has_instance opcode + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + - added additional parameters to check_has_instance opcode + * interpreter/Interpreter.cpp: + (JSC::isInvalidParamForIn): + (JSC::Interpreter::privateExecute): + - Add handling for non-default instanceof to op_check_has_instance + * jit/JITInlineMethods.h: + (JSC::JIT::emitArrayProfilingSiteForBytecodeIndex): + - Fixed no-LLInt no_DFG build + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_check_has_instance): + (JSC::JIT::emitSlow_op_check_has_instance): + - check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance. + (JSC::JIT::emit_op_instanceof): + (JSC::JIT::emitSlow_op_instanceof): + - no need to check for ImplementsDefaultHasInstance. + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_check_has_instance): + (JSC::JIT::emitSlow_op_check_has_instance): + - check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance. + (JSC::JIT::emit_op_instanceof): + (JSC::JIT::emitSlow_op_instanceof): + - no need to check for ImplementsDefaultHasInstance. + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * jit/JITStubs.h: + - Add handling for non-default instanceof to op_check_has_instance + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + - move check for ImplementsDefaultHasInstance, handle additional arguments to op_check_has_instance. + * runtime/ClassInfo.h: + (MethodTable): + (JSC): + - renamed hasInstance to customHasInstance + * runtime/CommonSlowPaths.h: + (CommonSlowPaths): + - removed opInstanceOfSlow (this was whittled down to one function call!) + * runtime/JSBoundFunction.cpp: + (JSC::JSBoundFunction::customHasInstance): + * runtime/JSBoundFunction.h: + (JSBoundFunction): + - renamed hasInstance to customHasInstance, reimplemented. + * runtime/JSCell.cpp: + (JSC::JSCell::customHasInstance): + * runtime/JSCell.h: + (JSCell): + * runtime/JSObject.cpp: + (JSC::JSObject::hasInstance): + (JSC): + (JSC::JSObject::defaultHasInstance): + * runtime/JSObject.h: + (JSObject): + +2012-09-21 Filip Pizlo + + Unreviewed, fix ARM build. + + * assembler/MacroAssemblerARMv7.h: + (JSC::MacroAssemblerARMv7::store8): + (MacroAssemblerARMv7): + * offlineasm/armv7.rb: + +2012-09-21 Filip Pizlo + + REGRESSION (r128400): Opening Google Web Fonts page hangs or crashes + https://bugs.webkit.org/show_bug.cgi?id=97328 + + Reviewed by Mark Hahnenberg. + + It's a bad idea to emit stub code that reallocates property storage when we're in indexed + storage mode. DFGRepatch.cpp knew this and had the appropriate check in one of the places, + but it didn't have it in all of the places. + + This change also adds some more handy disassembly support, which I used to find the bug. + + * assembler/LinkBuffer.h: + (JSC): + * dfg/DFGRepatch.cpp: + (JSC::DFG::generateProtoChainAccessStub): + (JSC::DFG::tryCacheGetByID): + (JSC::DFG::tryBuildGetByIDList): + (JSC::DFG::emitPutReplaceStub): + (JSC::DFG::emitPutTransitionStub): + (JSC::DFG::tryCachePutByID): + * jit/JITStubRoutine.h: + (JSC): + +2012-09-21 Filip Pizlo + + DFG CSE assumes that a holy PutByVal does not interfere with GetArrayLength, when it clearly does + https://bugs.webkit.org/show_bug.cgi?id=97373 + + Reviewed by Mark Hahnenberg. + + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::pureCSE): + (JSC::DFG::CSEPhase::getArrayLengthElimination): + (JSC::DFG::CSEPhase::putStructureStoreElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGGraph.h: + (Graph): + +2012-09-21 Chris Rogers + + Add Web Audio support for deprecated/legacy APIs + https://bugs.webkit.org/show_bug.cgi?id=97050 + + Reviewed by Eric Carlson. + + * Configurations/FeatureDefines.xcconfig: + +2012-09-21 Gavin Barraclough + + Global Math object should be configurable but isn't + https://bugs.webkit.org/show_bug.cgi?id=55343 + + Reviewed by Oliver Hunt. + + This has no performance impact. + + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::reset): + - Make 'Math' a regular property. + +2012-09-21 Chao-ying Fu + + Add MIPS or32 function + https://bugs.webkit.org/show_bug.cgi?id=97157 + + Reviewed by Gavin Barraclough. + + Add a missing or32 function. + + * assembler/MacroAssemblerMIPS.h: + (JSC::MacroAssemblerMIPS::or32): New function. + (MacroAssemblerMIPS): + +2012-09-20 Filip Pizlo + + CHECK_ARRAY_CONSISTENCY isn't being used or tested, so we should remove it + https://bugs.webkit.org/show_bug.cgi?id=97260 + + Rubber stamped by Geoffrey Garen. + + Supporting it will become difficult as we add more indexing types. It makes more + sense to kill, especially since we don't appear to use it or test it, ever. + + * runtime/ArrayConventions.h: + (JSC): + * runtime/ArrayPrototype.cpp: + (JSC::arrayProtoFuncSplice): + * runtime/ArrayStorage.h: + (JSC::ArrayStorage::copyHeaderFromDuringGC): + (ArrayStorage): + * runtime/FunctionPrototype.cpp: + (JSC::functionProtoFuncBind): + * runtime/JSArray.cpp: + (JSC::createArrayButterflyInDictionaryIndexingMode): + (JSC::JSArray::setLength): + (JSC::JSArray::pop): + (JSC::JSArray::push): + (JSC::JSArray::sortNumeric): + (JSC::JSArray::sort): + (JSC::JSArray::compactForSorting): + * runtime/JSArray.h: + (JSArray): + (JSC::createArrayButterfly): + (JSC::JSArray::tryCreateUninitialized): + (JSC::constructArray): + * runtime/JSObject.cpp: + (JSC::JSObject::putByIndex): + (JSC::JSObject::createArrayStorage): + (JSC::JSObject::deletePropertyByIndex): + (JSC): + * runtime/JSObject.h: + (JSC::JSObject::initializeIndex): + (JSObject): + +2012-09-20 Mark Lam + + Fixed a missing semicolon in the C++ llint backend. + https://bugs.webkit.org/show_bug.cgi?id=97252. + + Reviewed by Geoff Garen. + + * offlineasm/cloop.rb: + +2012-09-20 Geoffrey Garen + + Refactored the interpreter and JIT so they don't dictate closure layout + https://bugs.webkit.org/show_bug.cgi?id=97221 + + Reviewed by Oliver Hunt. + + Capture may change the location of an argument for space efficiency. This + patch removes static assumptions about argument location from the interpreter + and JIT. + + * bytecode/CodeBlock.h: + (JSC::CodeBlock::argumentIndexAfterCapture): + (JSC::ExecState::argumentAfterCapture): Factored out a helper function + so the compiler could share this logic. + + * bytecompiler/NodesCodegen.cpp: + (JSC::BracketAccessorNode::emitBytecode): Don't emit optimized bracket + access on arguments if a parameter has been captured by name. This case is + rare and, where I've seen it in the wild, the optimization mostly failed + anyway due to arguments escape, so I didn't feel like writing and testing + five copies of the code that would handle it in the baseline engines. + + The DFG can still synthesize this optimization even if we don't emit the + optimized bytecode for it. + + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + * dfg/DFGAssemblyHelpers.h: + (JSC::DFG::AssemblyHelpers::symbolTableFor): + (AssemblyHelpers): Use the right helper function to account for the fact + that a parameter may have been captured by name and moved. + + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): ASSERT that we haven't inlined + a .apply on captured arguments. Once we do start inlining such things, + we'll need to do a little bit of math here to get them right. + + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): Added support for bracket access on + an arguments object where arguments have also been captured by name. We + load the true index of the argument from a side vector. Arguments elision + is very powerful in the DFG, so I wanted to keep it working, even in this + rare case. + + * interpreter/Interpreter.cpp: + (JSC::loadVarargs): Use the right helper function to account for the fact + that a parameter may have been captured by name and moved. + + * jit/JITCall.cpp: + (JSC::JIT::compileLoadVarargs): + * jit/JITCall32_64.cpp: + (JSC::JIT::compileLoadVarargs): Don't use the inline copy loop if some + of our arguments have moved, since it would copy stale values. (We still + optimize the actual call, and elide the arguments object.) + +2012-09-20 Gabor Rapcsanyi + + [Qt] r129045 broke the ARM build + https://bugs.webkit.org/show_bug.cgi?id=97195 + + Reviewed by Zoltan Herczeg. + + Implementing missing store8 function. + + * assembler/MacroAssemblerARM.h: + (JSC::MacroAssemblerARM::store8): + (MacroAssemblerARM): + +2012-09-19 Geoffrey Garen + + OSR exit sometimes neglects to create the arguments object + https://bugs.webkit.org/show_bug.cgi?id=97162 + + Reviewed by Filip Pizlo. + + No performance change. + + I don't know of any case where this is a real problem in TOT, but it + will become a problem if we start compiling eval, with, or catch, and/or + sometimes stop doing arguments optimizations in the bytecode. + + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): Account for a + CreateArguments that has transformed into PhantomArguments. We used to + clear our reference to the CreateArguments node, but now we hold onto it, + so we need to account for it transforming. + + Don't replace a SetLocal(CreateArguments) with a SetLocal(JSValue()) + because that doesn't leave enough information behind for OSR exit to do + the right thing. Instead, maintain our reference to CreateArguments, and + rely on CreateArguments transforming into PhantomArguments after + optimization. SetLocal(PhantomArguments) is efficient, and it's a marker + for OSR exit to create the arguments object. + + Don't ASSERT that all PhantomArguments are unreferenced because we now + leave them in the graph as SetLocal(PhantomArguments), and that's harmless. + + * dfg/DFGArgumentsSimplificationPhase.h: + (NullableHashTraits): + (JSC::DFG::NullableHashTraits::emptyValue): Export our special hash table + for inline call frames so the OSR exit compiler can use it. + + * dfg/DFGOSRExitCompiler32_64.cpp: + (JSC::DFG::OSRExitCompiler::compileExit): + * dfg/DFGOSRExitCompiler64.cpp: + (JSC::DFG::OSRExitCompiler::compileExit): Don't load the 'arguments' + register to decide if we need to create the arguments object. Optimization + may have eliminated the initializing store to this register, in which + case we'll load garbage. Instead, use the global knowledge that all call + frames that optimized out 'arguments' now need to create it, and use a hash + table to make sure we do so only once per call frame. + + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): SetLocal(PhantomArguments) is unique + because we haven't just changed a value's format or elided a load or store; + instead, we've replaced an object with JSValue(). We could try to account + for this in a general way, but for now it's a special-case optimization, + so we give it a specific OSR hint instead. + +2012-09-19 Filip Pizlo + + REGRESSION(r128802): It made some JS tests crash + https://bugs.webkit.org/show_bug.cgi?id=97001 + + Reviewed by Mark Hahnenberg. + + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::visitChildren): + +2012-09-19 Filip Pizlo + + DFG should not assume that a ByVal access is generic just because it was unprofiled + https://bugs.webkit.org/show_bug.cgi?id=97088 + + Reviewed by Geoffrey Garen. + + We were not disambiguating between "Undecided" in the sense that the array profile + has no useful information versus "Undecided" in the sense that the array profile + knows that the access has not executed. That's an important distinction, since + the former form of "Undecided" means that we should consult value profiling, while + the latter means that we should force exit unless the value profiling indicates + that the access must be generic (base is not cell or property is not int). + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGArrayMode.cpp: + (JSC::DFG::fromObserved): + (JSC::DFG::refineArrayMode): + (JSC::DFG::modeAlreadyChecked): + (JSC::DFG::modeToString): + * dfg/DFGArrayMode.h: + (JSC::DFG::canCSEStorage): + (JSC::DFG::modeIsSpecific): + (JSC::DFG::modeSupportsLength): + (JSC::DFG::benefitsFromStructureCheck): + +2012-09-19 Filip Pizlo + + DFG should not emit PutByVal hole case unless it has to + https://bugs.webkit.org/show_bug.cgi?id=97080 + + Reviewed by Geoffrey Garen. + + This causes us to generate less code for typical PutByVal's. But if profiling tells us + that the hole case is being hit, we generate the same code as we would have generated + before. This seems like a slight speed-up across the board. + + * assembler/MacroAssemblerARMv7.h: + (JSC::MacroAssemblerARMv7::store8): + (MacroAssemblerARMv7): + * assembler/MacroAssemblerX86.h: + (MacroAssemblerX86): + (JSC::MacroAssemblerX86::store8): + * assembler/MacroAssemblerX86_64.h: + (MacroAssemblerX86_64): + (JSC::MacroAssemblerX86_64::store8): + * assembler/X86Assembler.h: + (X86Assembler): + (JSC::X86Assembler::movb_i8m): + * bytecode/ArrayProfile.h: + (JSC::ArrayProfile::ArrayProfile): + (JSC::ArrayProfile::addressOfMayStoreToHole): + (JSC::ArrayProfile::mayStoreToHole): + (ArrayProfile): + * dfg/DFGArrayMode.cpp: + (JSC::DFG::fromObserved): + (JSC::DFG::modeAlreadyChecked): + (JSC::DFG::modeToString): + * dfg/DFGArrayMode.h: + (DFG): + (JSC::DFG::mayStoreToHole): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * jit/JIT.h: + (JIT): + * jit/JITInlineMethods.h: + (JSC::JIT::emitArrayProfileStoreToHoleSpecialCase): + (JSC): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::emit_op_put_by_val): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::emit_op_put_by_val): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + +2012-09-18 Filip Pizlo + + DFG should not call out to C++ every time that it tries to put to an object that doesn't yet have array storage + https://bugs.webkit.org/show_bug.cgi?id=96983 + + Reviewed by Oliver Hunt. + + Introduce more polymorphism into the DFG's array mode support. Use that to + introduce the notion of effectul array modes, where the check for the mode + will perform actions necessary to ensure that we have the mode we want, if + the object is not already in that mode. Also added profiling support for + checking if an object is of a type that would not allow us to create array + storage (like a typed array or a string for example). + + This is a ~2x speed-up on loops that transform an object that did not have + indexed storage into one that does. + + * JSCTypedArrayStubs.h: + (JSC): + * bytecode/ArrayProfile.cpp: + (JSC::ArrayProfile::computeUpdatedPrediction): + * bytecode/ArrayProfile.h: + (JSC::ArrayProfile::ArrayProfile): + (JSC::ArrayProfile::mayInterceptIndexedAccesses): + (ArrayProfile): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGArrayMode.cpp: + (JSC::DFG::fromObserved): + (DFG): + (JSC::DFG::modeAlreadyChecked): + (JSC::DFG::modeToString): + * dfg/DFGArrayMode.h: + (DFG): + (JSC::DFG::modeUsesButterfly): + (JSC::DFG::isSlowPutAccess): + (JSC::DFG::benefitsFromStructureCheck): + (JSC::DFG::isEffectful): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::getArrayMode): + (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks): + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination): + * dfg/DFGFixupPhase.cpp: + (JSC::DFG::FixupPhase::fixupNode): + (JSC::DFG::FixupPhase::checkArray): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::byValIsPure): + * dfg/DFGNode.h: + (JSC::DFG::Node::hasArrayMode): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::checkArray): + (JSC::DFG::SpeculativeJIT::arrayify): + (DFG): + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * runtime/Arguments.h: + (Arguments): + * runtime/JSNotAnObject.h: + (JSNotAnObject): + * runtime/JSObject.h: + (JSObject): + (JSC::JSObject::ensureArrayStorage): + * runtime/JSString.h: + (JSC::JSString::createStructure): + +2012-09-18 Filip Pizlo + + Include PhantomArguments in DFGDisassembly + https://bugs.webkit.org/show_bug.cgi?id=97043 + + Reviewed by Geoffrey Garen. + + * dfg/DFGNode.h: + (JSC::DFG::Node::willHaveCodeGenOrOSR): + +2012-09-18 Filip Pizlo + + REGRESSION(r128802): It made some JS tests crash + https://bugs.webkit.org/show_bug.cgi?id=97001 + + Reviewed by Mark Hahnenberg. + + IndexingHeaderInlineMethods was incorrectly assuming that if the HasArrayStorage bit is clear, then that means that indexing payload capacity is zero. + + * runtime/IndexingHeaderInlineMethods.h: + (JSC::IndexingHeader::preCapacity): + (JSC::IndexingHeader::indexingPayloadSizeInBytes): + +2012-09-18 Mark Hahnenberg + + Use WTF::HasTrivialDestructor instead of compiler-specific versions in JSC::NeedsDestructor + https://bugs.webkit.org/show_bug.cgi?id=96980 + + Reviewed by Benjamin Poulain. + + * runtime/JSCell.h: + (JSC): + (NeedsDestructor): + +2012-09-18 Filip Pizlo + + DFGOperations doesn't use NativeCallFrameTracer in enough places + https://bugs.webkit.org/show_bug.cgi?id=96987 + + Reviewed by Mark Hahnenberg. + + Anything that can GC should use it. + + * dfg/DFGOperations.cpp: + +2012-09-18 Mark Lam + + Not reviewed. Attempt at greening the WinCairo bot. Touching + LowLevelInterpreter.asm to trigger a rebuild of LLIntDesiredOffsets. + https://bugs.webkit.org/show_bug.cgi?id=96992. + + * llint/LowLevelInterpreter.asm: + +2012-09-18 Peter Gal + + [Qt] REGRESSION(r128790): It broke the ARM build + https://bugs.webkit.org/show_bug.cgi?id=96968 + + Reviewed by Filip Pizlo. + + Implement the missing or32 method in the MacroAssemblerARM.h. + + * assembler/MacroAssemblerARM.h: + (JSC::MacroAssemblerARM::or32): + (MacroAssemblerARM): + +2012-09-18 Mark Lam + + Fix for WinCairo builds. + https://bugs.webkit.org/show_bug.cgi?id=96992. + + Reviewed by Filip Pizlo. + + Adding additional vcproj build targets in LLIntDesiredOffsets.vcproj, + LLIntOffsetsExtractor.vcproj, and LLIntAssembly.vcproj to match those + in jsc.vcproj. + + * JavaScriptCore.vcproj/LLIntAssembly/LLIntAssembly.vcproj: + * JavaScriptCore.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcproj: + * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcproj: + * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.vsprops: Added property svn:eol-style. + * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.vsprops: Added property svn:eol-style. + * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebugAll.vsprops: Added. + * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebugCairoCFLite.vsprops: Added. + * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorProduction.vsprops: Added. + * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.vsprops: Added property svn:eol-style. + * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorReleaseCairoCFLite.vsprops: Added. + * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorReleasePGO.vsprops: Added. + +2012-09-18 Filip Pizlo + + Unreviewed, fix sloppy English in comment. + + * runtime/JSGlobalObject.cpp: + (JSC): + +2012-09-17 Csaba Osztrogonác + + Unreviewed, rolling out r128826 and r128813. + + * API/JSCallbackConstructor.cpp: + (JSC): + (JSC::JSCallbackConstructor::JSCallbackConstructor): + * API/JSCallbackConstructor.h: + (JSCallbackConstructor): + * API/JSCallbackObject.cpp: + (JSC): + (JSC::::createStructure): + * API/JSCallbackObject.h: + (JSC::JSCallbackObject::create): + (JSCallbackObject): + * API/JSClassRef.cpp: + (OpaqueJSClass::prototype): + * API/JSObjectRef.cpp: + (JSObjectMake): + (JSObjectGetPrivate): + (JSObjectSetPrivate): + (JSObjectGetPrivateProperty): + (JSObjectSetPrivateProperty): + (JSObjectDeletePrivateProperty): + * API/JSValueRef.cpp: + (JSValueIsObjectOfClass): + * API/JSWeakObjectMapRefPrivate.cpp: + * GNUmakefile.list.am: + * JSCTypedArrayStubs.h: + (JSC): + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): + (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject): + * heap/Heap.cpp: + (JSC::Heap::isSafeToSweepStructures): + (JSC): + * heap/Heap.h: + (JSC::Heap::allocatorForObjectWithDestructor): + (Heap): + (JSC::Heap::allocateWithDestructor): + (JSC::Heap::allocateStructure): + (JSC): + * heap/IncrementalSweeper.cpp: + (JSC::IncrementalSweeper::IncrementalSweeper): + (JSC::IncrementalSweeper::sweepNextBlock): + (JSC::IncrementalSweeper::startSweeping): + (JSC::IncrementalSweeper::willFinishSweeping): + (JSC::IncrementalSweeper::structuresCanBeSwept): + (JSC): + * heap/IncrementalSweeper.h: + (IncrementalSweeper): + * heap/MarkedAllocator.cpp: + (JSC::MarkedAllocator::tryAllocateHelper): + (JSC::MarkedAllocator::allocateBlock): + * heap/MarkedAllocator.h: + (JSC::MarkedAllocator::cellsNeedDestruction): + (JSC::MarkedAllocator::onlyContainsStructures): + (MarkedAllocator): + (JSC::MarkedAllocator::MarkedAllocator): + (JSC::MarkedAllocator::init): + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::create): + (JSC::MarkedBlock::MarkedBlock): + (JSC): + (JSC::MarkedBlock::specializedSweep): + (JSC::MarkedBlock::sweep): + (JSC::MarkedBlock::sweepHelper): + * heap/MarkedBlock.h: + (JSC): + (MarkedBlock): + (JSC::MarkedBlock::cellsNeedDestruction): + (JSC::MarkedBlock::onlyContainsStructures): + * heap/MarkedSpace.cpp: + (JSC::MarkedSpace::MarkedSpace): + (JSC::MarkedSpace::resetAllocators): + (JSC::MarkedSpace::canonicalizeCellLivenessData): + (JSC::MarkedSpace::isPagedOut): + (JSC::MarkedSpace::freeBlock): + * heap/MarkedSpace.h: + (MarkedSpace): + (Subspace): + (JSC::MarkedSpace::allocatorFor): + (JSC::MarkedSpace::destructorAllocatorFor): + (JSC::MarkedSpace::allocateWithDestructor): + (JSC::MarkedSpace::allocateStructure): + (JSC::MarkedSpace::forEachBlock): + * heap/SlotVisitor.cpp: + * jit/JIT.h: + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateBasicJSObject): + (JSC::JIT::emitAllocateJSFinalObject): + (JSC::JIT::emitAllocateJSArray): + * jsc.cpp: + (GlobalObject::create): + * runtime/Arguments.cpp: + (JSC): + * runtime/Arguments.h: + (Arguments): + (JSC::Arguments::Arguments): + * runtime/ErrorPrototype.cpp: + (JSC): + * runtime/Executable.h: + * runtime/InternalFunction.cpp: + (JSC): + (JSC::InternalFunction::InternalFunction): + * runtime/InternalFunction.h: + (InternalFunction): + * runtime/JSCell.h: + (JSC): + (JSC::allocateCell): + * runtime/JSDestructibleObject.h: Removed. + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::reset): + (JSC): + * runtime/JSGlobalObject.h: + (JSGlobalObject): + (JSC::JSGlobalObject::createRareDataIfNeeded): + (JSC::JSGlobalObject::create): + * runtime/JSGlobalThis.h: + (JSGlobalThis): + (JSC::JSGlobalThis::JSGlobalThis): + * runtime/JSPropertyNameIterator.h: + * runtime/JSScope.cpp: + (JSC): + * runtime/JSString.h: + (JSC): + * runtime/JSWrapperObject.h: + (JSWrapperObject): + (JSC::JSWrapperObject::JSWrapperObject): + * runtime/MathObject.cpp: + (JSC): + * runtime/NameInstance.h: + (NameInstance): + * runtime/RegExp.h: + * runtime/RegExpObject.cpp: + (JSC): + * runtime/SparseArrayValueMap.h: + * runtime/Structure.h: + (JSC::Structure): + (JSC::JSCell::classInfo): + (JSC): + * runtime/StructureChain.h: + * runtime/SymbolTable.h: + * testRegExp.cpp: + (GlobalObject::create): + +2012-09-17 Geoffrey Garen + + Refactored the arguments object so it doesn't dictate closure layout + https://bugs.webkit.org/show_bug.cgi?id=96955 + + Reviewed by Oliver Hunt. + + * bytecode/CodeBlock.h: + (JSC::ExecState::argumentAfterCapture): Helper function for accessing an + argument that has been moved for capture. + + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::BytecodeGenerator): Generate metadata for arguments + that are captured. We don't move any arguments yet, but we do use this + metadata to tell the arguments object if an argument is stored in the + activation. + + * dfg/DFGOperations.cpp: + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments): + (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): Updated for the arguments object not + malloc'ing a separate backing store, and for a rename from deletedArguments + to slowArguments. + + * interpreter/CallFrame.h: + (ExecState): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::unwindCallFrame): + (JSC::Interpreter::privateExecute): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): Updated for small interface changes. + + * runtime/Arguments.cpp: + (JSC::Arguments::visitChildren): + (JSC::Arguments::copyToArguments): + (JSC::Arguments::fillArgList): + (JSC::Arguments::getOwnPropertySlotByIndex): + (JSC::Arguments::createStrictModeCallerIfNecessary): + (JSC::Arguments::createStrictModeCalleeIfNecessary): + (JSC::Arguments::getOwnPropertySlot): + (JSC::Arguments::getOwnPropertyDescriptor): + (JSC::Arguments::getOwnPropertyNames): + (JSC::Arguments::putByIndex): + (JSC::Arguments::put): + (JSC::Arguments::deletePropertyByIndex): + (JSC::Arguments::deleteProperty): + (JSC::Arguments::defineOwnProperty): + (JSC::Arguments::tearOff): Moved all data inline into the object, for speed, + and refactored all internal argument accesses to use helper functions, so + we can change the implementation without changing lots of code. + + (JSC::Arguments::didTearOffActivation): This function needs to account + for arguments that were moved by the activation object. We do this accounting + through a side vector that tells us where our arguments will be in the + activation. + + (JSC::Arguments::tearOffForInlineCallFrame): + * runtime/Arguments.h: + (Arguments): + (JSC::Arguments::length): + (JSC::Arguments::isTornOff): + (JSC::Arguments::Arguments): + (JSC::Arguments::allocateSlowArguments): + (JSC::Arguments::tryDeleteArgument): + (JSC::Arguments::trySetArgument): + (JSC::Arguments::tryGetArgument): + (JSC::Arguments::isDeletedArgument): + (JSC::Arguments::isArgument): + (JSC::Arguments::argument): + (JSC::Arguments::finishCreation): + + * runtime/JSActivation.h: + (JSC::JSActivation::create): + (JSActivation): + (JSC::JSActivation::captureStart): + (JSC::JSActivation::storageSize): + (JSC::JSActivation::registerOffset): + (JSC::JSActivation::isValid): The activation object is no longer responsible + for copying extra arguments provided by the caller. The argumnents object + does this instead. This means we can allocate and initialize an activation + without worrying about the call frame's argument count. + + * runtime/SymbolTable.h: + (JSC::SlowArgument::SlowArgument): + (SlowArgument): + (JSC): + (JSC::SharedSymbolTable::parameterCount): + (SharedSymbolTable): + (JSC::SharedSymbolTable::slowArguments): + (JSC::SharedSymbolTable::setSlowArguments): Added data structures to back + the algorithms above. + +2012-09-17 Filip Pizlo + + 32-bit LLInt get_by_val does vector length checks incorrectly + https://bugs.webkit.org/show_bug.cgi?id=96893 + + + Reviewed by Mark Hahnenberg. + + * llint/LowLevelInterpreter32_64.asm: + +2012-09-17 Filip Pizlo + + We don't have a bad enough time if an object's prototype chain crosses global objects + https://bugs.webkit.org/show_bug.cgi?id=96962 + + Reviewed by Geoffrey Garen. + + * runtime/JSGlobalObject.cpp: + (JSC): + +2012-09-17 Filip Pizlo + + Unreviewed, fix a broken assertion in offlineasm. + + * offlineasm/armv7.rb: + * offlineasm/backends.rb: + +2012-09-16 Mark Hahnenberg + + Delayed structure sweep can leak structures without bound + https://bugs.webkit.org/show_bug.cgi?id=96546 + + Reviewed by Gavin Barraclough. + + This patch gets rid of the separate Structure allocator in the MarkedSpace and adds two new destructor-only + allocators. We now have separate allocators for our three types of objects: those objects with no destructors, + those objects with destructors and with immortal structures, and those objects with destructors that don't have + immortal structures. All of the objects of the third type (destructors without immortal structures) now + inherit from a new class named JSDestructibleObject (which in turn is a subclass of JSNonFinalObject), which stores + the ClassInfo for these classes at a fixed offset for safe retrieval during sweeping/destruction. + + * API/JSCallbackConstructor.cpp: Use JSDestructibleObject for JSCallbackConstructor. + (JSC): + (JSC::JSCallbackConstructor::JSCallbackConstructor): + * API/JSCallbackConstructor.h: + (JSCallbackConstructor): + * API/JSCallbackObject.cpp: Inherit from JSDestructibleObject for normal JSCallbackObjects and use a finalizer for + JSCallbackObject, since JSGlobalObject also uses a finalizer. + (JSC): + (JSC::::create): We need to move the create function for JSCallbackObject out of line so we can add + the finalizer for it. We don't want to add the finalizer is something like finishCreation in case somebody decides + to subclass this. We use this same technique for many other subclasses of JSGlobalObject. + (JSC::::createStructure): + * API/JSCallbackObject.h: + (JSCallbackObject): + (JSC): + * API/JSClassRef.cpp: Change all the JSCallbackObject to use JSDestructibleObject instead. + (OpaqueJSClass::prototype): + * API/JSObjectRef.cpp: Ditto. + (JSObjectMake): + (JSObjectGetPrivate): + (JSObjectSetPrivate): + (JSObjectGetPrivateProperty): + (JSObjectSetPrivateProperty): + (JSObjectDeletePrivateProperty): + * API/JSValueRef.cpp: Ditto. + (JSValueIsObjectOfClass): + * API/JSWeakObjectMapRefPrivate.cpp: Ditto. + * JSCTypedArrayStubs.h: + (JSC): + * JavaScriptCore.xcodeproj/project.pbxproj: + * dfg/DFGSpeculativeJIT.h: Use the proper allocator type when doing inline allocation in the DFG. + (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): + (JSC::DFG::SpeculativeJIT::emitAllocateJSFinalObject): + * heap/Heap.cpp: + (JSC): + * heap/Heap.h: Add accessors for the various types of allocators now. Also remove the isSafeToSweepStructures function + since it's always safe to sweep Structures now. + (JSC::Heap::allocatorForObjectWithNormalDestructor): + (JSC::Heap::allocatorForObjectWithImmortalStructureDestructor): + (Heap): + (JSC::Heap::allocateWithNormalDestructor): + (JSC): + (JSC::Heap::allocateWithImmortalStructureDestructor): + * heap/IncrementalSweeper.cpp: Remove all the logic to detect when it's safe to sweep Structures from the + IncrementalSweeper since it's always safe to sweep Structures now. + (JSC::IncrementalSweeper::IncrementalSweeper): + (JSC::IncrementalSweeper::sweepNextBlock): + (JSC::IncrementalSweeper::startSweeping): + (JSC::IncrementalSweeper::willFinishSweeping): + (JSC): + * heap/IncrementalSweeper.h: + (IncrementalSweeper): + * heap/MarkedAllocator.cpp: Remove the logic that was preventing us from sweeping Structures if it wasn't safe. Add + tracking of the specific destructor type of allocator. + (JSC::MarkedAllocator::tryAllocateHelper): + (JSC::MarkedAllocator::allocateBlock): + * heap/MarkedAllocator.h: + (JSC::MarkedAllocator::destructorType): + (MarkedAllocator): + (JSC::MarkedAllocator::MarkedAllocator): + (JSC::MarkedAllocator::init): + * heap/MarkedBlock.cpp: Add all the destructor type stuff to MarkedBlocks so that we do the right thing when sweeping. + We also use the stored destructor type to determine the right thing to do in all JSCell::classInfo() calls. + (JSC::MarkedBlock::create): + (JSC::MarkedBlock::MarkedBlock): + (JSC): + (JSC::MarkedBlock::specializedSweep): + (JSC::MarkedBlock::sweep): + (JSC::MarkedBlock::sweepHelper): + * heap/MarkedBlock.h: + (JSC): + (JSC::MarkedBlock::allocator): + (JSC::MarkedBlock::destructorType): + * heap/MarkedSpace.cpp: Add the new destructor allocators to MarkedSpace. + (JSC::MarkedSpace::MarkedSpace): + (JSC::MarkedSpace::resetAllocators): + (JSC::MarkedSpace::canonicalizeCellLivenessData): + (JSC::MarkedSpace::isPagedOut): + (JSC::MarkedSpace::freeBlock): + * heap/MarkedSpace.h: + (MarkedSpace): + (JSC::MarkedSpace::immortalStructureDestructorAllocatorFor): + (JSC::MarkedSpace::normalDestructorAllocatorFor): + (JSC::MarkedSpace::allocateWithImmortalStructureDestructor): + (JSC::MarkedSpace::allocateWithNormalDestructor): + (JSC::MarkedSpace::forEachBlock): + * heap/SlotVisitor.cpp: Add include because the symbol was needed in an inlined function. + * jit/JIT.h: Make sure we use the correct allocator when doing inline allocations in the baseline JIT. + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateBasicJSObject): + (JSC::JIT::emitAllocateJSFinalObject): + (JSC::JIT::emitAllocateJSArray): + * jsc.cpp: + (GlobalObject::create): Add finalizer here since JSGlobalObject needs to use a finalizer instead of inheriting from + JSDestructibleObject. + * runtime/Arguments.cpp: Inherit from JSDestructibleObject. + (JSC): + * runtime/Arguments.h: + (Arguments): + (JSC::Arguments::Arguments): + * runtime/ErrorPrototype.cpp: Added an assert to make sure we have a trivial destructor. + (JSC): + * runtime/Executable.h: Indicate that all of the Executable* classes have immortal Structures. + (JSC): + * runtime/InternalFunction.cpp: Inherit from JSDestructibleObject. + (JSC): + (JSC::InternalFunction::InternalFunction): + * runtime/InternalFunction.h: + (InternalFunction): + * runtime/JSCell.h: Added the NEEDS_DESTRUCTOR macro to make it easier for classes to indicate that instead of being + allocated in a destructor MarkedAllocator that they will handle their destruction themselves through the + use of a finalizer. + (JSC): + (HasImmortalStructure): New template to help us determine at compile-time if a particular class + should be allocated in the immortal structure MarkedAllocator. The default value is false. In order + to be allocated in the immortal structure allocator, classes must specialize this template. Also added + a macro to make it easier for classes to specialize the template. + (JSC::allocateCell): Use the appropriate allocator depending on the destructor type. + * runtime/JSDestructibleObject.h: Added. New class that stores the ClassInfo of any subclass so that it can be + accessed safely when the object is being destroyed. + (JSC): + (JSDestructibleObject): + (JSC::JSDestructibleObject::classInfo): + (JSC::JSDestructibleObject::JSDestructibleObject): + (JSC::JSCell::classInfo): Checks the current MarkedBlock to see where it should get the ClassInfo from so that it's always safe. + * runtime/JSGlobalObject.cpp: JSGlobalObject now uses a finalizer instead of a destructor so that it can avoid forcing all + of its relatives in the inheritance hierarchy (e.g. JSScope) to use destructors as well. + (JSC::JSGlobalObject::reset): + * runtime/JSGlobalObject.h: + (JSGlobalObject): + (JSC::JSGlobalObject::createRareDataIfNeeded): Since we always create a finalizer now, we don't have to worry about adding one + for the m_rareData field when it's created. + (JSC::JSGlobalObject::create): + (JSC): + * runtime/JSGlobalThis.h: Inherit from JSDestructibleObject. + (JSGlobalThis): + (JSC::JSGlobalThis::JSGlobalThis): + * runtime/JSPropertyNameIterator.h: Has an immortal Structure. + (JSC): + * runtime/JSScope.cpp: + (JSC): + * runtime/JSString.h: Has an immortal Structure. + (JSC): + * runtime/JSWrapperObject.h: Inherit from JSDestructibleObject. + (JSWrapperObject): + (JSC::JSWrapperObject::JSWrapperObject): + * runtime/MathObject.cpp: Cleaning up some of the inheritance stuff. + (JSC): + * runtime/NameInstance.h: Inherit from JSDestructibleObject. + (NameInstance): + * runtime/RegExp.h: Has immortal Structure. + (JSC): + * runtime/RegExpObject.cpp: Inheritance cleanup. + (JSC): + * runtime/SparseArrayValueMap.h: Has immortal Structure. + (JSC): + * runtime/Structure.h: Has immortal Structure. + (JSC): + * runtime/StructureChain.h: Ditto. + (JSC): + * runtime/SymbolTable.h: Ditto. + (SharedSymbolTable): + (JSC): + +2012-09-17 Filip Pizlo + + If a prototype has indexed setters and its instances have indexed storage, then all put_by_val's should have a bad time + https://bugs.webkit.org/show_bug.cgi?id=96596 + + Reviewed by Gavin Barraclough. + + Added comprehensive support for accessors and read-only indexed properties on the + prototype chain. This is done without any performance regression on benchmarks that + we're aware of, by having the entire VM's strategy with respect to arrays tilted + heavily in favor of: + + - The prototype chain of JSArrays never having any accessors or read-only indexed + properties. If that changes, you're going to have a bad time. + + - Prototypes of non-JSArray objects either having no indexed accessors or read-only + indexed properties, or, having those indexed accessor thingies inserted before + any instance object (i.e. object with that prototype as its prototype) is created. + If you add indexed accessors or read-only indexed properties to an object that is + already used as a prototype, you're going to have a bad time. + + See below for the exact definition of having a bad time. + + Put another way, "fair" uses of indexed accessors and read-only indexed properties + are: + + - Put indexed accessors and read-only indexed properties on an object that is never + used as a prototype. This will slow down accesses to that object, but will not + have any effect on any other object. + + - Put those indexed accessor thingies on an object before it is used as a prototype + and then start instantiating objects that claim that object as their prototype. + This will slightly slow down indexed stores to the instance objects, and greatly + slow down all indexed accesses to the prototype, but will have no other effect. + + In short, "fair" uses only affect the object itself and any instance objects. But + if you start using indexed accessors in more eclectic ways, you're going to have + a bad time. + + Specifically, if an object that may be used as a prototype has an indexed accessor + added, the VM performs a whole-heap scan to find all objects that belong to the + same global object as the prototype you modified. If any of those objects has + indexed storage, their indexed storage is put into slow-put mode, just as if their + prototype chain had indexed accessors. This will happen even for objects that do + not currently have indexed accessors in their prototype chain. As well, all JSArray + allocations are caused to create arrays with slow-put storage, and all future + allocations of indexed storage for non-JSArray objects are also flipped to slow-put + mode. Note there are two aspects to having a bad time: (i) the whole-heap scan and + (ii) the poisoning of all indexed storage in the entire global object. (i) is + necessary for correctness. If we detect that an object that may be used as a + prototype has had an indexed accessor or indexed read-only property inserted into + it, then we need to ensure that henceforth all instances of that object inspect + the prototype chain whenever an indexed hole is stored to. But by default, indexed + stores do no such checking because doing so would be unnecessarily slow. So, we must + find all instances of the affected object and flip them into a different array + storage mode that omits all hole optimizations. Since prototypes never keep a list + of instance objects, the only way to find those objects is a whole-heap scan. But + (i) alone would be a potential disaster, if a program frequently allocated an + object without indexed accessors, then allocated a bunch of objects that used that + one as their prototype, and then added indexed accessors to the prototype. So, to + prevent massive heap scan storms in such awkward programs, having a bad time also + implies (ii): henceforth *all* objects belonging to that global object will use + slow put indexed storage, so that we don't ever have to scan the heap again. Note + that here we are using the global object as just an approximation of a program + module; it may be worth investigating in the future if other approximations can be + used instead. + + * bytecode/ArrayProfile.h: + (JSC): + (JSC::arrayModeFromStructure): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGArrayMode.cpp: + (JSC::DFG::fromObserved): + (JSC::DFG::modeAlreadyChecked): + (JSC::DFG::modeToString): + * dfg/DFGArrayMode.h: + (DFG): + (JSC::DFG::isSlowPutAccess): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::checkArray): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * jit/JIT.h: + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateJSArray): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_new_array): + * runtime/ArrayPrototype.cpp: + (JSC::ArrayPrototype::finishCreation): + (JSC::arrayProtoFuncSort): + * runtime/IndexingType.h: + (JSC): + (JSC::hasIndexedProperties): + (JSC::hasIndexingHeader): + (JSC::hasArrayStorage): + (JSC::shouldUseSlowPut): + * runtime/JSArray.cpp: + (JSC::JSArray::pop): + (JSC::JSArray::push): + (JSC::JSArray::fillArgList): + (JSC::JSArray::copyToArguments): + * runtime/JSArray.h: + (JSC::JSArray::createStructure): + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::JSGlobalObject): + (JSC::JSGlobalObject::reset): + (JSC): + (JSC::JSGlobalObject::haveABadTime): + * runtime/JSGlobalObject.h: + (JSGlobalObject): + (JSC::JSGlobalObject::addressOfArrayStructure): + (JSC::JSGlobalObject::havingABadTimeWatchpoint): + (JSC::JSGlobalObject::isHavingABadTime): + * runtime/JSObject.cpp: + (JSC::JSObject::visitButterfly): + (JSC::JSObject::getOwnPropertySlotByIndex): + (JSC::JSObject::put): + (JSC::JSObject::putByIndex): + (JSC::JSObject::enterDictionaryIndexingMode): + (JSC::JSObject::notifyPresenceOfIndexedAccessors): + (JSC): + (JSC::JSObject::createArrayStorage): + (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode): + (JSC::JSObject::switchToSlowPutArrayStorage): + (JSC::JSObject::setPrototype): + (JSC::JSObject::resetInheritorID): + (JSC::JSObject::inheritorID): + (JSC::JSObject::allowsAccessFrom): + (JSC::JSObject::deletePropertyByIndex): + (JSC::JSObject::getOwnPropertyNames): + (JSC::JSObject::unwrappedGlobalObject): + (JSC::JSObject::notifyUsedAsPrototype): + (JSC::JSObject::createInheritorID): + (JSC::JSObject::defineOwnIndexedProperty): + (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype): + (JSC::JSObject::attemptToInterceptPutByIndexOnHole): + (JSC::JSObject::putByIndexBeyondVectorLength): + (JSC::JSObject::putDirectIndexBeyondVectorLength): + (JSC::JSObject::getNewVectorLength): + (JSC::JSObject::getOwnPropertyDescriptor): + * runtime/JSObject.h: + (JSC::JSObject::mayBeUsedAsPrototype): + (JSObject): + (JSC::JSObject::mayInterceptIndexedAccesses): + (JSC::JSObject::getArrayLength): + (JSC::JSObject::getVectorLength): + (JSC::JSObject::canGetIndexQuickly): + (JSC::JSObject::getIndexQuickly): + (JSC::JSObject::canSetIndexQuickly): + (JSC::JSObject::setIndexQuickly): + (JSC::JSObject::initializeIndex): + (JSC::JSObject::completeInitialization): + (JSC::JSObject::inSparseIndexingMode): + (JSC::JSObject::arrayStorage): + (JSC::JSObject::arrayStorageOrNull): + (JSC::JSObject::ensureArrayStorage): + (JSC): + (JSC::JSValue::putByIndex): + * runtime/JSValue.cpp: + (JSC::JSValue::putToPrimitive): + (JSC::JSValue::putToPrimitiveByIndex): + (JSC): + * runtime/JSValue.h: + (JSValue): + * runtime/ObjectPrototype.cpp: + (JSC::ObjectPrototype::finishCreation): + * runtime/SparseArrayValueMap.cpp: + (JSC::SparseArrayValueMap::putEntry): + (JSC::SparseArrayEntry::put): + (JSC): + * runtime/SparseArrayValueMap.h: + (JSC): + (SparseArrayEntry): + * runtime/Structure.cpp: + (JSC::Structure::anyObjectInChainMayInterceptIndexedAccesses): + (JSC): + (JSC::Structure::suggestedIndexingTransition): + * runtime/Structure.h: + (Structure): + (JSC::Structure::mayInterceptIndexedAccesses): + * runtime/StructureTransitionTable.h: + (JSC::newIndexingType): + +2012-09-17 Filip Pizlo + + Array profiling has convergence issues + https://bugs.webkit.org/show_bug.cgi?id=96891 + + Reviewed by Gavin Barraclough. + + Now each array profiling site merges in the indexing type it observed into + the m_observedArrayModes bitset. The ArrayProfile also uses this to detect + cases where the structure must have gone polymorphic (if the bitset is + polymorphic then the structure must be). This achieves something like the + best of both worlds: on the one hand, we get a probabilistic structure that + we can use to optimize the monomorphic structure case, but on the other hand, + we get an accurate view of the set of types that were encountered. + + * assembler/MacroAssemblerARMv7.h: + (JSC::MacroAssemblerARMv7::or32): + (MacroAssemblerARMv7): + * assembler/MacroAssemblerX86.h: + (JSC::MacroAssemblerX86::or32): + (MacroAssemblerX86): + * assembler/MacroAssemblerX86_64.h: + (JSC::MacroAssemblerX86_64::or32): + (MacroAssemblerX86_64): + * assembler/X86Assembler.h: + (X86Assembler): + (JSC::X86Assembler::orl_rm): + * bytecode/ArrayProfile.cpp: + (JSC::ArrayProfile::computeUpdatedPrediction): + * bytecode/ArrayProfile.h: + (JSC::ArrayProfile::addressOfArrayModes): + (JSC::ArrayProfile::structureIsPolymorphic): + * jit/JIT.h: + (JIT): + * jit/JITInlineMethods.h: + (JSC): + (JSC::JIT::emitArrayProfilingSite): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::emit_op_get_by_val): + (JSC::JIT::emit_op_put_by_val): + (JSC::JIT::privateCompilePatchGetArrayLength): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::emit_op_get_by_val): + (JSC::JIT::emit_op_put_by_val): + (JSC::JIT::privateCompilePatchGetArrayLength): + * llint/LowLevelInterpreter.asm: + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + +2012-09-17 Mark Lam + + Not reviewed. Added svn:eol-style native to unbreak some build bots. + https://bugs.webkit.org/show_bug.cgi?id=96175. + + * JavaScriptCore.vcproj/LLIntAssembly/LLIntAssembly.vcproj: Added property svn:eol-style. + * JavaScriptCore.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcproj: Added property svn:eol-style. + * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcproj: Added property svn:eol-style. + +2012-09-16 Mark Lam + + Added MSVC project changes to enable building the llint. + https://bugs.webkit.org/show_bug.cgi?id=96175. + + Reviewed by Geoff Garen. + + This only adds the ability to build the llint, but currently, only the + C++ backend is supported. By default, the Windows port will remain + running with the baseline JIT. The llint will not be enabled. + + * JavaScriptCore.vcproj/JavaScriptCore.sln: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.vcproj/LLIntAssembly: Added. + * JavaScriptCore.vcproj/LLIntAssembly/LLIntAssembly.make: Added. + * JavaScriptCore.vcproj/LLIntAssembly/LLIntAssembly.vcproj: Added. + * JavaScriptCore.vcproj/LLIntAssembly/build-LLIntAssembly.sh: Added. + * JavaScriptCore.vcproj/LLIntDesiredOffsets: Added. + * JavaScriptCore.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.make: Added. + * JavaScriptCore.vcproj/LLIntDesiredOffsets/LLIntDesiredOffsets.vcproj: Added. + * JavaScriptCore.vcproj/LLIntDesiredOffsets/build-LLIntDesiredOffsets.sh: Added. + * JavaScriptCore.vcproj/LLIntOffsetsExtractor: Added. + * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractor.vcproj: Added. + * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorCommon.vsprops: Added. + * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorDebug.vsprops: Added. + * JavaScriptCore.vcproj/LLIntOffsetsExtractor/LLIntOffsetsExtractorRelease.vsprops: Added. + +2012-09-16 Filip Pizlo + + JSObject.cpp and JSArray.cpp have inconsistent tests for the invalid array index case + https://bugs.webkit.org/show_bug.cgi?id=96878 + + Reviewed by Sam Weinig. + + Removed the uses of UNLIKELY() because I don't believe they are buying us anything, + since we're already on the slow path. Also found other places where we're testing for + the invalid array index case using unusual predicates rather than just using + MAX_ARRAY_INDEX. With this change, I believe that all of our tests for invalid + array indices (i.e. indices that should be treated as non-indexed properties) + uniformly use MAX_ARRAY_INDEX and PropertyName::NotAnIndex. + + * runtime/JSArray.cpp: + (JSC::JSArray::push): + * runtime/JSObject.cpp: + (JSC::JSObject::putByIndex): + (JSC::JSObject::defineOwnIndexedProperty): + +2012-09-15 Filip Pizlo + + Following the Butterfly refactoring, the comment for lastArraySize was not updated + https://bugs.webkit.org/show_bug.cgi?id=96877 + + Reviewed by Sam Weinig. + + * runtime/JSObject.cpp: + (JSC): + +2012-09-15 Mark Lam + + Fixed JSLock to use the platform abstraction for Mutex instead of + depending on pthreads. + https://bugs.webkit.org/show_bug.cgi?id=96858. + + Reviewed by Filip Pizlo. + + This fixes a synchronization problem on the Windows port and makes + it more reliable when running the layout tests. + + * runtime/InitializeThreading.cpp: + (JSC::initializeThreadingOnce): + * runtime/JSLock.cpp: + (JSC): + (JSC::GlobalJSLock::GlobalJSLock): + (JSC::GlobalJSLock::~GlobalJSLock): + (JSC::GlobalJSLock::initialize): + * runtime/JSLock.h: + (GlobalJSLock): + (JSLock): + +2012-09-15 Filip Pizlo + + Structure check hoisting fails to consider the possibility of conflicting checks on the source of the first assignment to the hoisted variable + https://bugs.webkit.org/show_bug.cgi?id=96872 + + Reviewed by Oliver Hunt. + + This does a few related things: + + - It turns off the use of ForceOSRExit for sure-to-fail CheckStructures, because + I noticed that this would sometimes happen for a ForwardCheckStructure. The + problem is that ForceOSRExit exits backwards, not forwards. Since the code that + led to those ForceOSRExit's being inserted was written out of paranoia rather + than need, I removed it. Specifically, I removed the m_isValid = false code + for CheckStructure/StructureTransitionWatchpoint in AbstractState. + + - If a structure check causes a structure set to go empty, we don't want a + PutStructure to revive the set. It should instead be smart enough to realize + that an empty set implies that the code can't execute. This was the only "bug" + that the use of m_isValid = false was preventing. + + - Finally, the main change: structure check hoisting looks at the source of the + SetLocals on structure-check-hoistable variables and ensures that the source + is not checked with a conflicting structure. This is O(n^2) but it does not + show up at all in performance tests. + + The first two parts of this change were auxiliary bugs that were revealed by + the structure check hoister doing bad things. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::initialize): + (JSC::DFG::AbstractState::execute): + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + +2012-09-14 Filip Pizlo + + All of the things in SparseArrayValueMap should be out-of-line + https://bugs.webkit.org/show_bug.cgi?id=96854 + + Reviewed by Andy Estes. + + Those inline methods were buying us nothing. + + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * runtime/JSArray.cpp: + * runtime/JSGlobalData.cpp: + * runtime/JSObject.cpp: + * runtime/RegExpMatchesArray.cpp: + * runtime/SparseArrayValueMap.cpp: + (JSC::SparseArrayValueMap::SparseArrayValueMap): + (JSC): + (JSC::SparseArrayValueMap::~SparseArrayValueMap): + (JSC::SparseArrayValueMap::finishCreation): + (JSC::SparseArrayValueMap::create): + (JSC::SparseArrayValueMap::destroy): + (JSC::SparseArrayValueMap::createStructure): + (JSC::SparseArrayValueMap::add): + (JSC::SparseArrayValueMap::putEntry): + (JSC::SparseArrayValueMap::putDirect): + (JSC::SparseArrayEntry::get): + (JSC::SparseArrayEntry::getNonSparseMode): + (JSC::SparseArrayValueMap::visitChildren): + * runtime/SparseArrayValueMapInlineMethods.h: Removed. + +2012-09-14 Mike West + + JSC should throw a more descriptive exception when blocking 'eval' via CSP. + https://bugs.webkit.org/show_bug.cgi?id=94331 + + Reviewed by Geoffrey Garen. + + Unless explicitly whitelisted, the 'script-src' Content Security Policy + directive blocks 'eval' and 'eval'-like constructs such as + 'new Function()'. When 'eval' is encountered in code, an 'EvalError' is + thrown, but the associated message is poor: "Eval is disabled" doesn't + give developers enough information about why their code isn't behaving + as expected. + + This patch adds an 'errorMessage' parameter to the JavaScriptCore method + used to disable 'eval'; ContentSecurityPolicy has the opportunity to + pass in a more detailed and descriptive error that contains more context + for the developer. + + * runtime/Executable.cpp: + (JSC::EvalExecutable::compileInternal): + Drop the hard-coded "Eval is disabled" error message in favor of + reading the error message off the global object. + * runtime/FunctionConstructor.cpp: + (JSC::FunctionConstructor::getCallData): + Drop the hard-coded "Function constructor is disabled" error message + in favor of reading the error message off the global object. + * runtime/JSGlobalObject.h: + (JSGlobalObject): + (JSC::JSGlobalObject::evalEnabled): + Making this accessor method const. + (JSC::JSGlobalObject::evalDisabledErrorMessage): + Accessor for the error message set via 'setEvalDisabled'. + (JSC::JSGlobalObject::setEvalEnabled): + Adding an 'errorMessage' parameter which is stored on the global + object, and used when exceptions are thrown. + +2012-09-14 Filip Pizlo + + bbc homepage crashes immediately + https://bugs.webkit.org/show_bug.cgi?id=96812 + + + Reviewed by Oliver Hunt. + + If you use the old storage pointer to write to space you thought was newly allocated, + you're going to have a bad time. + + * runtime/JSArray.cpp: + (JSC::JSArray::unshiftCount): + +2012-09-14 Adam Barth + + Remove webkitPostMessage + https://bugs.webkit.org/show_bug.cgi?id=96577 + + Reviewed by Ojan Vafai. + + Add ENABLE_LEGACY_VENDOR_PREFIXES flag. + + * Configurations/FeatureDefines.xcconfig: + +2012-09-14 Tor Arne Vestbø + + [Qt] Make force_static_libs_as_shared work on Mac OS + + We had to move a few LIBS += around that were in the wrong place, + and not caught when everything was just linked into the final + QtWebKit library. + + Reviewed by Simon Hausmann. + + * jsc.pro: No need for AppKit, we get it from WTF.pri + +2012-09-14 Kevin Funk + + Fix interpreter build + https://bugs.webkit.org/show_bug.cgi?id=96617 + + Reviewed by Simon Hausmann. + + Make compile. + + * interpreter/Interpreter.cpp: + +2012-09-14 Parth Patel + + [BlackBerry] Switching from Slogger to Slogger2 requires changes in CMakeList of + webkit in order to include libraries of slog2 + https://bugs.webkit.org/show_bug.cgi?id=96391 + + Reviewed by Yong Li. + + Changes in Cmake files of JavaScriptCore of webkit to include slog2 libs in build + files of webkit in response to switching from Slogger to Slogger2. + + * shell/PlatformBlackBerry.cmake: + +2012-09-14 Mark Hahnenberg + + Remove the Zapped BlockState + https://bugs.webkit.org/show_bug.cgi?id=96708 + + Reviewed by Geoffrey Garen. + + The Zapped block state is rather confusing. It indicates that a block is in one of two different states that we + can't tell the difference between: + + 1) I have run all destructors of things that are zapped, and I have not allocated any more objects. This block + is ready for reclaiming if you so choose. + 2) I have run all the destructors of things that are zapped, but I have allocated more stuff since then, so it + is not safe to reclaim this block. + + This state adds a lot of complexity to our state transition model for MarkedBlocks. We should get rid of it. + We can replace this state by making sure mark bits represent all of the liveness information we need when running + our conservative stack scan. Instead of zapping the free list when canonicalizing cell liveness data prior to + a conservative scan, we can instead mark all objects in the block except for those in the free list. This should + incur no performance penalty since we're doing it on a very small O(1) number of blocks at the beginning of the collection. + + For the time being we still need to use zapping to determine whether we have run an object's destructor or not. + + * heap/MarkedAllocator.cpp: + (JSC::MarkedAllocator::tryAllocateHelper): Renaming stuff. + * heap/MarkedAllocator.h: Renamed zapFreeList to canonicalizeCellLivenessData to match. + (MarkedAllocator): + (JSC::MarkedAllocator::canonicalizeCellLivenessData): Same as old zapFreeList, but just call canonicalize instead. + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::specializedSweep): Remove the check for Zapped block stuff. Also change the block state to Marked + instead of Zapped if we're not producing a FreeList since that's the only other state that really makes any sense. + (JSC::MarkedBlock::sweepHelper): Remove Zapped related code. + (SetAllMarksFunctor): Functor to set all the mark bits in the block since there's not a simple function to call on + the Bitmap itself. + (JSC::SetAllMarksFunctor::operator()): + (JSC): + (JSC::MarkedBlock::canonicalizeCellLivenessData): Remove all the stuff for Zapped. For FreeListed, set all the mark bits + and then clear the ones for the objects in the FreeList. This ensures that only the things that were in the FreeList + are considered to be dead by the conservative scan, just like if we were to have zapped the FreeList like before. + * heap/MarkedBlock.h: + (MarkedBlock): + (JSC::MarkedBlock::clearMarked): Add function to clear individual mark bits, since we need that functionality now. + (JSC): + (JSC::MarkedBlock::isLive): Remove code for Zapped stuff. Marked handles all interesting cases now. + (JSC::MarkedBlock::forEachCell): Add new iterator function that iterates over all cells in the block, regardless of + whether they're live or a dead. + * heap/MarkedSpace.cpp: + (JSC::MarkedSpace::canonicalizeCellLivenessData): Change to call the renamed canonicalize function. + +2012-09-13 Kevin Funk + + Make compile with both OS(WINCE) and PLATFORM(QT) support + https://bugs.webkit.org/show_bug.cgi?id=95536 + + Reviewed by Simon Hausmann. + + Do not link against advapi32 on wince + + * jsc.pro: + +2012-09-13 Geoffrey Garen + + Refactored the DFG to make fewer assumptions about variable capture + https://bugs.webkit.org/show_bug.cgi?id=96680 + + Reviewed by Gavin Barraclough. + + A variable capture optimization patch I'm working on broke DFG + correctness and the arguments simplification optimization phase, so I've + refactored both to make fewer assumptions about variable capture. + + * bytecode/CodeBlock.h: + (JSC::CodeBlock::isCaptured): This is the new One True Way to find out + if a variable was captured. This gives us a single point of maintenance + as we chagne capture behavior. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::clobberCapturedVars): Don't assume that captured + variables have any particular location. Instead, ask the One True Function. + + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse): + (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize): Mechanical + changes to separate being captured from being 'arguments'. What used + to be + if (captured) + if (arguments) + x + y + is now + if (arguments) + x + y + else if (captured) + y + + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::getLocal): + (JSC::DFG::ByteCodeParser::setLocal): + (JSC::DFG::ByteCodeParser::getArgument): + (JSC::DFG::ByteCodeParser::setArgument): + (JSC::DFG::ByteCodeParser::flushDirect): + (JSC::DFG::ByteCodeParser::parseBlock): + (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compile): Use the One True Function. + +2012-09-13 Benjamin Poulain + + Improve the SourceProvider hierarchy + https://bugs.webkit.org/show_bug.cgi?id=95635 + + Reviewed by Geoffrey Garen. + + SourceProvider was designed to have subclasses magically handling the data without + decoding all of it. The virtual methods length() and getRange() were based + on these assumptions. + + In practice, the magic was in our head, there is no implementation that takes + advantage of that. + + SourceProvider is modified to adopt WebCore's ScriptSourceProvider::source() and base + everything on it. + The code using SourceProvider is also simplified. + + * interpreter/Interpreter.cpp: + (JSC::appendSourceToError): Keep a reference to the string instead of querying it for + each time it is used. + * parser/Lexer.cpp: + (JSC::::setCode): + (JSC::::sourceCode): + * parser/Parser.h: + (JSC::parse): + * parser/SourceCode.h: + (JSC::SourceCode::SourceCode): + (JSC::SourceCode::subExpression): + * parser/SourceProvider.h: + (SourceProvider): + (JSC::SourceProvider::getRange): + +2012-09-13 Filip Pizlo + + DFG: Dead GetButterfly's shouldn't be subject to CSE + https://bugs.webkit.org/show_bug.cgi?id=96707 + + + Reviewed by Oliver Hunt. + + There were a number of cases of this that creeped into the CSE: it would + match something even though it was dead. + + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination): + (JSC::DFG::CSEPhase::checkArrayElimination): + (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination): + (JSC::DFG::CSEPhase::getScopeChainLoadElimination): + (JSC::DFG::CSEPhase::getLocalLoadElimination): + +2012-09-13 Oliver Hunt + + Make global const initialisation explicit in the bytecode + https://bugs.webkit.org/show_bug.cgi?id=96711 + + Reviewed by Gavin Barraclough. + + Added op_init_global_const to make initialisation of global const + fields explicit. This will help us keep correct semantics in the + upcoming variable resolution refactoring. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + * bytecode/Opcode.h: + (JSC): + (JSC::padOpcodeName): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::emitInitGlobalConst): + (JSC): + * bytecompiler/BytecodeGenerator.h: + (BytecodeGenerator): + * bytecompiler/NodesCodegen.cpp: + (JSC::ConstDeclNode::emitCodeSingle): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCapabilities.h: + (JSC::DFG::canCompileOpcode): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + * jit/JIT.cpp: + (JSC::JIT::privateCompileMainPass): + (JSC::JIT::privateCompileSlowCases): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + +2012-09-13 Mark Hahnenberg + + Rename forEachCell to forEachLiveCell + https://bugs.webkit.org/show_bug.cgi?id=96685 + + Reviewed by Oliver Hunt. + + forEachCell actually only iterates over live cells. We should rename it to + reflect what it actually does. This is also helpful because we want to add a new + forEachCell that actually does iterate each and every cell in a MarkedBlock + regardless of whether or not it is live. + + * debugger/Debugger.cpp: + (JSC::Debugger::recompileAllJSFunctions): + * heap/Heap.cpp: + (JSC::Heap::globalObjectCount): + (JSC::Heap::objectTypeCounts): + * heap/MarkedBlock.h: + (MarkedBlock): + (JSC::MarkedBlock::forEachLiveCell): + * heap/MarkedSpace.h: + (MarkedSpace): + (JSC::MarkedSpace::forEachLiveCell): + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::releaseExecutableMemory): + +2012-09-13 Filip Pizlo + + [Qt][Win] REGRESSION(r128400): It broke the build + https://bugs.webkit.org/show_bug.cgi?id=96617 + + Reviewed by Simon Hausmann. + + Changed "JSC::Array" to "JSC::ArrayClass" because it's not used often enough + for the brevity to be beneficial, and because "Array" causes too much namespace + pollution. + + * runtime/IndexingType.h: + (JSC): + * runtime/JSArray.cpp: + (JSC::JSArray::pop): + (JSC::JSArray::push): + (JSC::JSArray::sortNumeric): + (JSC::JSArray::sort): + (JSC::JSArray::fillArgList): + (JSC::JSArray::copyToArguments): + (JSC::JSArray::compactForSorting): + * runtime/JSObject.cpp: + (JSC::JSObject::getOwnPropertySlotByIndex): + (JSC::JSObject::putByIndex): + (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode): + (JSC::JSObject::deletePropertyByIndex): + (JSC::JSObject::getOwnPropertyNames): + (JSC::JSObject::putByIndexBeyondVectorLength): + (JSC::JSObject::putDirectIndexBeyondVectorLength): + (JSC::JSObject::getNewVectorLength): + (JSC::JSObject::getOwnPropertyDescriptor): + * runtime/JSObject.h: + (JSC::JSObject::getArrayLength): + (JSC::JSObject::getVectorLength): + (JSC::JSObject::canGetIndexQuickly): + (JSC::JSObject::canSetIndexQuickly): + (JSC::JSObject::inSparseIndexingMode): + (JSC::JSObject::ensureArrayStorage): + +2012-09-13 Filip Pizlo + + Testing whether indexing type is ArrayWithArrayStorage should not compare against ArrayWithArrayStorage + https://bugs.webkit.org/show_bug.cgi?id=96611 + + Reviewed by Gavin Barraclough. + + * dfg/DFGRepatch.cpp: + (JSC::DFG::tryCacheGetByID): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::checkArray): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::privateCompilePatchGetArrayLength): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::privateCompilePatchGetArrayLength): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + +2012-09-09 Filip Pizlo + + JSC should have property butterflies + https://bugs.webkit.org/show_bug.cgi?id=91933 + + Reviewed by Geoffrey Garen. + + This changes the JSC object model. Previously, all objects had fast lookup for + named properties. Integer indexed properties were only fast if you used a + JSArray. With this change, all objects have fast indexed properties. This is + accomplished without any space overhead by using a bidirectional object layout, + aka butterflies. Each JSObject has a m_butterfly pointer where previously it + had a m_outOfLineStorage pointer. To the left of the location pointed to by + m_butterfly, we place all named out-of-line properties. To the right, we place + all indexed properties along with indexing meta-data. Though, some indexing + meta-data is placed in the 8-byte word immediately left of the pointed-to + location; this is in anticipation of the indexing meta-data being small enough + in the common case that m_butterfly always points to the first indexed + property. + + This is performance neutral, except on tests that use indexed properties on + plain objects, where the speed-up is in excess of an order of magnitude. + + One notable aspect of what this change brings is that it allows indexing + storage to morph over time. Currently this is only used to allow all non-array + objects to start out without any indexed storage. But it could be used for + some kinds of array type inference in the future. + + * API/JSCallbackObject.h: + (JSCallbackObject): + * API/JSCallbackObjectFunctions.h: + (JSC::::getOwnPropertySlotByIndex): + (JSC): + (JSC::::getOwnNonIndexPropertyNames): + * API/JSObjectRef.cpp: + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * bytecode/ArrayProfile.h: + (JSC): + (JSC::arrayModeFromStructure): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::emitDirectPutById): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGAdjacencyList.h: + (JSC::DFG::AdjacencyList::AdjacencyList): + (AdjacencyList): + * dfg/DFGArrayMode.cpp: + (JSC::DFG::fromObserved): + (JSC::DFG::modeAlreadyChecked): + (JSC::DFG::modeToString): + * dfg/DFGArrayMode.h: + (DFG): + (JSC::DFG::modeUsesButterfly): + (JSC::DFG::modeIsJSArray): + (JSC::DFG::isInBoundsAccess): + (JSC::DFG::modeSupportsLength): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::handleGetByOffset): + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGFixupPhase.cpp: + (JSC::DFG::FixupPhase::fixupNode): + (JSC::DFG::FixupPhase::addNode): + (FixupPhase): + (JSC::DFG::FixupPhase::checkArray): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::byValIsPure): + * dfg/DFGNode.h: + (JSC::DFG::Node::Node): + (Node): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGOperations.cpp: + (JSC::DFG::putByVal): + * dfg/DFGOperations.h: + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGRepatch.cpp: + (JSC::DFG::generateProtoChainAccessStub): + (JSC::DFG::tryCacheGetByID): + (JSC::DFG::tryBuildGetByIDList): + (JSC::DFG::emitPutReplaceStub): + (JSC::DFG::emitPutTransitionStub): + (JSC::DFG::tryBuildPutByIdList): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::checkArray): + (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage): + (JSC::DFG::SpeculativeJIT::compileGetArrayLength): + (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage): + (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage): + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::cachedGetById): + (JSC::DFG::SpeculativeJIT::cachedPutById): + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::cachedGetById): + (JSC::DFG::SpeculativeJIT::cachedPutById): + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + * heap/CopiedSpace.h: + (CopiedSpace): + * jit/JIT.h: + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateBasicJSObject): + (JSC::JIT::emitAllocateBasicStorage): + (JSC::JIT::emitAllocateJSArray): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_new_array): + (JSC::JIT::emitSlow_op_new_array): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::emit_op_get_by_val): + (JSC::JIT::compileGetDirectOffset): + (JSC::JIT::emit_op_put_by_val): + (JSC::JIT::compileGetByIdHotPath): + (JSC::JIT::emit_op_put_by_id): + (JSC::JIT::compilePutDirectOffset): + (JSC::JIT::privateCompilePatchGetArrayLength): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::emit_op_get_by_val): + (JSC::JIT::emit_op_put_by_val): + (JSC::JIT::compileGetByIdHotPath): + (JSC::JIT::emit_op_put_by_id): + (JSC::JIT::compilePutDirectOffset): + (JSC::JIT::compileGetDirectOffset): + (JSC::JIT::privateCompilePatchGetArrayLength): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * jsc.cpp: + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * llint/LowLevelInterpreter.asm: + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/Arguments.cpp: + (JSC::Arguments::deletePropertyByIndex): + (JSC::Arguments::defineOwnProperty): + * runtime/ArrayConstructor.cpp: + * runtime/ArrayConventions.h: Added. + (JSC): + (JSC::isDenseEnoughForVector): + (JSC::indexingHeaderForArray): + (JSC::baseIndexingHeaderForArray): + * runtime/ArrayPrototype.cpp: + (JSC::ArrayPrototype::create): + (JSC): + (JSC::ArrayPrototype::ArrayPrototype): + (JSC::arrayProtoFuncToString): + (JSC::arrayProtoFuncJoin): + (JSC::arrayProtoFuncSort): + (JSC::arrayProtoFuncFilter): + (JSC::arrayProtoFuncMap): + (JSC::arrayProtoFuncEvery): + (JSC::arrayProtoFuncForEach): + (JSC::arrayProtoFuncSome): + (JSC::arrayProtoFuncReduce): + (JSC::arrayProtoFuncReduceRight): + * runtime/ArrayPrototype.h: + (ArrayPrototype): + (JSC::ArrayPrototype::createStructure): + * runtime/ArrayStorage.h: Added. + (JSC): + (ArrayStorage): + (JSC::ArrayStorage::ArrayStorage): + (JSC::ArrayStorage::from): + (JSC::ArrayStorage::butterfly): + (JSC::ArrayStorage::indexingHeader): + (JSC::ArrayStorage::length): + (JSC::ArrayStorage::setLength): + (JSC::ArrayStorage::vectorLength): + (JSC::ArrayStorage::setVectorLength): + (JSC::ArrayStorage::copyHeaderFromDuringGC): + (JSC::ArrayStorage::inSparseMode): + (JSC::ArrayStorage::lengthOffset): + (JSC::ArrayStorage::vectorLengthOffset): + (JSC::ArrayStorage::numValuesInVectorOffset): + (JSC::ArrayStorage::vectorOffset): + (JSC::ArrayStorage::indexBiasOffset): + (JSC::ArrayStorage::sparseMapOffset): + (JSC::ArrayStorage::sizeFor): + * runtime/Butterfly.h: Added. + (JSC): + (Butterfly): + (JSC::Butterfly::Butterfly): + (JSC::Butterfly::totalSize): + (JSC::Butterfly::fromBase): + (JSC::Butterfly::offsetOfIndexingHeader): + (JSC::Butterfly::offsetOfPublicLength): + (JSC::Butterfly::offsetOfVectorLength): + (JSC::Butterfly::indexingHeader): + (JSC::Butterfly::propertyStorage): + (JSC::Butterfly::indexingPayload): + (JSC::Butterfly::arrayStorage): + (JSC::Butterfly::offsetOfPropertyStorage): + (JSC::Butterfly::indexOfPropertyStorage): + (JSC::Butterfly::base): + * runtime/ButterflyInlineMethods.h: Added. + (JSC): + (JSC::Butterfly::createUninitialized): + (JSC::Butterfly::create): + (JSC::Butterfly::createUninitializedDuringCollection): + (JSC::Butterfly::base): + (JSC::Butterfly::growPropertyStorage): + (JSC::Butterfly::growArrayRight): + (JSC::Butterfly::resizeArray): + (JSC::Butterfly::unshift): + (JSC::Butterfly::shift): + * runtime/ClassInfo.h: + (MethodTable): + (JSC): + * runtime/IndexingHeader.h: Added. + (JSC): + (IndexingHeader): + (JSC::IndexingHeader::offsetOfIndexingHeader): + (JSC::IndexingHeader::offsetOfPublicLength): + (JSC::IndexingHeader::offsetOfVectorLength): + (JSC::IndexingHeader::IndexingHeader): + (JSC::IndexingHeader::vectorLength): + (JSC::IndexingHeader::setVectorLength): + (JSC::IndexingHeader::publicLength): + (JSC::IndexingHeader::setPublicLength): + (JSC::IndexingHeader::from): + (JSC::IndexingHeader::fromEndOf): + (JSC::IndexingHeader::propertyStorage): + (JSC::IndexingHeader::arrayStorage): + (JSC::IndexingHeader::butterfly): + * runtime/IndexingHeaderInlineMethods.h: Added. + (JSC): + (JSC::IndexingHeader::preCapacity): + (JSC::IndexingHeader::indexingPayloadSizeInBytes): + * runtime/IndexingType.h: Added. + (JSC): + (JSC::hasIndexingHeader): + * runtime/JSActivation.cpp: + (JSC::JSActivation::JSActivation): + (JSC::JSActivation::visitChildren): + (JSC::JSActivation::getOwnNonIndexPropertyNames): + * runtime/JSActivation.h: + (JSActivation): + (JSC::JSActivation::tearOff): + * runtime/JSArray.cpp: + (JSC): + (JSC::createArrayButterflyInDictionaryIndexingMode): + (JSC::JSArray::setLengthWritable): + (JSC::JSArray::defineOwnProperty): + (JSC::JSArray::getOwnPropertySlot): + (JSC::JSArray::getOwnPropertyDescriptor): + (JSC::JSArray::put): + (JSC::JSArray::deleteProperty): + (JSC::JSArray::getOwnNonIndexPropertyNames): + (JSC::JSArray::unshiftCountSlowCase): + (JSC::JSArray::setLength): + (JSC::JSArray::pop): + (JSC::JSArray::push): + (JSC::JSArray::shiftCount): + (JSC::JSArray::unshiftCount): + (JSC::JSArray::sortNumeric): + (JSC::JSArray::sort): + (JSC::JSArray::fillArgList): + (JSC::JSArray::copyToArguments): + (JSC::JSArray::compactForSorting): + * runtime/JSArray.h: + (JSC): + (JSArray): + (JSC::JSArray::JSArray): + (JSC::JSArray::length): + (JSC::JSArray::createStructure): + (JSC::JSArray::isLengthWritable): + (JSC::createArrayButterfly): + (JSC::JSArray::create): + (JSC::JSArray::tryCreateUninitialized): + * runtime/JSBoundFunction.cpp: + (JSC::boundFunctionCall): + (JSC::boundFunctionConstruct): + (JSC::JSBoundFunction::finishCreation): + * runtime/JSCell.cpp: + (JSC::JSCell::getOwnNonIndexPropertyNames): + (JSC): + * runtime/JSCell.h: + (JSCell): + * runtime/JSFunction.cpp: + (JSC::JSFunction::getOwnPropertySlot): + (JSC::JSFunction::getOwnPropertyDescriptor): + (JSC::JSFunction::getOwnNonIndexPropertyNames): + (JSC::JSFunction::defineOwnProperty): + * runtime/JSFunction.h: + (JSFunction): + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::JSGlobalData): + * runtime/JSGlobalData.h: + (JSGlobalData): + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::reset): + * runtime/JSONObject.cpp: + (JSC::Stringifier::Holder::appendNextProperty): + (JSC::Walker::walk): + * runtime/JSObject.cpp: + (JSC): + (JSC::JSObject::visitButterfly): + (JSC::JSObject::visitChildren): + (JSC::JSFinalObject::visitChildren): + (JSC::JSObject::getOwnPropertySlotByIndex): + (JSC::JSObject::put): + (JSC::JSObject::putByIndex): + (JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists): + (JSC::JSObject::enterDictionaryIndexingMode): + (JSC::JSObject::createArrayStorage): + (JSC::JSObject::createInitialArrayStorage): + (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode): + (JSC::JSObject::putDirectAccessor): + (JSC::JSObject::deleteProperty): + (JSC::JSObject::deletePropertyByIndex): + (JSC::JSObject::getOwnPropertyNames): + (JSC::JSObject::getOwnNonIndexPropertyNames): + (JSC::JSObject::preventExtensions): + (JSC::JSObject::fillGetterPropertySlot): + (JSC::JSObject::putIndexedDescriptor): + (JSC::JSObject::defineOwnIndexedProperty): + (JSC::JSObject::allocateSparseIndexMap): + (JSC::JSObject::deallocateSparseIndexMap): + (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage): + (JSC::JSObject::putByIndexBeyondVectorLength): + (JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage): + (JSC::JSObject::putDirectIndexBeyondVectorLength): + (JSC::JSObject::getNewVectorLength): + (JSC::JSObject::increaseVectorLength): + (JSC::JSObject::checkIndexingConsistency): + (JSC::JSObject::growOutOfLineStorage): + (JSC::JSObject::getOwnPropertyDescriptor): + (JSC::putDescriptor): + (JSC::JSObject::putDirectMayBeIndex): + (JSC::JSObject::defineOwnNonIndexProperty): + (JSC::JSObject::defineOwnProperty): + (JSC::JSObject::getOwnPropertySlotSlow): + * runtime/JSObject.h: + (JSC::JSObject::getArrayLength): + (JSObject): + (JSC::JSObject::getVectorLength): + (JSC::JSObject::putDirectIndex): + (JSC::JSObject::canGetIndexQuickly): + (JSC::JSObject::getIndexQuickly): + (JSC::JSObject::canSetIndexQuickly): + (JSC::JSObject::setIndexQuickly): + (JSC::JSObject::initializeIndex): + (JSC::JSObject::completeInitialization): + (JSC::JSObject::inSparseIndexingMode): + (JSC::JSObject::butterfly): + (JSC::JSObject::outOfLineStorage): + (JSC::JSObject::offsetForLocation): + (JSC::JSObject::indexingShouldBeSparse): + (JSC::JSObject::butterflyOffset): + (JSC::JSObject::butterflyAddress): + (JSC::JSObject::arrayStorage): + (JSC::JSObject::arrayStorageOrZero): + (JSC::JSObject::ensureArrayStorage): + (JSC::JSObject::checkIndexingConsistency): + (JSC::JSNonFinalObject::JSNonFinalObject): + (JSC): + (JSC::JSObject::setButterfly): + (JSC::JSObject::setButterflyWithoutChangingStructure): + (JSC::JSObject::JSObject): + (JSC::JSObject::inlineGetOwnPropertySlot): + (JSC::JSObject::putDirectInternal): + (JSC::JSObject::setStructureAndReallocateStorageIfNecessary): + (JSC::JSObject::putDirectWithoutTransition): + (JSC::offsetInButterfly): + (JSC::offsetRelativeToPatchedStorage): + (JSC::indexRelativeToBase): + (JSC::offsetRelativeToBase): + * runtime/JSPropertyNameIterator.cpp: + (JSC::JSPropertyNameIterator::create): + * runtime/JSSymbolTableObject.cpp: + (JSC::JSSymbolTableObject::getOwnNonIndexPropertyNames): + * runtime/JSSymbolTableObject.h: + (JSSymbolTableObject): + * runtime/JSTypeInfo.h: + (JSC): + (JSC::TypeInfo::interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero): + (JSC::TypeInfo::overridesGetPropertyNames): + * runtime/LiteralParser.cpp: + (JSC::::parse): + * runtime/ObjectConstructor.cpp: + * runtime/ObjectPrototype.cpp: + (JSC::ObjectPrototype::ObjectPrototype): + (JSC): + * runtime/ObjectPrototype.h: + (ObjectPrototype): + * runtime/PropertyOffset.h: + (JSC::offsetInOutOfLineStorage): + * runtime/PropertyStorage.h: Added. + (JSC): + * runtime/PutDirectIndexMode.h: Added. + (JSC): + * runtime/RegExpMatchesArray.cpp: + (JSC::RegExpMatchesArray::RegExpMatchesArray): + (JSC): + (JSC::RegExpMatchesArray::create): + (JSC::RegExpMatchesArray::finishCreation): + * runtime/RegExpMatchesArray.h: + (RegExpMatchesArray): + (JSC::RegExpMatchesArray::createStructure): + * runtime/RegExpObject.cpp: + (JSC::RegExpObject::getOwnNonIndexPropertyNames): + * runtime/RegExpObject.h: + (RegExpObject): + * runtime/Reject.h: Added. + (JSC): + (JSC::reject): + * runtime/SparseArrayValueMap.cpp: Added. + (JSC): + * runtime/SparseArrayValueMap.h: Added. + (JSC): + (SparseArrayEntry): + (JSC::SparseArrayEntry::SparseArrayEntry): + (SparseArrayValueMap): + (JSC::SparseArrayValueMap::sparseMode): + (JSC::SparseArrayValueMap::setSparseMode): + (JSC::SparseArrayValueMap::lengthIsReadOnly): + (JSC::SparseArrayValueMap::setLengthIsReadOnly): + (JSC::SparseArrayValueMap::find): + (JSC::SparseArrayValueMap::remove): + (JSC::SparseArrayValueMap::notFound): + (JSC::SparseArrayValueMap::isEmpty): + (JSC::SparseArrayValueMap::contains): + (JSC::SparseArrayValueMap::size): + (JSC::SparseArrayValueMap::begin): + (JSC::SparseArrayValueMap::end): + * runtime/SparseArrayValueMapInlineMethods.h: Added. + (JSC): + (JSC::SparseArrayValueMap::SparseArrayValueMap): + (JSC::SparseArrayValueMap::~SparseArrayValueMap): + (JSC::SparseArrayValueMap::finishCreation): + (JSC::SparseArrayValueMap::create): + (JSC::SparseArrayValueMap::destroy): + (JSC::SparseArrayValueMap::createStructure): + (JSC::SparseArrayValueMap::add): + (JSC::SparseArrayValueMap::putEntry): + (JSC::SparseArrayValueMap::putDirect): + (JSC::SparseArrayEntry::get): + (JSC::SparseArrayEntry::getNonSparseMode): + (JSC::SparseArrayValueMap::visitChildren): + * runtime/StorageBarrier.h: Removed. + * runtime/StringObject.cpp: + (JSC::StringObject::putByIndex): + (JSC): + (JSC::StringObject::deletePropertyByIndex): + * runtime/StringObject.h: + (StringObject): + * runtime/StringPrototype.cpp: + * runtime/Structure.cpp: + (JSC::Structure::Structure): + (JSC::Structure::materializePropertyMap): + (JSC::Structure::nonPropertyTransition): + (JSC): + * runtime/Structure.h: + (Structure): + (JSC::Structure::indexingType): + (JSC::Structure::indexingTypeIncludingHistory): + (JSC::Structure::indexingTypeOffset): + (JSC::Structure::create): + * runtime/StructureTransitionTable.h: + (JSC): + (JSC::toAttributes): + (JSC::newIndexingType): + (JSC::StructureTransitionTable::Hash::hash): + * tests/mozilla/js1_6/Array/regress-304828.js: + +2012-09-12 Mark Lam + + Refactor Opcodes to distinguish between core and extension opcodes. + https://bugs.webkit.org/show_bug.cgi?id=96466. + + Reviewed by Filip Pizlo. + + * bytecode/Opcode.h: + (JSC): Added FOR_EACH_CORE_OPCODE_ID() macro. + * llint/LowLevelInterpreter.h: + (JSC): Auto-generate llint opcode aliases using the + FOR_EACH_CORE_OPCODE_ID() macro. + +2012-09-11 Geoffrey Garen + + Second step to fixing the Windows build: Add new symbols. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + +2012-09-11 Geoffrey Garen + + First step to fixing the Windows build: Remove old symbols. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + +2012-09-11 Geoffrey Garen + + Don't allocate a backing store just for a function's name + https://bugs.webkit.org/show_bug.cgi?id=96468 + + Reviewed by Oliver Hunt. + + Treat function.name like function.length etc., and use a custom getter. + This saves space in closures. + + * debugger/DebuggerCallFrame.cpp: + (JSC::DebuggerCallFrame::functionName): + * debugger/DebuggerCallFrame.h: + (DebuggerCallFrame): Updated for interface change. + + * runtime/Executable.h: + (JSC::JSFunction::JSFunction): Do a little inlining. + + * runtime/JSFunction.cpp: + (JSC::JSFunction::finishCreation): Gone now. That's the point of the patch. + + (JSC::JSFunction::name): + (JSC::JSFunction::displayName): + (JSC::JSFunction::nameGetter): + (JSC::JSFunction::getOwnPropertySlot): + (JSC::JSFunction::getOwnPropertyDescriptor): + (JSC::JSFunction::getOwnPropertyNames): + (JSC::JSFunction::put): + (JSC::JSFunction::deleteProperty): + (JSC::JSFunction::defineOwnProperty): Added custom accessors for .name + just like .length and others. + + * runtime/JSFunction.h: + (JSC::JSFunction::create): + (JSFunction): Updated for interface changes. + +2012-09-11 Mark Hahnenberg + + IncrementalSweeper should not sweep/free Zapped blocks + https://bugs.webkit.org/show_bug.cgi?id=96464 + + Reviewed by Filip Pizlo. + + This is not beneficial in terms of performance because there isn't any way a block can emerge + in the Zapped state from a call to Heap::collect() unless we run an eager sweep on it, in which + case we've already run all the destructors we possibly can. This also causes bugs since we don't + take zapped-ness into account when determining whether or not a block is empty to free it. The + incremental sweeper can then accidentally free blocks that it thinks are empty but are in fact + zapped with still-live objects in them. + + * heap/MarkedBlock.h: + (JSC::MarkedBlock::needsSweeping): It is only valid to sweep a block if it is in the Marked state. + +2012-09-11 Geoffrey Garen + + JSActivation should inline allocate its registers, and eliminate + 'arguments' registers in the common case + https://bugs.webkit.org/show_bug.cgi?id=96427 + + Reviewed by Filip Pizlo. + + This cuts the size class for simple closures down to 64 bytes. + + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::BytecodeGenerator): Set the usesNonStrictEval + flag, which is new. Use a more specific test for whether a function + uses 'arguments', so we can avoid allocating, initializing, and tearing + off those registers in the common case. Distinguish between capturing + arguments and not, so we can avoid allocating space for arguments in + the torn-off object. + + We can make this even more general in the future, with some bytecode + generator refactoring. + + (JSC::BytecodeGenerator::resolve): Updated for new interface. + + * bytecompiler/BytecodeGenerator.h: + (BytecodeGenerator): + (JSC::BytecodeGenerator::symbolTable): Updated some types. + + * heap/Heap.cpp: + (JSC::Heap::isValidAllocation): Allow large allocations, now that they + are both supported and used. + + * heap/Heap.h: + (Heap): Added a new form of allocateCell that specifies the full size + of the allocation, to allow for extra space on the end. + + * interpreter/CallFrame.h: + (JSC::ExecState::argumentOffset): + (JSC::ExecState::argumentOffsetIncludingThis): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::unwindCallFrame): Refactored this code to be more + specific about tearing off 'arguments' vs activations. This is something + I forgot in my last patch, and it is required now that we can have + acitvations without 'arguments' registers. + + * runtime/Arguments.h: + (JSC::Arguments::setRegisters): No need for setRegisters anymore because + the activation object's storage doesn't change. + + * runtime/JSActivation.cpp: + (JSC::JSActivation::JSActivation): Initialize our storage manually because + it's not declared to the C++ compiler. + + (JSC::JSActivation::visitChildren): No copyAndAppend because our storage + is not out-of-line anymore. + + (JSC::JSActivation::symbolTableGet): + (JSC::JSActivation::symbolTablePut): + (JSC::JSActivation::getOwnPropertyNames): + (JSC::JSActivation::symbolTablePutWithAttributes): + (JSC::JSActivation::getOwnPropertySlot): + (JSC::JSActivation::getOwnPropertyDescriptor): + (JSC::JSActivation::argumentsGetter): Refactored isTornOff() testing to + avoid using a data member and to avoid hard-coding any offset assumptions. + + * runtime/JSActivation.h: + (JSC): + (JSActivation): + (JSC::JSActivation::create): + (JSC::JSActivation::isDynamicScope): + (JSC::JSActivation::captureStart): + (JSC::JSActivation::storageSize): + (JSC::JSActivation::storageSizeInBytes): + (JSC::JSActivation::registerOffset): + (JSC::JSActivation::tearOff): + (JSC::JSActivation::isTornOff): + (JSC::JSActivation::storage): + (JSC::JSActivation::allocationSize): + (JSC::JSActivation::isValid): New helper functions for doing the math + on our inline storage. Note that in the "AllOfTheThings" tear-off case, + the number of things is not known at compile time, so we store the + number in the argument count register. We can't just copy the raw contents + of the register beacuse we need a value that is safe for precise marking, + and the value in the register file has an invalid tag. + + * runtime/JSCell.h: + (JSC::allocateCell): New function for allocating with extra storage + on the end. + + * runtime/JSSymbolTableObject.h: + (JSC::JSSymbolTableObject::JSSymbolTableObject): + (JSC::JSSymbolTableObject::finishCreation): + * runtime/JSVariableObject.h: + (JSC::JSVariableObject::JSVariableObject): + (JSVariableObject): Make it easier for subclasses to use their symbol + tables during construction, by passing the table as a constructor argument. + + * runtime/SymbolTable.h: + (JSC::SharedSymbolTable::usesNonStrictEval): + (JSC::SharedSymbolTable::setUsesNonStrictEval): + (SharedSymbolTable): + (JSC::SharedSymbolTable::captureMode): + (JSC::SharedSymbolTable::setCaptureMode): + (JSC::SharedSymbolTable::captureStart): + (JSC::SharedSymbolTable::setCaptureStart): + (JSC::SharedSymbolTable::captureEnd): + (JSC::SharedSymbolTable::setCaptureEnd): + (JSC::SharedSymbolTable::parameterCountIncludingThis): + (JSC::SharedSymbolTable::setParameterCountIncludingThis): + (JSC::SharedSymbolTable::SharedSymbolTable): Added data members to more + precisely describe what kind of capture is in play, and to avoid having + data members in the activation. We expect N activations per symbol table, + so this can be a big savings in heavy closure usage. + +2012-09-11 Ryuan Choi + + Fix build break with LLINT on 32bit machine after r128219 + https://bugs.webkit.org/show_bug.cgi?id=96461 + + Unreviewed build fix. + + * llint/LowLevelInterpreter32_64.asm: Fixed typo. + +2012-09-11 Michael Saboff + + Build fixed for http://trac.webkit.org/changeset/128243 + + Rubber stamped by Stephanie Lewis. + + Added missing include file needed by 96422. + + * icu/unicode/unorm2.h: Added. + +2012-09-11 Michael Saboff + + Build fixed for http://trac.webkit.org/changeset/128243 + + Rubber stamped by Stephanie Lewis. + + Added missing include file needed by 96422. + + * icu/unicode/ptypes.h: Added. + +2012-09-11 Michael Saboff + + Update ICU header files to more recent version + https://bugs.webkit.org/show_bug.cgi?id=96422 + + Reviewed by Geoff Garen. + + Updated ICU header files to 4.6.1. Modifications made as part of the merge are: + platform.h - Changed ifndef / define / endif for U_HAVE_UINT8_T, U_HAVE_UINT16_T, U_HAVE_UINT32_T, + U_HAVE_UINT64_T, U_IS_BIG_ENDIAN and U_ENABLE_TRACING to match the existing platform.h + putil.h (line 132) - Changes defined(U_WINDOWS) to defined(WIN32) || defined(OS2) to match existing putil.h + ustring.h (line 945) - Wrapped macro argument cs with { (const UChar *)cs } to match existing ustring.h + utypes.h (line 545) - Changed defined(U_WINDOWS) to defined(WIN32) to match existing utypes.h + + * icu/unicode/localpointer.h: Added. + * icu/unicode/parseerr.h: + * icu/unicode/platform.h: + * icu/unicode/putil.h: + * icu/unicode/uchar.h: + * icu/unicode/ucnv.h: + * icu/unicode/ucnv_err.h: + * icu/unicode/ucol.h: + * icu/unicode/uconfig.h: + * icu/unicode/uenum.h: + * icu/unicode/uiter.h: + * icu/unicode/uloc.h: + * icu/unicode/umachine.h: + * icu/unicode/unorm.h: + * icu/unicode/urename.h: + * icu/unicode/uscript.h: + * icu/unicode/uset.h: + * icu/unicode/ustring.h: + * icu/unicode/utf.h: + * icu/unicode/utf16.h: + * icu/unicode/utf8.h: + * icu/unicode/utypes.h: + * icu/unicode/uvernum.h: Added. + * icu/unicode/uversion.h: + +2012-09-11 Matt Lilek + + OS X port should compile with newer versions of clang + https://bugs.webkit.org/show_bug.cgi?id=96434 + + m_identIsVarDecl is unused - remove it. + + Reviewed by Anders Carlsson. + + * parser/NodeConstructors.h: + (JSC::ForInNode::ForInNode): + * parser/Nodes.h: + (ForInNode): + +2012-09-11 Filip Pizlo + + LLInt should optimize and profile array length accesses + https://bugs.webkit.org/show_bug.cgi?id=96417 + + Reviewed by Oliver Hunt. + + This fixes the following hole in our array profiling strategy, where the array + is large (more than 1000 elements): + + for (var i = 0; i < array.length; ++i) ... + + The peeled use of array.length (in the array prologue) will execute only once + before DFG optimization kicks in from the loop's OSR point. Since it executed + only once, it executed in the LLInt. And prior to this patch, the LLInt did + not profile array.length accesses - so the DFG will assume, based on the lack + of profiling, that the access is in fact not an access to the JSArray length + property. That could then impede our ability to hoist the array structure + check, and may make us pessimistic in other ways as well, since the generic + GetById used for the array length access will be viewed as a side-effecting + operation. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::printGetByIdCacheStatus): + (JSC::CodeBlock::finalizeUnconditionally): + * bytecode/GetByIdStatus.cpp: + (JSC::GetByIdStatus::computeFromLLInt): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCapabilities.h: + (JSC::DFG::canCompileOpcode): + * dfg/DFGFixupPhase.cpp: + (JSC::DFG::FixupPhase::fixupNode): + * jit/JIT.cpp: + (JSC::JIT::privateCompileMainPass): + (JSC::JIT::privateCompileSlowCases): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * llint/LowLevelInterpreter.asm: + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + +2012-09-11 Raphael Kubo da Costa + + [EFL] Rewrite the EFL-related Find modules + https://bugs.webkit.org/show_bug.cgi?id=95237 + + Reviewed by Kenneth Rohde Christiansen. + + * CMakeLists.txt: Stop setting the LINK_FLAGS property. + * PlatformEfl.cmake: Ditto. + * shell/PlatformEfl.cmake: Ditto. + +2012-09-11 Raphael Kubo da Costa + + [EFL] Unreviewed build fix after r128065. + + * CMakeLists.txt: Link against WTF for FastMalloc symbols, which + are needed when building with SYSTEM_MALLOC off. + +2012-09-10 Mark Hahnenberg + + Remove m_classInfo from JSCell + https://bugs.webkit.org/show_bug.cgi?id=96311 + + Reviewed by Oliver Hunt. + + Now that no one is using the ClassInfo in JSCell, we can remove it for the greater good. This is a 1.5% win on v8v7 and + a 1.7% win on kraken, and is an overall performance progression. + + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): Had to rearrange the order of when we take things off the free list + and when we store the Structure in the object because we would clobber the free list otherwise. This made it not okay for + the structure argument and the scratch register to alias one another. Also removed the store of the ClassInfo pointer in the + object. Yay! + (SpeculativeJIT): + * dfg/DFGSpeculativeJIT32_64.cpp: Since it's no longer okay for for the scratch register and structure register to alias + one another as stated above, had to add an extra temporary for passing the Structure. + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: Ditto. + (JSC::DFG::SpeculativeJIT::compile): + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateBasicJSObject): Similar changes to DFG's inline allocation except that it removed the object from + the free list first, so no changes were necessary there. + * llint/LowLevelInterpreter.asm: Change the constants for amount of inline storage to match PropertyOffset.h and remove + the store of the ClassInfo pointer during inline allocation. + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/JSCell.h: Remove the m_classInfo field and associated methods. + (JSCell): + * runtime/JSObject.h: + (JSObject): + * runtime/PropertyOffset.h: Expand the number of inline storage properties to take up the extra space that we're freeing + with the removal of the ClassInfo pointer. + (JSC): + * runtime/Structure.h: + (JSC): + (JSC::JSCell::JSCell): + (JSC::JSCell::finishCreation): + +2012-09-10 Geoffrey Garen + + Added large allocation support to MarkedSpace + https://bugs.webkit.org/show_bug.cgi?id=96214 + + Originally reviewed by Oliver Hunt, then I added a design revision by + suggested by Phil Pizlo. + + I expanded the imprecise size classes to cover up to 32KB, then added + an mmap-based allocator for everything bigger. There's a lot of tuning + we could do in these size classes, but currently they're almost + completely unused, so I haven't done any tuning. + + Subtle point: the large allocator is a degenerate case of our free list + logic. Its list only ever contains zero or one items. + + * heap/Heap.h: + (JSC::Heap::allocateStructure): Pipe in size information. + + * heap/MarkedAllocator.cpp: + (JSC::MarkedAllocator::tryAllocateHelper): Handle the case where we + find a free item in the sweep list but the item isn't big enough. This + can happen in the large allocator because it mixes sizes. + + (JSC::MarkedAllocator::tryAllocate): + (JSC::MarkedAllocator::allocateSlowCase): More piping. + + (JSC::MarkedAllocator::allocateBlock): Handle the oversize case. + + (JSC::MarkedAllocator::addBlock): I moved the call to didAddBlock here + because it made more sense. + + * heap/MarkedAllocator.h: + (MarkedAllocator): + (JSC::MarkedAllocator::allocate): + * heap/MarkedSpace.cpp: + (JSC::MarkedSpace::MarkedSpace): + (JSC::MarkedSpace::resetAllocators): + (JSC::MarkedSpace::canonicalizeCellLivenessData): + (JSC::MarkedSpace::isPagedOut): + (JSC::MarkedSpace::freeBlock): + * heap/MarkedSpace.h: + (MarkedSpace): + (JSC::MarkedSpace::allocatorFor): + (JSC::MarkedSpace::destructorAllocatorFor): + (JSC::MarkedSpace::allocateWithoutDestructor): + (JSC::MarkedSpace::allocateWithDestructor): + (JSC::MarkedSpace::allocateStructure): + (JSC::MarkedSpace::forEachBlock): + * runtime/Structure.h: + (JSC::Structure): More piping. + +2012-09-10 Geoffrey Garen + + Try to fix the Windows (32-bit) build. + + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_tear_off_arguments): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_tear_off_arguments): Get operands 1 and 2, not 1 and 1. :( + + Also took this opportunity to rename to indicate that these values are + not destinations anymore. + +2012-09-10 Geoffrey Garen + + DFG misses arguments tear-off for function.arguments if 'arguments' is used + https://bugs.webkit.org/show_bug.cgi?id=96227 + + Reviewed by Gavin Barraclough. + + We've decided not to allow function.arguments to alias the local + 'arguments' object, or a local var or function named 'arguments'. + Aliasing complicates the implementation (cf, this bug) and can produce + surprising behavior for web programmers. + + Eliminating the aliasing has the side-effect of fixing this bug. + + The compatibilty story: function.arguments is deprecated, was never + specified, and throws an exception in strict mode, so we expect it to + disappear over time. Firefox does not alias to 'arguments'; Chrome + does, but not if you use eval or with; IE does; Safari did. + + * dfg/DFGByteCodeParser.cpp: Noticed a little cleanup while verifying + this code. Use the CodeBlock method for better encapsulation. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::retrieveArgumentsFromVMCode): Behavior change: don't + alias. + + * tests/mozilla/js1_4/Functions/function-001.js: + (TestFunction_4): Updated test expectations for changed behavior. + +2012-09-10 Filip Pizlo + + offlineasm has some impossible to implement, and unused, instructions + https://bugs.webkit.org/show_bug.cgi?id=96310 + + Reviewed by Mark Hahnenberg. + + * offlineasm/armv7.rb: + * offlineasm/instructions.rb: + * offlineasm/x86.rb: + +2012-09-09 Geoffrey Garen + + Refactored op_tear_off* to support activations that don't allocate space for 'arguments' + https://bugs.webkit.org/show_bug.cgi?id=96231 + + Reviewed by Gavin Barraclough. + + This is a step toward smaller activations. + + As a side-effect, this patch eliminates a load and branch from the hot path + of activation tear-off by moving it to the cold path of arguments tear-off. Our + optimizing assumptions are that activations are common and that reifying the + arguments object is less common. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + * bytecode/Opcode.h: + (JSC::padOpcodeName): Updated for new opcode lengths. + + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::BytecodeGenerator): + (JSC::BytecodeGenerator::addConstantValue): Added support for JSValue() + in the bytecode, which we use when we have 'arguments' but no activation. + + (JSC::BytecodeGenerator::emitReturn): Always emit tear_off_arguments + if we've allocated the arguments registers. This allows tear_off_activation + not to worry about the arguments object anymore. + + Also, pass the activation and arguments values directly to these opcodes + instead of requiring the opcodes to infer the values through special + registers. This gives us more flexibility to move or eliminate registers. + + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGNode.h: + (Node): Updated for new opcode lengths. + + * dfg/DFGOperations.cpp: Activation tear-off doesn't worry about the + arguments object anymore. If 'arguments' is in use and reified, it's + responsible for aliasing back to the activation object in tear_off_arguments. + + * dfg/DFGOperations.h: + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + (SpeculativeJIT): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): Don't pass the arguments object to + activation tear-off; do pass the activation object to arguments tear-off. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): Ditto. + + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_tear_off_activation): + (JSC::JIT::emit_op_tear_off_arguments): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_tear_off_activation): + (JSC::JIT::emit_op_tear_off_arguments): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: Same change in a few more execution engines. + +2012-09-10 Patrick Gansterer + + [JSC] Use StringBuilder::appendNumber() instead of String::number() + https://bugs.webkit.org/show_bug.cgi?id=96236 + + Reviewed by Benjamin Poulain. + + * API/JSContextRef.cpp: + (JSContextCreateBacktrace): + +2012-09-06 Mark Hahnenberg + + Combine MarkStack and SlotVisitor into single class + https://bugs.webkit.org/show_bug.cgi?id=96043 + + Reviewed by Geoff Garen. + + Move all of MarkStack into SlotVisitor. The remaining stuff in MarkStack.cpp actually has to do + with MarkStack management/allocation. Cleaned up a few of the header files while I was at it. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * bytecode/CodeBlock.cpp: + * dfg/DFGCommon.h: + * heap/GCThreadSharedData.cpp: + * heap/GCThreadSharedData.h: + (GCThreadSharedData): + * heap/HeapRootVisitor.h: + * heap/MarkStack.cpp: + (JSC): + * heap/MarkStack.h: + (JSC): + (MarkStackSegment): + (JSC::MarkStackSegment::data): + (JSC::MarkStackSegment::capacityFromSize): + (JSC::MarkStackSegment::sizeFromCapacity): + (MarkStackSegmentAllocator): + (MarkStackArray): + * heap/MarkStackInlineMethods.h: + (JSC::MarkStackArray::postIncTop): + (JSC): + (JSC::MarkStackArray::preDecTop): + (JSC::MarkStackArray::setTopForFullSegment): + (JSC::MarkStackArray::setTopForEmptySegment): + (JSC::MarkStackArray::top): + (JSC::MarkStackArray::validatePrevious): + (JSC::MarkStackArray::append): + (JSC::MarkStackArray::canRemoveLast): + (JSC::MarkStackArray::removeLast): + (JSC::MarkStackArray::isEmpty): + (JSC::MarkStackArray::size): + * heap/SlotVisitor.cpp: Added. + (JSC): + (JSC::SlotVisitor::SlotVisitor): + (JSC::SlotVisitor::~SlotVisitor): + (JSC::SlotVisitor::setup): + (JSC::SlotVisitor::reset): + (JSC::SlotVisitor::append): + (JSC::visitChildren): + (JSC::SlotVisitor::donateKnownParallel): + (JSC::SlotVisitor::drain): + (JSC::SlotVisitor::drainFromShared): + (JSC::SlotVisitor::mergeOpaqueRoots): + (JSC::SlotVisitor::startCopying): + (JSC::SlotVisitor::allocateNewSpaceSlow): + (JSC::SlotVisitor::allocateNewSpaceOrPin): + (JSC::JSString::tryHashConstLock): + (JSC::JSString::releaseHashConstLock): + (JSC::JSString::shouldTryHashConst): + (JSC::SlotVisitor::internalAppend): + (JSC::SlotVisitor::copyAndAppend): + (JSC::SlotVisitor::doneCopying): + (JSC::SlotVisitor::harvestWeakReferences): + (JSC::SlotVisitor::finalizeUnconditionalFinalizers): + (JSC::SlotVisitor::validate): + * heap/SlotVisitor.h: + (JSC): + (SlotVisitor): + (JSC::SlotVisitor::sharedData): + (JSC::SlotVisitor::isEmpty): + (JSC::SlotVisitor::visitCount): + (JSC::SlotVisitor::resetChildCount): + (JSC::SlotVisitor::childCount): + (JSC::SlotVisitor::incrementChildCount): + (ParallelModeEnabler): + (JSC::ParallelModeEnabler::ParallelModeEnabler): + (JSC::ParallelModeEnabler::~ParallelModeEnabler): + * heap/SlotVisitorInlineMethods.h: + (JSC::SlotVisitor::append): + (JSC): + (JSC::SlotVisitor::appendUnbarrieredPointer): + (JSC::SlotVisitor::appendUnbarrieredValue): + (JSC::SlotVisitor::internalAppend): + (JSC::SlotVisitor::addWeakReferenceHarvester): + (JSC::SlotVisitor::addUnconditionalFinalizer): + (JSC::SlotVisitor::addOpaqueRoot): + (JSC::SlotVisitor::containsOpaqueRoot): + (JSC::SlotVisitor::opaqueRootCount): + (JSC::SlotVisitor::mergeOpaqueRootsIfNecessary): + (JSC::SlotVisitor::mergeOpaqueRootsIfProfitable): + (JSC::SlotVisitor::donate): + (JSC::SlotVisitor::donateAndDrain): + * jit/JITWriteBarrier.h: + (JSC::SlotVisitor::append): + * jit/JumpReplacementWatchpoint.cpp: + * runtime/JSCell.h: + * runtime/Structure.h: + (JSC::SlotVisitor::internalAppend): + * runtime/WriteBarrier.h: + (JSC): + (JSC::SlotVisitor::append): + (JSC::SlotVisitor::appendValues): + * yarr/YarrJIT.cpp: + +2012-09-10 Hojong Han + + [EFL] JIT memory usage is not retrieved + https://bugs.webkit.org/show_bug.cgi?id=96095 + + Reviewed by Geoffrey Garen. + + Fill JITBytes for EFL port. + + * runtime/MemoryStatistics.cpp: + (JSC::globalMemoryStatistics): + +2012-09-10 Thiago Marcos P. Santos + + [CMake][EFL] Enable the LLInt + https://bugs.webkit.org/show_bug.cgi?id=92682 + + Reviewed by Csaba Osztrogonác. + + Generate the headers needed by LLint when LLint is enabled. + + * CMakeLists.txt: + +2012-09-10 Carlos Garcia Campos + + Unreviewed. Fix make distcheck. + + * GNUmakefile.list.am: Add missing files. + +2012-09-09 Mark Lam + + Fixed a few llint C++ interpreter bugs. + https://bugs.webkit.org/show_bug.cgi?id=96127. + + Reviewed by Geoffrey Garen. + + * llint/LLIntCLoop.h: + CLoop::execute()'s bootstrapOpcodeId does not need a default + value. There is no case when this function is called without + that parameter being specified. + * llint/LowLevelInterpreter.asm: + Moved the dispatchAfterCall() call to where it is needed. + For the C_LOOP back-end, it generates unreachable code. + * llint/LowLevelInterpreter.cpp: + #include because LLIntAssembly.h needs it. + (JSC): + Fixed bug in SIGN_BIT32() macro. + Placate a MSVC warning for t0, and t1 being uninitialized. + (JSC::CLoop::execute): + The bootstrapOpcodeId arg should always be specified. + MSVC doesn't like UNUSED_PARAM() for labels. Switch to using + the new UNUSED_LABEL() macro. + * offlineasm/cloop.rb: + * offlineasm/generate_offset_extractor.rb: + Resolved a compiler warning found via MSVC. + +2012-09-09 Patrick Gansterer + + Add StringBuilder::appendNumber() and use it + https://bugs.webkit.org/show_bug.cgi?id=96030 + + Reviewed by Eric Seidel. + + Also fix a bunch of append() vs. appendLiteral() issues in the surrounding code. + + * API/JSContextRef.cpp: + (JSContextCreateBacktrace): + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + * interpreter/Interpreter.h: + (JSC::StackFrame::toString): + +2012-09-09 Patrick Gansterer + + Make the String initialization on the function side of String::number() + https://bugs.webkit.org/show_bug.cgi?id=95940 + + Reviewed by Benjamin Poulain. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + +2012-09-09 Geoffrey Garen + + Rolled out because it broke + fast/js/named-function-expression.html. + + Refactored bytecode generator initialization to support moving captured vars around + https://bugs.webkit.org/show_bug.cgi?id=96159 + + Reviewed by Gavin Barraclough. + +2012-09-08 Csaba Osztrogonác + + LLInt buildfix for case sensitive filesystems + https://bugs.webkit.org/show_bug.cgi?id=96099 + + Reviewed by Michael Saboff. + + * llint/LowLevelInterpreter.cpp: Fix filenames. + +2012-09-07 Benjamin Poulain + + Rename the ustring() accessor to string() + https://bugs.webkit.org/show_bug.cgi?id=95919 + + Reviewed by Geoffrey Garen. + + Rename ustring() to string() to make the accessor name more logical after + r127191. + + * API/JSBase.cpp: + (JSEvaluateScript): + (JSCheckScriptSyntax): + * API/JSObjectRef.cpp: + (JSObjectMakeFunctionWithCallback): + (JSObjectMakeFunction): + (JSObjectCopyPropertyNames): + * API/JSProfilerPrivate.cpp: + (JSStartProfiling): + (JSEndProfiling): + * API/JSValueRef.cpp: + (JSValueMakeString): + (JSValueMakeFromJSONString): + * API/OpaqueJSString.cpp: + (OpaqueJSString::string): + * API/OpaqueJSString.h: + (OpaqueJSString): + * bytecode/CodeBlock.cpp: + (JSC::idName): + (JSC::CodeBlock::dump): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::emitLoad): + (JSC::BytecodeGenerator::addStringConstant): + * bytecompiler/NodesCodegen.cpp: + (JSC::RegExpNode::emitBytecode): + (JSC::processClauseList): + * dfg/DFGGraph.cpp: + (JSC::DFG::Graph::dump): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * jsc.cpp: + (GlobalObject::addFunction): + (GlobalObject::addConstructableFunction): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * parser/ASTBuilder.h: + (JSC::ASTBuilder::createRegExp): + * parser/Parser.cpp: + (JSC::::parsePrimaryExpression): + * parser/Parser.h: + (JSC::Scope::declareVariable): + (JSC::Scope::declareParameter): + (JSC::Scope::useVariable): + * parser/SyntaxChecker.h: + (JSC::SyntaxChecker::createRegExp): + * runtime/ExceptionHelpers.cpp: + (JSC::createUndefinedVariableError): + * runtime/Executable.cpp: + (JSC::FunctionExecutable::paramString): + * runtime/Executable.h: + (JSC::FunctionExecutable::finishCreation): + * runtime/FunctionPrototype.cpp: + (JSC::FunctionPrototype::addFunctionProperties): + * runtime/Identifier.h: + (JSC::Identifier::string): + * runtime/JSFunction.cpp: + (JSC::JSFunction::calculatedDisplayName): + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::reset): + * runtime/JSONObject.cpp: + (JSC::PropertyNameForFunctionCall::value): + (JSC::Stringifier::Holder::appendNextProperty): + (JSC::Walker::walk): + * runtime/JSPropertyNameIterator.h: + (JSC::JSPropertyNameIterator::finishCreation): + * runtime/JSScope.cpp: + (JSC::JSScope::resolveBase): + * runtime/JSString.h: + (JSC::inlineJSValueNotStringtoString): + * runtime/LiteralParser.cpp: + (JSC::::parse): + * runtime/ObjectConstructor.cpp: + (JSC::ObjectConstructor::finishCreation): + (JSC::objectConstructorGetOwnPropertyNames): + (JSC::objectConstructorKeys): + * runtime/RegExpConstructor.cpp: + (JSC::RegExpConstructor::finishCreation): + +2012-09-07 Gavin Barraclough + + CALLFRAME_OFFSET and EXCEPTION_OFFSET are same in ctiTrampoline on ARM Thumb2 + https://bugs.webkit.org/show_bug.cgi?id=82013 + + Reviewed by Geoff Garen. + + Neither of these values need to be stored. At all. + + * jit/JITStubs.cpp: + (JSC): + (JSC::ctiTrampoline): + (JSC::JITThunks::JITThunks): + - Nothing to see here. Move along. + +2012-09-07 Sheriff Bot + + Unreviewed, rolling out r127938. + http://trac.webkit.org/changeset/127938 + https://bugs.webkit.org/show_bug.cgi?id=96166 + + It broke the build (Requested by smfr on #webkit). + + * llint/LowLevelInterpreter.cpp: + (JSC): + (JSC::CLoop::execute): + * offlineasm/cloop.rb: + +2012-09-07 Geoffrey Garen + + Refactored bytecode generator initialization to support moving captured vars around + https://bugs.webkit.org/show_bug.cgi?id=96159 + + Reviewed by Gavin Barraclough. + + This patch separates the stages of allocating registers, declaring identifiers + in the symbol table, and initializing registers, so you can change + allocation decisions without breaking the world. + + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::BytecodeGenerator): Call a set of helper functions + instead of inlining all the code, to help clarity. + + (JSC::BytecodeGenerator::allocateCapturedVars): + (JSC::BytecodeGenerator::allocateUncapturedVars): + (JSC::BytecodeGenerator::allocateActivationVar): + (JSC::BytecodeGenerator::allocateArgumentsVars): + (JSC::BytecodeGenerator::allocateCalleeVarUndeclared): + (JSC::BytecodeGenerator::declareParameters): + (JSC::BytecodeGenerator::declareCallee): + (JSC::BytecodeGenerator::initCalleeVar): + (JSC::BytecodeGenerator::initArgumentsVars): + (JSC::BytecodeGenerator::initActivationVar): + (JSC::BytecodeGenerator::initThisParameter): + (JSC::BytecodeGenerator::initFunctionDeclarations): + (JSC::BytecodeGenerator::declareParameter): + (JSC::BytecodeGenerator::createLazyRegisterIfNecessary): + (JSC::BytecodeGenerator::createActivationIfNecessary): Factored these + helper functions out from pre-existing code. + + * bytecompiler/BytecodeGenerator.h: + (BytecodeGenerator): + * parser/ASTBuilder.h: + (JSC::ASTBuilder::createFuncDeclStatement): + (JSC::ASTBuilder::addVar): + * parser/Nodes.h: + (JSC::DeclarationStacks::VarDeclaration::VarDeclaration): + (VarDeclaration): + (JSC::DeclarationStacks::FunctionDeclaration::FunctionDeclaration): + (FunctionDeclaration): Declaration stacks get a little more data now, + to support allocating registers before putting things in the symbol + table. I'm convinced that we should eventually just expand the symbol + table to understand these things. + +2012-09-07 Mark Lam + + Fix a llint C++ interpreter bugs. + https://bugs.webkit.org/show_bug.cgi?id=96127. + + Reviewed by Filip Pizlo. + + * llint/LowLevelInterpreter.cpp: + (JSC): + (JSC::CLoop::execute): + * offlineasm/cloop.rb: + +2012-09-07 Gavin Barraclough + + Object.prototype.__define{G,S}etter__ with non-callable second parameter should throw TypeError instead of SyntaxError + https://bugs.webkit.org/show_bug.cgi?id=93873 + + Reviewed by Sam Weinig. + + * runtime/ObjectPrototype.cpp: + (JSC::objectProtoFuncDefineGetter): + - throw TypeError instead of SyntaxError + (JSC::objectProtoFuncDefineSetter): + - throw TypeError instead of SyntaxError + +2012-09-06 Mark Hahnenberg + + JSC should have a zombie mode + https://bugs.webkit.org/show_bug.cgi?id=96047 + + Reviewed by Geoffrey Garen. + + To aid clients of JSC while they are debugging memory issues, we should add a zombie + mode that scribbles into objects in the MarkedSpace after they are found to be dead + to prevent a sort of "use after free" situation. As a first cut we should support a + mode that just scribbles on objects prior to their being reused (i.e. while they are + "zombies") and a mode in which, in addition to scribbling on zombies, once an object + has been marked its mark bit will never be cleared, thus giving us "immortal" zombies. + + These two modes will be enabled through the use of environment variables. For now these + will be "JSZombieEnabled" and "JSImmortalZombieEnabled". Setting them to any value will + result in the use of the appropriate mode. + + * heap/Heap.cpp: + (JSC::Heap::collect): Zombifies dead objects at the end of collection if zombie mode is enabled. + (ZombifyCellFunctor): + (JSC::ZombifyCellFunctor::ZombifyCellFunctor): Sets marked bits for dead objects if in immortal mode and writes 0xbbadbeef into them. + (JSC::ZombifyCellFunctor::operator()): + (JSC): + (ZombifyBlockFunctor): + (JSC::ZombifyBlockFunctor::operator()): + (JSC::Heap::zombifyDeadObjects): Eagerly sweeps so that we don't write garbage into an object before it + is finalized/destroyed. + * heap/Heap.h: + (Heap): + * heap/MarkedBlock.h: + (MarkedBlock): + (JSC::MarkedBlock::forEachDeadCell): Used to iterate over dead cells at the end of collection if zombie mode is enabled. + (JSC): + * runtime/Options.cpp: + (JSC::Options::initialize): + * runtime/Options.h: + (JSC): + +2012-09-05 Geoffrey Garen + + Rolled back in with a fix for + fast/dom/HTMLScriptElement/script-reexecution-pretty-diff.html, which + is to make sure that function declarations don't put their names in scope. + + Reviewed by Gavin Barraclough. + + Named functions should not allocate scope objects for their names + https://bugs.webkit.org/show_bug.cgi?id=95659 + + Reviewed by Oliver Hunt. + +2012-09-06 Michael Saboff + + 16 bit JSRopeString up converts an 8 bit fibers to 16 bits during resolution + https://bugs.webkit.org/show_bug.cgi?id=95810 + + Reviewed by Benjamin Poulain. + + Added 8 bit path that copies the contents of an 8 bit fiber to the 16 bit buffer + when resolving a 16 bit rope. + + * runtime/JSString.cpp: + (JSC::JSRopeString::resolveRopeSlowCase): + +2012-09-06 Gavin Barraclough + + JS test suite puts incorrect limitations on Function.toString() + https://bugs.webkit.org/show_bug.cgi?id=3975 + + Reviewed by Geoff Garen. + + The result of function toString is implementation defined; + these test cases were looking for specific whitespace formatting + that matches mozilla's, and for redundant braces to be inserted + around if/else blocks. Stop that. + + * tests/mozilla/expected.html: + * tests/mozilla/js1_2/function/tostring-1.js: + (simplify): + - reduce whitespace differences + * tests/mozilla/js1_2/function/tostring-2.js: + (simplify): + - reduce whitespace differences + (TestOr): + (TestAnd): + - added braces to match expected output + +2012-09-06 Yuqiang Xian + + Performance regressions on 32-bit platforms with revisions 125637 and 126387 + https://bugs.webkit.org/show_bug.cgi?id=95953 + + Reviewed by Filip Pizlo. + + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::emit_op_get_by_val): Fix the typo. + +2012-09-05 Geoffrey Garen + + Rolled out because it broke + fast/dom/HTMLScriptElement/script-reexecution-pretty-diff.html + + Named functions should not allocate scope objects for their names + https://bugs.webkit.org/show_bug.cgi?id=95659 + + Reviewed by Oliver Hunt. + +2012-09-06 Mark Lam + + Renamed useYarrJIT() option to useRegExpJIT(). Also fixed regression in + which inadvertantly allows the ASM llint to use the baseline JIT when + useRegExpJIT() is true. + https://bugs.webkit.org/show_bug.cgi?id=95918. + + Reviewed by Geoffrey Garen. + + * runtime/JSGlobalData.cpp: + (JSC::enableAssembler): + (JSC::JSGlobalData::JSGlobalData): + * runtime/JSGlobalData.h: + (JSC::JSGlobalData::canUseJIT): + (JSC::JSGlobalData::canUseRegExpJIT): + (JSGlobalData): + * runtime/Options.cpp: + (JSC::Options::initialize): + * runtime/Options.h: + (JSC): + +2012-09-06 Patrick Gansterer + + Build fix for Interpreter after r127698. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + +2012-09-05 Geoffrey Garen + + Named functions should not allocate scope objects for their names + https://bugs.webkit.org/show_bug.cgi?id=95659 + + Reviewed by Oliver Hunt. + + In most cases, we can merge a function expression's name into its symbol + table. This reduces memory footprint per closure from three objects + (function + activation + name scope) to two (function + activation), + speeds up closure allocation, and speeds up recursive calls. + + In the case of a named function expression that contains a non-strict + eval, the rules are so bat-poop crazy that I don't know how to model + them without an extra object. Since functions now default to not having + such an object, this case needs to allocate the object on function + entry. + + Therefore, this patch makes the slow case a bit slower so the fast case + can be faster and more memory-efficient. (Note that the slow case already + allocates an activation on entry, and until recently also allocated a + scope chain node on entry, so adding one allocation on entry shouldn't + break the bank.) + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::CodeBlock): Caught a missed initializer. No behavior change. + + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::BytecodeGenerator): Put the callee in static scope + during compilation so it doesn't need to be in dynamic scope at runtime. + + (JSC::BytecodeGenerator::resolveCallee): + (JSC::BytecodeGenerator::addCallee): Helper functions for either statically + resolving the callee or adding a dynamic scope that will resolve to it, + depending on whether you're in the fast path. + + We move the callee into a var location if it's captured because activations + prefer to have contiguous ranges of captured variables. + + * bytecompiler/BytecodeGenerator.h: + (JSC::BytecodeGenerator::registerFor): + (BytecodeGenerator): + + * dfg/DFGOperations.cpp: + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): This is the point of the patch: remove + one allocation in the case of a named function expression. + + * parser/Parser.cpp: + (JSC::::Parser): + * parser/Parser.h: + (JSC::Scope::declareCallee): + (Scope): + (Parser): + (JSC::parse): + * runtime/Executable.cpp: + (JSC::EvalExecutable::compileInternal): + (JSC::ProgramExecutable::checkSyntax): + (JSC::ProgramExecutable::compileInternal): + (JSC::FunctionExecutable::produceCodeBlockFor): + (JSC::FunctionExecutable::fromGlobalCode): Pipe the callee's name through + the parser so we get accurate information on whether the callee was captured. + + (JSC::FunctionExecutable::FunctionExecutable): + (JSC::EvalExecutable::compileInternal): + (JSC::ProgramExecutable::checkSyntax): + (JSC::ProgramExecutable::compileInternal): + (JSC::FunctionExecutable::produceCodeBlockFor): + (JSC::FunctionExecutable::fromGlobalCode): + * runtime/Executable.h: + (JSC::FunctionExecutable::create): + (FunctionExecutable): + (JSC::FunctionExecutable::finishCreation): I had to refactor function + creation to support the following function constructor quirk: the function + gets a name, but its name is not in lexical scope. + + To simplify this, FunctionExecutable now automatically extracts all the + data it needs from the parsed node. The special "fromGlobalCode" path + used by the function constructor creates an anonymous function, and then + quirkily sets the value used by the .name property to be non-null, even + though the parsed name is null. + + * runtime/JSNameScope.h: + (JSC::JSNameScope::create): + (JSC::JSNameScope::JSNameScope): Added support for explicitly specifying + your container scope. The compiler uses this for named function expressions. + +2012-09-05 Gavin Barraclough + + a = data[a]++; sets the wrong key in data + https://bugs.webkit.org/show_bug.cgi?id=91270 + + Reviewed by Oliver Hunt. + + Postfix inc/dec is unsafely using finalDestination, can trample base/subscript prior to the result being put. + + * bytecompiler/NodesCodegen.cpp: + (JSC::PostfixNode::emitResolve): + - Remove redundant parens. + (JSC::PostfixNode::emitBracket): + (JSC::PostfixNode::emitDot): + - Refactored to use tempDestination instead of finalDestination. + (JSC::PrefixNode::emitBracket): + (JSC::PrefixNode::emitDot): + - Should be using emitPreIncOrDec. + +2012-09-05 Gavin Barraclough + + Bug, assignment within subscript of prefix/postfix increment of bracket access + https://bugs.webkit.org/show_bug.cgi?id=95913 + + Reviewed by Oliver Hunt. + + javascript:alert((function(){ var a = { x:1 }; var b = { x:1 }; a[a=b,"x"]++; return a.x; })()) + + * bytecompiler/NodesCodegen.cpp: + (JSC::PostfixNode::emitBracket): + (JSC::PrefixNode::emitBracket): + - Should check for assigments in the subscript when loading the base. + * parser/Nodes.h: + (JSC::BracketAccessorNode::subscriptHasAssignments): + (BracketAccessorNode): + - Used by emitBracket methods. + +2012-09-05 Gavin Barraclough + + Merge prefix/postfix nodes + https://bugs.webkit.org/show_bug.cgi?id=95898 + + Reviewed by Geoff Garen. + + Simplify the AST. + This will also mean we have access to m_subscriptHasAssignments when generating a prefix/postfix op applied to a bracket access. + + * bytecompiler/NodesCodegen.cpp: + (JSC::PostfixNode::emitResolve): + - was PostfixResolveNode::emitBytecode + (JSC::PostfixNode::emitBracket): + - was PostfixBracketNode::emitBytecode + (JSC::PostfixNode::emitDot): + - was PostfixDotNode::emitBytecode + (JSC::PostfixNode::emitBytecode): + - was PostfixErrorNode::emitBytecode, call resolve/bracket/dot version as appropriate. + (JSC::PrefixNode::emitResolve): + - was PrefixResolveNode::emitBytecode + (JSC::PrefixNode::emitBracket): + - was PrefixBracketNode::emitBytecode + (JSC::PrefixNode::emitDot): + - was PrefixDotNode::emitBytecode + (JSC::PrefixNode::emitBytecode): + - was PrefixErrorNode::emitBytecode, call resolve/bracket/dot version as appropriate. + * parser/ASTBuilder.h: + (JSC::ASTBuilder::makePrefixNode): + - Just makes a PrefixNode! + (JSC::ASTBuilder::makePostfixNode): + - Just makes a PostfixNode! + * parser/NodeConstructors.h: + (JSC::PostfixNode::PostfixNode): + - Added, merge of PostfixResolveNode/PostfixBracketNode/PostfixDotNode/PostfixErrorNode. + (JSC::PrefixNode::PrefixNode): + - Added, merge of PrefixResolveNode/PrefixBracketNode/PrefixDotNode/PrefixErrorNode. + * parser/Nodes.h: + (PostfixNode): + - Added, merge of PostfixResolveNode/PostfixBracketNode/PostfixDotNode/PostfixErrorNode. + (PrefixNode): + - Added, merge of PrefixResolveNode/PrefixBracketNode/PrefixDotNode/PrefixErrorNode. + +2012-09-05 Mark Hahnenberg + + Remove use of JSCell::classInfoOffset() from tryCacheGetByID + https://bugs.webkit.org/show_bug.cgi?id=95860 + + Reviewed by Oliver Hunt. + + We should just do the indirection through the Structure instead. + + * dfg/DFGRepatch.cpp: + (JSC::DFG::tryCacheGetByID): + +2012-09-05 Geoffrey Garen + + Throw exceptions when assigning to const in strict mode + https://bugs.webkit.org/show_bug.cgi?id=95894 + + Reviewed by Oliver Hunt. + + Currently, this never happens; but it will start happening once the + callee is a local const register. In this patch, there's no change in + behavior. + + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::emitReadOnlyExceptionIfNeeded): Helper function + for doing the throwing. + * bytecompiler/BytecodeGenerator.h: + + * bytecompiler/NodesCodegen.cpp: + (JSC::PostfixResolveNode::emitBytecode): + (JSC::PrefixResolveNode::emitBytecode): + (JSC::ReadModifyResolveNode::emitBytecode): + (JSC::AssignResolveNode::emitBytecode): Call the helper function. + +2012-09-05 Geoffrey Garen + + Refactored callee access in the DFG to support it in the general case + https://bugs.webkit.org/show_bug.cgi?id=95887 + + Reviewed by Phil Pizlo and Gavin Barraclough. + + To support named function expressions, the DFG needs to understand the + callee register being used in arbitrary expressions, and not just + create_this. + + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::getDirect): + (JSC::DFG::ByteCodeParser::getCallee): Remap access to the callee register + into a GetCallee node. Otherwise, we get confused and think we have a + negatively indexed argument. + + (ByteCodeParser): + (JSC::DFG::ByteCodeParser::InlineStackEntry::remapOperand): Inlining also + needs to remap, but to the callee in the inline frame, and not the caller's + callee. + + (JSC::DFG::ByteCodeParser::parseBlock): Since we support the callee in + the general case now, there's no need to handle it in a special way for + create_this. + +2012-09-05 Mark Hahnenberg + + Remove use of JSCell::classInfoOffset() from virtualForThunkGenerator + https://bugs.webkit.org/show_bug.cgi?id=95821 + + Reviewed by Oliver Hunt. + + We can replace the load of the ClassInfo from the object with a load from the Structure. + + * dfg/DFGThunks.cpp: + (JSC::DFG::virtualForThunkGenerator): + +2012-09-05 Benjamin Poulain + + Fix the uses of String::operator+=() for Mac + https://bugs.webkit.org/show_bug.cgi?id=95818 + + Reviewed by Dan Bernstein. + + * jsc.cpp: + (functionJSCStack): Use StringBuilder to create the stack dump, it is faster + and avoid String::operator+=(). + + * parser/Parser.h: + (JSC::Parser::updateErrorMessageSpecialCase): + (JSC::Parser::updateErrorMessage): + (JSC::Parser::updateErrorWithNameAndMessage): + Use the String operators (and makeString) to concatenate the strings. + +2012-09-05 Gabor Rapcsanyi + + DFG JIT doesn't work properly on ARM hardfp + https://bugs.webkit.org/show_bug.cgi?id=95684 + + Reviewed by Filip Pizlo. + + Add hardfp support to DFG JIT. The patch is created with the + help of Zoltan Herczeg. + + * dfg/DFGCCallHelpers.h: + (CCallHelpers): + (JSC::DFG::CCallHelpers::setupArguments): + * dfg/DFGFPRInfo.h: + (FPRInfo): + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult): + (JSC::DFG::SpeculativeJIT::appendCallSetResult): + +2012-09-04 Mark Lam + + Allow the YarrJIT to use the assembler even when useJIT() is false. + Introduce the useYarrJIT() option. + https://bugs.webkit.org/show_bug.cgi?id=95809. + + Reviewed by Geoffrey Garen. + + * runtime/JSGlobalData.cpp: + (JSC::enableAssembler): + * runtime/Options.cpp: + (JSC::Options::initialize): + * runtime/Options.h: + (JSC): + +2012-09-04 Gavin Barraclough + + inc/dec behave incorrectly operating on a resolved const + https://bugs.webkit.org/show_bug.cgi?id=95815 + + Reviewed by Geoff Garen. + + There are two bugs here. + + (1) When the value being incremented is const, and the result is ignored, we assume this cannot be observed, and emit no code. + However if the value being incremented is not a primitive & has a valueOf conversion, then this should be being called. + + (2) In the case of a pre-increment of a const value where the result is not ignored, we'll move +/-1 to the destination, then + add the resolved const value being incremented to this. This is problematic if the destination is a local, and the const + value being incremented has a valueOf conversion that throws - the destination will be modified erroneously. Instead, we + need to use a temporary location. + + * bytecompiler/NodesCodegen.cpp: + (JSC::PostfixResolveNode::emitBytecode): + (JSC::PrefixResolveNode::emitBytecode): + - always at least perform a toNumber conversion, use tempDestination when reducing inc/dec to an add +/-1. + +2012-09-04 Filip Pizlo + + DFG GetByVal for JSArrays shouldn't OSR exit every time that the index is out of bound + https://bugs.webkit.org/show_bug.cgi?id=95717 + + Reviewed by Oliver Hunt. + + Rolling back in after fixing the negative index case. + + Make GetByVal for JSArrayOutOfBounds do meaningful things. The profiling was already + there so we should just use it! + + * bytecode/DFGExitProfile.h: + (JSC::DFG::exitKindToString): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-09-04 Sheriff Bot + + Unreviewed, rolling out r127503. + http://trac.webkit.org/changeset/127503 + https://bugs.webkit.org/show_bug.cgi?id=95788 + + broke some tests (fast/js/dfg-negative-array-index, fast/js + /dfg-put-by-val-setter-then-get-by-val) (Requested by thorton + on #webkit). + + * bytecode/DFGExitProfile.h: + (JSC::DFG::exitKindToString): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-09-04 Benjamin Poulain + + Improve JSC use of Strings after the UString->String change + https://bugs.webkit.org/show_bug.cgi?id=95633 + + Reviewed by Geoffrey Garen. + + This patch improve the use of strings in the JSC runtime. + + The initialization of Identifier is left for future patches. + + The improvements are the following: + -5% faster to raise one of the modified exception. + -3 times faster to execute Boolean::toString() + + Most of the changes are just about using the new methods + for string literals. + + With the changes, the binary on x86_64 gets 176 bytes smaller. + + * API/JSCallbackObjectFunctions.h: + (JSC::::staticFunctionGetter): + (JSC::::callbackGetter): + * API/JSContextRef.cpp: + (JSContextCreateBacktrace): + * API/JSObjectRef.cpp: + (JSObjectMakeFunctionWithCallback): + * bytecode/CodeBlock.cpp: + (JSC::valueToSourceString): + (JSC::CodeBlock::nameForRegister): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::addStackTraceIfNecessary): + * runtime/ArrayConstructor.cpp: + (JSC::constructArrayWithSizeQuirk): + * runtime/ArrayPrototype.cpp: + (JSC::shift): + (JSC::unshift): + (JSC::arrayProtoFuncPop): + (JSC::arrayProtoFuncReverse): + * runtime/BooleanPrototype.cpp: + (JSC::booleanProtoFuncToString): Instead of instanciating new strings, reuse the + keywords available in SmallStrings. Avoiding the creation of the JSString and StringImpl + makes the method significantly faster. + + * runtime/DateConversion.cpp: + (JSC::formatDateTime): + * runtime/DatePrototype.cpp: + (JSC::formatLocaleDate): + (JSC::formateDateInstance): + (JSC::dateProtoFuncToISOString): + Change the way we use snprintf() for clarity and performance. + + Instead of allocating one extra byte to put a zero "just in case", we use the size returned + by snprintf(). + To prevent any overflow from a programming mistake, we explicitely test for overflow and + return an empty string. + + (JSC::dateProtoFuncToJSON): + * runtime/Error.cpp: + (JSC::createNotEnoughArgumentsError): + (JSC::throwTypeError): + (JSC::throwSyntaxError): + * runtime/Error.h: + (JSC::StrictModeTypeErrorFunction::create): + * runtime/ErrorPrototype.cpp: + (JSC::ErrorPrototype::finishCreation): + (JSC::errorProtoFuncToString): + Using a null String is correct because (8) uses jsString(), (9) tests for a length of 0. + + * runtime/ExceptionHelpers.cpp: + (JSC::InterruptedExecutionError::defaultValue): + (JSC::TerminatedExecutionError::defaultValue): + (JSC::createStackOverflowError): + (JSC::createOutOfMemoryError): + * runtime/Executable.cpp: + (JSC::EvalExecutable::compileInternal): + (JSC::FunctionExecutable::paramString): + * runtime/FunctionConstructor.cpp: + (JSC::constructFunction): + (JSC::constructFunctionSkippingEvalEnabledCheck): + * runtime/FunctionPrototype.h: + (JSC::FunctionPrototype::create): + Using a null String for the name is correct because InternalFunction uses jsString() + to create the name value. + + * runtime/InternalFunction.cpp: + (JSC::InternalFunction::finishCreation): + There is no need to create an empty string for a null string, jsString() handle both + cases as empty JSString. + + * runtime/JSArray.cpp: + (JSC::reject): + (JSC::SparseArrayValueMap::put): + (JSC::JSArray::put): + (JSC::JSArray::putByIndexBeyondVectorLength): + (JSC::JSArray::putDirectIndexBeyondVectorLength): + (JSC::JSArray::setLength): + (JSC::JSArray::pop): + (JSC::JSArray::push): + * runtime/JSFunction.cpp: + (JSC::JSFunction::finishCreation): Same issue as InternalFunction::finishCreation. + + (JSC::JSFunction::callerGetter): + (JSC::JSFunction::defineOwnProperty): + * runtime/JSGlobalData.cpp: + (JSC::enableAssembler): Use CFSTR() instead of CFStringCreateWithCString(). + CFStringCreateWithCString() copy the content and may choose to decode the data. + CFSTR() is much more efficient. + + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::reset): + JSFunction uses jsString() to create the name, we can use null strings instead + of creating empty strings. + + (JSC::JSGlobalObject::createThrowTypeError): ditto. + * runtime/JSGlobalObjectFunctions.cpp: + (JSC::encode): + (JSC::decode): + (JSC::globalFuncEval): + * runtime/JSONObject.cpp: + (JSC::Stringifier::appendStringifiedValue): + (JSC::Stringifier::Holder::appendNextProperty): + (JSC::JSONProtoFuncParse): + (JSC::JSONProtoFuncStringify): + * runtime/JSObject.cpp: + (JSC::JSObject::put): + (JSC::JSObject::defaultValue): + (JSC::JSObject::hasInstance): + (JSC::JSObject::defineOwnProperty): + * runtime/JSString.cpp: + Return an empty JSString to avoid the creation of a temporary empty String. + + (JSC::JSRopeString::getIndexSlowCase): + * runtime/JSString.h: + (JSC): Remove the versions of jsNontrivialString() taking a char*. All the callers + have been replaced by calls using ASCIILiteral. + + * runtime/JSValue.cpp: + (JSC::JSValue::putToPrimitive): + * runtime/LiteralParser.cpp: + (JSC::::Lexer::lex): + (JSC::::Lexer::lexString): + (JSC::::Lexer::lexNumber): + (JSC::::parse): + * runtime/LiteralParser.h: + (JSC::LiteralParser::getErrorMessage): + * runtime/NumberPrototype.cpp: + (JSC::numberProtoFuncToExponential): + (JSC::numberProtoFuncToFixed): + (JSC::numberProtoFuncToPrecision): + (JSC::numberProtoFuncToString): + * runtime/ObjectConstructor.cpp: + (JSC::objectConstructorGetPrototypeOf): + (JSC::objectConstructorGetOwnPropertyDescriptor): + (JSC::objectConstructorGetOwnPropertyNames): + (JSC::objectConstructorKeys): + (JSC::toPropertyDescriptor): + (JSC::objectConstructorDefineProperty): + (JSC::objectConstructorDefineProperties): + (JSC::objectConstructorCreate): + (JSC::objectConstructorSeal): + (JSC::objectConstructorFreeze): + (JSC::objectConstructorPreventExtensions): + (JSC::objectConstructorIsSealed): + (JSC::objectConstructorIsFrozen): + (JSC::objectConstructorIsExtensible): + * runtime/ObjectPrototype.cpp: + (JSC::objectProtoFuncDefineGetter): + (JSC::objectProtoFuncDefineSetter): + (JSC::objectProtoFuncToString): + * runtime/RegExpConstructor.cpp: + (JSC::constructRegExp): + * runtime/RegExpObject.cpp: + (JSC::reject): + (JSC::regExpObjectSource): + * runtime/RegExpPrototype.cpp: + (JSC::regExpProtoFuncCompile): + * runtime/StringObject.cpp: + (JSC::StringObject::defineOwnProperty): + * runtime/StringPrototype.cpp: + (JSC::jsSpliceSubstrings): + (JSC::jsSpliceSubstringsWithSeparators): + +2012-09-04 Filip Pizlo + + DFG GetByVal for JSArrays shouldn't OSR exit every time that the index is out of bound + https://bugs.webkit.org/show_bug.cgi?id=95717 + + Reviewed by Oliver Hunt. + + Make GetByVal for JSArrayOutOfBounds do meaningful things. The profiling was already + there so we should just use it! + + * bytecode/DFGExitProfile.h: + (JSC::DFG::exitKindToString): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-09-04 Zoltan Horvath + + Extend the coverage of the Custom Allocation Framework in WTF and in JavaScriptCore + https://bugs.webkit.org/show_bug.cgi?id=95737 + + Reviewed by Eric Seidel. + + Add WTF_MAKE_FAST_ALLOCATED macro to the following class declarations because these are instantiated by operator new. + + * wtf/CryptographicallyRandomNumber.cpp: CryptographicallyRandomNumber is instantiated at wtf/CryptographicallyRandomNumber.cpp:162. + + * heap/MachineStackMarker.cpp: + (MachineThreads::Thread): Thread is instantiated at heap/MachineStackMarker.cpp:196. + * jit/ExecutableAllocatorFixedVMPool.cpp: + (FixedVMPoolExecutableAllocator): FixedVMPoolExecutableAllocator is instantiated at jit/ExecutableAllocatorFixedVMPool.cpp:111 + * parser/SourceProviderCache.h: + (SourceProviderCache): SourceProviderCache is instantiated at parser/SourceProvider.h:49. + * parser/SourceProviderCacheItem.h: + (SourceProviderCacheItem): SourceProviderCacheItem is instantiated at parser/Parser.cpp:843. + * runtime/GCActivityCallback.h: + (GCActivityCallback): GCActivityCallback is instantiated at runtime/GCActivityCallback.h:96. + * tools/CodeProfile.h: + (CodeProfile): CodeProfile is instantiated at JavaScriptCore/tools/CodeProfiling.cpp:140. + +2012-09-04 Mark Hahnenberg + + Remove uses of ClassInfo from SpeculativeJIT::compileObjectOrOtherLogicalNot + https://bugs.webkit.org/show_bug.cgi?id=95510 + + Reviewed by Oliver Hunt. + + More refactoring to get rid of ClassInfo checks in the DFG. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot): + (JSC::DFG::SpeculativeJIT::compileLogicalNot): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compileNonStringCellOrOtherLogicalNot): + (JSC::DFG::SpeculativeJIT::compileLogicalNot): + +2012-09-03 Patrick Gansterer + + Unreviewed. Build fix for ENABLE(CLASSIC_INTERPRETER) after r127393. + + * interpreter/Interpreter.h: + +2012-09-02 Geoffrey Garen + + Fixed failures seen on Linux bots. + + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_push_with_scope): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_push_with_scope): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * jit/JITStubs.h: push_*_scope doesn't have a destination operand anymore. + Accordingly, update these places in the baseline JIT, which I missed in my last patch. + +2012-09-02 Geoffrey Garen + + Refactored scope chain opcodes to support optimization for named function expressions + https://bugs.webkit.org/show_bug.cgi?id=95658 + + Reviewed by Sam Weinig. + + Renamed + push_scope => push_with_scope + push_new_scope => push_name_scope + to clarify the difference between them. + + Changed push_with_scope and push_name_scope not to save the new scope in + a temporary register, since doing so made optimization harder. + + (The old behavior was a hold-over from when the scope chain wasn't + a GC object, and wouldn't be marked otherwise. Now, the scope chain is + marked because it is a GC object pointed to by the call frame.) + + Changed push_name_scope to accept an operand specifying the attributes + for the named property, instead of assuming DontDelete, because a named + function expression needs ReadOnly|DontDelete. + + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::highestUsedRegister): Removed this function, + which used to be related to preserving saved scope object temporaries, + because it had no callers. + +2012-09-01 Geoffrey Garen + + Rolled back out a piece of + because it broke inspector tests on Windows. + + Shrink activation objects by half + https://bugs.webkit.org/show_bug.cgi?id=95591 + + Reviewed by Sam Weinig. + +2012-09-01 Mark Lam + + LLInt C loop backend. + https://bugs.webkit.org/show_bug.cgi?id=91052. + + Reviewed by Filip Pizlo. + + * JavaScriptCore.xcodeproj/project.pbxproj: + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + (JSC::CodeBlock::bytecodeOffset): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::execute): + (JSC::Interpreter::executeCall): + (JSC::Interpreter::executeConstruct): + (JSC): + * interpreter/Interpreter.h: + * jit/JITStubs.h: + (JITStackFrame): + (JSC): + * llint/LLIntCLoop.cpp: Added. + (JSC): + (LLInt): + (JSC::LLInt::CLoop::initialize): + (JSC::LLInt::CLoop::catchRoutineFor): + (JSC::LLInt::CLoop::hostCodeEntryFor): + (JSC::LLInt::CLoop::jsCodeEntryWithArityCheckFor): + (JSC::LLInt::CLoop::jsCodeEntryFor): + * llint/LLIntCLoop.h: Added. + (JSC): + (LLInt): + (CLoop): + * llint/LLIntData.cpp: + (JSC::LLInt::initialize): + * llint/LLIntData.h: + (JSC): + * llint/LLIntOfflineAsmConfig.h: + * llint/LLIntOpcode.h: + * llint/LLIntThunks.cpp: + (LLInt): + * llint/LowLevelInterpreter.asm: + * llint/LowLevelInterpreter.cpp: + (LLInt): + (JSC::LLInt::Ints2Double): + (JSC): + (JSC::CLoop::execute): + * llint/LowLevelInterpreter.h: + (JSC): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * offlineasm/asm.rb: + * offlineasm/backends.rb: + * offlineasm/cloop.rb: Added. + * offlineasm/instructions.rb: + * runtime/Executable.h: + (ExecutableBase): + (JSC::ExecutableBase::hostCodeEntryFor): + (JSC::ExecutableBase::jsCodeEntryFor): + (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor): + (JSC::ExecutableBase::catchRoutineFor): + (NativeExecutable): + * runtime/JSValue.h: + (JSC): + (LLInt): + (JSValue): + * runtime/JSValueInlineMethods.h: + (JSC): + (JSC::JSValue::JSValue): + * runtime/Options.cpp: + (JSC::Options::initialize): + +2012-09-01 Geoffrey Garen + + Rolled back in a piece of . + + Shrink activation objects by half + https://bugs.webkit.org/show_bug.cgi?id=95591 + + Reviewed by Sam Weinig. + + * runtime/JSActivation.h: + (JSActivation): + +2012-09-01 Geoffrey Garen + + Rolled back in a piece of . + + Shrink activation objects by half + https://bugs.webkit.org/show_bug.cgi?id=95591 + + Reviewed by Sam Weinig. + + * runtime/JSActivation.cpp: + (JSC::JSActivation::JSActivation): + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::JSGlobalObject): + (JSC::JSGlobalObject::setGlobalThis): + (JSC): + (JSC::JSGlobalObject::visitChildren): + * runtime/JSGlobalObject.h: + (JSGlobalObject): + (JSC::JSScope::globalThis): + (JSC): + (JSC::JSGlobalObject::globalThis): + * runtime/JSNameScope.h: + (JSC::JSNameScope::JSNameScope): + * runtime/JSScope.cpp: + (JSC::JSScope::visitChildren): + * runtime/JSScope.h: + (JSScope): + (JSC::JSScope::JSScope): + (JSC::JSScope::globalObject): + (JSC::JSScope::globalData): + * runtime/JSSegmentedVariableObject.h: + (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject): + * runtime/JSSymbolTableObject.h: + (JSC::JSSymbolTableObject::JSSymbolTableObject): + * runtime/JSVariableObject.h: + (JSC::JSVariableObject::JSVariableObject): + * runtime/JSWithScope.h: + (JSC::JSWithScope::JSWithScope): + * runtime/StrictEvalActivation.cpp: + (JSC::StrictEvalActivation::StrictEvalActivation): + +2012-09-01 Geoffrey Garen + + Rolled back out a piece of + because it broke Window inspector tests. + + Shrink activation objects by half + https://bugs.webkit.org/show_bug.cgi?id=95591 + + Reviewed by Sam Weinig. + + * runtime/JSActivation.h: + (JSActivation): + +2012-08-31 Filip Pizlo + + Unreviewed, attempt to fix Windows, take two. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + +2012-08-31 Filip Pizlo + + Unreviewed, attempt to fix Windows. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + +2012-08-31 Filip Pizlo + + JSArray::putDirectIndex should by default behave like JSObject::putDirect + https://bugs.webkit.org/show_bug.cgi?id=95630 + + Reviewed by Gavin Barraclough. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * jsc.cpp: + (GlobalObject::finishCreation): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * runtime/JSArray.cpp: + (JSC::SparseArrayValueMap::putDirect): + (JSC::JSArray::defineOwnNumericProperty): + (JSC::JSArray::putDirectIndexBeyondVectorLength): + * runtime/JSArray.h: + (SparseArrayValueMap): + (JSArray): + (JSC::JSArray::putDirectIndex): + * runtime/JSONObject.cpp: + (JSC::Walker::walk): + * runtime/RegExpMatchesArray.cpp: + (JSC::RegExpMatchesArray::reifyAllProperties): + (JSC::RegExpMatchesArray::reifyMatchProperty): + * runtime/StringPrototype.cpp: + (JSC::splitStringByOneCharacterImpl): + (JSC::stringProtoFuncSplit): + +2012-08-31 Geoffrey Garen + + Rolled back in a piece of . + + Shrink activation objects by half + https://bugs.webkit.org/show_bug.cgi?id=95591 + + Reviewed by Sam Weinig. + + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::JSGlobalData): + * runtime/JSGlobalData.h: + (JSGlobalData): + * runtime/JSNameScope.h: + (JSC::JSNameScope::JSNameScope): + * runtime/JSWithScope.h: + (JSC::JSWithScope::JSWithScope): + * runtime/StrictEvalActivation.cpp: + (JSC::StrictEvalActivation::StrictEvalActivation): + +2012-08-31 Geoffrey Garen + + Rolled back in a piece of . + + Shrink activation objects by half + https://bugs.webkit.org/show_bug.cgi?id=95591 + + Reviewed by Sam Weinig. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_resolve_global_dynamic): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/JSActivation.cpp: + (JSC::JSActivation::JSActivation): + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::JSGlobalData): + * runtime/JSGlobalData.h: + (JSGlobalData): + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::reset): + (JSC::JSGlobalObject::visitChildren): + * runtime/JSGlobalObject.h: + (JSGlobalObject): + (JSC::JSGlobalObject::withScopeStructure): + (JSC::JSGlobalObject::strictEvalActivationStructure): + (JSC::JSGlobalObject::activationStructure): + (JSC::JSGlobalObject::nameScopeStructure): + +2012-08-31 Mark Hahnenberg + + Remove use of ClassInfo in SpeculativeJIT::emitBranch + https://bugs.webkit.org/show_bug.cgi?id=95623 + + Reviewed by Filip Pizlo. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch): + (JSC::DFG::SpeculativeJIT::emitBranch): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::emitNonStringCellOrOtherBranch): + (JSC::DFG::SpeculativeJIT::emitBranch): + +2012-08-31 Geoffrey Garen + + Rolled back in a piece of . + + Shrink activation objects by half + https://bugs.webkit.org/show_bug.cgi?id=95591 + + Reviewed by Sam Weinig. + + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::MarkedBlock): + * heap/MarkedBlock.h: + (MarkedBlock): + (JSC::MarkedBlock::globalData): + (JSC): + * heap/WeakSet.cpp: + (JSC::WeakSet::addAllocator): + * heap/WeakSet.h: + (WeakSet): + (JSC::WeakSet::WeakSet): + (JSC::WeakSet::globalData): + * runtime/JSGlobalData.h: + (JSC::WeakSet::heap): + (JSC): + +2012-08-31 Mark Lam + + Refactor LLInt and supporting code in preparation for the C Loop backend. + https://bugs.webkit.org/show_bug.cgi?id=95531. + + Reviewed by Filip Pizlo. + + * bytecode/GetByIdStatus.cpp: + (JSC::GetByIdStatus::computeFromLLInt): + * bytecode/PutByIdStatus.cpp: + (JSC::PutByIdStatus::computeFromLLInt): + * jit/JITExceptions.cpp: + (JSC::genericThrow): Use ExecutableBase::catchRoutineFor() to fetch + fetch the catch routine for a thrown exception. This will allow + us to redefine that for the C loop later, and still keep this + code readable. + * llint/LLIntOfflineAsmConfig.h: Moved ASM macros to + LowLevelInterpreter.cpp which is the only place they are used. This + will make it more convenient to redefine them for the C loop later. + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::setUpCall): Use ExecutableBase's hostCodeEntry() + jsCodeEntryFor(), and jsCodeWithArityCheckEntryFor() for computing + the entry points to functions being called. + * llint/LLIntSlowPaths.h: + (SlowPathReturnType): + (JSC::LLInt::encodeResult): + (LLInt): + (JSC::LLInt::decodeResult): Added. Needed by LLInt C Loop later. + * llint/LowLevelInterpreter.asm: + * llint/LowLevelInterpreter.cpp: + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * offlineasm/asm.rb: Disambiguate between opcodes and other labels. + * offlineasm/config.rb: + * runtime/Executable.h: + (JSC::ExecutableBase::hostCodeEntryFor): Added. + (ExecutableBase): + (JSC::ExecutableBase::jsCodeEntryFor): Added. + (JSC::ExecutableBase::jsCodeWithArityCheckEntryFor): Added. + (JSC::ExecutableBase::catchRoutineFor): Added. + * runtime/JSValueInlineMethods.h: + (JSC): + +2012-08-31 Tony Chang + + Remove ENABLE_CSS3_FLEXBOX compile time flag + https://bugs.webkit.org/show_bug.cgi?id=95382 + + Reviewed by Ojan Vafai. + + Everyone is already enabling this by default and the spec has stablized. + + * Configurations/FeatureDefines.xcconfig: + +2012-08-31 Geoffrey Garen + + Not reviewed. + + Rolled out http://trac.webkit.org/changeset/127293 because it broke + inspector tests on Windows. + + Shrink activation objects by half + https://bugs.webkit.org/show_bug.cgi?id=95591 + + Reviewed by Sam Weinig. + +2012-08-31 Geoffrey Garen + + Shrink activation objects by half + https://bugs.webkit.org/show_bug.cgi?id=95591 + + Reviewed by Sam Weinig. + + Removed the global object, global data, and global this pointers from + JSScope, and changed an int to a bitfield. This gets the JSActivation + class down to 64 bytes, which in practice cuts it in half by getting it + out of the 128 byte size class. + + Now, it's one extra indirection to get these pointers. These pointers + aren't accessed by JIT code, so I thought there would be no cost to the + extra indirection. However, some C++-heavy SunSpider tests regressed a + bit in an early version of the patch, which added even more indirection. + This suggests that calls to exec->globalData() and/or exec->lexicalGlobalObject() + are common and probably duplicated in lots of places, and could stand + further optimization in C++. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): Test against the specific activation + for our global object, since there's no VM-shared activation structure + anymore. This is guaranteed to have the same success rate as the old test + because activation scope is fixed at compile time. + + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::MarkedBlock): + * heap/MarkedBlock.h: + (JSC::MarkedBlock::globalData): + * heap/WeakSet.cpp: + (JSC::WeakSet::addAllocator): + * heap/WeakSet.h: + (WeakSet): + (JSC::WeakSet::WeakSet): + (JSC::WeakSet::globalData): Store a JSGlobalData* instead of a Heap* + because JSGlobalData->Heap is just a constant fold in the addressing + mode, while Heap->JSGlobalData is an extra pointer dereference. (These + objects should eventually just merge.) + + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_resolve_global_dynamic): See DFGAbstractState.cpp. + + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: Load the activation structure from + the code block instead of the global data because the structure is not + VM-shared anymore. (See DFGAbstractState.cpp.) + + * runtime/JSActivation.cpp: + (JSC::JSActivation::JSActivation): + * runtime/JSActivation.h: + (JSActivation): This is the point of the patch: Remove the data. + + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::JSGlobalData): + * runtime/JSGlobalData.h: + (JSGlobalData): No longer VM-shared. (See DFGAbstractState.cpp.) + + (JSC::WeakSet::heap): (See WeakSet.h.) + + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::JSGlobalObject): + (JSC::JSGlobalObject::setGlobalThis): + (JSC::JSGlobalObject::reset): + (JSC::JSGlobalObject::visitChildren): + * runtime/JSGlobalObject.h: + (JSGlobalObject): + (JSC::JSGlobalObject::withScopeStructure): + (JSC::JSGlobalObject::strictEvalActivationStructure): + (JSC::JSGlobalObject::activationStructure): + (JSC::JSGlobalObject::nameScopeStructure): + (JSC::JSScope::globalThis): + (JSC::JSGlobalObject::globalThis): Data that used to be in the JSScope + class goes here now, so it's not duplicated across all activations. + + * runtime/JSNameScope.h: + (JSC::JSNameScope::JSNameScope): + * runtime/JSScope.cpp: + (JSC::JSScope::visitChildren): This is the point of the patch: Remove the data. + + * runtime/JSScope.h: + (JSScope): + (JSC::JSScope::JSScope): + (JSC::JSScope::globalObject): + (JSC::JSScope::globalData): + * runtime/JSSegmentedVariableObject.h: + (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject): + * runtime/JSSymbolTableObject.h: + (JSC::JSSymbolTableObject::JSSymbolTableObject): + * runtime/JSVariableObject.h: + (JSC::JSVariableObject::JSVariableObject): + * runtime/JSWithScope.h: + (JSC::JSWithScope::JSWithScope): + * runtime/StrictEvalActivation.cpp: + (JSC::StrictEvalActivation::StrictEvalActivation): Simplified now that + we don't need to pass so much data to JSScope. + +2012-08-31 Patrick Gansterer + + Build fix for WinCE after r127191. + + * bytecode/JumpTable.h: + +2012-08-30 Filip Pizlo + + ASSERTION FAILURE in JSC::JSGlobalData::float32ArrayDescriptor when running fast/js/dfg-float64array.html + https://bugs.webkit.org/show_bug.cgi?id=95398 + + Reviewed by Mark Hahnenberg. + + Trying to get the build failure to be a bit more informative. + + * runtime/JSGlobalData.h: + (JSGlobalData): + +2012-08-30 Geoffrey Garen + + Try to fix the Qt build: add some #includes that, for some reason, only the Qt linker requires. + + * runtime/BooleanObject.cpp: + * runtime/ErrorInstance.cpp: + * runtime/NameInstance.cpp: + +2012-08-30 Geoffrey Garen + + Fix the Qt build: Removed a now-dead variable. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::execute): + +2012-08-30 Benjamin Poulain + + Ambiguous operator[] after r127191 on some compiler + https://bugs.webkit.org/show_bug.cgi?id=95509 + + Reviewed by Simon Fraser. + + On some compilers, the operator[] conflicts with the Obj-C++ operators. This attempts to solve + the issue. + + * runtime/JSString.h: + (JSC::jsSingleCharacterSubstring): + (JSC::jsString): + (JSC::jsSubstring8): + (JSC::jsSubstring): + (JSC::jsOwnedString): + +2012-08-30 Geoffrey Garen + + Try to fix the Qt build: Remove the inline keyword at the declaration + site. + + The Qt compiler seems to be confused, complaining about these functions + not being defined in a translation unit, even though no generated code + in the unit calls these functions. Maybe removing the keyword at the + declaration site will change its mind. + + This shouldn't change the inlining decision at all: the definition is + still inline. + + * interpreter/CallFrame.h: + (ExecState): + +2012-08-30 Geoffrey Garen + + Undo Qt build fix guess, since it breaks other builds. + + * runtime/JSArray.h: + +2012-08-30 Geoffrey Garen + + Try to fix the Qt build: add an #include to JSArray.h, since + it's included by some of the files Qt complains about, and + some of is functions call the functions Qt complains about. + + * runtime/JSArray.h: + +2012-08-30 Geoffrey Garen + + Second step toward fixing the Windows build: Add new symbols. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + +2012-08-30 Geoffrey Garen + + Try to fix the Qt build: add an #include. + + * bytecode/GetByIdStatus.cpp: + +2012-08-30 Geoffrey Garen + + First step toward fixing the Windows build: Remove old symbols. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + +2012-08-30 Geoffrey Garen + + Use one object instead of two for closures, eliminating ScopeChainNode + https://bugs.webkit.org/show_bug.cgi?id=95501 + + Reviewed by Filip Pizlo. + + This patch removes ScopeChainNode, and moves all the data and related + functions that used to be in ScopeChainNode into JSScope. + + Most of this patch is mechanical changes to use a JSScope* where we used + to use a ScopeChainNode*. I've only specifically commented about items + that were non-mechanical. + + * runtime/Completion.cpp: + (JSC::evaluate): + * runtime/Completion.h: Don't require an explicit scope chain argument + when evaluating code. Clients never wanted anything other than the + global scope, and other arbitrary scopes probably wouldn't work + correctly, anyway. + + * runtime/JSScope.cpp: + * runtime/JSScope.h: + (JSC::JSScope::JSScope): JSScope now requires the data we used to pass to + ScopeChainNode, so it can link itself into the scope chain correctly. + + * runtime/JSWithScope.h: + (JSC::JSWithScope::create): + (JSC::JSWithScope::JSWithScope): JSWithScope gets an extra constructor + for specifically supplying your own scope chain. The DOM needs this + interface for setting up the scope chain for certain event handlers. + Other clients always just push the JSWithScope to the head of the current + scope chain. + +2012-08-30 Mark Lam + + Render unto #ifdef's that which belong to them. + https://bugs.webkit.org/show_bug.cgi?id=95482. + + Reviewed by Filip Pizlo. + + Refining / disambiguating between #ifdefs and adding some. For + example, ENABLE(JIT) is conflated with ENABLE(LLINT) in some places. + Also, we need to add ENABLE(COMPUTED_GOTO_OPCODES) to indicate that we + want interpreted opcodes to use COMPUTED GOTOs apart from ENABLE(LLINT) + and ENABLE(COMPUTED_GOTO_CLASSIC_INTERPRETER). Also cleaned up #ifdefs + in certain places which were previously incorrect. + + * bytecode/CodeBlock.cpp: + (JSC): + (JSC::CodeBlock::bytecodeOffset): + * bytecode/CodeBlock.h: + (CodeBlock): + * bytecode/Opcode.h: + (JSC::padOpcodeName): + * config.h: + * dfg/DFGOperations.cpp: + * interpreter/AbstractPC.cpp: + (JSC::AbstractPC::AbstractPC): + * interpreter/CallFrame.h: + (ExecState): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::~Interpreter): + (JSC::Interpreter::initialize): + (JSC::Interpreter::isOpcode): + (JSC::Interpreter::unwindCallFrame): + (JSC::getLineNumberForCallFrame): + (JSC::getCallerInfo): + (JSC::Interpreter::execute): + (JSC::Interpreter::executeCall): + (JSC::Interpreter::executeConstruct): + (JSC::Interpreter::privateExecute): + * interpreter/Interpreter.h: + (JSC::Interpreter::getOpcode): + (JSC::Interpreter::getOpcodeID): + (Interpreter): + * jit/HostCallReturnValue.h: + * jit/JITCode.h: + (JITCode): + * jit/JITExceptions.cpp: + * jit/JITExceptions.h: + * jit/JSInterfaceJIT.h: + * llint/LLIntData.h: + (JSC::LLInt::getOpcode): + * llint/LLIntEntrypoints.cpp: + (JSC::LLInt::getFunctionEntrypoint): + (JSC::LLInt::getEvalEntrypoint): + (JSC::LLInt::getProgramEntrypoint): + * llint/LLIntOffsetsExtractor.cpp: + (JSC::LLIntOffsetsExtractor::dummy): + * llint/LLIntSlowPaths.cpp: + (LLInt): + * runtime/JSGlobalData.cpp: + (JSC): + +2012-08-30 JungJik Lee + + [EFL][WK2] Add WebMemorySampler feature. + https://bugs.webkit.org/show_bug.cgi?id=91214 + + Reviewed by Kenneth Rohde Christiansen. + + WebMemorySampler collects Javascript stack and JIT memory usage in globalMemoryStatistics. + + * PlatformEfl.cmake: + +2012-08-30 Benjamin Poulain + + Replace JSC::UString by WTF::String + https://bugs.webkit.org/show_bug.cgi?id=95271 + + Reviewed by Geoffrey Garen. + + Having JSC::UString and WTF::String increase the complexity of working on WebKit, and + add useless conversions in the bindings. It also cause some code bloat. + + The performance advantages of UString have been ported over in previous patches. This patch + is the last step: getting rid of UString. + + In addition to the simplified code, this also reduce the binary size by 15kb on x86_64. + + * API/OpaqueJSString.cpp: + (OpaqueJSString::ustring): + * runtime/Identifier.h: + (JSC::Identifier::ustring): + To avoid changing everything at once, the function named ustring() were kept as is. They + will be renamed in a follow up patch. + + * runtime/JSString.h: + (JSC::JSString::string): + (JSC::JSValue::toWTFString): + (JSC::inlineJSValueNotStringtoString): + (JSC::JSValue::toWTFStringInline): + Since JSValue::toString() already exist (and return the JSString), the direct accessor is renamed + to ::toWTFString(). We may change ::string() to ::jsString() and ::toWTFString() to ::toString() + in the future. + + * runtime/StringPrototype.cpp: + (JSC::substituteBackreferencesSlow): Replace the use of UString::getCharacters<>() by String::getCharactersWithUpconvert<>(). + +2012-08-24 Mark Hahnenberg + + Remove uses of ClassInfo in StrictEq and CompareEq in the DFG + https://bugs.webkit.org/show_bug.cgi?id=93401 + + Reviewed by Filip Pizlo. + + Another incremental step in removing the dependence on ClassInfo pointers in object headers. + + * bytecode/SpeculatedType.h: + (JSC::isCellOrOtherSpeculation): + (JSC): + * dfg/DFGAbstractState.cpp: Updated the CFA to reflect the changes to the backend. + (JSC::DFG::AbstractState::execute): + * dfg/DFGNode.h: + (Node): + (JSC::DFG::Node::shouldSpeculateString): Added this new function since it was conspicuously absent. + (JSC::DFG::Node::shouldSpeculateNonStringCellOrOther): Also add this function for use in the CFA. + * dfg/DFGSpeculativeJIT.cpp: Refactored how we handle CompareEq and CompareStrictEq in the DFG. We now just + check for Strings by comparing the object's Structure to the global Structure for strings. We only + check for MasqueradesAsUndefined if the watchpoint has fired. These changes allow us to remove our + uses of the ClassInfo pointer for compiling these nodes. + (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality): + (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch): + (JSC::DFG::SpeculativeJIT::compare): + (JSC::DFG::SpeculativeJIT::compileStrictEq): + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + * dfg/DFGSpeculativeJIT32_64.cpp: Same changes for 32 bit as for 64 bit. + (JSC::DFG::SpeculativeJIT::compileObjectEquality): + (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality): + (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compileObjectEquality): + (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality): + (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality): + +2012-08-30 Yong Li + + [BlackBerry] Implement IncrementalSweeper for PLATFORM(BLACKBERRY) + https://bugs.webkit.org/show_bug.cgi?id=95469 + + Reviewed by Rob Buis. + + RIM PR# 200595. + Share most code with USE(CF) and implement timer-related methods + for PLATFORM(BLACKBERRY). + + * heap/IncrementalSweeper.cpp: + (JSC): + (JSC::IncrementalSweeper::IncrementalSweeper): + (JSC::IncrementalSweeper::create): + (JSC::IncrementalSweeper::scheduleTimer): + (JSC::IncrementalSweeper::cancelTimer): + (JSC::IncrementalSweeper::doSweep): + * heap/IncrementalSweeper.h: + (IncrementalSweeper): + +2012-08-30 Mark Lam + + Fix broken classic intrpreter build. + https://bugs.webkit.org/show_bug.cgi?id=95484. + + Reviewed by Filip Pizlo. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + +2012-08-30 Byungwoo Lee + + Build warning : -Wsign-compare on DFGByteCodeParser.cpp. + https://bugs.webkit.org/show_bug.cgi?id=95418 + + Reviewed by Filip Pizlo. + + There is a build warning '-Wsign-compare' on + findArgumentPositionForLocal() in DFGByteCodeParser.cpp. + + For removing this warning, casting statement is added explicitly. + + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal): + (JSC::DFG::ByteCodeParser::findArgumentPosition): + +2012-08-30 Yong Li + + [BlackBerry] Set timer client on platform timer used in HeapTimer + https://bugs.webkit.org/show_bug.cgi?id=95464 + + Reviewed by Rob Buis. + + Otherwise the timer won't work. + + * heap/HeapTimer.cpp: + (JSC::HeapTimer::HeapTimer): + +2012-08-30 Julien BRIANCEAU + + [sh4] Add missing implementation for JavaScriptCore JIT + https://bugs.webkit.org/show_bug.cgi?id=95452 + + Reviewed by Oliver Hunt. + + * assembler/MacroAssemblerSH4.h: + (JSC::MacroAssemblerSH4::isCompactPtrAlignedAddressOffset): + (MacroAssemblerSH4): + (JSC::MacroAssemblerSH4::add32): + (JSC::MacroAssemblerSH4::convertibleLoadPtr): + * assembler/SH4Assembler.h: + (JSC::SH4Assembler::labelIgnoringWatchpoints): + (SH4Assembler): + (JSC::SH4Assembler::replaceWithLoad): + (JSC::SH4Assembler::replaceWithAddressComputation): + +2012-08-30 Charles Wei + + [BlackBerry] Eliminate build warnings + https://bugs.webkit.org/show_bug.cgi?id=95338 + + Reviewed by Filip Pizlo. + + static_cast to the same type to eliminate the build time warnings. + + * assembler/AssemblerBufferWithConstantPool.h: + (JSC::AssemblerBufferWithConstantPool::flushWithoutBarrier): + * assembler/MacroAssemblerARM.h: + (JSC::MacroAssemblerARM::branch32): + +2012-08-29 Mark Hahnenberg + + Remove use of ClassInfo from compileGetByValOnArguments and compileGetArgumentsLength + https://bugs.webkit.org/show_bug.cgi?id=95131 + + Reviewed by Filip Pizlo. + + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments): We don't need this speculation check. We can replace it + with an assert to guarantee this. + +2012-08-29 Mark Lam + + Refactoring LLInt::Data. + https://bugs.webkit.org/show_bug.cgi?id=95316. + + Reviewed by Geoff Garen. + + This change allows its opcodeMap to be easily queried from any function + without needing to go through a GlobalData object. It also introduces + the LLInt::getCodePtr() methods that will be used by the LLInt C loop + later to redefine how llint symbols (opcodes and trampoline glue + labels) get resolved. + + * assembler/MacroAssemblerCodeRef.h: + (MacroAssemblerCodePtr): + (JSC::MacroAssemblerCodePtr::createLLIntCodePtr): + (MacroAssemblerCodeRef): + (JSC::MacroAssemblerCodeRef::createLLIntCodeRef): + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::adjustPCIfAtCallSite): + (JSC::CodeBlock::bytecodeOffset): + * bytecode/Opcode.h: + Remove the 'const' to simplify things and avoid having to do + additional casts and #ifdefs in many places. + * bytecode/ResolveGlobalStatus.cpp: + (JSC::computeForLLInt): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::generate): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::initialize): + * interpreter/Interpreter.h: + (Interpreter): + * jit/JITExceptions.cpp: + (JSC::genericThrow): + * llint/LLIntData.cpp: + (LLInt): + (JSC::LLInt::initialize): + * llint/LLIntData.h: + (JSC): + (LLInt): + (Data): + (JSC::LLInt::exceptionInstructions): + (JSC::LLInt::opcodeMap): + (JSC::LLInt::getOpcode): + (JSC::LLInt::getCodePtr): + (JSC::LLInt::Data::performAssertions): + * llint/LLIntExceptions.cpp: + (JSC::LLInt::returnToThrowForThrownException): + (JSC::LLInt::returnToThrow): + (JSC::LLInt::callToThrow): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + (JSC::LLInt::handleHostCall): + * runtime/InitializeThreading.cpp: + (JSC::initializeThreadingOnce): Initialize the singleton LLInt data. + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::JSGlobalData): + * runtime/JSGlobalData.h: + (JSGlobalData): Removed the now unneeded LLInt::Data instance in + JSGlobalData. + * runtime/JSValue.h: + (JSValue): + +2012-08-29 Gavin Barraclough + + PutById uses DataLabel32, not DataLabelCompact + https://bugs.webkit.org/show_bug.cgi?id=95245 + + Reviewed by Geoff Garen. + + JIT::resetPatchPutById calls the the wrong thing on x86-64 – this is moot right now, + since they currently both do the same thing, but if we were to ever make compact mean + 8-bit this could be a real problem. Also, relying on the object still being in eax + on entry to the transition stub isn't very robust - added nonArgGPR1 to at least make + this explicit. + + * jit/JITPropertyAccess.cpp: + (JSC::JIT::emitSlow_op_put_by_id): + - copy regT0 to nonArgGPR1 + (JSC::JIT::privateCompilePutByIdTransition): + - DataLabelCompact -> DataLabel32 + (JSC::JIT::resetPatchPutById): + - reload regT0 from nonArgGPR1 + * jit/JSInterfaceJIT.h: + (JSInterfaceJIT): + - added nonArgGPR1 + +2012-08-28 Yong Li + + ExecutableAllocator should be destructed after Heap + https://bugs.webkit.org/show_bug.cgi?id=95244 + + Reviewed by Rob Buis. + + RIM PR# 199364. + Make ExecutableAllocator the first member in JSGlobalData. + Existing Web Worker tests can show the issue. + + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::JSGlobalData): + * runtime/JSGlobalData.h: + (JSGlobalData): + +2012-08-29 Geoffrey Garen + + Try to fix the Windows build. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Export! + +2012-08-28 Geoffrey Garen + + Introduced JSWithScope, making all scope objects subclasses of JSScope + https://bugs.webkit.org/show_bug.cgi?id=95295 + + Reviewed by Filip Pizlo. + + This is a step toward removing ScopeChainNode. With a uniform representation + for objects in the scope chain, we can move data from ScopeChainNode + into JSScope. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: Build! + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): Use an explicit JSWithScope object + for 'with' statements. Since 'with' can put any object in the scope + chain, we'll need an adapter object to hold the data ScopeChainNode + currently holds. + + (JSGlobalData): Support for JSWithScope. + + * runtime/JSScope.cpp: + (JSC::JSScope::objectAtScope): + * runtime/JSScope.h: Check for and unwrap JSWithScope. + + * runtime/JSType.h: Support for JSWithScope. + + * runtime/StrictEvalActivation.cpp: + (JSC::StrictEvalActivation::StrictEvalActivation): + * runtime/StrictEvalActivation.h: + (StrictEvalActivation): Inherit from JSScope, to make the scope chain uniform. + + * runtime/JSWithScope.cpp: Added. + (JSC::JSWithScope::visitChildren): + * runtime/JSWithScope.h: Added. + (JSWithScope): + (JSC::JSWithScope::create): + (JSC::JSWithScope::object): + (JSC::JSWithScope::createStructure): + (JSC::JSWithScope::JSWithScope): New adapter object. Since this object + is never exposed to scripts, it doesn't need any meaningful implementation + of property access or other callbacks. + +2012-08-29 Patrick Gansterer + + Unreviewed. Build fix for !ENABLE(JIT) after r126962. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + +2012-08-28 Geoffrey Garen + + Added JSScope::objectInScope(), and refactored callers to use it + https://bugs.webkit.org/show_bug.cgi?id=95281 + + Reviewed by Gavin Barraclough. + + This is a step toward removing ScopeChainNode. We need a layer of + indirection so that 'with' scopes can proxy for an object. + JSScope::objectInScope() will be that layer. + + * bytecode/EvalCodeCache.h: + (JSC::EvalCodeCache::tryGet): + (JSC::EvalCodeCache::getSlow): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::resolve): + (JSC::BytecodeGenerator::resolveConstDecl): . vs -> + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::unwindCallFrame): + (JSC::Interpreter::execute): + * runtime/JSScope.cpp: + (JSC::JSScope::resolve): + (JSC::JSScope::resolveSkip): + (JSC::JSScope::resolveGlobalDynamic): + (JSC::JSScope::resolveBase): + (JSC::JSScope::resolveWithBase): + (JSC::JSScope::resolveWithThis): Added JSScope::objectAtScope() calls. + + * runtime/JSScope.h: + (JSScope): + (JSC::JSScope::objectAtScope): + (JSC): + (ScopeChainIterator): + (JSC::ScopeChainIterator::ScopeChainIterator): + (JSC::ScopeChainIterator::get): + (JSC::ScopeChainIterator::operator->): + (JSC::ScopeChainIterator::operator++): + (JSC::ScopeChainIterator::operator==): + (JSC::ScopeChainIterator::operator!=): + (JSC::ScopeChainNode::begin): + (JSC::ScopeChainNode::end): I moved ScopeChainIterator to this file + to resolve a circular #include problem. Eventually, I'll probably rename + it to JSScope::iterator, so I think it belongs here. + + * runtime/ScopeChain.cpp: + (JSC::ScopeChainNode::print): + (JSC::ScopeChainNode::localDepth): . vs -> + + * runtime/ScopeChain.h: + (ScopeChainNode): I made the 'object' data member private because it's + no longer safe to access -- you need to call JSScope::objectAtScope() + instead. + + The JITs need to be friends because of the private declaration. + + Subtly, JIT/LLInt code is correct without any changes because JIT/LLInt + code never compiles direct access to a with scope. + +2012-08-28 Mark Lam + + Adding support for adding LLInt opcode extensions. This will be needed + by the LLInt C loop interpreter later. + https://bugs.webkit.org/show_bug.cgi?id=95277. + + Reviewed by Geoffrey Garen. + + * JavaScriptCore.xcodeproj/project.pbxproj: + * bytecode/Opcode.h: + * llint/LLIntOpcode.h: Added. + * llint/LowLevelInterpreter.h: + +2012-08-28 Gavin Barraclough + + Rolled out r126928, this broke stuff :'-( + + * jit/JITPropertyAccess.cpp: + (JSC::JIT::privateCompilePutByIdTransition): + (JSC::JIT::resetPatchPutById): + +2012-08-28 Gavin Barraclough + + PutById uses DataLabel32, not DataLabelCompact + https://bugs.webkit.org/show_bug.cgi?id=95245 + + Reviewed by Geoff Garen. + + JIT::resetPatchPutById calls the the wrong thing on x86-64 – this is moot right now, + since they currently both do the same thing, but if we were to ever make compact mean + 8-bit this could be a real problem. Also, don't rely on the object still being in eax + on entry to the transition stub – this isn't very robust. + + * jit/JITPropertyAccess.cpp: + (JSC::JIT::privateCompilePutByIdTransition): + - DataLabelCompact -> DataLabel32 + (JSC::JIT::resetPatchPutById): + - reload regT0 from the stack + +2012-08-28 Sheriff Bot + + Unreviewed, rolling out r126914. + http://trac.webkit.org/changeset/126914 + https://bugs.webkit.org/show_bug.cgi?id=95239 + + it breaks everything and fixes nothing (Requested by pizlo on + #webkit). + + * API/JSCallbackObject.h: + (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty): + (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty): + (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren): + * API/JSCallbackObjectFunctions.h: + (JSC::::getOwnPropertyNames): + * API/JSClassRef.cpp: + (OpaqueJSClass::~OpaqueJSClass): + (OpaqueJSClassContextData::OpaqueJSClassContextData): + (OpaqueJSClass::contextData): + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + (JSC::EvalCodeCache::visitAggregate): + (JSC::CodeBlock::nameForRegister): + * bytecode/JumpTable.h: + (JSC::StringJumpTable::offsetForValue): + (JSC::StringJumpTable::ctiForValue): + * bytecode/LazyOperandValueProfile.cpp: + (JSC::LazyOperandValueProfileParser::getIfPresent): + * bytecode/SamplingTool.cpp: + (JSC::SamplingTool::dump): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::addVar): + (JSC::BytecodeGenerator::addGlobalVar): + (JSC::BytecodeGenerator::addConstant): + (JSC::BytecodeGenerator::addConstantValue): + (JSC::BytecodeGenerator::emitLoad): + (JSC::BytecodeGenerator::addStringConstant): + (JSC::BytecodeGenerator::emitLazyNewFunction): + * bytecompiler/NodesCodegen.cpp: + (JSC::PropertyListNode::emitBytecode): + * debugger/Debugger.cpp: + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse): + (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse): + (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize): + (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild): + * dfg/DFGAssemblyHelpers.cpp: + (JSC::DFG::AssemblyHelpers::decodedCodeMapFor): + * dfg/DFGByteCodeCache.h: + (JSC::DFG::ByteCodeCache::~ByteCodeCache): + (JSC::DFG::ByteCodeCache::get): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::cellConstant): + (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck): + (JSC::DFG::StructureCheckHoistingPhase::noticeClobber): + * heap/Heap.cpp: + (JSC::Heap::markProtectedObjects): + * heap/Heap.h: + (JSC::Heap::forEachProtectedCell): + * heap/JITStubRoutineSet.cpp: + (JSC::JITStubRoutineSet::markSlow): + (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines): + * heap/MarkStack.cpp: + (JSC::MarkStack::internalAppend): + * heap/Weak.h: + (JSC::weakRemove): + * jit/JIT.cpp: + (JSC::JIT::privateCompile): + * jit/JITStubs.cpp: + (JSC::JITThunks::ctiStub): + * parser/Parser.cpp: + (JSC::::parseStrictObjectLiteral): + * profiler/Profile.cpp: + (JSC::functionNameCountPairComparator): + (JSC::Profile::debugPrintDataSampleStyle): + * runtime/Identifier.cpp: + (JSC::Identifier::add): + * runtime/JSActivation.cpp: + (JSC::JSActivation::getOwnPropertyNames): + (JSC::JSActivation::symbolTablePutWithAttributes): + * runtime/JSArray.cpp: + (JSC::SparseArrayValueMap::put): + (JSC::SparseArrayValueMap::putDirect): + (JSC::SparseArrayValueMap::visitChildren): + (JSC::JSArray::enterDictionaryMode): + (JSC::JSArray::defineOwnNumericProperty): + (JSC::JSArray::getOwnPropertySlotByIndex): + (JSC::JSArray::getOwnPropertyDescriptor): + (JSC::JSArray::putByIndexBeyondVectorLength): + (JSC::JSArray::putDirectIndexBeyondVectorLength): + (JSC::JSArray::deletePropertyByIndex): + (JSC::JSArray::getOwnPropertyNames): + (JSC::JSArray::setLength): + (JSC::JSArray::sort): + (JSC::JSArray::compactForSorting): + (JSC::JSArray::checkConsistency): + * runtime/JSSymbolTableObject.cpp: + (JSC::JSSymbolTableObject::getOwnPropertyNames): + * runtime/JSSymbolTableObject.h: + (JSC::symbolTableGet): + (JSC::symbolTablePut): + (JSC::symbolTablePutWithAttributes): + * runtime/RegExpCache.cpp: + (JSC::RegExpCache::invalidateCode): + * runtime/WeakGCMap.h: + (JSC::WeakGCMap::clear): + (JSC::WeakGCMap::set): + * tools/ProfileTreeNode.h: + (JSC::ProfileTreeNode::sampleChild): + (JSC::ProfileTreeNode::childCount): + (JSC::ProfileTreeNode::dumpInternal): + (JSC::ProfileTreeNode::compareEntries): + +2012-08-28 Filip Pizlo + + LLInt should not rely on ordering of global labels + https://bugs.webkit.org/show_bug.cgi?id=95221 + + Reviewed by Oliver Hunt. + + * llint/LowLevelInterpreter.asm: + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + +2012-08-28 Caio Marcelo de Oliveira Filho + + Rename first/second to key/value in HashMap iterators + https://bugs.webkit.org/show_bug.cgi?id=82784 + + Reviewed by Eric Seidel. + + * API/JSCallbackObject.h: + (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty): + (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty): + (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren): + * API/JSCallbackObjectFunctions.h: + (JSC::::getOwnPropertyNames): + * API/JSClassRef.cpp: + (OpaqueJSClass::~OpaqueJSClass): + (OpaqueJSClassContextData::OpaqueJSClassContextData): + (OpaqueJSClass::contextData): + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + (JSC::EvalCodeCache::visitAggregate): + (JSC::CodeBlock::nameForRegister): + * bytecode/JumpTable.h: + (JSC::StringJumpTable::offsetForValue): + (JSC::StringJumpTable::ctiForValue): + * bytecode/LazyOperandValueProfile.cpp: + (JSC::LazyOperandValueProfileParser::getIfPresent): + * bytecode/SamplingTool.cpp: + (JSC::SamplingTool::dump): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::addVar): + (JSC::BytecodeGenerator::addGlobalVar): + (JSC::BytecodeGenerator::addConstant): + (JSC::BytecodeGenerator::addConstantValue): + (JSC::BytecodeGenerator::emitLoad): + (JSC::BytecodeGenerator::addStringConstant): + (JSC::BytecodeGenerator::emitLazyNewFunction): + * bytecompiler/NodesCodegen.cpp: + (JSC::PropertyListNode::emitBytecode): + * debugger/Debugger.cpp: + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse): + (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse): + (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize): + (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild): + * dfg/DFGAssemblyHelpers.cpp: + (JSC::DFG::AssemblyHelpers::decodedCodeMapFor): + * dfg/DFGByteCodeCache.h: + (JSC::DFG::ByteCodeCache::~ByteCodeCache): + (JSC::DFG::ByteCodeCache::get): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::cellConstant): + (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck): + (JSC::DFG::StructureCheckHoistingPhase::noticeClobber): + * heap/Heap.cpp: + (JSC::Heap::markProtectedObjects): + * heap/Heap.h: + (JSC::Heap::forEachProtectedCell): + * heap/JITStubRoutineSet.cpp: + (JSC::JITStubRoutineSet::markSlow): + (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines): + * heap/MarkStack.cpp: + (JSC::MarkStack::internalAppend): + * heap/Weak.h: + (JSC::weakRemove): + * jit/JIT.cpp: + (JSC::JIT::privateCompile): + * jit/JITStubs.cpp: + (JSC::JITThunks::ctiStub): + * parser/Parser.cpp: + (JSC::::parseStrictObjectLiteral): + * profiler/Profile.cpp: + (JSC::functionNameCountPairComparator): + (JSC::Profile::debugPrintDataSampleStyle): + * runtime/Identifier.cpp: + (JSC::Identifier::add): + * runtime/JSActivation.cpp: + (JSC::JSActivation::getOwnPropertyNames): + (JSC::JSActivation::symbolTablePutWithAttributes): + * runtime/JSArray.cpp: + (JSC::SparseArrayValueMap::put): + (JSC::SparseArrayValueMap::putDirect): + (JSC::SparseArrayValueMap::visitChildren): + (JSC::JSArray::enterDictionaryMode): + (JSC::JSArray::defineOwnNumericProperty): + (JSC::JSArray::getOwnPropertySlotByIndex): + (JSC::JSArray::getOwnPropertyDescriptor): + (JSC::JSArray::putByIndexBeyondVectorLength): + (JSC::JSArray::putDirectIndexBeyondVectorLength): + (JSC::JSArray::deletePropertyByIndex): + (JSC::JSArray::getOwnPropertyNames): + (JSC::JSArray::setLength): + (JSC::JSArray::sort): + (JSC::JSArray::compactForSorting): + (JSC::JSArray::checkConsistency): + * runtime/JSSymbolTableObject.cpp: + (JSC::JSSymbolTableObject::getOwnPropertyNames): + * runtime/JSSymbolTableObject.h: + (JSC::symbolTableGet): + (JSC::symbolTablePut): + (JSC::symbolTablePutWithAttributes): + * runtime/RegExpCache.cpp: + (JSC::RegExpCache::invalidateCode): + * runtime/WeakGCMap.h: + (JSC::WeakGCMap::clear): + (JSC::WeakGCMap::set): + * tools/ProfileTreeNode.h: + (JSC::ProfileTreeNode::sampleChild): + (JSC::ProfileTreeNode::childCount): + (JSC::ProfileTreeNode::dumpInternal): + (JSC::ProfileTreeNode::compareEntries): + +2012-08-28 Geoffrey Garen + + GCC warning in JSActivation is causing Mac EWS errors + https://bugs.webkit.org/show_bug.cgi?id=95103 + + Reviewed by Sam Weinig. + + Try to fix a strict aliasing violation by using bitwise_cast. The + union in the cast should signal to the compiler that aliasing between + types is happening. + + * runtime/JSActivation.cpp: + (JSC::JSActivation::visitChildren): + +2012-08-28 Geoffrey Garen + + Build fix: svn add two files I forgot in my last patch. + +2012-08-27 Geoffrey Garen + + Refactored and consolidated variable resolution functions + https://bugs.webkit.org/show_bug.cgi?id=95166 + + Reviewed by Filip Pizlo. + + This patch does a few things: + + (1) Introduces a new class, JSScope, which is the base class for all + objects that represent a scope in the scope chain. + + (2) Refactors and consolidates duplicate implementations of variable + resolution into the JSScope class. + + (3) Renames JSStaticScopeObject to JSNameScope because, as distinct from + something like a 'let' scope, JSStaticScopeObject only has storage for a + single name. + + These changes makes logical sense to me as-is. I will also use them in an + upcoming optimization. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: Build! + + * bytecode/CodeBlock.cpp: + (JSC): Build fix for LLInt-only builds. + + * bytecode/GlobalResolveInfo.h: + (GlobalResolveInfo): Use PropertyOffset to be consistent with other parts + of the engine. + + * bytecompiler/NodesCodegen.cpp: + * dfg/DFGOperations.cpp: Use the shared code in JSScope instead of rolling + our own. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::execute): + (JSC::Interpreter::createExceptionScope): + (JSC::Interpreter::privateExecute): + * interpreter/Interpreter.h: Use the shared code in JSScope instead of rolling + our own. + + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): Use the shared code in JSScope instead of rolling + our own. + + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + (LLInt): Use the shared code in JSScope instead of rolling our own. Note + that one of these slow paths calls the wrong helper function. I left it + that way to avoid a behavior change in a refactoring patch. + + * parser/Nodes.cpp: Updated for rename. + + * runtime/CommonSlowPaths.h: + (CommonSlowPaths): Removed resolve slow paths because were duplicative. + + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::JSGlobalData): + * runtime/JSGlobalData.h: + (JSGlobalData): Updated for renames. + + * runtime/JSNameScope.cpp: Copied from Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp. + (JSC): + (JSC::JSNameScope::visitChildren): + (JSC::JSNameScope::toThisObject): + (JSC::JSNameScope::put): + (JSC::JSNameScope::getOwnPropertySlot): + * runtime/JSNameScope.h: Copied from Source/JavaScriptCore/runtime/JSStaticScopeObject.h. + (JSC): + (JSC::JSNameScope::create): + (JSC::JSNameScope::createStructure): + (JSNameScope): + (JSC::JSNameScope::JSNameScope): + (JSC::JSNameScope::isDynamicScope): Used do-webcore-rename script here. + It is fabulous! + + * runtime/JSObject.h: + (JSObject): + (JSC::JSObject::isNameScopeObject): More rename. + + * runtime/JSScope.cpp: Added. + (JSC): + (JSC::JSScope::isDynamicScope): + (JSC::JSScope::resolve): + (JSC::JSScope::resolveSkip): + (JSC::JSScope::resolveGlobal): + (JSC::JSScope::resolveGlobalDynamic): + (JSC::JSScope::resolveBase): + (JSC::JSScope::resolveWithBase): + (JSC::JSScope::resolveWithThis): + * runtime/JSScope.h: Added. + (JSC): + (JSScope): + (JSC::JSScope::JSScope): All the code here is a port from the + Interpreter.cpp implementations of this functionality. + + * runtime/JSStaticScopeObject.cpp: Removed. + * runtime/JSStaticScopeObject.h: Removed. + + * runtime/JSSymbolTableObject.cpp: + (JSC): + * runtime/JSSymbolTableObject.h: + (JSSymbolTableObject): + * runtime/JSType.h: Updated for rename. + + * runtime/Operations.h: + (JSC::resolveBase): Removed because it was duplicative. + +2012-08-28 Alban Browaeys + + [GTK] LLint build fails with -g -02 + https://bugs.webkit.org/show_bug.cgi?id=90098 + + Reviewed by Filip Pizlo. + + Avoid duplicate offsets for llint, discarding them. + + * offlineasm/offsets.rb: + +2012-08-27 Sheriff Bot + + Unreviewed, rolling out r126836. + http://trac.webkit.org/changeset/126836 + https://bugs.webkit.org/show_bug.cgi?id=95163 + + Broke all Apple ports, EFL, and Qt. (Requested by tkent on + #webkit). + + * API/JSCallbackObject.h: + (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty): + (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty): + (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren): + * API/JSCallbackObjectFunctions.h: + (JSC::::getOwnPropertyNames): + * API/JSClassRef.cpp: + (OpaqueJSClass::~OpaqueJSClass): + (OpaqueJSClassContextData::OpaqueJSClassContextData): + (OpaqueJSClass::contextData): + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + (JSC::EvalCodeCache::visitAggregate): + (JSC::CodeBlock::nameForRegister): + * bytecode/JumpTable.h: + (JSC::StringJumpTable::offsetForValue): + (JSC::StringJumpTable::ctiForValue): + * bytecode/LazyOperandValueProfile.cpp: + (JSC::LazyOperandValueProfileParser::getIfPresent): + * bytecode/SamplingTool.cpp: + (JSC::SamplingTool::dump): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::addVar): + (JSC::BytecodeGenerator::addGlobalVar): + (JSC::BytecodeGenerator::addConstant): + (JSC::BytecodeGenerator::addConstantValue): + (JSC::BytecodeGenerator::emitLoad): + (JSC::BytecodeGenerator::addStringConstant): + (JSC::BytecodeGenerator::emitLazyNewFunction): + * bytecompiler/NodesCodegen.cpp: + (JSC::PropertyListNode::emitBytecode): + * debugger/Debugger.cpp: + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse): + (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse): + (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize): + (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild): + * dfg/DFGAssemblyHelpers.cpp: + (JSC::DFG::AssemblyHelpers::decodedCodeMapFor): + * dfg/DFGByteCodeCache.h: + (JSC::DFG::ByteCodeCache::~ByteCodeCache): + (JSC::DFG::ByteCodeCache::get): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::cellConstant): + (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck): + (JSC::DFG::StructureCheckHoistingPhase::noticeClobber): + * heap/Heap.cpp: + (JSC::Heap::markProtectedObjects): + * heap/Heap.h: + (JSC::Heap::forEachProtectedCell): + * heap/JITStubRoutineSet.cpp: + (JSC::JITStubRoutineSet::markSlow): + (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines): + * heap/MarkStack.cpp: + (JSC::MarkStack::internalAppend): + * heap/Weak.h: + (JSC::weakRemove): + * jit/JIT.cpp: + (JSC::JIT::privateCompile): + * jit/JITStubs.cpp: + (JSC::JITThunks::ctiStub): + * parser/Parser.cpp: + (JSC::::parseStrictObjectLiteral): + * profiler/Profile.cpp: + (JSC::functionNameCountPairComparator): + (JSC::Profile::debugPrintDataSampleStyle): + * runtime/Identifier.cpp: + (JSC::Identifier::add): + * runtime/JSActivation.cpp: + (JSC::JSActivation::getOwnPropertyNames): + (JSC::JSActivation::symbolTablePutWithAttributes): + * runtime/JSArray.cpp: + (JSC::SparseArrayValueMap::put): + (JSC::SparseArrayValueMap::putDirect): + (JSC::SparseArrayValueMap::visitChildren): + (JSC::JSArray::enterDictionaryMode): + (JSC::JSArray::defineOwnNumericProperty): + (JSC::JSArray::getOwnPropertySlotByIndex): + (JSC::JSArray::getOwnPropertyDescriptor): + (JSC::JSArray::putByIndexBeyondVectorLength): + (JSC::JSArray::putDirectIndexBeyondVectorLength): + (JSC::JSArray::deletePropertyByIndex): + (JSC::JSArray::getOwnPropertyNames): + (JSC::JSArray::setLength): + (JSC::JSArray::sort): + (JSC::JSArray::compactForSorting): + (JSC::JSArray::checkConsistency): + * runtime/JSSymbolTableObject.cpp: + (JSC::JSSymbolTableObject::getOwnPropertyNames): + * runtime/JSSymbolTableObject.h: + (JSC::symbolTableGet): + (JSC::symbolTablePut): + (JSC::symbolTablePutWithAttributes): + * runtime/RegExpCache.cpp: + (JSC::RegExpCache::invalidateCode): + * runtime/WeakGCMap.h: + (JSC::WeakGCMap::clear): + (JSC::WeakGCMap::set): + * tools/ProfileTreeNode.h: + (JSC::ProfileTreeNode::sampleChild): + (JSC::ProfileTreeNode::childCount): + (JSC::ProfileTreeNode::dumpInternal): + (JSC::ProfileTreeNode::compareEntries): + +2012-08-27 Caio Marcelo de Oliveira Filho + + Rename first/second to key/value in HashMap iterators + https://bugs.webkit.org/show_bug.cgi?id=82784 + + Reviewed by Eric Seidel. + + * API/JSCallbackObject.h: + (JSC::JSCallbackObjectData::JSPrivatePropertyMap::getPrivateProperty): + (JSC::JSCallbackObjectData::JSPrivatePropertyMap::setPrivateProperty): + (JSC::JSCallbackObjectData::JSPrivatePropertyMap::visitChildren): + * API/JSCallbackObjectFunctions.h: + (JSC::::getOwnPropertyNames): + * API/JSClassRef.cpp: + (OpaqueJSClass::~OpaqueJSClass): + (OpaqueJSClassContextData::OpaqueJSClassContextData): + (OpaqueJSClass::contextData): + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + (JSC::EvalCodeCache::visitAggregate): + (JSC::CodeBlock::nameForRegister): + * bytecode/JumpTable.h: + (JSC::StringJumpTable::offsetForValue): + (JSC::StringJumpTable::ctiForValue): + * bytecode/LazyOperandValueProfile.cpp: + (JSC::LazyOperandValueProfileParser::getIfPresent): + * bytecode/SamplingTool.cpp: + (JSC::SamplingTool::dump): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::addVar): + (JSC::BytecodeGenerator::addGlobalVar): + (JSC::BytecodeGenerator::addConstant): + (JSC::BytecodeGenerator::addConstantValue): + (JSC::BytecodeGenerator::emitLoad): + (JSC::BytecodeGenerator::addStringConstant): + (JSC::BytecodeGenerator::emitLazyNewFunction): + * bytecompiler/NodesCodegen.cpp: + (JSC::PropertyListNode::emitBytecode): + * debugger/Debugger.cpp: + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse): + (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse): + (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize): + (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild): + * dfg/DFGAssemblyHelpers.cpp: + (JSC::DFG::AssemblyHelpers::decodedCodeMapFor): + * dfg/DFGByteCodeCache.h: + (JSC::DFG::ByteCodeCache::~ByteCodeCache): + (JSC::DFG::ByteCodeCache::get): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::cellConstant): + (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck): + (JSC::DFG::StructureCheckHoistingPhase::noticeClobber): + * heap/Heap.cpp: + (JSC::Heap::markProtectedObjects): + * heap/Heap.h: + (JSC::Heap::forEachProtectedCell): + * heap/JITStubRoutineSet.cpp: + (JSC::JITStubRoutineSet::markSlow): + (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines): + * heap/MarkStack.cpp: + (JSC::MarkStack::internalAppend): + * heap/Weak.h: + (JSC::weakRemove): + * jit/JIT.cpp: + (JSC::JIT::privateCompile): + * jit/JITStubs.cpp: + (JSC::JITThunks::ctiStub): + * parser/Parser.cpp: + (JSC::::parseStrictObjectLiteral): + * profiler/Profile.cpp: + (JSC::functionNameCountPairComparator): + (JSC::Profile::debugPrintDataSampleStyle): + * runtime/Identifier.cpp: + (JSC::Identifier::add): + * runtime/JSActivation.cpp: + (JSC::JSActivation::getOwnPropertyNames): + (JSC::JSActivation::symbolTablePutWithAttributes): + * runtime/JSArray.cpp: + (JSC::SparseArrayValueMap::put): + (JSC::SparseArrayValueMap::putDirect): + (JSC::SparseArrayValueMap::visitChildren): + (JSC::JSArray::enterDictionaryMode): + (JSC::JSArray::defineOwnNumericProperty): + (JSC::JSArray::getOwnPropertySlotByIndex): + (JSC::JSArray::getOwnPropertyDescriptor): + (JSC::JSArray::putByIndexBeyondVectorLength): + (JSC::JSArray::putDirectIndexBeyondVectorLength): + (JSC::JSArray::deletePropertyByIndex): + (JSC::JSArray::getOwnPropertyNames): + (JSC::JSArray::setLength): + (JSC::JSArray::sort): + (JSC::JSArray::compactForSorting): + (JSC::JSArray::checkConsistency): + * runtime/JSSymbolTableObject.cpp: + (JSC::JSSymbolTableObject::getOwnPropertyNames): + * runtime/JSSymbolTableObject.h: + (JSC::symbolTableGet): + (JSC::symbolTablePut): + (JSC::symbolTablePutWithAttributes): + * runtime/RegExpCache.cpp: + (JSC::RegExpCache::invalidateCode): + * runtime/WeakGCMap.h: + (JSC::WeakGCMap::clear): + (JSC::WeakGCMap::set): + * tools/ProfileTreeNode.h: + (JSC::ProfileTreeNode::sampleChild): + (JSC::ProfileTreeNode::childCount): + (JSC::ProfileTreeNode::dumpInternal): + (JSC::ProfileTreeNode::compareEntries): + +2012-08-27 Filip Pizlo + + Structure check hoisting should abstain if the OSR entry's must-handle value for the respective variable has a different structure + https://bugs.webkit.org/show_bug.cgi?id=95141 + + + Reviewed by Mark Hahnenberg. + + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + +2012-08-27 Mark Hahnenberg + + Remove use of ClassInfo from SpeculativeJIT::compileGetByValOnArguments + https://bugs.webkit.org/show_bug.cgi?id=95131 + + Reviewed by Filip Pizlo. + + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments): We don't need this speculation check. We can replace it + with an assert to guarantee this. + +2012-08-27 Oliver Hunt + + Remove opcode definition autogen for now + https://bugs.webkit.org/show_bug.cgi?id=95148 + + Reviewed by Mark Hahnenberg. + + This isn't worth doing at the moment. + + * DerivedSources.make: + * JavaScriptCore.xcodeproj/project.pbxproj: + * bytecode/Opcode.h: + (JSC): + (JSC::padOpcodeName): + * bytecode/OpcodeDefinitions.h: Removed. + * bytecode/opcodes: Removed. + * opcode_definition_generator.py: Removed. + * opcode_generator.py: Removed. + * opcode_parser.py: Removed. + +2012-08-27 Mark Hahnenberg + + Remove uses of TypedArray ClassInfo from SpeculativeJIT::checkArgumentTypes + https://bugs.webkit.org/show_bug.cgi?id=95112 + + Reviewed by Filip Pizlo. + + Removing these checks since we no longer need them. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::initialize): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::checkArgumentTypes): + +2012-08-27 Benjamin Poulain + + Add ECMAScript Number to String conversion to WTF::String + https://bugs.webkit.org/show_bug.cgi?id=95016 + + Reviewed by Geoffrey Garen. + + Rename UString::number(double) to UString::numberToStringECMAScript(double) to + differenciate it from the fixed-width conversion performed by String::number(). + + * parser/ParserArena.h: + (JSC::IdentifierArena::makeNumericIdentifier): + * runtime/JSONObject.cpp: + (JSC::Stringifier::appendStringifiedValue): + * runtime/NumberPrototype.cpp: + (JSC::numberProtoFuncToExponential): + (JSC::numberProtoFuncToFixed): + (JSC::numberProtoFuncToPrecision): + (JSC::numberProtoFuncToString): + * runtime/NumericStrings.h: + (JSC::NumericStrings::add): + * runtime/UString.cpp: + (JSC::UString::numberToStringECMAScript): + * runtime/UString.h: + (UString): + +2012-08-27 Mikhail Pozdnyakov + + Rename RegisterProtocolHandler API to NavigatorContentUtils + https://bugs.webkit.org/show_bug.cgi?id=94920 + + Reviewed by Adam Barth. + + ENABLE_REGISTER_PROTOCOL_HANDLER is renamed to ENABLE_NAVIGATOR_CONTENT_UTILS. + + * Configurations/FeatureDefines.xcconfig: + +2012-08-26 Filip Pizlo + + Unreviewed, fix for builds without VALUE_PROFILING. I had forgotten that shouldEmitProfiling() + is designed to return true if DFG_JIT is disabled. I should be using canBeOptimized() instead. + + * jit/JITCall.cpp: + (JSC::JIT::compileOpCall): + * jit/JITCall32_64.cpp: + (JSC::JIT::compileOpCall): + +2012-08-26 Geoffrey Garen + + Don't allocate space for arguments and call frame if arguments aren't captured + https://bugs.webkit.org/show_bug.cgi?id=95024 + + Reviewed by Phil Pizlo. + + 27% on v8-real-earley. + + * runtime/JSActivation.h: + (JSC::JSActivation::registerOffset): The offset is zero if we're skipping + the arguments and call frame because "offset" means space reserved for + those things. + + (JSC::JSActivation::tearOff): Don't copy the scope chain and callee. We + don't need them for anything, and we're no longer guaranteed to have + space for them. + +2012-08-26 Geoffrey Garen + + Removed the NULL checks from visitChildren functions + https://bugs.webkit.org/show_bug.cgi?id=95021 + + Reviewed by Oliver Hunt. + + As of http://trac.webkit.org/changeset/126624, all values are NULL-checked + during GC, so explicit NULL checks aren't needed anymore. + +2011-08-26 Geoffrey Garen + + Removed a JSC-specific hack from the web inspector + https://bugs.webkit.org/show_bug.cgi?id=95033 + + Reviewed by Filip Pizlo. + + Added support for what the web inspector really wanted instead. + + * runtime/JSActivation.cpp: + (JSC::JSActivation::symbolTableGet): + (JSC::JSActivation::symbolTablePut): Added some explanation for these + checks, which were non-obvious to me. + + (JSC::JSActivation::getOwnPropertySlot): It's impossible to access the + arguments property of an activation after it's been torn off, since the + only way to tear off an activation is to instantiate a new function, + which has its own arguments property in scope. However, the inspector + get special access to activations, and may try to perform this access, + so we need a special guard to maintain coherence and avoid crashing in + case the activation optimized out the arguments property. + + * runtime/JSActivation.cpp: + (JSC::JSActivation::symbolTableGet): + (JSC::JSActivation::symbolTablePut): + (JSC::JSActivation::getOwnPropertyNames): + (JSC::JSActivation::getOwnPropertyDescriptor): Provide getOwnPropertyNames + and getOwnPropertyDescriptor implementations, to meet the web inspector's + needs. (User code can never call these.) + +2012-08-24 Filip Pizlo + + Finally inlining should correctly track the catch context + https://bugs.webkit.org/show_bug.cgi?id=94986 + + + Reviewed by Sam Weinig. + + This fixes two behaviors: + + 1) Throwing from a finally block. Previously, we would seem to reenter the finally + block - though only once. + + 2) Executing a finally block from some nested context, for example due to a + 'continue', 'break', or 'return' in the try. This would execute the finally + block in the context of of the try block, which could lead to either scope depth + mismatches or reexecutions of the finally block on throw, similarly to (1) but + for different reasons. + + * bytecompiler/BytecodeGenerator.cpp: + (JSC): + (JSC::BytecodeGenerator::pushFinallyContext): + (JSC::BytecodeGenerator::emitComplexJumpScopes): + (JSC::BytecodeGenerator::pushTry): + (JSC::BytecodeGenerator::popTryAndEmitCatch): + * bytecompiler/BytecodeGenerator.h: + (FinallyContext): + (TryData): + (JSC): + (TryContext): + (TryRange): + (BytecodeGenerator): + * bytecompiler/NodesCodegen.cpp: + (JSC::TryNode::emitBytecode): + +2012-08-26 Filip Pizlo + + Array type checks and storage accesses should be uniformly represented and available to CSE + https://bugs.webkit.org/show_bug.cgi?id=95013 + + Reviewed by Oliver Hunt. + + This uniformly breaks up all array accesses into up to three parts: + + 1) The type check, using a newly introduced CheckArray node, in addition to possibly + a CheckStructure node. We were already inserting the CheckStructure prior to this + patch. The CheckArray node will be automatically eliminated if the thing it was + checking for had already been checked for, either intentionally (a CheckStructure + inserted based on the array profile of this access) or accidentally (some checks, + typically a CheckStructure, inserted for some unrelated operations). The + CheckArray node may not be inserted if the array type is non-specific (Generic or + ForceExit). + + 2) The storage load using GetIndexedPropertyStorage. Previously, this only worked for + GetByVal. Now it works for all array accesses. The storage load may not be + inserted if the mode of array access does not permit CSE of storage loads (like + non-specific modes or Arguments). + + 3) The access itself: one of GetByVal, PutByVal, PutByValAlias, ArrayPush, ArrayPop, + GetArrayLength, StringCharAt, or StringCharCodeAt. + + This means that the type check can be subjected to CSE even if the CFA isn't smart + enough to reason about it (yet!). It also means that the storage load can always be + subjected to CSE; previously CSE on storage load only worked for array loads and not + other forms of access. Finally, it removes the bizarre behavior that + GetIndexedPropertyStorage previously had: previously, it was responsible for the type + check in some cases, but not others; this made reasoning about the CFA really + confusing. + + This change also disables late refinement of array mode, since I decided that + supporting that feature is both confusing and likely unprofitable. The array modes are + now locked in in the first fixup run after prediction propagation. Of course, + refinements from Generic to something else would not have been a problem; we could + reenable those if we thought we really needed to. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + * dfg/DFGArrayMode.cpp: + (JSC::DFG::fromStructure): + (DFG): + (JSC::DFG::refineArrayMode): + * dfg/DFGArrayMode.h: + (DFG): + (JSC::DFG::modeIsJSArray): + (JSC::DFG::lengthNeedsStorage): + (JSC::DFG::modeIsSpecific): + (JSC::DFG::modeSupportsLength): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::ByteCodeParser): + (JSC::DFG::ByteCodeParser::getArrayMode): + (ByteCodeParser): + (JSC::DFG::ByteCodeParser::getArrayModeAndEmitChecks): + (JSC::DFG::ByteCodeParser::handleIntrinsic): + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCFGSimplificationPhase.cpp: + (JSC::DFG::CFGSimplificationPhase::mergeBlocks): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::CSEPhase): + (JSC::DFG::CSEPhase::checkStructureElimination): + (CSEPhase): + (JSC::DFG::CSEPhase::checkArrayElimination): + (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + (JSC::DFG::performCSE): + * dfg/DFGCSEPhase.h: + (DFG): + * dfg/DFGCommon.h: + * dfg/DFGConstantFoldingPhase.cpp: + (JSC::DFG::ConstantFoldingPhase::foldConstants): + * dfg/DFGDriver.cpp: + (JSC::DFG::compile): + * dfg/DFGFixupPhase.cpp: + (JSC::DFG::FixupPhase::fixupNode): + (JSC::DFG::FixupPhase::checkArray): + (FixupPhase): + (JSC::DFG::FixupPhase::blessArrayOperation): + * dfg/DFGGraph.cpp: + (JSC::DFG::Graph::Graph): + (DFG): + (JSC::DFG::Graph::dump): + (JSC::DFG::Graph::collectGarbage): + * dfg/DFGGraph.h: + (Graph): + (JSC::DFG::Graph::vote): + (JSC::DFG::Graph::substitute): + * dfg/DFGNode.h: + (JSC::DFG::Node::hasArrayMode): + (JSC::DFG::Node::setArrayMode): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGOperations.cpp: + * dfg/DFGPhase.h: + (DFG): + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + (JSC::DFG::PredictionPropagationPhase::mergeDefaultFlags): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::checkArray): + (JSC::DFG::SpeculativeJIT::useChildren): + (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): + (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray): + (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage): + (JSC::DFG::SpeculativeJIT::compileGetArrayLength): + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + +2012-08-26 Filip Pizlo + + DFGGraph.h has a bogus comment about the nature of StorageAccessData + https://bugs.webkit.org/show_bug.cgi?id=95035 + + Reviewed by Oliver Hunt. + + The comment is both wrong (storage access instructions don't reference CheckStructure) + and highly redundant: of course it's the case that two structures may have the same + identifier. Our interference analyses currently don't care about this and make the + conservative assumptions when necessary (same identifier, same object -> must be same + property; same identifier, may be same object -> may be the same property). Better to + remove the bogus comment since the code that operates over this data structure is + fairly self-explanatory already. + + * dfg/DFGGraph.h: + (StorageAccessData): + +2012-08-25 Geoffrey Garen + + Try a little harder to fix the Linux build. + + * runtime/JSActivation.cpp: + * runtime/JSActivation.h: + +2012-08-25 Geoffrey Garen + + Try to fix the Linux build. + + * runtime/JSActivation.cpp: + +2012-08-25 Geoffrey Garen + + Don't use malloc / destructors for activation objects + https://bugs.webkit.org/show_bug.cgi?id=94897 + + Reviewed by Oliver Hunt. + + 65% faster on v8-real-earley. + + Lots of boilerplate here, but the jist is this: + + (1) Use CopiedSpace instead of malloc to allocate the activation's + backing store. + + (2) Use MarkedSpace instead of ref-counting to allocate the symbol table. + + (3) ==> No more destructor. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::CodeBlock): + (JSC::CodeBlock::stronglyVisitStrongReferences): + * bytecode/CodeBlock.h: + (JSC::CodeBlock::symbolTable): + (CodeBlock): + (JSC::GlobalCodeBlock::GlobalCodeBlock): + (JSC::FunctionCodeBlock::FunctionCodeBlock): + (FunctionCodeBlock): SymbolTable is a GC object now, so it gets a write + barrier and visit calls instead of ref-counting. I changed all CodeBlocks + to use shared symbol tables because the distinction between shared and + unshared hurt my head. + + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::resolve): + (JSC::BytecodeGenerator::resolveConstDecl): + (JSC::BytecodeGenerator::emitPutStaticVar): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): Sometimes, a period just wants + to be an arrow. And then C++ is there to accommodate. + + * jit/JITDriver.h: + (JSC::jitCompileFunctionIfAppropriate): + * runtime/Arguments.h: + (ArgumentsData): + (JSC::Arguments::setRegisters): + (Arguments): + (JSC::Arguments::argument): + (JSC::Arguments::finishCreation): + * runtime/Executable.cpp: + (JSC::FunctionExecutable::FunctionExecutable): + (JSC::ProgramExecutable::compileInternal): + (JSC::FunctionExecutable::compileForCallInternal): + (JSC::FunctionExecutable::compileForConstructInternal): + (JSC::FunctionExecutable::visitChildren): + * runtime/Executable.h: + (JSC::FunctionExecutable::symbolTable): + (FunctionExecutable): + * runtime/ExecutionHarness.h: + (JSC::prepareFunctionForExecution): I changed from WriteBarrier to + WriteBarrierBase so activations could reuse StorageBarrier and PropertyStorage. + + * runtime/JSActivation.cpp: + (JSC::JSActivation::JSActivation): + (JSC::JSActivation::finishCreation): Allocate the symbol table here, + after we're fully constructed, to avoid GC during initialization. + + (JSC::JSActivation::visitChildren): + (JSC::JSActivation::symbolTableGet): + (JSC::JSActivation::symbolTablePut): + (JSC::JSActivation::getOwnPropertyNames): + (JSC::JSActivation::symbolTablePutWithAttributes): + * runtime/JSActivation.h: + (JSC::JSActivation::create): + (JSActivation): + (JSC::JSActivation::registerOffset): + (JSC): + (JSC::JSActivation::registerArraySize): + (JSC::JSActivation::registerArraySizeInBytes): + (JSC::JSActivation::tearOff): Tear-off zero-initializes all uncopied + registers. This makes it safe to copyAndAppend the full buffer in + visitChildren, without any extra checks. + + * runtime/JSCell.h: + (JSCell): Moved a shared default set of flags into this base class, so + I could use it in a few places. + + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::JSGlobalData): + * runtime/JSGlobalData.h: + (JSGlobalData): New structure for symbol tables. + + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::JSGlobalObject): + (JSC::JSGlobalObject::addStaticGlobals): + * runtime/JSGlobalObject.h: + (JSGlobalObject): + (JSC::JSGlobalObject::symbolTableHasProperty): We don't need an inline + symbol table -- JSSymbolTableObject will GC allocate one for us. + + * runtime/JSObject.h: + (JSObject): + * runtime/JSSegmentedVariableObject.h: + (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject): + * runtime/JSStaticScopeObject.cpp: + (JSC): + (JSC::JSStaticScopeObject::visitChildren): NULL check our register store + because finishCreation allocates an object now, so we may get marked + before we've assigned to our register store. + + * runtime/JSStaticScopeObject.h: + (JSC::JSStaticScopeObject::finishCreation): + (JSC::JSStaticScopeObject::JSStaticScopeObject): + (JSStaticScopeObject): No more destructor for this object, either, since + it no longer embeds a hash table. + + * runtime/JSSymbolTableObject.cpp: + (JSC::JSSymbolTableObject::visitChildren): + (JSC::JSSymbolTableObject::deleteProperty): + (JSC::JSSymbolTableObject::getOwnPropertyNames): + * runtime/JSSymbolTableObject.h: + (JSC::JSSymbolTableObject::symbolTable): + (JSSymbolTableObject): + (JSC::JSSymbolTableObject::JSSymbolTableObject): + (JSC::JSSymbolTableObject::finishCreation): + (JSC::symbolTableGet): + (JSC::symbolTablePut): + (JSC::symbolTablePutWithAttributes): SymbolTableObject allocates a symbol + table automatically if one isn't provided. (Activations provide their + own, which they get from compiled code.) + + * runtime/JSVariableObject.cpp: + (JSC): + * runtime/JSVariableObject.h: + (JSC::JSVariableObject::registerAt): + (JSC::JSVariableObject::addressOfRegisters): + (JSVariableObject): + (JSC::JSVariableObject::JSVariableObject): + (JSC::JSVariableObject::finishCreation): Removed a bunch of obsolete code. + Activations manage their registers directly now. + + * runtime/StorageBarrier.h: + (StorageBarrier): + (JSC::StorageBarrier::operator!): + + * runtime/SymbolTable.cpp: + (JSC): + (JSC::SharedSymbolTable::destroy): + * runtime/SymbolTable.h: + (JSC::SharedSymbolTable::create): + (SharedSymbolTable): + (JSC::SharedSymbolTable::createStructure): + (JSC::SharedSymbolTable::SharedSymbolTable): Boilerplat code to + make shared symbol table GC-allocated. + +2012-08-25 Filip Pizlo + + op_call should have ArrayProfiling for the benefit of array intrinsics + https://bugs.webkit.org/show_bug.cgi?id=95014 + + Reviewed by Sam Weinig. + + This is a performance-neutral change that just adds the profiling but does not + use it, yet. If in the future we wanted to make this kind of profiling cheaper + we could move it into specialized thunks for the relevant array intrinsics, but + I figure that if this much simpler change gives us what we need without any + discernable performance penalty then that's for the best. + + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::emitCall): + * jit/JITCall.cpp: + (JSC::JIT::compileOpCall): + * jit/JITCall32_64.cpp: + (JSC::JIT::compileOpCall): + * llint/LowLevelInterpreter.asm: + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + +2012-08-25 Filip Pizlo + + The redundant phi elimination phase is not used and should be removed + https://bugs.webkit.org/show_bug.cgi?id=95006 + + Reviewed by Dan Bernstein. + + Just removing dead code. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * dfg/DFGDriver.cpp: + * dfg/DFGRedundantPhiEliminationPhase.cpp: Removed. + * dfg/DFGRedundantPhiEliminationPhase.h: Removed. + +2012-08-24 Benjamin Poulain + + Unify Number to StringImpl conversion + https://bugs.webkit.org/show_bug.cgi?id=94879 + + Reviewed by Geoffrey Garen. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + * runtime/UString.cpp: + * runtime/UString.h: + (JSC::UString::number): + Update UString to directly use the common NumberToString implementation. + +2012-08-24 Oliver Hunt + + Always null check cells before marking + https://bugs.webkit.org/show_bug.cgi?id=94968 + + Reviewed by Geoffrey Garen. + + Originally we tried to minimise null checks by only null checking values + that we knew could be null, however given that we can't ever guarantee + when a GC will happen, we're better off just always assuming that a null + check will be necessary. This results in a much less fragile code base + as we can add GC allocations to object initialisers without having to + subsequently worry about whether the object we are initialising will need + to add a bunch of null checks in its visitChildren implementation. + + * heap/MarkStack.cpp: + (JSC::MarkStack::internalAppend): + * heap/MarkStackInlineMethods.h: + (JSC::MarkStack::append): + (JSC::MarkStack::appendUnbarrieredPointer): + * runtime/Structure.h: + (JSC::MarkStack::internalAppend): + +2012-08-23 Oliver Hunt + + Autogenerate Opcode definitions + https://bugs.webkit.org/show_bug.cgi?id=94840 + + Reviewed by Gavin Barraclough. + + Start the process of autogenerating the code emission for the bytecode. + We'll just start with automatic generation of the list of Opcodes as that + requires the actual definition of the opcodes, and the logic for parsing + them. + + Due to some rather annoying dependency cycles, this initial version has + the OpcodeDefinitions.h file checked into the tree, although with some + work I hope to be able to fix that. + + * DerivedSources.make: + * JavaScriptCore.xcodeproj/project.pbxproj: + * bytecode/Opcode.h: + Include OpcodeDefinitions.h as our definitive source of info + about the opcodes. + * bytecode/OpcodeDefinitions.h: Added. + Autogenerated file + * bytecode/opcodes: Added. + The new opcode definition file + * opcode_definition_generator.py: Added. + (generateOpcodeDefinition): + (generate): + Module that generates the content for OpcodeDefinitions.h + * opcode_generator.py: Added. + (printUsage): + (main): + Driver script + * opcode_parser.py: Added. + Simple parser for the opcode definitions. + +2011-08-23 Geoffrey Garen + + Unreviewed, rolling out r126505. + http://trac.webkit.org/changeset/126505 + https://bugs.webkit.org/show_bug.cgi?id=94840 + + Caused testapi to crash on launch + + * DerivedSources.make: + * JavaScriptCore.xcodeproj/project.pbxproj: + * bytecode/Opcode.h: + (JSC): + (JSC::padOpcodeName): + * bytecode/OpcodeDefinitions.h: Removed. + * bytecode/opcodes: Removed. + * opcode_definition_generator.py: Removed. + * opcode_generator.py: Removed. + * opcode_parser.py: Removed. + +2012-08-23 Oliver Hunt + + Autogenerate Opcode definitions + https://bugs.webkit.org/show_bug.cgi?id=94840 + + Reviewed by Gavin Barraclough. + + Start the process of autogenerating the code emission for the bytecode. + We'll just start with automatic generation of the list of Opcodes as that + requires the actual definition of the opcodes, and the logic for parsing + them. + + Due to some rather annoying dependency cycles, this initial version has + the OpcodeDefinitions.h file checked into the tree, although with some + work I hope to be able to fix that. + + * DerivedSources.make: + * JavaScriptCore.xcodeproj/project.pbxproj: + * bytecode/Opcode.h: + Include OpcodeDefinitions.h as our definitive source of info + about the opcodes. + * bytecode/OpcodeDefinitions.h: Added. + Autogenerated file + * bytecode/opcodes: Added. + The new opcode definition file + * opcode_definition_generator.py: Added. + (generateOpcodeDefinition): + (generate): + Module that generates the content for OpcodeDefinitions.h + * opcode_generator.py: Added. + (printUsage): + (main): + Driver script + * opcode_parser.py: Added. + Simple parser for the opcode definitions. + +2012-08-23 Mark Hahnenberg + + Change behavior of MasqueradesAsUndefined to better accommodate DFG changes + https://bugs.webkit.org/show_bug.cgi?id=93884 + + Reviewed by Filip Pizlo. + + With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of + MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines, + we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined + objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject). + For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not + masquerade as undefined within frame B, but it will continue to masquerade in frame A. + + There are two primary changes that are taking place here. One is to thread the ExecState* through + JSValue::toBoolean and JSCell::toBoolean so that JSCell::toBoolean can check the object's + JSGlobalObject to compare it to the lexical JSGlobalObject of the currently running code. If the two + are distinct, then the object cannot MasqueradeAsUndefined. + + The other change is to perform this comparison of JSGlobalObjects everywhere where the MasqueradesAsUndefined + flag in the Structure is checked. For C++ code, this check has been factored into its own function in + Structure::masqueradesAsUndefined. We only perform this check in the DFG if the current JSGlobalObject has + had a MasqueradesAsUndefined object allocated within its context. This conditional compilation is managed + through the use of a WatchpointSet in each JSGlobalObject and alternate create() functions for JS DOM wrappers + that are MasqueradesAsUndefined. + + * API/JSValueRef.cpp: + (JSValueToBoolean): + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + * bytecode/Watchpoint.h: + (WatchpointSet): + * debugger/DebuggerCallFrame.h: + (JSC::DebuggerCallFrame::callFrame): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGCFGSimplificationPhase.cpp: + (JSC::DFG::CFGSimplificationPhase::run): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull): + (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull): + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull): + (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull): + (JSC::DFG::SpeculativeJIT::compile): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_is_undefined): + (JSC::JIT::emit_op_jeq_null): + (JSC::JIT::emit_op_jneq_null): + (JSC::JIT::emit_op_eq_null): + (JSC::JIT::emit_op_neq_null): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_is_undefined): + (JSC::JIT::emit_op_jeq_null): + (JSC::JIT::emit_op_jneq_null): + (JSC::JIT::emit_op_eq_null): + (JSC::JIT::emit_op_neq_null): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/ArrayPrototype.cpp: + (JSC::arrayProtoFuncFilter): + (JSC::arrayProtoFuncEvery): + (JSC::arrayProtoFuncSome): + * runtime/BooleanConstructor.cpp: + (JSC::constructBoolean): + (JSC::callBooleanConstructor): + * runtime/JSCell.h: + (JSCell): + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::JSGlobalObject): + * runtime/JSGlobalObject.h: + (JSGlobalObject): + (JSC::JSGlobalObject::masqueradesAsUndefinedWatchpoint): + * runtime/JSString.h: + (JSC::JSCell::toBoolean): + (JSC::JSValue::toBoolean): + * runtime/JSValue.h: + * runtime/ObjectConstructor.cpp: + (JSC::toPropertyDescriptor): + * runtime/Operations.cpp: + (JSC::jsTypeStringForValue): + (JSC::jsIsObjectType): + * runtime/Operations.h: + (JSC): + (JSC::JSValue::equalSlowCaseInline): + * runtime/RegExpConstructor.cpp: + (JSC::setRegExpConstructorMultiline): + * runtime/RegExpPrototype.cpp: + (JSC::regExpProtoFuncToString): + * runtime/Structure.h: + (Structure): + (JSC::Structure::globalObjectOffset): + (JSC::Structure::masqueradesAsUndefined): + (JSC): + +2012-08-23 Mark Rowe + + Make JavaScriptCore build with the latest version of clang. + + Reviewed by Dan Bernstein. + + * heap/MachineStackMarker.cpp: + (JSC::MachineThreads::MachineThreads): The m_heap member is only used within + assertions, so guard its initialization with !ASSERT_DISABLED. + * heap/MachineStackMarker.h: + (MachineThreads): Ditto for its declaration. + * jit/JITStubCall.h: + (JSC::JITStubCall::JITStubCall): The m_returnType member is only used within + assertions or if we're using JSVALUE32_64, so guard its uses with the appropriate + #if. + (JITStubCall): Ditto. + +2012-08-23 Christophe Dumez + + Serialization of JavaScript values does not appear to respect new HTML5 Structured Clone semantics + https://bugs.webkit.org/show_bug.cgi?id=65292 + + Reviewed by Oliver Hunt. + + Add function to construct a StringObject from a JSValue. + Similar functions already exist for NumberObject and + BooleanObject for example. + + Export several symbols so address linking errors in + WebCore. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + * runtime/BooleanObject.h: + (BooleanObject): + * runtime/NumberObject.h: + (NumberObject): + (JSC): + * runtime/StringObject.cpp: + (JSC::constructString): + (JSC): + * runtime/StringObject.h: + (JSC): + +2012-08-22 Filip Pizlo + + Array accesses should remember what kind of array they are predicted to access + https://bugs.webkit.org/show_bug.cgi?id=94448 + + Reviewed by Gavin Barraclough. + + Introduced the notion of DFG::Array::Mode, stored in node.arrayMode(), which allows nodes + to remember how they decided to access arrays. This permits the bytecode parser to "lock in" + the mode of access if it has profiling at its disposal, and it also allows the prediction + propagator to do a fixup of the array mode later in the optimization fixpoint. + + This patch adds a healthy amount of new capability (specifically the ability of the parser + to lock in an array mode regardless of type predictions) and it also blows away a lot of + messy code. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + * dfg/DFGArrayMode.cpp: Added. + (DFG): + (JSC::DFG::fromObserved): + (JSC::DFG::refineArrayMode): + (JSC::DFG::modeAlreadyChecked): + (JSC::DFG::modeToString): + * dfg/DFGArrayMode.h: Added. + (DFG): + (JSC::DFG::canCSEStorage): + (JSC::DFG::modeForPut): + (JSC::DFG::modesCompatibleForStorageLoad): + (JSC::DFG::modeSupportsLength): + * dfg/DFGByteCodeParser.cpp: + (ByteCodeParser): + (JSC::DFG::ByteCodeParser::getArrayModeWithoutOSRExit): + (JSC::DFG::ByteCodeParser::getArrayMode): + (JSC::DFG::ByteCodeParser::handleIntrinsic): + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::getByValLoadElimination): + (JSC::DFG::CSEPhase::checkStructureLoadElimination): + (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination): + (JSC::DFG::CSEPhase::getByOffsetLoadElimination): + (JSC::DFG::CSEPhase::putByOffsetStoreElimination): + (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGFixupPhase.cpp: + (JSC::DFG::FixupPhase::fixupNode): + * dfg/DFGGraph.cpp: + (JSC::DFG::Graph::dump): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::byValIsPure): + (JSC::DFG::Graph::clobbersWorld): + * dfg/DFGNode.h: + (JSC::DFG::Node::hasArrayMode): + (Node): + (JSC::DFG::Node::arrayMode): + (JSC::DFG::Node::setArrayMode): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::typedArrayDescriptor): + (DFG): + (JSC::DFG::SpeculativeJIT::speculateArray): + (JSC::DFG::SpeculativeJIT::compileGetByValOnString): + (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): + (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): + (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): + (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray): + (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage): + (JSC::DFG::SpeculativeJIT::compileGetArrayLength): + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + +2012-08-22 Geoffrey Garen + + ThreadRestrictionVerifier should be opt-in, not opt-out + https://bugs.webkit.org/show_bug.cgi?id=94761 + + Reviewed by Mark Hahnenberg. + + Removed explicit calls to disable the verifier, since it's off by default now. + + * parser/SourceProvider.h: + (JSC::SourceProvider::SourceProvider): + (SourceProvider): + * runtime/SymbolTable.h: + (JSC::SharedSymbolTable::SharedSymbolTable): + +2012-08-22 Mark Hahnenberg + + Separate MarkStackThreadSharedData from MarkStack + https://bugs.webkit.org/show_bug.cgi?id=94294 + + Reviewed by Filip Pizlo. + + MarkStackThreadSharedData is soon going to have data to allow for a parallel copying + mode too, so to separate our concerns we should split it out into its own set of files + and rename it to GCThreadSharedData. For now this is purely a cosmetic refactoring. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * heap/GCThreadSharedData.cpp: Added. + (JSC): + (JSC::GCThreadSharedData::resetChildren): + (JSC::GCThreadSharedData::childVisitCount): + (JSC::GCThreadSharedData::markingThreadMain): + (JSC::GCThreadSharedData::markingThreadStartFunc): + (JSC::GCThreadSharedData::GCThreadSharedData): + (JSC::GCThreadSharedData::~GCThreadSharedData): + (JSC::GCThreadSharedData::reset): + * heap/GCThreadSharedData.h: Added. + (JSC): + (GCThreadSharedData): + * heap/Heap.h: + (Heap): + * heap/ListableHandler.h: + (ListableHandler): + * heap/MarkStack.cpp: + (JSC::MarkStack::MarkStack): + (JSC::MarkStack::~MarkStack): + * heap/MarkStack.h: + (JSC): + (MarkStack): + (JSC::MarkStack::sharedData): + * heap/MarkStackInlineMethods.h: Added. + (JSC): + (JSC::MarkStack::append): + (JSC::MarkStack::appendUnbarrieredPointer): + (JSC::MarkStack::appendUnbarrieredValue): + (JSC::MarkStack::internalAppend): + (JSC::MarkStack::addWeakReferenceHarvester): + (JSC::MarkStack::addUnconditionalFinalizer): + (JSC::MarkStack::addOpaqueRoot): + (JSC::MarkStack::containsOpaqueRoot): + (JSC::MarkStack::opaqueRootCount): + * heap/SlotVisitor.h: + (JSC): + (SlotVisitor): + (JSC::SlotVisitor::SlotVisitor): + +2012-08-22 Gabor Ballabas + + Fix JSC build when DFG-JIT is disabled + https://bugs.webkit.org/show_bug.cgi?id=94694 + + Reviewed by Csaba Osztrogonác. + + Adding an appropriate guard for fixing the build. + + * bytecode/ResolveGlobalStatus.cpp: + (JSC): + +2012-08-21 Mark Lam + + Introducing the VMInspector for VM debugging use. + https://bugs.webkit.org/show_bug.cgi?id=94613. + + Reviewed by Filip Pizlo. + + Adding some utility functions for debugging the VM. This code is + presently #ifdef'd out by default. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * interpreter/CallFrame.h: + (ExecState): + * interpreter/VMInspector.cpp: Added. + (JSC): + (JSC::VMInspector::getTypeName): + (JSC::VMInspector::dumpFrame0): + (JSC::VMInspector::dumpFrame): + (JSC::VMInspector::countFrames): + * interpreter/VMInspector.h: Added. + (JSC): + (VMInspector): + +2012-08-21 Filip Pizlo + + A patchable GetById right after a watchpoint should have the appropriate nop padding + https://bugs.webkit.org/show_bug.cgi?id=94635 + + Reviewed by Mark Hahnenberg. + + * assembler/AbstractMacroAssembler.h: + (JSC::AbstractMacroAssembler::padBeforePatch): + (AbstractMacroAssembler): + * assembler/MacroAssemblerARMv7.h: + (JSC::MacroAssemblerARMv7::load32WithCompactAddressOffsetPatch): + (JSC::MacroAssemblerARMv7::moveWithPatch): + (JSC::MacroAssemblerARMv7::patchableJump): + * assembler/MacroAssemblerX86.h: + (JSC::MacroAssemblerX86::moveWithPatch): + (JSC::MacroAssemblerX86::branchPtrWithPatch): + (JSC::MacroAssemblerX86::storePtrWithPatch): + * assembler/MacroAssemblerX86Common.h: + (JSC::MacroAssemblerX86Common::load32WithAddressOffsetPatch): + (JSC::MacroAssemblerX86Common::load32WithCompactAddressOffsetPatch): + (JSC::MacroAssemblerX86Common::loadCompactWithAddressOffsetPatch): + (JSC::MacroAssemblerX86Common::store32WithAddressOffsetPatch): + * assembler/MacroAssemblerX86_64.h: + (JSC::MacroAssemblerX86_64::loadPtrWithAddressOffsetPatch): + (JSC::MacroAssemblerX86_64::loadPtrWithCompactAddressOffsetPatch): + (JSC::MacroAssemblerX86_64::storePtrWithAddressOffsetPatch): + (JSC::MacroAssemblerX86_64::moveWithPatch): + * jit/JumpReplacementWatchpoint.cpp: + (JSC::JumpReplacementWatchpoint::fireInternal): + +2012-08-20 Mark Lam + + Fix broken non-JIT build. + https://bugs.webkit.org/show_bug.cgi?id=94564. + + Reviewed by Filip Pizlo. + + Added some UNUSED_PARAM() macros to make the compiler happy. + + * runtime/Executable.cpp: + (JSC::EvalExecutable::compileInternal): + (JSC::ProgramExecutable::compileInternal): + (JSC::FunctionExecutable::compileForCallInternal): + (JSC::FunctionExecutable::compileForConstructInternal): + +2012-08-20 Mark Lam + + Fixed erroneous line number for LLint frame when throwing exceptions. + https://bugs.webkit.org/show_bug.cgi?id=94051. + + Reviewed by Filip Pizlo. + + For LLInt frames, before throwing an exception, adjust the PC from the + return PC back to the call PC if we are indeed at a call site. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::adjustPCIfAtCallSite): + (JSC): + (JSC::CodeBlock::bytecodeOffset): + * bytecode/CodeBlock.h: + (CodeBlock): + * llint/LLIntExceptions.cpp: + (JSC::LLInt::fixupPCforExceptionIfNeeded): + (LLInt): + (JSC::LLInt::interpreterThrowInCaller): + (JSC::LLInt::returnToThrow): + (JSC::LLInt::callToThrow): + +2012-08-20 Filip Pizlo + + fast/js/dfg-peephole-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html on 32-bit + https://bugs.webkit.org/show_bug.cgi?id=94538 + + Reviewed by Mark Hahnenberg. + + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality): + +2012-08-20 Filip Pizlo + + fast/js/dfg-compare-final-object-to-final-object-or-other-when-both-proven-final-object.html crashes on 32-bit + https://bugs.webkit.org/show_bug.cgi?id=94026 + + Reviewed by Mark Hahnenberg. + + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality): + +2012-08-19 Filip Pizlo + + The relationship between abstract values and structure transition watchpoints should be rationalized + https://bugs.webkit.org/show_bug.cgi?id=94205 + + Reviewed by Geoffrey Garen. + + This patch does a number of things related to the handling of the abstract values + arrising from values with structures known to be watchpointable: + + - This rationalizes the relationship between the structure that we know an object + to have *right now* based on having executed a check against that structure, and + the structure that we know the object could have *in the future* based on a type + check executed in the past over a structure that was watchpointable. + + - We use the above to assert that structure transition watchpoints are being used + soundly. + + - We use the above to strength reduce CheckStructure into StructureTransitionWatchpoint + whenever possible. + + - This rationalizes the handling of CFA over constants that appeared in the bytecode. + If at compile-time the constant has a watchpointable structure, then we can prove + what structures it may have in the future. The analysis uses this to both assert + that structure transition watchpoints are being used correctly, and to find + opportunities for using them more aggressively. + + The net effect of all of these changes is that OSR entry should work more smoothly. + It may also be a slight win due to strength reductions, though most of those strength + reductions would have already been done by the parser and the structure check hoister. + + * GNUmakefile.list.am: + * JavaScriptCore.xcodeproj/project.pbxproj: + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::beginBasicBlock): + (JSC::DFG::AbstractState::execute): + * dfg/DFGAbstractValue.h: + (DFG): + (JSC::DFG::AbstractValue::clear): + (JSC::DFG::AbstractValue::isClear): + (JSC::DFG::AbstractValue::makeTop): + (JSC::DFG::AbstractValue::clobberStructures): + (JSC::DFG::AbstractValue::isTop): + (JSC::DFG::AbstractValue::setFuturePossibleStructure): + (AbstractValue): + (JSC::DFG::AbstractValue::filterFuturePossibleStructure): + (JSC::DFG::AbstractValue::setMostSpecific): + (JSC::DFG::AbstractValue::set): + (JSC::DFG::AbstractValue::operator==): + (JSC::DFG::AbstractValue::merge): + (JSC::DFG::AbstractValue::filter): + (JSC::DFG::AbstractValue::filterValueByType): + (JSC::DFG::AbstractValue::validateType): + (JSC::DFG::AbstractValue::validate): + (JSC::DFG::AbstractValue::checkConsistency): + (JSC::DFG::AbstractValue::dump): + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::checkStructureLoadElimination): + (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGConstantFoldingPhase.cpp: + (JSC::DFG::ConstantFoldingPhase::foldConstants): + * dfg/DFGNode.h: + (JSC::DFG::Node::convertToStructureTransitionWatchpoint): + (Node): + (JSC::DFG::Node::hasStructure): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGOSREntry.cpp: + (JSC::DFG::prepareOSREntry): + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::convertLastOSRExitToForward): + (JSC::DFG::SpeculativeJIT::forwardSpeculationWatchpoint): + (DFG): + (JSC::DFG::SpeculativeJIT::speculationWatchpointWithConditionalDirection): + (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck): + (JSC::DFG::SpeculativeJIT::speculateArray): + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGStructureAbstractValue.h: Added. + (DFG): + (StructureAbstractValue): + (JSC::DFG::StructureAbstractValue::StructureAbstractValue): + (JSC::DFG::StructureAbstractValue::clear): + (JSC::DFG::StructureAbstractValue::makeTop): + (JSC::DFG::StructureAbstractValue::top): + (JSC::DFG::StructureAbstractValue::add): + (JSC::DFG::StructureAbstractValue::addAll): + (JSC::DFG::StructureAbstractValue::contains): + (JSC::DFG::StructureAbstractValue::isSubsetOf): + (JSC::DFG::StructureAbstractValue::doesNotContainAnyOtherThan): + (JSC::DFG::StructureAbstractValue::isSupersetOf): + (JSC::DFG::StructureAbstractValue::filter): + (JSC::DFG::StructureAbstractValue::isClear): + (JSC::DFG::StructureAbstractValue::isTop): + (JSC::DFG::StructureAbstractValue::isClearOrTop): + (JSC::DFG::StructureAbstractValue::isNeitherClearNorTop): + (JSC::DFG::StructureAbstractValue::size): + (JSC::DFG::StructureAbstractValue::at): + (JSC::DFG::StructureAbstractValue::operator[]): + (JSC::DFG::StructureAbstractValue::last): + (JSC::DFG::StructureAbstractValue::speculationFromStructures): + (JSC::DFG::StructureAbstractValue::hasSingleton): + (JSC::DFG::StructureAbstractValue::singleton): + (JSC::DFG::StructureAbstractValue::operator==): + (JSC::DFG::StructureAbstractValue::dump): + (JSC::DFG::StructureAbstractValue::topValue): + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + +2012-08-17 Filip Pizlo + + The current state of the call frame should be taken into account in the DFG for both predictions and proofs + https://bugs.webkit.org/show_bug.cgi?id=94412 + + Reviewed by Geoffrey Garen. + + This ensures that no matter how smart the DFG gets, it'll always know through + which entrypoint OSR will try to enter, and with which values it will attempt + to do so. For prologue OSR, this has no effect other than adding the current + arguments to the argument predictions. For loop OSR, this makes our treatment + of the loop slightly more conservative - just conservative enough to ensure + that OSR succeeds. + + * bytecode/CodeBlock.cpp: + (JSC::ProgramCodeBlock::compileOptimized): + (JSC::EvalCodeBlock::compileOptimized): + (JSC::FunctionCodeBlock::compileOptimized): + * bytecode/CodeBlock.h: + (CodeBlock): + (ProgramCodeBlock): + (EvalCodeBlock): + (FunctionCodeBlock): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::initialize): + * dfg/DFGAbstractValue.h: + (JSC::DFG::AbstractValue::setMostSpecific): + (AbstractValue): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::fixVariableAccessPredictions): + (JSC::DFG::ByteCodeParser::parse): + * dfg/DFGDriver.cpp: + (JSC::DFG::compile): + (JSC::DFG::tryCompile): + (JSC::DFG::tryCompileFunction): + * dfg/DFGDriver.h: + (DFG): + (JSC::DFG::tryCompile): + (JSC::DFG::tryCompileFunction): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::Graph): + (Graph): + * jit/JITDriver.h: + (JSC::jitCompileIfAppropriate): + (JSC::jitCompileFunctionIfAppropriate): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * runtime/Executable.cpp: + (JSC::EvalExecutable::compileOptimized): + (JSC::EvalExecutable::compileInternal): + (JSC::ProgramExecutable::compileOptimized): + (JSC::ProgramExecutable::compileInternal): + (JSC::FunctionExecutable::compileOptimizedForCall): + (JSC::FunctionExecutable::compileOptimizedForConstruct): + (JSC::FunctionExecutable::compileForCallInternal): + (JSC::FunctionExecutable::compileForConstructInternal): + * runtime/Executable.h: + (EvalExecutable): + (ProgramExecutable): + (FunctionExecutable): + (JSC::FunctionExecutable::compileOptimizedFor): + * runtime/ExecutionHarness.h: + (JSC::prepareForExecution): + (JSC::prepareFunctionForExecution): + +2012-08-17 Filip Pizlo + + DFG CSE should be more honest about when it changed the IR + https://bugs.webkit.org/show_bug.cgi?id=94408 + + Reviewed by Geoffrey Garen. + + The CSE phase now always returns true if it changed the IR. + + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::setReplacement): + (JSC::DFG::CSEPhase::eliminate): + (JSC::DFG::CSEPhase::performNodeCSE): + +2012-08-17 Filip Pizlo + + DFG is still too pessimistic about what constitutes a side-effect on array accesses + https://bugs.webkit.org/show_bug.cgi?id=94309 + + Reviewed by Geoffrey Garen. + + This change means that even if structure transition watchpoints are not used for + hoisting of clobbered structure checks, we still retain good performance on the + benchmarks we care about. That's important, since butterflies will likely make + most array structures not watchpointable. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + +2012-08-17 Milian Wolff + + [Qt] QNX build fails due to ctype usage in system headers + https://bugs.webkit.org/show_bug.cgi?id=93849 + + Reviewed by Simon Hausmann. + + Move the check for whether DisallowCType should be active or not + to the DisallowCType.h header. This way, we can update the list + of platforms or OSes which do not work with this header in a + central place. All users can now safely include the header + and do not need to place custom guards around it. + + * config.h: + +2012-08-16 Simon Hausmann + + [Qt] Replace use of internal Weak smart pointer with JSWeakObjectMap + https://bugs.webkit.org/show_bug.cgi?id=93872 + + Reviewed by Kenneth Rohde Christiansen. + + * Target.pri: Add missing JSWeakObjectMap file to build. + +2012-08-16 Filip Pizlo + + Structure check hoisting should be less expensive + https://bugs.webkit.org/show_bug.cgi?id=94201 + + Reviewed by Mark Hahnenberg. + + This appears like a broad win on short-running programs. + + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGDriver.cpp: + (JSC::DFG::compile): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::compareAndSwap): + (Graph): + (JSC::DFG::Graph::substitute): + (JSC::DFG::Graph::substituteGetLocal): + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + +2012-08-16 Filip Pizlo + + All op_resolve_global instructions should end up in the list of global resolve instructions + https://bugs.webkit.org/show_bug.cgi?id=94247 + + + Reviewed by Mark Hahnenberg. + + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::emitResolveWithBase): + +2012-08-15 Bruno de Oliveira Abinader + + [css3-text] Add CSS3 Text decoration compile flag + https://bugs.webkit.org/show_bug.cgi?id=93863 + + Reviewed by Julien Chaffraix. + + This patch handles the compile flag implementation, which will come disabled by + default, thus not exposing the CSS3 text decoration features to the web, unless + when explicitly enabling it with "--css3-text-decoration" build parameter. + + * Configurations/FeatureDefines.xcconfig: + +2012-08-15 Sheriff Bot + + Unreviewed, rolling out r125687. + http://trac.webkit.org/changeset/125687 + https://bugs.webkit.org/show_bug.cgi?id=94147 + + It broke the whole world (Requested by Ossy_night on #webkit). + + * API/JSValueRef.cpp: + (JSValueToBoolean): + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + * bytecode/Watchpoint.h: + (WatchpointSet): + * debugger/DebuggerCallFrame.h: + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGCFGSimplificationPhase.cpp: + (JSC::DFG::CFGSimplificationPhase::run): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull): + (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull): + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull): + (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull): + (JSC::DFG::SpeculativeJIT::compile): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_is_undefined): + (JSC::JIT::emit_op_jeq_null): + (JSC::JIT::emit_op_jneq_null): + (JSC::JIT::emit_op_eq_null): + (JSC::JIT::emit_op_neq_null): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_is_undefined): + (JSC::JIT::emit_op_jeq_null): + (JSC::JIT::emit_op_jneq_null): + (JSC::JIT::emit_op_eq_null): + (JSC::JIT::emit_op_neq_null): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/ArrayPrototype.cpp: + (JSC::arrayProtoFuncFilter): + (JSC::arrayProtoFuncEvery): + (JSC::arrayProtoFuncSome): + * runtime/BooleanConstructor.cpp: + (JSC::constructBoolean): + (JSC::callBooleanConstructor): + * runtime/JSCell.h: + (JSCell): + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::JSGlobalObject): + * runtime/JSGlobalObject.h: + (JSGlobalObject): + * runtime/JSString.h: + (JSC::JSCell::toBoolean): + (JSC::JSValue::toBoolean): + * runtime/JSValue.h: + * runtime/ObjectConstructor.cpp: + (JSC::toPropertyDescriptor): + * runtime/Operations.cpp: + (JSC::jsTypeStringForValue): + (JSC::jsIsObjectType): + * runtime/Operations.h: + (JSC): + (JSC::JSValue::equalSlowCaseInline): + * runtime/RegExpConstructor.cpp: + (JSC::setRegExpConstructorMultiline): + * runtime/RegExpPrototype.cpp: + (JSC::regExpProtoFuncToString): + * runtime/Structure.h: + +2012-08-15 Gabor Ballabas + + Buildfix after r125541 + https://bugs.webkit.org/show_bug.cgi?id=94097 + + Reviewed by Filip Pizlo. + + r125541 has broken the traditional ARM port build of JSC. + + * assembler/MacroAssemblerARM.h: + (JSC::MacroAssemblerARM::neg32): + (JSC::MacroAssemblerARM::xor32): + +2012-08-14 Mark Hahnenberg + + Change behavior of MasqueradesAsUndefined to better accommodate DFG changes + https://bugs.webkit.org/show_bug.cgi?id=93884 + + Reviewed by Geoffrey Garen. + + With some upcoming changes to the DFG to remove uses of ClassInfo, we will be changing the behavior of + MasqueradesAsUndefined. In order to make this change consistent across all of our execution engines, + we will make this change to MasqueradesAsUndefined as a separate patch. After this patch, MasqueradesAsUndefined + objects will only masquerade as undefined in their original context (i.e. their original JSGlobalObject). + For example, if an object that masquerades as undefined in frame A is passed to frame B, it will not + masquerade as undefined within frame B, but it will continue to masquerade in frame A. + + There are two primary changes that are taking place here. One is to thread the ExecState* through + JSValue::toBoolean and JSCell::toBoolean so that JSCell::toBoolean can check the object's + JSGlobalObject to compare it to the lexical JSGlobalObject of the currently running code. If the two + are distinct, then the object cannot MasqueradeAsUndefined. + + The other change is to perform this comparison of JSGlobalObjects everywhere where the MasqueradesAsUndefined + flag in the Structure is checked. For C++ code, this check has been factored into its own function in + Structure::masqueradesAsUndefined. We only perform this check in the DFG if the current JSGlobalObject has + had a MasqueradesAsUndefined object allocated within its context. This conditional compilation is managed + through the use of a WatchpointSet in each JSGlobalObject and alternate create() functions for JS DOM wrappers + that are MasqueradesAsUndefined. + + * API/JSValueRef.cpp: + (JSValueToBoolean): + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + * bytecode/Watchpoint.h: + (WatchpointSet): + * debugger/DebuggerCallFrame.h: + (JSC::DebuggerCallFrame::callFrame): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGCFGSimplificationPhase.cpp: + (JSC::DFG::CFGSimplificationPhase::run): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull): + (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull): + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNull): + (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull): + (JSC::DFG::SpeculativeJIT::compile): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_is_undefined): + (JSC::JIT::emit_op_jeq_null): + (JSC::JIT::emit_op_jneq_null): + (JSC::JIT::emit_op_eq_null): + (JSC::JIT::emit_op_neq_null): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_is_undefined): + (JSC::JIT::emit_op_jeq_null): + (JSC::JIT::emit_op_jneq_null): + (JSC::JIT::emit_op_eq_null): + (JSC::JIT::emit_op_neq_null): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/ArrayPrototype.cpp: + (JSC::arrayProtoFuncFilter): + (JSC::arrayProtoFuncEvery): + (JSC::arrayProtoFuncSome): + * runtime/BooleanConstructor.cpp: + (JSC::constructBoolean): + (JSC::callBooleanConstructor): + * runtime/JSCell.h: + (JSCell): + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::JSGlobalObject): + * runtime/JSGlobalObject.h: + (JSGlobalObject): + (JSC::JSGlobalObject::masqueradesAsUndefinedWatchpoint): + * runtime/JSString.h: + (JSC::JSCell::toBoolean): + (JSC::JSValue::toBoolean): + * runtime/JSValue.h: + * runtime/ObjectConstructor.cpp: + (JSC::toPropertyDescriptor): + * runtime/Operations.cpp: + (JSC::jsTypeStringForValue): + (JSC::jsIsObjectType): + * runtime/Operations.h: + (JSC): + (JSC::JSValue::equalSlowCaseInline): + * runtime/RegExpConstructor.cpp: + (JSC::setRegExpConstructorMultiline): + * runtime/RegExpPrototype.cpp: + (JSC::regExpProtoFuncToString): + * runtime/Structure.h: + (Structure): + (JSC::Structure::globalObjectOffset): + (JSC::Structure::masqueradesAsUndefined): + (JSC): + +2012-08-14 Filip Pizlo + + Unreviewed, build fix for !ENABLE(DFG_JIT) + + * jit/JITPropertyAccess.cpp: + (JSC::JIT::emit_op_get_by_val): + (JSC::JIT::emit_op_put_by_val): + (JSC::JIT::privateCompilePatchGetArrayLength): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::emit_op_get_by_val): + (JSC::JIT::emit_op_put_by_val): + (JSC::JIT::privateCompilePatchGetArrayLength): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + +2012-08-13 Filip Pizlo + + Array checks should use the structure, not the class info + https://bugs.webkit.org/show_bug.cgi?id=93150 + + Reviewed by Mark Hahnenberg. + + This changes all array checks used in array accesses (get, put, get length, + push, pop) to use the structure, not the class info. Additionally, these + checks in the LLInt and baseline JIT record the structure in an ArrayProfile, + so that the DFG can know exactly what structure to check for. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * bytecode/ArrayProfile.cpp: Added. + (JSC): + (JSC::ArrayProfile::computeUpdatedPrediction): + * bytecode/ArrayProfile.h: Added. + (JSC): + (JSC::arrayModeFromStructure): + (ArrayProfile): + (JSC::ArrayProfile::ArrayProfile): + (JSC::ArrayProfile::bytecodeOffset): + (JSC::ArrayProfile::addressOfLastSeenStructure): + (JSC::ArrayProfile::observeStructure): + (JSC::ArrayProfile::expectedStructure): + (JSC::ArrayProfile::structureIsPolymorphic): + (JSC::ArrayProfile::hasDefiniteStructure): + (JSC::ArrayProfile::observedArrayModes): + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + (JSC::CodeBlock::getArrayProfile): + (JSC): + (JSC::CodeBlock::getOrAddArrayProfile): + (JSC::CodeBlock::updateAllPredictionsAndCountLiveness): + * bytecode/CodeBlock.h: + (JSC::CodeBlock::executionEntryCount): + (JSC::CodeBlock::numberOfArrayProfiles): + (JSC::CodeBlock::arrayProfiles): + (JSC::CodeBlock::addArrayProfile): + (CodeBlock): + * bytecode/Instruction.h: + (JSC): + (JSC::Instruction::Instruction): + * bytecode/Opcode.h: + (JSC): + (JSC::padOpcodeName): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::emitGetArgumentByVal): + (JSC::BytecodeGenerator::emitGetByVal): + (JSC::BytecodeGenerator::emitPutByVal): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::initialize): + (JSC::DFG::AbstractState::execute): + * dfg/DFGAbstractValue.h: + (JSC::DFG::StructureAbstractValue::hasSingleton): + (StructureAbstractValue): + (JSC::DFG::StructureAbstractValue::singleton): + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGFixupPhase.cpp: + (JSC::DFG::FixupPhase::fixupNode): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::speculateArray): + (DFG): + (JSC::DFG::SpeculativeJIT::compile): + (JSC::DFG::SpeculativeJIT::checkArgumentTypes): + (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage): + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::emit_op_get_by_val): + (JSC::JIT::emit_op_put_by_val): + (JSC::JIT::privateCompilePatchGetArrayLength): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::emit_op_get_by_val): + (JSC::JIT::emit_op_put_by_val): + (JSC::JIT::privateCompilePatchGetArrayLength): + * llint/LLIntOffsetsExtractor.cpp: + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/Structure.h: + (Structure): + (JSC::Structure::classInfoOffset): + +2012-08-14 Gabor Ballabas + + Rename functions in the ARM port of DFG-JIT for better code readability. + https://bugs.webkit.org/show_bug.cgi?id=93609 + + Reviewed by Zoltan Herczeg. + + Rename functions in the ARM port of DFG-JIT for better code + readability, and for following the WebKit coding style + wherever it is possible. + + * assembler/ARMAssembler.cpp: + (JSC::ARMAssembler::genInt): + (JSC::ARMAssembler::getImm): + (JSC::ARMAssembler::moveImm): + (JSC::ARMAssembler::encodeComplexImm): + (JSC::ARMAssembler::dataTransfer32): + (JSC::ARMAssembler::baseIndexTransfer32): + (JSC::ARMAssembler::dataTransfer16): + (JSC::ARMAssembler::baseIndexTransfer16): + (JSC::ARMAssembler::dataTransferFloat): + (JSC::ARMAssembler::baseIndexTransferFloat): + * assembler/ARMAssembler.h: + (JSC::ARMAssembler::bitAnd): + (JSC::ARMAssembler::bitAnds): + (JSC::ARMAssembler::eor): + (JSC::ARMAssembler::eors): + (JSC::ARMAssembler::sub): + (JSC::ARMAssembler::subs): + (JSC::ARMAssembler::rsb): + (JSC::ARMAssembler::rsbs): + (JSC::ARMAssembler::add): + (JSC::ARMAssembler::adds): + (JSC::ARMAssembler::adc): + (JSC::ARMAssembler::adcs): + (JSC::ARMAssembler::sbc): + (JSC::ARMAssembler::sbcs): + (JSC::ARMAssembler::rsc): + (JSC::ARMAssembler::rscs): + (JSC::ARMAssembler::tst): + (JSC::ARMAssembler::teq): + (JSC::ARMAssembler::cmp): + (JSC::ARMAssembler::cmn): + (JSC::ARMAssembler::orr): + (JSC::ARMAssembler::orrs): + (JSC::ARMAssembler::mov): + (JSC::ARMAssembler::movw): + (JSC::ARMAssembler::movt): + (JSC::ARMAssembler::movs): + (JSC::ARMAssembler::bic): + (JSC::ARMAssembler::bics): + (JSC::ARMAssembler::mvn): + (JSC::ARMAssembler::mvns): + (JSC::ARMAssembler::mul): + (JSC::ARMAssembler::muls): + (JSC::ARMAssembler::mull): + (JSC::ARMAssembler::vmov_f64): + (JSC::ARMAssembler::vadd_f64): + (JSC::ARMAssembler::vdiv_f64): + (JSC::ARMAssembler::vsub_f64): + (JSC::ARMAssembler::vmul_f64): + (JSC::ARMAssembler::vcmp_f64): + (JSC::ARMAssembler::vsqrt_f64): + (JSC::ARMAssembler::vabs_f64): + (JSC::ARMAssembler::vneg_f64): + (JSC::ARMAssembler::ldrImmediate): + (JSC::ARMAssembler::ldrUniqueImmediate): + (JSC::ARMAssembler::dtrUp): + (JSC::ARMAssembler::dtrUpRegister): + (JSC::ARMAssembler::dtrDown): + (JSC::ARMAssembler::dtrDownRegister): + (JSC::ARMAssembler::halfDtrUp): + (JSC::ARMAssembler::halfDtrUpRegister): + (JSC::ARMAssembler::halfDtrDown): + (JSC::ARMAssembler::halfDtrDownRegister): + (JSC::ARMAssembler::doubleDtrUp): + (JSC::ARMAssembler::doubleDtrDown): + (JSC::ARMAssembler::push): + (JSC::ARMAssembler::pop): + (JSC::ARMAssembler::poke): + (JSC::ARMAssembler::peek): + (JSC::ARMAssembler::vmov_vfp64): + (JSC::ARMAssembler::vmov_arm64): + (JSC::ARMAssembler::vmov_vfp32): + (JSC::ARMAssembler::vmov_arm32): + (JSC::ARMAssembler::vcvt_f64_s32): + (JSC::ARMAssembler::vcvt_s32_f64): + (JSC::ARMAssembler::vcvt_u32_f64): + (JSC::ARMAssembler::vcvt_f64_f32): + (JSC::ARMAssembler::vcvt_f32_f64): + (JSC::ARMAssembler::clz): + (JSC::ARMAssembler::lslRegister): + (JSC::ARMAssembler::lsrRegister): + (JSC::ARMAssembler::asrRegister): + (JSC::ARMAssembler::align): + (JSC::ARMAssembler::loadBranchTarget): + (JSC::ARMAssembler::vmov): + * assembler/MacroAssemblerARM.cpp: + (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords): + * assembler/MacroAssemblerARM.h: + (JSC::MacroAssemblerARM::add32): + (JSC::MacroAssemblerARM::and32): + (JSC::MacroAssemblerARM::lshift32): + (JSC::MacroAssemblerARM::mul32): + (JSC::MacroAssemblerARM::or32): + (JSC::MacroAssemblerARM::rshift32): + (JSC::MacroAssemblerARM::urshift32): + (JSC::MacroAssemblerARM::sub32): + (JSC::MacroAssemblerARM::xor32): + (JSC::MacroAssemblerARM::countLeadingZeros32): + (JSC::MacroAssemblerARM::convertibleLoadPtr): + (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch): + (JSC::MacroAssemblerARM::load32WithCompactAddressOffsetPatch): + (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch): + (JSC::MacroAssemblerARM::store32): + (JSC::MacroAssemblerARM::pop): + (JSC::MacroAssemblerARM::push): + (JSC::MacroAssemblerARM::move): + (JSC::MacroAssemblerARM::swap): + (JSC::MacroAssemblerARM::branch32): + (JSC::MacroAssemblerARM::branchTest32): + (JSC::MacroAssemblerARM::mull32): + (JSC::MacroAssemblerARM::branchSub32): + (JSC::MacroAssemblerARM::compare32): + (JSC::MacroAssemblerARM::test32): + (JSC::MacroAssemblerARM::load32): + (JSC::MacroAssemblerARM::relativeTableJump): + (JSC::MacroAssemblerARM::moveWithPatch): + (JSC::MacroAssemblerARM::loadDouble): + (JSC::MacroAssemblerARM::moveDouble): + (JSC::MacroAssemblerARM::addDouble): + (JSC::MacroAssemblerARM::divDouble): + (JSC::MacroAssemblerARM::subDouble): + (JSC::MacroAssemblerARM::mulDouble): + (JSC::MacroAssemblerARM::sqrtDouble): + (JSC::MacroAssemblerARM::absDouble): + (JSC::MacroAssemblerARM::negateDouble): + (JSC::MacroAssemblerARM::convertInt32ToDouble): + (JSC::MacroAssemblerARM::convertFloatToDouble): + (JSC::MacroAssemblerARM::convertDoubleToFloat): + (JSC::MacroAssemblerARM::branchDouble): + (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32): + (JSC::MacroAssemblerARM::branchTruncateDoubleToUint32): + (JSC::MacroAssemblerARM::truncateDoubleToInt32): + (JSC::MacroAssemblerARM::truncateDoubleToUint32): + (JSC::MacroAssemblerARM::branchConvertDoubleToInt32): + (JSC::MacroAssemblerARM::branchDoubleNonZero): + (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN): + +2012-08-13 Simon Hausmann + + Unreviewed, rolling out r125444. + http://trac.webkit.org/changeset/125444 + https://bugs.webkit.org/show_bug.cgi?id=93872 + + Broke some tests + + * Target.pri: + +2012-08-13 Simon Hausmann + + [Qt] Replace use of internal Weak smart pointer with JSWeakObjectMap + https://bugs.webkit.org/show_bug.cgi?id=93872 + + Reviewed by Kenneth Rohde Christiansen. + + * Target.pri: Add missing JSWeakObjectMap file to build. + +2012-08-13 Raphael Kubo da Costa + + [CMake] Remove glib-related Find modules and write single new one instead. + https://bugs.webkit.org/show_bug.cgi?id=93786 + + Reviewed by Rob Buis. + + * shell/PlatformEfl.cmake: Use GLIB_* instead of Glib_*. + +2012-08-12 Allan Sandfeld Jensen + + Doesn't build with ENABLE_JIT=0 + https://bugs.webkit.org/show_bug.cgi?id=85042 + + Reviewed by Eric Seidel. + + Include headers without which CallFrame.h does not build, and + fix gcc warning about comparing unsigned int with 0. + + * dfg/DFGDriver.cpp: + * interpreter/Interpreter.cpp: + (JSC::Interpreter::isOpcode): + +2012-08-10 Yong Li + + [BlackBerry] GCActivityCallback should always schedule GC even allocated bytes is a small number + https://bugs.webkit.org/show_bug.cgi?id=93650 + + Reviewed by Rob Buis. + + Even a small number of allocated JS objects could hold expensive resources. + + * runtime/GCActivityCallbackBlackBerry.cpp: + (JSC::DefaultGCActivityCallback::didAllocate): + +2012-08-09 Yong Li + + [QNX] Implement getCPUTime() for OS(QNX) + https://bugs.webkit.org/show_bug.cgi?id=93516 + + Reviewed by George Staikos. + + Implement getCPUTime() with CLOCK_THREAD_CPUTIME_ID so it will tell + exactly how long the current thread has spent without being impacted + by other things. + + * runtime/TimeoutChecker.cpp: + (JSC::getCPUTime): + +2012-08-08 Shane Stephens + + Compile flag for CSS Hierarchies + https://bugs.webkit.org/show_bug.cgi?id=92433 + + Reviewed by Tony Chang. + + * Configurations/FeatureDefines.xcconfig: + +2012-08-08 Benjamin Poulain + + Use char* instead of LChar* for the public interface of String construction from literals + https://bugs.webkit.org/show_bug.cgi?id=93402 + + Reviewed by Michael Saboff. + + Update JSC' Identifier to use StringImpl::createFromLiteral with a char*. + + * runtime/Identifier.cpp: + (JSC::IdentifierASCIIStringTranslator::translate): + +2012-08-08 Patrick Gansterer + + Remove ce_time.(cpp|h) from list of source files + https://bugs.webkit.org/show_bug.cgi?id=93446 + + Reviewed by Simon Hausmann. + + r125004 removed the last dependency on functions defined in ce_time.cpp. + + * Target.pri: + +2012-08-08 Patrick Gansterer + + [WIN] Use GetTimeZoneInformation() for getting the timezone name + https://bugs.webkit.org/show_bug.cgi?id=91936 + + Reviewed by Ryosuke Niwa. + + The MS CRT implementation of strftime calls the same functions in the background. + Using them directly avoids the overhead of parsing the format string and removes + the dependency on strftime() for WinCE where this function does not exist. + + * runtime/DateConversion.cpp: + (JSC::formatTime): + +2012-08-07 Gabor Ballabas + + Refactor magic numbers in the ARM port of DFG-JIT + https://bugs.webkit.org/show_bug.cgi?id=93348 + + Reviewed by Eric Seidel. + + Introduce new names for hard-coded magic numbers. + Refactor constant with confusing names to more descriptive ones. + + * assembler/ARMAssembler.cpp: + (JSC::ARMAssembler::patchConstantPoolLoad): + (JSC::ARMAssembler::getOp2): + (JSC::ARMAssembler::genInt): + (JSC::ARMAssembler::getImm): + (JSC::ARMAssembler::moveImm): + (JSC::ARMAssembler::encodeComplexImm): + (JSC::ARMAssembler::dataTransfer32): + (JSC::ARMAssembler::dataTransfer16): + (JSC::ARMAssembler::dataTransferFloat): + (JSC::ARMAssembler::executableCopy): + * assembler/ARMAssembler.h: + (JSC::ARMAssembler::emitInstruction): + (JSC::ARMAssembler::ands_r): + (JSC::ARMAssembler::eors_r): + (JSC::ARMAssembler::subs_r): + (JSC::ARMAssembler::rsbs_r): + (JSC::ARMAssembler::adds_r): + (JSC::ARMAssembler::adcs_r): + (JSC::ARMAssembler::sbcs_r): + (JSC::ARMAssembler::rscs_r): + (JSC::ARMAssembler::tst_r): + (JSC::ARMAssembler::teq_r): + (JSC::ARMAssembler::cmp_r): + (JSC::ARMAssembler::cmn_r): + (JSC::ARMAssembler::orrs_r): + (JSC::ARMAssembler::movs_r): + (JSC::ARMAssembler::bics_r): + (JSC::ARMAssembler::mvns_r): + (JSC::ARMAssembler::muls_r): + (JSC::ARMAssembler::ldr_imm): + (JSC::ARMAssembler::ldr_un_imm): + (JSC::ARMAssembler::dtr_u): + (JSC::ARMAssembler::dtr_ur): + (JSC::ARMAssembler::dtr_dr): + (JSC::ARMAssembler::dtrh_u): + (JSC::ARMAssembler::dtrh_ur): + (JSC::ARMAssembler::fdtr_u): + (JSC::ARMAssembler::push_r): + (JSC::ARMAssembler::pop_r): + (JSC::ARMAssembler::getLdrImmAddress): + (JSC::ARMAssembler::getLdrImmAddressOnPool): + (JSC::ARMAssembler::patchConstantPoolLoad): + (JSC::ARMAssembler::repatchCompact): + (JSC::ARMAssembler::replaceWithJump): + (JSC::ARMAssembler::replaceWithLoad): + (JSC::ARMAssembler::replaceWithAddressComputation): + (JSC::ARMAssembler::getOp2Byte): + (JSC::ARMAssembler::getOp2Half): + (JSC::ARMAssembler::getImm16Op2): + (JSC::ARMAssembler::placeConstantPoolBarrier): + (JSC::ARMAssembler::getConditionalField): + * assembler/MacroAssemblerARM.cpp: + (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords): + * assembler/MacroAssemblerARM.h: + (JSC::MacroAssemblerARM::and32): + (JSC::MacroAssemblerARM::branch32): + (JSC::MacroAssemblerARM::branchTest32): + (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32): + +2012-08-07 Benjamin Poulain + + Use the initialization from literal for JSC's Identifiers + https://bugs.webkit.org/show_bug.cgi?id=93193 + + Reviewed by Geoffrey Garen. + + This patches modify Identifier ot take advantage of the new initialization from literal. + + In addition to the memory savings (~600bytes per instance), this gives us a 2% speed + improvement on CommonIdentifiers on average. + + * runtime/CommonIdentifiers.cpp: + (JSC::CommonIdentifiers::CommonIdentifiers): + Null and empty strings are forbidden for literal initialization. Use the most efficient constructors + instead of a literal. + + * runtime/Identifier.cpp: + (IdentifierASCIIStringTranslator): + Rename IdentifierCStringTranslator to IdentifierASCIIStringTranslator to make the text encoding + explicit. + (JSC::IdentifierASCIIStringTranslator::hash): + (JSC::IdentifierASCIIStringTranslator::equal): + (JSC::IdentifierASCIIStringTranslator::translate): Use the fast initialization from literal. + (JSC::Identifier::add): + * runtime/Identifier.h: + (JSC::Identifier::Identifier): + +2012-08-07 Simon Hausmann + + [Qt][Win] Remove pthreads linkage + + Reviewed by Csaba Osztrogonác. + + After r124823 linkage to pthreads is not needed anymore for the Windows + build. + + * JavaScriptCore.pri: + +2012-08-07 Gabor Ballabas + + Refactor emit*Inst functions and introduce toARMWord functions in DFG-JIT's traditional ARM port + https://bugs.webkit.org/show_bug.cgi?id=93266 + + Reviewed by Csaba Osztrogonác. + + First part of a bigger refactoring issue trying to make traditional + ARM DFG-JIT port easier to read and understand. + + + * assembler/ARMAssembler.h: + (JSC::ARMAssembler::emitInstruction): + (JSC::ARMAssembler::emitDoublePrecisionInstruction): + (JSC::ARMAssembler::emitSinglePrecisionInstruction): + (JSC::ARMAssembler::and_r): + (JSC::ARMAssembler::ands_r): + (JSC::ARMAssembler::eor_r): + (JSC::ARMAssembler::eors_r): + (JSC::ARMAssembler::sub_r): + (JSC::ARMAssembler::subs_r): + (JSC::ARMAssembler::rsb_r): + (JSC::ARMAssembler::rsbs_r): + (JSC::ARMAssembler::add_r): + (JSC::ARMAssembler::adds_r): + (JSC::ARMAssembler::adc_r): + (JSC::ARMAssembler::adcs_r): + (JSC::ARMAssembler::sbc_r): + (JSC::ARMAssembler::sbcs_r): + (JSC::ARMAssembler::rsc_r): + (JSC::ARMAssembler::rscs_r): + (JSC::ARMAssembler::tst_r): + (JSC::ARMAssembler::teq_r): + (JSC::ARMAssembler::cmp_r): + (JSC::ARMAssembler::cmn_r): + (JSC::ARMAssembler::orr_r): + (JSC::ARMAssembler::orrs_r): + (JSC::ARMAssembler::mov_r): + (JSC::ARMAssembler::movw_r): + (JSC::ARMAssembler::movt_r): + (JSC::ARMAssembler::movs_r): + (JSC::ARMAssembler::bic_r): + (JSC::ARMAssembler::bics_r): + (JSC::ARMAssembler::mvn_r): + (JSC::ARMAssembler::mvns_r): + (JSC::ARMAssembler::mul_r): + (JSC::ARMAssembler::muls_r): + (JSC::ARMAssembler::mull_r): + (JSC::ARMAssembler::vmov_f64_r): + (JSC::ARMAssembler::vadd_f64_r): + (JSC::ARMAssembler::vdiv_f64_r): + (JSC::ARMAssembler::vsub_f64_r): + (JSC::ARMAssembler::vmul_f64_r): + (JSC::ARMAssembler::vcmp_f64_r): + (JSC::ARMAssembler::vsqrt_f64_r): + (JSC::ARMAssembler::vabs_f64_r): + (JSC::ARMAssembler::vneg_f64_r): + (JSC::ARMAssembler::ldr_imm): + (JSC::ARMAssembler::ldr_un_imm): + (JSC::ARMAssembler::dtr_u): + (JSC::ARMAssembler::dtr_ur): + (JSC::ARMAssembler::dtr_d): + (JSC::ARMAssembler::dtr_dr): + (JSC::ARMAssembler::dtrh_u): + (JSC::ARMAssembler::dtrh_ur): + (JSC::ARMAssembler::dtrh_d): + (JSC::ARMAssembler::dtrh_dr): + (JSC::ARMAssembler::fdtr_u): + (JSC::ARMAssembler::fdtr_d): + (JSC::ARMAssembler::push_r): + (JSC::ARMAssembler::pop_r): + (JSC::ARMAssembler::vmov_vfp64_r): + (JSC::ARMAssembler::vmov_arm64_r): + (JSC::ARMAssembler::vmov_vfp32_r): + (JSC::ARMAssembler::vmov_arm32_r): + (JSC::ARMAssembler::vcvt_f64_s32_r): + (JSC::ARMAssembler::vcvt_s32_f64_r): + (JSC::ARMAssembler::vcvt_u32_f64_r): + (JSC::ARMAssembler::vcvt_f64_f32_r): + (JSC::ARMAssembler::vcvt_f32_f64_r): + (JSC::ARMAssembler::vmrs_apsr): + (JSC::ARMAssembler::clz_r): + (JSC::ARMAssembler::bx): + (JSC::ARMAssembler::blx): + (JSC::ARMAssembler::linkJump): + (JSC::ARMAssembler::toARMWord): + (ARMAssembler): + +2012-08-06 Patrick Gansterer + + [WIN] Remove dependency on pthread from MachineStackMarker + https://bugs.webkit.org/show_bug.cgi?id=68429 + + Reviewed by Geoffrey Garen. + + Windows has no support for calling a destructor for thread specific data. + Since we need more control over creating and deleting thread specific keys + we can not simply extend WTF::ThreadSpecific with this functionality. + + All thread specific keys created via the new API get stored in a list. + After a thread function finished we iterate over this list and call + the registered destructor for every item if needed. + + * heap/MachineStackMarker.cpp: Use the new functions instead of pthread directly. + (JSC::MachineThreads::~MachineThreads): + (JSC::MachineThreads::makeUsableFromMultipleThreads): + (JSC::MachineThreads::addCurrentThread): + * heap/MachineStackMarker.h: + (MachineThreads): + +2012-08-06 Patrick Gansterer + + Unify JSC date and time formating functions + https://bugs.webkit.org/show_bug.cgi?id=92282 + + Reviewed by Geoffrey Garen. + + Replace the existing functions for formating GregorianDateTime + with one single function. This removes some code duplications + in DatePrototype and is a preperation to fix encoding issues, + since we can add UChar* values to the resulting string now. + + * runtime/DateConstructor.cpp: + (JSC::callDate): + * runtime/DateConversion.cpp: + (JSC::formatDateTime): + * runtime/DateConversion.h: + (JSC): + * runtime/DatePrototype.cpp: + (JSC::formateDateInstance): + (JSC::dateProtoFuncToString): + (JSC::dateProtoFuncToUTCString): + (JSC::dateProtoFuncToDateString): + (JSC::dateProtoFuncToTimeString): + (JSC::dateProtoFuncToGMTString): + +2012-08-06 Carlos Garcia Campos + + Unreviewed. Fix make distcheck. + + * GNUmakefile.list.am: Add missing header file. + +2012-08-05 Peter Wang + + Web Inspector: [JSC] implement setting breakpoints by line:column + https://bugs.webkit.org/show_bug.cgi?id=53003 + + Reviewed by Geoffrey Garen. + + Add a counter to Lexer to record the column info of each Token. Add a column parameter to + op_debug, cti_op_debug, and _llint_op_debug byte-code command. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + * bytecode/Opcode.h: + (JSC): + (JSC::padOpcodeName): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::resolve): + (JSC::BytecodeGenerator::emitDebugHook): + * bytecompiler/BytecodeGenerator.h: + (BytecodeGenerator): + * bytecompiler/NodesCodegen.cpp: + (JSC::ArrayNode::toArgumentList): + (JSC::ApplyFunctionCallDotNode::emitBytecode): + (JSC::ConstStatementNode::emitBytecode): + (JSC::EmptyStatementNode::emitBytecode): + (JSC::DebuggerStatementNode::emitBytecode): + (JSC::ExprStatementNode::emitBytecode): + (JSC::VarStatementNode::emitBytecode): + (JSC::IfNode::emitBytecode): + (JSC::IfElseNode::emitBytecode): + (JSC::DoWhileNode::emitBytecode): + (JSC::WhileNode::emitBytecode): + (JSC::ForNode::emitBytecode): + (JSC::ForInNode::emitBytecode): + (JSC::ContinueNode::emitBytecode): + (JSC::BreakNode::emitBytecode): + (JSC::ReturnNode::emitBytecode): + (JSC::WithNode::emitBytecode): + (JSC::SwitchNode::emitBytecode): + (JSC::LabelNode::emitBytecode): + (JSC::ThrowNode::emitBytecode): + (JSC::TryNode::emitBytecode): + (JSC::ProgramNode::emitBytecode): + (JSC::EvalNode::emitBytecode): + (JSC::FunctionBodyNode::emitBytecode): + * debugger/Debugger.h: + * interpreter/Interpreter.cpp: + (JSC::Interpreter::unwindCallFrame): + (JSC::Interpreter::throwException): + (JSC::Interpreter::debug): + (JSC::Interpreter::privateExecute): + * interpreter/Interpreter.h: + (Interpreter): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_debug): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_debug): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * llint/LowLevelInterpreter.asm: + * parser/ASTBuilder.h: + (ASTBuilder): + (JSC::ASTBuilder::createCommaExpr): + (JSC::ASTBuilder::createLogicalNot): + (JSC::ASTBuilder::createUnaryPlus): + (JSC::ASTBuilder::createVoid): + (JSC::ASTBuilder::thisExpr): + (JSC::ASTBuilder::createResolve): + (JSC::ASTBuilder::createObjectLiteral): + (JSC::ASTBuilder::createArray): + (JSC::ASTBuilder::createNumberExpr): + (JSC::ASTBuilder::createString): + (JSC::ASTBuilder::createBoolean): + (JSC::ASTBuilder::createNull): + (JSC::ASTBuilder::createBracketAccess): + (JSC::ASTBuilder::createDotAccess): + (JSC::ASTBuilder::createRegExp): + (JSC::ASTBuilder::createNewExpr): + (JSC::ASTBuilder::createConditionalExpr): + (JSC::ASTBuilder::createAssignResolve): + (JSC::ASTBuilder::createFunctionExpr): + (JSC::ASTBuilder::createFunctionBody): + (JSC::ASTBuilder::createGetterOrSetterProperty): + (JSC::ASTBuilder::createArgumentsList): + (JSC::ASTBuilder::createPropertyList): + (JSC::ASTBuilder::createFuncDeclStatement): + (JSC::ASTBuilder::createBlockStatement): + (JSC::ASTBuilder::createExprStatement): + (JSC::ASTBuilder::createIfStatement): + (JSC::ASTBuilder::createForLoop): + (JSC::ASTBuilder::createForInLoop): + (JSC::ASTBuilder::createEmptyStatement): + (JSC::ASTBuilder::createVarStatement): + (JSC::ASTBuilder::createReturnStatement): + (JSC::ASTBuilder::createBreakStatement): + (JSC::ASTBuilder::createContinueStatement): + (JSC::ASTBuilder::createTryStatement): + (JSC::ASTBuilder::createSwitchStatement): + (JSC::ASTBuilder::createWhileStatement): + (JSC::ASTBuilder::createDoWhileStatement): + (JSC::ASTBuilder::createLabelStatement): + (JSC::ASTBuilder::createWithStatement): + (JSC::ASTBuilder::createThrowStatement): + (JSC::ASTBuilder::createDebugger): + (JSC::ASTBuilder::createConstStatement): + (JSC::ASTBuilder::appendConstDecl): + (JSC::ASTBuilder::combineCommaNodes): + (JSC::ASTBuilder::appendBinaryOperation): + (JSC::ASTBuilder::createAssignment): + (JSC::ASTBuilder::createNumber): + (JSC::ASTBuilder::makeTypeOfNode): + (JSC::ASTBuilder::makeDeleteNode): + (JSC::ASTBuilder::makeNegateNode): + (JSC::ASTBuilder::makeBitwiseNotNode): + (JSC::ASTBuilder::makeMultNode): + (JSC::ASTBuilder::makeDivNode): + (JSC::ASTBuilder::makeModNode): + (JSC::ASTBuilder::makeAddNode): + (JSC::ASTBuilder::makeSubNode): + (JSC::ASTBuilder::makeLeftShiftNode): + (JSC::ASTBuilder::makeRightShiftNode): + (JSC::ASTBuilder::makeURightShiftNode): + (JSC::ASTBuilder::makeBitOrNode): + (JSC::ASTBuilder::makeBitAndNode): + (JSC::ASTBuilder::makeBitXOrNode): + (JSC::ASTBuilder::makeFunctionCallNode): + (JSC::ASTBuilder::makeBinaryNode): + (JSC::ASTBuilder::makeAssignNode): + (JSC::ASTBuilder::makePrefixNode): + (JSC::ASTBuilder::makePostfixNode): + * parser/Lexer.cpp: + (JSC::::setCode): + (JSC::::internalShift): + (JSC::::shift): + (JSC::::lex): + * parser/Lexer.h: + (Lexer): + (JSC::Lexer::currentColumnNumber): + (JSC::::lexExpectIdentifier): + * parser/NodeConstructors.h: + (JSC::Node::Node): + (JSC::ExpressionNode::ExpressionNode): + (JSC::StatementNode::StatementNode): + (JSC::NullNode::NullNode): + (JSC::BooleanNode::BooleanNode): + (JSC::NumberNode::NumberNode): + (JSC::StringNode::StringNode): + (JSC::RegExpNode::RegExpNode): + (JSC::ThisNode::ThisNode): + (JSC::ResolveNode::ResolveNode): + (JSC::ArrayNode::ArrayNode): + (JSC::PropertyListNode::PropertyListNode): + (JSC::ObjectLiteralNode::ObjectLiteralNode): + (JSC::BracketAccessorNode::BracketAccessorNode): + (JSC::DotAccessorNode::DotAccessorNode): + (JSC::ArgumentListNode::ArgumentListNode): + (JSC::NewExprNode::NewExprNode): + (JSC::EvalFunctionCallNode::EvalFunctionCallNode): + (JSC::FunctionCallValueNode::FunctionCallValueNode): + (JSC::FunctionCallResolveNode::FunctionCallResolveNode): + (JSC::FunctionCallBracketNode::FunctionCallBracketNode): + (JSC::FunctionCallDotNode::FunctionCallDotNode): + (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode): + (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode): + (JSC::PrePostResolveNode::PrePostResolveNode): + (JSC::PostfixResolveNode::PostfixResolveNode): + (JSC::PostfixBracketNode::PostfixBracketNode): + (JSC::PostfixDotNode::PostfixDotNode): + (JSC::PostfixErrorNode::PostfixErrorNode): + (JSC::DeleteResolveNode::DeleteResolveNode): + (JSC::DeleteBracketNode::DeleteBracketNode): + (JSC::DeleteDotNode::DeleteDotNode): + (JSC::DeleteValueNode::DeleteValueNode): + (JSC::VoidNode::VoidNode): + (JSC::TypeOfResolveNode::TypeOfResolveNode): + (JSC::TypeOfValueNode::TypeOfValueNode): + (JSC::PrefixResolveNode::PrefixResolveNode): + (JSC::PrefixBracketNode::PrefixBracketNode): + (JSC::PrefixDotNode::PrefixDotNode): + (JSC::PrefixErrorNode::PrefixErrorNode): + (JSC::UnaryOpNode::UnaryOpNode): + (JSC::UnaryPlusNode::UnaryPlusNode): + (JSC::NegateNode::NegateNode): + (JSC::BitwiseNotNode::BitwiseNotNode): + (JSC::LogicalNotNode::LogicalNotNode): + (JSC::BinaryOpNode::BinaryOpNode): + (JSC::MultNode::MultNode): + (JSC::DivNode::DivNode): + (JSC::ModNode::ModNode): + (JSC::AddNode::AddNode): + (JSC::SubNode::SubNode): + (JSC::LeftShiftNode::LeftShiftNode): + (JSC::RightShiftNode::RightShiftNode): + (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode): + (JSC::LessNode::LessNode): + (JSC::GreaterNode::GreaterNode): + (JSC::LessEqNode::LessEqNode): + (JSC::GreaterEqNode::GreaterEqNode): + (JSC::ThrowableBinaryOpNode::ThrowableBinaryOpNode): + (JSC::InstanceOfNode::InstanceOfNode): + (JSC::InNode::InNode): + (JSC::EqualNode::EqualNode): + (JSC::NotEqualNode::NotEqualNode): + (JSC::StrictEqualNode::StrictEqualNode): + (JSC::NotStrictEqualNode::NotStrictEqualNode): + (JSC::BitAndNode::BitAndNode): + (JSC::BitOrNode::BitOrNode): + (JSC::BitXOrNode::BitXOrNode): + (JSC::LogicalOpNode::LogicalOpNode): + (JSC::ConditionalNode::ConditionalNode): + (JSC::ReadModifyResolveNode::ReadModifyResolveNode): + (JSC::AssignResolveNode::AssignResolveNode): + (JSC::ReadModifyBracketNode::ReadModifyBracketNode): + (JSC::AssignBracketNode::AssignBracketNode): + (JSC::AssignDotNode::AssignDotNode): + (JSC::ReadModifyDotNode::ReadModifyDotNode): + (JSC::AssignErrorNode::AssignErrorNode): + (JSC::CommaNode::CommaNode): + (JSC::ConstStatementNode::ConstStatementNode): + (JSC::EmptyStatementNode::EmptyStatementNode): + (JSC::DebuggerStatementNode::DebuggerStatementNode): + (JSC::ExprStatementNode::ExprStatementNode): + (JSC::VarStatementNode::VarStatementNode): + (JSC::IfNode::IfNode): + (JSC::IfElseNode::IfElseNode): + (JSC::DoWhileNode::DoWhileNode): + (JSC::WhileNode::WhileNode): + (JSC::ForNode::ForNode): + (JSC::ContinueNode::ContinueNode): + (JSC::BreakNode::BreakNode): + (JSC::ReturnNode::ReturnNode): + (JSC::WithNode::WithNode): + (JSC::LabelNode::LabelNode): + (JSC::ThrowNode::ThrowNode): + (JSC::TryNode::TryNode): + (JSC::FuncExprNode::FuncExprNode): + (JSC::FuncDeclNode::FuncDeclNode): + (JSC::SwitchNode::SwitchNode): + (JSC::ConstDeclNode::ConstDeclNode): + (JSC::BlockNode::BlockNode): + (JSC::ForInNode::ForInNode): + * parser/Nodes.cpp: + (JSC::StatementNode::setLoc): + (JSC): + (JSC::ScopeNode::ScopeNode): + (JSC::ProgramNode::ProgramNode): + (JSC::ProgramNode::create): + (JSC::EvalNode::EvalNode): + (JSC::EvalNode::create): + (JSC::FunctionBodyNode::FunctionBodyNode): + (JSC::FunctionBodyNode::create): + * parser/Nodes.h: + (Node): + (JSC::Node::columnNo): + (ExpressionNode): + (StatementNode): + (JSC::StatementNode::column): + (NullNode): + (BooleanNode): + (NumberNode): + (StringNode): + (RegExpNode): + (ThisNode): + (ResolveNode): + (ArrayNode): + (PropertyListNode): + (ObjectLiteralNode): + (BracketAccessorNode): + (DotAccessorNode): + (ArgumentListNode): + (NewExprNode): + (EvalFunctionCallNode): + (FunctionCallValueNode): + (FunctionCallResolveNode): + (FunctionCallBracketNode): + (FunctionCallDotNode): + (CallFunctionCallDotNode): + (ApplyFunctionCallDotNode): + (PrePostResolveNode): + (PostfixResolveNode): + (PostfixBracketNode): + (PostfixDotNode): + (PostfixErrorNode): + (DeleteResolveNode): + (DeleteBracketNode): + (DeleteDotNode): + (DeleteValueNode): + (VoidNode): + (TypeOfResolveNode): + (TypeOfValueNode): + (PrefixResolveNode): + (PrefixBracketNode): + (PrefixDotNode): + (PrefixErrorNode): + (UnaryOpNode): + (UnaryPlusNode): + (NegateNode): + (BitwiseNotNode): + (LogicalNotNode): + (BinaryOpNode): + (MultNode): + (DivNode): + (ModNode): + (AddNode): + (SubNode): + (LeftShiftNode): + (RightShiftNode): + (UnsignedRightShiftNode): + (LessNode): + (GreaterNode): + (LessEqNode): + (GreaterEqNode): + (ThrowableBinaryOpNode): + (InstanceOfNode): + (InNode): + (EqualNode): + (NotEqualNode): + (StrictEqualNode): + (NotStrictEqualNode): + (BitAndNode): + (BitOrNode): + (BitXOrNode): + (LogicalOpNode): + (ConditionalNode): + (ReadModifyResolveNode): + (AssignResolveNode): + (ReadModifyBracketNode): + (AssignBracketNode): + (AssignDotNode): + (ReadModifyDotNode): + (AssignErrorNode): + (CommaNode): + (ConstDeclNode): + (ConstStatementNode): + (BlockNode): + (EmptyStatementNode): + (DebuggerStatementNode): + (ExprStatementNode): + (VarStatementNode): + (IfNode): + (IfElseNode): + (DoWhileNode): + (WhileNode): + (ForNode): + (ForInNode): + (ContinueNode): + (BreakNode): + (ReturnNode): + (WithNode): + (LabelNode): + (ThrowNode): + (TryNode): + (ScopeNode): + (ProgramNode): + (EvalNode): + (FunctionBodyNode): + (FuncExprNode): + (FuncDeclNode): + (SwitchNode): + * parser/Parser.cpp: + (JSC::::parseSourceElements): + (JSC::::parseVarDeclaration): + (JSC::::parseConstDeclaration): + (JSC::::parseDoWhileStatement): + (JSC::::parseWhileStatement): + (JSC::::parseVarDeclarationList): + (JSC::::parseConstDeclarationList): + (JSC::::parseForStatement): + (JSC::::parseBreakStatement): + (JSC::::parseContinueStatement): + (JSC::::parseReturnStatement): + (JSC::::parseThrowStatement): + (JSC::::parseWithStatement): + (JSC::::parseSwitchStatement): + (JSC::::parseTryStatement): + (JSC::::parseDebuggerStatement): + (JSC::::parseBlockStatement): + (JSC::::parseStatement): + (JSC::::parseFunctionBody): + (JSC::::parseFunctionInfo): + (JSC::::parseFunctionDeclaration): + (JSC::::parseExpressionOrLabelStatement): + (JSC::::parseExpressionStatement): + (JSC::::parseIfStatement): + (JSC::::parseExpression): + (JSC::::parseAssignmentExpression): + (JSC::::parseConditionalExpression): + (JSC::::parseBinaryExpression): + (JSC::::parseProperty): + (JSC::::parseObjectLiteral): + (JSC::::parseStrictObjectLiteral): + (JSC::::parseArrayLiteral): + (JSC::::parsePrimaryExpression): + (JSC::::parseArguments): + (JSC::::parseMemberExpression): + (JSC::::parseUnaryExpression): + * parser/Parser.h: + (JSC::Parser::next): + (JSC::Parser::nextExpectIdentifier): + (JSC::Parser::tokenStart): + (JSC::Parser::tokenLine): + (JSC::Parser::tokenEnd): + (JSC::Parser::tokenLocation): + (Parser): + (JSC::Parser::getTokenName): + (JSC::::parse): + * parser/ParserTokens.h: + (JSC::JSTokenLocation::JSTokenLocation): + (JSTokenLocation): + (JSToken): + * parser/SourceProviderCacheItem.h: + (JSC::SourceProviderCacheItem::closeBraceToken): + * parser/SyntaxChecker.h: + (JSC::SyntaxChecker::makeFunctionCallNode): + (JSC::SyntaxChecker::createCommaExpr): + (JSC::SyntaxChecker::makeAssignNode): + (JSC::SyntaxChecker::makePrefixNode): + (JSC::SyntaxChecker::makePostfixNode): + (JSC::SyntaxChecker::makeTypeOfNode): + (JSC::SyntaxChecker::makeDeleteNode): + (JSC::SyntaxChecker::makeNegateNode): + (JSC::SyntaxChecker::makeBitwiseNotNode): + (JSC::SyntaxChecker::createLogicalNot): + (JSC::SyntaxChecker::createUnaryPlus): + (JSC::SyntaxChecker::createVoid): + (JSC::SyntaxChecker::thisExpr): + (JSC::SyntaxChecker::createResolve): + (JSC::SyntaxChecker::createObjectLiteral): + (JSC::SyntaxChecker::createArray): + (JSC::SyntaxChecker::createNumberExpr): + (JSC::SyntaxChecker::createString): + (JSC::SyntaxChecker::createBoolean): + (JSC::SyntaxChecker::createNull): + (JSC::SyntaxChecker::createBracketAccess): + (JSC::SyntaxChecker::createDotAccess): + (JSC::SyntaxChecker::createRegExp): + (JSC::SyntaxChecker::createNewExpr): + (JSC::SyntaxChecker::createConditionalExpr): + (JSC::SyntaxChecker::createAssignResolve): + (JSC::SyntaxChecker::createFunctionExpr): + (JSC::SyntaxChecker::createFunctionBody): + (JSC::SyntaxChecker::createArgumentsList): + (JSC::SyntaxChecker::createPropertyList): + (JSC::SyntaxChecker::createFuncDeclStatement): + (JSC::SyntaxChecker::createBlockStatement): + (JSC::SyntaxChecker::createExprStatement): + (JSC::SyntaxChecker::createIfStatement): + (JSC::SyntaxChecker::createForLoop): + (JSC::SyntaxChecker::createForInLoop): + (JSC::SyntaxChecker::createEmptyStatement): + (JSC::SyntaxChecker::createVarStatement): + (JSC::SyntaxChecker::createReturnStatement): + (JSC::SyntaxChecker::createBreakStatement): + (JSC::SyntaxChecker::createContinueStatement): + (JSC::SyntaxChecker::createTryStatement): + (JSC::SyntaxChecker::createSwitchStatement): + (JSC::SyntaxChecker::createWhileStatement): + (JSC::SyntaxChecker::createWithStatement): + (JSC::SyntaxChecker::createDoWhileStatement): + (JSC::SyntaxChecker::createLabelStatement): + (JSC::SyntaxChecker::createThrowStatement): + (JSC::SyntaxChecker::createDebugger): + (JSC::SyntaxChecker::createConstStatement): + (JSC::SyntaxChecker::appendConstDecl): + (JSC::SyntaxChecker::createGetterOrSetterProperty): + (JSC::SyntaxChecker::combineCommaNodes): + (JSC::SyntaxChecker::operatorStackPop): + +2012-08-03 Filip Pizlo + + Crashes in dfgBuildPutByIdList when clicking on just about anything on Google Maps + https://bugs.webkit.org/show_bug.cgi?id=92691 + + Reviewed by Mark Hahnenberg. + + The state of the stubs was changing after we determined the type (by virtue of the slow path + function that was called), since the get or put (in this case put) could cause arbitrary + side effects. Perhaps a full-blown fix would be to eliminate our reliance of the slow path + function to determine what to do, but an easier fix for now is to have the slow path give up + if its assumptions were invalidated by a side effect. + + * dfg/DFGOperations.cpp: + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + +2012-08-03 Filip Pizlo + + DFG handling of get_by_id should always inject a ForceOSRExit node if there is no prediction + https://bugs.webkit.org/show_bug.cgi?id=93162 + + Reviewed by Mark Hahnenberg. + + This simplifies the DFG IR by ensuring that all nodes that use value profiles will be preceded + by a ForceOSRExit if the value profile had no data. + + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + +2012-08-03 Filip Pizlo + + DFG::StructureCheckHoistingPhase keeps a Node& around for too long + https://bugs.webkit.org/show_bug.cgi?id=93157 + + Reviewed by Mark Hahnenberg. + + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + +2012-08-02 Patrick Gansterer + + Move getLocalTime() as static inline function to DateMath + https://bugs.webkit.org/show_bug.cgi?id=92955 + + Reviewed by Ryosuke Niwa. + + getCurrentLocalTime() and getLocalTime() has been superseded with the + GregorianDateTime class. So we can move it into DateMath.cpp as an static inline + function. This allows us to remove the dependecy on time() and localtime() + for Windows CE, where this functions require the ce_time library to work. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + +2012-08-02 Filip Pizlo + + ASSERTION FAILED: at(m_compileIndex).canExit() || m_isCheckingArgumentTypes + https://bugs.webkit.org/show_bug.cgi?id=91074 + + Reviewed by Mark Hahnenberg. + + Fixes a bug where the speculative JIT was performing an unnecessary speculation that the + CFA had proven shouldn't be performed, leading to asserts that a node should not have + exit sites. This is a debug-only assert with no release symptom - we were just emitting + a check that was not reachable. + + Also found, and fixed, a bug where structure check hoisting was slightly confusing the + CFA by inserting GetLocal's into the graph. CSE would clean the GetLocal's up, which + would make the backend happy - but the CFA would produce subtly wrong results. + + * bytecode/SpeculatedType.h: + (JSC::isOtherOrEmptySpeculation): + (JSC): + * dfg/DFGDriver.cpp: + (JSC::DFG::compile): + * dfg/DFGGraph.cpp: + (JSC::DFG::Graph::dump): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality): + (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality): + +2012-08-02 Filip Pizlo + + Unreviewed, build fix for DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE). + + * dfg/DFGStructureCheckHoistingPhase.cpp: + (JSC::DFG::StructureCheckHoistingPhase::run): + +2012-08-01 Mark Hahnenberg + + Remove all uses of ClassInfo for JSStrings in JIT code + https://bugs.webkit.org/show_bug.cgi?id=92935 + + Reviewed by Geoffrey Garen. + + This is the first step in removing our dependence on in-object ClassInfo pointers + in JIT code. Most of the changes are to check the Structure, which is unique for + JSString primitives. + + * bytecode/SpeculatedType.cpp: + (JSC::speculationFromClassInfo): + (JSC::speculationFromStructure): Changed to check the TypeInfo in the Structure + since there wasn't a JSGlobalData immediately available to grab the JSString + Structure out of. + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * jit/JITInlineMethods.h: + (JSC::JIT::emitLoadCharacterString): + * jit/JITOpcodes.cpp: + (JSC::JIT::privateCompileCTIMachineTrampolines): + (JSC::JIT::emit_op_to_primitive): + (JSC::JIT::emit_op_convert_this): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::privateCompileCTIMachineTrampolines): + (JSC::JIT::emit_op_to_primitive): + (JSC::JIT::emitSlow_op_eq): + (JSC::JIT::emitSlow_op_neq): + (JSC::JIT::compileOpStrictEq): + (JSC::JIT::emit_op_convert_this): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::stringGetByValStubGenerator): + (JSC::JIT::emitSlow_op_get_by_val): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::stringGetByValStubGenerator): + (JSC::JIT::emitSlow_op_get_by_val): + * jit/SpecializedThunkJIT.h: + (JSC::SpecializedThunkJIT::loadJSStringArgument): + * jit/ThunkGenerators.cpp: + (JSC::stringCharLoad): + (JSC::charCodeAtThunkGenerator): + (JSC::charAtThunkGenerator): + +2012-08-02 Filip Pizlo + + Unreviewed, missed a style goof in the previous patch: "NodeIndex nodeIndex" + in a method signature is painfully redundant. + + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + +2012-08-02 Filip Pizlo + + DFGSpeculativeJIT.h has too many inline method bodies + https://bugs.webkit.org/show_bug.cgi?id=92957 + + Reviewed by Antti Koivisto. + + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::speculationCheck): + (DFG): + (JSC::DFG::SpeculativeJIT::speculationWatchpoint): + (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck): + (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection): + (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution): + (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection): + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + +2012-08-01 Sheriff Bot + + Unreviewed, rolling out r124406. + http://trac.webkit.org/changeset/124406 + https://bugs.webkit.org/show_bug.cgi?id=92951 + + it set the Mac bots on fire (Requested by pizlo on #webkit). + + * bytecode/Opcode.h: + (JSC): + (JSC::padOpcodeName): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::emitDebugHook): + * bytecompiler/BytecodeGenerator.h: + (BytecodeGenerator): + * bytecompiler/NodesCodegen.cpp: + (JSC::ArrayNode::toArgumentList): + (JSC::ApplyFunctionCallDotNode::emitBytecode): + (JSC::ConditionalNode::emitBytecode): + (JSC::ConstStatementNode::emitBytecode): + (JSC::EmptyStatementNode::emitBytecode): + (JSC::DebuggerStatementNode::emitBytecode): + (JSC::ExprStatementNode::emitBytecode): + (JSC::VarStatementNode::emitBytecode): + (JSC::IfNode::emitBytecode): + (JSC::IfElseNode::emitBytecode): + (JSC::DoWhileNode::emitBytecode): + (JSC::WhileNode::emitBytecode): + (JSC::ForNode::emitBytecode): + (JSC::ForInNode::emitBytecode): + (JSC::ContinueNode::emitBytecode): + (JSC::BreakNode::emitBytecode): + (JSC::ReturnNode::emitBytecode): + (JSC::WithNode::emitBytecode): + (JSC::SwitchNode::emitBytecode): + (JSC::LabelNode::emitBytecode): + (JSC::ThrowNode::emitBytecode): + (JSC::TryNode::emitBytecode): + (JSC::ProgramNode::emitBytecode): + (JSC::EvalNode::emitBytecode): + (JSC::FunctionBodyNode::emitBytecode): + * debugger/Debugger.h: + * interpreter/Interpreter.cpp: + (JSC::Interpreter::unwindCallFrame): + (JSC::Interpreter::throwException): + (JSC::Interpreter::debug): + * interpreter/Interpreter.h: + (Interpreter): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_debug): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_debug): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * parser/ASTBuilder.h: + (ASTBuilder): + (JSC::ASTBuilder::createCommaExpr): + (JSC::ASTBuilder::createLogicalNot): + (JSC::ASTBuilder::createUnaryPlus): + (JSC::ASTBuilder::createVoid): + (JSC::ASTBuilder::thisExpr): + (JSC::ASTBuilder::createResolve): + (JSC::ASTBuilder::createObjectLiteral): + (JSC::ASTBuilder::createArray): + (JSC::ASTBuilder::createNumberExpr): + (JSC::ASTBuilder::createString): + (JSC::ASTBuilder::createBoolean): + (JSC::ASTBuilder::createNull): + (JSC::ASTBuilder::createBracketAccess): + (JSC::ASTBuilder::createDotAccess): + (JSC::ASTBuilder::createRegExp): + (JSC::ASTBuilder::createNewExpr): + (JSC::ASTBuilder::createConditionalExpr): + (JSC::ASTBuilder::createAssignResolve): + (JSC::ASTBuilder::createFunctionExpr): + (JSC::ASTBuilder::createFunctionBody): + (JSC::ASTBuilder::createGetterOrSetterProperty): + (JSC::ASTBuilder::createArgumentsList): + (JSC::ASTBuilder::createPropertyList): + (JSC::ASTBuilder::createFuncDeclStatement): + (JSC::ASTBuilder::createBlockStatement): + (JSC::ASTBuilder::createExprStatement): + (JSC::ASTBuilder::createIfStatement): + (JSC::ASTBuilder::createForLoop): + (JSC::ASTBuilder::createForInLoop): + (JSC::ASTBuilder::createEmptyStatement): + (JSC::ASTBuilder::createVarStatement): + (JSC::ASTBuilder::createReturnStatement): + (JSC::ASTBuilder::createBreakStatement): + (JSC::ASTBuilder::createContinueStatement): + (JSC::ASTBuilder::createTryStatement): + (JSC::ASTBuilder::createSwitchStatement): + (JSC::ASTBuilder::createWhileStatement): + (JSC::ASTBuilder::createDoWhileStatement): + (JSC::ASTBuilder::createLabelStatement): + (JSC::ASTBuilder::createWithStatement): + (JSC::ASTBuilder::createThrowStatement): + (JSC::ASTBuilder::createDebugger): + (JSC::ASTBuilder::createConstStatement): + (JSC::ASTBuilder::appendConstDecl): + (JSC::ASTBuilder::combineCommaNodes): + (JSC::ASTBuilder::appendBinaryOperation): + (JSC::ASTBuilder::createAssignment): + (JSC::ASTBuilder::createNumber): + (JSC::ASTBuilder::makeTypeOfNode): + (JSC::ASTBuilder::makeDeleteNode): + (JSC::ASTBuilder::makeNegateNode): + (JSC::ASTBuilder::makeBitwiseNotNode): + (JSC::ASTBuilder::makeMultNode): + (JSC::ASTBuilder::makeDivNode): + (JSC::ASTBuilder::makeModNode): + (JSC::ASTBuilder::makeAddNode): + (JSC::ASTBuilder::makeSubNode): + (JSC::ASTBuilder::makeLeftShiftNode): + (JSC::ASTBuilder::makeRightShiftNode): + (JSC::ASTBuilder::makeURightShiftNode): + (JSC::ASTBuilder::makeBitOrNode): + (JSC::ASTBuilder::makeBitAndNode): + (JSC::ASTBuilder::makeBitXOrNode): + (JSC::ASTBuilder::makeFunctionCallNode): + (JSC::ASTBuilder::makeBinaryNode): + (JSC::ASTBuilder::makeAssignNode): + (JSC::ASTBuilder::makePrefixNode): + (JSC::ASTBuilder::makePostfixNode): + * parser/Lexer.cpp: + (JSC::::setCode): + (JSC::::internalShift): + (JSC::::shift): + (JSC::::lex): + * parser/Lexer.h: + (Lexer): + (JSC::::lexExpectIdentifier): + * parser/NodeConstructors.h: + (JSC::Node::Node): + (JSC::ExpressionNode::ExpressionNode): + (JSC::StatementNode::StatementNode): + (JSC::NullNode::NullNode): + (JSC::BooleanNode::BooleanNode): + (JSC::NumberNode::NumberNode): + (JSC::StringNode::StringNode): + (JSC::RegExpNode::RegExpNode): + (JSC::ThisNode::ThisNode): + (JSC::ResolveNode::ResolveNode): + (JSC::ArrayNode::ArrayNode): + (JSC::PropertyListNode::PropertyListNode): + (JSC::ObjectLiteralNode::ObjectLiteralNode): + (JSC::BracketAccessorNode::BracketAccessorNode): + (JSC::DotAccessorNode::DotAccessorNode): + (JSC::ArgumentListNode::ArgumentListNode): + (JSC::NewExprNode::NewExprNode): + (JSC::EvalFunctionCallNode::EvalFunctionCallNode): + (JSC::FunctionCallValueNode::FunctionCallValueNode): + (JSC::FunctionCallResolveNode::FunctionCallResolveNode): + (JSC::FunctionCallBracketNode::FunctionCallBracketNode): + (JSC::FunctionCallDotNode::FunctionCallDotNode): + (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode): + (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode): + (JSC::PrePostResolveNode::PrePostResolveNode): + (JSC::PostfixResolveNode::PostfixResolveNode): + (JSC::PostfixBracketNode::PostfixBracketNode): + (JSC::PostfixDotNode::PostfixDotNode): + (JSC::PostfixErrorNode::PostfixErrorNode): + (JSC::DeleteResolveNode::DeleteResolveNode): + (JSC::DeleteBracketNode::DeleteBracketNode): + (JSC::DeleteDotNode::DeleteDotNode): + (JSC::DeleteValueNode::DeleteValueNode): + (JSC::VoidNode::VoidNode): + (JSC::TypeOfResolveNode::TypeOfResolveNode): + (JSC::TypeOfValueNode::TypeOfValueNode): + (JSC::PrefixResolveNode::PrefixResolveNode): + (JSC::PrefixBracketNode::PrefixBracketNode): + (JSC::PrefixDotNode::PrefixDotNode): + (JSC::PrefixErrorNode::PrefixErrorNode): + (JSC::UnaryOpNode::UnaryOpNode): + (JSC::UnaryPlusNode::UnaryPlusNode): + (JSC::NegateNode::NegateNode): + (JSC::BitwiseNotNode::BitwiseNotNode): + (JSC::LogicalNotNode::LogicalNotNode): + (JSC::BinaryOpNode::BinaryOpNode): + (JSC::MultNode::MultNode): + (JSC::DivNode::DivNode): + (JSC::ModNode::ModNode): + (JSC::AddNode::AddNode): + (JSC::SubNode::SubNode): + (JSC::LeftShiftNode::LeftShiftNode): + (JSC::RightShiftNode::RightShiftNode): + (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode): + (JSC::LessNode::LessNode): + (JSC::GreaterNode::GreaterNode): + (JSC::LessEqNode::LessEqNode): + (JSC::GreaterEqNode::GreaterEqNode): + (JSC::ThrowableBinaryOpNode::ThrowableBinaryOpNode): + (JSC::InstanceOfNode::InstanceOfNode): + (JSC::InNode::InNode): + (JSC::EqualNode::EqualNode): + (JSC::NotEqualNode::NotEqualNode): + (JSC::StrictEqualNode::StrictEqualNode): + (JSC::NotStrictEqualNode::NotStrictEqualNode): + (JSC::BitAndNode::BitAndNode): + (JSC::BitOrNode::BitOrNode): + (JSC::BitXOrNode::BitXOrNode): + (JSC::LogicalOpNode::LogicalOpNode): + (JSC::ConditionalNode::ConditionalNode): + (JSC::ReadModifyResolveNode::ReadModifyResolveNode): + (JSC::AssignResolveNode::AssignResolveNode): + (JSC::ReadModifyBracketNode::ReadModifyBracketNode): + (JSC::AssignBracketNode::AssignBracketNode): + (JSC::AssignDotNode::AssignDotNode): + (JSC::ReadModifyDotNode::ReadModifyDotNode): + (JSC::AssignErrorNode::AssignErrorNode): + (JSC::CommaNode::CommaNode): + (JSC::ConstStatementNode::ConstStatementNode): + (JSC::EmptyStatementNode::EmptyStatementNode): + (JSC::DebuggerStatementNode::DebuggerStatementNode): + (JSC::ExprStatementNode::ExprStatementNode): + (JSC::VarStatementNode::VarStatementNode): + (JSC::IfNode::IfNode): + (JSC::IfElseNode::IfElseNode): + (JSC::DoWhileNode::DoWhileNode): + (JSC::WhileNode::WhileNode): + (JSC::ForNode::ForNode): + (JSC::ContinueNode::ContinueNode): + (JSC::BreakNode::BreakNode): + (JSC::ReturnNode::ReturnNode): + (JSC::WithNode::WithNode): + (JSC::LabelNode::LabelNode): + (JSC::ThrowNode::ThrowNode): + (JSC::TryNode::TryNode): + (JSC::FuncExprNode::FuncExprNode): + (JSC::FuncDeclNode::FuncDeclNode): + (JSC::SwitchNode::SwitchNode): + (JSC::ConstDeclNode::ConstDeclNode): + (JSC::BlockNode::BlockNode): + (JSC::ForInNode::ForInNode): + * parser/Nodes.cpp: + (JSC): + (JSC::StatementNode::setLoc): + (JSC::ScopeNode::ScopeNode): + (JSC::ProgramNode::ProgramNode): + (JSC::ProgramNode::create): + (JSC::EvalNode::EvalNode): + (JSC::EvalNode::create): + (JSC::FunctionBodyNode::FunctionBodyNode): + (JSC::FunctionBodyNode::create): + * parser/Nodes.h: + (Node): + (ExpressionNode): + (StatementNode): + (NullNode): + (BooleanNode): + (NumberNode): + (StringNode): + (RegExpNode): + (ThisNode): + (ResolveNode): + (ArrayNode): + (PropertyListNode): + (ObjectLiteralNode): + (BracketAccessorNode): + (DotAccessorNode): + (ArgumentListNode): + (NewExprNode): + (EvalFunctionCallNode): + (FunctionCallValueNode): + (FunctionCallResolveNode): + (FunctionCallBracketNode): + (FunctionCallDotNode): + (CallFunctionCallDotNode): + (ApplyFunctionCallDotNode): + (PrePostResolveNode): + (PostfixResolveNode): + (PostfixBracketNode): + (PostfixDotNode): + (PostfixErrorNode): + (DeleteResolveNode): + (DeleteBracketNode): + (DeleteDotNode): + (DeleteValueNode): + (VoidNode): + (TypeOfResolveNode): + (TypeOfValueNode): + (PrefixResolveNode): + (PrefixBracketNode): + (PrefixDotNode): + (PrefixErrorNode): + (UnaryOpNode): + (UnaryPlusNode): + (NegateNode): + (BitwiseNotNode): + (LogicalNotNode): + (BinaryOpNode): + (MultNode): + (DivNode): + (ModNode): + (AddNode): + (SubNode): + (LeftShiftNode): + (RightShiftNode): + (UnsignedRightShiftNode): + (LessNode): + (GreaterNode): + (LessEqNode): + (GreaterEqNode): + (ThrowableBinaryOpNode): + (InstanceOfNode): + (InNode): + (EqualNode): + (NotEqualNode): + (StrictEqualNode): + (NotStrictEqualNode): + (BitAndNode): + (BitOrNode): + (BitXOrNode): + (LogicalOpNode): + (ConditionalNode): + (ReadModifyResolveNode): + (AssignResolveNode): + (ReadModifyBracketNode): + (AssignBracketNode): + (AssignDotNode): + (ReadModifyDotNode): + (AssignErrorNode): + (CommaNode): + (ConstDeclNode): + (ConstStatementNode): + (BlockNode): + (EmptyStatementNode): + (DebuggerStatementNode): + (ExprStatementNode): + (VarStatementNode): + (IfNode): + (IfElseNode): + (DoWhileNode): + (WhileNode): + (ForNode): + (ForInNode): + (ContinueNode): + (BreakNode): + (ReturnNode): + (WithNode): + (LabelNode): + (ThrowNode): + (TryNode): + (ScopeNode): + (ProgramNode): + (EvalNode): + (FunctionBodyNode): + (FuncExprNode): + (FuncDeclNode): + (SwitchNode): + * parser/Parser.cpp: + (JSC::::parseSourceElements): + (JSC::::parseVarDeclaration): + (JSC::::parseConstDeclaration): + (JSC::::parseDoWhileStatement): + (JSC::::parseWhileStatement): + (JSC::::parseVarDeclarationList): + (JSC::::parseConstDeclarationList): + (JSC::::parseForStatement): + (JSC::::parseBreakStatement): + (JSC::::parseContinueStatement): + (JSC::::parseReturnStatement): + (JSC::::parseThrowStatement): + (JSC::::parseWithStatement): + (JSC::::parseSwitchStatement): + (JSC::::parseTryStatement): + (JSC::::parseDebuggerStatement): + (JSC::::parseBlockStatement): + (JSC::::parseStatement): + (JSC::::parseFunctionBody): + (JSC::::parseFunctionInfo): + (JSC::::parseFunctionDeclaration): + (JSC::::parseExpressionOrLabelStatement): + (JSC::::parseExpressionStatement): + (JSC::::parseIfStatement): + (JSC::::parseExpression): + (JSC::::parseAssignmentExpression): + (JSC::::parseConditionalExpression): + (JSC::::parseBinaryExpression): + (JSC::::parseProperty): + (JSC::::parseObjectLiteral): + (JSC::::parseStrictObjectLiteral): + (JSC::::parseArrayLiteral): + (JSC::::parsePrimaryExpression): + (JSC::::parseArguments): + (JSC::::parseMemberExpression): + (JSC::::parseUnaryExpression): + * parser/Parser.h: + (JSC::Parser::next): + (JSC::Parser::nextExpectIdentifier): + (JSC::Parser::tokenStart): + (JSC::Parser::tokenLine): + (JSC::Parser::tokenEnd): + (JSC::Parser::getTokenName): + (JSC::::parse): + * parser/ParserTokens.h: + (JSC::JSTokenInfo::JSTokenInfo): + (JSTokenInfo): + (JSToken): + * parser/SourceProviderCacheItem.h: + (JSC::SourceProviderCacheItem::closeBraceToken): + * parser/SyntaxChecker.h: + (JSC::SyntaxChecker::makeFunctionCallNode): + (JSC::SyntaxChecker::createCommaExpr): + (JSC::SyntaxChecker::makeAssignNode): + (JSC::SyntaxChecker::makePrefixNode): + (JSC::SyntaxChecker::makePostfixNode): + (JSC::SyntaxChecker::makeTypeOfNode): + (JSC::SyntaxChecker::makeDeleteNode): + (JSC::SyntaxChecker::makeNegateNode): + (JSC::SyntaxChecker::makeBitwiseNotNode): + (JSC::SyntaxChecker::createLogicalNot): + (JSC::SyntaxChecker::createUnaryPlus): + (JSC::SyntaxChecker::createVoid): + (JSC::SyntaxChecker::thisExpr): + (JSC::SyntaxChecker::createResolve): + (JSC::SyntaxChecker::createObjectLiteral): + (JSC::SyntaxChecker::createArray): + (JSC::SyntaxChecker::createNumberExpr): + (JSC::SyntaxChecker::createString): + (JSC::SyntaxChecker::createBoolean): + (JSC::SyntaxChecker::createNull): + (JSC::SyntaxChecker::createBracketAccess): + (JSC::SyntaxChecker::createDotAccess): + (JSC::SyntaxChecker::createRegExp): + (JSC::SyntaxChecker::createNewExpr): + (JSC::SyntaxChecker::createConditionalExpr): + (JSC::SyntaxChecker::createAssignResolve): + (JSC::SyntaxChecker::createFunctionExpr): + (JSC::SyntaxChecker::createFunctionBody): + (JSC::SyntaxChecker::createArgumentsList): + (JSC::SyntaxChecker::createPropertyList): + (JSC::SyntaxChecker::createFuncDeclStatement): + (JSC::SyntaxChecker::createBlockStatement): + (JSC::SyntaxChecker::createExprStatement): + (JSC::SyntaxChecker::createIfStatement): + (JSC::SyntaxChecker::createForLoop): + (JSC::SyntaxChecker::createForInLoop): + (JSC::SyntaxChecker::createEmptyStatement): + (JSC::SyntaxChecker::createVarStatement): + (JSC::SyntaxChecker::createReturnStatement): + (JSC::SyntaxChecker::createBreakStatement): + (JSC::SyntaxChecker::createContinueStatement): + (JSC::SyntaxChecker::createTryStatement): + (JSC::SyntaxChecker::createSwitchStatement): + (JSC::SyntaxChecker::createWhileStatement): + (JSC::SyntaxChecker::createWithStatement): + (JSC::SyntaxChecker::createDoWhileStatement): + (JSC::SyntaxChecker::createLabelStatement): + (JSC::SyntaxChecker::createThrowStatement): + (JSC::SyntaxChecker::createDebugger): + (JSC::SyntaxChecker::createConstStatement): + (JSC::SyntaxChecker::appendConstDecl): + (JSC::SyntaxChecker::createGetterOrSetterProperty): + (JSC::SyntaxChecker::combineCommaNodes): + (JSC::SyntaxChecker::operatorStackPop): + +2012-08-01 Peter Wang + + Web Inspector: [JSC] implement setting breakpoints by line:column + https://bugs.webkit.org/show_bug.cgi?id=53003 + + Reviewed by Geoffrey Garen. + + Add a counter in lexer to record the column of each token. Debugger will use column info + in "Pretty Print" debug mode of Inspector. + + * bytecode/Opcode.h: + (JSC): + (JSC::padOpcodeName): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::emitDebugHook): + * bytecompiler/BytecodeGenerator.h: + (BytecodeGenerator): + * bytecompiler/NodesCodegen.cpp: + (JSC::ArrayNode::toArgumentList): + (JSC::ApplyFunctionCallDotNode::emitBytecode): + (JSC::ConditionalNode::emitBytecode): + (JSC::ConstStatementNode::emitBytecode): + (JSC::EmptyStatementNode::emitBytecode): + (JSC::DebuggerStatementNode::emitBytecode): + (JSC::ExprStatementNode::emitBytecode): + (JSC::VarStatementNode::emitBytecode): + (JSC::IfNode::emitBytecode): + (JSC::IfElseNode::emitBytecode): + (JSC::DoWhileNode::emitBytecode): + (JSC::WhileNode::emitBytecode): + (JSC::ForNode::emitBytecode): + (JSC::ForInNode::emitBytecode): + (JSC::ContinueNode::emitBytecode): + (JSC::BreakNode::emitBytecode): + (JSC::ReturnNode::emitBytecode): + (JSC::WithNode::emitBytecode): + (JSC::SwitchNode::emitBytecode): + (JSC::LabelNode::emitBytecode): + (JSC::ThrowNode::emitBytecode): + (JSC::TryNode::emitBytecode): + (JSC::ProgramNode::emitBytecode): + (JSC::EvalNode::emitBytecode): + (JSC::FunctionBodyNode::emitBytecode): + * debugger/Debugger.h: + * interpreter/Interpreter.cpp: + (JSC::Interpreter::unwindCallFrame): + (JSC::Interpreter::throwException): + (JSC::Interpreter::debug): + * interpreter/Interpreter.h: + (Interpreter): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_debug): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_debug): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * parser/ASTBuilder.h: + (ASTBuilder): + (JSC::ASTBuilder::createCommaExpr): + (JSC::ASTBuilder::createLogicalNot): + (JSC::ASTBuilder::createUnaryPlus): + (JSC::ASTBuilder::createVoid): + (JSC::ASTBuilder::thisExpr): + (JSC::ASTBuilder::createResolve): + (JSC::ASTBuilder::createObjectLiteral): + (JSC::ASTBuilder::createArray): + (JSC::ASTBuilder::createNumberExpr): + (JSC::ASTBuilder::createString): + (JSC::ASTBuilder::createBoolean): + (JSC::ASTBuilder::createNull): + (JSC::ASTBuilder::createBracketAccess): + (JSC::ASTBuilder::createDotAccess): + (JSC::ASTBuilder::createRegExp): + (JSC::ASTBuilder::createNewExpr): + (JSC::ASTBuilder::createConditionalExpr): + (JSC::ASTBuilder::createAssignResolve): + (JSC::ASTBuilder::createFunctionExpr): + (JSC::ASTBuilder::createFunctionBody): + (JSC::ASTBuilder::createGetterOrSetterProperty): + (JSC::ASTBuilder::createArgumentsList): + (JSC::ASTBuilder::createPropertyList): + (JSC::ASTBuilder::createFuncDeclStatement): + (JSC::ASTBuilder::createBlockStatement): + (JSC::ASTBuilder::createExprStatement): + (JSC::ASTBuilder::createIfStatement): + (JSC::ASTBuilder::createForLoop): + (JSC::ASTBuilder::createForInLoop): + (JSC::ASTBuilder::createEmptyStatement): + (JSC::ASTBuilder::createVarStatement): + (JSC::ASTBuilder::createReturnStatement): + (JSC::ASTBuilder::createBreakStatement): + (JSC::ASTBuilder::createContinueStatement): + (JSC::ASTBuilder::createTryStatement): + (JSC::ASTBuilder::createSwitchStatement): + (JSC::ASTBuilder::createWhileStatement): + (JSC::ASTBuilder::createDoWhileStatement): + (JSC::ASTBuilder::createLabelStatement): + (JSC::ASTBuilder::createWithStatement): + (JSC::ASTBuilder::createThrowStatement): + (JSC::ASTBuilder::createDebugger): + (JSC::ASTBuilder::createConstStatement): + (JSC::ASTBuilder::appendConstDecl): + (JSC::ASTBuilder::combineCommaNodes): + (JSC::ASTBuilder::appendBinaryOperation): + (JSC::ASTBuilder::createAssignment): + (JSC::ASTBuilder::createNumber): + (JSC::ASTBuilder::makeTypeOfNode): + (JSC::ASTBuilder::makeDeleteNode): + (JSC::ASTBuilder::makeNegateNode): + (JSC::ASTBuilder::makeBitwiseNotNode): + (JSC::ASTBuilder::makeMultNode): + (JSC::ASTBuilder::makeDivNode): + (JSC::ASTBuilder::makeModNode): + (JSC::ASTBuilder::makeAddNode): + (JSC::ASTBuilder::makeSubNode): + (JSC::ASTBuilder::makeLeftShiftNode): + (JSC::ASTBuilder::makeRightShiftNode): + (JSC::ASTBuilder::makeURightShiftNode): + (JSC::ASTBuilder::makeBitOrNode): + (JSC::ASTBuilder::makeBitAndNode): + (JSC::ASTBuilder::makeBitXOrNode): + (JSC::ASTBuilder::makeFunctionCallNode): + (JSC::ASTBuilder::makeBinaryNode): + (JSC::ASTBuilder::makeAssignNode): + (JSC::ASTBuilder::makePrefixNode): + (JSC::ASTBuilder::makePostfixNode): + * parser/Lexer.cpp: + (JSC::::setCode): + (JSC::::internalShift): + (JSC::::shift): + (JSC::::lex): + * parser/Lexer.h: + (Lexer): + (JSC::Lexer::currentColumnNumber): + (JSC::::lexExpectIdentifier): + * parser/NodeConstructors.h: + (JSC::Node::Node): + (JSC::ExpressionNode::ExpressionNode): + (JSC::StatementNode::StatementNode): + (JSC::NullNode::NullNode): + (JSC::BooleanNode::BooleanNode): + (JSC::NumberNode::NumberNode): + (JSC::StringNode::StringNode): + (JSC::RegExpNode::RegExpNode): + (JSC::ThisNode::ThisNode): + (JSC::ResolveNode::ResolveNode): + (JSC::ArrayNode::ArrayNode): + (JSC::PropertyListNode::PropertyListNode): + (JSC::ObjectLiteralNode::ObjectLiteralNode): + (JSC::BracketAccessorNode::BracketAccessorNode): + (JSC::DotAccessorNode::DotAccessorNode): + (JSC::ArgumentListNode::ArgumentListNode): + (JSC::NewExprNode::NewExprNode): + (JSC::EvalFunctionCallNode::EvalFunctionCallNode): + (JSC::FunctionCallValueNode::FunctionCallValueNode): + (JSC::FunctionCallResolveNode::FunctionCallResolveNode): + (JSC::FunctionCallBracketNode::FunctionCallBracketNode): + (JSC::FunctionCallDotNode::FunctionCallDotNode): + (JSC::CallFunctionCallDotNode::CallFunctionCallDotNode): + (JSC::ApplyFunctionCallDotNode::ApplyFunctionCallDotNode): + (JSC::PrePostResolveNode::PrePostResolveNode): + (JSC::PostfixResolveNode::PostfixResolveNode): + (JSC::PostfixBracketNode::PostfixBracketNode): + (JSC::PostfixDotNode::PostfixDotNode): + (JSC::PostfixErrorNode::PostfixErrorNode): + (JSC::DeleteResolveNode::DeleteResolveNode): + (JSC::DeleteBracketNode::DeleteBracketNode): + (JSC::DeleteDotNode::DeleteDotNode): + (JSC::DeleteValueNode::DeleteValueNode): + (JSC::VoidNode::VoidNode): + (JSC::TypeOfResolveNode::TypeOfResolveNode): + (JSC::TypeOfValueNode::TypeOfValueNode): + (JSC::PrefixResolveNode::PrefixResolveNode): + (JSC::PrefixBracketNode::PrefixBracketNode): + (JSC::PrefixDotNode::PrefixDotNode): + (JSC::PrefixErrorNode::PrefixErrorNode): + (JSC::UnaryOpNode::UnaryOpNode): + (JSC::UnaryPlusNode::UnaryPlusNode): + (JSC::NegateNode::NegateNode): + (JSC::BitwiseNotNode::BitwiseNotNode): + (JSC::LogicalNotNode::LogicalNotNode): + (JSC::BinaryOpNode::BinaryOpNode): + (JSC::MultNode::MultNode): + (JSC::DivNode::DivNode): + (JSC::ModNode::ModNode): + (JSC::AddNode::AddNode): + (JSC::SubNode::SubNode): + (JSC::LeftShiftNode::LeftShiftNode): + (JSC::RightShiftNode::RightShiftNode): + (JSC::UnsignedRightShiftNode::UnsignedRightShiftNode): + (JSC::LessNode::LessNode): + (JSC::GreaterNode::GreaterNode): + (JSC::LessEqNode::LessEqNode): + (JSC::GreaterEqNode::GreaterEqNode): + (JSC::ThrowableBinaryOpNode::ThrowableBinaryOpNode): + (JSC::InstanceOfNode::InstanceOfNode): + (JSC::InNode::InNode): + (JSC::EqualNode::EqualNode): + (JSC::NotEqualNode::NotEqualNode): + (JSC::StrictEqualNode::StrictEqualNode): + (JSC::NotStrictEqualNode::NotStrictEqualNode): + (JSC::BitAndNode::BitAndNode): + (JSC::BitOrNode::BitOrNode): + (JSC::BitXOrNode::BitXOrNode): + (JSC::LogicalOpNode::LogicalOpNode): + (JSC::ConditionalNode::ConditionalNode): + (JSC::ReadModifyResolveNode::ReadModifyResolveNode): + (JSC::AssignResolveNode::AssignResolveNode): + (JSC::ReadModifyBracketNode::ReadModifyBracketNode): + (JSC::AssignBracketNode::AssignBracketNode): + (JSC::AssignDotNode::AssignDotNode): + (JSC::ReadModifyDotNode::ReadModifyDotNode): + (JSC::AssignErrorNode::AssignErrorNode): + (JSC::CommaNode::CommaNode): + (JSC::ConstStatementNode::ConstStatementNode): + (JSC::EmptyStatementNode::EmptyStatementNode): + (JSC::DebuggerStatementNode::DebuggerStatementNode): + (JSC::ExprStatementNode::ExprStatementNode): + (JSC::VarStatementNode::VarStatementNode): + (JSC::IfNode::IfNode): + (JSC::IfElseNode::IfElseNode): + (JSC::DoWhileNode::DoWhileNode): + (JSC::WhileNode::WhileNode): + (JSC::ForNode::ForNode): + (JSC::ContinueNode::ContinueNode): + (JSC::BreakNode::BreakNode): + (JSC::ReturnNode::ReturnNode): + (JSC::WithNode::WithNode): + (JSC::LabelNode::LabelNode): + (JSC::ThrowNode::ThrowNode): + (JSC::TryNode::TryNode): + (JSC::FuncExprNode::FuncExprNode): + (JSC::FuncDeclNode::FuncDeclNode): + (JSC::SwitchNode::SwitchNode): + (JSC::ConstDeclNode::ConstDeclNode): + (JSC::BlockNode::BlockNode): + (JSC::ForInNode::ForInNode): + * parser/Nodes.cpp: + (JSC::StatementNode::setLoc): + (JSC): + (JSC::ScopeNode::ScopeNode): + (JSC::ProgramNode::ProgramNode): + (JSC::ProgramNode::create): + (JSC::EvalNode::EvalNode): + (JSC::EvalNode::create): + (JSC::FunctionBodyNode::FunctionBodyNode): + (JSC::FunctionBodyNode::create): + * parser/Nodes.h: + (Node): + (JSC::Node::columnNo): + (ExpressionNode): + (StatementNode): + (JSC::StatementNode::column): + (NullNode): + (BooleanNode): + (NumberNode): + (StringNode): + (RegExpNode): + (ThisNode): + (ResolveNode): + (ArrayNode): + (PropertyListNode): + (ObjectLiteralNode): + (BracketAccessorNode): + (DotAccessorNode): + (ArgumentListNode): + (NewExprNode): + (EvalFunctionCallNode): + (FunctionCallValueNode): + (FunctionCallResolveNode): + (FunctionCallBracketNode): + (FunctionCallDotNode): + (CallFunctionCallDotNode): + (ApplyFunctionCallDotNode): + (PrePostResolveNode): + (PostfixResolveNode): + (PostfixBracketNode): + (PostfixDotNode): + (PostfixErrorNode): + (DeleteResolveNode): + (DeleteBracketNode): + (DeleteDotNode): + (DeleteValueNode): + (VoidNode): + (TypeOfResolveNode): + (TypeOfValueNode): + (PrefixResolveNode): + (PrefixBracketNode): + (PrefixDotNode): + (PrefixErrorNode): + (UnaryOpNode): + (UnaryPlusNode): + (NegateNode): + (BitwiseNotNode): + (LogicalNotNode): + (BinaryOpNode): + (MultNode): + (DivNode): + (ModNode): + (AddNode): + (SubNode): + (LeftShiftNode): + (RightShiftNode): + (UnsignedRightShiftNode): + (LessNode): + (GreaterNode): + (LessEqNode): + (GreaterEqNode): + (ThrowableBinaryOpNode): + (InstanceOfNode): + (InNode): + (EqualNode): + (NotEqualNode): + (StrictEqualNode): + (NotStrictEqualNode): + (BitAndNode): + (BitOrNode): + (BitXOrNode): + (LogicalOpNode): + (ConditionalNode): + (ReadModifyResolveNode): + (AssignResolveNode): + (ReadModifyBracketNode): + (AssignBracketNode): + (AssignDotNode): + (ReadModifyDotNode): + (AssignErrorNode): + (CommaNode): + (ConstDeclNode): + (ConstStatementNode): + (BlockNode): + (EmptyStatementNode): + (DebuggerStatementNode): + (ExprStatementNode): + (VarStatementNode): + (IfNode): + (IfElseNode): + (DoWhileNode): + (WhileNode): + (ForNode): + (ForInNode): + (ContinueNode): + (BreakNode): + (ReturnNode): + (WithNode): + (LabelNode): + (ThrowNode): + (TryNode): + (ScopeNode): + (ProgramNode): + (EvalNode): + (FunctionBodyNode): + (FuncExprNode): + (FuncDeclNode): + (SwitchNode): + * parser/Parser.cpp: + (JSC::::parseSourceElements): + (JSC::::parseVarDeclaration): + (JSC::::parseConstDeclaration): + (JSC::::parseDoWhileStatement): + (JSC::::parseWhileStatement): + (JSC::::parseVarDeclarationList): + (JSC::::parseConstDeclarationList): + (JSC::::parseForStatement): + (JSC::::parseBreakStatement): + (JSC::::parseContinueStatement): + (JSC::::parseReturnStatement): + (JSC::::parseThrowStatement): + (JSC::::parseWithStatement): + (JSC::::parseSwitchStatement): + (JSC::::parseTryStatement): + (JSC::::parseDebuggerStatement): + (JSC::::parseBlockStatement): + (JSC::::parseStatement): + (JSC::::parseFunctionBody): + (JSC::::parseFunctionInfo): + (JSC::::parseFunctionDeclaration): + (JSC::::parseExpressionOrLabelStatement): + (JSC::::parseExpressionStatement): + (JSC::::parseIfStatement): + (JSC::::parseExpression): + (JSC::::parseAssignmentExpression): + (JSC::::parseConditionalExpression): + (JSC::::parseBinaryExpression): + (JSC::::parseProperty): + (JSC::::parseObjectLiteral): + (JSC::::parseStrictObjectLiteral): + (JSC::::parseArrayLiteral): + (JSC::::parsePrimaryExpression): + (JSC::::parseArguments): + (JSC::::parseMemberExpression): + (JSC::::parseUnaryExpression): + * parser/Parser.h: + (JSC::Parser::next): + (JSC::Parser::nextExpectIdentifier): + (JSC::Parser::tokenStart): + (JSC::Parser::tokenLine): + (JSC::Parser::tokenEnd): + (JSC::Parser::tokenLocation): + (Parser): + (JSC::Parser::getTokenName): + (JSC::::parse): + * parser/ParserTokens.h: + (JSC::JSTokenLocation::JSTokenLocation): + (JSTokenLocation): + (JSToken): + * parser/SourceProviderCacheItem.h: + (JSC::SourceProviderCacheItem::closeBraceToken): + * parser/SyntaxChecker.h: + (JSC::SyntaxChecker::makeFunctionCallNode): + (JSC::SyntaxChecker::createCommaExpr): + (JSC::SyntaxChecker::makeAssignNode): + (JSC::SyntaxChecker::makePrefixNode): + (JSC::SyntaxChecker::makePostfixNode): + (JSC::SyntaxChecker::makeTypeOfNode): + (JSC::SyntaxChecker::makeDeleteNode): + (JSC::SyntaxChecker::makeNegateNode): + (JSC::SyntaxChecker::makeBitwiseNotNode): + (JSC::SyntaxChecker::createLogicalNot): + (JSC::SyntaxChecker::createUnaryPlus): + (JSC::SyntaxChecker::createVoid): + (JSC::SyntaxChecker::thisExpr): + (JSC::SyntaxChecker::createResolve): + (JSC::SyntaxChecker::createObjectLiteral): + (JSC::SyntaxChecker::createArray): + (JSC::SyntaxChecker::createNumberExpr): + (JSC::SyntaxChecker::createString): + (JSC::SyntaxChecker::createBoolean): + (JSC::SyntaxChecker::createNull): + (JSC::SyntaxChecker::createBracketAccess): + (JSC::SyntaxChecker::createDotAccess): + (JSC::SyntaxChecker::createRegExp): + (JSC::SyntaxChecker::createNewExpr): + (JSC::SyntaxChecker::createConditionalExpr): + (JSC::SyntaxChecker::createAssignResolve): + (JSC::SyntaxChecker::createFunctionExpr): + (JSC::SyntaxChecker::createFunctionBody): + (JSC::SyntaxChecker::createArgumentsList): + (JSC::SyntaxChecker::createPropertyList): + (JSC::SyntaxChecker::createFuncDeclStatement): + (JSC::SyntaxChecker::createBlockStatement): + (JSC::SyntaxChecker::createExprStatement): + (JSC::SyntaxChecker::createIfStatement): + (JSC::SyntaxChecker::createForLoop): + (JSC::SyntaxChecker::createForInLoop): + (JSC::SyntaxChecker::createEmptyStatement): + (JSC::SyntaxChecker::createVarStatement): + (JSC::SyntaxChecker::createReturnStatement): + (JSC::SyntaxChecker::createBreakStatement): + (JSC::SyntaxChecker::createContinueStatement): + (JSC::SyntaxChecker::createTryStatement): + (JSC::SyntaxChecker::createSwitchStatement): + (JSC::SyntaxChecker::createWhileStatement): + (JSC::SyntaxChecker::createWithStatement): + (JSC::SyntaxChecker::createDoWhileStatement): + (JSC::SyntaxChecker::createLabelStatement): + (JSC::SyntaxChecker::createThrowStatement): + (JSC::SyntaxChecker::createDebugger): + (JSC::SyntaxChecker::createConstStatement): + (JSC::SyntaxChecker::appendConstDecl): + (JSC::SyntaxChecker::createGetterOrSetterProperty): + (JSC::SyntaxChecker::combineCommaNodes): + (JSC::SyntaxChecker::operatorStackPop): + +2012-08-01 Filip Pizlo + + DFG should hoist structure checks + https://bugs.webkit.org/show_bug.cgi?id=92696 + + Reviewed by Gavin Barraclough. + + This hoists structure checks in the same way that we would hoist array checks, but with added + complexity to cope with the fact that the structure of an object may change. This is handled + by performing a side effects analysis over the region in which the respective variable is + live. If a structure clobbering side effect may happen then we either hoist the structure + checks and fall back on structure transition watchpoints (if the watchpoint set is still + valid), or we avoid hoisting altogether. + + Doing this required teaching the CFA that we may have an expectation that an object has a + particular structure even after structure clobbering happens, in the sense that structure + proofs that were cobbered can be revived using watchpoints. CFA must know about this so that + OSR entry may know about it, since we cannot allow entry to happen if the variable has a + clobbered structure proof, will have a watchpoint to revive the proof, and the variable in + the baseline JIT has a completely unrelated structure. + + This is mostly performance neutral. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * bytecode/ValueRecovery.h: + (JSC::ValueRecovery::isSet): + (JSC::ValueRecovery::operator!): + (ValueRecovery): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + (JSC::DFG::AbstractState::clobberWorld): + (DFG): + (JSC::DFG::AbstractState::clobberCapturedVars): + * dfg/DFGAbstractState.h: + (AbstractState): + * dfg/DFGAbstractValue.h: + (JSC::DFG::AbstractValue::clear): + (JSC::DFG::AbstractValue::isClear): + (JSC::DFG::AbstractValue::makeTop): + (JSC::DFG::AbstractValue::isTop): + (JSC::DFG::AbstractValue::set): + (JSC::DFG::AbstractValue::operator==): + (JSC::DFG::AbstractValue::merge): + (JSC::DFG::AbstractValue::filter): + (JSC::DFG::AbstractValue::validate): + (JSC::DFG::AbstractValue::validateForEntry): + (AbstractValue): + (JSC::DFG::AbstractValue::checkConsistency): + (JSC::DFG::AbstractValue::dump): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::setLocal): + (JSC::DFG::ByteCodeParser::getArgument): + (JSC::DFG::ByteCodeParser::setArgument): + (JSC::DFG::ByteCodeParser::parseBlock): + (JSC::DFG::ByteCodeParser::fixVariableAccessSpeculations): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::checkStructureLoadElimination): + (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination): + (JSC::DFG::CSEPhase::putStructureStoreElimination): + (JSC::DFG::CSEPhase::getLocalLoadElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGDriver.cpp: + (JSC::DFG::compile): + * dfg/DFGGraph.cpp: + (JSC::DFG::Graph::dump): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::vote): + (Graph): + * dfg/DFGNode.h: + (JSC::DFG::Node::convertToStructureTransitionWatchpoint): + (Node): + (JSC::DFG::Node::hasStructureSet): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGOSREntry.cpp: + (JSC::DFG::prepareOSREntry): + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + (PredictionPropagationPhase): + (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting): + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck): + (JSC::DFG::SpeculativeJIT::speculationCheckWithConditionalDirection): + (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecutionWithConditionalDirection): + (JSC::DFG::SpeculateCellOperand::SpeculateCellOperand): + (JSC::DFG::SpeculateCellOperand::gpr): + (SpeculateCellOperand): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::fillSpeculateCell): + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::fillSpeculateCell): + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGStructureCheckHoistingPhase.cpp: Added. + (DFG): + (StructureCheckHoistingPhase): + (JSC::DFG::StructureCheckHoistingPhase::StructureCheckHoistingPhase): + (JSC::DFG::StructureCheckHoistingPhase::run): + (JSC::DFG::StructureCheckHoistingPhase::noticeStructureCheck): + (JSC::DFG::StructureCheckHoistingPhase::noticeClobber): + (JSC::DFG::StructureCheckHoistingPhase::clobber): + (CheckData): + (JSC::DFG::StructureCheckHoistingPhase::CheckData::CheckData): + (JSC::DFG::performStructureCheckHoisting): + * dfg/DFGStructureCheckHoistingPhase.h: Added. + (DFG): + * dfg/DFGVariableAccessData.h: + (VariableAccessData): + (JSC::DFG::VariableAccessData::VariableAccessData): + (JSC::DFG::VariableAccessData::mergeStructureCheckHoistingFailed): + (JSC::DFG::VariableAccessData::structureCheckHoistingFailed): + (JSC::DFG::VariableAccessData::clearVotes): + (JSC::DFG::VariableAccessData::vote): + (JSC::DFG::VariableAccessData::voteRatio): + (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote): + * runtime/Options.h: + (JSC): + +2012-08-01 Filip Pizlo + + DFG should distinguish between PutByVal's that clobber the world and ones that don't + https://bugs.webkit.org/show_bug.cgi?id=92923 + + Reviewed by Mark Hahnenberg. + + This is performance-neutral. I also confirmed that it's neutral if we make the + clobbering variant (PutByValSafe) clobber all knowledge of what is an array, + which should feed nicely into work on removing uses of ClassInfo. + + * bytecode/DFGExitProfile.h: + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::getByValLoadElimination): + (JSC::DFG::CSEPhase::checkStructureLoadElimination): + (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination): + (JSC::DFG::CSEPhase::getByOffsetLoadElimination): + (JSC::DFG::CSEPhase::putByOffsetStoreElimination): + (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination): + (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGFixupPhase.cpp: + (JSC::DFG::FixupPhase::fixupNode): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::byValIsPure): + (JSC::DFG::Graph::clobbersWorld): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-08-01 Jian Li + + Add new CSS property "-webkit-widget-region" to expose dashboard region support for other port + https://bugs.webkit.org/show_bug.cgi?id=90298 + + Reviewed by Adam Barth. + + * Configurations/FeatureDefines.xcconfig: Add ENABLE_WIDGET_REGION define. + +2012-08-01 Patrick Gansterer + + Replace WTF::getCurrentLocalTime() with GregorianDateTime::setToCurrentLocalTime() + https://bugs.webkit.org/show_bug.cgi?id=92286 + + Reviewed by Geoffrey Garen. + + Add a method to GregorianDateTime to set its values to the current locale time. + Replacing all occurrences of getCurrentLocalTime with the new function allows + us to remove getCurrentLocalTime in a next step. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + +2012-08-01 Mark Hahnenberg + + C++ code should get ClassInfo from the Structure + https://bugs.webkit.org/show_bug.cgi?id=92892 + + Reviewed by Geoffrey Garen. + + In our march to remove ClassInfo from our JSCell object headers, we can switch + C++ code over to grabbing the ClassInfo from the Structure since it is finally + safe to do so now that Structure access is safe during finalization/destruction. + The remaining JIT code changes can be done in a separate patch. + + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::callDestructor): We don't want to clear the Structure any more + since the Structure should still be valid at this point. + * heap/WeakSetInlines.h: + (JSC::WeakBlock::finalize): Ditto. + * runtime/JSCell.h: + (JSC): + * runtime/Structure.h: + (JSC::JSCell::classInfo): Move JSCell's classInfo() to Structure.h so it can be + inline. Use a different method of getting the JSCell's Structure based on + whether we're in GC_VALIDATION mode or not, since always using get() will cause + infinite recursion in GC_VALIDATION mode. + (JSC): + +2012-07-31 Mark Hahnenberg + + MarkedBlock::sweep() should sweep another block if it can't sweep a Structure block + https://bugs.webkit.org/show_bug.cgi?id=92819 + + Reviewed by Geoffrey Garen. + + If we are forced to allocate a new block for Structures because we are unable to safely + sweep our pre-existing Structure blocks, we should sweep another random block so that we + can start sweeping Structure blocks sooner. + + * heap/IncrementalSweeper.cpp: + (JSC::IncrementalSweeper::doSweep): Change to use sweepNextBlock. + (JSC): + (JSC::IncrementalSweeper::sweepNextBlock): + * heap/IncrementalSweeper.h: + (IncrementalSweeper): + * heap/MarkedAllocator.cpp: + (JSC::MarkedAllocator::tryAllocateHelper): When we can't safely sweep + our Structure blocks, call sweepNextBlock instead. + +2012-07-31 Sam Weinig + + Fix the Windows build. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + +2012-07-31 Geoffrey Garen + + Maybe fix the GCC build. + + * heap/HeapBlock.h: + (HeapBlock): Accommodate incorrect parsing in GCC. + +2012-07-31 Sam Weinig + + Stop masking 8 bits off of the visited link hash. We need all the bits! + https://bugs.webkit.org/show_bug.cgi?id=92799 + + Reviewed by Anders Carlsson. + + * runtime/Identifier.cpp: + (JSC::IdentifierCStringTranslator::hash): + (JSC::IdentifierLCharFromUCharTranslator::hash): + * runtime/Identifier.h: + (JSC::IdentifierCharBufferTranslator::hash): + Update for new function names. + +2012-07-31 Geoffrey Garen + + Maybe break the Windows build. + + Reviewed by Anders Carlsson. + + Formally objected to by Sam Weinig. + + * heap/HeapBlock.h: + (HeapBlock): Try to slightly improve this because we don't want Windows to control our lives. + +2012-07-30 Mark Hahnenberg + + Structures should be swept after all other objects + https://bugs.webkit.org/show_bug.cgi?id=92679 + + Reviewed by Filip Pizlo. + + In order to get rid of ClassInfo from our objects, we need to be able to safely get the + ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the + Structure, but currently it is not safe to do so because the order of destruction of objects + is not guaranteed to sweep objects before their corresponding Structure. We can fix this by + sweeping Structures after everything else. + + * heap/Heap.cpp: + (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures. + If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is + safe to sweep structures since we'll always do Structures last anyways due to the ordering of + MarkedSpace::forEachBlock. + (JSC): + (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now + calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out + these pointers after it has invalidated them to prevent accidental use-after-free in the sweep() + calls during lastChanceToFinalize(). + * heap/Heap.h: + (Heap): + * heap/HeapTimer.h: + (HeapTimer): + * heap/IncrementalSweeper.cpp: + (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures. + This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping + the first time. + (JSC): + (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we + make our first pass. We now null out the slots as we sweep them so that we can quickly find the + Structures during the second pass. + (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index. + (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify + the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can + assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock + iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds. + (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index. + * heap/IncrementalSweeper.h: Add declarations for new stuff. + (IncrementalSweeper): + * heap/MarkedAllocator.cpp: + (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and + if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing + the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that + will sweep some number of other blocks in place of the current block to mitigate the cost of the floating + Structure garbage. + (JSC::MarkedAllocator::addBlock): + * heap/MarkedAllocator.h: + (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no + longer valid to allocate from, so we set the current block to null. + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures + at an unsafe time. + * heap/MarkedSpace.cpp: + (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping. + (JSC): + * heap/MarkedSpace.h: + (JSC): + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown. + +2012-07-31 Geoffrey Garen + + Fix all the other builds I just broke. Maybe fix the Windows build. + + * heap/HeapBlock.h: + (HeapBlock): WTF? + +2012-07-31 Geoffrey Garen + + Maybe fix the Windows build. + + * heap/HeapBlock.h: + (HeapBlock): WTF? + +2012-07-31 Geoffrey Garen + + Maybe fix the Windows build. + + * heap/HeapBlock.h: + (HeapBlock): WTF? + +2012-07-31 Geoffrey Garen + + Removed some public data and casting from the Heap + https://bugs.webkit.org/show_bug.cgi?id=92777 + + Reviewed by Oliver Hunt. + + * heap/BlockAllocator.cpp: + (JSC::BlockAllocator::releaseFreeBlocks): + (JSC::BlockAllocator::blockFreeingThreadMain): Use the DeadBlock class + since HeapBlock is a template, and not a class, now. Call destroy() + instead of monkeying around with DeadBlock's internal data because + encapsulation is good. + + * heap/BlockAllocator.h: + (DeadBlock): Added a class to represent a dead block, since HeapBlock is + a template now, and can't be instantiated directly. + + (JSC::DeadBlock::DeadBlock): + (JSC::DeadBlock::create): + (BlockAllocator): + (JSC::BlockAllocator::allocate): + (JSC::BlockAllocator::deallocate): Use the DeadBlock class because + encapsulation is good. + + * heap/CopiedBlock.h: + (CopiedBlock::destroy): No need for a destroy() function, since we + inherit one now. + + (JSC::CopiedBlock::CopiedBlock): + (JSC::CopiedBlock::payloadEnd): + (JSC::CopiedBlock::capacity): Updated for some encapsulation inside + HeapBlock. + + * heap/CopiedSpace.cpp: + (JSC::CopiedSpace::~CopiedSpace): + (JSC::CopiedSpace::doneCopying): + (JSC::CopiedSpace::size): + (JSC::CopiedSpace::capacity): + (JSC::isBlockListPagedOut): Removed a bunch of casting. This is no longer + necessary, now that our list and its nodes have the right type. + + * heap/CopiedSpace.h: Use the right type in our data structures because + it improves clarity. + + * heap/CopiedSpaceInlineMethods.h: + (JSC::CopiedSpace::startedCopying): Use swap to avoid duplicating it. + + * heap/HeapBlock.h: + (HeapBlock): Made this a class template so we can return the right type + in linked list operations. Made our data private because encapsulation + is good. + + (JSC::HeapBlock::destroy): Since we know our type, we can also eliminate + duplicate destroy() functions in our subclasses. + + (JSC::HeapBlock::allocation): Added an accessor so we can hide our data. + By using const, this accessor prevents clients from accidentally deleting + our allocation. + + * heap/MarkedAllocator.cpp: + (JSC::MarkedAllocator::isPagedOut): + (JSC::MarkedAllocator::tryAllocateHelper): + (JSC::MarkedAllocator::removeBlock): Removed a bunch of casting. This is + no longer necessary, now that our list and its nodes have the right type. + + * heap/MarkedAllocator.h: + (MarkedAllocator): + (JSC::MarkedAllocator::reset): + (JSC::MarkedAllocator::forEachBlock): Use the right type, do less casting. + + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::destroy): Removed this function because our parent + class provides it for us now. + + (JSC::MarkedBlock::MarkedBlock): + * heap/MarkedBlock.h: + (MarkedBlock): + (JSC::MarkedBlock::capacity): Updated for encapsulation. + +2012-07-31 Filip Pizlo + + DFG OSR exit profiling has unusual oversights + https://bugs.webkit.org/show_bug.cgi?id=92728 + + Reviewed by Geoffrey Garen. + + * dfg/DFGOSRExit.cpp: + (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow): + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::speculationWatchpoint): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-07-31 Chao-ying Fu + + Add MIPS add32 function + https://bugs.webkit.org/show_bug.cgi?id=91522 + + Reviewed by Oliver Hunt. + + Add isCompactPtrAlignedAddressOffset. + Add a new version of add32 that accepts AbsoluteAddress as inputs. + + * assembler/MacroAssemblerMIPS.h: + (JSC::MacroAssemblerMIPS::isCompactPtrAlignedAddressOffset): New. + (MacroAssemblerMIPS): + (JSC::MacroAssemblerMIPS::add32): Support AbsoluteAddress as inputs. + +2012-07-30 Sheriff Bot + + Unreviewed, rolling out r124123. + http://trac.webkit.org/changeset/124123 + https://bugs.webkit.org/show_bug.cgi?id=92700 + + ASSERT crashes terminate webkit Layout tests (Requested by + msaboff on #webkit). + + * heap/Heap.cpp: + * heap/Heap.h: + (Heap): + * heap/IncrementalSweeper.cpp: + (JSC::IncrementalSweeper::doSweep): + (JSC::IncrementalSweeper::startSweeping): + (JSC::IncrementalSweeper::IncrementalSweeper): + (JSC): + * heap/IncrementalSweeper.h: + (IncrementalSweeper): + * heap/MarkedAllocator.cpp: + (JSC::MarkedAllocator::tryAllocateHelper): + (JSC::MarkedAllocator::addBlock): + * heap/MarkedAllocator.h: + (JSC::MarkedAllocator::zapFreeList): + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::sweepHelper): + * heap/MarkedSpace.cpp: + * heap/MarkedSpace.h: + (JSC::MarkedSpace::sweep): + (JSC): + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::~JSGlobalData): + +2012-07-30 Mark Hahnenberg + + Structures should be swept after all other objects + https://bugs.webkit.org/show_bug.cgi?id=92679 + + Reviewed by Filip Pizlo. + + In order to get rid of ClassInfo from our objects, we need to be able to safely get the + ClassInfo during the destruction of objects. We'd like to get the ClassInfo out of the + Structure, but currently it is not safe to do so because the order of destruction of objects + is not guaranteed to sweep objects before their corresponding Structure. We can fix this by + sweeping Structures after everything else. + + * heap/Heap.cpp: + (JSC::Heap::isSafeToSweepStructures): Add a function that checks if it is safe to sweep Structures. + If the Heap's IncrementalSweeper member is null, that means we're shutting down this VM and it is + safe to sweep structures since we'll always do Structures last anyways due to the ordering of + MarkedSpace::forEachBlock. + (JSC): + (JSC::Heap::didStartVMShutdown): Add this intermediate function to the Heap that ~JSGlobalData now + calls rather than calling the two HeapTimer objects individually. This allows the Heap to null out + these pointers after it has invalidated them to prevent accidental use-after-free in the sweep() + calls during lastChanceToFinalize(). + * heap/Heap.h: + (Heap): + * heap/HeapTimer.h: + (HeapTimer): + * heap/IncrementalSweeper.cpp: + (JSC::IncrementalSweeper::structuresCanBeSwept): Determines if it is currently safe to sweep Structures. + This decision is based on whether we have gotten to the end of the vector of blocks that need sweeping + the first time. + (JSC): + (JSC::IncrementalSweeper::doSweep): We add a second pass over the vector to sweep Structures after we + make our first pass. We now null out the slots as we sweep them so that we can quickly find the + Structures during the second pass. + (JSC::IncrementalSweeper::startSweeping): Initialize our new Structure sweeping index. + (JSC::IncrementalSweeper::willFinishSweeping): Callback that is called by MarkedSpace::sweep to notify + the IncrementalSweeper that we are going to sweep all of the remaining blocks in the Heap so it can + assume that everything is taken care of in the correct order. Since MarkedSpace::forEachBlock + iterates over the Structure blocks after all other blocks, the ordering property for sweeping Structures holds. + (JSC::IncrementalSweeper::IncrementalSweeper): Initialize Structure sweeping index. + * heap/IncrementalSweeper.h: Add declarations for new stuff. + (IncrementalSweeper): + * heap/MarkedAllocator.cpp: + (JSC::MarkedAllocator::tryAllocateHelper): We now check if the current block only contains structures and + if so and it isn't safe to sweep Structures according to the Heap, we just return early instead of doing + the normal lazy sweep. If this proves to be too much of a waste in the future we can add an extra clause that + will sweep some number of other blocks in place of the current block to mitigate the cost of the floating + Structure garbage. + (JSC::MarkedAllocator::addBlock): + * heap/MarkedAllocator.h: + (JSC::MarkedAllocator::zapFreeList): When we zap the free list in the MarkedAllocator, the current block is no + longer valid to allocate from, so we set the current block to null. + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::sweepHelper): Added a couple assertions to make sure that we weren't trying to sweep Structures + at an unsafe time. + * heap/MarkedSpace.cpp: + (JSC::MarkedSpace::sweep): Notify the IncrementalSweeper that the MarkedSpace will finish all currently remaining sweeping. + (JSC): + * heap/MarkedSpace.h: + (JSC): + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::~JSGlobalData): Call the new Heap::didStartVMShutdown. + +2012-07-29 Filip Pizlo + + PropertyNameArray::m_shouldCache is only assigned and never used + https://bugs.webkit.org/show_bug.cgi?id=92598 + + Reviewed by Dan Bernstein. + + * runtime/PropertyNameArray.h: + (JSC::PropertyNameArray::PropertyNameArray): + (PropertyNameArray): + +2012-07-29 Rik Cabanier + + Add ENABLE_CSS_COMPOSITING flag + https://bugs.webkit.org/show_bug.cgi?id=92553 + + Reviewed by Dirk Schulze. + + Adds compiler flag CSS_COMPOSITING to build systems to enable CSS blending and compositing. See spec https://dvcs.w3.org/hg/FXTF/rawfile/tip/compositing/index.html + + * Configurations/FeatureDefines.xcconfig: + +2012-07-27 Mark Hahnenberg + + Split functionality of MarkedAllocator::m_currentBlock + https://bugs.webkit.org/show_bug.cgi?id=92550 + + Reviewed by Filip Pizlo. + + MarkedAllocator::m_currentBlock serves two purposes right now; it indicates the block that is currently + being used for allocation and the beginning of the list of blocks that need to be swept. We should split + these two functionalities into two separate fields. + + * heap/MarkedAllocator.cpp: + (JSC::MarkedAllocator::tryAllocateHelper): Use m_blocksToSweep instead of m_currentBlock as the + initializer/reference of the loop. Only change m_currentBlock when we know what the result will be. + (JSC::MarkedAllocator::addBlock): When we add a new block we know that both m_blocksToSweep and + m_currentBlock are null. In order to preserve the invariant that m_currentBlock <= m_blocksToSweep, + we assign both of them to point to the new block. + (JSC::MarkedAllocator::removeBlock): We need a separate check to see if the block we're removing is + m_blocksToSweep and if so, advance it to the next block in the list. + * heap/MarkedAllocator.h: + (MarkedAllocator): Initialize m_blocksToSweep. + (JSC::MarkedAllocator::MarkedAllocator): + (JSC::MarkedAllocator::reset): We set m_blocksToSweep to be the head of our list. This function is called + at the end of a collection, so all of the blocks in our allocator need to be swept. We need to sweep a + block before we can start allocating, so m_currentBlock is set to null. We also set the freeList to + the empty FreeList to emphasize the fact that we can't start allocating until we do some sweeping. + +2012-07-27 Mark Hahnenberg + + Increase inline storage for JSFinalObjects by one + https://bugs.webkit.org/show_bug.cgi?id=92526 + + Reviewed by Geoffrey Garen. + + Now that we've removed the inheritorID from objects, we can increase our inline storage for JSFinalObjects on + 64-bit platforms by 1. + + * llint/LowLevelInterpreter.asm: Change the constant. + * runtime/PropertyOffset.h: Change the constant. + (JSC): + +2012-07-27 Jer Noble + + Support a rational time class for use by media elements. + https://bugs.webkit.org/show_bug.cgi?id=88787 + + Re-export WTF::MediaTime from JavaScriptCore. + + Reviewed by Eric Carlson. + + * JavaScriptCore.order: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + +2012-07-26 Filip Pizlo + + JSObject::reallocateStorageIfNecessary is neither used nor defined + https://bugs.webkit.org/show_bug.cgi?id=92417 + + Reviewed by Mark Rowe. + + * runtime/JSObject.h: + (JSObject): + +2012-07-26 Mark Hahnenberg + + Allocate Structures in a separate part of the Heap + https://bugs.webkit.org/show_bug.cgi?id=92420 + + Reviewed by Filip Pizlo. + + To fix our issue with destruction/finalization of Structures before their objects, we can move Structures to a separate + part of the Heap that will be swept after all other objects. This first patch will just be separating Structures + out into their own separate MarkedAllocator. Everything else will behave identically. + + * heap/Heap.h: New function to allocate Structures in the Heap. + (Heap): + (JSC): + (JSC::Heap::allocateStructure): + * heap/MarkedAllocator.cpp: Pass whether or not we're allocated Structures to the MarkedBlock. + (JSC::MarkedAllocator::allocateBlock): + * heap/MarkedAllocator.h: Add tracking for whether or not we're allocating only Structures. + (JSC::MarkedAllocator::onlyContainsStructures): + (MarkedAllocator): + (JSC::MarkedAllocator::MarkedAllocator): + (JSC::MarkedAllocator::init): + * heap/MarkedBlock.cpp: Add tracking for whether or not we're allocating only Structures. We need this to be able to + distinguish the various MarkedBlock types in MarkedSpace::allocatorFor(MarkedBlock*). + (JSC::MarkedBlock::create): + (JSC::MarkedBlock::MarkedBlock): + * heap/MarkedBlock.h: + (MarkedBlock): + (JSC::MarkedBlock::onlyContainsStructures): + (JSC): + * heap/MarkedSpace.cpp: Include the new Structure allocator in all the places that all the other allocators are used/modified. + (JSC::MarkedSpace::MarkedSpace): + (JSC::MarkedSpace::resetAllocators): + (JSC::MarkedSpace::canonicalizeCellLivenessData): + (JSC::MarkedSpace::isPagedOut): + * heap/MarkedSpace.h: Add new MarkedAllocator just for Structures. + (MarkedSpace): + (JSC::MarkedSpace::allocatorFor): + (JSC::MarkedSpace::allocateStructure): + (JSC): + (JSC::MarkedSpace::forEachBlock): + * runtime/Structure.h: Move all of the functions that call allocateCell down below the explicit template specialization + for allocateCell. The new inline specialization for allocateCell directly calls the allocateStructure() function in the + Heap. + (Structure): + (JSC::Structure): + (JSC): + (JSC::Structure::create): + (JSC::Structure::createStructure): + +2012-07-26 Filip Pizlo + + JSArray has methods that are neither used nor defined + https://bugs.webkit.org/show_bug.cgi?id=92416 + + Reviewed by Simon Fraser. + + * runtime/JSArray.h: + (JSArray): + +2012-07-26 Zoltan Herczeg + + [Qt][ARM]ARMAssembler needs buildfix afert r123417 + https://bugs.webkit.org/show_bug.cgi?id=92086 + + Reviewed by Csaba Osztrogonác. + + The ARM implementation of this should be optimized code path + is covered by a non-optimized code path. This patch fixes this, + and adds a new function which returns with the offset range. + + * assembler/ARMAssembler.h: + (JSC::ARMAssembler::readPointer): + (ARMAssembler): + (JSC::ARMAssembler::repatchInt32): + (JSC::ARMAssembler::repatchCompact): + * assembler/MacroAssemblerARM.h: + (MacroAssemblerARM): + (JSC::MacroAssemblerARM::isCompactPtrAlignedAddressOffset): + (JSC::MacroAssemblerARM::load32WithCompactAddressOffsetPatch): + +2012-07-25 Mark Hahnenberg + + Build fix for 32-bit after r123682 + + * runtime/JSObject.h: Need to pad out JSObjects on 32-bit so that they're the correct size since + we only removed one 4-byte word and we need to be 8-byte aligned. + (JSObject): + +2012-07-25 Filip Pizlo + + JSC GC object copying APIs should allow for greater flexibility + https://bugs.webkit.org/show_bug.cgi?id=92316 + + Reviewed by Mark Hahnenberg. + + It's now the case that visitChildren() methods can directly pin and allocate in new space during copying. + They can also do the copying and marking themselves. This new API is only used for JSObjects for now. + + * JavaScriptCore.xcodeproj/project.pbxproj: + * heap/MarkStack.cpp: + (JSC::SlotVisitor::allocateNewSpaceSlow): + (JSC::SlotVisitor::allocateNewSpaceOrPin): + (JSC): + (JSC::SlotVisitor::copyAndAppend): + * heap/MarkStack.h: + (MarkStack): + (JSC::MarkStack::appendUnbarrieredValue): + (JSC): + * heap/SlotVisitor.h: + * heap/SlotVisitorInlineMethods.h: Added. + (JSC): + (JSC::SlotVisitor::checkIfShouldCopyAndPinOtherwise): + (JSC::SlotVisitor::allocateNewSpace): + * runtime/JSObject.cpp: + (JSC::JSObject::visitOutOfLineStorage): + (JSC): + (JSC::JSObject::visitChildren): + (JSC::JSFinalObject::visitChildren): + * runtime/JSObject.h: + (JSObject): + +2012-07-25 Mark Hahnenberg + + Remove JSObject::m_inheritorID + https://bugs.webkit.org/show_bug.cgi?id=88378 + + Reviewed by Filip Pizlo. + + This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction), + and most objects don't need an inheritorID (this value is only used if the object is used as a prototype). + Instead use a private named value in the object's property storage. + + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): No need m_inheritorID to initialize! + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateBasicJSObject): No need m_inheritorID to initialize! + * llint/LowLevelInterpreter.asm: No need m_inheritorID to initialize! + * runtime/JSGlobalData.h: + (JSGlobalData): Added private name 'm_inheritorIDKey'. + * runtime/JSGlobalThis.cpp: + (JSC::JSGlobalThis::setUnwrappedObject): resetInheritorID is now passed a JSGlobalData&. + * runtime/JSObject.cpp: + (JSC::JSObject::visitChildren): No m_inheritorID to be marked. + (JSC::JSFinalObject::visitChildren): No m_inheritorID to be marked. + (JSC::JSObject::createInheritorID): Store the newly created inheritorID in the property map. Make sure + it's got the DontEnum attribute!! + * runtime/JSObject.h: + (JSObject): + (JSC::JSObject::resetInheritorID): Remove the inheritorID from property storage. + (JSC): + (JSC::JSObject::inheritorID): Read the inheritorID from property storage. + +2012-07-25 Caio Marcelo de Oliveira Filho + + Create a specialized pair for use in HashMap iterators + https://bugs.webkit.org/show_bug.cgi?id=92137 + + Reviewed by Ryosuke Niwa. + + Update a couple of sites that relied on the fact that "contents" of iterators were + std::pairs. + + * profiler/Profile.cpp: + (JSC): This code kept a vector of the pairs that were the "contents" of the iterators. This + is changed to use a KeyValuePair. We make use HashCount's ValueType (which represents only + the key) to get the proper key parameter for KeyValuePair. + * tools/ProfileTreeNode.h: + (ProfileTreeNode): Use HashMap::ValueType to declare the type of the contents of the hash + instead of declaring it manually. This will make use of the new KeyValuePair. + +2012-07-25 Patrick Gansterer + + REGRESSION(r123505): Date.getYear() returns the same as Date.getFullYear() + https://bugs.webkit.org/show_bug.cgi?id=92218 + + Reviewed by Csaba Osztrogonác. + + * runtime/DatePrototype.cpp: + (JSC::dateProtoFuncGetYear): Added the missing offset of 1900 to the return value. + +2012-07-24 Filip Pizlo + + REGRESSION(r123417): It made tests assert/crash on 32 bit + https://bugs.webkit.org/show_bug.cgi?id=92088 + + Reviewed by Mark Hahnenberg. + + The pointer arithmetic was wrong, because negative numbers are hard to think about. + + * dfg/DFGRepatch.cpp: + (JSC::DFG::emitPutTransitionStub): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage): + +2012-07-24 Patrick Gansterer + + Store the full year in GregorianDateTime + https://bugs.webkit.org/show_bug.cgi?id=92067 + + Reviewed by Geoffrey Garen. + + Use the full year instead of the offset from year 1900 + for the year member variable of GregorianDateTime. + + * runtime/DateConstructor.cpp: + (JSC::constructDate): + (JSC::dateUTC): + * runtime/DateConversion.cpp: + (JSC::formatDate): + (JSC::formatDateUTCVariant): + * runtime/DatePrototype.cpp: + (JSC::formatLocaleDate): + (JSC::fillStructuresUsingDateArgs): + (JSC::dateProtoFuncToISOString): + (JSC::dateProtoFuncGetFullYear): + (JSC::dateProtoFuncGetUTCFullYear): + (JSC::dateProtoFuncSetYear): + * runtime/JSDateMath.cpp: + (JSC::gregorianDateTimeToMS): + (JSC::msToGregorianDateTime): + +2012-07-24 Patrick Gansterer + + [WIN] Build fix after r123417. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + +2012-07-23 Patrick Gansterer + + Move GregorianDateTime from JSC to WTF namespace + https://bugs.webkit.org/show_bug.cgi?id=91948 + + Reviewed by Geoffrey Garen. + + Moving GregorianDateTime into the WTF namespace allows us to us to + use it in WebCore too. The new class has the same behaviour as the + old struct. Only the unused timeZone member has been removed. + + * runtime/DateConstructor.cpp: + * runtime/DateConversion.cpp: + * runtime/DateConversion.h: + * runtime/DateInstance.h: + * runtime/DatePrototype.cpp: + * runtime/JSDateMath.cpp: + * runtime/JSDateMath.h: + +2012-07-23 Filip Pizlo + + Property storage should grow in reverse address direction, to support butterflies + https://bugs.webkit.org/show_bug.cgi?id=91788 + + Reviewed by Geoffrey Garen. + + Changes property storage to grow to the left, and changes the property storage pointer to point + one 8-byte word (i.e. JSValue) to the right of the first value in the storage. + + Also improved debug support somewhat, by adding a describe() function to the jsc command-line, + and a slow mode of object access in LLInt. + + * assembler/ARMv7Assembler.h: + (JSC::ARMv7Assembler::repatchCompact): + * assembler/MacroAssemblerARMv7.h: + (MacroAssemblerARMv7): + (JSC::MacroAssemblerARMv7::isCompactPtrAlignedAddressOffset): + (JSC::MacroAssemblerARMv7::load32WithCompactAddressOffsetPatch): + * assembler/MacroAssemblerX86Common.h: + (JSC::MacroAssemblerX86Common::isCompactPtrAlignedAddressOffset): + (JSC::MacroAssemblerX86Common::repatchCompact): + * assembler/X86Assembler.h: + (JSC::X86Assembler::repatchCompact): + * bytecode/CodeBlock.cpp: + (JSC::dumpStructure): + * bytecode/GetByIdStatus.h: + (JSC::GetByIdStatus::GetByIdStatus): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGRepatch.cpp: + (JSC::DFG::tryCacheGetByID): + (JSC::DFG::emitPutTransitionStub): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage): + (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage): + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * heap/ConservativeRoots.cpp: + (JSC::ConservativeRoots::genericAddPointer): + * heap/CopiedSpace.h: + (CopiedSpace): + * heap/CopiedSpaceInlineMethods.h: + (JSC::CopiedSpace::pinIfNecessary): + (JSC): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::compileGetDirectOffset): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::compileGetDirectOffset): + * jit/JITStubs.cpp: + (JSC::JITThunks::tryCacheGetByID): + * jsc.cpp: + (GlobalObject::finishCreation): + (functionDescribe): + * llint/LLIntCommon.h: + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/JSObject.cpp: + (JSC::JSObject::visitChildren): + (JSC::JSFinalObject::visitChildren): + (JSC::JSObject::growOutOfLineStorage): + * runtime/JSObject.h: + (JSC::JSObject::getDirectLocation): + (JSC::JSObject::offsetForLocation): + * runtime/JSValue.h: + (JSValue): + * runtime/PropertyOffset.h: + (JSC::offsetInOutOfLineStorage): + +2012-07-23 Filip Pizlo + + DFG is too aggressive in performing the specific value optimization on loads + https://bugs.webkit.org/show_bug.cgi?id=92034 + + Reviewed by Mark Hahnenberg. + + This ensures that we don't do optimizations based on a structure having a specific + value, if there is no way to detect that the value is despecified. This is the + case for dictionaries, since despecifying a value in a dictionary does not lead to + a transition and so cannot be caught by either structure checks or structure + transition watchpoints. + + * bytecode/GetByIdStatus.cpp: + (JSC::GetByIdStatus::computeFromLLInt): + (JSC::GetByIdStatus::computeForChain): + (JSC::GetByIdStatus::computeFor): + * bytecode/ResolveGlobalStatus.cpp: + (JSC::computeForStructure): + +2012-07-23 Filip Pizlo + + REGRESSION(r123169): It made fast/js/dfg-inline-arguments-use-from-uninlined-code.html fail on 32 bit platforms + https://bugs.webkit.org/show_bug.cgi?id=92002 + + Reviewed by Mark Hahnenberg. + + In the process of changing the nature of local variable typing, I forgot to modify one of the places where + we glue the DFG's notion of variable prediction to the runtime's notion of variable tagging. + + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-07-23 Simon Fraser + + Part 2 of: Implement sticky positioning + https://bugs.webkit.org/show_bug.cgi?id=90046 + + Reviewed by Ojan Vafai. + + Turn on ENABLE_CSS_STICKY_POSITION. + + * Configurations/FeatureDefines.xcconfig: + +2012-07-23 Patrick Gansterer + + Move JSC::parseDate() from DateConversion to JSDateMath + https://bugs.webkit.org/show_bug.cgi?id=91982 + + Reviewed by Geoffrey Garen. + + Moveing this function into the other files removes the dependency + on JSC spcific classes in DateConversion.{cpp|h}. + + * runtime/DateConversion.cpp: + * runtime/DateConversion.h: + (JSC): + * runtime/JSDateMath.cpp: + (JSC::parseDate): + (JSC): + * runtime/JSDateMath.h: + (JSC): + +2012-07-23 Simon Fraser + + Part 1 of: Implement sticky positioning + https://bugs.webkit.org/show_bug.cgi?id=90046 + + Reviewed by Ojan Vafai. + + Add ENABLE_CSS_STICKY_POSITION, defaulting to off initially. + + Sort the ENABLE_CSS lines in the file. Make sure all the flags + are in FEATURE_DEFINES. + + * Configurations/FeatureDefines.xcconfig: + +2012-07-23 Yong Li + + [BlackBerry] Implement GCActivityCallback with platform timer + https://bugs.webkit.org/show_bug.cgi?id=90175 + + Reviewed by Rob Buis. + + Use JSLock when performing GC to avoid assertions. + + * runtime/GCActivityCallbackBlackBerry.cpp: + (JSC::DefaultGCActivityCallback::doWork): + +2012-07-23 Kent Tamura + + Rename ENABLE_METER_TAG and ENABLE_PROGRESS_TAG to ENABLE_METER_ELEMENT and ENABLE_PROGRESS_ELEMENT respectively + https://bugs.webkit.org/show_bug.cgi?id=91941 + + Reviewed by Kentaro Hara. + + A flag name for an elmement should be ENABLE_*_ELEMENT. + + * Configurations/FeatureDefines.xcconfig: + +2012-07-22 Kent Tamura + + Rename ENABLE_DETAILS to ENABLE_DETAILS_ELEMENT + https://bugs.webkit.org/show_bug.cgi?id=91928 + + Reviewed by Kentaro Hara. + + A flag name for an elmement should be ENABLE_*_ELEMENT. + + * Configurations/FeatureDefines.xcconfig: + +2012-07-21 Patrick Gansterer + + [WIN] Use GetDateFormat and GetTimeFormat instead of strftime + https://bugs.webkit.org/show_bug.cgi?id=83436 + + Reviewed by Brent Fulgham. + + The MS CRT implementation of strftime calls the same two functions. + Using them directly avoids the overhead of parsing the format string and removes + the dependency on strftime() for WinCE where this function does not exist. + + * runtime/DatePrototype.cpp: + (JSC::formatLocaleDate): + +2012-07-20 Kent Tamura + + Rename ENABLE_DATALIST to ENABLE_DATALIST_ELEMENT + https://bugs.webkit.org/show_bug.cgi?id=91846 + + Reviewed by Kentaro Hara. + + A flag name for an elmement should be ENABLE_*_ELEMENT. + + * Configurations/FeatureDefines.xcconfig: + +2012-07-20 Han Shen + + [Chromium] Compilation fails under gcc 4.7 + https://bugs.webkit.org/show_bug.cgi?id=90227 + + Reviewed by Tony Chang. + + Disable warnings about c++0x compatibility in gcc newer than 4.6. + + * JavaScriptCore.gyp/JavaScriptCore.gyp: + +2012-07-18 Filip Pizlo + + DFG cell checks should be hoisted + https://bugs.webkit.org/show_bug.cgi?id=91717 + + Reviewed by Geoffrey Garen. + + The DFG has always had the policy of hoisting array and integer checks to + the point of variable assignment. Eventually, we added doubles and booleans + to the mix. But cells should really be part of this as well, particularly + for 32-bit where accessing a known-type variable is dramatically cheaper + than accessing a variable whose types is only predicted but otherwise + unproven. + + This appears to be a definite speed-up for V8 on 32-bit, a possible speed-up + for Kraken, and a possible slow-down for V8 on 64-bit (around 0.2% if at + all). Any slow-downs can, and should, be addressed by making the hoisting + logic cognizant of variables that are never used in a manner that requires + type checks, and by sinking argument checks to the point(s) of first use. + + To make this work I had to change some OSR machinery, and special-case the + type predictions of the 'this' argument for constructors. OSR exit normally + assumes that arguments are boxed, which happens to be true because the + type prediction used for check hoisting is LUB'd with the type of the + argument that was passed in - so either the arguments are always stored to + with the full tag+payload, or if only the payload is stored then the tag + matches whatever the caller would have set. But not so with the 'this' + argument for constructors, which is not initialized by the caller. We + could make this more precise by having argument types for OSR be inferred + using similar machinery to other locals, but I figured that for this patch + I should use the surgical fix. + + * assembler/MacroAssemblerX86_64.h: + (JSC::MacroAssemblerX86_64::branchTestPtr): + (MacroAssemblerX86_64): + * assembler/X86Assembler.h: + (JSC::X86Assembler::testq_rm): + (X86Assembler): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::initialize): + (JSC::DFG::AbstractState::execute): + * dfg/DFGDriver.cpp: + (JSC::DFG::compile): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::isCreatedThisArgument): + (Graph): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::checkArgumentTypes): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGValueSource.h: + (JSC::DFG::ValueSource::forSpeculation): + +2012-07-19 Filip Pizlo + + Fast path of storage resize should be removed from property storage reallocation, since it is only useful for arrays + https://bugs.webkit.org/show_bug.cgi?id=91796 + + Reviewed by Geoffrey Garen. + + * dfg/DFGRepatch.cpp: + (JSC::DFG::emitPutTransitionStub): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage): + * runtime/JSObject.cpp: + (JSC::JSObject::growOutOfLineStorage): + +2012-07-19 Mark Lam + + Bug fixes and enhancements for OfflineASM annotation system. + https://bugs.webkit.org/show_bug.cgi?id=91690 + + Reviewed by Filip Pizlo. + + * offlineasm/armv7.rb: added default handling of Instruction lower(). + * offlineasm/asm.rb: added more support for annotations and more pretty printing. + * offlineasm/ast.rb: added more support for annotations. + * offlineasm/config.rb: added $preferredCommentStartColumn, simplified $enableInstrAnnotations. + * offlineasm/parser.rb: added more support for annotations. + * offlineasm/transform.rb: added more support for annotations. + * offlineasm/x86.rb: added default handling of Instruction lower(). + +2012-07-19 Patrick Gansterer + + [WIN] Fix compilation of JSGlobalData.h with ENABLE(DFG_JIT) + https://bugs.webkit.org/show_bug.cgi?id=91243 + + Reviewed by Geoffrey Garen. + + Disable MSVC warning 4200 "zero-sized array in struct/union" for JSC::ScratchBuffer. + + * runtime/JSGlobalData.h: + (JSC): + +2012-07-19 Mark Lam + + Fixed broken ENABLE_JIT=0 build. + https://bugs.webkit.org/show_bug.cgi?id=91725 + + Reviewed by Oliver Hunt. + + * bytecode/Watchpoint.cpp: + * heap/JITStubRoutineSet.h: + (JSC): + (JITStubRoutineSet): + (JSC::JITStubRoutineSet::JITStubRoutineSet): + (JSC::JITStubRoutineSet::~JITStubRoutineSet): + (JSC::JITStubRoutineSet::add): + (JSC::JITStubRoutineSet::clearMarks): + (JSC::JITStubRoutineSet::mark): + (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines): + (JSC::JITStubRoutineSet::traceMarkedStubRoutines): + +2012-07-19 Kristóf Kosztyó + + [Qt] Unreviewed buildfix after r123042. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::dumpRegisters): + +2012-07-18 Filip Pizlo + + DFG should emit inline code for property storage (re)allocation + https://bugs.webkit.org/show_bug.cgi?id=91597 + + Reviewed by Oliver Hunt. + + This adds two new ops to the DFG IR: AllocatePropertyStorage and + ReallocatePropertyStorage. It enables these to interact properly with + CSE so that a GetPropertyStorage on something for which we have + obviously done a (Re)AllocatePropertyStorage will result in the + GetPropertyStorage being eliminated. Other than that, the code + emitted for these ops is identical to the code we were emitting in + the corresponding PutById stub. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::putStructureStoreElimination): + (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination): + * dfg/DFGNode.h: + (JSC::DFG::Node::hasStructureTransitionData): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage): + (DFG): + (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage): + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + (SpeculativeJIT): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * runtime/Structure.cpp: + (JSC::nextOutOfLineStorageCapacity): + * runtime/Structure.h: + (JSC): + +2012-07-16 Oliver Hunt + + dumpCallFrame is broken in ToT + https://bugs.webkit.org/show_bug.cgi?id=91444 + + Reviewed by Gavin Barraclough. + + Various changes have been made to the SF calling convention, but + dumpCallFrame has not been updated to reflect these changes. + That resulted in both bogus information, as well as numerous + assertions of sadness. + + This patch makes dumpCallFrame actually work again and adds the + wonderful feature of telling you the name of the variable that a + register reflects, or what value it contains. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::nameForRegister): + A really innefficient mechanism for finding the name of a local register. + This should only ever be used by debug code so this should be okay. + * bytecode/CodeBlock.h: + (CodeBlock): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::generate): + Debug builds no longer throw away a functions symbol table, this allows + us to actually perform a register# to name mapping + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::link): + We weren't propogating the bytecode offset here leading to assertions + in debug builds when dumping bytecode of DFG compiled code. + * interpreter/Interpreter.cpp: + (JSC): + (JSC::Interpreter::dumpRegisters): + Rework to actually be correct. + (JSC::getCallerInfo): + Return the byteocde offset as well now, given we have to determine it + anyway. + (JSC::Interpreter::getStackTrace): + (JSC::Interpreter::retrieveCallerFromVMCode): + * interpreter/Interpreter.h: + (Interpreter): + * jsc.cpp: + (GlobalObject::finishCreation): + (functionDumpCallFrame): + Give debug builds of JSC a method for calling dumpCallFrame so we can + inspect a callframe without requiring us to break in a debugger. + +2012-07-18 Filip Pizlo + + DFG 32-bit PutById transition stub storage reallocation case copies the first pointer of each JSValue instead of the whole JSValue + https://bugs.webkit.org/show_bug.cgi?id=91599 + + Reviewed by Geoffrey Garen. + + * dfg/DFGRepatch.cpp: + (JSC::DFG::emitPutTransitionStub): + +2012-07-17 Filip Pizlo + + DFG 32-bit PutById transition stub passes the payload/tag arguments to a DFG operation in the wrong order + https://bugs.webkit.org/show_bug.cgi?id=91576 + + Reviewed by Gavin Barraclough. + + * dfg/DFGRepatch.cpp: + (JSC::DFG::emitPutTransitionStub): + +2012-07-17 Filip Pizlo + + [Qt] REGRESSION(r122768, r122771): They broke jquery/data.html and inspector/elements/edit-dom-actions.html + https://bugs.webkit.org/show_bug.cgi?id=91476 + + Reviewed by Mark Hahnenberg. + + The 32-bit repatching code was not correctly adapted to the new world where there may not always + be an available scratch register. Fixed it by ensuring that the scratch register we select does + not overlap with the value tag. + + * dfg/DFGRepatch.cpp: + (JSC::DFG::generateProtoChainAccessStub): + (JSC::DFG::tryCacheGetByID): + (JSC::DFG::tryBuildGetByIDList): + (JSC::DFG::emitPutReplaceStub): + +2012-07-17 Gabor Rapcsanyi + + Unreviewed buildfix from Zoltan Herczeg after 122768. + + * dfg/DFGCCallHelpers.h: + (JSC::DFG::CCallHelpers::setupArgumentsWithExecState): + (CCallHelpers): + +2012-07-17 David Barr + + Introduce ENABLE_CSS_IMAGE_ORIENTATION compile flag + https://bugs.webkit.org/show_bug.cgi?id=89055 + + Reviewed by Kent Tamura. + + The css3-images module is at candidate recommendation. + http://www.w3.org/TR/2012/CR-css3-images-20120417/#the-image-orientation + + Add a configuration option for CSS image-orientation support, disabling it by default. + + * Configurations/FeatureDefines.xcconfig: + +2012-07-16 Filip Pizlo + + Unreviewed, roll out 122790 because it broke the Windows build. I'm not + sure what to do with exported symbols that are predicated on NDEBUG. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + * bytecode/CodeBlock.cpp: + (JSC): + * bytecode/CodeBlock.h: + (CodeBlock): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::generate): + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::link): + * interpreter/Interpreter.cpp: + (JSC): + (JSC::Interpreter::dumpRegisters): + (JSC::getCallerInfo): + (JSC::Interpreter::getStackTrace): + (JSC::Interpreter::retrieveCallerFromVMCode): + * interpreter/Interpreter.h: + (Interpreter): + * jsc.cpp: + (GlobalObject::finishCreation): + +2012-07-16 Oliver Hunt + + dumpCallFrame is broken in ToT + https://bugs.webkit.org/show_bug.cgi?id=91444 + + Reviewed by Gavin Barraclough. + + Various changes have been made to the SF calling convention, but + dumpCallFrame has not been updated to reflect these changes. + That resulted in both bogus information, as well as numerous + assertions of sadness. + + This patch makes dumpCallFrame actually work again and adds the + wonderful feature of telling you the name of the variable that a + register reflects, or what value it contains. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::nameForRegister): + A really innefficient mechanism for finding the name of a local register. + This should only ever be used by debug code so this should be okay. + * bytecode/CodeBlock.h: + (CodeBlock): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::generate): + Debug builds no longer throw away a functions symbol table, this allows + us to actually perform a register# to name mapping + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::link): + We weren't propogating the bytecode offset here leading to assertions + in debug builds when dumping bytecode of DFG compiled code. + * interpreter/Interpreter.cpp: + (JSC): + (JSC::Interpreter::dumpRegisters): + Rework to actually be correct. + (JSC::getCallerInfo): + Return the byteocde offset as well now, given we have to determine it + anyway. + (JSC::Interpreter::getStackTrace): + (JSC::Interpreter::retrieveCallerFromVMCode): + * interpreter/Interpreter.h: + (Interpreter): + * jsc.cpp: + (GlobalObject::finishCreation): + (functionDumpCallFrame): + Give debug builds of JSC a method for calling dumpCallFrame so we can + inspect a callframe without requiring us to break in a debugger. + +2012-07-16 Filip Pizlo + + Unreviewed, adding forgotten files. + + * dfg/DFGRegisterSet.h: Added. + (DFG): + (RegisterSet): + (JSC::DFG::RegisterSet::RegisterSet): + (JSC::DFG::RegisterSet::asPOD): + (JSC::DFG::RegisterSet::copyInfo): + (JSC::DFG::RegisterSet::set): + (JSC::DFG::RegisterSet::setGPRByIndex): + (JSC::DFG::RegisterSet::clear): + (JSC::DFG::RegisterSet::get): + (JSC::DFG::RegisterSet::getGPRByIndex): + (JSC::DFG::RegisterSet::getFreeGPR): + (JSC::DFG::RegisterSet::setFPRByIndex): + (JSC::DFG::RegisterSet::getFPRByIndex): + (JSC::DFG::RegisterSet::setByIndex): + (JSC::DFG::RegisterSet::getByIndex): + (JSC::DFG::RegisterSet::numberOfSetGPRs): + (JSC::DFG::RegisterSet::numberOfSetFPRs): + (JSC::DFG::RegisterSet::numberOfSetRegisters): + (JSC::DFG::RegisterSet::setBit): + (JSC::DFG::RegisterSet::clearBit): + (JSC::DFG::RegisterSet::getBit): + * dfg/DFGScratchRegisterAllocator.h: Added. + (DFG): + (ScratchRegisterAllocator): + (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator): + (JSC::DFG::ScratchRegisterAllocator::lock): + (JSC::DFG::ScratchRegisterAllocator::allocateScratch): + (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR): + (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR): + (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters): + (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing): + (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping): + (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize): + (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer): + (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer): + +2012-07-15 Filip Pizlo + + DFG PutById transition should handle storage allocation, and inline it + https://bugs.webkit.org/show_bug.cgi?id=91337 + + Reviewed by Oliver Hunt. + + This enables the patching of DFG PutById to handle the out-of-line storage + allocation case. Furthermore, it inlines out-of-line storage allocation (and + reallocation) into the generated stubs. + + To do this, this patch adds the ability to store the relevant register + allocation state (i.e. the set of in-use registers) in the structure stub + info so that the stub generation code can more flexibly select scratch + registers: sometimes it needs none, sometimes one - or sometimes up to + three. Moreover, to make the stub generation register allocation simple and + maintainable, this patch introduces a reusable scratch register allocator + class. This register allocator understands that some registers are in use by + the main path code and so must be spilled as necessary, other registers are + locked for use in the stub itself and so cannot even be spilled, while still + others may be allocated for scratch purposes. A scratch register that is + used must be spilled. If a register is locked, it cannot be used as a + scratch register. If a register is used, it can be used as a scratch + register so long as it is spilled. + + This is a sub-1% speed-up on V8 and neutral elsewhere. + + * GNUmakefile.list.am: + * JavaScriptCore.xcodeproj/project.pbxproj: + * assembler/MacroAssemblerCodeRef.h: + (FunctionPtr): + (JSC::FunctionPtr::FunctionPtr): + * bytecode/StructureStubInfo.h: + * dfg/DFGCCallHelpers.h: + (JSC::DFG::CCallHelpers::setupArgumentsWithExecState): + (CCallHelpers): + * dfg/DFGGPRInfo.h: + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::link): + * dfg/DFGJITCompiler.h: + (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord): + (PropertyAccessRecord): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGRegisterBank.h: + (JSC::DFG::RegisterBank::isInUse): + (RegisterBank): + * dfg/DFGRegisterSet.h: Added. + (DFG): + (RegisterSet): + (JSC::DFG::RegisterSet::RegisterSet): + (JSC::DFG::RegisterSet::asPOD): + (JSC::DFG::RegisterSet::copyInfo): + (JSC::DFG::RegisterSet::set): + (JSC::DFG::RegisterSet::setGPRByIndex): + (JSC::DFG::RegisterSet::clear): + (JSC::DFG::RegisterSet::get): + (JSC::DFG::RegisterSet::getGPRByIndex): + (JSC::DFG::RegisterSet::getFreeGPR): + (JSC::DFG::RegisterSet::setFPRByIndex): + (JSC::DFG::RegisterSet::getFPRByIndex): + (JSC::DFG::RegisterSet::setByIndex): + (JSC::DFG::RegisterSet::getByIndex): + (JSC::DFG::RegisterSet::numberOfSetGPRs): + (JSC::DFG::RegisterSet::numberOfSetFPRs): + (JSC::DFG::RegisterSet::numberOfSetRegisters): + (JSC::DFG::RegisterSet::setBit): + (JSC::DFG::RegisterSet::clearBit): + (JSC::DFG::RegisterSet::getBit): + * dfg/DFGRepatch.cpp: + (JSC::DFG::generateProtoChainAccessStub): + (JSC::DFG::tryCacheGetByID): + (JSC::DFG::tryBuildGetByIDList): + (JSC::DFG::emitPutReplaceStub): + (JSC::DFG::emitPutTransitionStub): + (JSC::DFG::tryCachePutByID): + (JSC::DFG::tryBuildPutByIdList): + * dfg/DFGScratchRegisterAllocator.h: Added. + (DFG): + (ScratchRegisterAllocator): + (JSC::DFG::ScratchRegisterAllocator::ScratchRegisterAllocator): + (JSC::DFG::ScratchRegisterAllocator::lock): + (JSC::DFG::ScratchRegisterAllocator::allocateScratch): + (JSC::DFG::ScratchRegisterAllocator::allocateScratchGPR): + (JSC::DFG::ScratchRegisterAllocator::allocateScratchFPR): + (JSC::DFG::ScratchRegisterAllocator::didReuseRegisters): + (JSC::DFG::ScratchRegisterAllocator::preserveReusedRegistersByPushing): + (JSC::DFG::ScratchRegisterAllocator::restoreReusedRegistersByPopping): + (JSC::DFG::ScratchRegisterAllocator::desiredScratchBufferSize): + (JSC::DFG::ScratchRegisterAllocator::preserveUsedRegistersToScratchBuffer): + (JSC::DFG::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBuffer): + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + (JSC::DFG::SpeculativeJIT::usedRegisters): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::cachedGetById): + (JSC::DFG::SpeculativeJIT::cachedPutById): + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::cachedGetById): + (JSC::DFG::SpeculativeJIT::cachedPutById): + (JSC::DFG::SpeculativeJIT::compile): + * heap/CopiedAllocator.h: + (CopiedAllocator): + (JSC::CopiedAllocator::fastPathShouldSucceed): + (JSC): + +2012-07-16 Patrick Gansterer + + Add dfg switch to create_jit_stubs script + https://bugs.webkit.org/show_bug.cgi?id=91256 + + Reviewed by Geoffrey Garen. + + * create_jit_stubs: Add a switch to enable or disable the generation of + stub functions in #if ENABLE(DFG_JIT) conditions. + +2012-07-16 Gabor Rapcsanyi + + Unreviewed buildfix after r122729. Typo fix. + + * assembler/MacroAssemblerARM.h: + (JSC::MacroAssemblerARM::add32): + +2012-07-16 Gabor Rapcsanyi + + Unreviewed buildfix from Zoltan Herczeg after r122677. + Implement missing add32 function to MacroAssemblerARM. + + * assembler/MacroAssemblerARM.h: + (JSC::MacroAssemblerARM::add32): + (MacroAssemblerARM): + +2012-07-14 Filip Pizlo + + DFG PutByVal opcodes should accept more than 3 operands + https://bugs.webkit.org/show_bug.cgi?id=91332 + + Reviewed by Oliver Hunt. + + Turned PutByVal/PutByValAlias into var-arg nodes, so that we can give them + 4 or more operands in the future. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::getByValLoadElimination): + (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGFixupPhase.cpp: + (JSC::DFG::FixupPhase::fixupNode): + (JSC::DFG::FixupPhase::fixDoubleEdge): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::byValIsPure): + (JSC::DFG::Graph::varArgNumChildren): + (Graph): + (JSC::DFG::Graph::numChildren): + (JSC::DFG::Graph::varArgChild): + (JSC::DFG::Graph::child): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): + (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-07-14 Filip Pizlo + + Rationalize and optimize storage allocation + https://bugs.webkit.org/show_bug.cgi?id=91303 + + Reviewed by Oliver Hunt. + + This implements a backwards bump allocator for copied space storage + allocation, shown in pseudo-code below: + + pointer bump(size) { + pointer tmp = allocator->remaining; + tmp -= size; + if (tmp < 0) + fail; + allocator->remaining = tmp; + return allocator->payloadEnd - tmp - size; + } + + The advantage of this allocator is that it: + + - Only requires one comparison in the common case where size is known to + not be huge, and this comparison can be done by checking the sign bit + of the subtraction. + + - Can be implemented even when only one register is available. This + register is reused for both temporary storage during allocation and + for the result. + + - Preserves the behavior that memory in a block is filled in from lowest + address to highest address, which allows for a cheap reallocation fast + path. + + - Is resilient against the block used for allocation being the last one + in virtual memory, thereby otherwise leading to the risk of overflow + in the bump pointer, despite only doing one branch. + + In order to implement this allocator using the smallest possible chunk + of code, I refactored the copied space code so that all of the allocation + logic is in CopiedAllocator, and all of the state is in either + CopiedBlock or CopiedAllocator. This should make changing the allocation + fast path easier in the future. + + In order to do this, I needed to add some new assembler support, + particularly for various forms of add(address, register) and negPtr(). + + This is performance neutral. The purpose of this change is to facilitate + further inlining of storage allocation without having to reserve + additional registers or emit too much code. + + * assembler/MacroAssembler.h: + (JSC::MacroAssembler::addPtr): + (MacroAssembler): + (JSC::MacroAssembler::negPtr): + * assembler/MacroAssemblerARMv7.h: + (MacroAssemblerARMv7): + (JSC::MacroAssemblerARMv7::add32): + * assembler/MacroAssemblerX86.h: + (JSC::MacroAssemblerX86::add32): + (MacroAssemblerX86): + * assembler/MacroAssemblerX86_64.h: + (MacroAssemblerX86_64): + (JSC::MacroAssemblerX86_64::addPtr): + (JSC::MacroAssemblerX86_64::negPtr): + * assembler/X86Assembler.h: + (X86Assembler): + (JSC::X86Assembler::addl_mr): + (JSC::X86Assembler::addq_mr): + (JSC::X86Assembler::negq_r): + * heap/CopiedAllocator.h: + (CopiedAllocator): + (JSC::CopiedAllocator::isValid): + (JSC::CopiedAllocator::CopiedAllocator): + (JSC::CopiedAllocator::tryAllocate): + (JSC): + (JSC::CopiedAllocator::tryReallocate): + (JSC::CopiedAllocator::forceAllocate): + (JSC::CopiedAllocator::resetCurrentBlock): + (JSC::CopiedAllocator::setCurrentBlock): + (JSC::CopiedAllocator::currentCapacity): + * heap/CopiedBlock.h: + (CopiedBlock): + (JSC::CopiedBlock::create): + (JSC::CopiedBlock::zeroFillWilderness): + (JSC::CopiedBlock::CopiedBlock): + (JSC::CopiedBlock::payloadEnd): + (JSC): + (JSC::CopiedBlock::payloadCapacity): + (JSC::CopiedBlock::data): + (JSC::CopiedBlock::dataEnd): + (JSC::CopiedBlock::dataSize): + (JSC::CopiedBlock::wilderness): + (JSC::CopiedBlock::wildernessEnd): + (JSC::CopiedBlock::wildernessSize): + (JSC::CopiedBlock::size): + * heap/CopiedSpace.cpp: + (JSC::CopiedSpace::tryAllocateSlowCase): + (JSC::CopiedSpace::tryAllocateOversize): + (JSC::CopiedSpace::tryReallocate): + (JSC::CopiedSpace::doneFillingBlock): + (JSC::CopiedSpace::doneCopying): + * heap/CopiedSpace.h: + (CopiedSpace): + * heap/CopiedSpaceInlineMethods.h: + (JSC::CopiedSpace::startedCopying): + (JSC::CopiedSpace::allocateBlockForCopyingPhase): + (JSC::CopiedSpace::allocateBlock): + (JSC::CopiedSpace::tryAllocate): + (JSC): + * heap/MarkStack.cpp: + (JSC::SlotVisitor::startCopying): + (JSC::SlotVisitor::allocateNewSpace): + (JSC::SlotVisitor::doneCopying): + * heap/SlotVisitor.h: + (JSC::SlotVisitor::SlotVisitor): + * jit/JIT.h: + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateBasicStorage): + (JSC::JIT::emitAllocateJSArray): + +2012-07-13 Mark Lam + + OfflineASM Pretty printing and commenting enhancements. + https://bugs.webkit.org/show_bug.cgi?id=91281 + + Reviewed by Filip Pizlo. + + Added some minor pretty printing in the OfflineASM. + Also added infrastruture for adding multiple types of comments and + annotations with the ability to enable/disable them in the generated + output as desired. + + * GNUmakefile.list.am: add new file config.rb. + * llint/LLIntOfflineAsmConfig.h: + Added OFFLINE_ASM_BEGIN, OFFLINE_ASM_END, and OFFLINE_ASM_LOCAL_LABEL macros. + This will allow us to redefine these for other backends later. + * llint/LowLevelInterpreter32_64.asm: + Add a small example of instruction annotations for now. + * llint/LowLevelInterpreter64.asm: + Add a small example of instruction annotations for now. + * offlineasm/armv7.rb: Added handling of annotations. + * offlineasm/asm.rb: + Added machinery to dump the new comments and annotations. + Also added some indentations to make the output a little prettier. + * offlineasm/ast.rb: Added annotation field in class Instruction. + * offlineasm/backends.rb: + * offlineasm/config.rb: Added. + Currently only contains commenting options. This file is meant to be + a centralized place for build config values much like config.h for + JavaScriptCore. + * offlineasm/generate_offset_extractor.rb: + * offlineasm/instructions.rb: + * offlineasm/offsets.rb: + * offlineasm/opt.rb: + * offlineasm/parser.rb: Parse and record annotations. + * offlineasm/registers.rb: + * offlineasm/self_hash.rb: + * offlineasm/settings.rb: + * offlineasm/transform.rb: + * offlineasm/x86.rb: Added handling of annotations. + +2012-07-13 Filip Pizlo + + ASSERTION FAILED: use.useKind() != DoubleUse + https://bugs.webkit.org/show_bug.cgi?id=91082 + + Reviewed by Geoffrey Garen. + + The implementation of Branch() was unwisely relying on register allocation state + to decide what speculations to perform. That's never correct. + + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-07-13 Sheriff Bot + + Unreviewed, rolling out r122640. + http://trac.webkit.org/changeset/122640 + https://bugs.webkit.org/show_bug.cgi?id=91298 + + LLInt apparently does not expect to mark these (Requested by + olliej on #webkit). + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::visitStructures): + (JSC::CodeBlock::stronglyVisitStrongReferences): + +2012-07-13 Oliver Hunt + + LLInt fails to mark structures stored in the bytecode + https://bugs.webkit.org/show_bug.cgi?id=91296 + + Reviewed by Geoffrey Garen. + + LLInt stores structures in the bytecode, so we need to visit the appropriate + instructions as we would if we were running in the classic interpreter. + This requires adding additional checks for the LLInt specific opcodes, and + the lint specific variants of operand ordering. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::visitStructures): + (JSC::CodeBlock::stronglyVisitStrongReferences): + +2012-07-13 Yong Li + + [BlackBerry] Implement GCActivityCallback with platform timer + https://bugs.webkit.org/show_bug.cgi?id=90175 + + Reviewed by Rob Buis. + + Implement GCActivityCallback and HeapTimer for BlackBerry port. + + * heap/HeapTimer.cpp: + (JSC): + (JSC::HeapTimer::HeapTimer): + (JSC::HeapTimer::~HeapTimer): + (JSC::HeapTimer::timerDidFire): + (JSC::HeapTimer::synchronize): + (JSC::HeapTimer::invalidate): + (JSC::HeapTimer::didStartVMShutdown): + * heap/HeapTimer.h: + (HeapTimer): + * runtime/GCActivityCallbackBlackBerry.cpp: + (JSC): + (JSC::DefaultGCActivityCallback::doWork): + (JSC::DefaultGCActivityCallback::didAllocate): + (JSC::DefaultGCActivityCallback::willCollect): + (JSC::DefaultGCActivityCallback::cancel): + +2012-07-13 Patrick Gansterer + + [WIN] Fix compilation of DFGRepatch.cpp + https://bugs.webkit.org/show_bug.cgi?id=91241 + + Reviewed by Geoffrey Garen. + + Use intptr_t instead of uintptr_t when calling CodeLocationCommon::dataLabelPtrAtOffset(int) + to fix MSVC "unary minus operator applied to unsigned type, result still unsigned" warning. + + * dfg/DFGRepatch.cpp: + (JSC::DFG::dfgResetGetByID): + (JSC::DFG::dfgResetPutByID): + +2012-07-13 Patrick Gansterer + + Fix ARM_TRADITIONAL JIT for COMPILER(MSVC) and COMPILER(RVCT) after r121885 + https://bugs.webkit.org/show_bug.cgi?id=91238 + + Reviewed by Zoltan Herczeg. + + r121885 changed the assembler instruction only for COMPILER(GCC). + Use the same instructions for the other compilers too. + + * jit/JITStubs.cpp: + (JSC::ctiTrampoline): + (JSC::ctiTrampolineEnd): + (JSC::ctiVMThrowTrampoline): + +2012-07-12 Filip Pizlo + + DFG property access stubs should use structure transition watchpoints + https://bugs.webkit.org/show_bug.cgi?id=91135 + + Reviewed by Geoffrey Garen. + + This adds a Watchpoint subclass that will clear a structure stub (i.e. + a property access stub) when fired. The DFG stub generation code now + uses this optimization. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * bytecode/CodeBlock.cpp: + (JSC): + (JSC::CodeBlock::finalizeUnconditionally): + (JSC::CodeBlock::resetStub): + (JSC::CodeBlock::resetStubInternal): + * bytecode/CodeBlock.h: + (JSC): + (CodeBlock): + * bytecode/StructureStubClearingWatchpoint.cpp: Added. + (JSC): + (JSC::StructureStubClearingWatchpoint::~StructureStubClearingWatchpoint): + (JSC::StructureStubClearingWatchpoint::push): + (JSC::StructureStubClearingWatchpoint::fireInternal): + (JSC::WatchpointsOnStructureStubInfo::~WatchpointsOnStructureStubInfo): + (JSC::WatchpointsOnStructureStubInfo::addWatchpoint): + (JSC::WatchpointsOnStructureStubInfo::ensureReferenceAndAddWatchpoint): + * bytecode/StructureStubClearingWatchpoint.h: Added. + (JSC): + (StructureStubClearingWatchpoint): + (JSC::StructureStubClearingWatchpoint::StructureStubClearingWatchpoint): + (WatchpointsOnStructureStubInfo): + (JSC::WatchpointsOnStructureStubInfo::WatchpointsOnStructureStubInfo): + (JSC::WatchpointsOnStructureStubInfo::codeBlock): + (JSC::WatchpointsOnStructureStubInfo::stubInfo): + * bytecode/StructureStubInfo.h: + (JSC::StructureStubInfo::reset): + (JSC::StructureStubInfo::addWatchpoint): + (StructureStubInfo): + * dfg/DFGRepatch.cpp: + (JSC::DFG::addStructureTransitionCheck): + (DFG): + (JSC::DFG::generateProtoChainAccessStub): + (JSC::DFG::emitPutTransitionStub): + * jit/JumpReplacementWatchpoint.h: + +2012-07-12 Filip Pizlo + + DFG CFA may get overzealous in loops that have code that must exit + https://bugs.webkit.org/show_bug.cgi?id=91188 + + Reviewed by Gavin Barraclough. + + Ensure that if the CFA assumes that an operation must exit, then it will always exit + no matter what happens after. That's necessary to preserve soundness. + + Remove a broken fixup done by the DFG simplifier, where it was trying to say that the + variable-at-head was the first access in the second block in the merge, if the first + block did not read the variable. That's totally wrong, if the first block was in fact + doing a phantom read. I removed that fixup and instead hardened the rest of the + compiler. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::endBasicBlock): + * dfg/DFGBasicBlock.h: + (JSC::DFG::BasicBlock::BasicBlock): + (BasicBlock): + * dfg/DFGCFAPhase.cpp: + (JSC::DFG::CFAPhase::performBlockCFA): + * dfg/DFGCFGSimplificationPhase.cpp: + (JSC::DFG::CFGSimplificationPhase::mergeBlocks): + * dfg/DFGConstantFoldingPhase.cpp: + (JSC::DFG::ConstantFoldingPhase::ConstantFoldingPhase): + (JSC::DFG::ConstantFoldingPhase::run): + (ConstantFoldingPhase): + (JSC::DFG::ConstantFoldingPhase::foldConstants): + (JSC::DFG::ConstantFoldingPhase::paintUnreachableCode): + * dfg/DFGVariableEventStream.cpp: + (JSC::DFG::VariableEventStream::reconstruct): + +2012-07-12 Allan Sandfeld Jensen + + [Qt] Implement MemoryUsageSupport + https://bugs.webkit.org/show_bug.cgi?id=91094 + + Reviewed by Adam Barth. + + Compile in MemoryStatistics so we can make use of the interface. + + * Target.pri: + +2012-07-12 Csaba Osztrogonác + + Remove dead code after r122392. + https://bugs.webkit.org/show_bug.cgi?id=91049 + + Reviewed by Filip Pizlo. + + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::emitCall): + +2012-07-11 Adenilson Cavalcanti + + Build fix + remove dead code + https://bugs.webkit.org/show_bug.cgi?id=91039 + + Reviewed by Filip Pizlo. + + An unused variable was breaking compilation (thanks to warnings being treated as errors). + + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::emitCall): + +2012-07-11 Mark Rowe + + Build against the latest SDK when targeting older OS X versions. + + Reviewed by Dan Bernstein. + + The deployment target is already set to the version that we're targeting, and it's that setting + which determines which functionality from the SDK is available to us. + + * Configurations/Base.xcconfig: + +2012-07-11 Filip Pizlo + + DFG should have fast virtual calls + https://bugs.webkit.org/show_bug.cgi?id=90924 + + Reviewed by Gavin Barraclough. + + Implements virtual call support in the style of the old JIT, with the + caveat that we still use the same slow path for both InternalFunction + calls and JSFunction calls. Also rationalized the way that our + CodeOrigin indices tie into exception checks (previously it was a + strange one-to-one mapping with fairly limited assertions; now it's a + one-to-many mapping for CodeOrigins to exception checks, respectively). + I also took the opportunity to clean up + CallLinkInfo::callReturnLocation, which previously was either a Call or + a NearCall. Now it's just a NearCall. As well, exceptions during slow + path call resolution are now handled by returning an exception throwing + thunk rather than returning null. And finally, I made a few things + public that were previously private-with-lots-of-friends, because I + truly despise the thought of listing each thunk generating function as + a friend of JSValue and friends. + + * bytecode/CallLinkInfo.cpp: + (JSC::CallLinkInfo::unlink): + * bytecode/CallLinkInfo.h: + (CallLinkInfo): + * bytecode/CodeOrigin.h: + (JSC::CodeOrigin::CodeOrigin): + (JSC::CodeOrigin::isSet): + * dfg/DFGAssemblyHelpers.h: + (JSC::DFG::AssemblyHelpers::AssemblyHelpers): + * dfg/DFGCCallHelpers.h: + (JSC::DFG::CCallHelpers::CCallHelpers): + * dfg/DFGGPRInfo.h: + (GPRInfo): + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::link): + (JSC::DFG::JITCompiler::compileFunction): + * dfg/DFGJITCompiler.h: + (JSC::DFG::CallBeginToken::CallBeginToken): + (JSC::DFG::CallBeginToken::~CallBeginToken): + (CallBeginToken): + (JSC::DFG::CallBeginToken::set): + (JSC::DFG::CallBeginToken::registerWithExceptionCheck): + (JSC::DFG::CallBeginToken::codeOrigin): + (JSC::DFG::CallExceptionRecord::CallExceptionRecord): + (CallExceptionRecord): + (JSC::DFG::JITCompiler::currentCodeOriginIndex): + (JITCompiler): + (JSC::DFG::JITCompiler::beginCall): + (JSC::DFG::JITCompiler::notifyCall): + (JSC::DFG::JITCompiler::prepareForExceptionCheck): + (JSC::DFG::JITCompiler::addExceptionCheck): + (JSC::DFG::JITCompiler::addFastExceptionCheck): + * dfg/DFGOperations.cpp: + * dfg/DFGRepatch.cpp: + (JSC::DFG::dfgLinkFor): + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheck): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::emitCall): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::emitCall): + * dfg/DFGThunks.cpp: + (JSC::DFG::emitPointerValidation): + (DFG): + (JSC::DFG::throwExceptionFromCallSlowPathGenerator): + (JSC::DFG::slowPathFor): + (JSC::DFG::linkForThunkGenerator): + (JSC::DFG::linkCallThunkGenerator): + (JSC::DFG::linkConstructThunkGenerator): + (JSC::DFG::virtualForThunkGenerator): + (JSC::DFG::virtualCallThunkGenerator): + (JSC::DFG::virtualConstructThunkGenerator): + * dfg/DFGThunks.h: + (DFG): + * jit/JIT.cpp: + (JSC::JIT::privateCompile): + (JSC::JIT::linkFor): + * runtime/Executable.h: + (ExecutableBase): + (JSC::ExecutableBase::offsetOfJITCodeFor): + (JSC::ExecutableBase::offsetOfNumParametersFor): + * runtime/JSValue.h: + (JSValue): + +2012-07-11 Filip Pizlo + + Accidentally used the wrong license (3-clause instead of 2-clause) in some + files I just committed. + + Rubber stamped by Oliver Hunt. + + * bytecode/Watchpoint.cpp: + * bytecode/Watchpoint.h: + * jit/JumpReplacementWatchpoint.cpp: + * jit/JumpReplacementWatchpoint.h: + +2012-07-11 Filip Pizlo + + Watchpoints and jump replacement should be decoupled + https://bugs.webkit.org/show_bug.cgi?id=91016 + + Reviewed by Oliver Hunt. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * assembler/AbstractMacroAssembler.h: + (JSC): + (Label): + * bytecode/CodeBlock.h: + (JSC::CodeBlock::appendWatchpoint): + (JSC::CodeBlock::watchpoint): + (DFGData): + * bytecode/Watchpoint.cpp: + (JSC): + * bytecode/Watchpoint.h: + (JSC::Watchpoint::Watchpoint): + (Watchpoint): + (JSC::Watchpoint::fire): + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::speculationWatchpoint): + * jit/JumpReplacementWatchpoint.cpp: Added. + (JSC): + (JSC::JumpReplacementWatchpoint::correctLabels): + (JSC::JumpReplacementWatchpoint::fireInternal): + * jit/JumpReplacementWatchpoint.h: Added. + (JSC): + (JumpReplacementWatchpoint): + (JSC::JumpReplacementWatchpoint::JumpReplacementWatchpoint): + (JSC::JumpReplacementWatchpoint::setDestination): + +2012-07-11 Kevin Ollivier + + [wx] Unreviewed build fix. Don't try to build udis86_itab.c since it's included by + another file. + + * wscript: + +2012-07-11 Chao-ying Fu + + Add MIPS convertibleLoadPtr and other functions + https://bugs.webkit.org/show_bug.cgi?id=90714 + + Reviewed by Oliver Hunt. + + * assembler/MIPSAssembler.h: + (JSC::MIPSAssembler::labelIgnoringWatchpoints): + (MIPSAssembler): + (JSC::MIPSAssembler::replaceWithLoad): + (JSC::MIPSAssembler::replaceWithAddressComputation): + * assembler/MacroAssemblerMIPS.h: + (JSC::MacroAssemblerMIPS::convertibleLoadPtr): + (MacroAssemblerMIPS): + +2012-07-11 Anders Carlsson + + Add -Wtautological-compare and -Wsign-compare warning flags + https://bugs.webkit.org/show_bug.cgi?id=90994 + + Reviewed by Mark Rowe. + + * Configurations/Base.xcconfig: + +2012-07-11 Benjamin Poulain + + Simplify the copying of JSC ARMv7's LinkRecord + https://bugs.webkit.org/show_bug.cgi?id=90930 + + Reviewed by Filip Pizlo. + + The class LinkRecord is used by value everywhere in ARMv7Assembler. The compiler uses + memmove() to move the objects. + + The problem is memmove() is overkill for this object, moving the value can be done with + 3 load-store. This patch adds an operator= to the class doing more efficient copying. + This reduces the link time by 19%. + + * assembler/ARMv7Assembler.h: + (JSC::ARMv7Assembler::LinkRecord::LinkRecord): + (JSC::ARMv7Assembler::LinkRecord::operator=): + (JSC::ARMv7Assembler::LinkRecord::from): + (JSC::ARMv7Assembler::LinkRecord::setFrom): + (JSC::ARMv7Assembler::LinkRecord::to): + (JSC::ARMv7Assembler::LinkRecord::type): + (JSC::ARMv7Assembler::LinkRecord::linkType): + (JSC::ARMv7Assembler::LinkRecord::setLinkType): + (JSC::ARMv7Assembler::LinkRecord::condition): + +2012-07-11 Andy Wingo + + jsc: Parse options before creating global data + https://bugs.webkit.org/show_bug.cgi?id=90975 + + Reviewed by Filip Pizlo. + + This patch moves the options parsing in "jsc" before the creation + of the JSGlobalData, so that --useJIT=no has a chance to take + effect. + + * jsc.cpp: + (CommandLine::parseArguments): Refactor to be a class, and take + argc and argv as constructor arguments. + (jscmain): Move arg parsing before JSGlobalData creation. + +2012-07-10 Filip Pizlo + + REGRESSION(r122166): It made 170 tests crash on 32 bit platforms + https://bugs.webkit.org/show_bug.cgi?id=90852 + + Reviewed by Zoltan Herczeg. + + If we can't use the range filter, we should still make sure that the + address is remotely sane, otherwise the hashtables will assert. + + * jit/JITStubRoutine.h: + (JSC::JITStubRoutine::passesFilter): + +2012-07-10 Filip Pizlo + + DFG recompilation heuristics should be based on count, not rate + https://bugs.webkit.org/show_bug.cgi?id=90146 + + Reviewed by Oliver Hunt. + + Rolling r121511 back in after fixing the DFG's interpretation of op_div + profiling, with Gavin's rubber stamp. + + This removes a bunch of code that was previously trying to prevent spurious + reoptimizations if a large enough majority of executions of a code block did + not result in OSR exit. It turns out that this code was purely harmful. This + patch removes all of that logic and replaces it with a dead-simple + heuristic: if you exit more than N times (where N is an exponential function + of the number of times the code block has already been recompiled) then we + will recompile. + + This appears to be a broad ~1% win on many benchmarks large and small. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::CodeBlock): + * bytecode/CodeBlock.h: + (JSC::CodeBlock::couldTakeSpecialFastCase): + (CodeBlock): + (JSC::CodeBlock::osrExitCounter): + (JSC::CodeBlock::countOSRExit): + (JSC::CodeBlock::addressOfOSRExitCounter): + (JSC::CodeBlock::offsetOfOSRExitCounter): + (JSC::CodeBlock::adjustedExitCountThreshold): + (JSC::CodeBlock::exitCountThresholdForReoptimization): + (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop): + (JSC::CodeBlock::shouldReoptimizeNow): + (JSC::CodeBlock::shouldReoptimizeFromLoopNow): + * bytecode/ExecutionCounter.cpp: + (JSC::ExecutionCounter::setThreshold): + * bytecode/ExecutionCounter.h: + (ExecutionCounter): + (JSC::ExecutionCounter::clippedThreshold): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::makeDivSafe): + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::compileBody): + * dfg/DFGOSRExit.cpp: + (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow): + * dfg/DFGOSRExitCompiler.cpp: + (JSC::DFG::OSRExitCompiler::handleExitCounts): + * dfg/DFGOperations.cpp: + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * runtime/Options.h: + (JSC): + +2012-07-09 Matt Falkenhagen + + Add ENABLE_DIALOG_ELEMENT and skeleton files + https://bugs.webkit.org/show_bug.cgi?id=90521 + + Reviewed by Kent Tamura. + + * Configurations/FeatureDefines.xcconfig: + +2012-07-09 Filip Pizlo + + Unreviewed, roll out http://trac.webkit.org/changeset/121511 + It made in-browser V8v7 10% slower. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::CodeBlock): + * bytecode/CodeBlock.h: + (CodeBlock): + (JSC::CodeBlock::countSpeculationSuccess): + (JSC::CodeBlock::countSpeculationFailure): + (JSC::CodeBlock::speculativeSuccessCounter): + (JSC::CodeBlock::speculativeFailCounter): + (JSC::CodeBlock::forcedOSRExitCounter): + (JSC::CodeBlock::addressOfSpeculativeSuccessCounter): + (JSC::CodeBlock::addressOfSpeculativeFailCounter): + (JSC::CodeBlock::addressOfForcedOSRExitCounter): + (JSC::CodeBlock::offsetOfSpeculativeSuccessCounter): + (JSC::CodeBlock::offsetOfSpeculativeFailCounter): + (JSC::CodeBlock::offsetOfForcedOSRExitCounter): + (JSC::CodeBlock::largeFailCountThreshold): + (JSC::CodeBlock::largeFailCountThresholdForLoop): + (JSC::CodeBlock::shouldReoptimizeNow): + (JSC::CodeBlock::shouldReoptimizeFromLoopNow): + * bytecode/ExecutionCounter.cpp: + (JSC::ExecutionCounter::setThreshold): + * bytecode/ExecutionCounter.h: + (ExecutionCounter): + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::compileBody): + * dfg/DFGOSRExit.cpp: + (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow): + * dfg/DFGOSRExitCompiler.cpp: + (JSC::DFG::OSRExitCompiler::handleExitCounts): + * dfg/DFGOperations.cpp: + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * runtime/Options.h: + (JSC): + +2012-07-09 Filip Pizlo + + DFG may get stuck in an infinite fix point if it constant folds a mispredicted node + https://bugs.webkit.org/show_bug.cgi?id=90829 + + + Reviewed by Oliver Hunt. + + If a node is shown to have been mispredicted during CFA, then don't allow constant + folding to make the graph even more degenerate. Instead, pull back on constant folding + and allow the normal OSR machinery to fix our profiling so that a future recompilation + doesn't see the same mistake. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGAbstractState.h: + (JSC::DFG::AbstractState::trySetConstant): + (AbstractState): + * dfg/DFGPhase.h: + (JSC::DFG::Phase::name): + (Phase): + (JSC::DFG::runAndLog): + (DFG): + (JSC::DFG::runPhase): + +2012-07-09 Filip Pizlo + + It should be possible to jettison JIT stub routines even if they are currently running + https://bugs.webkit.org/show_bug.cgi?id=90731 + + Reviewed by Gavin Barraclough. + + This gives the GC awareness of all JIT-generated stubs for inline caches. That + means that if you want to delete a JIT-generated stub, you don't have to worry + about whether or not it is currently running: if there is a chance that it might + be, the GC will kindly defer deletion until non-running-ness is proved. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * bytecode/Instruction.h: + (JSC): + (PolymorphicStubInfo): + (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set): + (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList): + * bytecode/PolymorphicPutByIdList.cpp: + (JSC::PutByIdAccess::fromStructureStubInfo): + * bytecode/PolymorphicPutByIdList.h: + (JSC::PutByIdAccess::transition): + (JSC::PutByIdAccess::replace): + (JSC::PutByIdAccess::stubRoutine): + (PutByIdAccess): + (JSC::PolymorphicPutByIdList::currentSlowPathTarget): + * bytecode/StructureStubInfo.h: + (JSC::StructureStubInfo::reset): + * dfg/DFGRepatch.cpp: + (JSC::DFG::generateProtoChainAccessStub): + (JSC::DFG::tryCacheGetByID): + (JSC::DFG::tryBuildGetByIDList): + (JSC::DFG::tryBuildGetByIDProtoList): + (JSC::DFG::emitPutReplaceStub): + (JSC::DFG::emitPutTransitionStub): + (JSC::DFG::tryCachePutByID): + (JSC::DFG::tryBuildPutByIdList): + * heap/ConservativeRoots.cpp: + (JSC): + (DummyMarkHook): + (JSC::DummyMarkHook::mark): + (JSC::ConservativeRoots::add): + (CompositeMarkHook): + (JSC::CompositeMarkHook::CompositeMarkHook): + (JSC::CompositeMarkHook::mark): + * heap/ConservativeRoots.h: + (JSC): + (ConservativeRoots): + * heap/Heap.cpp: + (JSC::Heap::markRoots): + (JSC::Heap::deleteUnmarkedCompiledCode): + * heap/Heap.h: + (JSC): + (Heap): + * heap/JITStubRoutineSet.cpp: Added. + (JSC): + (JSC::JITStubRoutineSet::JITStubRoutineSet): + (JSC::JITStubRoutineSet::~JITStubRoutineSet): + (JSC::JITStubRoutineSet::add): + (JSC::JITStubRoutineSet::clearMarks): + (JSC::JITStubRoutineSet::markSlow): + (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines): + (JSC::JITStubRoutineSet::traceMarkedStubRoutines): + * heap/JITStubRoutineSet.h: Added. + (JSC): + (JITStubRoutineSet): + (JSC::JITStubRoutineSet::mark): + * heap/MachineStackMarker.h: + (JSC): + * interpreter/RegisterFile.cpp: + (JSC::RegisterFile::gatherConservativeRoots): + * interpreter/RegisterFile.h: + (JSC): + * jit/ExecutableAllocator.cpp: + (JSC::DemandExecutableAllocator::DemandExecutableAllocator): + * jit/ExecutableAllocator.h: + (JSC): + * jit/ExecutableAllocatorFixedVMPool.cpp: + (JSC): + (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator): + * jit/GCAwareJITStubRoutine.cpp: Added. + (JSC): + (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine): + (JSC::GCAwareJITStubRoutine::~GCAwareJITStubRoutine): + (JSC::GCAwareJITStubRoutine::observeZeroRefCount): + (JSC::GCAwareJITStubRoutine::deleteFromGC): + (JSC::GCAwareJITStubRoutine::markRequiredObjectsInternal): + (JSC::MarkingGCAwareJITStubRoutineWithOneObject::MarkingGCAwareJITStubRoutineWithOneObject): + (JSC::MarkingGCAwareJITStubRoutineWithOneObject::~MarkingGCAwareJITStubRoutineWithOneObject): + (JSC::MarkingGCAwareJITStubRoutineWithOneObject::markRequiredObjectsInternal): + (JSC::createJITStubRoutine): + * jit/GCAwareJITStubRoutine.h: Added. + (JSC): + (GCAwareJITStubRoutine): + (JSC::GCAwareJITStubRoutine::markRequiredObjects): + (MarkingGCAwareJITStubRoutineWithOneObject): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::privateCompilePutByIdTransition): + (JSC::JIT::privateCompilePatchGetArrayLength): + (JSC::JIT::privateCompileGetByIdProto): + (JSC::JIT::privateCompileGetByIdSelfList): + (JSC::JIT::privateCompileGetByIdProtoList): + (JSC::JIT::privateCompileGetByIdChainList): + (JSC::JIT::privateCompileGetByIdChain): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::privateCompilePutByIdTransition): + (JSC::JIT::privateCompilePatchGetArrayLength): + (JSC::JIT::privateCompileGetByIdProto): + (JSC::JIT::privateCompileGetByIdSelfList): + (JSC::JIT::privateCompileGetByIdProtoList): + (JSC::JIT::privateCompileGetByIdChainList): + (JSC::JIT::privateCompileGetByIdChain): + * jit/JITStubRoutine.cpp: Added. + (JSC): + (JSC::JITStubRoutine::~JITStubRoutine): + (JSC::JITStubRoutine::observeZeroRefCount): + * jit/JITStubRoutine.h: Added. + (JSC): + (JITStubRoutine): + (JSC::JITStubRoutine::JITStubRoutine): + (JSC::JITStubRoutine::createSelfManagedRoutine): + (JSC::JITStubRoutine::code): + (JSC::JITStubRoutine::asCodePtr): + (JSC::JITStubRoutine::ref): + (JSC::JITStubRoutine::deref): + (JSC::JITStubRoutine::startAddress): + (JSC::JITStubRoutine::endAddress): + (JSC::JITStubRoutine::addressStep): + (JSC::JITStubRoutine::canPerformRangeFilter): + (JSC::JITStubRoutine::filteringStartAddress): + (JSC::JITStubRoutine::filteringExtentSize): + (JSC::JITStubRoutine::passesFilter): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + (JSC::getPolymorphicAccessStructureListSlot): + +2012-07-09 Sheriff Bot + + Unreviewed, rolling out r122107. + http://trac.webkit.org/changeset/122107 + https://bugs.webkit.org/show_bug.cgi?id=90794 + + Build failure on Mac debug bots (Requested by falken_ on + #webkit). + + * Configurations/FeatureDefines.xcconfig: + +2012-07-09 Matt Falkenhagen + + Add ENABLE_DIALOG_ELEMENT and skeleton files + https://bugs.webkit.org/show_bug.cgi?id=90521 + + Reviewed by Kent Tamura. + + * Configurations/FeatureDefines.xcconfig: + +2012-07-08 Ryosuke Niwa + + gcc build fix after r121925. + + * runtime/JSObject.h: + (JSC::JSFinalObject::finishCreation): + +2012-07-08 Zoltan Herczeg + + [Qt][ARM] Implementing missing macro assembler instructions after r121925 + https://bugs.webkit.org/show_bug.cgi?id=90657 + + Reviewed by Csaba Osztrogonác. + + Implementing convertibleLoadPtr, replaceWithLoad and + replaceWithAddressComputation. + + * assembler/ARMAssembler.h: + (JSC::ARMAssembler::replaceWithLoad): + (ARMAssembler): + (JSC::ARMAssembler::replaceWithAddressComputation): + * assembler/MacroAssemblerARM.h: + (JSC::MacroAssemblerARM::convertibleLoadPtr): + (MacroAssemblerARM): + +2012-07-06 Filip Pizlo + + WebKit Version 5.1.7 (6534.57.2, r121935): Double-click no longer works on OpenStreetMap + https://bugs.webkit.org/show_bug.cgi?id=90703 + + Reviewed by Michael Saboff. + + It turns out that in my object model refactoring, I managed to fix get_by_pname in all + execution engines except 64-bit baseline JIT. + + * jit/JITPropertyAccess.cpp: + (JSC::JIT::emit_op_get_by_pname): + +2012-07-06 Pravin D + + Build Error on Qt Linux build + https://bugs.webkit.org/show_bug.cgi?id=90699 + + Reviewed by Laszlo Gombos. + + * parser/Parser.cpp: + (JSC::::parseForStatement): + Removed unused boolean variable as this was causing build error on Qt Linux. + +2012-07-06 Nuno Lopes + + Fix build with recent clang. + https://bugs.webkit.org/show_bug.cgi?id=90634 + + Reviewed by Oliver Hunt. + + * jit/SpecializedThunkJIT.h: + (JSC::SpecializedThunkJIT::SpecializedThunkJIT): + (SpecializedThunkJIT): + * jit/ThunkGenerators.cpp: + (JSC::charCodeAtThunkGenerator): + (JSC::charAtThunkGenerator): + (JSC::fromCharCodeThunkGenerator): + (JSC::sqrtThunkGenerator): + (JSC::floorThunkGenerator): + (JSC::ceilThunkGenerator): + (JSC::roundThunkGenerator): + (JSC::expThunkGenerator): + (JSC::logThunkGenerator): + (JSC::absThunkGenerator): + (JSC::powThunkGenerator): + * parser/ASTBuilder.h: + (JSC::ASTBuilder::createAssignResolve): + (JSC::ASTBuilder::createForLoop): + (JSC::ASTBuilder::createForInLoop): + (JSC::ASTBuilder::makeAssignNode): + (JSC::ASTBuilder::makePrefixNode): + (JSC::ASTBuilder::makePostfixNode): + * parser/NodeConstructors.h: + (JSC::PostfixErrorNode::PostfixErrorNode): + (JSC::PrefixErrorNode::PrefixErrorNode): + (JSC::AssignResolveNode::AssignResolveNode): + (JSC::AssignErrorNode::AssignErrorNode): + (JSC::ForNode::ForNode): + (JSC::ForInNode::ForInNode): + * parser/Nodes.h: + (FunctionCallResolveNode): + (PostfixErrorNode): + (PrefixErrorNode): + (ReadModifyResolveNode): + (AssignResolveNode): + (AssignErrorNode): + (ForNode): + (ForInNode): + * parser/Parser.cpp: + (JSC::::parseVarDeclarationList): + (JSC::::parseForStatement): + * parser/SyntaxChecker.h: + (JSC::SyntaxChecker::createAssignResolve): + (JSC::SyntaxChecker::createForLoop): + +2012-07-06 Zoltan Herczeg + + [Qt][ARM] REGRESSION(r121885): It broke 30 jsc tests, 500+ layout tests + https://bugs.webkit.org/show_bug.cgi?id=90656 + + Reviewed by Csaba Osztrogonác. + + Typo fixes. + + * assembler/MacroAssemblerARM.cpp: + (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords): + Rename getOp2Byte() -> getOp2Half() + * assembler/MacroAssemblerARMv7.h: + (JSC::MacroAssemblerARMv7::convertibleLoadPtr): + Add a necessary space. + * jit/JITStubs.cpp: + (JSC): + Revert INLINE_ARM_FUNCTION macro. + +2012-07-05 Filip Pizlo + + REGRESSION(r121925): It broke 5 sputnik tests on x86 platforms + https://bugs.webkit.org/show_bug.cgi?id=90658 + + Reviewed by Zoltan Herczeg. + + Under the new object model, out-of-line property accesses such as those + in ResolveGlobal must account for the fact that the offset to the Kth + property is represented by K + inlineStorageCapacity. Hence, the property + loads in ResolveGlobal must have an additional -inlineStorageCapacity * + sizeof(JSValue) offset. + + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-07-05 Csaba Osztrogonác + + [Qt] Unreviewed 64 bit buildfix after r121925. + + * bytecode/PutByIdStatus.cpp: + (JSC::PutByIdStatus::computeFromLLInt): + +2012-07-05 Michael Saboff + + JSString::tryHashConstLock() fails to get exclusive lock + https://bugs.webkit.org/show_bug.cgi?id=90639 + + Reviewed by Oliver Hunt. + + Added check that the string is already locked even before compare and swap. + + * heap/MarkStack.cpp: + (JSC::JSString::tryHashConstLock): + +2012-07-04 Filip Pizlo + + Inline property storage should not be wasted when it is exhausted + https://bugs.webkit.org/show_bug.cgi?id=90347 + + Reviewed by Gavin Barraclough. + + Previously, if we switched an object from using inline storage to out-of-line + storage, we would abandon the inline storage. This would have two main implications: + (i) all accesses to the object, even for properties that were previously in inline + storage, must now take an extra indirection; and (ii) we waste a non-trivial amount + of space since we must allocate additional out-of-line storage to hold properties + that would have fit in the inline storage. There's also the copying cost when + switching to out-of-line storage - we must copy all inline properties into ouf-of-line + storage. + + This patch changes the way that object property storage works so that we can use both + inline and out-of-line storage concurrently. This is accomplished by introducing a + new notion of property offset. This PropertyOffset is a 32-bit signed integer and it + behaves as follows: + + offset == -1: invalid offset, indicating a property that does not exist. + + 0 <= offset <= inlineStorageCapacity: offset into inline storage. + + inlineStorageCapacity < offset: offset into out-of-line storage. + + Because non-final objects don't have inline storage, the only valid PropertyOffsets + for those objects' properties are -1 or > inlineStorageCapacity. + + This now means that the decision to use inline or out-of-line storage for an access is + made based on the offset, rather than the structure. It also means that any access + where the offset is a variable must have an extra branch, unless the type of the + object is also known (if it's known to be a non-final object then we can just assert + that the offset is >= inlineStorageCapacity). + + This looks like a big Kraken speed-up and a slight V8 speed-up. + + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * assembler/ARMv7Assembler.h: + (ARMv7Assembler): + (JSC::ARMv7Assembler::ldrWide8BitImmediate): + (JSC::ARMv7Assembler::replaceWithLoad): + (JSC::ARMv7Assembler::replaceWithAddressComputation): + * assembler/AbstractMacroAssembler.h: + (AbstractMacroAssembler): + (ConvertibleLoadLabel): + (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::ConvertibleLoadLabel): + (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::isSet): + (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints): + (JSC::AbstractMacroAssembler::replaceWithLoad): + (JSC::AbstractMacroAssembler::replaceWithAddressComputation): + * assembler/CodeLocation.h: + (JSC): + (CodeLocationCommon): + (CodeLocationConvertibleLoad): + (JSC::CodeLocationConvertibleLoad::CodeLocationConvertibleLoad): + (JSC::CodeLocationCommon::convertibleLoadAtOffset): + * assembler/LinkBuffer.cpp: + (JSC::LinkBuffer::finalizeCodeWithDisassembly): + * assembler/LinkBuffer.h: + (LinkBuffer): + (JSC::LinkBuffer::locationOf): + * assembler/MacroAssemblerARMv7.h: + (MacroAssemblerARMv7): + (JSC::MacroAssemblerARMv7::convertibleLoadPtr): + * assembler/MacroAssemblerX86.h: + (JSC::MacroAssemblerX86::convertibleLoadPtr): + (MacroAssemblerX86): + * assembler/MacroAssemblerX86_64.h: + (JSC::MacroAssemblerX86_64::convertibleLoadPtr): + (MacroAssemblerX86_64): + * assembler/RepatchBuffer.h: + (RepatchBuffer): + (JSC::RepatchBuffer::replaceWithLoad): + (JSC::RepatchBuffer::replaceWithAddressComputation): + (JSC::RepatchBuffer::setLoadInstructionIsActive): + * assembler/X86Assembler.h: + (JSC::X86Assembler::replaceWithLoad): + (X86Assembler): + (JSC::X86Assembler::replaceWithAddressComputation): + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::printGetByIdOp): + (JSC::CodeBlock::dump): + (JSC::CodeBlock::finalizeUnconditionally): + * bytecode/GetByIdStatus.cpp: + (JSC::GetByIdStatus::computeFromLLInt): + (JSC::GetByIdStatus::computeForChain): + (JSC::GetByIdStatus::computeFor): + * bytecode/GetByIdStatus.h: + (JSC::GetByIdStatus::GetByIdStatus): + (JSC::GetByIdStatus::offset): + (GetByIdStatus): + * bytecode/Opcode.h: + (JSC): + (JSC::padOpcodeName): + * bytecode/PutByIdStatus.cpp: + (JSC::PutByIdStatus::computeFromLLInt): + (JSC::PutByIdStatus::computeFor): + * bytecode/PutByIdStatus.h: + (JSC::PutByIdStatus::PutByIdStatus): + (JSC::PutByIdStatus::offset): + (PutByIdStatus): + * bytecode/ResolveGlobalStatus.cpp: + (JSC): + (JSC::computeForStructure): + * bytecode/ResolveGlobalStatus.h: + (JSC::ResolveGlobalStatus::ResolveGlobalStatus): + (JSC::ResolveGlobalStatus::offset): + (ResolveGlobalStatus): + * bytecode/StructureSet.h: + (StructureSet): + * bytecode/StructureStubInfo.h: + * dfg/DFGByteCodeParser.cpp: + (ByteCodeParser): + (JSC::DFG::ByteCodeParser::handleGetByOffset): + (JSC::DFG::ByteCodeParser::handleGetById): + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCapabilities.h: + (JSC::DFG::canCompileOpcode): + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::link): + * dfg/DFGJITCompiler.h: + (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord): + (PropertyAccessRecord): + * dfg/DFGRepatch.cpp: + (JSC::DFG::dfgRepatchByIdSelfAccess): + (JSC::DFG::generateProtoChainAccessStub): + (JSC::DFG::tryCacheGetByID): + (JSC::DFG::tryBuildGetByIDList): + (JSC::DFG::tryBuildGetByIDProtoList): + (JSC::DFG::emitPutReplaceStub): + (JSC::DFG::emitPutTransitionStub): + (JSC::DFG::tryCachePutByID): + (JSC::DFG::tryBuildPutByIdList): + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::cachedGetById): + (JSC::DFG::SpeculativeJIT::cachedPutById): + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::cachedGetById): + (JSC::DFG::SpeculativeJIT::cachedPutById): + (JSC::DFG::SpeculativeJIT::compile): + * heap/MarkStack.cpp: + (JSC::visitChildren): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::tryCacheGetByID): + (JSC::Interpreter::privateExecute): + * jit/JIT.cpp: + (JSC::JIT::privateCompileMainPass): + (JSC::JIT::privateCompileSlowCases): + (JSC::PropertyStubCompilationInfo::copyToStubInfo): + * jit/JIT.h: + (JSC::PropertyStubCompilationInfo::PropertyStubCompilationInfo): + (JSC::JIT::compileGetByIdProto): + (JSC::JIT::compileGetByIdSelfList): + (JSC::JIT::compileGetByIdProtoList): + (JSC::JIT::compileGetByIdChainList): + (JSC::JIT::compileGetByIdChain): + (JSC::JIT::compilePutByIdTransition): + (JIT): + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateBasicJSObject): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_resolve_global): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_resolve_global): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::compileGetDirectOffset): + (JSC::JIT::emit_op_method_check): + (JSC::JIT::compileGetByIdHotPath): + (JSC::JIT::emit_op_put_by_id): + (JSC::JIT::compilePutDirectOffset): + (JSC::JIT::privateCompilePutByIdTransition): + (JSC::JIT::patchGetByIdSelf): + (JSC::JIT::patchPutByIdReplace): + (JSC::JIT::privateCompileGetByIdProto): + (JSC::JIT::privateCompileGetByIdSelfList): + (JSC::JIT::privateCompileGetByIdProtoList): + (JSC::JIT::privateCompileGetByIdChainList): + (JSC::JIT::privateCompileGetByIdChain): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::emit_op_method_check): + (JSC::JIT::compileGetByIdHotPath): + (JSC::JIT::emit_op_put_by_id): + (JSC::JIT::compilePutDirectOffset): + (JSC::JIT::compileGetDirectOffset): + (JSC::JIT::privateCompilePutByIdTransition): + (JSC::JIT::patchGetByIdSelf): + (JSC::JIT::patchPutByIdReplace): + (JSC::JIT::privateCompileGetByIdProto): + (JSC::JIT::privateCompileGetByIdSelfList): + (JSC::JIT::privateCompileGetByIdProtoList): + (JSC::JIT::privateCompileGetByIdChainList): + (JSC::JIT::privateCompileGetByIdChain): + (JSC::JIT::emit_op_get_by_pname): + * jit/JITStubs.cpp: + (JSC::JITThunks::tryCacheGetByID): + (JSC::DEFINE_STUB_FUNCTION): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * llint/LowLevelInterpreter.asm: + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * offlineasm/x86.rb: + * runtime/JSGlobalObject.h: + (JSGlobalObject): + (JSC::JSGlobalObject::functionNameOffset): + * runtime/JSObject.cpp: + (JSC::JSObject::visitChildren): + (JSC): + (JSC::JSFinalObject::visitChildren): + (JSC::JSObject::put): + (JSC::JSObject::deleteProperty): + (JSC::JSObject::getPropertySpecificValue): + (JSC::JSObject::removeDirect): + (JSC::JSObject::growOutOfLineStorage): + (JSC::JSObject::getOwnPropertyDescriptor): + * runtime/JSObject.h: + (JSObject): + (JSC::JSObject::getDirect): + (JSC::JSObject::getDirectLocation): + (JSC::JSObject::hasInlineStorage): + (JSC::JSObject::inlineStorageUnsafe): + (JSC::JSObject::inlineStorage): + (JSC::JSObject::outOfLineStorage): + (JSC::JSObject::locationForOffset): + (JSC::JSObject::offsetForLocation): + (JSC::JSObject::getDirectOffset): + (JSC::JSObject::putDirectOffset): + (JSC::JSObject::putUndefinedAtDirectOffset): + (JSC::JSObject::addressOfOutOfLineStorage): + (JSC::JSObject::finishCreation): + (JSC::JSNonFinalObject::JSNonFinalObject): + (JSC::JSNonFinalObject::finishCreation): + (JSFinalObject): + (JSC::JSFinalObject::finishCreation): + (JSC::JSFinalObject::JSFinalObject): + (JSC::JSObject::offsetOfOutOfLineStorage): + (JSC::JSObject::setOutOfLineStorage): + (JSC::JSObject::JSObject): + (JSC): + (JSC::JSCell::fastGetOwnProperty): + (JSC::JSObject::putDirectInternal): + (JSC::JSObject::setStructureAndReallocateStorageIfNecessary): + (JSC::JSObject::putDirectWithoutTransition): + (JSC::offsetRelativeToPatchedStorage): + (JSC::indexRelativeToBase): + (JSC::offsetRelativeToBase): + * runtime/JSPropertyNameIterator.cpp: + (JSC::JSPropertyNameIterator::create): + * runtime/JSPropertyNameIterator.h: + (JSPropertyNameIterator): + (JSC::JSPropertyNameIterator::getOffset): + (JSC::JSPropertyNameIterator::finishCreation): + * runtime/JSValue.cpp: + (JSC::JSValue::putToPrimitive): + * runtime/Operations.h: + (JSC::normalizePrototypeChain): + * runtime/Options.cpp: + (JSC): + (JSC::Options::initialize): + * runtime/PropertyMapHashTable.h: + (PropertyMapEntry): + (JSC::PropertyMapEntry::PropertyMapEntry): + (PropertyTable): + (JSC::PropertyTable::PropertyTable): + (JSC::PropertyTable::getDeletedOffset): + (JSC::PropertyTable::addDeletedOffset): + (JSC::PropertyTable::nextOffset): + (JSC): + (JSC::PropertyTable::sizeInMemory): + * runtime/PropertyOffset.h: Added. + (JSC): + (JSC::checkOffset): + (JSC::validateOffset): + (JSC::isValidOffset): + (JSC::isInlineOffset): + (JSC::isOutOfLineOffset): + (JSC::offsetInInlineStorage): + (JSC::offsetInOutOfLineStorage): + (JSC::offsetInRespectiveStorage): + (JSC::numberOfOutOfLineSlotsForLastOffset): + (JSC::numberOfSlotsForLastOffset): + (JSC::nextPropertyOffsetFor): + (JSC::firstPropertyOffsetFor): + * runtime/PropertySlot.h: + (JSC::PropertySlot::cachedOffset): + (JSC::PropertySlot::setValue): + (JSC::PropertySlot::setCacheableGetterSlot): + (JSC::PropertySlot::clearOffset): + * runtime/PutPropertySlot.h: + (JSC::PutPropertySlot::setExistingProperty): + (JSC::PutPropertySlot::setNewProperty): + (JSC::PutPropertySlot::cachedOffset): + (PutPropertySlot): + * runtime/Structure.cpp: + (JSC::Structure::Structure): + (JSC::Structure::materializePropertyMap): + (JSC::nextOutOfLineStorageCapacity): + (JSC::Structure::growOutOfLineCapacity): + (JSC::Structure::suggestedNewOutOfLineStorageCapacity): + (JSC::Structure::addPropertyTransitionToExistingStructure): + (JSC::Structure::addPropertyTransition): + (JSC::Structure::removePropertyTransition): + (JSC::Structure::flattenDictionaryStructure): + (JSC::Structure::addPropertyWithoutTransition): + (JSC::Structure::removePropertyWithoutTransition): + (JSC::Structure::copyPropertyTableForPinning): + (JSC::Structure::get): + (JSC::Structure::putSpecificValue): + (JSC::Structure::remove): + * runtime/Structure.h: + (Structure): + (JSC::Structure::putWillGrowOutOfLineStorage): + (JSC::Structure::previousID): + (JSC::Structure::outOfLineCapacity): + (JSC::Structure::outOfLineSizeForKnownFinalObject): + (JSC::Structure::outOfLineSizeForKnownNonFinalObject): + (JSC::Structure::outOfLineSize): + (JSC::Structure::hasInlineStorage): + (JSC::Structure::inlineCapacity): + (JSC::Structure::inlineSizeForKnownFinalObject): + (JSC::Structure::inlineSize): + (JSC::Structure::totalStorageSize): + (JSC::Structure::totalStorageCapacity): + (JSC::Structure::firstValidOffset): + (JSC::Structure::lastValidOffset): + (JSC::Structure::isValidOffset): + (JSC::Structure::isEmpty): + (JSC::Structure::transitionCount): + (JSC::Structure::get): + +2012-07-05 Oliver Hunt + + JSObjectCallAsFunction should thisConvert the provided thisObject + https://bugs.webkit.org/show_bug.cgi?id=90628 + + Reviewed by Gavin Barraclough. + + Perform this conversion on the provided this object. + + * API/JSObjectRef.cpp: + (JSObjectCallAsFunction): + +2012-07-05 Zoltan Herczeg + + [Qt] Unreviewed buildfix after r121886. Typo fix. + + * assembler/MacroAssemblerARM.cpp: + (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords): + +2012-07-05 Zoltan Herczeg + + Port DFG JIT to traditional ARM + https://bugs.webkit.org/show_bug.cgi?id=90198 + + Reviewed by Filip Pizlo. + + This patch contains the macro assembler part of the + DFG JIT support on ARM systems with fixed 32 bit instruction + width. A large amount of old code was refactored, and the ARMv4 + or lower support is removed from the macro assembler. + + Sunspider is improved by 8%, and V8 is 92%. + + * assembler/ARMAssembler.cpp: + (JSC::ARMAssembler::dataTransfer32): + (JSC::ARMAssembler::baseIndexTransfer32): + (JSC): + (JSC::ARMAssembler::dataTransfer16): + (JSC::ARMAssembler::baseIndexTransfer16): + (JSC::ARMAssembler::dataTransferFloat): + (JSC::ARMAssembler::baseIndexTransferFloat): + (JSC::ARMAssembler::executableCopy): + * assembler/ARMAssembler.h: + (JSC::ARMAssembler::ARMAssembler): + (JSC::ARMAssembler::emitInst): + (JSC::ARMAssembler::vmov_f64_r): + (ARMAssembler): + (JSC::ARMAssembler::vabs_f64_r): + (JSC::ARMAssembler::vneg_f64_r): + (JSC::ARMAssembler::ldr_imm): + (JSC::ARMAssembler::ldr_un_imm): + (JSC::ARMAssembler::dtr_u): + (JSC::ARMAssembler::dtr_ur): + (JSC::ARMAssembler::dtr_d): + (JSC::ARMAssembler::dtr_dr): + (JSC::ARMAssembler::dtrh_u): + (JSC::ARMAssembler::dtrh_ur): + (JSC::ARMAssembler::dtrh_d): + (JSC::ARMAssembler::dtrh_dr): + (JSC::ARMAssembler::fdtr_u): + (JSC::ARMAssembler::fdtr_d): + (JSC::ARMAssembler::push_r): + (JSC::ARMAssembler::pop_r): + (JSC::ARMAssembler::poke_r): + (JSC::ARMAssembler::peek_r): + (JSC::ARMAssembler::vmov_vfp64_r): + (JSC::ARMAssembler::vmov_arm64_r): + (JSC::ARMAssembler::vmov_vfp32_r): + (JSC::ARMAssembler::vmov_arm32_r): + (JSC::ARMAssembler::vcvt_u32_f64_r): + (JSC::ARMAssembler::vcvt_f64_f32_r): + (JSC::ARMAssembler::vcvt_f32_f64_r): + (JSC::ARMAssembler::clz_r): + (JSC::ARMAssembler::bkpt): + (JSC::ARMAssembler::bx): + (JSC::ARMAssembler::blx): + (JSC::ARMAssembler::labelIgnoringWatchpoints): + (JSC::ARMAssembler::labelForWatchpoint): + (JSC::ARMAssembler::label): + (JSC::ARMAssembler::getLdrImmAddress): + (JSC::ARMAssembler::replaceWithJump): + (JSC::ARMAssembler::maxJumpReplacementSize): + (JSC::ARMAssembler::getOp2Byte): + (JSC::ARMAssembler::getOp2Half): + (JSC::ARMAssembler::RM): + (JSC::ARMAssembler::RS): + (JSC::ARMAssembler::RD): + (JSC::ARMAssembler::RN): + * assembler/AssemblerBufferWithConstantPool.h: + (JSC::AssemblerBufferWithConstantPool::ensureSpaceForAnyInstruction): + * assembler/MacroAssemblerARM.cpp: + (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords): + * assembler/MacroAssemblerARM.h: + (JSC::MacroAssemblerARM::add32): + (MacroAssemblerARM): + (JSC::MacroAssemblerARM::and32): + (JSC::MacroAssemblerARM::lshift32): + (JSC::MacroAssemblerARM::mul32): + (JSC::MacroAssemblerARM::neg32): + (JSC::MacroAssemblerARM::rshift32): + (JSC::MacroAssemblerARM::urshift32): + (JSC::MacroAssemblerARM::xor32): + (JSC::MacroAssemblerARM::load8): + (JSC::MacroAssemblerARM::load8Signed): + (JSC::MacroAssemblerARM::load16): + (JSC::MacroAssemblerARM::load16Signed): + (JSC::MacroAssemblerARM::load32): + (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch): + (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch): + (JSC::MacroAssemblerARM::store8): + (JSC::MacroAssemblerARM::store16): + (JSC::MacroAssemblerARM::store32): + (JSC::MacroAssemblerARM::move): + (JSC::MacroAssemblerARM::jump): + (JSC::MacroAssemblerARM::branchAdd32): + (JSC::MacroAssemblerARM::mull32): + (JSC::MacroAssemblerARM::branchMul32): + (JSC::MacroAssemblerARM::nearCall): + (JSC::MacroAssemblerARM::compare32): + (JSC::MacroAssemblerARM::test32): + (JSC::MacroAssemblerARM::sub32): + (JSC::MacroAssemblerARM::call): + (JSC::MacroAssemblerARM::loadFloat): + (JSC::MacroAssemblerARM::loadDouble): + (JSC::MacroAssemblerARM::storeFloat): + (JSC::MacroAssemblerARM::storeDouble): + (JSC::MacroAssemblerARM::moveDouble): + (JSC::MacroAssemblerARM::addDouble): + (JSC::MacroAssemblerARM::divDouble): + (JSC::MacroAssemblerARM::subDouble): + (JSC::MacroAssemblerARM::mulDouble): + (JSC::MacroAssemblerARM::absDouble): + (JSC::MacroAssemblerARM::negateDouble): + (JSC::MacroAssemblerARM::convertInt32ToDouble): + (JSC::MacroAssemblerARM::convertFloatToDouble): + (JSC::MacroAssemblerARM::convertDoubleToFloat): + (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32): + (JSC::MacroAssemblerARM::branchTruncateDoubleToUint32): + (JSC::MacroAssemblerARM::truncateDoubleToInt32): + (JSC::MacroAssemblerARM::truncateDoubleToUint32): + (JSC::MacroAssemblerARM::branchConvertDoubleToInt32): + (JSC::MacroAssemblerARM::branchDoubleNonZero): + (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN): + (JSC::MacroAssemblerARM::invert): + (JSC::MacroAssemblerARM::replaceWithJump): + (JSC::MacroAssemblerARM::maxJumpReplacementSize): + (JSC::MacroAssemblerARM::call32): + * assembler/SH4Assembler.h: + (JSC::SH4Assembler::label): + * dfg/DFGAssemblyHelpers.h: + (JSC::DFG::AssemblyHelpers::debugCall): + (JSC::DFG::AssemblyHelpers::boxDouble): + (JSC::DFG::AssemblyHelpers::unboxDouble): + * dfg/DFGCCallHelpers.h: + (CCallHelpers): + (JSC::DFG::CCallHelpers::setupArguments): + * dfg/DFGFPRInfo.h: + (DFG): + * dfg/DFGGPRInfo.h: + (DFG): + (GPRInfo): + * dfg/DFGOperations.cpp: + (JSC): + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult): + (JSC::DFG::SpeculativeJIT::appendCallSetResult): + * jit/JITStubs.cpp: + (JSC): + * jit/JITStubs.h: + (JITStackFrame): + * jit/JSInterfaceJIT.h: + (JSInterfaceJIT): + +2012-07-04 Anthony Scian + + Web Inspector [JSC]: Implement ScriptCallStack::stackTrace + https://bugs.webkit.org/show_bug.cgi?id=40118 + + Reviewed by Yong Li. + + Added member functions to expose function name, urlString, and line #. + Refactored toString to make use of these member functions to reduce + duplicated code for future maintenance. + + Manually tested refactoring of toString by tracing thrown exceptions. + + * interpreter/Interpreter.h: + (JSC::StackFrame::toString): + (JSC::StackFrame::friendlySourceURL): + (JSC::StackFrame::friendlyFunctionName): + (JSC::StackFrame::friendlyLineNumber): + +2012-07-04 Andy Wingo + + [GTK] Enable parallel GC + https://bugs.webkit.org/show_bug.cgi?id=90568 + + Reviewed by Martin Robinson. + + * runtime/Options.cpp: Include for std::min. + +2012-07-04 John Mellor + + Text Autosizing: Add compile flag and runtime setting + https://bugs.webkit.org/show_bug.cgi?id=87394 + + This patch renames Font Boosting to Text Autosizing. + + Reviewed by Adam Barth. + + * Configurations/FeatureDefines.xcconfig: + +2012-07-03 Michael Saboff + + Enh: Hash Const JSString in Backing Stores to Save Memory + https://bugs.webkit.org/show_bug.cgi?id=86024 + + Reviewed by Oliver Hunt. + + During garbage collection, each marking thread keeps a HashMap of + strings. While visiting via MarkStack::copyAndAppend(), we check to + see if the string we are visiting is already in the HashMap. If not + we add it. If so, we change the reference to the current string we're + visiting to the prior string. + + To reduce the performance impact of this change, two throttles have + ben added. 1) We only try hash consting if a significant number of new + strings have been created since the last hash const. Currently this is + set at 100 strings. 2) If a string is unique at the end of a marking + it will not be checked during further GC phases. In some cases this + won't catch all duplicates, but we are trying to catch the growth of + duplicate strings. + + * heap/Heap.cpp: + (JSC::Heap::markRoots): + * heap/MarkStack.cpp: + (JSC::MarkStackThreadSharedData::resetChildren): + (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData): + (JSC::MarkStackThreadSharedData::reset): + (JSC::MarkStack::setup): Check to see if enough strings have been created + to hash const. + (JSC::MarkStack::reset): Added call to clear m_uniqueStrings. + (JSC::JSString::tryHashConstLock): New method to lock JSString for + hash consting. + (JSC::JSString::releaseHashConstLock): New unlock method. + (JSC::JSString::shouldTryHashConst): Set of checks to see if we should + try to hash const the string. + (JSC::MarkStack::internalAppend): New method that performs the hash consting. + (JSC::SlotVisitor::copyAndAppend): Changed to call the new hash + consting internalAppend(). + * heap/MarkStack.h: + (MarkStackThreadSharedData): + (MarkStack): + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::JSGlobalData): + * runtime/JSGlobalData.h: + (JSGlobalData): + (JSC::JSGlobalData::haveEnoughNewStringsToHashConst): + (JSC::JSGlobalData::resetNewStringsSinceLastHashConst): + * runtime/JSString.h: + (JSString): Changed from using bool flags to using an unsigned + m_flags field. This works better with the weakCompareAndSwap in + JSString::tryHashConstLock(). Changed the 8bitness setting and + checking to use new accessors. + (JSC::JSString::JSString): + (JSC::JSString::finishCreation): + (JSC::JSString::is8Bit): Updated for new m_flags. + (JSC::JSString::setIs8Bit): New setter. + New hash const flags accessors: + (JSC::JSString::isHashConstSingleton): + (JSC::JSString::clearHashConstSingleton): + (JSC::JSString::setHashConstSingleton): + (JSC::JSRopeString::finishCreation): + (JSC::JSRopeString::append): + +2012-07-03 Tony Chang + + [chromium] Unreviewed, update .gitignore to handle VS2010 files. + + * JavaScriptCore.gyp/.gitignore: + +2012-07-03 Mark Lam + + Add ability to symbolically set and dump JSC VM options. + See comments in runtime/Options.h for details on how the options work. + https://bugs.webkit.org/show_bug.cgi?id=90420 + + Reviewed by Filip Pizlo. + + * assembler/LinkBuffer.cpp: + (JSC::LinkBuffer::finalizeCodeWithDisassembly): + * assembler/LinkBuffer.h: + (JSC): + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::shouldOptimizeNow): + * bytecode/CodeBlock.h: + (JSC::CodeBlock::likelyToTakeSlowCase): + (JSC::CodeBlock::couldTakeSlowCase): + (JSC::CodeBlock::likelyToTakeSpecialFastCase): + (JSC::CodeBlock::likelyToTakeDeepestSlowCase): + (JSC::CodeBlock::likelyToTakeAnySlowCase): + (JSC::CodeBlock::jitAfterWarmUp): + (JSC::CodeBlock::jitSoon): + (JSC::CodeBlock::reoptimizationRetryCounter): + (JSC::CodeBlock::countReoptimization): + (JSC::CodeBlock::counterValueForOptimizeAfterWarmUp): + (JSC::CodeBlock::counterValueForOptimizeAfterLongWarmUp): + (JSC::CodeBlock::optimizeSoon): + (JSC::CodeBlock::exitCountThresholdForReoptimization): + (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop): + * bytecode/ExecutionCounter.h: + (JSC::ExecutionCounter::clippedThreshold): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::handleInlining): + * dfg/DFGCapabilities.h: + (JSC::DFG::mightCompileEval): + (JSC::DFG::mightCompileProgram): + (JSC::DFG::mightCompileFunctionForCall): + (JSC::DFG::mightCompileFunctionForConstruct): + (JSC::DFG::mightInlineFunctionForCall): + (JSC::DFG::mightInlineFunctionForConstruct): + * dfg/DFGCommon.h: + (JSC::DFG::shouldShowDisassembly): + * dfg/DFGDriver.cpp: + (JSC::DFG::compile): + * dfg/DFGOSRExit.cpp: + (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow): + * dfg/DFGVariableAccessData.h: + (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote): + * heap/MarkStack.cpp: + (JSC::MarkStackSegmentAllocator::allocate): + (JSC::MarkStackSegmentAllocator::shrinkReserve): + (JSC::MarkStackArray::MarkStackArray): + (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData): + (JSC::SlotVisitor::donateKnownParallel): + (JSC::SlotVisitor::drain): + (JSC::SlotVisitor::drainFromShared): + * heap/MarkStack.h: + (JSC::MarkStack::mergeOpaqueRootsIfProfitable): + (JSC::MarkStack::addOpaqueRoot): + * heap/SlotVisitor.h: + (JSC::SlotVisitor::donate): + * jit/JIT.cpp: + (JSC::JIT::emitOptimizationCheck): + * jsc.cpp: + (printUsageStatement): + (parseArguments): + * runtime/InitializeThreading.cpp: + (JSC::initializeThreadingOnce): + * runtime/JSGlobalData.cpp: + (JSC::enableAssembler): + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::JSGlobalObject): + * runtime/Options.cpp: + (JSC): + (JSC::overrideOptionWithHeuristic): + (JSC::Options::initialize): + (JSC::Options::setOption): + (JSC::Options::dumpAllOptions): + (JSC::Options::dumpOption): + * runtime/Options.h: + (JSC): + (Options): + (EntryInfo): + +2012-07-03 Jocelyn Turcotte Joel Dillon + + [Qt][Win] Fix broken QtWebKit5.lib linking + https://bugs.webkit.org/show_bug.cgi?id=88321 + + Reviewed by Kenneth Rohde Christiansen. + + The goal is to have different ports build systems define STATICALLY_LINKED_WITH_WTF + when building JavaScriptCore, if both are packaged in the same DLL, instead + of relying on the code to handle this. + The effects of BUILDING_* and STATICALLY_LINKED_WITH_* are currently the same + except for a check in Source/JavaScriptCore/config.h. + + Keeping the old way for the WX port as requested by the port's contributors. + For non-Windows ports there is no difference between IMPORT and EXPORT, no + change is needed. + + * API/JSBase.h: + JS symbols shouldn't be included by WTF objects anymore. Remove the export when BUILDING_WTF. + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: + Make sure that JavaScriptCore uses import symbols of WTF for the Win port. + * runtime/JSExportMacros.h: + +2012-07-02 Filip Pizlo + + DFG OSR exit value recoveries should be computed lazily + https://bugs.webkit.org/show_bug.cgi?id=82155 + + Reviewed by Gavin Barraclough. + + This change aims to reduce one aspect of DFG compile times: the fact + that we currently compute the value recoveries for each local and + argument on every speculation check. We compile many speculation checks, + so this can add up quick. The strategy that this change takes is to + have the DFG save just enough information about how the compiler is + choosing to represent state, that the DFG::OSRExitCompiler can reify + the value recoveries lazily. + + This appears to be an 0.3% SunSpider speed-up and is neutral elsewhere. + + I also took the opportunity to fix the sampling regions profiler (it + was missing an export macro) and to put in more sampling regions in + the DFG (which are disabled so long as ENABLE(SAMPLING_REGIONS) is + false). + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * bytecode/CodeBlock.cpp: + (JSC): + (JSC::CodeBlock::shrinkDFGDataToFit): + * bytecode/CodeBlock.h: + (CodeBlock): + (JSC::CodeBlock::minifiedDFG): + (JSC::CodeBlock::variableEventStream): + (DFGData): + * bytecode/Operands.h: + (JSC::Operands::hasOperand): + (Operands): + (JSC::Operands::size): + (JSC::Operands::at): + (JSC::Operands::operator[]): + (JSC::Operands::isArgument): + (JSC::Operands::isVariable): + (JSC::Operands::argumentForIndex): + (JSC::Operands::variableForIndex): + (JSC::Operands::operandForIndex): + (JSC): + (JSC::dumpOperands): + * bytecode/SamplingTool.h: + (SamplingRegion): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::parse): + * dfg/DFGCFAPhase.cpp: + (JSC::DFG::performCFA): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::performCSE): + * dfg/DFGFixupPhase.cpp: + (JSC::DFG::performFixup): + * dfg/DFGGenerationInfo.h: + (JSC::DFG::GenerationInfo::GenerationInfo): + (JSC::DFG::GenerationInfo::initConstant): + (JSC::DFG::GenerationInfo::initInteger): + (JSC::DFG::GenerationInfo::initJSValue): + (JSC::DFG::GenerationInfo::initCell): + (JSC::DFG::GenerationInfo::initBoolean): + (JSC::DFG::GenerationInfo::initDouble): + (JSC::DFG::GenerationInfo::initStorage): + (GenerationInfo): + (JSC::DFG::GenerationInfo::noticeOSRBirth): + (JSC::DFG::GenerationInfo::use): + (JSC::DFG::GenerationInfo::spill): + (JSC::DFG::GenerationInfo::setSpilled): + (JSC::DFG::GenerationInfo::fillJSValue): + (JSC::DFG::GenerationInfo::fillCell): + (JSC::DFG::GenerationInfo::fillInteger): + (JSC::DFG::GenerationInfo::fillBoolean): + (JSC::DFG::GenerationInfo::fillDouble): + (JSC::DFG::GenerationInfo::fillStorage): + (JSC::DFG::GenerationInfo::appendFill): + (JSC::DFG::GenerationInfo::appendSpill): + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::link): + (JSC::DFG::JITCompiler::compile): + (JSC::DFG::JITCompiler::compileFunction): + * dfg/DFGMinifiedGraph.h: Added. + (DFG): + (MinifiedGraph): + (JSC::DFG::MinifiedGraph::MinifiedGraph): + (JSC::DFG::MinifiedGraph::at): + (JSC::DFG::MinifiedGraph::append): + (JSC::DFG::MinifiedGraph::prepareAndShrink): + (JSC::DFG::MinifiedGraph::setOriginalGraphSize): + (JSC::DFG::MinifiedGraph::originalGraphSize): + * dfg/DFGMinifiedNode.cpp: Added. + (DFG): + (JSC::DFG::MinifiedNode::fromNode): + * dfg/DFGMinifiedNode.h: Added. + (DFG): + (JSC::DFG::belongsInMinifiedGraph): + (MinifiedNode): + (JSC::DFG::MinifiedNode::MinifiedNode): + (JSC::DFG::MinifiedNode::index): + (JSC::DFG::MinifiedNode::op): + (JSC::DFG::MinifiedNode::hasChild1): + (JSC::DFG::MinifiedNode::child1): + (JSC::DFG::MinifiedNode::hasConstant): + (JSC::DFG::MinifiedNode::hasConstantNumber): + (JSC::DFG::MinifiedNode::constantNumber): + (JSC::DFG::MinifiedNode::hasWeakConstant): + (JSC::DFG::MinifiedNode::weakConstant): + (JSC::DFG::MinifiedNode::getIndex): + (JSC::DFG::MinifiedNode::compareByNodeIndex): + (JSC::DFG::MinifiedNode::hasChild): + * dfg/DFGNode.h: + (Node): + * dfg/DFGOSRExit.cpp: + (JSC::DFG::OSRExit::OSRExit): + * dfg/DFGOSRExit.h: + (OSRExit): + * dfg/DFGOSRExitCompiler.cpp: + * dfg/DFGOSRExitCompiler.h: + (OSRExitCompiler): + * dfg/DFGOSRExitCompiler32_64.cpp: + (JSC::DFG::OSRExitCompiler::compileExit): + * dfg/DFGOSRExitCompiler64.cpp: + (JSC::DFG::OSRExitCompiler::compileExit): + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::performPredictionPropagation): + * dfg/DFGRedundantPhiEliminationPhase.cpp: + (JSC::DFG::performRedundantPhiElimination): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::SpeculativeJIT): + (DFG): + (JSC::DFG::SpeculativeJIT::fillStorage): + (JSC::DFG::SpeculativeJIT::noticeOSRBirth): + (JSC::DFG::SpeculativeJIT::compileMovHint): + (JSC::DFG::SpeculativeJIT::compile): + (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor): + * dfg/DFGSpeculativeJIT.h: + (DFG): + (JSC::DFG::SpeculativeJIT::use): + (SpeculativeJIT): + (JSC::DFG::SpeculativeJIT::spill): + (JSC::DFG::SpeculativeJIT::speculationCheck): + (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck): + (JSC::DFG::SpeculativeJIT::recordSetLocal): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::fillInteger): + (JSC::DFG::SpeculativeJIT::fillDouble): + (JSC::DFG::SpeculativeJIT::fillJSValue): + (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): + (JSC::DFG::SpeculativeJIT::fillSpeculateDouble): + (JSC::DFG::SpeculativeJIT::fillSpeculateCell): + (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::fillInteger): + (JSC::DFG::SpeculativeJIT::fillDouble): + (JSC::DFG::SpeculativeJIT::fillJSValue): + (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): + (JSC::DFG::SpeculativeJIT::fillSpeculateDouble): + (JSC::DFG::SpeculativeJIT::fillSpeculateCell): + (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGValueRecoveryOverride.h: Added. + (DFG): + (ValueRecoveryOverride): + (JSC::DFG::ValueRecoveryOverride::ValueRecoveryOverride): + * dfg/DFGValueSource.cpp: Added. + (DFG): + (JSC::DFG::ValueSource::dump): + * dfg/DFGValueSource.h: Added. + (DFG): + (JSC::DFG::dataFormatToValueSourceKind): + (JSC::DFG::valueSourceKindToDataFormat): + (JSC::DFG::isInRegisterFile): + (ValueSource): + (JSC::DFG::ValueSource::ValueSource): + (JSC::DFG::ValueSource::forPrediction): + (JSC::DFG::ValueSource::forDataFormat): + (JSC::DFG::ValueSource::isSet): + (JSC::DFG::ValueSource::kind): + (JSC::DFG::ValueSource::isInRegisterFile): + (JSC::DFG::ValueSource::dataFormat): + (JSC::DFG::ValueSource::valueRecovery): + (JSC::DFG::ValueSource::nodeIndex): + (JSC::DFG::ValueSource::nodeIndexFromKind): + (JSC::DFG::ValueSource::kindFromNodeIndex): + * dfg/DFGVariableEvent.cpp: Added. + (DFG): + (JSC::DFG::VariableEvent::dump): + (JSC::DFG::VariableEvent::dumpFillInfo): + (JSC::DFG::VariableEvent::dumpSpillInfo): + * dfg/DFGVariableEvent.h: Added. + (DFG): + (VariableEvent): + (JSC::DFG::VariableEvent::VariableEvent): + (JSC::DFG::VariableEvent::reset): + (JSC::DFG::VariableEvent::fillGPR): + (JSC::DFG::VariableEvent::fillPair): + (JSC::DFG::VariableEvent::fillFPR): + (JSC::DFG::VariableEvent::spill): + (JSC::DFG::VariableEvent::death): + (JSC::DFG::VariableEvent::setLocal): + (JSC::DFG::VariableEvent::movHint): + (JSC::DFG::VariableEvent::kind): + (JSC::DFG::VariableEvent::nodeIndex): + (JSC::DFG::VariableEvent::dataFormat): + (JSC::DFG::VariableEvent::gpr): + (JSC::DFG::VariableEvent::tagGPR): + (JSC::DFG::VariableEvent::payloadGPR): + (JSC::DFG::VariableEvent::fpr): + (JSC::DFG::VariableEvent::virtualRegister): + (JSC::DFG::VariableEvent::operand): + (JSC::DFG::VariableEvent::variableRepresentation): + * dfg/DFGVariableEventStream.cpp: Added. + (DFG): + (JSC::DFG::VariableEventStream::logEvent): + (MinifiedGenerationInfo): + (JSC::DFG::MinifiedGenerationInfo::MinifiedGenerationInfo): + (JSC::DFG::MinifiedGenerationInfo::update): + (JSC::DFG::VariableEventStream::reconstruct): + * dfg/DFGVariableEventStream.h: Added. + (DFG): + (VariableEventStream): + (JSC::DFG::VariableEventStream::appendAndLog): + * dfg/DFGVirtualRegisterAllocationPhase.cpp: + (JSC::DFG::performVirtualRegisterAllocation): + +2012-07-02 Filip Pizlo + + DFG::ArgumentsSimplificationPhase should assert that the PhantomArguments nodes it creates are not shouldGenerate() + https://bugs.webkit.org/show_bug.cgi?id=90407 + + Reviewed by Mark Hahnenberg. + + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + +2012-07-02 Gavin Barraclough + + Array.prototype.pop should throw if property is not configurable + https://bugs.webkit.org/show_bug.cgi?id=75788 + + Rubber Stamped by Oliver Hunt. + + No real bug here any more, but the error we throw sometimes has a misleading message. + + * runtime/JSArray.cpp: + (JSC::JSArray::pop): + +2012-06-29 Filip Pizlo + + JSObject wastes too much memory on unused property slots + https://bugs.webkit.org/show_bug.cgi?id=90255 + + Reviewed by Mark Hahnenberg. + + Rolling back in after applying a simple fix: it appears that + JSObject::setStructureAndReallocateStorageIfNecessary() was allocating more + property storage than necessary. Fixing this appears to resolve the crash. + + This does a few things: + + - JSNonFinalObject no longer has inline property storage. + + - Initial out-of-line property storage size is 4 slots for JSNonFinalObject, + or 2x the inline storage for JSFinalObject. + + - Property storage is only reallocated if it needs to be. Previously, we + would reallocate the property storage on any transition where the original + structure said shouldGrowProperyStorage(), but this led to spurious + reallocations when doing transitionless property adds and there are + deleted property slots available. That in turn led to crashes, because we + would switch to out-of-line storage even if the capacity matched the + criteria for inline storage. + + - Inline JSFunction allocation is killed off because we don't have a good + way of inlining property storage allocation. This didn't hurt performance. + Killing off code is better than fixing it if that code wasn't doing any + good. + + This looks like a 1% progression on V8. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + * jit/JIT.cpp: + (JSC::JIT::privateCompileSlowCases): + * jit/JIT.h: + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateBasicJSObject): + (JSC): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_new_func): + (JSC): + (JSC::JIT::emit_op_new_func_exp): + * runtime/JSFunction.cpp: + (JSC::JSFunction::finishCreation): + * runtime/JSObject.h: + (JSC::JSObject::isUsingInlineStorage): + (JSObject): + (JSC::JSObject::finishCreation): + (JSC): + (JSC::JSNonFinalObject::hasInlineStorage): + (JSNonFinalObject): + (JSC::JSNonFinalObject::JSNonFinalObject): + (JSC::JSNonFinalObject::finishCreation): + (JSC::JSFinalObject::hasInlineStorage): + (JSC::JSFinalObject::finishCreation): + (JSC::JSObject::offsetOfInlineStorage): + (JSC::JSObject::setPropertyStorage): + (JSC::Structure::inlineStorageCapacity): + (JSC::Structure::isUsingInlineStorage): + (JSC::JSObject::putDirectInternal): + (JSC::JSObject::setStructureAndReallocateStorageIfNecessary): + (JSC::JSObject::putDirectWithoutTransition): + * runtime/Structure.cpp: + (JSC::Structure::Structure): + (JSC::nextPropertyStorageCapacity): + (JSC): + (JSC::Structure::growPropertyStorageCapacity): + (JSC::Structure::suggestedNewPropertyStorageSize): + * runtime/Structure.h: + (JSC::Structure::putWillGrowPropertyStorage): + (Structure): + +2012-06-29 Filip Pizlo + + Webkit crashes in DFG on Google Docs when creating a new document + https://bugs.webkit.org/show_bug.cgi?id=90209 + + Reviewed by Gavin Barraclough. + + Don't attempt to short-circuit Phantom(GetLocal) if the GetLocal is for a + captured variable. + + * dfg/DFGCFGSimplificationPhase.cpp: + (JSC::DFG::CFGSimplificationPhase::mergeBlocks): + +2012-06-30 Zan Dobersek + + Unreviewed, rolling out r121605. + http://trac.webkit.org/changeset/121605 + https://bugs.webkit.org/show_bug.cgi?id=90336 + + Changes caused flaky crashes in sputnik/Unicode tests on Apple + WK1 and GTK Linux builders + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + * jit/JIT.cpp: + (JSC::JIT::privateCompileSlowCases): + * jit/JIT.h: + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateBasicJSObject): + (JSC::JIT::emitAllocateJSFinalObject): + (JSC): + (JSC::JIT::emitAllocateJSFunction): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_new_func): + (JSC::JIT::emitSlow_op_new_func): + (JSC): + (JSC::JIT::emit_op_new_func_exp): + (JSC::JIT::emitSlow_op_new_func_exp): + * runtime/JSFunction.cpp: + (JSC::JSFunction::finishCreation): + * runtime/JSObject.h: + (JSC::JSObject::isUsingInlineStorage): + (JSObject): + (JSC::JSObject::finishCreation): + (JSC): + (JSNonFinalObject): + (JSC::JSNonFinalObject::JSNonFinalObject): + (JSC::JSNonFinalObject::finishCreation): + (JSFinalObject): + (JSC::JSFinalObject::finishCreation): + (JSC::JSObject::offsetOfInlineStorage): + (JSC::JSObject::setPropertyStorage): + (JSC::Structure::isUsingInlineStorage): + (JSC::JSObject::putDirectInternal): + (JSC::JSObject::putDirectWithoutTransition): + (JSC::JSObject::transitionTo): + * runtime/Structure.cpp: + (JSC::Structure::Structure): + (JSC): + (JSC::Structure::growPropertyStorageCapacity): + (JSC::Structure::suggestedNewPropertyStorageSize): + * runtime/Structure.h: + (JSC::Structure::shouldGrowPropertyStorage): + (JSC::Structure::propertyStorageSize): + +2012-06-29 Mark Hahnenberg + + Remove warning about protected values when the Heap is being destroyed + https://bugs.webkit.org/show_bug.cgi?id=90302 + + Reviewed by Geoffrey Garen. + + Having to do book-keeping about whether values allocated from a certain + VM are or are not protected makes the JSC API much more difficult to use + correctly. Clients should be able to throw an entire VM away and not have + to worry about unprotecting all of the values that they protected earlier. + + * heap/Heap.cpp: + (JSC::Heap::lastChanceToFinalize): + +2012-06-29 Filip Pizlo + + JSObject wastes too much memory on unused property slots + https://bugs.webkit.org/show_bug.cgi?id=90255 + + Reviewed by Mark Hahnenberg. + + This does a few things: + + - JSNonFinalObject no longer has inline property storage. + + - Initial out-of-line property storage size is 4 slots for JSNonFinalObject, + or 2x the inline storage for JSFinalObject. + + - Property storage is only reallocated if it needs to be. Previously, we + would reallocate the property storage on any transition where the original + structure said shouldGrowProperyStorage(), but this led to spurious + reallocations when doing transitionless property adds and there are + deleted property slots available. That in turn led to crashes, because we + would switch to out-of-line storage even if the capacity matched the + criteria for inline storage. + + - Inline JSFunction allocation is killed off because we don't have a good + way of inlining property storage allocation. This didn't hurt performance. + Killing off code is better than fixing it if that code wasn't doing any + good. + + This looks like a 1% progression on V8. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + * jit/JIT.cpp: + (JSC::JIT::privateCompileSlowCases): + * jit/JIT.h: + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateBasicJSObject): + (JSC): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_new_func): + (JSC): + (JSC::JIT::emit_op_new_func_exp): + * runtime/JSFunction.cpp: + (JSC::JSFunction::finishCreation): + * runtime/JSObject.h: + (JSC::JSObject::isUsingInlineStorage): + (JSObject): + (JSC::JSObject::finishCreation): + (JSC): + (JSC::JSNonFinalObject::hasInlineStorage): + (JSNonFinalObject): + (JSC::JSNonFinalObject::JSNonFinalObject): + (JSC::JSNonFinalObject::finishCreation): + (JSC::JSFinalObject::hasInlineStorage): + (JSC::JSFinalObject::finishCreation): + (JSC::JSObject::offsetOfInlineStorage): + (JSC::JSObject::setPropertyStorage): + (JSC::Structure::inlineStorageCapacity): + (JSC::Structure::isUsingInlineStorage): + (JSC::JSObject::putDirectInternal): + (JSC::JSObject::setStructureAndReallocateStorageIfNecessary): + (JSC::JSObject::putDirectWithoutTransition): + * runtime/Structure.cpp: + (JSC::Structure::Structure): + (JSC::nextPropertyStorageCapacity): + (JSC): + (JSC::Structure::growPropertyStorageCapacity): + (JSC::Structure::suggestedNewPropertyStorageSize): + * runtime/Structure.h: + (JSC::Structure::putWillGrowPropertyStorage): + (Structure): + +2012-06-28 Filip Pizlo + + DFG recompilation heuristics should be based on count, not rate + https://bugs.webkit.org/show_bug.cgi?id=90146 + + Reviewed by Oliver Hunt. + + This removes a bunch of code that was previously trying to prevent spurious + reoptimizations if a large enough majority of executions of a code block did + not result in OSR exit. It turns out that this code was purely harmful. This + patch removes all of that logic and replaces it with a dead-simple + heuristic: if you exit more than N times (where N is an exponential function + of the number of times the code block has already been recompiled) then we + will recompile. + + This appears to be a broad ~1% win on many benchmarks large and small. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::CodeBlock): + * bytecode/CodeBlock.h: + (JSC::CodeBlock::osrExitCounter): + (JSC::CodeBlock::countOSRExit): + (CodeBlock): + (JSC::CodeBlock::addressOfOSRExitCounter): + (JSC::CodeBlock::offsetOfOSRExitCounter): + (JSC::CodeBlock::adjustedExitCountThreshold): + (JSC::CodeBlock::exitCountThresholdForReoptimization): + (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop): + (JSC::CodeBlock::shouldReoptimizeNow): + (JSC::CodeBlock::shouldReoptimizeFromLoopNow): + * bytecode/ExecutionCounter.cpp: + (JSC::ExecutionCounter::setThreshold): + * bytecode/ExecutionCounter.h: + (ExecutionCounter): + (JSC::ExecutionCounter::clippedThreshold): + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::compileBody): + * dfg/DFGOSRExit.cpp: + (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow): + * dfg/DFGOSRExitCompiler.cpp: + (JSC::DFG::OSRExitCompiler::handleExitCounts): + * dfg/DFGOperations.cpp: + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * runtime/Options.cpp: + (Options): + (JSC::Options::initializeOptions): + * runtime/Options.h: + (Options): + +2012-06-28 Mark Lam + + Adding a commenting utility to record BytecodeGenerator comments + with opcodes that are emitted. Presently, the comments can only + be constant strings. Adding comments for opcodes is optional. + If a comment is added, the comment will be printed following the + opcode when CodeBlock::dump() is called. + + This utility is disabled by default, and is only meant for VM + development purposes. It should not be enabled for product builds. + + To enable this utility, set ENABLE_BYTECODE_COMMENTS in CodeBlock.h + to 1. + + https://bugs.webkit.org/show_bug.cgi?id=90095 + + Reviewed by Geoffrey Garen. + + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dumpBytecodeCommentAndNewLine): Dumps the comment. + (JSC): + (JSC::CodeBlock::printUnaryOp): Add comment dumps. + (JSC::CodeBlock::printBinaryOp): Add comment dumps. + (JSC::CodeBlock::printConditionalJump): Add comment dumps. + (JSC::CodeBlock::printCallOp): Add comment dumps. + (JSC::CodeBlock::printPutByIdOp): Add comment dumps. + (JSC::CodeBlock::dump): Add comment dumps. + (JSC::CodeBlock::CodeBlock): + (JSC::CodeBlock::commentForBytecodeOffset): + Finds the comment for an opcode if available. + (JSC::CodeBlock::dumpBytecodeComments): + For debugging whether comments are collected. + It is not being called anywhere. + * bytecode/CodeBlock.h: + (CodeBlock): + (JSC::CodeBlock::bytecodeComments): + * bytecode/Comment.h: Added. + (JSC): + (Comment): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::BytecodeGenerator): + (JSC::BytecodeGenerator::emitOpcode): Calls emitComment(). + (JSC): + (JSC::BytecodeGenerator::emitComment): Adds comment to CodeBlock. + (JSC::BytecodeGenerator::prependComment): + Registers a comment for emitComemnt() to use later. + * bytecompiler/BytecodeGenerator.h: + (BytecodeGenerator): + (JSC::BytecodeGenerator::emitComment): + (JSC::BytecodeGenerator::prependComment): + These are inlined versions of these functions that nullify them + when ENABLE_BYTECODE_COMMENTS is 0. + (JSC::BytecodeGenerator::comments): + +2012-06-28 Oliver Hunt + + 32bit DFG incorrectly claims an fpr is fillable even if it has not been proven double + https://bugs.webkit.org/show_bug.cgi?id=90127 + + Reviewed by Filip Pizlo. + + The 32-bit version of fillSpeculateDouble doesn't handle Number->fpr loads + correctly. This patch fixes this by killing the fill info in the GenerationInfo + when the spillFormat doesn't guarantee the value is a double. + + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::fillSpeculateDouble): + +2012-06-28 Kent Tamura + + Classify form control states by their owner forms + https://bugs.webkit.org/show_bug.cgi?id=89950 + + Reviewed by Hajime Morita. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + Expose WTF::StringBuilder::canShrink() + +2012-06-27 Michael Saboff + + [Win] jscore-tests flakey + https://bugs.webkit.org/show_bug.cgi?id=88118 + + Reviewed by Jessie Berlin. + + jsDriver.pl on windows intermittently doesn't get the returned value from jsc, + instead it gets 126. Added a new option to jsc (-x) which prints the exit + code before exiting. jsDriver.pl uses this option on Windows and parses the + exit code output for the exit code, removing it before comparing the actual + and expected outputs. Filed a follow on "FIXME" defect: + [WIN] Intermittent failure for jsc return value to propagate through jsDriver.pl + https://bugs.webkit.org/show_bug.cgi?id=90119 + + * jsc.cpp: + (CommandLine::CommandLine): + (CommandLine): + (printUsageStatement): + (parseArguments): + (jscmain): + * tests/mozilla/jsDriver.pl: + (execute_tests): + +2012-06-27 Sheriff Bot + + Unreviewed, rolling out r121359. + http://trac.webkit.org/changeset/121359 + https://bugs.webkit.org/show_bug.cgi?id=90115 + + Broke many inspector tests (Requested by jpfau on #webkit). + + * interpreter/Interpreter.h: + (JSC::StackFrame::toString): + +2012-06-27 Filip Pizlo + + Javascript SHA-512 gives wrong hash on second and subsequent runs unless Web Inspector Javascript Debugging is on + https://bugs.webkit.org/show_bug.cgi?id=90053 + + + Reviewed by Mark Hahnenberg. + + The problem is that the code was assuming that the recovery should be Undefined if the source of + the SetLocal was !shouldGenerate(). But that's wrong, since the DFG optimizer may skip around a + UInt32ToNumber node (hence making it !shouldGenerate()) and keep the source of that node alive. + In that case we should base the recovery on the source of the UInt32ToNumber. The logic for this + was already in place but the fast check for !shouldGenerate() broke it. + + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor): + +2012-06-27 Filip Pizlo + + DFG disassembly should be easier to read + https://bugs.webkit.org/show_bug.cgi?id=90106 + + Reviewed by Mark Hahnenberg. + + Did a few things: + + - Options::showDFGDisassembly now shows OSR exit disassembly as well. + + - Phi node dumping doesn't attempt to do line wrapping since it just made the dump harder + to read. + + - DFG graph disassembly view shows a few additional node types that turn out to be + essential for understanding OSR exits. + + Put together, these changes reinforce the philosophy that anything needed for computing + OSR exit is just as important as the machine code itself. Of course, we still don't take + that philosophy to its full extreme - for example Phantom nodes are not dumped. We may + revisit that in the future. + + * assembler/LinkBuffer.cpp: + (JSC::LinkBuffer::finalizeCodeWithDisassembly): + * assembler/LinkBuffer.h: + (JSC): + * dfg/DFGDisassembler.cpp: + (JSC::DFG::Disassembler::dump): + * dfg/DFGGraph.cpp: + (JSC::DFG::Graph::dumpBlockHeader): + * dfg/DFGNode.h: + (JSC::DFG::Node::willHaveCodeGenOrOSR): + * dfg/DFGOSRExitCompiler.cpp: + * jit/JIT.cpp: + (JSC::JIT::privateCompile): + +2012-06-25 Mark Hahnenberg + + JSLock should be per-JSGlobalData + https://bugs.webkit.org/show_bug.cgi?id=89123 + + Reviewed by Geoffrey Garen. + + * API/APIShims.h: + (APIEntryShimWithoutLock): + (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to + determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the + HeapTimer class because timerDidFire could run after somebody has started to tear down that particular + JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after + its destruction has begun. + (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock): + (JSC::APIEntryShim::APIEntryShim): + (APIEntryShim): + (JSC::APIEntryShim::~APIEntryShim): + (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors. + Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock + and before we've released it, which can only done in APIEntryShim. + (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here. + * API/JSContextRef.cpp: + (JSGlobalContextCreate): + (JSGlobalContextCreateInGroup): + (JSGlobalContextRelease): + (JSContextCreateBacktrace): + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + * heap/CopiedSpace.cpp: + (JSC::CopiedSpace::tryAllocateSlowCase): + * heap/Heap.cpp: + (JSC::Heap::protect): + (JSC::Heap::unprotect): + (JSC::Heap::collect): + (JSC::Heap::setActivityCallback): + (JSC::Heap::activityCallback): + (JSC::Heap::sweeper): + * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they + are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback + and the IncrementalSweeper to make sure they're the last things that get initialized during construction to + prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about. + (Heap): + * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown. + (JSC::HeapTimer::~HeapTimer): + (JSC::HeapTimer::invalidate): + (JSC): + (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread + that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the + HeapTimer and schedule it to fire immediately so that it can notice and kill itself. + (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed + out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim, + but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case + we were interrupted between releasing our mutex and trying to grab the APILock. + * heap/HeapTimer.h: + (HeapTimer): + * heap/IncrementalSweeper.cpp: + (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles + all of that for us. + (JSC::IncrementalSweeper::create): + * heap/IncrementalSweeper.h: + (IncrementalSweeper): + * heap/MarkedAllocator.cpp: + (JSC::MarkedAllocator::allocateSlowCase): + * heap/WeakBlock.cpp: + (JSC::WeakBlock::reap): + * jsc.cpp: + (functionGC): + (functionReleaseExecutableMemory): + (jscmain): + * runtime/Completion.cpp: + (JSC::checkSyntax): + (JSC::evaluate): + * runtime/GCActivityCallback.h: + (DefaultGCActivityCallback): + (JSC::DefaultGCActivityCallback::create): + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::JSGlobalData): + (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper) + that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity + it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the + APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes. + (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock. + (JSC::JSGlobalData::sharedInstanceInternal): + * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and + de-refing JSGlobalDatas on separate threads since we don't do it that often anyways. + (JSGlobalData): + (JSC::JSGlobalData::apiLock): + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::~JSGlobalObject): + (JSC::JSGlobalObject::init): + * runtime/JSLock.cpp: + (JSC): + (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance. + (JSC::GlobalJSLock::~GlobalJSLock): + (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that + it can successfully unlock it later without it disappearing from underneath it. + (JSC::JSLockHolder::~JSLockHolder): + (JSC::JSLock::JSLock): + (JSC::JSLock::~JSLock): + (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for + actually waiting for long periods. + (JSC::JSLock::unlock): + (JSC::JSLock::currentThreadIsHoldingLock): + (JSC::JSLock::dropAllLocks): + (JSC::JSLock::dropAllLocksUnconditionally): + (JSC::JSLock::grabAllLocks): + (JSC::JSLock::DropAllLocks::DropAllLocks): + (JSC::JSLock::DropAllLocks::~DropAllLocks): + * runtime/JSLock.h: + (JSC): + (GlobalJSLock): + (JSLockHolder): + (JSLock): + (DropAllLocks): + * runtime/WeakGCMap.h: + (JSC::WeakGCMap::set): + * testRegExp.cpp: + (realMain): + +2012-06-27 Filip Pizlo + + x86 disassembler confuses immediates with addresses + https://bugs.webkit.org/show_bug.cgi?id=90099 + + Reviewed by Mark Hahnenberg. + + Prepend "$" to immediates to disambiguate between immediates and addresses. This is in + accordance with the gas and AT&T syntax. + + * disassembler/udis86/udis86_syn-att.c: + (gen_operand): + +2012-06-27 Filip Pizlo + + Add a comment clarifying Options::showDisassembly versus Options::showDFGDisassembly. + + Rubber stamped by Mark Hahnenberg. + + * runtime/Options.cpp: + (JSC::Options::initializeOptions): + +2012-06-27 Anthony Scian + + Web Inspector [JSC]: Implement ScriptCallStack::stackTrace + https://bugs.webkit.org/show_bug.cgi?id=40118 + + Reviewed by Yong Li. + + Added member functions to expose function name, urlString, and line #. + Refactored toString to make use of these member functions to reduce + duplicated code for future maintenance. + + Manually tested refactoring of toString by tracing thrown exceptions. + + * interpreter/Interpreter.h: + (StackFrame): + (JSC::StackFrame::toString): + (JSC::StackFrame::friendlySourceURL): + (JSC::StackFrame::friendlyFunctionName): + (JSC::StackFrame::friendlyLineNumber): + +2012-06-27 Oswald Buddenhagen + + [Qt] Remove redundant c++11 warning suppression code + + This is already handled in default_post. + + Reviewed by Tor Arne Vestbø. + + * Target.pri: + +2012-06-26 Tor Arne Vestbø + + [Qt] Add missing heades to HEADERS + + For JavaScriptCore there aren't any Qt specific files, so we include all + headers for easy editing in Qt Creator. + + Reviewed by Simon Hausmann. + + * Target.pri: + +2012-06-26 Dominic Cooney + + [Chromium] Remove unused build scripts and empty folders for JavaScriptCore w/ gyp + https://bugs.webkit.org/show_bug.cgi?id=90029 + + Reviewed by Adam Barth. + + * gyp: Removed. + * gyp/generate-derived-sources.sh: Removed. + * gyp/generate-dtrace-header.sh: Removed. + * gyp/run-if-exists.sh: Removed. + * gyp/update-info-plist.sh: Removed. + +2012-06-26 Geoffrey Garen + + Reduced (but did not eliminate) use of "berzerker GC" + https://bugs.webkit.org/show_bug.cgi?id=89237 + + Reviewed by Gavin Barraclough. + + (PART 2) + + This part turns off "berzerker GC" and turns on incremental shrinking. + + * heap/IncrementalSweeper.cpp: + (JSC::IncrementalSweeper::doSweep): Free or shrink after sweeping to + maintain the behavior we used to get from the occasional berzerker GC, + which would run all finalizers and then free or shrink all blocks + synchronously. + + * heap/MarkedBlock.h: + (JSC::MarkedBlock::needsSweeping): Sweep zapped blocks, too. It's always + safe to sweep a zapped block (that's the point of zapping), and it's + sometimes profitable. For example, consider this case: Block A does some + allocation (transitioning Block A from Marked to FreeListed), then GC + happens (transitioning Block A to Zapped), then all objects in Block A + are free, then the incremental sweeper visits Block A. If we skipped + Zapped blocks, we'd skip Block A, even though it would be profitable to + run its destructors and free its memory. + + * runtime/GCActivityCallback.cpp: + (JSC::DefaultGCActivityCallback::doWork): Don't sweep eagerly; we'll do + this incrementally. + +2012-06-26 Filip Pizlo + + DFG PutByValAlias is too aggressive + https://bugs.webkit.org/show_bug.cgi?id=90026 + + + Reviewed by Gavin Barraclough. + + For CSE on normal arrays, we now treat PutByVal as impure. This does not appear to affect + performance by much. + + For CSE on typed arrays, we fix PutByValAlias by making GetByVal speculate that the access + is within bounds. This also has the effect of making our out-of-bounds handling consistent + with WebCore. + + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::byValIsPure): + (JSC::DFG::Graph::clobbersWorld): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): + (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): + +2012-06-26 Yong Li + + [BlackBerry] Add JSC statistics into about:memory + https://bugs.webkit.org/show_bug.cgi?id=89779 + + Reviewed by Rob Buis. + + Fix non-JIT build on BlackBerry broken by r121196. + + * runtime/MemoryStatistics.cpp: + (JSC::globalMemoryStatistics): + +2012-06-25 Filip Pizlo + + DFG::operationNewArray is unnecessarily slow, and may use the wrong array + prototype when inlined + https://bugs.webkit.org/show_bug.cgi?id=89821 + + Reviewed by Geoffrey Garen. + + Fixes all array allocations to use the right structure, and hence the right prototype. Adds + inlining of new Array(...) with a non-zero number of arguments. Optimizes allocations of + empty arrays. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::handleConstantInternalFunction): + * dfg/DFGCCallHelpers.h: + (JSC::DFG::CCallHelpers::setupArgumentsWithExecState): + (CCallHelpers): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * runtime/JSArray.h: + (JSC): + (JSC::constructArray): + * runtime/JSGlobalObject.h: + (JSC): + (JSC::constructArray): + +2012-06-26 Filip Pizlo + + New fast/js/dfg-store-unexpected-value-into-argument-and-osr-exit.html fails on 32 bit + https://bugs.webkit.org/show_bug.cgi?id=89953 + + Reviewed by Zoltan Herczeg. + + DFG 32-bit JIT was confused about the difference between a predicted type and a + proven type. This is easy to get confused about, since a local that is predicted int32 + almost always means that the local must be an int32 since speculations are hoisted to + stores to locals. But that is less likely to be the case for arguments, where there is + an additional least-upper-bounding step: any store to an argument with a weird type + may force the argument to be any type. + + This patch basically duplicates the functionality in DFGSpeculativeJIT64.cpp for + GetLocal: the decision of whether to load a local as an int32 (or as an array, or as + a boolean) is made based on the AbstractValue::m_type, which is a type proof, rather + than the VariableAccessData::prediction(), which is a predicted type. + + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-06-25 Filip Pizlo + + JSC should try to make profiling deterministic because otherwise reproducing failures is + nearly impossible + https://bugs.webkit.org/show_bug.cgi?id=89940 + + Rubber stamped by Gavin Barraclough. + + This rolls out the part of http://trac.webkit.org/changeset/121215 that introduced randomness + into the system. Now, instead of randomizing the tier-up threshold, we always set it to an + artificially low (and statically predetermined!) value. This gives most of the benefit of + threshold randomization without actually making the system behave completely differently on + each invocation. + + * bytecode/ExecutionCounter.cpp: + (JSC::ExecutionCounter::setThreshold): + * runtime/Options.cpp: + (Options): + (JSC::Options::initializeOptions): + * runtime/Options.h: + (Options): + +2012-06-22 Filip Pizlo + + Value profiling should use tier-up threshold randomization to get more coverage + https://bugs.webkit.org/show_bug.cgi?id=89802 + + Reviewed by Gavin Barraclough. + + This patch causes both LLInt and Baseline JIT code to take the OSR slow path several + times before actually doing OSR. If we take the OSR slow path before the execution + count threshold is reached, then we just call CodeBlock::updateAllPredictions() to + compute the current latest least-upper-bound SpecType of all values seen in each + ValueProfile. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::stronglyVisitStrongReferences): + (JSC::CodeBlock::updateAllPredictionsAndCountLiveness): + (JSC): + (JSC::CodeBlock::updateAllPredictions): + (JSC::CodeBlock::shouldOptimizeNow): + * bytecode/CodeBlock.h: + (JSC::CodeBlock::llintExecuteCounter): + (JSC::CodeBlock::jitExecuteCounter): + (CodeBlock): + (JSC::CodeBlock::updateAllPredictions): + * bytecode/ExecutionCounter.cpp: + (JSC::ExecutionCounter::setThreshold): + (JSC::ExecutionCounter::status): + (JSC): + * bytecode/ExecutionCounter.h: + (JSC::ExecutionCounter::count): + (ExecutionCounter): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGOperations.cpp: + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::jitCompileAndSetHeuristics): + (JSC::LLInt::entryOSR): + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::JSGlobalObject): + (JSC): + * runtime/JSGlobalObject.h: + (JSGlobalObject): + (JSC::JSGlobalObject::weakRandomInteger): + * runtime/Options.cpp: + (Options): + (JSC::Options::initializeOptions): + * runtime/Options.h: + (Options): + * runtime/WeakRandom.h: + (WeakRandom): + (JSC::WeakRandom::seedUnsafe): + +2012-06-25 Yong Li + + [BlackBerry] Add JSC statistics into about:memory + https://bugs.webkit.org/show_bug.cgi?id=89779 + + Reviewed by Rob Buis. + + Add MemoryStatistics.cpp into build, and fill JITBytes for BlackBerry port. + + * PlatformBlackBerry.cmake: + * runtime/MemoryStatistics.cpp: + (JSC::globalMemoryStatistics): + +2012-06-23 Sheriff Bot + + Unreviewed, rolling out r121058. + http://trac.webkit.org/changeset/121058 + https://bugs.webkit.org/show_bug.cgi?id=89809 + + Patch causes plugins tests to crash in GTK debug builds + (Requested by zdobersek on #webkit). + + * API/APIShims.h: + (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): + (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock): + (APIEntryShimWithoutLock): + (JSC::APIEntryShim::APIEntryShim): + (APIEntryShim): + (JSC::APICallbackShim::~APICallbackShim): + * API/JSContextRef.cpp: + (JSGlobalContextCreate): + (JSGlobalContextCreateInGroup): + (JSGlobalContextRelease): + (JSContextCreateBacktrace): + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + * heap/CopiedSpace.cpp: + (JSC::CopiedSpace::tryAllocateSlowCase): + * heap/Heap.cpp: + (JSC::Heap::protect): + (JSC::Heap::unprotect): + (JSC::Heap::collect): + (JSC::Heap::setActivityCallback): + (JSC::Heap::activityCallback): + (JSC::Heap::sweeper): + * heap/Heap.h: + (Heap): + * heap/HeapTimer.cpp: + (JSC::HeapTimer::~HeapTimer): + (JSC::HeapTimer::invalidate): + (JSC::HeapTimer::timerDidFire): + (JSC): + * heap/HeapTimer.h: + (HeapTimer): + * heap/IncrementalSweeper.cpp: + (JSC::IncrementalSweeper::doWork): + (JSC::IncrementalSweeper::create): + * heap/IncrementalSweeper.h: + (IncrementalSweeper): + * heap/MarkedAllocator.cpp: + (JSC::MarkedAllocator::allocateSlowCase): + * heap/WeakBlock.cpp: + (JSC::WeakBlock::reap): + * jsc.cpp: + (functionGC): + (functionReleaseExecutableMemory): + (jscmain): + * runtime/Completion.cpp: + (JSC::checkSyntax): + (JSC::evaluate): + * runtime/GCActivityCallback.h: + (DefaultGCActivityCallback): + (JSC::DefaultGCActivityCallback::create): + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::JSGlobalData): + (JSC::JSGlobalData::~JSGlobalData): + (JSC::JSGlobalData::sharedInstance): + (JSC::JSGlobalData::sharedInstanceInternal): + * runtime/JSGlobalData.h: + (JSGlobalData): + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::~JSGlobalObject): + (JSC::JSGlobalObject::init): + * runtime/JSLock.cpp: + (JSC): + (JSC::createJSLockCount): + (JSC::JSLock::lockCount): + (JSC::setLockCount): + (JSC::JSLock::JSLock): + (JSC::JSLock::lock): + (JSC::JSLock::unlock): + (JSC::JSLock::currentThreadIsHoldingLock): + (JSC::JSLock::DropAllLocks::DropAllLocks): + (JSC::JSLock::DropAllLocks::~DropAllLocks): + * runtime/JSLock.h: + (JSC): + (JSLock): + (JSC::JSLock::JSLock): + (JSC::JSLock::~JSLock): + (DropAllLocks): + * runtime/WeakGCMap.h: + (JSC::WeakGCMap::set): + * testRegExp.cpp: + (realMain): + +2012-06-22 Alexandru Chiculita + + [CSS Shaders] Re-enable the CSS Shaders compile time flag on Safari Mac + https://bugs.webkit.org/show_bug.cgi?id=89781 + + Reviewed by Dean Jackson. + + Added ENABLE_CSS_SHADERS flag as enabled by default on Safari for Mac. + + * Configurations/FeatureDefines.xcconfig: + +2012-06-22 Filip Pizlo + + DFG tier-up should happen in prologues, not epilogues + https://bugs.webkit.org/show_bug.cgi?id=89752 + + Reviewed by Geoffrey Garen. + + This change has two outcomes: + + 1) Slightly reduces the likelihood that a function will be optimized both + standalone and via inlining. Previously, if you had a call sequence like foo() + calls bar() exactly once, and nobody else calls bar(), then bar() would get + optimized first (because it returns first) and then foo() gets optimized. If foo() + can inline bar() then that means that bar() gets optimized twice. But now, if we + optimize in prologues, then foo() will be optimized first. If it inlines bar(), + that means that there will no longer be any calls to bar(). + + 2) It lets us kill some code in JITStubs. Epilogue tier-up was very different from + loop tier-up, since epilogue tier-up should not attempt OSR. But prologue tier-up + requires OSR (albeit really easy OSR since it's the top of the compilation unit), + so it becomes just like loop tier-up. As a result, we now have one optimization + hook (cti_optimize) instead of two (cti_optimize_from_loop and + cti_optimize_from_ret). + + As a consequence of not having an optimization check in epilogues, the OSR exit + code must now trigger reoptimization itself instead of just signaling the epilogue + check to fire. + + This also adds the ability to count the number of DFG compilations, which was + useful for debugging this patch and might be useful for other things in the future. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::reoptimize): + (JSC): + * bytecode/CodeBlock.h: + (CodeBlock): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseCodeBlock): + * dfg/DFGDriver.cpp: + (DFG): + (JSC::DFG::getNumCompilations): + (JSC::DFG::compile): + * dfg/DFGDriver.h: + (DFG): + * dfg/DFGOSRExitCompiler.cpp: + (JSC::DFG::OSRExitCompiler::handleExitCounts): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * jit/JIT.cpp: + (JSC::JIT::emitOptimizationCheck): + * jit/JIT.h: + * jit/JITCall32_64.cpp: + (JSC::JIT::emit_op_ret): + (JSC::JIT::emit_op_ret_object_or_this): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_ret): + (JSC::JIT::emit_op_ret_object_or_this): + (JSC::JIT::emit_op_enter): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_enter): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + * jit/JITStubs.h: + +2012-06-20 Mark Hahnenberg + + JSLock should be per-JSGlobalData + https://bugs.webkit.org/show_bug.cgi?id=89123 + + Reviewed by Gavin Barraclough. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + * API/APIShims.h: + (APIEntryShimWithoutLock): + (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to + determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the + HeapTimer class because timerDidFire could run after somebody has started to tear down that particular + JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after + its destruction has begun. + (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock): Now derefs if it also refed. + (JSC::APIEntryShim::APIEntryShim): + (APIEntryShim): + (JSC::APIEntryShim::~APIEntryShim): + (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors. + Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock + and before we've released it, which can only done in APIEntryShim. + (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here. + * API/JSContextRef.cpp: + (JSGlobalContextCreate): + (JSGlobalContextCreateInGroup): + (JSGlobalContextRelease): + (JSContextCreateBacktrace): + * heap/CopiedSpace.cpp: + (JSC::CopiedSpace::tryAllocateSlowCase): + * heap/Heap.cpp: + (JSC::Heap::protect): + (JSC::Heap::unprotect): + (JSC::Heap::collect): + (JSC::Heap::setActivityCallback): + (JSC::Heap::activityCallback): + (JSC::Heap::sweeper): + * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they + are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback + and the IncrementalSweeper to make sure they're the last things that get initialized during construction to + prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about. + (Heap): + * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown. + (JSC::HeapTimer::~HeapTimer): + (JSC::HeapTimer::invalidate): + (JSC): + (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread + that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the + HeapTimer and schedule it to fire immediately so that it can notice and kill itself. + (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed + out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim, + but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case + we were interrupted between releasing our mutex and trying to grab the APILock. + * heap/HeapTimer.h: + (HeapTimer): + * heap/IncrementalSweeper.cpp: + (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles + all of that for us. + (JSC::IncrementalSweeper::create): + * heap/IncrementalSweeper.h: + (IncrementalSweeper): + * heap/MarkedAllocator.cpp: + (JSC::MarkedAllocator::allocateSlowCase): + * heap/WeakBlock.cpp: + (JSC::WeakBlock::reap): + * jsc.cpp: + (functionGC): + (functionReleaseExecutableMemory): + (jscmain): + * runtime/Completion.cpp: + (JSC::checkSyntax): + (JSC::evaluate): + * runtime/GCActivityCallback.h: + (DefaultGCActivityCallback): + (JSC::DefaultGCActivityCallback::create): + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::JSGlobalData): + (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper) + that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity + it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the + APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes. + (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock. + (JSC::JSGlobalData::sharedInstanceInternal): + * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and + de-refing JSGlobalDatas on separate threads since we don't do it that often anyways. + (JSGlobalData): + (JSC::JSGlobalData::apiLock): + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::~JSGlobalObject): + (JSC::JSGlobalObject::init): + * runtime/JSLock.cpp: + (JSC): + (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance. + (JSC::GlobalJSLock::~GlobalJSLock): + (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that + it can successfully unlock it later without it disappearing from underneath it. + (JSC::JSLockHolder::~JSLockHolder): + (JSC::JSLock::JSLock): + (JSC::JSLock::~JSLock): + (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for + actually waiting for long periods. + (JSC::JSLock::unlock): + (JSC::JSLock::currentThreadIsHoldingLock): + (JSC::JSLock::dropAllLocks): + (JSC::JSLock::dropAllLocksUnconditionally): + (JSC::JSLock::grabAllLocks): + (JSC::JSLock::DropAllLocks::DropAllLocks): + (JSC::JSLock::DropAllLocks::~DropAllLocks): + * runtime/JSLock.h: + (JSC): + (GlobalJSLock): + (JSLockHolder): + (JSLock): + (DropAllLocks): + * runtime/WeakGCMap.h: + (JSC::WeakGCMap::set): + * testRegExp.cpp: + (realMain): + +2012-06-22 Peter Beverloo + + [Chromium] Disable c++0x compatibility warnings in JavaScriptCore.gyp when building for Android + https://bugs.webkit.org/show_bug.cgi?id=88853 + + Reviewed by Steve Block. + + The Android exclusions were necessary to fix a gyp generation error, as + the gcc_version variable wasn't being defined for Android. Remove these + exceptions when Chromium is able to define the gcc_version variable. + + * JavaScriptCore.gyp/JavaScriptCore.gyp: + +2012-06-21 Filip Pizlo + + op_resolve_global should not prevent DFG inlining + https://bugs.webkit.org/show_bug.cgi?id=89726 + + Reviewed by Gavin Barraclough. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::CodeBlock): + (JSC::CodeBlock::shrinkToFit): + * bytecode/GlobalResolveInfo.h: + (JSC::GlobalResolveInfo::GlobalResolveInfo): + (GlobalResolveInfo): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): + * dfg/DFGCapabilities.h: + (JSC::DFG::canInlineOpcode): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-06-20 Filip Pizlo + + DFG should inline 'new Array()' + https://bugs.webkit.org/show_bug.cgi?id=89632 + + Reviewed by Geoffrey Garen. + + This adds support for treating InternalFunction like intrinsics. The code + to do so is actually quite clean, so I don't feel bad about perpetuating + the InternalFunction vs. JSFunction-with-NativeExecutable dichotomy. + + Currently this newfound power is only used to inline 'new Array()'. + + * dfg/DFGByteCodeParser.cpp: + (ByteCodeParser): + (JSC::DFG::ByteCodeParser::handleCall): + (JSC::DFG::ByteCodeParser::handleConstantInternalFunction): + (DFG): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::isInternalFunctionConstant): + (JSC::DFG::Graph::valueOfInternalFunctionConstant): + +2012-06-21 Mark Hahnenberg + + Adding copyrights to new files. + + * heap/HeapTimer.cpp: + * heap/HeapTimer.h: + * heap/IncrementalSweeper.cpp: + * heap/IncrementalSweeper.h: + +2012-06-21 Arnaud Renevier + + make sure headers are included only once per file + https://bugs.webkit.org/show_bug.cgi?id=88922 + + Reviewed by Alexey Proskuryakov. + + * bytecode/CodeBlock.h: + * heap/MachineStackMarker.cpp: + * runtime/JSVariableObject.h: + +2012-06-21 Ryuan Choi + + [EFL][WK2] Make WebKit2/Efl headers and resources installable. + https://bugs.webkit.org/show_bug.cgi?id=88207 + + Reviewed by Chang Shu. + + * shell/CMakeLists.txt: Use ${EXEC_INSTALL_DIR} instead of hardcoding "bin" + +2012-06-20 Geoffrey Garen + + Reduced (but did not eliminate) use of "berzerker GC" + https://bugs.webkit.org/show_bug.cgi?id=89237 + + Reviewed by Gavin Barraclough. + + (PART 1) + + This patch turned out to be crashy, so I'm landing the non-crashy bits + first. + + This part is pre-requisite refactoring. I didn't actually turn off + "berzerker GC" or turn on incremental shrinking. + + * heap/MarkedAllocator.cpp: + (JSC::MarkedAllocator::removeBlock): Make sure to clear the free list when + we throw away the block we're currently allocating out of. Otherwise, we'll + allocate out of a stale free list. + + * heap/MarkedSpace.cpp: + (JSC::Free::Free): + (JSC::Free::operator()): + (JSC::Free::returnValue): Refactored this functor to use a shared helper + function, so we can share our implementation with the incremental sweeper. + + Also changed to freeing individual blocks immediately instead of linking + them into a list for later freeing. This makes the programming interface + simpler, and it's slightly more efficient to boot. + + (JSC::MarkedSpace::~MarkedSpace): Updated for rename. + + (JSC::MarkedSpace::freeBlock): + (JSC::MarkedSpace::freeOrShrinkBlock): New helper functions to share behavior + with the incremental sweeper. + + (JSC::MarkedSpace::shrink): Updated for new functor behavior. + + * heap/MarkedSpace.h: Statically typed languages are awesome. + +2012-06-20 Filip Pizlo + + DFG should optimize ResolveGlobal + https://bugs.webkit.org/show_bug.cgi?id=89617 + + Reviewed by Oliver Hunt. + + This adds inlining of ResolveGlobal accesses that are known monomorphic. It also + adds the specific function optimization to ResolveGlobal, when it is inlined. And, + it makes internal functions act like specific functions, since that will be the + most common use-case of this optimization. + + This is only a slighy speed-up (sub 1%), since we don't yet do the obvious thing + with this optimization, which is to completely inline common "globally resolved" + function and constructor calls, like "new Array()". + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::globalResolveInfoForBytecodeOffset): + * bytecode/CodeBlock.h: + (CodeBlock): + (JSC::CodeBlock::numberOfGlobalResolveInfos): + * bytecode/GlobalResolveInfo.h: + (JSC::getGlobalResolveInfoBytecodeOffset): + (JSC): + * bytecode/ResolveGlobalStatus.cpp: Added. + (JSC): + (JSC::computeForStructure): + (JSC::computeForLLInt): + (JSC::ResolveGlobalStatus::computeFor): + * bytecode/ResolveGlobalStatus.h: Added. + (JSC): + (ResolveGlobalStatus): + (JSC::ResolveGlobalStatus::ResolveGlobalStatus): + (JSC::ResolveGlobalStatus::state): + (JSC::ResolveGlobalStatus::isSet): + (JSC::ResolveGlobalStatus::operator!): + (JSC::ResolveGlobalStatus::isSimple): + (JSC::ResolveGlobalStatus::takesSlowPath): + (JSC::ResolveGlobalStatus::structure): + (JSC::ResolveGlobalStatus::offset): + (JSC::ResolveGlobalStatus::specificValue): + * dfg/DFGByteCodeParser.cpp: + (ByteCodeParser): + (JSC::DFG::ByteCodeParser::handleGetByOffset): + (DFG): + (JSC::DFG::ByteCodeParser::handleGetById): + (JSC::DFG::ByteCodeParser::parseBlock): + * runtime/JSObject.cpp: + (JSC::getCallableObjectSlow): + (JSC): + (JSC::JSObject::put): + (JSC::JSObject::putDirectVirtual): + (JSC::JSObject::putDirectAccessor): + * runtime/JSObject.h: + (JSC): + (JSC::getCallableObject): + (JSC::JSObject::putOwnDataProperty): + (JSC::JSObject::putDirect): + (JSC::JSObject::putDirectWithoutTransition): + +2012-06-20 Filip Pizlo + + Functions on global objects should be specializable + https://bugs.webkit.org/show_bug.cgi?id=89615 + + Reviewed by Oliver Hunt. + + I tested to see if this brought back the bug in https://bugs.webkit.org/show_bug.cgi?id=33343, + and it didn't. Bug 33343 was the reason why we disabled global object function specialization + to begin with. So I'm guessing this is safe. + + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::init): + +2012-06-20 Filip Pizlo + + build-webkit failure due to illegal 32-bit integer constants in code + generated by offlineasm + https://bugs.webkit.org/show_bug.cgi?id=89347 + + Reviewed by Geoffrey Garen. + + The offending constants are the magic numbers used by offlineasm to find + offsets in the generated machine code. Added code to turn them into what + the C++ compiler will believe to be valid 32-bit values. + + * offlineasm/offsets.rb: + +2012-06-19 Geoffrey Garen + + Made the incremental sweeper more aggressive + https://bugs.webkit.org/show_bug.cgi?id=89527 + + Reviewed by Oliver Hunt. + + This is a pre-requisite to getting rid of "berzerker GC" because we need + the sweeper to reclaim memory in a timely fashion, or we'll see a memory + footprint regression. + + * heap/IncrementalSweeper.h: + * heap/IncrementalSweeper.cpp: + (JSC::IncrementalSweeper::scheduleTimer): Since the time slice is predictable, + no need to use a data member to record it. + + (JSC::IncrementalSweeper::doSweep): Sweep as many blocks as we can in a + small time slice. This is better than sweeping only one block per timer + fire because that strategy has a heavy timer overhead, and artificially + delays memory reclamation. + +2012-06-20 Filip Pizlo + + DFG should be able to print disassembly interleaved with the IR + https://bugs.webkit.org/show_bug.cgi?id=89551 + + Reviewed by Geoffrey Garen. + + This change also removes running Dominators unconditionally on every DFG + compile. Dominators are designed to be computed on-demand, and currently + the only demand is graph dumps. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * assembler/ARMv7Assembler.h: + (JSC::ARMv7Assembler::labelIgnoringWatchpoints): + (ARMv7Assembler): + * assembler/AbstractMacroAssembler.h: + (AbstractMacroAssembler): + (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints): + * assembler/X86Assembler.h: + (X86Assembler): + (JSC::X86Assembler::labelIgnoringWatchpoints): + * dfg/DFGCommon.h: + (JSC::DFG::shouldShowDisassembly): + (DFG): + * dfg/DFGDisassembler.cpp: Added. + (DFG): + (JSC::DFG::Disassembler::Disassembler): + (JSC::DFG::Disassembler::dump): + (JSC::DFG::Disassembler::dumpDisassembly): + * dfg/DFGDisassembler.h: Added. + (DFG): + (Disassembler): + (JSC::DFG::Disassembler::setStartOfCode): + (JSC::DFG::Disassembler::setForBlock): + (JSC::DFG::Disassembler::setForNode): + (JSC::DFG::Disassembler::setEndOfMainPath): + (JSC::DFG::Disassembler::setEndOfCode): + * dfg/DFGDriver.cpp: + (JSC::DFG::compile): + * dfg/DFGGraph.cpp: + (JSC::DFG::Graph::dumpCodeOrigin): + (JSC::DFG::Graph::amountOfNodeWhiteSpace): + (DFG): + (JSC::DFG::Graph::printNodeWhiteSpace): + (JSC::DFG::Graph::dump): + (JSC::DFG::Graph::dumpBlockHeader): + * dfg/DFGGraph.h: + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::JITCompiler): + (DFG): + (JSC::DFG::JITCompiler::compile): + (JSC::DFG::JITCompiler::compileFunction): + * dfg/DFGJITCompiler.h: + (JITCompiler): + (JSC::DFG::JITCompiler::setStartOfCode): + (JSC::DFG::JITCompiler::setForBlock): + (JSC::DFG::JITCompiler::setForNode): + (JSC::DFG::JITCompiler::setEndOfMainPath): + (JSC::DFG::JITCompiler::setEndOfCode): + * dfg/DFGNode.h: + (Node): + (JSC::DFG::Node::willHaveCodeGen): + * dfg/DFGNodeFlags.cpp: + (JSC::DFG::nodeFlagsAsString): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + * runtime/Options.cpp: + (Options): + (JSC::Options::initializeOptions): + * runtime/Options.h: + (Options): + +2012-06-19 Filip Pizlo + + JSC should be able to show disassembly for all generated JIT code + https://bugs.webkit.org/show_bug.cgi?id=89536 + + Reviewed by Gavin Barraclough. + + Now instead of doing linkBuffer.finalizeCode(), you do + FINALIZE_CODE(linkBuffer, (... explanation ...)). FINALIZE_CODE() then + prints your explanation and the disassembled code, if + Options::showDisassembly is set to true. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * assembler/LinkBuffer.cpp: Added. + (JSC): + (JSC::LinkBuffer::finalizeCodeWithoutDisassembly): + (JSC::LinkBuffer::finalizeCodeWithDisassembly): + (JSC::LinkBuffer::linkCode): + (JSC::LinkBuffer::performFinalization): + (JSC::LinkBuffer::dumpLinkStatistics): + (JSC::LinkBuffer::dumpCode): + * assembler/LinkBuffer.h: + (LinkBuffer): + (JSC): + * assembler/MacroAssemblerCodeRef.h: + (JSC::MacroAssemblerCodeRef::tryToDisassemble): + (MacroAssemblerCodeRef): + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::compile): + (JSC::DFG::JITCompiler::compileFunction): + * dfg/DFGOSRExitCompiler.cpp: + * dfg/DFGRepatch.cpp: + (JSC::DFG::generateProtoChainAccessStub): + (JSC::DFG::tryCacheGetByID): + (JSC::DFG::tryBuildGetByIDList): + (JSC::DFG::emitPutReplaceStub): + (JSC::DFG::emitPutTransitionStub): + * dfg/DFGThunks.cpp: + (JSC::DFG::osrExitGenerationThunkGenerator): + * disassembler/Disassembler.h: + (JSC): + (JSC::tryToDisassemble): + * disassembler/UDis86Disassembler.cpp: + (JSC::tryToDisassemble): + * jit/JIT.cpp: + (JSC::JIT::privateCompile): + * jit/JITCode.h: + (JSC::JITCode::tryToDisassemble): + * jit/JITOpcodes.cpp: + (JSC::JIT::privateCompileCTIMachineTrampolines): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::privateCompileCTIMachineTrampolines): + (JSC::JIT::privateCompileCTINativeCall): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::stringGetByValStubGenerator): + (JSC::JIT::privateCompilePutByIdTransition): + (JSC::JIT::privateCompilePatchGetArrayLength): + (JSC::JIT::privateCompileGetByIdProto): + (JSC::JIT::privateCompileGetByIdSelfList): + (JSC::JIT::privateCompileGetByIdProtoList): + (JSC::JIT::privateCompileGetByIdChainList): + (JSC::JIT::privateCompileGetByIdChain): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::stringGetByValStubGenerator): + (JSC::JIT::privateCompilePutByIdTransition): + (JSC::JIT::privateCompilePatchGetArrayLength): + (JSC::JIT::privateCompileGetByIdProto): + (JSC::JIT::privateCompileGetByIdSelfList): + (JSC::JIT::privateCompileGetByIdProtoList): + (JSC::JIT::privateCompileGetByIdChainList): + (JSC::JIT::privateCompileGetByIdChain): + * jit/SpecializedThunkJIT.h: + (JSC::SpecializedThunkJIT::finalize): + * jit/ThunkGenerators.cpp: + (JSC::charCodeAtThunkGenerator): + (JSC::charAtThunkGenerator): + (JSC::fromCharCodeThunkGenerator): + (JSC::sqrtThunkGenerator): + (JSC::floorThunkGenerator): + (JSC::ceilThunkGenerator): + (JSC::roundThunkGenerator): + (JSC::expThunkGenerator): + (JSC::logThunkGenerator): + (JSC::absThunkGenerator): + (JSC::powThunkGenerator): + * llint/LLIntThunks.cpp: + (JSC::LLInt::generateThunkWithJumpTo): + (JSC::LLInt::functionForCallEntryThunkGenerator): + (JSC::LLInt::functionForConstructEntryThunkGenerator): + (JSC::LLInt::functionForCallArityCheckThunkGenerator): + (JSC::LLInt::functionForConstructArityCheckThunkGenerator): + (JSC::LLInt::evalEntryThunkGenerator): + (JSC::LLInt::programEntryThunkGenerator): + * runtime/Options.cpp: + (Options): + (JSC::Options::initializeOptions): + * runtime/Options.h: + (Options): + * yarr/YarrJIT.cpp: + (JSC::Yarr::YarrGenerator::compile): + +2012-06-19 Mark Hahnenberg + + [Qt][Mac] REGRESSION(r120742): It broke the build + https://bugs.webkit.org/show_bug.cgi?id=89516 + + Reviewed by Geoffrey Garen. + + Removing GCActivityCallbackCF.cpp because it doesn't mesh well with cross-platform + code on Darwin (e.g. Qt). We now use plain ol' vanilla ifdefs to handle platforms + without CF support. These if-defs will probably disappear in the future when we + use cross-platform timers in HeapTimer. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * runtime/GCActivityCallback.cpp: + (JSC): + (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback): + (JSC::DefaultGCActivityCallback::doWork): + (JSC::DefaultGCActivityCallback::scheduleTimer): + (JSC::DefaultGCActivityCallback::cancelTimer): + (JSC::DefaultGCActivityCallback::didAllocate): + (JSC::DefaultGCActivityCallback::willCollect): + (JSC::DefaultGCActivityCallback::cancel): + * runtime/GCActivityCallbackCF.cpp: Removed. + +2012-06-19 Filip Pizlo + + DFG CFA forgets to notify subsequent phases of found constants if it proves LogicalNot to be a constant + https://bugs.webkit.org/show_bug.cgi?id=89511 + + + Reviewed by Geoffrey Garen. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + +2012-06-19 Mark Lam + + CodeBlock::needsCallReturnIndices() is no longer needed. + https://bugs.webkit.org/show_bug.cgi?id=89490 + + Reviewed by Geoffrey Garen. + + * bytecode/CodeBlock.h: + (JSC::CodeBlock::needsCallReturnIndices): removed. + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::link): + * jit/JIT.cpp: + (JSC::JIT::privateCompile): + +2012-06-19 Filip Pizlo + + Unreviewed, try to fix Windows build. + + * JavaScriptCore.vcproj/JavaScriptCore/copy-files.cmd: + +2012-06-17 Filip Pizlo + + It should be possible to look at disassembly + https://bugs.webkit.org/show_bug.cgi?id=89319 + + Reviewed by Sam Weinig. + + This imports the udis86 disassembler library. The library is placed + behind an abstraction in disassembler/Disassembler.h, so that we can + in the future use other disassemblers (for other platforms) whenever + appropriate. As a first step, the disassembler is being invoked for + DFG verbose dumps. + + If we ever want to merge a new version of udis86 in the future, I've + made notes about changes I made to the library in + disassembler/udis86/differences.txt. + + * CMakeLists.txt: + * DerivedSources.make: + * GNUmakefile.list.am: + * JavaScriptCore.pri: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: + * JavaScriptCore.xcodeproj/project.pbxproj: + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::compile): + (JSC::DFG::JITCompiler::compileFunction): + * disassembler: Added. + * disassembler/Disassembler.h: Added. + (JSC): + (JSC::tryToDisassemble): + * disassembler/UDis86Disassembler.cpp: Added. + (JSC): + (JSC::tryToDisassemble): + * disassembler/udis86: Added. + * disassembler/udis86/differences.txt: Added. + * disassembler/udis86/itab.py: Added. + (UdItabGenerator): + (UdItabGenerator.__init__): + (UdItabGenerator.toGroupId): + (UdItabGenerator.genLookupTable): + (UdItabGenerator.genLookupTableList): + (UdItabGenerator.genInsnTable): + (genItabH): + (genItabH.UD_ITAB_H): + (genItabC): + (genItab): + (main): + * disassembler/udis86/optable.xml: Added. + * disassembler/udis86/ud_opcode.py: Added. + (UdOpcodeTables): + (UdOpcodeTables.sizeOfTable): + (UdOpcodeTables.nameOfTable): + (UdOpcodeTables.updateTable): + (UdOpcodeTables.Insn): + (UdOpcodeTables.Insn.__init__): + (UdOpcodeTables.Insn.__init__.opcode): + (UdOpcodeTables.parse): + (UdOpcodeTables.addInsnDef): + (UdOpcodeTables.print_table): + (UdOpcodeTables.print_tree): + * disassembler/udis86/ud_optable.py: Added. + (UdOptableXmlParser): + (UdOptableXmlParser.parseDef): + (UdOptableXmlParser.parse): + (printFn): + (parse): + (main): + * disassembler/udis86/udis86.c: Added. + (ud_init): + (ud_disassemble): + (ud_set_mode): + (ud_set_vendor): + (ud_set_pc): + (ud): + (ud_insn_asm): + (ud_insn_off): + (ud_insn_hex): + (ud_insn_ptr): + (ud_insn_len): + * disassembler/udis86/udis86.h: Added. + * disassembler/udis86/udis86_decode.c: Added. + (eff_adr_mode): + (ud_lookup_mnemonic): + (decode_prefixes): + (modrm): + (resolve_operand_size): + (resolve_mnemonic): + (decode_a): + (decode_gpr): + (resolve_gpr64): + (resolve_gpr32): + (resolve_reg): + (decode_imm): + (decode_modrm_reg): + (decode_modrm_rm): + (decode_o): + (decode_operand): + (decode_operands): + (clear_insn): + (resolve_mode): + (gen_hex): + (decode_insn): + (decode_3dnow): + (decode_ssepfx): + (decode_ext): + (decode_opcode): + (ud_decode): + * disassembler/udis86/udis86_decode.h: Added. + (ud_itab_entry_operand): + (ud_itab_entry): + (ud_lookup_table_list_entry): + (sse_pfx_idx): + (mode_idx): + (modrm_mod_idx): + (vendor_idx): + (is_group_ptr): + (group_idx): + * disassembler/udis86/udis86_extern.h: Added. + * disassembler/udis86/udis86_input.c: Added. + (inp_buff_hook): + (inp_file_hook): + (ud): + (ud_set_user_opaque_data): + (ud_get_user_opaque_data): + (ud_set_input_buffer): + (ud_set_input_file): + (ud_input_skip): + (ud_input_end): + (ud_inp_next): + (ud_inp_back): + (ud_inp_peek): + (ud_inp_move): + (ud_inp_uint8): + (ud_inp_uint16): + (ud_inp_uint32): + (ud_inp_uint64): + * disassembler/udis86/udis86_input.h: Added. + * disassembler/udis86/udis86_itab_holder.c: Added. + * disassembler/udis86/udis86_syn-att.c: Added. + (opr_cast): + (gen_operand): + (ud_translate_att): + * disassembler/udis86/udis86_syn-intel.c: Added. + (opr_cast): + (gen_operand): + (ud_translate_intel): + * disassembler/udis86/udis86_syn.c: Added. + * disassembler/udis86/udis86_syn.h: Added. + (mkasm): + * disassembler/udis86/udis86_types.h: Added. + (ud_operand): + (ud): + * jit/JITCode.h: + (JITCode): + (JSC::JITCode::tryToDisassemble): + +2012-06-19 Mark Hahnenberg + + GCActivityCallback and IncrementalSweeper should share code + https://bugs.webkit.org/show_bug.cgi?id=89400 + + Reviewed by Geoffrey Garen. + + A lot of functionality is duplicated between GCActivityCallback and IncrementalSweeper. + We should extract the common functionality out into a separate class that both of them + can inherit from. This refactoring will be an even greater boon when we add the ability + to shut these two agents down in a thread-safe fashion + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * heap/Heap.cpp: + (JSC::Heap::Heap): Move initialization down so that the JSGlobalData has a valid Heap when + we're initializing the GCActivityCallback and the IncrementalSweeper. + * heap/Heap.h: + (Heap): + * heap/HeapTimer.cpp: Added. + (JSC): + (JSC::HeapTimer::HeapTimer): Initialize the various base class data that + DefaultGCActivityCallback::commonConstructor() used to do. + (JSC::HeapTimer::~HeapTimer): Call to invalidate(). + (JSC::HeapTimer::synchronize): Same functionality as the old DefaultGCActivityCallback::synchronize(). + Virtual so that non-CF subclasses can override. + (JSC::HeapTimer::invalidate): Tears down the runloop timer to prevent any future firing. + (JSC::HeapTimer::timerDidFire): Callback to pass to the timer function. Casts and calls the virtual doWork(). + * heap/HeapTimer.h: Added. This is the class that serves as the common base class for + both GCActivityCallback and IncrementalSweeper. It handles setting up and tearing down run loops and synchronizing + across threads for its subclasses. + (JSC): + (HeapTimer): + * heap/IncrementalSweeper.cpp: Changes to accomodate the extraction of common functionality + between IncrementalSweeper and GCActivityCallback into a common ancestor. + (JSC): + (JSC::IncrementalSweeper::doWork): + (JSC::IncrementalSweeper::IncrementalSweeper): + (JSC::IncrementalSweeper::cancelTimer): + (JSC::IncrementalSweeper::create): + * heap/IncrementalSweeper.h: + (IncrementalSweeper): + * runtime/GCActivityCallback.cpp: + (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback): + (JSC::DefaultGCActivityCallback::doWork): + * runtime/GCActivityCallback.h: + (GCActivityCallback): + (JSC::GCActivityCallback::willCollect): + (JSC::GCActivityCallback::GCActivityCallback): + (JSC): + (DefaultGCActivityCallback): Remove the platform data struct. The platform data should be kept in + the class itself so as to be accessible by doWork(). Most of the platform data for CF is kept in + HeapTimer anyways, so we only need the m_delay field now. + * runtime/GCActivityCallbackBlackBerry.cpp: + (JSC): + (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback): + (JSC::DefaultGCActivityCallback::doWork): + (JSC::DefaultGCActivityCallback::didAllocate): + * runtime/GCActivityCallbackCF.cpp: + (JSC): + (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback): + (JSC::DefaultGCActivityCallback::doWork): + (JSC::DefaultGCActivityCallback::scheduleTimer): + (JSC::DefaultGCActivityCallback::cancelTimer): + (JSC::DefaultGCActivityCallback::didAllocate): + (JSC::DefaultGCActivityCallback::willCollect): + (JSC::DefaultGCActivityCallback::cancel): + + +2012-06-19 Mike West + + Introduce ENABLE_CSP_NEXT configuration flag. + https://bugs.webkit.org/show_bug.cgi?id=89300 + + Reviewed by Adam Barth. + + The 1.0 draft of the Content Security Policy spec is just about to + move to Last Call. We'll hide work on the upcoming 1.1 spec behind + this ENABLE flag, disabled by default. + + Spec: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html + + * Configurations/FeatureDefines.xcconfig: + +2012-06-18 Mark Lam + + Changed JSC to always record line number information so that error.stack + and window.onerror() can report proper line numbers. + https://bugs.webkit.org/show_bug.cgi?id=89410 + + Reviewed by Geoffrey Garen. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::CodeBlock): + (JSC::CodeBlock::lineNumberForBytecodeOffset): + (JSC::CodeBlock::shrinkToFit): m_lineInfo is now available unconditionally. + + * bytecode/CodeBlock.h: + (JSC::CodeBlock::addLineInfo): + (JSC::CodeBlock::hasLineInfo): Unused. Now removed. + (JSC::CodeBlock::needsCallReturnIndices): + (CodeBlock): + (RareData): Hoisted m_lineInfo out of m_rareData. m_lineInfo is now + filled in unconditionally. + + * bytecompiler/BytecodeGenerator.h: + (JSC::BytecodeGenerator::addLineInfo): + +2012-06-18 Andy Estes + + Fix r120663, which didn't land the change that was reviewed. + +2012-06-18 Andy Estes + + [JSC] In JSGlobalData.cpp, enableAssembler() sometimes leaks two CF objects + https://bugs.webkit.org/show_bug.cgi?id=89415 + + Reviewed by Sam Weinig. + + In the case where canUseJIT was a non-NULL CFBooleanRef, + enableAssembler() would leak both canUseJITKey and canUseJIT by + returning before calling CFRelease. Fix this by using RetainPtr. + + * runtime/JSGlobalData.cpp: + (JSC::enableAssembler): + +2012-06-17 Geoffrey Garen + + GC copy phase spends needless cycles zero-filling blocks + https://bugs.webkit.org/show_bug.cgi?id=89128 + + Reviewed by Gavin Barraclough. + + We only need to zero-fill when we're allocating memory that might not + get fully initialized before GC. + + * heap/CopiedBlock.h: + (JSC::CopiedBlock::createNoZeroFill): + (JSC::CopiedBlock::create): Added a way to create without zero-filling. + This is our optimization. + + (JSC::CopiedBlock::zeroFillToEnd): + (JSC::CopiedBlock::CopiedBlock): Split zero-filling out from creation, + so we can sometimes create without zero-filling. + + * heap/CopiedSpace.cpp: + (JSC::CopiedSpace::init): + (JSC::CopiedSpace::tryAllocateSlowCase): + (JSC::CopiedSpace::doneCopying): Renamed addNewBlock to allocateBlock() + to clarify that the new block is always newly-allocated. + + (JSC::CopiedSpace::doneFillingBlock): Make sure to zero-fill to the end + of a block that might be used in the future for allocation. (Most of the + time, this is a no-op, since we've already filled the block completely.) + + (JSC::CopiedSpace::getFreshBlock): Removed this function because the + abstraction of "allocation must succeed" is no longer useful. + + * heap/CopiedSpace.h: Updated declarations to match. + + * heap/CopiedSpaceInlineMethods.h: + (JSC::CopiedSpace::allocateBlockForCopyingPhase): New function, which + knows that it can skip zero-filling. + + Added tighter scoping to our lock, to improve parallelism. + + (JSC::CopiedSpace::allocateBlock): Folded getFreshBlock functionality + into this function, for simplicity. + + * heap/MarkStack.cpp: + (JSC::SlotVisitor::startCopying): + (JSC::SlotVisitor::allocateNewSpace): Use our new zero-fill-free helper + function for great good. + +2012-06-17 Filip Pizlo + + DFG should attempt to use structure watchpoints for all inlined get_by_id's and put_by_id's + https://bugs.webkit.org/show_bug.cgi?id=89316 + + Reviewed by Oliver Hunt. + + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::addStructureTransitionCheck): + (ByteCodeParser): + (JSC::DFG::ByteCodeParser::handleGetById): + (JSC::DFG::ByteCodeParser::parseBlock): + +2012-06-15 Yong Li + + [BlackBerry] Put platform-specific GC policy in GCActivityCallback + https://bugs.webkit.org/show_bug.cgi?id=89236 + + Reviewed by Rob Buis. + + Add GCActivityCallbackBlackBerry.cpp and implement platform-specific + low memory GC policy there. + + * PlatformBlackBerry.cmake: + * heap/Heap.h: + (JSC::Heap::isSafeToCollect): Added. + * runtime/GCActivityCallbackBlackBerry.cpp: Added. + (JSC): + (JSC::DefaultGCActivityCallbackPlatformData::DefaultGCActivityCallbackPlatformData): + (DefaultGCActivityCallbackPlatformData): + (JSC::DefaultGCActivityCallback::DefaultGCActivityCallback): + (JSC::DefaultGCActivityCallback::~DefaultGCActivityCallback): + (JSC::DefaultGCActivityCallback::didAllocate): + (JSC::DefaultGCActivityCallback::willCollect): + (JSC::DefaultGCActivityCallback::synchronize): + (JSC::DefaultGCActivityCallback::cancel): + +2012-06-15 Filip Pizlo + + DFG should be able to set watchpoints on structure transitions in the + method check prototype chain + https://bugs.webkit.org/show_bug.cgi?id=89058 + + Adding the same assertion to 32-bit that I added to 64-bit. This change + does not affect correctness but it's a good thing for assertion coverage. + + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-06-13 Filip Pizlo + + DFG should be able to set watchpoints on structure transitions in the + method check prototype chain + https://bugs.webkit.org/show_bug.cgi?id=89058 + + Reviewed by Gavin Barraclough. + + This adds the ability to set watchpoints on Structures, and then does + the most modest thing we can do with this ability: the DFG now sets + watchpoints on structure transitions in the prototype chain of method + checks. + + This appears to be a >1% speed-up on V8. + + * bytecode/PutByIdStatus.cpp: + (JSC::PutByIdStatus::computeFromLLInt): + (JSC::PutByIdStatus::computeFor): + * bytecode/StructureSet.h: + (JSC::StructureSet::containsOnly): + (StructureSet): + * bytecode/Watchpoint.cpp: + (JSC::WatchpointSet::WatchpointSet): + (JSC::InlineWatchpointSet::add): + (JSC): + (JSC::InlineWatchpointSet::inflateSlow): + (JSC::InlineWatchpointSet::freeFat): + * bytecode/Watchpoint.h: + (WatchpointSet): + (JSC): + (InlineWatchpointSet): + (JSC::InlineWatchpointSet::InlineWatchpointSet): + (JSC::InlineWatchpointSet::~InlineWatchpointSet): + (JSC::InlineWatchpointSet::hasBeenInvalidated): + (JSC::InlineWatchpointSet::isStillValid): + (JSC::InlineWatchpointSet::startWatching): + (JSC::InlineWatchpointSet::notifyWrite): + (JSC::InlineWatchpointSet::isFat): + (JSC::InlineWatchpointSet::fat): + (JSC::InlineWatchpointSet::inflate): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::addStructureTransitionCheck): + (ByteCodeParser): + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination): + (CSEPhase): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGCommon.h: + * dfg/DFGGraph.cpp: + (JSC::DFG::Graph::dump): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::isCellConstant): + * dfg/DFGJITCompiler.h: + (JSC::DFG::JITCompiler::addWeakReferences): + (JITCompiler): + * dfg/DFGNode.h: + (JSC::DFG::Node::hasStructure): + (Node): + (JSC::DFG::Node::structure): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGRepatch.cpp: + (JSC::DFG::emitPutTransitionStub): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * jit/JITStubs.cpp: + (JSC::JITThunks::tryCachePutByID): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * runtime/Structure.cpp: + (JSC::Structure::Structure): + * runtime/Structure.h: + (JSC::Structure::transitionWatchpointSetHasBeenInvalidated): + (Structure): + (JSC::Structure::transitionWatchpointSetIsStillValid): + (JSC::Structure::addTransitionWatchpoint): + (JSC::Structure::notifyTransitionFromThisStructure): + (JSC::JSCell::setStructure): + * runtime/SymbolTable.cpp: + (JSC::SymbolTableEntry::attemptToWatch): + +2012-06-13 Filip Pizlo + + DFG should be able to set watchpoints on global variables + https://bugs.webkit.org/show_bug.cgi?id=88692 + + Reviewed by Geoffrey Garen. + + Rolling back in after fixing Windows build issues, and implementing + branchTest8 for the Qt port's strange assemblers. + + This implements global variable constant folding by allowing the optimizing + compiler to set a "watchpoint" on globals that it wishes to constant fold. + If the watchpoint fires, then an OSR exit is forced by overwriting the + machine code that the optimizing compiler generated with a jump. + + As such, this patch is adding quite a bit of stuff: + + - Jump replacement on those hardware targets supported by the optimizing + JIT. It is now possible to patch in a jump instruction over any recorded + watchpoint label. The jump must be "local" in the sense that it must be + within the range of the largest jump distance supported by a one + instruction jump. + + - WatchpointSets and Watchpoints. A Watchpoint is a doubly-linked list node + that records the location where a jump must be inserted and the + destination to which it should jump. Watchpoints can be added to a + WatchpointSet. The WatchpointSet can be fired all at once, which plants + all jumps. WatchpointSet also remembers if it had ever been invalidated, + which allows for monotonicity: we typically don't want to optimize using + watchpoints on something for which watchpoints had previously fired. The + act of notifying a WatchpointSet has a trivial fast path in case no + Watchpoints are registered (one-byte load+branch). + + - SpeculativeJIT::speculationWatchpoint(). It's like speculationCheck(), + except that you don't have to emit branches. But, you need to know what + WatchpointSet to add the resulting Watchpoint to. Not everything that + you could write a speculationCheck() for will have a WatchpointSet that + would get notified if the condition you were speculating against became + invalid. + + - SymbolTableEntry now has the ability to refer to a WatchpointSet. It can + do so without incurring any space overhead for those entries that don't + have WatchpointSets. + + - The bytecode generator infers all global function variables to be + watchable, and makes all stores perform the WatchpointSet's write check, + and marks all loads as being potentially watchable (i.e. you can compile + them to a watchpoint and a constant). + + Put together, this allows for fully sleazy inlining of calls to globally + declared functions. The inline prologue will no longer contain the load of + the function, or any checks of the function you're calling. I.e. it's + pretty much like the kind of inlining you would see in Java or C++. + Furthermore, the watchpointing functionality is built to be fairly general, + and should allow setting watchpoints on all sorts of interesting things + in the future. + + The sleazy inlining means that we will now sometimes inline in code paths + that have never executed. Previously, to inline we would have either had + to have executed the call (to read the call's inline cache) or have + executed the method check (to read the method check's inline cache). Now, + we might inline when the callee is a watched global variable. This + revealed some humorous bugs. First, constant folding disagreed with CFA + over what kinds of operations can clobber (example: code path A is dead + but stores a String into variable X, all other code paths store 0 into + X, and then you do CompareEq(X, 0) - CFA will say that this is a non- + clobbering constant, but constant folding thought it was clobbering + because it saw the String prediction). Second, inlining would crash if + the inline callee had not been compiled. This patch fixes both bugs, + since otherwise run-javascriptcore-tests would report regressions. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * assembler/ARMv7Assembler.h: + (ARMv7Assembler): + (JSC::ARMv7Assembler::ARMv7Assembler): + (JSC::ARMv7Assembler::labelForWatchpoint): + (JSC::ARMv7Assembler::label): + (JSC::ARMv7Assembler::replaceWithJump): + (JSC::ARMv7Assembler::maxJumpReplacementSize): + * assembler/AbstractMacroAssembler.h: + (JSC): + (AbstractMacroAssembler): + (Label): + (JSC::AbstractMacroAssembler::watchpointLabel): + (JSC::AbstractMacroAssembler::readPointer): + * assembler/AssemblerBuffer.h: + * assembler/MacroAssemblerARM.h: + (JSC::MacroAssemblerARM::branchTest8): + (MacroAssemblerARM): + (JSC::MacroAssemblerARM::replaceWithJump): + (JSC::MacroAssemblerARM::maxJumpReplacementSize): + * assembler/MacroAssemblerARMv7.h: + (JSC::MacroAssemblerARMv7::load8Signed): + (JSC::MacroAssemblerARMv7::load16Signed): + (MacroAssemblerARMv7): + (JSC::MacroAssemblerARMv7::replaceWithJump): + (JSC::MacroAssemblerARMv7::maxJumpReplacementSize): + (JSC::MacroAssemblerARMv7::branchTest8): + (JSC::MacroAssemblerARMv7::jump): + (JSC::MacroAssemblerARMv7::makeBranch): + * assembler/MacroAssemblerMIPS.h: + (JSC::MacroAssemblerMIPS::branchTest8): + (MacroAssemblerMIPS): + (JSC::MacroAssemblerMIPS::replaceWithJump): + (JSC::MacroAssemblerMIPS::maxJumpReplacementSize): + * assembler/MacroAssemblerSH4.h: + (JSC::MacroAssemblerSH4::branchTest8): + (MacroAssemblerSH4): + (JSC::MacroAssemblerSH4::replaceWithJump): + (JSC::MacroAssemblerSH4::maxJumpReplacementSize): + * assembler/MacroAssemblerX86.h: + (MacroAssemblerX86): + (JSC::MacroAssemblerX86::branchTest8): + * assembler/MacroAssemblerX86Common.h: + (JSC::MacroAssemblerX86Common::replaceWithJump): + (MacroAssemblerX86Common): + (JSC::MacroAssemblerX86Common::maxJumpReplacementSize): + * assembler/MacroAssemblerX86_64.h: + (MacroAssemblerX86_64): + (JSC::MacroAssemblerX86_64::branchTest8): + * assembler/X86Assembler.h: + (JSC::X86Assembler::X86Assembler): + (X86Assembler): + (JSC::X86Assembler::cmpb_im): + (JSC::X86Assembler::testb_im): + (JSC::X86Assembler::labelForWatchpoint): + (JSC::X86Assembler::label): + (JSC::X86Assembler::replaceWithJump): + (JSC::X86Assembler::maxJumpReplacementSize): + (JSC::X86Assembler::X86InstructionFormatter::memoryModRM): + * bytecode/CodeBlock.cpp: + (JSC): + (JSC::CodeBlock::printGetByIdCacheStatus): + (JSC::CodeBlock::dump): + * bytecode/CodeBlock.h: + (JSC::CodeBlock::appendOSRExit): + (JSC::CodeBlock::appendSpeculationRecovery): + (CodeBlock): + (JSC::CodeBlock::appendWatchpoint): + (JSC::CodeBlock::numberOfWatchpoints): + (JSC::CodeBlock::watchpoint): + (DFGData): + * bytecode/DFGExitProfile.h: + (JSC::DFG::exitKindToString): + (JSC::DFG::exitKindIsCountable): + * bytecode/GetByIdStatus.cpp: + (JSC::GetByIdStatus::computeForChain): + * bytecode/Instruction.h: + (Instruction): + (JSC::Instruction::Instruction): + * bytecode/Opcode.h: + (JSC): + (JSC::padOpcodeName): + * bytecode/Watchpoint.cpp: Added. + (JSC): + (JSC::Watchpoint::~Watchpoint): + (JSC::Watchpoint::correctLabels): + (JSC::Watchpoint::fire): + (JSC::WatchpointSet::WatchpointSet): + (JSC::WatchpointSet::~WatchpointSet): + (JSC::WatchpointSet::add): + (JSC::WatchpointSet::notifyWriteSlow): + (JSC::WatchpointSet::fireAllWatchpoints): + * bytecode/Watchpoint.h: Added. + (JSC): + (Watchpoint): + (JSC::Watchpoint::Watchpoint): + (JSC::Watchpoint::setDestination): + (WatchpointSet): + (JSC::WatchpointSet::isStillValid): + (JSC::WatchpointSet::hasBeenInvalidated): + (JSC::WatchpointSet::startWatching): + (JSC::WatchpointSet::notifyWrite): + (JSC::WatchpointSet::addressOfIsWatched): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::ResolveResult::checkValidity): + (JSC::BytecodeGenerator::addGlobalVar): + (JSC::BytecodeGenerator::BytecodeGenerator): + (JSC::BytecodeGenerator::resolve): + (JSC::BytecodeGenerator::emitResolve): + (JSC::BytecodeGenerator::emitResolveWithBase): + (JSC::BytecodeGenerator::emitResolveWithThis): + (JSC::BytecodeGenerator::emitGetStaticVar): + (JSC::BytecodeGenerator::emitPutStaticVar): + * bytecompiler/BytecodeGenerator.h: + (BytecodeGenerator): + * bytecompiler/NodesCodegen.cpp: + (JSC::FunctionCallResolveNode::emitBytecode): + (JSC::PostfixResolveNode::emitBytecode): + (JSC::PrefixResolveNode::emitBytecode): + (JSC::ReadModifyResolveNode::emitBytecode): + (JSC::AssignResolveNode::emitBytecode): + (JSC::ConstDeclNode::emitCodeSingle): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + (JSC::DFG::AbstractState::clobberStructures): + * dfg/DFGAbstractState.h: + (AbstractState): + (JSC::DFG::AbstractState::didClobber): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::handleInlining): + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCCallHelpers.h: + (CCallHelpers): + (JSC::DFG::CCallHelpers::setupArguments): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::globalVarWatchpointElimination): + (CSEPhase): + (JSC::DFG::CSEPhase::globalVarStoreElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGCapabilities.h: + (JSC::DFG::canCompileOpcode): + * dfg/DFGConstantFoldingPhase.cpp: + (JSC::DFG::ConstantFoldingPhase::run): + * dfg/DFGCorrectableJumpPoint.h: + (JSC::DFG::CorrectableJumpPoint::isSet): + (CorrectableJumpPoint): + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::linkOSRExits): + (JSC::DFG::JITCompiler::link): + * dfg/DFGNode.h: + (JSC::DFG::Node::hasIdentifierNumberForCheck): + (Node): + (JSC::DFG::Node::identifierNumberForCheck): + (JSC::DFG::Node::hasRegisterPointer): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGOSRExit.cpp: + (JSC::DFG::OSRExit::OSRExit): + * dfg/DFGOSRExit.h: + (OSRExit): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + (JSC::DFG::SpeculativeJIT::appendCall): + (SpeculativeJIT): + (JSC::DFG::SpeculativeJIT::speculationWatchpoint): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + * jit/JIT.cpp: + (JSC::JIT::privateCompileMainPass): + (JSC::JIT::privateCompileSlowCases): + * jit/JIT.h: + * jit/JITPropertyAccess.cpp: + (JSC::JIT::emit_op_put_global_var_check): + (JSC): + (JSC::JIT::emitSlow_op_put_global_var_check): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::emit_op_put_global_var_check): + (JSC): + (JSC::JIT::emitSlow_op_put_global_var_check): + * jit/JITStubs.cpp: + (JSC::DEFINE_STUB_FUNCTION): + (JSC): + * jit/JITStubs.h: + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + (LLInt): + * llint/LLIntSlowPaths.h: + (LLInt): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/JSObject.cpp: + (JSC::JSObject::removeDirect): + * runtime/JSObject.h: + (JSObject): + * runtime/JSSymbolTableObject.h: + (JSC::symbolTableGet): + (JSC::symbolTablePut): + (JSC::symbolTablePutWithAttributes): + * runtime/SymbolTable.cpp: Added. + (JSC): + (JSC::SymbolTableEntry::copySlow): + (JSC::SymbolTableEntry::freeFatEntrySlow): + (JSC::SymbolTableEntry::couldBeWatched): + (JSC::SymbolTableEntry::attemptToWatch): + (JSC::SymbolTableEntry::addressOfIsWatched): + (JSC::SymbolTableEntry::addWatchpoint): + (JSC::SymbolTableEntry::notifyWriteSlow): + (JSC::SymbolTableEntry::inflateSlow): + * runtime/SymbolTable.h: + (JSC): + (SymbolTableEntry): + (Fast): + (JSC::SymbolTableEntry::Fast::Fast): + (JSC::SymbolTableEntry::Fast::isNull): + (JSC::SymbolTableEntry::Fast::getIndex): + (JSC::SymbolTableEntry::Fast::isReadOnly): + (JSC::SymbolTableEntry::Fast::getAttributes): + (JSC::SymbolTableEntry::Fast::isFat): + (JSC::SymbolTableEntry::SymbolTableEntry): + (JSC::SymbolTableEntry::~SymbolTableEntry): + (JSC::SymbolTableEntry::operator=): + (JSC::SymbolTableEntry::isNull): + (JSC::SymbolTableEntry::getIndex): + (JSC::SymbolTableEntry::getFast): + (JSC::SymbolTableEntry::getAttributes): + (JSC::SymbolTableEntry::isReadOnly): + (JSC::SymbolTableEntry::watchpointSet): + (JSC::SymbolTableEntry::notifyWrite): + (FatEntry): + (JSC::SymbolTableEntry::FatEntry::FatEntry): + (JSC::SymbolTableEntry::isFat): + (JSC::SymbolTableEntry::fatEntry): + (JSC::SymbolTableEntry::inflate): + (JSC::SymbolTableEntry::bits): + (JSC::SymbolTableEntry::freeFatEntry): + (JSC::SymbolTableEntry::pack): + (JSC::SymbolTableEntry::isValidIndex): + +2012-06-13 Sheriff Bot + + Unreviewed, rolling out r120172. + http://trac.webkit.org/changeset/120172 + https://bugs.webkit.org/show_bug.cgi?id=88976 + + The patch causes compilation failures on Gtk, Qt and Apple Win + bots (Requested by zdobersek on #webkit). + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * assembler/ARMv7Assembler.h: + (JSC::ARMv7Assembler::nop): + (JSC::ARMv7Assembler::label): + (JSC::ARMv7Assembler::readPointer): + (ARMv7Assembler): + * assembler/AbstractMacroAssembler.h: + (JSC): + (AbstractMacroAssembler): + (Label): + * assembler/AssemblerBuffer.h: + * assembler/MacroAssemblerARM.h: + * assembler/MacroAssemblerARMv7.h: + (JSC::MacroAssemblerARMv7::nop): + (JSC::MacroAssemblerARMv7::jump): + (JSC::MacroAssemblerARMv7::makeBranch): + * assembler/MacroAssemblerMIPS.h: + * assembler/MacroAssemblerSH4.h: + * assembler/MacroAssemblerX86.h: + (MacroAssemblerX86): + (JSC::MacroAssemblerX86::moveWithPatch): + * assembler/MacroAssemblerX86Common.h: + * assembler/MacroAssemblerX86_64.h: + (JSC::MacroAssemblerX86_64::branchTest8): + * assembler/X86Assembler.h: + (JSC::X86Assembler::cmpb_im): + (JSC::X86Assembler::codeSize): + (JSC::X86Assembler::label): + (JSC::X86Assembler::X86InstructionFormatter::memoryModRM): + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + * bytecode/CodeBlock.h: + (JSC::CodeBlock::appendOSRExit): + (JSC::CodeBlock::appendSpeculationRecovery): + (DFGData): + * bytecode/DFGExitProfile.h: + (JSC::DFG::exitKindToString): + (JSC::DFG::exitKindIsCountable): + * bytecode/Instruction.h: + * bytecode/Opcode.h: + (JSC): + (JSC::padOpcodeName): + * bytecode/Watchpoint.cpp: Removed. + * bytecode/Watchpoint.h: Removed. + * bytecompiler/BytecodeGenerator.cpp: + (JSC::ResolveResult::checkValidity): + (JSC::BytecodeGenerator::addGlobalVar): + (JSC::BytecodeGenerator::BytecodeGenerator): + (JSC::BytecodeGenerator::resolve): + (JSC::BytecodeGenerator::emitResolve): + (JSC::BytecodeGenerator::emitResolveWithBase): + (JSC::BytecodeGenerator::emitResolveWithThis): + (JSC::BytecodeGenerator::emitGetStaticVar): + (JSC::BytecodeGenerator::emitPutStaticVar): + * bytecompiler/BytecodeGenerator.h: + (BytecodeGenerator): + * bytecompiler/NodesCodegen.cpp: + (JSC::FunctionCallResolveNode::emitBytecode): + (JSC::PostfixResolveNode::emitBytecode): + (JSC::PrefixResolveNode::emitBytecode): + (JSC::ReadModifyResolveNode::emitBytecode): + (JSC::AssignResolveNode::emitBytecode): + (JSC::ConstDeclNode::emitCodeSingle): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + (JSC::DFG::AbstractState::clobberStructures): + * dfg/DFGAbstractState.h: + (AbstractState): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::handleInlining): + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCCallHelpers.h: + (JSC::DFG::CCallHelpers::setupArguments): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::globalVarStoreElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGCapabilities.h: + (JSC::DFG::canCompileOpcode): + * dfg/DFGConstantFoldingPhase.cpp: + (JSC::DFG::ConstantFoldingPhase::run): + * dfg/DFGCorrectableJumpPoint.h: + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::linkOSRExits): + (JSC::DFG::JITCompiler::link): + * dfg/DFGNode.h: + (JSC::DFG::Node::hasRegisterPointer): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGOSRExit.cpp: + (JSC::DFG::OSRExit::OSRExit): + * dfg/DFGOSRExit.h: + (OSRExit): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + (JSC::DFG::SpeculativeJIT::appendCallSetResult): + (JSC::DFG::SpeculativeJIT::speculationCheck): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * jit/JIT.cpp: + (JSC::JIT::privateCompileMainPass): + (JSC::JIT::privateCompileSlowCases): + * jit/JIT.h: + * jit/JITPropertyAccess.cpp: + * jit/JITPropertyAccess32_64.cpp: + * jit/JITStubs.cpp: + * jit/JITStubs.h: + * llint/LLIntSlowPaths.cpp: + * llint/LLIntSlowPaths.h: + (LLInt): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/JSObject.cpp: + (JSC::JSObject::removeDirect): + * runtime/JSObject.h: + (JSObject): + * runtime/JSSymbolTableObject.h: + (JSC::symbolTableGet): + (JSC::symbolTablePut): + (JSC::symbolTablePutWithAttributes): + * runtime/SymbolTable.cpp: Removed. + * runtime/SymbolTable.h: + (JSC): + (JSC::SymbolTableEntry::isNull): + (JSC::SymbolTableEntry::getIndex): + (SymbolTableEntry): + (JSC::SymbolTableEntry::getAttributes): + (JSC::SymbolTableEntry::isReadOnly): + (JSC::SymbolTableEntry::pack): + (JSC::SymbolTableEntry::isValidIndex): + +2012-06-12 Filip Pizlo + + DFG should be able to set watchpoints on global variables + https://bugs.webkit.org/show_bug.cgi?id=88692 + + Reviewed by Geoffrey Garen. + + This implements global variable constant folding by allowing the optimizing + compiler to set a "watchpoint" on globals that it wishes to constant fold. + If the watchpoint fires, then an OSR exit is forced by overwriting the + machine code that the optimizing compiler generated with a jump. + + As such, this patch is adding quite a bit of stuff: + + - Jump replacement on those hardware targets supported by the optimizing + JIT. It is now possible to patch in a jump instruction over any recorded + watchpoint label. The jump must be "local" in the sense that it must be + within the range of the largest jump distance supported by a one + instruction jump. + + - WatchpointSets and Watchpoints. A Watchpoint is a doubly-linked list node + that records the location where a jump must be inserted and the + destination to which it should jump. Watchpoints can be added to a + WatchpointSet. The WatchpointSet can be fired all at once, which plants + all jumps. WatchpointSet also remembers if it had ever been invalidated, + which allows for monotonicity: we typically don't want to optimize using + watchpoints on something for which watchpoints had previously fired. The + act of notifying a WatchpointSet has a trivial fast path in case no + Watchpoints are registered (one-byte load+branch). + + - SpeculativeJIT::speculationWatchpoint(). It's like speculationCheck(), + except that you don't have to emit branches. But, you need to know what + WatchpointSet to add the resulting Watchpoint to. Not everything that + you could write a speculationCheck() for will have a WatchpointSet that + would get notified if the condition you were speculating against became + invalid. + + - SymbolTableEntry now has the ability to refer to a WatchpointSet. It can + do so without incurring any space overhead for those entries that don't + have WatchpointSets. + + - The bytecode generator infers all global function variables to be + watchable, and makes all stores perform the WatchpointSet's write check, + and marks all loads as being potentially watchable (i.e. you can compile + them to a watchpoint and a constant). + + Put together, this allows for fully sleazy inlining of calls to globally + declared functions. The inline prologue will no longer contain the load of + the function, or any checks of the function you're calling. I.e. it's + pretty much like the kind of inlining you would see in Java or C++. + Furthermore, the watchpointing functionality is built to be fairly general, + and should allow setting watchpoints on all sorts of interesting things + in the future. + + The sleazy inlining means that we will now sometimes inline in code paths + that have never executed. Previously, to inline we would have either had + to have executed the call (to read the call's inline cache) or have + executed the method check (to read the method check's inline cache). Now, + we might inline when the callee is a watched global variable. This + revealed some humorous bugs. First, constant folding disagreed with CFA + over what kinds of operations can clobber (example: code path A is dead + but stores a String into variable X, all other code paths store 0 into + X, and then you do CompareEq(X, 0) - CFA will say that this is a non- + clobbering constant, but constant folding thought it was clobbering + because it saw the String prediction). Second, inlining would crash if + the inline callee had not been compiled. This patch fixes both bugs, + since otherwise run-javascriptcore-tests would report regressions. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * assembler/ARMv7Assembler.h: + (ARMv7Assembler): + (JSC::ARMv7Assembler::ARMv7Assembler): + (JSC::ARMv7Assembler::labelForWatchpoint): + (JSC::ARMv7Assembler::label): + (JSC::ARMv7Assembler::replaceWithJump): + (JSC::ARMv7Assembler::maxJumpReplacementSize): + * assembler/AbstractMacroAssembler.h: + (JSC): + (AbstractMacroAssembler): + (Label): + (JSC::AbstractMacroAssembler::watchpointLabel): + * assembler/AssemblerBuffer.h: + * assembler/MacroAssemblerARM.h: + (JSC::MacroAssemblerARM::replaceWithJump): + (MacroAssemblerARM): + (JSC::MacroAssemblerARM::maxJumpReplacementSize): + * assembler/MacroAssemblerARMv7.h: + (MacroAssemblerARMv7): + (JSC::MacroAssemblerARMv7::replaceWithJump): + (JSC::MacroAssemblerARMv7::maxJumpReplacementSize): + (JSC::MacroAssemblerARMv7::branchTest8): + (JSC::MacroAssemblerARMv7::jump): + (JSC::MacroAssemblerARMv7::makeBranch): + * assembler/MacroAssemblerMIPS.h: + (JSC::MacroAssemblerMIPS::replaceWithJump): + (MacroAssemblerMIPS): + (JSC::MacroAssemblerMIPS::maxJumpReplacementSize): + * assembler/MacroAssemblerSH4.h: + (JSC::MacroAssemblerSH4::replaceWithJump): + (MacroAssemblerSH4): + (JSC::MacroAssemblerSH4::maxJumpReplacementSize): + * assembler/MacroAssemblerX86.h: + (MacroAssemblerX86): + (JSC::MacroAssemblerX86::branchTest8): + * assembler/MacroAssemblerX86Common.h: + (JSC::MacroAssemblerX86Common::replaceWithJump): + (MacroAssemblerX86Common): + (JSC::MacroAssemblerX86Common::maxJumpReplacementSize): + * assembler/MacroAssemblerX86_64.h: + (MacroAssemblerX86_64): + (JSC::MacroAssemblerX86_64::branchTest8): + * assembler/X86Assembler.h: + (JSC::X86Assembler::X86Assembler): + (X86Assembler): + (JSC::X86Assembler::cmpb_im): + (JSC::X86Assembler::testb_im): + (JSC::X86Assembler::labelForWatchpoint): + (JSC::X86Assembler::label): + (JSC::X86Assembler::replaceWithJump): + (JSC::X86Assembler::maxJumpReplacementSize): + (JSC::X86Assembler::X86InstructionFormatter::memoryModRM): + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + * bytecode/CodeBlock.h: + (JSC::CodeBlock::appendOSRExit): + (JSC::CodeBlock::appendSpeculationRecovery): + (CodeBlock): + (JSC::CodeBlock::appendWatchpoint): + (JSC::CodeBlock::numberOfWatchpoints): + (JSC::CodeBlock::watchpoint): + (DFGData): + * bytecode/DFGExitProfile.h: + (JSC::DFG::exitKindToString): + (JSC::DFG::exitKindIsCountable): + * bytecode/Instruction.h: + (Instruction): + (JSC::Instruction::Instruction): + * bytecode/Opcode.h: + (JSC): + (JSC::padOpcodeName): + * bytecode/Watchpoint.cpp: Added. + (JSC): + (JSC::Watchpoint::~Watchpoint): + (JSC::Watchpoint::correctLabels): + (JSC::Watchpoint::fire): + (JSC::WatchpointSet::WatchpointSet): + (JSC::WatchpointSet::~WatchpointSet): + (JSC::WatchpointSet::add): + (JSC::WatchpointSet::notifyWriteSlow): + (JSC::WatchpointSet::fireAllWatchpoints): + * bytecode/Watchpoint.h: Added. + (JSC): + (Watchpoint): + (JSC::Watchpoint::Watchpoint): + (JSC::Watchpoint::setDestination): + (WatchpointSet): + (JSC::WatchpointSet::isStillValid): + (JSC::WatchpointSet::hasBeenInvalidated): + (JSC::WatchpointSet::startWatching): + (JSC::WatchpointSet::notifyWrite): + (JSC::WatchpointSet::addressOfIsWatched): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::ResolveResult::checkValidity): + (JSC::BytecodeGenerator::addGlobalVar): + (JSC::BytecodeGenerator::BytecodeGenerator): + (JSC::BytecodeGenerator::resolve): + (JSC::BytecodeGenerator::emitResolve): + (JSC::BytecodeGenerator::emitResolveWithBase): + (JSC::BytecodeGenerator::emitResolveWithThis): + (JSC::BytecodeGenerator::emitGetStaticVar): + (JSC::BytecodeGenerator::emitPutStaticVar): + * bytecompiler/BytecodeGenerator.h: + (BytecodeGenerator): + * bytecompiler/NodesCodegen.cpp: + (JSC::FunctionCallResolveNode::emitBytecode): + (JSC::PostfixResolveNode::emitBytecode): + (JSC::PrefixResolveNode::emitBytecode): + (JSC::ReadModifyResolveNode::emitBytecode): + (JSC::AssignResolveNode::emitBytecode): + (JSC::ConstDeclNode::emitCodeSingle): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + (JSC::DFG::AbstractState::clobberStructures): + * dfg/DFGAbstractState.h: + (AbstractState): + (JSC::DFG::AbstractState::didClobber): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::handleInlining): + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCCallHelpers.h: + (CCallHelpers): + (JSC::DFG::CCallHelpers::setupArguments): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::globalVarWatchpointElimination): + (CSEPhase): + (JSC::DFG::CSEPhase::globalVarStoreElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGCapabilities.h: + (JSC::DFG::canCompileOpcode): + * dfg/DFGConstantFoldingPhase.cpp: + (JSC::DFG::ConstantFoldingPhase::run): + * dfg/DFGCorrectableJumpPoint.h: + (JSC::DFG::CorrectableJumpPoint::isSet): + (CorrectableJumpPoint): + * dfg/DFGJITCompiler.cpp: + (JSC::DFG::JITCompiler::linkOSRExits): + (JSC::DFG::JITCompiler::link): + * dfg/DFGNode.h: + (JSC::DFG::Node::hasIdentifierNumberForCheck): + (Node): + (JSC::DFG::Node::identifierNumberForCheck): + (JSC::DFG::Node::hasRegisterPointer): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGOSRExit.cpp: + (JSC::DFG::OSRExit::OSRExit): + * dfg/DFGOSRExit.h: + (OSRExit): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + (JSC::DFG::SpeculativeJIT::appendCall): + (SpeculativeJIT): + (JSC::DFG::SpeculativeJIT::speculationWatchpoint): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * jit/JIT.cpp: + (JSC::JIT::privateCompileMainPass): + (JSC::JIT::privateCompileSlowCases): + * jit/JIT.h: + * jit/JITPropertyAccess.cpp: + (JSC::JIT::emit_op_put_global_var_check): + (JSC): + (JSC::JIT::emitSlow_op_put_global_var_check): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::emit_op_put_global_var_check): + (JSC): + (JSC::JIT::emitSlow_op_put_global_var_check): + * jit/JITStubs.cpp: + (JSC::JITThunks::JITThunks): + (JSC::DEFINE_STUB_FUNCTION): + (JSC): + * jit/JITStubs.h: + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + (LLInt): + * llint/LLIntSlowPaths.h: + (LLInt): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/JSObject.cpp: + (JSC::JSObject::removeDirect): + * runtime/JSObject.h: + (JSObject): + * runtime/JSSymbolTableObject.h: + (JSC::symbolTableGet): + (JSC::symbolTablePut): + (JSC::symbolTablePutWithAttributes): + * runtime/SymbolTable.cpp: Added. + (JSC): + (JSC::SymbolTableEntry::copySlow): + (JSC::SymbolTableEntry::freeFatEntrySlow): + (JSC::SymbolTableEntry::couldBeWatched): + (JSC::SymbolTableEntry::attemptToWatch): + (JSC::SymbolTableEntry::addressOfIsWatched): + (JSC::SymbolTableEntry::addWatchpoint): + (JSC::SymbolTableEntry::notifyWriteSlow): + (JSC::SymbolTableEntry::inflateSlow): + * runtime/SymbolTable.h: + (JSC): + (SymbolTableEntry): + (Fast): + (JSC::SymbolTableEntry::Fast::Fast): + (JSC::SymbolTableEntry::Fast::isNull): + (JSC::SymbolTableEntry::Fast::getIndex): + (JSC::SymbolTableEntry::Fast::isReadOnly): + (JSC::SymbolTableEntry::Fast::getAttributes): + (JSC::SymbolTableEntry::Fast::isFat): + (JSC::SymbolTableEntry::SymbolTableEntry): + (JSC::SymbolTableEntry::~SymbolTableEntry): + (JSC::SymbolTableEntry::operator=): + (JSC::SymbolTableEntry::isNull): + (JSC::SymbolTableEntry::getIndex): + (JSC::SymbolTableEntry::getFast): + (JSC::SymbolTableEntry::getAttributes): + (JSC::SymbolTableEntry::isReadOnly): + (JSC::SymbolTableEntry::watchpointSet): + (JSC::SymbolTableEntry::notifyWrite): + (FatEntry): + (JSC::SymbolTableEntry::FatEntry::FatEntry): + (JSC::SymbolTableEntry::isFat): + (JSC::SymbolTableEntry::fatEntry): + (JSC::SymbolTableEntry::inflate): + (JSC::SymbolTableEntry::bits): + (JSC::SymbolTableEntry::freeFatEntry): + (JSC::SymbolTableEntry::pack): + (JSC::SymbolTableEntry::isValidIndex): + +2012-06-12 Filip Pizlo + + Unreviewed build fix for ARMv7 debug builds. + + * jit/JITStubs.cpp: + (JSC::JITThunks::JITThunks): + +2012-06-12 Geoffrey Garen + + Build fix for case-sensitive file systems: use the right case. + + * heap/ListableHandler.h: + +2012-06-11 Geoffrey Garen + + GC should be 1.7X faster + https://bugs.webkit.org/show_bug.cgi?id=88840 + + Reviewed by Oliver Hunt. + + I profiled, and removed anything that showed up as a concurrency + bottleneck. Then, I added 3 threads to our max thread count, since we + can scale up to more threads now. + + * heap/BlockAllocator.cpp: + (JSC::BlockAllocator::BlockAllocator): + (JSC::BlockAllocator::~BlockAllocator): + (JSC::BlockAllocator::releaseFreeBlocks): + (JSC::BlockAllocator::waitForRelativeTimeWhileHoldingLock): + (JSC::BlockAllocator::waitForRelativeTime): + (JSC::BlockAllocator::blockFreeingThreadMain): + * heap/BlockAllocator.h: + (BlockAllocator): + (JSC::BlockAllocator::allocate): + (JSC::BlockAllocator::deallocate): Use a spin lock for the common case + where we're just popping a linked list. (A pthread mutex would sleep our + thread even if the lock were only contended for a microsecond.) + + Scope the lock to avoid holding it while allocating VM, since that's a + slow activity and it doesn't modify any of our data structures. + + We still use a pthread mutex to handle our condition variable since we + have to, and it's not a hot path. + + * heap/CopiedSpace.cpp: + (JSC::CopiedSpace::CopiedSpace): + (JSC::CopiedSpace::doneFillingBlock): + * heap/CopiedSpace.h: + (JSC::CopiedSpace::CopiedSpace): Use a spin lock for the to space lock, + since it just guards linked list and hash table manipulation. + + * heap/MarkStack.cpp: + (JSC::MarkStackSegmentAllocator::MarkStackSegmentAllocator): + (JSC::MarkStackSegmentAllocator::allocate): + (JSC::MarkStackSegmentAllocator::release): + (JSC::MarkStackSegmentAllocator::shrinkReserve): Use a spin lock, since + we're just managing a linked list. + + (JSC::MarkStackArray::donateSomeCellsTo): Changed donation to be proportional + to our current stack size. This fixes cases where we used to donate too + much. Interestingly, donating too much was starving the donor (when it + ran out of work later) *and* the recipient (since it had to wait on a + long donation operation to complete before it could acquire the lock). + + In the worst case, we're still guaranteed to donate N cells in roughly log N time. + + This change also fixes cases where we used to donate too little, since + we would always keep a fixed minimum number of cells. In the worst case, + with N marking threads, would could have N large object graph roots in + our stack for the duration of GC, and scale to only 1 thread. + + It's an interesting observation that a single object in the mark stack + might represent an arbitrarily large object graph -- and only the act + of marking can find out. + + (JSC::MarkStackArray::stealSomeCellsFrom): Steal in proportion to idle + threads. Once again, this fixes cases where constants could cause us + to steal too much or too little. + + (JSC::SlotVisitor::donateKnownParallel): Always wake up other threads + if they're idle. We can afford to do this because we're conservative + about when we donate. + + (JSC::SlotVisitor::drainFromShared): + * heap/MarkStack.h: + (MarkStackSegmentAllocator): + (MarkStackArray): + (JSC): + * heap/SlotVisitor.h: Merged the "should I donate?" decision into a + single function, for simplicity. + + * runtime/Options.cpp: + (minimumNumberOfScansBetweenRebalance): Reduced the delay before donation + a lot. We can afford to do this because, in the common case, donation is + a single branch that decides not to donate. + + (cpusToUse): Use more CPUs now, since we scale better now. + + * runtime/Options.h: + (Options): Removed now-unused variables. + +2012-06-12 Filip Pizlo + + REGRESSION(120121): inspector tests crash in DFG + https://bugs.webkit.org/show_bug.cgi?id=88941 + + Reviewed by Geoffrey Garen. + + The CFG simplifier has two different ways of fixing up GetLocal, Phantom, and Flush. If we've + already fixed up the node one way, we shouldn't try the other way. The reason why we shouldn't + is that the second way depends on the node referring to other nodes in the to-be-jettisoned + block. After fixup they potentially will refer to nodes in the block being merged to. + + * dfg/DFGCFGSimplificationPhase.cpp: + (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal): + (JSC::DFG::CFGSimplificationPhase::mergeBlocks): + +2012-06-12 Leo Yang + + Dynamic hash table in DOMObjectHashTableMap is wrong in multiple threads + https://bugs.webkit.org/show_bug.cgi?id=87334 + + Reviewed by Geoffrey Garen. + + Add a copy member function to JSC::HasTable. This function will copy all data + members except for *table* which contains thread specific data that prevents + up copying it. When you want to copy a JSC::HashTable that was constructed + on another thread you should call JSC::HashTable::copy(). + + * runtime/Lookup.h: + (JSC::HashTable::copy): + (HashTable): + +2012-06-12 Filip Pizlo + + DFG should not ASSERT if you have a double use of a variable that is not revealed to be a double + until after CFG simplification + https://bugs.webkit.org/show_bug.cgi?id=88927 + + + Reviewed by Geoffrey Garen. + + Speculation fixup needs to run if simplification did things, because simplification can change + predictions - particularly if you had a control flow path that stored weird things into a + variable, but that path got axed by the simplifier. + + Running fixup in the fixpoint requires making it idempotent, which it previously wasn't. Only + one place needed to be changed, namely the un-MustGenerate-ion of ValueToInt32. + + * dfg/DFGDriver.cpp: + (JSC::DFG::compile): + * dfg/DFGFixupPhase.cpp: + (JSC::DFG::FixupPhase::fixupNode): + +2012-06-12 Filip Pizlo + + REGRESSION (r119779): Javascript TypeError: 'undefined' is not an object + https://bugs.webkit.org/show_bug.cgi?id=88783 + + + Reviewed by Geoffrey Garen. + + If you don't keep alive the base of an object access over the various checks + you do for the prototype chain, you're going to have a bad time. + + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::handleGetById): + +2012-06-12 Hojong Han + + Property names of the built-in object cannot be retrieved + after trying to delete one of its properties + https://bugs.webkit.org/show_bug.cgi?id=86461 + + Reviewed by Gavin Barraclough. + + * runtime/JSObject.cpp: + (JSC::getClassPropertyNames): + (JSC::JSObject::getOwnPropertyNames): + +2012-06-11 Gyuyoung Kim + + [CMAKE][EFL] Remove duplicated executable output path + https://bugs.webkit.org/show_bug.cgi?id=88765 + + Reviewed by Daniel Bates. + + CMake files for EFL port have redefined executable output path. However, EFL port doesn't + need to define again because it is already defined in top-level CMake file. + + * shell/CMakeLists.txt: + +2012-06-11 Carlos Garcia Campos + + Unreviewed. Fix make distcheck issues. + + * GNUmakefile.list.am: Remove non existent header file. + +2012-06-10 Patrick Gansterer + + Unreviewed. Build fix for !ENABLE(JIT) after r119844 and r119925. + + * runtime/Executable.h: + (ExecutableBase): + (JSC::ExecutableBase::clearCodeVirtual): + +2012-06-10 Patrick Gansterer + + Unreviewed. Build fix for !ENABLE(JIT) after r119844. + + * runtime/Executable.h: + (ExecutableBase): + (JSC): + +2012-06-09 Dominic Cooney + + [Chromium] Remove JavaScriptCore dependencies from gyp + https://bugs.webkit.org/show_bug.cgi?id=88510 + + Reviewed by Adam Barth. + + Chromium doesn't support JSC any more and there doesn't seem to be + a strong interest in using GYP as the common build system in other + ports. + + * JavaScriptCore.gyp/JavaScriptCore.gyp: WebCore still depends on YARR interpreter. + * JavaScriptCore.gypi: Only include YARR source. + * gyp/JavaScriptCore.gyp: Removed. + * gyp/gtk.gyp: Removed. + +2012-06-09 Geoffrey Garen + + Unreviewed, rolling back in part2 of r118646. + + This patch removes eager finalization. + + Weak pointer finalization should be lazy + https://bugs.webkit.org/show_bug.cgi?id=87599 + + Reviewed by Sam Weinig. + + * heap/Heap.cpp: + (JSC::Heap::collect): Don't finalize eagerly -- we'll do it lazily. + + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::sweep): Do sweep weak sets when sweeping a block, + since we won't get another chance. + + * heap/MarkedBlock.h: + (JSC::MarkedBlock::sweepWeakSet): + * heap/MarkedSpace.cpp: + (MarkedSpace::WeakSetSweep): + * heap/MarkedSpace.h: + (JSC::MarkedSpace::sweepWeakSets): Removed now-unused code. + +2012-06-09 Sukolsak Sakshuwong + + Add UNDO_MANAGER flag + https://bugs.webkit.org/show_bug.cgi?id=87908 + + Reviewed by Tony Chang. + + * Configurations/FeatureDefines.xcconfig: + +2012-06-08 Geoffrey Garen + + Unreviewed, rolling back in part1 of r118646. + + This patch includes everything necessary for lazy finalization, but + keeps eager finalization enabled for the time being. + + Weak pointer finalization should be lazy + https://bugs.webkit.org/show_bug.cgi?id=87599 + + Reviewed by Sam Weinig. + + * heap/MarkedBlock.cpp: + * heap/MarkedBlock.h: + (JSC::MarkedBlock::resetAllocator): + * heap/MarkedSpace.cpp: + (JSC::MarkedSpace::resetAllocators): + * heap/MarkedSpace.h: + (JSC::MarkedSpace::resetAllocators): Don't force allocator reset anymore. + It will happen automatically when a weak set is swept. It's simpler to + have only one canonical way for this to happen, and it wasn't buying + us anything to do it eagerly. + * heap/WeakBlock.cpp: + (JSC::WeakBlock::sweep): Don't short-circuit a sweep unless we know + the sweep would be a no-op. If even one finalizer is pending, we need to + run it, since we won't get another chance. + * heap/WeakSet.cpp: + (JSC::WeakSet::sweep): This loop can be simpler now that + WeakBlock::sweep() does what we mean. + Reset our allocator after a sweep because this is the optimal time to + start trying to recycle old weak pointers. + (JSC::WeakSet::tryFindAllocator): Don't sweep when searching for an + allocator because we've swept already, and forcing a new sweep would be + wasteful. + * heap/WeakSet.h: + (JSC::WeakSet::shrink): Be sure to reset our allocator after a shrink + because the shrink may have removed the block the allocator was going to + allocate out of. + +2012-06-08 Gavin Barraclough + + Unreviewed roll out r119795. + + This broke jquery/core.html + + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateBasicJSObject): + * llint/LowLevelInterpreter.asm: + * runtime/JSGlobalData.h: + (JSGlobalData): + * runtime/JSGlobalThis.cpp: + (JSC::JSGlobalThis::setUnwrappedObject): + * runtime/JSObject.cpp: + (JSC::JSObject::visitChildren): + (JSC::JSObject::createInheritorID): + * runtime/JSObject.h: + (JSObject): + (JSC::JSObject::resetInheritorID): + (JSC): + (JSC::JSObject::offsetOfInheritorID): + (JSC::JSObject::inheritorID): + +2012-06-08 Filip Pizlo + + PredictedType should be called SpeculatedType + https://bugs.webkit.org/show_bug.cgi?id=88477 + + Unreviewed, fix a renaming goof from http://trac.webkit.org/changeset/119660. + I accidentally renamed ByteCodeParser::getPrediction to + ByteCodeParser::getSpeculation. That was not the intent. This changes it + back. + + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::addCall): + (JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit): + (JSC::DFG::ByteCodeParser::getPrediction): + (JSC::DFG::ByteCodeParser::handleCall): + (JSC::DFG::ByteCodeParser::parseBlock): + +2012-06-08 Andy Wingo + + Explictly mark stubs called by JIT as being internal + https://bugs.webkit.org/show_bug.cgi?id=88552 + + Reviewed by Filip Pizlo. + + * dfg/DFGOSRExitCompiler.h: + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * jit/HostCallReturnValue.h: + * jit/JITStubs.cpp: + * jit/JITStubs.h: + * jit/ThunkGenerators.cpp: + * llint/LLIntSlowPaths.h: Mark a bunch of stubs as being + WTF_INTERNAL. Change most calls to SYMBOL_STRING_RELOCATION to + LOCAL_REFERENCE, or GLOBAL_REFERENCE in the case of the wrappers + to truly global symbols. + * offlineasm/asm.rb: Generate LOCAL_REFERENCE instead of + SYMBOL_STRING_RELOCATION. + +2012-06-08 Geoffrey Garen + + Don't rely on weak pointers for eager CodeBlock finalization + https://bugs.webkit.org/show_bug.cgi?id=88465 + + Reviewed by Gavin Barraclough. + + This is incompatible with lazy weak pointer finalization. + + I considered just making CodeBlock finalization lazy-friendly, but it + turns out that the heap is already way up in CodeBlock's business when + it comes to finalization, so I decided to finish the job and move full + responsibility for CodeBlock finalization into the heap. + + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Maybe this + will build. + + * debugger/Debugger.cpp: Updated for rename. + + * heap/Heap.cpp: + (JSC::Heap::deleteAllCompiledCode): Renamed for consistency. Fixed a bug + where we would not delete code for a code block that had been previously + jettisoned. I don't know if this happens in practice -- I mostly did + this to improve consistency with deleteUnmarkedCompiledCode. + + (JSC::Heap::deleteUnmarkedCompiledCode): New function, responsible for + eager finalization of unmarked code blocks. + + (JSC::Heap::collect): Updated for rename. Updated to call + deleteUnmarkedCompiledCode(), which takes care of jettisoned DFG code + blocks too. + + (JSC::Heap::addCompiledCode): Renamed, since this points to all code + now, not just functions. + + * heap/Heap.h: + (Heap): Keep track of all user code, not just functions. This is a + negligible additional overhead, since most code is function code. + + * runtime/Executable.cpp: + (JSC::*::finalize): Removed these functions, since we don't rely on + weak pointer finalization anymore. + + (JSC::FunctionExecutable::FunctionExecutable): Moved linked-list stuff + into base class so all executables can be in the list. + + (JSC::EvalExecutable::clearCode): + (JSC::ProgramExecutable::clearCode): + (JSC::FunctionExecutable::clearCode): All we need to do is delete our + CodeBlock -- that will delete all of its internal data structures. + + (JSC::FunctionExecutable::clearCodeIfNotCompiling): Factored out a helper + function to improve clarity. + + * runtime/Executable.h: + (JSC::ExecutableBase): Moved linked-list stuff + into base class so all executables can be in the list. + + (JSC::NativeExecutable::create): + (NativeExecutable): + (ScriptExecutable): + (JSC::ScriptExecutable::finishCreation): + (JSC::EvalExecutable::create): + (EvalExecutable): + (JSC::ProgramExecutable::create): + (ProgramExecutable): + (FunctionExecutable): + (JSC::FunctionExecutable::create): Don't use a finalizer -- the heap + will call us back to destroy our code block. + + (JSC::FunctionExecutable::discardCode): Renamed to clearCodeIfNotCompiling() + for clarity. + + (JSC::FunctionExecutable::isCompiling): New helper function, for clarity. + + (JSC::ScriptExecutable::clearCodeVirtual): New helper function, since + the heap needs to make polymorphic calls to clear code. + + * runtime/JSGlobalData.cpp: + (JSC::StackPreservingRecompiler::operator()): + * runtime/JSGlobalObject.cpp: + (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Updated for + renames. + +2012-06-07 Filip Pizlo + + DFG should inline prototype chain accesses, and do the right things if the + specific function optimization is available + https://bugs.webkit.org/show_bug.cgi?id=88594 + + Reviewed by Gavin Barraclough. + + Looks like a 3% win on V8. + + * bytecode/CodeBlock.h: + (JSC::Structure::prototypeForLookup): + (JSC): + * bytecode/GetByIdStatus.cpp: + (JSC::GetByIdStatus::computeFromLLInt): + (JSC): + (JSC::GetByIdStatus::computeForChain): + (JSC::GetByIdStatus::computeFor): + * bytecode/GetByIdStatus.h: + (JSC::GetByIdStatus::GetByIdStatus): + (JSC::GetByIdStatus::isSimple): + (JSC::GetByIdStatus::chain): + (JSC::GetByIdStatus::specificValue): + (GetByIdStatus): + * bytecode/StructureSet.h: + (StructureSet): + (JSC::StructureSet::singletonStructure): + * bytecode/StructureStubInfo.h: + (JSC::StructureStubInfo::initGetByIdProto): + (JSC::StructureStubInfo::initGetByIdChain): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::handleGetById): + * dfg/DFGRepatch.cpp: + (JSC::DFG::tryCacheGetByID): + * jit/JITStubs.cpp: + (JSC::JITThunks::tryCacheGetByID): + * runtime/JSGlobalObject.h: + (JSC::Structure::prototypeForLookup): + (JSC): + * runtime/Structure.h: + (Structure): + +2012-06-07 Gavin Barraclough + + Remove JSObject::m_inheritorID + https://bugs.webkit.org/show_bug.cgi?id=88378 + + Reviewed by Geoff Garen. + + This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction), + and most objects don't need an inheritorID (this value is only used if the object is used as a prototype). + Instead use a private named value in the object's property storage. + + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): + - No need m_inheritorID to initialize! + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateBasicJSObject): + - No need m_inheritorID to initialize! + * llint/LowLevelInterpreter.asm: + - No need m_inheritorID to initialize! + * runtime/JSGlobalData.h: + (JSGlobalData): + - Added private name 'm_inheritorIDKey'. + * runtime/JSGlobalThis.cpp: + (JSC::JSGlobalThis::setUnwrappedObject): + - resetInheritorID is now passed a JSGlobalData&. + * runtime/JSObject.cpp: + (JSC::JSObject::visitChildren): + - No m_inheritorID to be marked. + (JSC::JSObject::createInheritorID): + - Store the newly created inheritorID in the property map. + * runtime/JSObject.h: + (JSC::JSObject::resetInheritorID): + - Remove the inheritorID from property storage. + (JSC::JSObject::inheritorID): + - Read the inheritorID from property storage. + +2012-06-07 Gavin Barraclough + + Math.pow on iOS does not support denormal numbers. + https://bugs.webkit.org/show_bug.cgi?id=88592 + + Reviewed by Filip Pizlo. + + Import an implementation from fdlibm, detect cases where it is safe to use the system + implementation & where we should fall back to fdlibm. + + * runtime/MathObject.cpp: + (JSC::isDenormal): + (JSC::isEdgeCase): + (JSC::mathPow): + - On iOS, detect cases where denormal support may be required & use fdlibm in these cases. + (JSC::mathProtoFuncPow): + - Changed to use mathPow. + (JSC::fdlibmScalbn): + (JSC::fdlibmPow): + - These functions imported from fdlibm; original style retained to ease future merging. + +2012-06-07 Patrick Gansterer + + Unreviewed. Build fix for !ENABLE(JIT) after r119441. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + +2012-06-07 Andy Wingo + + Unreviewed build fix after r119593. + + * llint/LLIntOfflineAsmConfig.h (OFFLINE_ASM_GLOBAL_LABEL): Fix + uses of "name" to be "label", the macro's parameter. Otherwise we + serialize mentions of the literal symbol "name" into the objcode. + Causes a build error using GNU ld (not gold). + +2012-06-06 Ryosuke Niwa + + Chromium build fix attempt. Why do we need to list these files in gyp!? + + * JavaScriptCore.gypi: + +2012-06-06 Filip Pizlo + + PredictedType should be called SpeculatedType + https://bugs.webkit.org/show_bug.cgi?id=88477 + + Rubber stamped by Gavin Barraclough. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::shouldOptimizeNow): + (JSC::CodeBlock::dumpValueProfiles): + * bytecode/CodeBlock.h: + (JSC::CodeBlock::valueProfilePredictionForBytecodeOffset): + * bytecode/LazyOperandValueProfile.cpp: + (JSC::LazyOperandValueProfileParser::prediction): + * bytecode/LazyOperandValueProfile.h: + (LazyOperandValueProfileParser): + * bytecode/PredictedType.cpp: Removed. + * bytecode/PredictedType.h: Removed. + * bytecode/SpeculatedType.cpp: Copied from Source/JavaScriptCore/bytecode/PredictedType.cpp. + (JSC::speculationToString): + (JSC::speculationToAbbreviatedString): + (JSC::speculationFromClassInfo): + (JSC::speculationFromStructure): + (JSC::speculationFromCell): + (JSC::speculationFromValue): + * bytecode/SpeculatedType.h: Copied from Source/JavaScriptCore/bytecode/PredictedType.h. + (JSC): + (JSC::isAnySpeculation): + (JSC::isCellSpeculation): + (JSC::isObjectSpeculation): + (JSC::isFinalObjectSpeculation): + (JSC::isFinalObjectOrOtherSpeculation): + (JSC::isFixedIndexedStorageObjectSpeculation): + (JSC::isStringSpeculation): + (JSC::isArraySpeculation): + (JSC::isFunctionSpeculation): + (JSC::isInt8ArraySpeculation): + (JSC::isInt16ArraySpeculation): + (JSC::isInt32ArraySpeculation): + (JSC::isUint8ArraySpeculation): + (JSC::isUint8ClampedArraySpeculation): + (JSC::isUint16ArraySpeculation): + (JSC::isUint32ArraySpeculation): + (JSC::isFloat32ArraySpeculation): + (JSC::isFloat64ArraySpeculation): + (JSC::isArgumentsSpeculation): + (JSC::isActionableIntMutableArraySpeculation): + (JSC::isActionableFloatMutableArraySpeculation): + (JSC::isActionableTypedMutableArraySpeculation): + (JSC::isActionableMutableArraySpeculation): + (JSC::isActionableArraySpeculation): + (JSC::isArrayOrOtherSpeculation): + (JSC::isMyArgumentsSpeculation): + (JSC::isInt32Speculation): + (JSC::isDoubleRealSpeculation): + (JSC::isDoubleSpeculation): + (JSC::isNumberSpeculation): + (JSC::isBooleanSpeculation): + (JSC::isOtherSpeculation): + (JSC::isEmptySpeculation): + (JSC::mergeSpeculations): + (JSC::mergeSpeculation): + * bytecode/StructureSet.h: + (JSC::StructureSet::speculationFromStructures): + * bytecode/ValueProfile.h: + (JSC::ValueProfileBase::ValueProfileBase): + (JSC::ValueProfileBase::dump): + (JSC::ValueProfileBase::computeUpdatedPrediction): + (ValueProfileBase): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::initialize): + (JSC::DFG::AbstractState::execute): + (JSC::DFG::AbstractState::mergeStateAtTail): + * dfg/DFGAbstractState.h: + (JSC::DFG::AbstractState::speculateInt32Unary): + (JSC::DFG::AbstractState::speculateNumberUnary): + (JSC::DFG::AbstractState::speculateBooleanUnary): + (JSC::DFG::AbstractState::speculateInt32Binary): + (JSC::DFG::AbstractState::speculateNumberBinary): + * dfg/DFGAbstractValue.h: + (JSC::DFG::StructureAbstractValue::filter): + (JSC::DFG::StructureAbstractValue::speculationFromStructures): + (JSC::DFG::AbstractValue::AbstractValue): + (JSC::DFG::AbstractValue::clear): + (JSC::DFG::AbstractValue::isClear): + (JSC::DFG::AbstractValue::makeTop): + (JSC::DFG::AbstractValue::clobberStructures): + (JSC::DFG::AbstractValue::isTop): + (JSC::DFG::AbstractValue::set): + (JSC::DFG::AbstractValue::merge): + (JSC::DFG::AbstractValue::filter): + (JSC::DFG::AbstractValue::validateIgnoringValue): + (JSC::DFG::AbstractValue::validate): + (JSC::DFG::AbstractValue::checkConsistency): + (JSC::DFG::AbstractValue::dump): + (AbstractValue): + * dfg/DFGArgumentPosition.h: + (JSC::DFG::ArgumentPosition::ArgumentPosition): + (JSC::DFG::ArgumentPosition::mergeArgumentAwareness): + (JSC::DFG::ArgumentPosition::prediction): + (ArgumentPosition): + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + * dfg/DFGByteCodeParser.cpp: + (ByteCodeParser): + (JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation): + (JSC::DFG::ByteCodeParser::getLocal): + (JSC::DFG::ByteCodeParser::getArgument): + (JSC::DFG::ByteCodeParser::addCall): + (JSC::DFG::ByteCodeParser::getSpeculationWithoutOSRExit): + (JSC::DFG::ByteCodeParser::getSpeculation): + (InlineStackEntry): + (JSC::DFG::ByteCodeParser::handleCall): + (JSC::DFG::ByteCodeParser::handleIntrinsic): + (JSC::DFG::ByteCodeParser::handleGetById): + (JSC::DFG::ByteCodeParser::parseBlock): + (JSC::DFG::ByteCodeParser::fixVariableAccessSpeculations): + (JSC::DFG::ByteCodeParser::parse): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::getIndexedPropertyStorageLoadElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGConstantFoldingPhase.cpp: + (JSC::DFG::ConstantFoldingPhase::run): + * dfg/DFGFixupPhase.cpp: + (JSC::DFG::FixupPhase::fixupNode): + (JSC::DFG::FixupPhase::fixDoubleEdge): + * dfg/DFGGraph.cpp: + (JSC::DFG::Graph::nameOfVariableAccessData): + (JSC::DFG::Graph::dump): + (JSC::DFG::Graph::predictArgumentTypes): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::getJSConstantSpeculation): + (JSC::DFG::Graph::isPredictedNumerical): + (JSC::DFG::Graph::byValIsPure): + * dfg/DFGJITCompiler.h: + (JSC::DFG::JITCompiler::getSpeculation): + * dfg/DFGNode.h: + (JSC::DFG::Node::Node): + (JSC::DFG::Node::getHeapPrediction): + (JSC::DFG::Node::predictHeap): + (JSC::DFG::Node::prediction): + (JSC::DFG::Node::predict): + (JSC::DFG::Node::shouldSpeculateInteger): + (JSC::DFG::Node::shouldSpeculateDouble): + (JSC::DFG::Node::shouldSpeculateNumber): + (JSC::DFG::Node::shouldSpeculateBoolean): + (JSC::DFG::Node::shouldSpeculateFinalObject): + (JSC::DFG::Node::shouldSpeculateFinalObjectOrOther): + (JSC::DFG::Node::shouldSpeculateArray): + (JSC::DFG::Node::shouldSpeculateArguments): + (JSC::DFG::Node::shouldSpeculateInt8Array): + (JSC::DFG::Node::shouldSpeculateInt16Array): + (JSC::DFG::Node::shouldSpeculateInt32Array): + (JSC::DFG::Node::shouldSpeculateUint8Array): + (JSC::DFG::Node::shouldSpeculateUint8ClampedArray): + (JSC::DFG::Node::shouldSpeculateUint16Array): + (JSC::DFG::Node::shouldSpeculateUint32Array): + (JSC::DFG::Node::shouldSpeculateFloat32Array): + (JSC::DFG::Node::shouldSpeculateFloat64Array): + (JSC::DFG::Node::shouldSpeculateArrayOrOther): + (JSC::DFG::Node::shouldSpeculateObject): + (JSC::DFG::Node::shouldSpeculateCell): + (Node): + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::setPrediction): + (JSC::DFG::PredictionPropagationPhase::mergePrediction): + (JSC::DFG::PredictionPropagationPhase::propagate): + (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::fillStorage): + (JSC::DFG::SpeculativeJIT::writeBarrier): + (JSC::DFG::GPRTemporary::GPRTemporary): + (JSC::DFG::FPRTemporary::FPRTemporary): + (JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch): + (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality): + (JSC::DFG::SpeculativeJIT::compilePeepHoleBranch): + (JSC::DFG::SpeculativeJIT::compile): + (JSC::DFG::SpeculativeJIT::checkArgumentTypes): + (JSC::DFG::SpeculativeJIT::compileGetCharCodeAt): + (JSC::DFG::SpeculativeJIT::compileGetByValOnString): + (JSC::DFG::SpeculativeJIT::compileValueToInt32): + (JSC::DFG::SpeculativeJIT::compileDoubleAsInt32): + (JSC::DFG::SpeculativeJIT::compileInt32ToDouble): + (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLength): + (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray): + (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): + (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray): + (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray): + (JSC::DFG::SpeculativeJIT::compileInstanceOf): + (JSC::DFG::SpeculativeJIT::compileAdd): + (JSC::DFG::SpeculativeJIT::compileArithSub): + (JSC::DFG::SpeculativeJIT::compileArithNegate): + (JSC::DFG::SpeculativeJIT::compileArithMul): + (JSC::DFG::SpeculativeJIT::compileArithMod): + (JSC::DFG::SpeculativeJIT::compare): + (JSC::DFG::SpeculativeJIT::compileStrictEq): + (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage): + (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments): + (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength): + (JSC::DFG::SpeculativeJIT::compileRegExpExec): + * dfg/DFGSpeculativeJIT.h: + (DFG): + (JSC::DFG::ValueSource::forSpeculation): + (SpeculativeJIT): + (GPRTemporary): + (FPRTemporary): + (JSC::DFG::SpecDoubleOperand::SpecDoubleOperand): + (JSC::DFG::SpecDoubleOperand::~SpecDoubleOperand): + (JSC::DFG::SpecDoubleOperand::fpr): + (JSC::DFG::SpecCellOperand::SpecCellOperand): + (JSC::DFG::SpecCellOperand::~SpecCellOperand): + (JSC::DFG::SpecCellOperand::gpr): + (JSC::DFG::SpecBooleanOperand::SpecBooleanOperand): + (JSC::DFG::SpecBooleanOperand::~SpecBooleanOperand): + (JSC::DFG::SpecBooleanOperand::gpr): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): + (JSC::DFG::SpeculativeJIT::fillSpecDouble): + (JSC::DFG::SpeculativeJIT::fillSpecCell): + (JSC::DFG::SpeculativeJIT::fillSpecBoolean): + (JSC::DFG::SpeculativeJIT::compileObjectEquality): + (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality): + (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality): + (JSC::DFG::SpeculativeJIT::compileDoubleCompare): + (JSC::DFG::SpeculativeJIT::compileLogicalNot): + (JSC::DFG::SpeculativeJIT::emitBranch): + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): + (JSC::DFG::SpeculativeJIT::fillSpecDouble): + (JSC::DFG::SpeculativeJIT::fillSpecCell): + (JSC::DFG::SpeculativeJIT::fillSpecBoolean): + (JSC::DFG::SpeculativeJIT::compileObjectEquality): + (JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality): + (JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality): + (JSC::DFG::SpeculativeJIT::compileDoubleCompare): + (JSC::DFG::SpeculativeJIT::compileLogicalNot): + (JSC::DFG::SpeculativeJIT::emitBranch): + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGVariableAccessData.h: + (JSC::DFG::VariableAccessData::VariableAccessData): + (JSC::DFG::VariableAccessData::predict): + (JSC::DFG::VariableAccessData::nonUnifiedPrediction): + (JSC::DFG::VariableAccessData::prediction): + (JSC::DFG::VariableAccessData::argumentAwarePrediction): + (JSC::DFG::VariableAccessData::mergeArgumentAwarePrediction): + (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote): + (JSC::DFG::VariableAccessData::makePredictionForDoubleFormat): + (VariableAccessData): + +2012-06-06 Filip Pizlo + + Global object variable accesses should not require an extra load + https://bugs.webkit.org/show_bug.cgi?id=88385 + + Reviewed by Gavin Barraclough and Geoffrey Garen. + + Previously, if you wanted to access a global variable, you'd first have + to load the register array from the appropriate global object and then + either load or store at an offset to the register array. This is because + JSGlobalObject inherited from JSVariableObject, and JSVariableObject is + designed with the pessimistic assumption that its register array may + point into the call stack. This is never the case for global objects. + Hence, even though the global object may add more registers at any time, + it does not need to store them in a contiguous array. It can use a + SegmentedVector or similar. + + This patch refactors global objects and variable objects as follows: + + - The functionality to track variables in an indexable array using a + SymbolTable to map names to indices is moved into JSSymbolTableObject, + which is now a supertype of JSVariableObject. JSVariableObject is now + just a holder for a registers array and implements the registerAt() + method that is left abstract in JSSymbolTableObject. Because all users + of JSVariableObject know whether they are a JSStaticScopeObject, + JSActivation, or JSGlobalObject, this "abstract" method is not virtual; + instead the utility methods that would call registerAt() are now + template functions that require you to know statically what subtype of + JSSymbolTableObject you're using (JSVariableObject or something else), + so that registerAt() can be statically bound. + + - A new class is added called JSSegmentedVariableObject, which only + differs from JSVariableObject in how it allocates registers. It uses a + SegmentedVector instead of manually managing a pointer to a contiguous + slab of registers. This changes the interface somewhat; for example + with JSVariableObject if you wanted to add a register you had to do + it yourself since the JSVariableObject didn't know how the registers + array ought to be allocated. With JSSegmentedVariableObject you can + just call addRegisters(). JSSegmentedVariableObject preserves the + invariant that once you get a pointer into a register, that pointer + will continue to be valid so long as the JSSegmentedVariableObject is + alive. This allows the JITs and interpreters to skip the extra load. + + - JSGlobalObject now inherits from JSSegmentedVariableObject. For now + (and possibly forever) it is the only subtype of this new class. + + - The bytecode format is changed so that get_global_var and + put_global_var have a pointer to the register directly rather than + having an index. A convenience method is provided in + JSSegmentedVariableObject to get the index given a a pointer, which is + used for assertions and debug dumps. + + This appears to be a 1% across the board win. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + * bytecode/Instruction.h: + (Instruction): + (JSC::Instruction::Instruction): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::ResolveResult::registerPointer): + (JSC): + (JSC::BytecodeGenerator::BytecodeGenerator): + (JSC::BytecodeGenerator::retrieveLastUnaryOp): + (JSC::BytecodeGenerator::resolve): + (JSC::BytecodeGenerator::resolveConstDecl): + (JSC::BytecodeGenerator::emitGetStaticVar): + (JSC::BytecodeGenerator::emitPutStaticVar): + * bytecompiler/BytecodeGenerator.h: + (ResolveResult): + (BytecodeGenerator): + * dfg/DFGAssemblyHelpers.h: + (AssemblyHelpers): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::globalVarLoadElimination): + (JSC::DFG::CSEPhase::globalVarStoreElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGGraph.cpp: + (JSC::DFG::Graph::dump): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::globalObjectFor): + (Graph): + * dfg/DFGNode.h: + (JSC::DFG::Node::hasVarNumber): + (Node): + (JSC::DFG::Node::hasRegisterPointer): + (JSC::DFG::Node::registerPointer): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * heap/Heap.h: + (Heap): + (JSC::Heap::isWriteBarrierEnabled): + (JSC): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::execute): + (JSC::Interpreter::privateExecute): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::emit_op_get_global_var): + (JSC::JIT::emit_op_put_global_var): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::emit_op_get_global_var): + (JSC::JIT::emit_op_put_global_var): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/JSGlobalObject.cpp: + (JSC): + (JSC::JSGlobalObject::put): + (JSC::JSGlobalObject::putDirectVirtual): + (JSC::JSGlobalObject::defineOwnProperty): + (JSC::JSGlobalObject::visitChildren): + (JSC::JSGlobalObject::addStaticGlobals): + (JSC::JSGlobalObject::getOwnPropertySlot): + (JSC::JSGlobalObject::getOwnPropertyDescriptor): + * runtime/JSGlobalObject.h: + (JSGlobalObject): + (JSC::JSGlobalObject::JSGlobalObject): + (JSC): + (JSC::JSGlobalObject::hasOwnPropertyForWrite): + * runtime/JSSegmentedVariableObject.cpp: Added. + (JSC): + (JSC::JSSegmentedVariableObject::findRegisterIndex): + (JSC::JSSegmentedVariableObject::addRegisters): + (JSC::JSSegmentedVariableObject::visitChildren): + * runtime/JSSegmentedVariableObject.h: Added. + (JSC): + (JSSegmentedVariableObject): + (JSC::JSSegmentedVariableObject::registerAt): + (JSC::JSSegmentedVariableObject::assertRegisterIsInThisObject): + (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject): + (JSC::JSSegmentedVariableObject::finishCreation): + * runtime/JSStaticScopeObject.cpp: + (JSC::JSStaticScopeObject::put): + (JSC::JSStaticScopeObject::putDirectVirtual): + (JSC::JSStaticScopeObject::getOwnPropertySlot): + * runtime/JSSymbolTableObject.cpp: Added. + (JSC): + (JSC::JSSymbolTableObject::destroy): + (JSC::JSSymbolTableObject::deleteProperty): + (JSC::JSSymbolTableObject::getOwnPropertyNames): + (JSC::JSSymbolTableObject::putDirectVirtual): + (JSC::JSSymbolTableObject::isDynamicScope): + * runtime/JSSymbolTableObject.h: Added. + (JSC): + (JSSymbolTableObject): + (JSC::JSSymbolTableObject::symbolTable): + (JSC::JSSymbolTableObject::JSSymbolTableObject): + (JSC::JSSymbolTableObject::finishCreation): + (JSC::symbolTableGet): + (JSC::symbolTablePut): + (JSC::symbolTablePutWithAttributes): + * runtime/JSVariableObject.cpp: + (JSC): + * runtime/JSVariableObject.h: + (JSVariableObject): + (JSC::JSVariableObject::JSVariableObject): + (JSC::JSVariableObject::finishCreation): + (JSC): + * runtime/WriteBarrier.h: + +2012-06-06 Filip Pizlo + + DFG arguments access slow path should not crash if the arguments haven't been created + https://bugs.webkit.org/show_bug.cgi?id=88471 + + Reviewed by Gavin Barraclough. + + * dfg/DFGCCallHelpers.h: + (JSC::DFG::CCallHelpers::setupArgumentsWithExecState): + (CCallHelpers): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-06-06 Michael Saboff + + ENH: Add Logging to GC Marking Phase + https://bugs.webkit.org/show_bug.cgi?id=88364 + + Reviewed by Filip Pizlo. + + Log GC marking to stderr or a file. The logging in controlled + with the define ENABLE_OBJECT_MARK_LOGGING in wtf/Platform.h. + If DATA_LOG_TO_FILE in wtf/DataLog.cpp is set to 1, output is + logged to a file otherwise it is logged to stderr. + + When logging is enabled, the GC is built single threaded since the + log output from the various threads isn't buffered and output in a + thread safe manner. + + * heap/Heap.cpp: + (JSC::Heap::markRoots): + * heap/MarkStack.cpp: + (JSC::MarkStackThreadSharedData::resetChildren): + (JSC::MarkStackThreadSharedData::childVisitCount): + (JSC::MarkStackThreadSharedData::markingThreadMain): + (JSC::MarkStackThreadSharedData::markingThreadStartFunc): + (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData): + (JSC::MarkStackThreadSharedData::reset): + * heap/MarkStack.h: + (MarkStackThreadSharedData): + (MarkStack): + (JSC::MarkStack::sharedData): + (JSC::MarkStack::resetChildCount): + (JSC::MarkStack::childCount): + (JSC::MarkStack::incrementChildCount): + * runtime/JSArray.cpp: + (JSC::JSArray::visitChildren): + * runtime/JSCell.cpp: + (JSC::JSCell::className): + * runtime/JSCell.h: + (JSCell): + (JSC::JSCell::visitChildren): + * runtime/JSString.cpp: + (JSC::JSString::visitChildren): + * runtime/JSString.h: + (JSString): + * runtime/Structure.h: + (JSC::MarkStack::internalAppend): + +2012-06-06 Gavin Barraclough + + Assigning to a static property should not change iteration order + https://bugs.webkit.org/show_bug.cgi?id=88401 + + Reviewed by Geoff Garen. + + A specific iteration order is not defined by the spec, but test-262 somewhat tenuously + requires that it is at least stable, e.g. ch10/10.4/10.4.2/S10.4.2_A1.1_T1.js + + Whilst it is not clear that this behavior really arises from the specification, it + would seem like common sense to conform to this. + + The problem here is that we allow properties in the structure to shadow those in the + static table, and we iterate the properties in the structure first - which means that + as values of existing properties are modified, their iteration order changes too. + + The easy fix is to iterate the properties from the static table first. This has a + further benefit, since it will mean that user added properties will come after those + present in the static table (respected the expected insertion-order). + + * runtime/JSObject.cpp: + (JSC::JSObject::getOwnPropertyNames): + - Iterate static properties first. + +2012-06-06 Andy Wingo + + Ensure consistent order of evaluation in LLInt slow paths + https://bugs.webkit.org/show_bug.cgi?id=88409 + + Reviewed by Geoffrey Garen. + + * llint/LLIntSlowPaths.cpp: + (slow_path_mul) + (slow_path_sub) + (slow_path_div) + (slow_path_mod) + (slow_path_lshift) + (slow_path_rshift) + (slow_path_urshift) + (slow_path_bitand) + (slow_path_bitor) + (slow_path_bitxor): Avoid calling toNumber, toInt32, or toUInt32 + multiple times without intervening sequence points. Fixes + fast/js/exception-sequencing-binops.html with GCC 4.7 on x86-64 + Linux, which reordered evaluation of the arguments to fmod. + +2012-06-06 Andy Wingo + + [GTK] Enable the LLInt + https://bugs.webkit.org/show_bug.cgi?id=88315 + + Reviewed by Filip Pizlo. + + * GNUmakefile.am: Add rules to generate LLIntDesiredOffsets.h and + LLIntAssembly.h. + * GNUmakefile.list.am: Add offlineasm and llint files to the + dist. Add LLInt source files to the build. + * llint/LowLevelInterpreter.asm (crash): Generate a store of + 0xbbadbeef to a register, not to a constant. Otherwise, gas was + failing to assemble result. + * offlineasm/asm.rb (labelReference): Generate a + SYMBOL_STRING_RELOCATION instead of a SYMBOL_STRING, so that we go + through the PLT on ELF systems. + +2012-06-06 Andy Wingo + + REGRESSION (r106478): None of the Paper.js JavaScript examples work + https://bugs.webkit.org/show_bug.cgi?id=87158 + + Reviewed by Michael Saboff. + + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::resolve): If we have to bail out to + dynamicResolve(), only skip static scopes from the head of the + scope chain. Before, we were also skipping activations with + direct eval as well, which was incorrect. + +2012-06-06 Dan Bernstein + + Reverted r119567, the fix for , because it broke the 32-bit build. + + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateBasicJSObject): + * llint/LowLevelInterpreter.asm: + * runtime/JSGlobalData.h: + (JSGlobalData): + * runtime/JSGlobalThis.cpp: + (JSC::JSGlobalThis::setUnwrappedObject): + * runtime/JSObject.cpp: + (JSC::JSObject::visitChildren): + (JSC::JSObject::createInheritorID): + * runtime/JSObject.h: + (JSObject): + (JSC::JSObject::resetInheritorID): + (JSC): + (JSC::JSObject::offsetOfInheritorID): + (JSC::JSObject::inheritorID): + +2012-06-05 Yuqiang Xian + + Improve Math.round and Math.floor intrinsic + https://bugs.webkit.org/show_bug.cgi?id=88314 + + Reviewed by Filip Pizlo. + + Currently we call a native function from the JIT code to complete the + "round" and "floor" operations. We could inline some fast paths + especially for those positive values on the platforms where floating + point truncation is supported. + This brings 3% gain on Kraken, especially 32% on audio-oscillator, + and slight win on SunSpider, measured on IA32. + + * jit/ThunkGenerators.cpp: + (JSC::floorThunkGenerator): + (JSC): + (JSC::roundThunkGenerator): + +2012-06-05 Gavin Barraclough + + Remove JSObject::m_inheritorID + https://bugs.webkit.org/show_bug.cgi?id=88378 + + Reviewed by Geoff Garen. + + This is rarely used, and not performance critical (the commonly accessed copy is cached on JSFunction), + and most objects don't need an inheritorID (this value is only used if the object is used as a prototype). + Instead use a private named value in the object's property storage. + + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject): + - No need m_inheritorID to initialize! + * jit/JITInlineMethods.h: + (JSC::JIT::emitAllocateBasicJSObject): + - No need m_inheritorID to initialize! + * llint/LowLevelInterpreter.asm: + - No need m_inheritorID to initialize! + * runtime/JSGlobalData.h: + (JSGlobalData): + - Added private name 'm_inheritorIDKey'. + * runtime/JSGlobalThis.cpp: + (JSC::JSGlobalThis::setUnwrappedObject): + - resetInheritorID is now passed a JSGlobalData&. + * runtime/JSObject.cpp: + (JSC::JSObject::visitChildren): + - No m_inheritorID to be marked. + (JSC::JSObject::createInheritorID): + - Store the newly created inheritorID in the property map. + * runtime/JSObject.h: + (JSC::JSObject::resetInheritorID): + - Remove the inheritorID from property storage. + (JSC::JSObject::inheritorID): + - Read the inheritorID from property storage. + +2012-06-05 Filip Pizlo + + DFG CFG simplification should not attempt to deref nodes inside of an unreachable subgraph + https://bugs.webkit.org/show_bug.cgi?id=88362 + + Reviewed by Gavin Barraclough. + + * dfg/DFGCFGSimplificationPhase.cpp: + (JSC::DFG::CFGSimplificationPhase::fixPhis): + (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference): + +2012-06-05 Mark Hahnenberg + + Entry into JSC should CRASH() if the Heap is busy + https://bugs.webkit.org/show_bug.cgi?id=88355 + + Reviewed by Geoffrey Garen. + + Interpreter::execute() returns jsNull() right now if we try to enter it while + the Heap is busy (e.g. with a collection), which is okay, but some code paths + that call Interpreter::execute() allocate objects before checking if the Heap + is busy. Attempting to execute JS code while the Heap is busy should not be + allowed and should be enforced by a release-mode CRASH() to prevent vague, + unhelpful backtraces later on if somebody makes a mistake. Normally, recursively + executing JS code is okay, e.g. for evals, but it should not occur during a + Heap allocation or collection because the Heap is not guaranteed to be in a + consistent state (especially during collections). We are protected from + executing JS on the same Heap concurrently on two separate threads because + they must each take a JSLock first. However, we are not protected from reentrant + execution of JS on the same thread because JSLock allows reentrancy. Therefore, + we should fail early if we detect an entrance into JS code while the Heap is busy. + + * heap/Heap.cpp: Changed Heap::collect so that it sets the m_operationInProgress field + at the beginning of collection and then unsets it at the end so that it is set at all + times throughout the duration of a collection rather than sporadically during various + phases. There is no reason to unset during a collection because our collector does + not currently support running additional JS between the phases of a collection. + (JSC::Heap::getConservativeRegisterRoots): + (JSC::Heap::markRoots): + (JSC::Heap::collect): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::execute): Crash if the Heap is busy. + * runtime/Completion.cpp: Crash if the Heap is busy. We do it here before we call + Interpreter::execute() because we do some allocation prior to calling execute() which + could cause Heap corruption if, for example, that allocation caused a collection. + (JSC::evaluate): + +2012-06-05 Dongwoo Im + + Add 'isProtocolHandlerRegistered' and 'unregisterProtocolHandler'. + https://bugs.webkit.org/show_bug.cgi?id=73176 + + Reviewed by Adam Barth. + + Two more APIs are added in Custom Scheme Handler specification. + http://dev.w3.org/html5/spec/Overview.html#custom-handlers + One is 'isProtocolHandlerRegistered' to query whether the specific URL + is registered or not. + The other is 'unregisterProtocolHandler' to remove the registered URL. + + * Configurations/FeatureDefines.xcconfig: Add a macro 'ENABLE_CUSTOM_SCHEME_HANDLER'. + +2012-06-04 Filip Pizlo + + DFG CFG simplification should correct the variables at the head of the predecessor block + https://bugs.webkit.org/show_bug.cgi?id=88284 + + Reviewed by Geoffrey Garen. + + * dfg/DFGCFGSimplificationPhase.cpp: + (JSC::DFG::CFGSimplificationPhase::mergeBlocks): + +2012-06-04 Geoffrey Garen + + Unreviewed. + + Rolled out r119364 because it's still causing crashes (when running + v8-earley in release builds of DRT) + + This time for sure! + + * heap/Heap.cpp: + (JSC::Heap::collect): + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::sweep): + * heap/MarkedBlock.h: + (JSC::MarkedBlock::resetAllocator): + (JSC): + * heap/MarkedSpace.cpp: + (JSC::ResetAllocator::operator()): + (JSC): + (JSC::MarkedSpace::resetAllocators): + (JSC::MarkedSpace::sweepWeakSets): + * heap/MarkedSpace.h: + (MarkedSpace): + * heap/WeakBlock.cpp: + (JSC::WeakBlock::sweep): + * heap/WeakSet.cpp: + (JSC::WeakSet::sweep): + (JSC::WeakSet::tryFindAllocator): + * heap/WeakSet.h: + (JSC::WeakSet::shrink): + +2012-06-04 Filip Pizlo + + DFG arguments simplification should have rationalized handling of TearOffArguments + https://bugs.webkit.org/show_bug.cgi?id=88206 + + Reviewed by Geoffrey Garen. + + - Accesses to the unmodified arguments register ought to have the same effect on + alias/escape analysis of arguments as accesses to the mutable arguments register. + + - The existence of TearOffArguments should not get in the way of arguments aliasing. + + - TearOffArguments should be eliminated if CreateArguments is eliminated. + + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse): + +2012-06-04 Gavin Barraclough + + Remove enabledProfilerReference + https://bugs.webkit.org/show_bug.cgi?id=88258 + + Reviewed by Michael Saboff. + + Make the enabled profiler a member of JSGlobalData, and switch code that accesses it to do so directly + via the JSGlobalData, rather than holding a Profiler** reference to it. Do not pass the Profiler** + reference to JIT code. This patch does not change the stack layout on entry into JIT code (passing an + unused void* instead), since this is an intrusive change better handled in a separate patch. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::throwException): + (JSC::Interpreter::execute): + (JSC::Interpreter::executeCall): + (JSC::Interpreter::executeConstruct): + (JSC::Interpreter::privateExecute): + * jit/JITCode.h: + (JSC::JITCode::execute): + - Don't pass Profiler** to JIT code. + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_profile_will_call): + (JSC::JIT::emit_op_profile_did_call): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_profile_will_call): + (JSC::JIT::emit_op_profile_did_call): + * jit/JITStubs.cpp: + (JSC): + (JSC::ctiTrampoline): + (JSC::ctiVMThrowTrampoline): + (JSC::ctiOpThrowNotCaught): + (JSC::JITThunks::JITThunks): + (JSC::DEFINE_STUB_FUNCTION): + - For ARM_THUMB2, rename ENABLE_PROFILER_REFERENCE_OFFSET to FIRST_STACK_ARGUMENT (which is how it is being used). + - For MIPS, remove ENABLE_PROFILER_REFERENCE_OFFSET. + * jit/JITStubs.h: + (JITStackFrame): + (JSC): + - Renamed enabledProfilerReference to unusedX. + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * llint/LowLevelInterpreter.asm: + * profiler/Profiler.cpp: + (JSC): + (JSC::Profiler::startProfiling): + (JSC::Profiler::stopProfiling): + * profiler/Profiler.h: + (Profiler): + - Removed s_sharedEnabledProfilerReference, enabledProfilerReference(). + * runtime/JSGlobalData.cpp: + (JSC::JSGlobalData::JSGlobalData): + * runtime/JSGlobalData.h: + (JSC): + (JSC::JSGlobalData::enabledProfiler): + (JSGlobalData): + - Added m_enabledProfiler, enabledProfiler(). + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::~JSGlobalObject): + +2012-06-04 Filip Pizlo + + get_argument_by_val should be profiled everywhere + https://bugs.webkit.org/show_bug.cgi?id=88205 + + Reviewed by Geoffrey Garen. + + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emitSlow_op_get_argument_by_val): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + +2012-06-04 Filip Pizlo + + DFG arguments simplification takes unkindly to direct accesses to the arguments register + https://bugs.webkit.org/show_bug.cgi?id=88261 + + Reviewed by Geoffrey Garen. + + Fixed arguments simplification for direct accesses to the arguments register, which may + arise if CSE had not run. Fixed CSE so that it does run prior to arguments simplification, + by making it a full-fledged member of the fixpoint. Fixed other issues in arguments + simplification, like realizing that it needs to bail if there is a direct assignment to + the arguments register, and failing to turn CreateArguments into PhantomArguments. Also + fixed CSE's handling of store elimination of captured locals in the presence of a + GetMyArgumentByVal (or one of its friends), and fixed CSE to correctly fixup variables at + tail if the Flush it removes is the last operation on a local in a basic block. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::run): + (JSC::DFG::CSEPhase::setLocalStoreElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + (CSEPhase): + * dfg/DFGDriver.cpp: + (JSC::DFG::compile): + +2012-06-04 Anders Carlsson + + Fix a struct/class mismatch. + + * heap/Handle.h: + (Handle): + +2012-06-04 David Kilzer + + BUILD FIX: FeatureDefines.xcconfig should match across projects + + * Configurations/FeatureDefines.xcconfig: + - Add missing ENABLE_LEGACY_CSS_VENDOR_PREFIXES. + +2012-06-02 Geoffrey Garen + + Weak pointer finalization should be lazy + https://bugs.webkit.org/show_bug.cgi?id=87599 + + Reviewed by Sam Weinig. + + This time for sure! + + * heap/Heap.cpp: + (JSC::Heap::collect): Don't sweep eagerly -- we'll sweep lazily instead. + + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::sweep): Sweep our weak set before we sweep our other + destructors -- this is our last chance to run weak set finalizers before + we recycle our memory. + + * heap/MarkedBlock.h: + (JSC::MarkedBlock::resetAllocator): + * heap/MarkedSpace.cpp: + (JSC::MarkedSpace::resetAllocators): + * heap/MarkedSpace.h: + (JSC::MarkedSpace::resetAllocators): Don't force allocator reset anymore. + It will happen automatically when a weak set is swept. It's simpler to + have only one canonical way for this to happen, and it wasn't buying + us anything to do it eagerly. + + * heap/WeakBlock.cpp: + (JSC::WeakBlock::sweep): Don't short-circuit a sweep unless we know + the sweep would be a no-op. If even one finalizer is pending, we need to + run it, since we won't get another chance. + + * heap/WeakSet.cpp: + (JSC::WeakSet::sweep): This loop can be simpler now that + WeakBlock::sweep() does what we mean. + + Reset our allocator after a sweep because this is the optimal time to + start trying to recycle old weak pointers. + + (JSC::WeakSet::tryFindAllocator): Don't sweep when searching for an + allocator because we've swept already, and forcing a new sweep would be + wasteful. + + * heap/WeakSet.h: + (JSC::WeakSet::shrink): Be sure to reset our allocator after a shrink + because the shrink may have removed the block the allocator was going to + allocate out of. + +2012-06-02 Filip Pizlo + + If the DFG bytecode parser detects that op_method_check has gone polymorphic, it + shouldn't revert all the way to GetById/GetByIdFlush + https://bugs.webkit.org/show_bug.cgi?id=88176 + + Reviewed by Geoffrey Garen. + + Refactored the code so that the op_method_check case of the parser gracefully falls + through to all of the goodness of the normal op_get_by_id case. + + * dfg/DFGByteCodeParser.cpp: + (ByteCodeParser): + (JSC::DFG::ByteCodeParser::handleGetById): + (DFG): + (JSC::DFG::ByteCodeParser::parseBlock): + +2012-06-02 Filip Pizlo + + DFG CSE should be able to eliminate unnecessary flushes of arguments and captured variables + https://bugs.webkit.org/show_bug.cgi?id=87929 + + Reviewed by Geoffrey Garen. + + Slight speed-up on V8. Big win (up to 50%) on programs that inline very small functions. + + This required a bunch of changes: + + - The obvious change is making CSE essentially ignore whether or not the set of + operations between the Flush and the SetLocal can exit, and instead focus on whether or + not that set of operations can clobber the world or access local variables. This code + is now refactored to return a set of flags indicating any of these events, and the CSE + decides what to do based on those flags. If the set of operations is non-clobbering + and non-accessing, then the Flush is turned into a Phantom on the child of the + SetLocal. This expands the liveness of the relevant variable but virtually guarantees + that it will be register allocated and not flushed to the stack. So, yeah, this patch + is a lot of work to save a few stores to the stack. + + - Previously, CheckArgumentsNotCreated was optimized "lazily" in that you only knew if + it was a no-op if you were holding onto a CFA abstract state. But this would make the + CSE act pessimistically, since it doesn't use the CFA. Hence, this patch changes the + constant folding phase into something more broad; it now fixes up + CheckArgumentsNotCreated nodes by turning them into phantoms if it knows that they are + no-ops. + + - Arguments simplification was previously relying on this very strange PhantomArguments + node, which had two different meanings: for normal execution it meant the empty value + but for OSR exit it meant that the arguments should be reified. This produces problems + when set SetLocals to the captured arguments registers are CSE'd away, since we'd be + triggering reification of arguments without having initialized the arguments registers + to empty. The cleanest solution was to fix PhantomArguments to have one meaning: + namely, arguments reification on OSR exit. Hence, this patch changes arguments + simplification to change SetLocal of CreateArguments on the arguments registers to be + a SetLocal of Empty. + + - Argument value recoveries were previously derived from the value source of the + arguments at the InlineStart. But that relies on all SetLocals to arguments having + been flushed. It's possible that we could have elided the SetLocal to the arguments + at the callsite because there were subsequent SetLocals to the arguments inside of the + callee, in which case the InlineStart would get the wrong information. Hence, this + patch changes argument value recovery computation to operate over the ArgumentPositions + directly. + + - But that doesn't actually work, because previously, there was no way to link an + InlineStart back to the corresponding ArgumentPositions, at least not without some + ugliness. So this patch instates the rule that the m_argumentPositions vector consists + of disjoint subsequences such that each subsequence corresponds to an inline callsite + and can be identified by its first index, and within each subsequence are the + ArgumentPositions of all of the arguments ordered by argument index. This required + flipping the order in which ArgumentPositions are added to the vector, and giving + InlineStart an operand that indicates the start of that inline callsite's + ArgumentPosition subsequence. + + - This patch also revealed a nasty bug in the reification of arguments in inline call + frames on OSR exit. Since the reification was happening after the values of virtual + registers were recovered, the value recoveries of the inline arguments were wrong. + Hence using operationCreateInlinedArguments is wrong. For example a value recovery + might say that you have to box a double, but if we had already boxed it then boxing + it a second time will result in garbage. The specific case of this bug was this patch + uncovered was that now it is possible for an inline call frame to not have any valid + value recoveries for any inline arguments, if the optimization elides all argument + flushes, while at the same time optimizing away arguments creation. Then OSR exit + would try to recover the arguments using the inline call frame, which had bogus + information, and humorous crashes would ensue. This patch fixes this issue by moving + arguments reification to after call frame reification, so that arguments reification + can always use operationCreateArguments instead of operationCreateInlinedArguments. + + - This patch may turn a Flush into a Phantom. That's kind of the whole point. But that + broke forward speculation checks, which knew to look for a Flush prior to a SetLocal + but didn't know that there could alternatively be a Phantom in place of the Flush. + This patch fixes that by augmenting the forward speculation check logic. + + - Finally, in the process of having fun with all of the above, I realized that my DFG + validation was not actually running on every phase like I had originally designed it + to. In fact it was only running just after bytecode parsing. I initially tried to + make it run in every phase but found that this causes some tests to timeout + (specifically the evil fuzzing ones), so I decided on a compromise where: (i) in + release mode validation never runs, (ii) in debug mode validation will run just + after parsing and just before the backend, and (iii) it's possible with a simple + switch to enable validation to run on every phase. + + Luckily all of the above issues were already covered by the 77 or so DFG-specific + layout tests. Hence, this patch does not introduce any new tests despite being so + meaty. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGArgumentPosition.h: + (JSC::DFG::ArgumentPosition::prediction): + (JSC::DFG::ArgumentPosition::doubleFormatState): + (JSC::DFG::ArgumentPosition::shouldUseDoubleFormat): + (ArgumentPosition): + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::handleInlining): + (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::SetLocalStoreEliminationResult::SetLocalStoreEliminationResult): + (SetLocalStoreEliminationResult): + (JSC::DFG::CSEPhase::setLocalStoreElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGCommon.h: + * dfg/DFGConstantFoldingPhase.cpp: + (JSC::DFG::ConstantFoldingPhase::run): + * dfg/DFGDriver.cpp: + (JSC::DFG::compile): + * dfg/DFGNode.h: + (Node): + (JSC::DFG::Node::hasArgumentPositionStart): + (JSC::DFG::Node::argumentPositionStart): + * dfg/DFGOSRExitCompiler32_64.cpp: + (JSC::DFG::OSRExitCompiler::compileExit): + * dfg/DFGOSRExitCompiler64.cpp: + (JSC::DFG::OSRExitCompiler::compileExit): + * dfg/DFGPhase.cpp: + (DFG): + * dfg/DFGPhase.h: + (Phase): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-06-02 Geoffrey Garen + + DOM string cache should hash pointers, not characters + https://bugs.webkit.org/show_bug.cgi?id=88175 + + Reviewed by Phil Pizlo and Sam Weinig. + + * heap/Weak.h: + (JSC::weakAdd): + (JSC::weakRemove): Made these function templates slightly more generic + to accommodate new client types. + +2012-06-01 Filip Pizlo + + DFG CFA should know that PutByVal can clobber the world + https://bugs.webkit.org/show_bug.cgi?id=88155 + + Reviewed by Gavin Barraclough. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + +2012-06-01 Filip Pizlo + + DFG CFA should mark basic blocks as having constants if local accesses yield constants + https://bugs.webkit.org/show_bug.cgi?id=88153 + + Reviewed by Gavin Barraclough. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + +2012-06-01 Filip Pizlo + + DFG arguments simplification phase uses a node.codeOrigin after appending a node + https://bugs.webkit.org/show_bug.cgi?id=88151 + + Reviewed by Geoffrey Garen. + + The right thing to do is to save the CodeOrigin before appending to the graph. + + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + +2012-06-01 Filip Pizlo + + DFG should not emit unnecessary speculation checks when performing an int32 to double conversion on + a value that is proved to be a number, predicted to be an int32, but not proved to be an int32 + https://bugs.webkit.org/show_bug.cgi?id=88146 + + Reviewed by Gavin Barraclough. + + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compileInt32ToDouble): + +2012-06-01 Filip Pizlo + + DFG constant folding search for the last local access skips the immediately previous local access + https://bugs.webkit.org/show_bug.cgi?id=88141 + + Reviewed by Michael Saboff. + + If you use a loop in the style of: + + for (i = start; i--;) + + then you need to remember that the first value of 'i' that the loop body will see is 'start - 1'. + Hence the following is probably wrong: + + for (i = start - 1; i--;) + + * dfg/DFGConstantFoldingPhase.cpp: + (JSC::DFG::ConstantFoldingPhase::run): + +2012-06-01 Filip Pizlo + + DFG constant folding should be OK with GetLocal of captured variables having a constant + https://bugs.webkit.org/show_bug.cgi?id=88137 + + Reviewed by Gavin Barraclough. + + * dfg/DFGConstantFoldingPhase.cpp: + (JSC::DFG::ConstantFoldingPhase::run): + +2012-05-31 Mark Hahnenberg + + JSGlobalObject does not mark m_privateNameStructure + https://bugs.webkit.org/show_bug.cgi?id=88023 + + Rubber stamped by Gavin Barraclough. + + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::visitChildren): We need to mark this so it doesn't get + inadvertently garbage collected. + +2012-05-31 Erik Arvidsson + + Make DOM Exceptions Errors + https://bugs.webkit.org/show_bug.cgi?id=85078 + + Reviewed by Oliver Hunt. + + WebIDL mandates that exceptions should have Error.prototype on its prototype chain. + + For JSC we have access to the Error.prototype from the binding code. + + For V8 we set a field in the WrapperTypeInfo and when the constructor function is created we + set the prototype as needed. + + Updated test: fast/dom/DOMException/prototype-object.html + + * JavaScriptCore.xcodeproj/project.pbxproj: + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::reset): + * runtime/JSGlobalObject.h: + (JSC): + (JSGlobalObject): + (JSC::JSGlobalObject::errorPrototype): + +2012-05-31 Andy Wingo + + Fix reference to unset variable in debug mode + https://bugs.webkit.org/show_bug.cgi?id=87981 + + Reviewed by Geoffrey Garen. + + * runtime/JSONObject.cpp (Stringifier::Holder::Holder): + Initialize m_size in debug mode, as we check it later in an assert. + +2012-05-30 Mark Hahnenberg + + Heap should sweep incrementally + https://bugs.webkit.org/show_bug.cgi?id=85429 + + We shouldn't have to wait for the opportunistic GC timer to fire in order + to call object destructors. Instead, we should incrementally sweep some + subset of the blocks requiring sweeping periodically. We tie this sweeping + to a timer rather than to collections because we want to reclaim this memory + even if we stop allocating. This way, our memory usage scales smoothly with + actual use, regardless of whether we've recently done an opportunistic GC or not. + + Reviewed by Geoffrey Garen. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.gypi: + * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * heap/Heap.cpp: + (JSC::Heap::Heap): + (JSC::Heap::collect): We no longer sweep during a full sweep. We only shrink now, + which we will switch over to being done during incremental sweeping too as soon as + all finalizers can be run lazily (and, by extension, incrementally). + (JSC::Heap::sweeper): + (JSC): + * heap/Heap.h: + (JSC): + (Heap): + * heap/IncrementalSweeper.cpp: Added. + (JSC): + (JSC::IncrementalSweeper::timerDidFire): The IncrementalSweeper works very similarly to + GCActivityCallback. It is tied to a run-loop based timer that fires periodically based + on how long the previous sweep increment took to run. The IncrementalSweeper doesn't do + anything if the platform doesn't support CoreFoundation. + (JSC::IncrementalSweeper::IncrementalSweeper): + (JSC::IncrementalSweeper::~IncrementalSweeper): + (JSC::IncrementalSweeper::create): + (JSC::IncrementalSweeper::scheduleTimer): + (JSC::IncrementalSweeper::cancelTimer): + (JSC::IncrementalSweeper::doSweep): Iterates over the snapshot of the MarkedSpace taken + during the last collection, checking to see which blocks need sweeping. If it successfully + gets to the end of the blocks that need sweeping then it cancels the timer. + (JSC::IncrementalSweeper::startSweeping): We take a snapshot of the Heap and store it in + a Vector that the incremental sweep will iterate over. We also reset our index into this Vector. + * heap/IncrementalSweeper.h: Added. + (JSC): + (IncrementalSweeper): + * heap/MarkedBlock.h: + (JSC::MarkedBlock::needsSweeping): If a block is in the Marked state it needs sweeping + to be usable and to run any destructors that need to be run. + +2012-05-30 Patrick Gansterer + + [WINCE] Fix JSString after r115516. + https://bugs.webkit.org/show_bug.cgi?id=87892 + + Reviewed by Geoffrey Garen. + + r115516 splitted JSString into two classes, with addition nested classes. + Add a workaround for the WinCE compiler since it can't resolve the friend class + declerations corretly and denies the access to protected members of JSString. + + * runtime/JSString.h: + (JSC::JSRopeString::RopeBuilder::append): + (JSC::JSRopeString::append): + (JSRopeString): + +2012-05-30 Oliver Hunt + + Really provide error information with the inspector disabled + https://bugs.webkit.org/show_bug.cgi?id=87910 + + Reviewed by Filip Pizlo. + + Don't bother checking for anything other than pre-existing error info. + In the absence of complete line number information you'll only get the + line a function starts on, but at least it's something. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::throwException): + +2012-05-30 Filip Pizlo + + LLInt broken on x86-32 with JIT turned off + https://bugs.webkit.org/show_bug.cgi?id=87906 + + Reviewed by Geoffrey Garen. + + Fixed the code to not clobber registers that contain important things, like the call frame. + + * llint/LowLevelInterpreter32_64.asm: + +2012-05-30 Filip Pizlo + + ScriptDebugServer wants sourceIDs that are non-zero because that's what HashMaps want, so JSC should placate it + https://bugs.webkit.org/show_bug.cgi?id=87887 + + Reviewed by Darin Adler. + + Better fix - we now never call SourceProvider::asID() if SourceProvider* is 0. + + * parser/Nodes.h: + (JSC::ScopeNode::sourceID): + * parser/SourceCode.h: + (JSC::SourceCode::providerID): + (SourceCode): + * parser/SourceProvider.h: + (SourceProvider): + (JSC::SourceProvider::asID): + * runtime/Executable.h: + (JSC::ScriptExecutable::sourceID): + +2012-05-30 Filip Pizlo + + ScriptDebugServer wants sourceIDs that are non-zero because that's what HashMaps want, so JSC should placate it + https://bugs.webkit.org/show_bug.cgi?id=87887 + + Reviewed by Geoffrey Garen. + + * parser/SourceProvider.h: + (JSC::SourceProvider::asID): + +2012-05-30 Oliver Hunt + + DFG does not correctly handle exceptions caught in the LLInt + https://bugs.webkit.org/show_bug.cgi?id=87885 + + Reviewed by Filip Pizlo. + + Make the DFG use genericThrow, rather than reimplementing a small portion of it. + Also make the LLInt slow paths validate that their PC is correct. + + * dfg/DFGOperations.cpp: + * llint/LLIntSlowPaths.cpp: + (LLInt): + +2012-05-29 Filip Pizlo + + DFG CFA should infer types and values of captured variables + https://bugs.webkit.org/show_bug.cgi?id=87813 + + Reviewed by Gavin Barraclough. + + Slight speed-up in V8/earley-boyer (~1%). + + * bytecode/CodeBlock.h: + (JSC::CodeBlock::argumentsAreCaptured): + (JSC::CodeBlock::argumentIsCaptured): + (CodeBlock): + * dfg/DFGAbstractState.cpp: + (DFG): + (JSC::DFG::AbstractState::beginBasicBlock): + (JSC::DFG::AbstractState::initialize): + (JSC::DFG::AbstractState::endBasicBlock): + (JSC::DFG::AbstractState::execute): + (JSC::DFG::AbstractState::clobberWorld): + (JSC::DFG::AbstractState::clobberStructures): + (JSC::DFG::AbstractState::mergeStateAtTail): + (JSC::DFG::AbstractState::merge): + (JSC::DFG::AbstractState::mergeToSuccessors): + * dfg/DFGAbstractState.h: + (JSC::DFG::AbstractState::variables): + (AbstractState): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-05-30 Patrick Gansterer + + Unreviewed. Build fix for !ENABLE(JIT) after r117823. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + +2012-05-30 Sheriff Bot + + Unreviewed, rolling out r118868. + http://trac.webkit.org/changeset/118868 + https://bugs.webkit.org/show_bug.cgi?id=87828 + + introduced ~20 crashes on Mac and Qt bots (Requested by pizlo_ + on #webkit). + + * heap/Heap.cpp: + (JSC::Heap::collect): + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::sweep): + * heap/MarkedBlock.h: + (JSC::MarkedBlock::sweepWeakSet): + (JSC): + * heap/MarkedSpace.cpp: + (JSC::SweepWeakSet::operator()): + (JSC): + (JSC::MarkedSpace::sweepWeakSets): + * heap/MarkedSpace.h: + (MarkedSpace): + +2012-05-29 Geoffrey Garen + + Rolled back in r118646, now that + https://bugs.webkit.org/show_bug.cgi?id=87784 is fixed. + + http://trac.webkit.org/changeset/118646 + https://bugs.webkit.org/show_bug.cgi?id=87599 + + * heap/Heap.cpp: + (JSC::Heap::collect): + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::sweep): + * heap/MarkedBlock.h: + (JSC): + * heap/MarkedSpace.cpp: + (JSC): + * heap/MarkedSpace.h: + (MarkedSpace): + +2012-05-29 Filip Pizlo + + DFG should keep captured variables alive until the (inline) return. + https://bugs.webkit.org/show_bug.cgi?id=87205 + + Reviewed by Gavin Barraclough. + + Changes the way we do flushing for captured variables and arguments. Instead of flushing + each SetLocal immediately, we flush at kill points. So a SetLocal will cause a Flush of + whatever was live in the variable previously, and a return will cause a Flush of all + captured variables and all arguments. + + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::setDirect): + (JSC::DFG::ByteCodeParser::set): + (JSC::DFG::ByteCodeParser::setLocal): + (JSC::DFG::ByteCodeParser::getArgument): + (JSC::DFG::ByteCodeParser::setArgument): + (JSC::DFG::ByteCodeParser::findArgumentPositionForArgument): + (ByteCodeParser): + (JSC::DFG::ByteCodeParser::findArgumentPositionForLocal): + (JSC::DFG::ByteCodeParser::findArgumentPosition): + (JSC::DFG::ByteCodeParser::flush): + (JSC::DFG::ByteCodeParser::flushDirect): + (JSC::DFG::ByteCodeParser::flushArgumentsAndCapturedVariables): + (JSC::DFG::ByteCodeParser::handleInlining): + (JSC::DFG::ByteCodeParser::parseBlock): + (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::setLocalStoreElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck): + +2012-05-29 Geoffrey Garen + + WeakGCMap should be lazy-finalization-safe + https://bugs.webkit.org/show_bug.cgi?id=87784 + + Reviewed by Darin Adler. + + * runtime/WeakGCMap.h: + (JSC::WeakGCMap::get): Since this is a map of raw WeakImpl pointers, and + not Weak, we need to verify manually that the WeakImpl is live before + we return its payload. + +2012-05-29 Mark Hahnenberg + + CopiedSpace::doneCopying could start another collection + https://bugs.webkit.org/show_bug.cgi?id=86538 + + Reviewed by Geoffrey Garen. + + It's possible that if we don't have anything at the head of to-space + after a collection and the BlockAllocator doesn't have any fresh blocks + to give us right now we could start another collection while still in + the middle of the first collection when we call CopiedSpace::addNewBlock(). + + One way to resolve this would be to have Heap::shouldCollect() check that + m_operationInProgress is NoOperation. This would prevent the path in + getFreshBlock() that starts the collection if we're already in the middle of one. + + I could not come up with a test case to reproduce this crash on ToT. + + * heap/Heap.h: + (JSC::Heap::shouldCollect): We shouldn't collect if we're already in the middle + of a collection, i.e. the current operation should be NoOperation. + +2012-05-29 David Barr + + Introduce ENABLE_CSS_IMAGE_RESOLUTION compile flag + https://bugs.webkit.org/show_bug.cgi?id=87685 + + Reviewed by Eric Seidel. + + Add a configuration option for CSS image-resolution support, disabling it by default. + + * Configurations/FeatureDefines.xcconfig: + +2012-05-28 Sheriff Bot + + Unreviewed, rolling out r118646. + http://trac.webkit.org/changeset/118646 + https://bugs.webkit.org/show_bug.cgi?id=87691 + + broke V8 raytrace benchmark (Requested by pizlo_ on #webkit). + + * heap/Heap.cpp: + (JSC::Heap::collect): + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::sweep): + * heap/MarkedBlock.h: + (JSC::MarkedBlock::sweepWeakSet): + (JSC): + * heap/MarkedSpace.cpp: + (JSC::SweepWeakSet::operator()): + (JSC): + (JSC::MarkedSpace::sweepWeakSets): + * heap/MarkedSpace.h: + (MarkedSpace): + +2012-05-28 Filip Pizlo + + DFG should not generate code for code that the CFA proves to be unreachable + https://bugs.webkit.org/show_bug.cgi?id=87682 + + Reviewed by Sam Weinig. + + This also fixes a small performance bug where CFA was not marking blocks + as having constants (and hence not triggering constant folding) if the only + constants were on GetLocals. + + And fixing that bug revealed another bug: constant folding was assuming that + a GetLocal must be the first access to a local in a basic block. This isn't + true. The first access may be a Flush. This patch fixes that issue using the + safest approach possible, since we don't need to be clever for something that + only happens in one of our benchmarks. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGConstantFoldingPhase.cpp: + (JSC::DFG::ConstantFoldingPhase::run): + * dfg/DFGJITCompiler.h: + (JSC::DFG::JITCompiler::noticeOSREntry): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-05-28 Carlos Garcia Campos + + Unreviewed. Fix make distcheck. + + * GNUmakefile.list.am: Add missing header file. + +2012-05-27 Geoffrey Garen + + Weak pointer finalization should be lazy + https://bugs.webkit.org/show_bug.cgi?id=87599 + + Reviewed by Darin Adler. + + * heap/Heap.cpp: + (JSC::Heap::collect): Don't force immediate finalization -- it will + happen lazily. + + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::sweep): Sweep a block's weak set when sweeping the + block. The weak set may not have been swept yet, and this is our last + chance to run weak finalizers before we recycle the memory they reference. + + * heap/MarkedBlock.h: + * heap/MarkedSpace.cpp: + (JSC::MarkedBlock::sweepWeakSets): + * heap/MarkedSpace.h: + (JSC::MarkedSpace::sweepWeakSets): Nixed sweepWeakSets because it's unused + now. + +2012-05-26 Geoffrey Garen + + WebKit should be lazy-finalization-safe (esp. the DOM) v2 + https://bugs.webkit.org/show_bug.cgi?id=87581 + + Reviewed by Oliver Hunt. + + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::callDestructor): + * heap/WeakBlock.h: + * heap/WeakSetInlines.h: + (JSC::WeakBlock::finalize): Since we don't guarantee destruction order, + it's not valid to access GC pointers like the Structure pointer during + finalization. We NULL out the structure pointer in debug builds to try + to make this programming mistake more obvious. + + * API/JSCallbackConstructor.cpp: + (JSC::JSCallbackConstructor::destroy): + * API/JSCallbackObject.cpp: + (JSC::::destroy): + (JSC::JSCallbackObjectData::finalize): + * runtime/Arguments.cpp: + (JSC::Arguments::destroy): + * runtime/DateInstance.cpp: + (JSC::DateInstance::destroy): + * runtime/Error.cpp: + (JSC::StrictModeTypeErrorFunction::destroy): + * runtime/Executable.cpp: + (JSC::ExecutableBase::destroy): + (JSC::NativeExecutable::destroy): + (JSC::ScriptExecutable::destroy): + (JSC::EvalExecutable::destroy): + (JSC::ProgramExecutable::destroy): + (JSC::FunctionExecutable::destroy): + * runtime/JSGlobalObject.cpp: + (JSC::JSGlobalObject::destroy): + * runtime/JSPropertyNameIterator.cpp: + (JSC::JSPropertyNameIterator::destroy): + * runtime/JSStaticScopeObject.cpp: + (JSC::JSStaticScopeObject::destroy): + * runtime/JSString.cpp: + (JSC::JSString::destroy): + * runtime/JSVariableObject.cpp: + (JSC::JSVariableObject::destroy): + * runtime/NameInstance.cpp: + (JSC::NameInstance::destroy): + * runtime/RegExp.cpp: + (JSC::RegExp::destroy): + * runtime/RegExpConstructor.cpp: + (JSC::RegExpConstructor::destroy): + * runtime/Structure.cpp: + (JSC::Structure::destroy): + * runtime/StructureChain.cpp: + (JSC::StructureChain::destroy): Use static_cast instead of jsCast because + jsCast does Structure-based validation, and our Structure is not guaranteed + to be alive when we get finalized. + +2012-05-22 Filip Pizlo + + DFG CSE should eliminate redundant WeakJSConstants + https://bugs.webkit.org/show_bug.cgi?id=87179 + + Reviewed by Gavin Barraclough. + + Merged r118141 from dfgopt. + + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::weakConstantCSE): + (CSEPhase): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGNode.h: + (JSC::DFG::Node::weakConstant): + +2012-05-22 Filip Pizlo + + DFG CSE should do redundant store elimination + https://bugs.webkit.org/show_bug.cgi?id=87161 + + Reviewed by Oliver Hunt. + + Merge r118138 from dfgopt. + + This patch adds redundant store elimination. For example, consider this + code: + + o.x = 42; + o.x = 84; + + If o.x is speculated to be a well-behaved field, the first assignment is + unnecessary, since the second just overwrites it. We would like to + eliminate the first assignment in these cases. The need for this + optimization arises mostly from stores that our runtime requires. For + example: + + o = {f:1, g:2, h:3}; + + This will have four assignments to the structure for the newly created + object - one assignment for the empty structure, one for {f}, one for + {f, g}, and one for {f, g, h}. We would like to only have the last of + those assigments in this case. + + Intriguingly, doing so for captured variables breaks the way arguments + simplification used to work. Consider that prior to either arguments + simplification or store elimination we will have IR that looks like: + + a: SetLocal(r0, Empty) + b: SetLocal(r1, Empty) + c: GetLocal(r0) + d: CreateArguments(@c) + e: SetLocal(r0, @d) + f: SetLocal(r1, @d) + + Then redundant store elimination will eliminate the stores that + initialize the arguments registers to Empty, but then arguments + simplification eliminates the stores that initialize the arguments to + the newly created arguments - and at this point we no longer have any + stores to the arguments register, leading to hilarious crashes. This + patch therefore changes arguments simplification to replace + CreateArguments with JSConstant(Empty) rather than eliminating the + SetLocals. But this revealed bugs where arguments simplification was + being overzealous, so I fixed those bugs. + + This is a minor speed-up on V8/early and a handful of other tests. + + * bytecode/CodeBlock.h: + (JSC::CodeBlock::uncheckedActivationRegister): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse): + (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses): + (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::globalVarStoreElimination): + (CSEPhase): + (JSC::DFG::CSEPhase::putStructureStoreElimination): + (JSC::DFG::CSEPhase::putByOffsetStoreElimination): + (JSC::DFG::CSEPhase::setLocalStoreElimination): + (JSC::DFG::CSEPhase::setReplacement): + (JSC::DFG::CSEPhase::eliminate): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::uncheckedActivationRegisterFor): + (Graph): + * dfg/DFGNode.h: + (JSC::DFG::Node::isPhantomArguments): + (Node): + (JSC::DFG::Node::hasConstant): + (JSC::DFG::Node::valueOfJSConstant): + (JSC::DFG::Node::hasStructureTransitionData): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-05-21 Filip Pizlo + + DFG ConvertThis should just be a CheckStructure if the structure is known + https://bugs.webkit.org/show_bug.cgi?id=87057 + + Reviewed by Gavin Barraclough. + + Merged r118021 from dfgopt. + + This gives ValueProfile the ability to track singleton values - i.e. profiling + sites that always see the same value. + + That is then used to profile the structure in op_convert_this. + + This is then used to optimize op_convert_this into a CheckStructure if the + structure is always the same. + + That then results in better CSE in inlined code that uses 'this', since + previously we couldn't CSE accesses on 'this' from different inline call frames. + + Also fixed a bug where we were unnecessarily flushing 'this'. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::dump): + (JSC::CodeBlock::stronglyVisitStrongReferences): + * bytecode/LazyOperandValueProfile.cpp: + (JSC::CompressedLazyOperandValueProfileHolder::computeUpdatedPredictions): + * bytecode/LazyOperandValueProfile.h: + (CompressedLazyOperandValueProfileHolder): + * bytecode/Opcode.h: + (JSC): + (JSC::padOpcodeName): + * bytecode/ValueProfile.h: + (JSC::ValueProfileBase::ValueProfileBase): + (JSC::ValueProfileBase::dump): + (JSC::ValueProfileBase::computeUpdatedPrediction): + (ValueProfileBase): + * bytecompiler/BytecodeGenerator.cpp: + (JSC::BytecodeGenerator::BytecodeGenerator): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::setArgument): + (JSC::DFG::ByteCodeParser::parseBlock): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_convert_this): + (JSC::JIT::emitSlow_op_convert_this): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_convert_this): + (JSC::JIT::emitSlow_op_convert_this): + * llint/LLIntSlowPaths.cpp: + (JSC::LLInt::LLINT_SLOW_PATH_DECL): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + * runtime/JSValue.h: + (JSValue): + * runtime/Structure.h: + (JSC::JSValue::structureOrUndefined): + (JSC): + +2012-05-24 Tim Horton + + Add feature defines for web-facing parts of CSS Regions and Exclusions + https://bugs.webkit.org/show_bug.cgi?id=87442 + + + Reviewed by Dan Bernstein. + + * Configurations/FeatureDefines.xcconfig: + +2012-05-24 Geoffrey Garen + + WebKit should be lazy-finalization-safe (esp. the DOM) + https://bugs.webkit.org/show_bug.cgi?id=87456 + + Reviewed by Filip Pizlo. + + Lazy finalization adds one twist to weak pointer use: + + A HashMap of weak pointers may contain logically null entries. + (Weak pointers behave as-if null once their payloads die.) + Insertion must not assume that a pre-existing entry is + necessarily valid, and iteration must not assume that all + entries can be dereferenced. + + (Previously, I thought that it also added a second twist: + + A demand-allocated weak pointer may replace a dead payload + before the payload's finalizer runs. In that case, when the + payload's finalizer runs, the payload has already been + overwritten, and the finalizer should not clear the payload, + which now points to something new. + + But that's not the case here, since we cancel the old payload's + finalizer when we over-write it. I've added ASSERTs to verify this + assumption, in case it ever changes.) + + * API/JSClassRef.cpp: + (OpaqueJSClass::prototype): No need to specify null; that's the default. + + * API/JSWeakObjectMapRefPrivate.cpp: Use remove, since take() is gone. + + * heap/PassWeak.h: + (WeakImplAccessor::was): This is no longer a debug-only function, since + it's required to reason about lazily finalized pointers. + + * heap/Weak.h: + (JSC::weakAdd): + (JSC::weakRemove): + (JSC::weakClear): Added these helper functions for the common idioms of + what clients want to do in their weak pointer finalizers. + + * jit/JITStubs.cpp: + (JSC::JITThunks::hostFunctionStub): Use the new idioms. Otherwise, we + would return NULL for a "zombie" executable weak pointer that was waiting + for finalization (item (2)), and finalizing a dead executable weak pointer + would potentially destroy a new, live one (item (1)). + + * runtime/RegExpCache.cpp: + (JSC::RegExpCache::lookupOrCreate): + (JSC::RegExpCache::finalize): Ditto. + + (JSC::RegExpCache::invalidateCode): Check for null while iterating. (See + item (2).) + + * runtime/Structure.cpp: + (JSC::StructureTransitionTable::contains): + (JSC::StructureTransitionTable::add): Use get and set instead of add and + contains, since add and contains are not compatible with lazy finalization. + + * runtime/WeakGCMap.h: + (WeakGCMap): + (JSC::WeakGCMap::clear): + (JSC::WeakGCMap::remove): Removed a bunch of code that was incompatible with + lazy finalization because I didn't feel like making it compatible, and I had + no way to test it. + +2012-05-24 Filip Pizlo + + REGRESSION (r118013-r118031): Loops/Reloads under www.yahoo.com, quits after three tries with error + https://bugs.webkit.org/show_bug.cgi?id=87327 + + Reviewed by Geoffrey Garen. + + If you use AbstractValue::filter(StructureSet) to test subset relationships between TOP and a + set containing >=2 elements, you're going to have a bad time. + + That's because AbstractValue considers a set with >=2 elements to be equivalent to TOP, in order + to save space and speed up convergence. So filtering has no effect in this case, which made + the code think that the abstract value was proving that the structure check was unnecessary. + The correct thing to do is to use isSubsetOf() on the StructureAbstractValue, which does the + right thingies for TOP and >=2 elements. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-05-24 Filip Pizlo + + new test fast/js/dfg-arguments-mixed-alias.html fails on JSVALUE32_64 + https://bugs.webkit.org/show_bug.cgi?id=87378 + + Reviewed by Gavin Barraclough. + + - Captured variable tracking forgot did not consistently handle arguments, leading to OSR + badness. + + - Nodes capable of exiting were tracked in a non-monotonic way, leading to compiler errors. + + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::CSEPhase): + (CSEPhase): + (JSC::DFG::performCSE): + * dfg/DFGCSEPhase.h: + (DFG): + * dfg/DFGCommon.h: + * dfg/DFGDriver.cpp: + (JSC::DFG::compile): + * dfg/DFGGraph.cpp: + (JSC::DFG::Graph::resetExitStates): + (DFG): + * dfg/DFGGraph.h: + (Graph): + * dfg/DFGPhase.h: + (DFG): + (JSC::DFG::runPhase): + +2012-05-24 Geoffrey Garen + + Made WeakSet per-block instead of per-heap + https://bugs.webkit.org/show_bug.cgi?id=87401 + + Reviewed by Oliver Hunt. + + This allows us fast access to the set of all weak pointers for a block, + which is a step toward lazy finalization. + + No performance change. + + * heap/Heap.cpp: + (JSC::Heap::Heap): + (JSC::Heap::lastChanceToFinalize): Removed the per-heap weak set, since + it's per-block now. + + (JSC::Heap::markRoots): Delegate weak set visiting to the marked space, + since it knows how to iterate all blocks. + + (JSC::Heap::collect): Moved the reaping outside of markRoots, since it + doesn't mark anything. + + Make sure to reset allocators after shrinking, since shrinking may + deallocate the current allocator. + + * heap/Heap.h: + (Heap): No more per-heap weak set, since it's per-block now. + + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::MarkedBlock): + * heap/MarkedBlock.h: + (MarkedBlock): + (JSC::MarkedBlock::lastChanceToFinalize): Migrated finalization logic + here from the heap, so the heap doesn't need to know about our internal + data structures like our weak set. + + (JSC::MarkedBlock::heap): + (JSC::MarkedBlock::weakSet): + (JSC::MarkedBlock::shrink): + (JSC::MarkedBlock::resetAllocator): + (JSC::MarkedBlock::visitWeakSet): + (JSC::MarkedBlock::reapWeakSet): + (JSC::MarkedBlock::sweepWeakSet): + * heap/MarkedSpace.cpp: + (JSC::VisitWeakSet::VisitWeakSet): + (JSC::VisitWeakSet::operator()): + (VisitWeakSet): + (JSC): + (JSC::ReapWeakSet::operator()): + (JSC::SweepWeakSet::operator()): + (JSC::LastChanceToFinalize::operator()): + (JSC::MarkedSpace::lastChanceToFinalize): + (JSC::ResetAllocator::operator()): + (JSC::MarkedSpace::resetAllocators): + (JSC::MarkedSpace::visitWeakSets): + (JSC::MarkedSpace::reapWeakSets): + (JSC::MarkedSpace::sweepWeakSets): + (JSC::Shrink::operator()): + (JSC::MarkedSpace::shrink): + * heap/MarkedSpace.h: + (MarkedSpace): Make sure to account for our weak sets when sweeping, + shrinking, etc. + + * heap/WeakSet.cpp: + (JSC): + * heap/WeakSet.h: + (WeakSet): + (JSC::WeakSet::heap): + (JSC): + (JSC::WeakSet::lastChanceToFinalize): + (JSC::WeakSet::visit): + (JSC::WeakSet::reap): + (JSC::WeakSet::shrink): + (JSC::WeakSet::resetAllocator): Inlined some things since they're called + once per block now instead of once per heap. + + * heap/WeakSetInlines.h: + (JSC::WeakSet::allocate): Use the per-block weak set since there is no + per-heap weak set anymore. + +2012-05-24 Gavin Barraclough + + Fix arm build + + Rubber stamped by Geoff Garen + + * dfg/DFGGPRInfo.h: + (GPRInfo): + +2012-05-24 Gavin Barraclough + + Move cacheFlush from ExecutableAllocator to Assembler classes + https://bugs.webkit.org/show_bug.cgi?id=87420 + + Reviewed by Oliver Hunt. + + Makes more sense there, & remove a pile of #ifdefs. + + * assembler/ARMAssembler.cpp: + (JSC): + (JSC::ARMAssembler::cacheFlush): + * assembler/ARMAssembler.h: + (ARMAssembler): + (JSC::ARMAssembler::cacheFlush): + * assembler/ARMv7Assembler.h: + (JSC::ARMv7Assembler::relinkJump): + (JSC::ARMv7Assembler::cacheFlush): + (ARMv7Assembler): + (JSC::ARMv7Assembler::setInt32): + (JSC::ARMv7Assembler::setUInt7ForLoad): + * assembler/AbstractMacroAssembler.h: + (JSC::AbstractMacroAssembler::cacheFlush): + * assembler/LinkBuffer.h: + (JSC::LinkBuffer::performFinalization): + * assembler/MIPSAssembler.h: + (JSC::MIPSAssembler::relinkJump): + (JSC::MIPSAssembler::relinkCall): + (JSC::MIPSAssembler::repatchInt32): + (JSC::MIPSAssembler::cacheFlush): + (MIPSAssembler): + * assembler/SH4Assembler.h: + (JSC::SH4Assembler::repatchCompact): + (JSC::SH4Assembler::cacheFlush): + (SH4Assembler): + * assembler/X86Assembler.h: + (X86Assembler): + (JSC::X86Assembler::cacheFlush): + * jit/ExecutableAllocator.cpp: + (JSC): + * jit/ExecutableAllocator.h: + (ExecutableAllocator): + +2012-05-24 John Mellor + + Font Boosting: Add compile flag and runtime setting + https://bugs.webkit.org/show_bug.cgi?id=87394 + + Reviewed by Adam Barth. + + Add ENABLE_FONT_BOOSTING. + + * Configurations/FeatureDefines.xcconfig: + +2012-05-24 Allan Sandfeld Jensen + + cti_vm_throw gets kicked out by gcc 4.6 -flto + https://bugs.webkit.org/show_bug.cgi?id=56088 + + Reviewed by Darin Adler. + + Add REFERENCED_FROM_ASM to functions only referenced from assembler. + + * dfg/DFGOperations.cpp: + * jit/HostCallReturnValue.h: + * jit/JITStubs.h: + * jit/ThunkGenerators.cpp: + +2012-05-24 Filip Pizlo + + Incorrect merge of r117542 from dfg opt branch in r118323 is leading to fast/js/dfg-arguments-osr-exit.html failing + https://bugs.webkit.org/show_bug.cgi?id=87350 + + Reviewed by Maciej Stachowiak. + + The dfgopt branch introduced the notion of a local variable being killed because it was aliased + to the Arguments object as in cases like: + + var a = arguments; + return a.length; + + This required changes to OSR exit handling - if the variable is dead but aliased to arguments, then + OSR exit should reify the arguments. But meanwhile, in tip of tree we introduced special handling for + dead variables on OSR exit. When the two were merged in r118323, the structure of the if/else branches + ended up being such that we would treat dead arguments variables as totally dead as opposed to treating + them as variables that need arguments reification. + + This fixes the structure of the relevant if/else block so that variables that are dead-but-arguments + end up being treated as reified arguments objects, while variables that are dead but not aliased to + arguments are treated as tip of tree would have treated them (initialize to Undefined). + + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-05-24 Csaba Osztrogonác + + Unreviewed 32 bit buildfix after r118325. + + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): Use ASSERT_UNUSED instead ASSERT. + +2012-05-23 Filip Pizlo + + DFG operationTearOffActivation should return after handling the null activation case + https://bugs.webkit.org/show_bug.cgi?id=87348 + + + Reviewed by Oliver Hunt. + + * dfg/DFGOperations.cpp: + +2012-05-23 Filip Pizlo + + Unreviewed, merge the arguments fix in r118138 to get bots green. + + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse): + +2012-05-20 Filip Pizlo + + DFG CFA should record if a node can OSR exit + https://bugs.webkit.org/show_bug.cgi?id=86905 + + Reviewed by Oliver Hunt. + + Merged r117931 from dfgopt. + + Adds a NodeFlag that denotes nodes that are known to not have OSR exits. + This ought to aid any backwards analyses that need to know when a + backward flow merge might happen due to a side exit. + + Also added assertions into speculationCheck() that ensure that we did not + mark a node as non-exiting and then promptly compile in an exit. This + helped catch some minor bugs where we were doing unnecessary speculation + checks. + + This is a perf-neutral change. The speculation checks that this removes + were not on hot paths of major benchmarks. + + * bytecode/PredictedType.h: + (JSC): + (JSC::isAnyPrediction): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGAbstractState.h: + (JSC::DFG::AbstractState::speculateInt32Unary): + (AbstractState): + (JSC::DFG::AbstractState::speculateNumberUnary): + (JSC::DFG::AbstractState::speculateBooleanUnary): + (JSC::DFG::AbstractState::speculateInt32Binary): + (JSC::DFG::AbstractState::speculateNumberBinary): + * dfg/DFGNode.h: + (JSC::DFG::Node::mergeFlags): + (JSC::DFG::Node::filterFlags): + (Node): + (JSC::DFG::Node::setCanExit): + (JSC::DFG::Node::canExit): + * dfg/DFGNodeFlags.cpp: + (JSC::DFG::nodeFlagsAsString): + * dfg/DFGNodeFlags.h: + (DFG): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::SpeculativeJIT): + (JSC::DFG::SpeculativeJIT::checkArgumentTypes): + (JSC::DFG::SpeculativeJIT::compileValueToInt32): + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::speculationCheck): + (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck): + (JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution): + (SpeculativeJIT): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): + (JSC::DFG::SpeculativeJIT::fillSpeculateDouble): + (JSC::DFG::SpeculativeJIT::fillSpeculateCell): + (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal): + (JSC::DFG::SpeculativeJIT::fillSpeculateDouble): + (JSC::DFG::SpeculativeJIT::fillSpeculateCell): + (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): + (JSC::DFG::SpeculativeJIT::compile): + +2012-05-20 Filip Pizlo + + DFG should not do unnecessary indirections when storing to objects + https://bugs.webkit.org/show_bug.cgi?id=86959 + + Reviewed by Oliver Hunt. + + Merged r117819 from dfgopt. + + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::getByOffsetLoadElimination): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-05-17 Filip Pizlo + + DFG should optimize aliased uses of the Arguments object of the current call frame + https://bugs.webkit.org/show_bug.cgi?id=86552 + + Reviewed by Geoff Garen. + + Merged r117542 and r117543 from dfgopt. + + Performs must-alias and escape analysis on uses of CreateArguments, and if + a variable is must-aliased to CreateArguments and does not escape, then we + turn all uses of that variable into direct arguments accesses. + + 36% speed-up on V8/earley leading to a 2.3% speed-up overall in V8. + + * bytecode/CodeBlock.h: + (JSC::CodeBlock::uncheckedArgumentsRegister): + * bytecode/ValueRecovery.h: + (JSC::ValueRecovery::argumentsThatWereNotCreated): + (ValueRecovery): + (JSC::ValueRecovery::dump): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGAdjacencyList.h: + (AdjacencyList): + (JSC::DFG::AdjacencyList::removeEdgeFromBag): + * dfg/DFGArgumentsSimplificationPhase.cpp: + (JSC::DFG::ArgumentsSimplificationPhase::run): + (ArgumentsSimplificationPhase): + (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUse): + (JSC::DFG::ArgumentsSimplificationPhase::observeBadArgumentsUses): + (JSC::DFG::ArgumentsSimplificationPhase::observeProperArgumentsUse): + (JSC::DFG::ArgumentsSimplificationPhase::isOKToOptimize): + (JSC::DFG::ArgumentsSimplificationPhase::removeArgumentsReferencingPhantomChild): + * dfg/DFGAssemblyHelpers.h: + (JSC::DFG::AssemblyHelpers::argumentsRegisterFor): + (AssemblyHelpers): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCFGSimplificationPhase.cpp: + (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference): + * dfg/DFGGPRInfo.h: + (GPRInfo): + * dfg/DFGGraph.cpp: + (JSC::DFG::Graph::collectGarbage): + (DFG): + * dfg/DFGGraph.h: + (Graph): + (JSC::DFG::Graph::executableFor): + (JSC::DFG::Graph::argumentsRegisterFor): + (JSC::DFG::Graph::uncheckedArgumentsRegisterFor): + (JSC::DFG::Graph::clobbersWorld): + * dfg/DFGNode.h: + (JSC::DFG::Node::hasHeapPrediction): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGOSRExitCompiler.cpp: + * dfg/DFGOSRExitCompiler.h: + (JSC::DFG::OSRExitCompiler::OSRExitCompiler): + (OSRExitCompiler): + * dfg/DFGOSRExitCompiler32_64.cpp: + (JSC::DFG::OSRExitCompiler::compileExit): + * dfg/DFGOSRExitCompiler64.cpp: + (JSC::DFG::OSRExitCompiler::compileExit): + * dfg/DFGOperations.cpp: + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::ValueSource::dump): + (JSC::DFG::SpeculativeJIT::compile): + (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor): + * dfg/DFGSpeculativeJIT.h: + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGVariableAccessData.h: + (JSC::DFG::VariableAccessData::VariableAccessData): + (JSC::DFG::VariableAccessData::mergeIsArgumentsAlias): + (VariableAccessData): + (JSC::DFG::VariableAccessData::isArgumentsAlias): + * jit/JITOpcodes.cpp: + (JSC::JIT::emitSlow_op_get_argument_by_val): + +2012-05-23 Filip Pizlo + + DFGCapabilities should not try to get an arguments register from code blocks that don't have one + https://bugs.webkit.org/show_bug.cgi?id=87332 + + Reviewed by Andy Estes. + + * dfg/DFGCapabilities.h: + (JSC::DFG::canInlineOpcode): + +2012-05-23 Filip Pizlo + + DFG should have sparse conditional constant propagation + https://bugs.webkit.org/show_bug.cgi?id=86580 + + Reviewed by Oliver Hunt. + + Merged r117370 from dfgopt. + + This enhances CFA so that if it suspects at any point during the fixpoint that a + branch will only go one way, then it only propagates in that one way. + + This vastly increases the opportunities for CFG simplification. For example, it + enables us to evaporate this loop: + + for (var i = 0; i < 1; ++i) doThings(i); + + As a result, it uncovered loads of bugs in the CFG simplifier. In particular: + + - Phi fixup was assuming that all Phis worth fixing up are shouldGenerate(). + That's not true; we also fixup Phis that are dead. + + - GetLocal fixup was assuming that it's only necessary to rewire links to a + GetLocal, and that the GetLocal's own links don't need to be rewired. Untrue, + because the GetLocal may not be rewirable (first block has no GetLocal for r42 + but second block does have a GetLocal), in which case it will refer to a Phi + in the second block. We need it to refer to a Phi from the first block to + ensure that subsequent transformations work. + + - Tail operand fixup was ignoring the fact that Phis in successors may contain + references to the children of our tail variables. Hence, successor Phi child + substitution needs to use the original second block variable table as its + prior, rather than trying to reconstruct the prior later (since by that point + the children of the second block's tail variables will have been fixed up, so + we will not know what the prior would have been). + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::beginBasicBlock): + (JSC::DFG::AbstractState::endBasicBlock): + (JSC::DFG::AbstractState::reset): + (JSC::DFG::AbstractState::execute): + (JSC::DFG::AbstractState::mergeToSuccessors): + * dfg/DFGAbstractState.h: + (JSC::DFG::AbstractState::branchDirectionToString): + (AbstractState): + * dfg/DFGCFGSimplificationPhase.cpp: + (JSC::DFG::CFGSimplificationPhase::run): + (JSC::DFG::CFGSimplificationPhase::removePotentiallyDeadPhiReference): + (JSC::DFG::CFGSimplificationPhase::OperandSubstitution::OperandSubstitution): + (OperandSubstitution): + (JSC::DFG::CFGSimplificationPhase::skipGetLocal): + (JSC::DFG::CFGSimplificationPhase::recordPossibleIncomingReference): + (CFGSimplificationPhase): + (JSC::DFG::CFGSimplificationPhase::fixTailOperand): + (JSC::DFG::CFGSimplificationPhase::mergeBlocks): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::changeEdge): + +2012-05-23 Ojan Vafai + + add back the ability to disable flexbox + https://bugs.webkit.org/show_bug.cgi?id=87147 + + Reviewed by Tony Chang. + + * Configurations/FeatureDefines.xcconfig: + +2012-05-23 Filip Pizlo + + Unreviewed, fix Windows build. + + * bytecode/CodeBlock.h: + * dfg/DFGCapabilities.h: + (JSC::DFG::canCompileOpcode): + (JSC::DFG::canCompileOpcodes): + * dfg/DFGCommon.h: + (DFG): + +2012-05-23 Filip Pizlo + + DFG should optimize inlined uses of arguments.length and arguments[i] + https://bugs.webkit.org/show_bug.cgi?id=86327 + + Reviewed by Gavin Barraclough. + + Merged r117017 from dfgopt. + + Turns inlined uses of arguments.length into a constant. + + Turns inlined uses of arguments[constant] into a direct reference to the + argument. + + Big win on micro-benchmarks. Not yet a win on V8 because the hot uses of + arguments.length and arguments[i] are aliased. I'll leave the aliasing + optimizations to a later patch. + + * CMakeLists.txt: + * GNUmakefile.list.am: + * JavaScriptCore.xcodeproj/project.pbxproj: + * Target.pri: + * bytecode/DFGExitProfile.h: + (FrequentExitSite): + (JSC::DFG::FrequentExitSite::FrequentExitSite): + (JSC::DFG::QueryableExitProfile::hasExitSite): + (QueryableExitProfile): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGArgumentsSimplificationPhase.cpp: Added. + (DFG): + (ArgumentsSimplificationPhase): + (JSC::DFG::ArgumentsSimplificationPhase::ArgumentsSimplificationPhase): + (JSC::DFG::ArgumentsSimplificationPhase::run): + (JSC::DFG::performArgumentsSimplification): + * dfg/DFGArgumentsSimplificationPhase.h: Added. + (DFG): + * dfg/DFGAssemblyHelpers.cpp: + (JSC::DFG::AssemblyHelpers::executableFor): + (DFG): + * dfg/DFGAssemblyHelpers.h: + (AssemblyHelpers): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::getLocalLoadElimination): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGDriver.cpp: + (JSC::DFG::compile): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::Graph): + (JSC::DFG::Graph::executableFor): + (Graph): + (JSC::DFG::Graph::clobbersWorld): + * dfg/DFGNode.h: + (JSC::DFG::Node::convertToConstant): + (JSC::DFG::Node::convertToGetLocalUnlinked): + (Node): + (JSC::DFG::Node::unlinkedLocal): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGOSRExit.cpp: + (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow): + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-05-13 Filip Pizlo + + DFG should be able to optimize foo.apply(bar, arguments) + https://bugs.webkit.org/show_bug.cgi?id=86306 + + Reviewed by Gavin Barraclough. + + Merge r116912 from dfgopt. + + Enables compilation of op_jneq_ptr and some forms of op_call_varargs. + + Also includes a bunch of bug fixes that were made necessary by the increased + pressure on the CFG simplifier. + + This is a 1-2% win on V8. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::printCallOp): + (JSC::CodeBlock::CodeBlock): + (JSC::ProgramCodeBlock::canCompileWithDFGInternal): + (JSC::EvalCodeBlock::canCompileWithDFGInternal): + (JSC::FunctionCodeBlock::canCompileWithDFGInternal): + * bytecode/CodeBlock.h: + (CodeBlock): + (JSC::CodeBlock::canCompileWithDFG): + (JSC::CodeBlock::canCompileWithDFGState): + (ProgramCodeBlock): + (EvalCodeBlock): + (FunctionCodeBlock): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + (JSC::DFG::ByteCodeParser::processPhiStack): + (JSC::DFG::ByteCodeParser::parse): + * dfg/DFGCFGSimplificationPhase.cpp: + (JSC::DFG::CFGSimplificationPhase::run): + (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal): + (JSC::DFG::CFGSimplificationPhase::fixTailOperand): + (JSC::DFG::CFGSimplificationPhase::mergeBlocks): + * dfg/DFGCSEPhase.cpp: + (JSC::DFG::CSEPhase::getLocalLoadElimination): + (CSEPhase): + (JSC::DFG::CSEPhase::setReplacement): + (JSC::DFG::CSEPhase::performNodeCSE): + * dfg/DFGCapabilities.cpp: + (JSC::DFG::debugFail): + (DFG): + (JSC::DFG::canHandleOpcodes): + (JSC::DFG::canCompileOpcodes): + (JSC::DFG::canInlineOpcodes): + * dfg/DFGCapabilities.h: + (JSC::DFG::canCompileOpcode): + (JSC::DFG::canInlineOpcode): + (DFG): + (JSC::DFG::canCompileOpcodes): + (JSC::DFG::canCompileEval): + (JSC::DFG::canCompileProgram): + (JSC::DFG::canCompileFunctionForCall): + (JSC::DFG::canCompileFunctionForConstruct): + * dfg/DFGCommon.h: + * dfg/DFGGraph.cpp: + (JSC::DFG::Graph::dump): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::emitCall): + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGValidate.cpp: + (Validate): + (JSC::DFG::Validate::validate): + (JSC::DFG::Validate::checkOperand): + (JSC::DFG::Validate::reportValidationContext): + * jit/JIT.cpp: + (JSC::JIT::emitOptimizationCheck): + (JSC::JIT::privateCompileSlowCases): + (JSC::JIT::privateCompile): + * jit/JIT.h: + * jit/JITArithmetic.cpp: + (JSC::JIT::compileBinaryArithOp): + * jit/JITPropertyAccess.cpp: + (JSC::JIT::privateCompilePutByIdTransition): + * jit/JITPropertyAccess32_64.cpp: + (JSC::JIT::privateCompilePutByIdTransition): + * tools/CodeProfile.cpp: + (JSC::CodeProfile::sample): + +2012-05-23 Geoffrey Garen + + Refactored WeakBlock to use malloc, clarify behavior + https://bugs.webkit.org/show_bug.cgi?id=87318 + + Reviewed by Filip Pizlo. + + We want to use malloc so we can make these smaller than 4KB, + since an individual MarkedBlock will usually have fewer than + 4KB worth of weak pointers. + + * heap/Heap.cpp: + (JSC::Heap::markRoots): Renamed visitLiveWeakImpls to visit, since + we no longer need to distinguish from "visitDeadWeakImpls". + + Renamed "visitDeadWeakImpls" to "reap" because we're not actually + doing any visiting -- we're just tagging things as dead. + + * heap/WeakBlock.cpp: + (JSC::WeakBlock::create): + (JSC::WeakBlock::destroy): + (JSC::WeakBlock::WeakBlock): Malloc! + + (JSC::WeakBlock::visit): + (JSC::WeakBlock::reap): Renamed as above. + + * heap/WeakBlock.h: + (WeakBlock): Reduced to 3KB, as explained above. + + * heap/WeakSet.cpp: + (JSC::WeakSet::visit): + (JSC::WeakSet::reap): + * heap/WeakSet.h: + (WeakSet): Updated for renames, and to match WebKit style. + +2012-05-23 Filip Pizlo + + Use after free in JSC::DFG::ByteCodeParser::processPhiStack + https://bugs.webkit.org/show_bug.cgi?id=87312 + + + Reviewed by Oliver Hunt. + + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::processPhiStack): + (JSC::DFG::ByteCodeParser::parse): + +2012-05-23 Filip Pizlo + + It should be possible to make C function calls from DFG code on ARM in debug mode + https://bugs.webkit.org/show_bug.cgi?id=87313 + + Reviewed by Gavin Barraclough. + + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + +2012-05-11 Filip Pizlo + + DFG should be able to inline functions that use arguments reflectively + https://bugs.webkit.org/show_bug.cgi?id=86132 + + Reviewed by Oliver Hunt. + + Merged r116838 from dfgopt. + + This turns on inlining of functions that use arguments reflectively, but it + does not do any of the obvious optimizations that this exposes. I'll save that + for another patch - the important thing for now is that this contains all of + the plumbing necessary to make this kind of inlining sound even in bizarro + cases like an inline callee escaping the arguments object to parts of the + inline caller where the arguments are otherwise dead. Or even more fun cases + like where you've inlined to an inline stack that is three-deep, and the + function on top of the inline stack reflectively accesses the arguments of a + function that is in the middle of the inline stack. Any subsequent + optimizations that we do for the obvious cases of arguments usage in inline + functions will have to take care not to break the baseline functionality that + this patch plumbs together. + + * bytecode/CodeBlock.cpp: + (JSC::CodeBlock::printCallOp): + (JSC::CodeBlock::dump): + * bytecode/CodeBlock.h: + * dfg/DFGAssemblyHelpers.h: + (JSC::DFG::AssemblyHelpers::argumentsRegisterFor): + (AssemblyHelpers): + * dfg/DFGByteCodeParser.cpp: + (InlineStackEntry): + (JSC::DFG::ByteCodeParser::handleCall): + (JSC::DFG::ByteCodeParser::handleInlining): + (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): + (JSC::DFG::ByteCodeParser::parse): + * dfg/DFGCCallHelpers.h: + (JSC::DFG::CCallHelpers::setupArgumentsWithExecState): + (CCallHelpers): + * dfg/DFGCapabilities.h: + (JSC::DFG::canInlineOpcode): + * dfg/DFGDriver.cpp: + (JSC::DFG::compile): + * dfg/DFGFixupPhase.cpp: + (JSC::DFG::FixupPhase::fixupNode): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * interpreter/CallFrame.cpp: + (JSC): + (JSC::CallFrame::someCodeBlockForPossiblyInlinedCode): + * interpreter/CallFrame.h: + (ExecState): + (JSC::ExecState::someCodeBlockForPossiblyInlinedCode): + * interpreter/Interpreter.cpp: + (JSC::Interpreter::retrieveArgumentsFromVMCode): + * runtime/Arguments.cpp: + (JSC::Arguments::tearOff): + (JSC): + (JSC::Arguments::tearOffForInlineCallFrame): + * runtime/Arguments.h: + (Arguments): + (JSC::Arguments::create): + (JSC::Arguments::finishCreation): + (JSC): + +2012-05-23 Filip Pizlo + + Every OSR exit on ARM results in a crash + https://bugs.webkit.org/show_bug.cgi?id=87307 + + Reviewed by Geoffrey Garen. + + * dfg/DFGThunks.cpp: + (JSC::DFG::osrExitGenerationThunkGenerator): + +2012-05-23 Geoffrey Garen + + Refactored heap tear-down to use normal value semantics (i.e., destructors) + https://bugs.webkit.org/show_bug.cgi?id=87302 + + Reviewed by Oliver Hunt. + + This is a step toward incremental DOM finalization. + + * heap/CopiedSpace.cpp: + (JSC::CopiedSpace::~CopiedSpace): + * heap/CopiedSpace.h: + (CopiedSpace): Just use our destructor, instead of relying on the heap + to send us a special message at a special time. + + * heap/Heap.cpp: + (JSC::Heap::Heap): Use OwnPtr for m_markListSet because this is not Sparta. + + (JSC::Heap::~Heap): No need for delete or freeAllBlocks because normal + destructors do this work automatically now. + + (JSC::Heap::lastChanceToFinalize): Just call lastChanceToFinalize on our + sub-objects, and assume it does the right thing. This improves encapsulation, + so we can add items requiring finalization to our sub-objects. + + * heap/Heap.h: Moved m_blockAllocator to get the right destruction order. + + * heap/MarkedSpace.cpp: + (Take): + (JSC): + (JSC::Take::Take): + (JSC::Take::operator()): + (JSC::Take::returnValue): Moved to the top of the file so it can be used + in another function. + + (JSC::MarkedSpace::~MarkedSpace): Delete all outstanding memory, like a good + destructor should. + + (JSC::MarkedSpace::lastChanceToFinalize): Moved some code here from the heap, + since it pertains to our internal implementation details. + + * heap/MarkedSpace.h: + (MarkedSpace): + * heap/WeakBlock.cpp: + (JSC::WeakBlock::lastChanceToFinalize): + * heap/WeakBlock.h: + (WeakBlock): + * heap/WeakSet.cpp: + (JSC::WeakSet::lastChanceToFinalize): + * heap/WeakSet.h: + (WeakSet): Stop using a special freeAllBlocks() callback and just implement + lastChanceToFinalize. + +2011-05-22 Geoffrey Garen + + Encapsulated some calculations for whether portions of the heap are empty + https://bugs.webkit.org/show_bug.cgi?id=87210 + + Reviewed by Gavin Barraclough. + + This is a step toward incremental DOM finalization. + + * heap/Heap.cpp: + (JSC::Heap::~Heap): Explicitly call freeAllBlocks() instead of relying + implicitly on all blocks thinking they're empty. In future, we may + choose to tear down the heap without first setting all data structures + to "empty". + + * heap/MarkedBlock.h: + (JSC::MarkedBlock::isEmpty): + (JSC::MarkedBlock::gatherDirtyCells): Renamed markCountIsZero to isEmpty, + in preparation for making it check for outstanding finalizers in addition + to marked cells. + + * heap/MarkedSpace.cpp: + (Take): + (JSC::Take::Take): + (JSC::Take::operator()): + (JSC::Take::returnValue): + (JSC::MarkedSpace::shrink): + (JSC::MarkedSpace::freeAllBlocks): Refactored the "Take" functor to support + a conditional isEmpty check, so it dould be shared by shrink() and freeAllBlocks(). + + * heap/WeakBlock.cpp: + (JSC::WeakBlock::WeakBlock): + (JSC::WeakBlock::visitLiveWeakImpls): + (JSC::WeakBlock::visitDeadWeakImpls): + * heap/WeakBlock.h: + (WeakBlock): + (JSC::WeakBlock::isEmpty): + * heap/WeakSet.cpp: + (JSC::WeakSet::sweep): + (JSC::WeakSet::shrink): Use isEmpty(), in preparation for changes in + its implementation. + +2012-05-23 Oswald Buddenhagen + + [Qt] Remove references to $$QT_SOURCE_TREE + + With a modularized Qt, it's ambigious. What we really want is qtbase, + which qtcore is a proxy for (we assume it will always live in qtbase). + + Reviewed by Tor Arne Vestbø. + + * JavaScriptCore.pri: + * Target.pri: + +2012-05-09 Filip Pizlo + + DFG should allow inlining in case of certain arity mismatches + https://bugs.webkit.org/show_bug.cgi?id=86059 + + Reviewed by Geoff Garen. + + Merge r116620 from dfgopt. + + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::handleInlining): + +2012-05-08 Filip Pizlo + + DFG variable capture analysis should work even if the variables arose through inlining + https://bugs.webkit.org/show_bug.cgi?id=85945 + + Reviewed by Oliver Hunt. + + Merged r116555 from dfgopt. + + This just changes how the DFG queries whether a variable is captured. It does not + change any user-visible behavior. + + As part of this change, I further solidified the policy that the CFA behaves in an + undefined way for captured locals and queries about their values will not yield + reliable results. This will likely be changed in the future, but for now it makes + sense. + + One fun part about this change is that it recognizes that the same variable may + be both captured and not, at the same time, because their live interval spans + inlining boundaries. This only happens in the case of arguments to functions that + capture their arguments, and this change treats them with just the right touch of + conservatism: they will be treated as if captured by the caller as well as the + callee. + + Finally, this also adds captured variable reasoning to the InlineCallFrame, which + I thought might be useful for later tooling. + + This is perf-neutral, since it does it does not make the DFG take advantage of this + new functionality in any way. In particular, it is still the case that the DFG will + not inline functions that use arguments reflectively or that create activations. + + * bytecode/CodeBlock.h: + (CodeBlock): + (JSC::CodeBlock::needsActivation): + (JSC::CodeBlock::argumentIsCaptured): + (JSC::CodeBlock::localIsCaptured): + (JSC::CodeBlock::isCaptured): + * bytecode/CodeOrigin.h: + (InlineCallFrame): + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::initialize): + (JSC::DFG::AbstractState::endBasicBlock): + (JSC::DFG::AbstractState::execute): + (JSC::DFG::AbstractState::merge): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::newVariableAccessData): + (JSC::DFG::ByteCodeParser::getLocal): + (JSC::DFG::ByteCodeParser::setLocal): + (JSC::DFG::ByteCodeParser::getArgument): + (JSC::DFG::ByteCodeParser::setArgument): + (JSC::DFG::ByteCodeParser::flushArgument): + (JSC::DFG::ByteCodeParser::parseBlock): + (JSC::DFG::ByteCodeParser::processPhiStack): + (JSC::DFG::ByteCodeParser::fixVariableAccessPredictions): + (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): + * dfg/DFGCFGSimplificationPhase.cpp: + (CFGSimplificationPhase): + (JSC::DFG::CFGSimplificationPhase::keepOperandAlive): + (JSC::DFG::CFGSimplificationPhase::fixPossibleGetLocal): + (JSC::DFG::CFGSimplificationPhase::fixTailOperand): + * dfg/DFGCommon.h: + * dfg/DFGFixupPhase.cpp: + (JSC::DFG::FixupPhase::fixupNode): + * dfg/DFGGraph.cpp: + (JSC::DFG::Graph::nameOfVariableAccessData): + * dfg/DFGGraph.h: + (JSC::DFG::Graph::needsActivation): + (JSC::DFG::Graph::usesArguments): + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::doRoundOfDoubleVoting): + * dfg/DFGSpeculativeJIT.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGVariableAccessData.h: + (JSC::DFG::VariableAccessData::VariableAccessData): + (JSC::DFG::VariableAccessData::mergeIsCaptured): + (VariableAccessData): + (JSC::DFG::VariableAccessData::isCaptured): + +2012-05-08 Filip Pizlo + + DFG should support op_get_argument_by_val and op_get_arguments_length + https://bugs.webkit.org/show_bug.cgi?id=85911 + + Reviewed by Oliver Hunt. + + Merged r116467 from dfgopt. + + This adds a simple and relatively conservative implementation of op_get_argument_by_val + and op_get_arguments_length. We can optimize these later. For now it's great to have + the additional coverage. + + This patch appears to be perf-neutral. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGAssemblyHelpers.h: + (JSC::DFG::AssemblyHelpers::addressFor): + (JSC::DFG::AssemblyHelpers::tagFor): + (JSC::DFG::AssemblyHelpers::payloadFor): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCapabilities.h: + (JSC::DFG::canCompileOpcode): + (JSC::DFG::canInlineOpcode): + * dfg/DFGNode.h: + (JSC::DFG::Node::hasHeapPrediction): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGSpeculativeJIT.h: + (JSC::DFG::SpeculativeJIT::callOperation): + (SpeculativeJIT): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * jit/JITOpcodes.cpp: + (JSC::JIT::emit_op_get_argument_by_val): + * jit/JITOpcodes32_64.cpp: + (JSC::JIT::emit_op_get_argument_by_val): + * llint/LowLevelInterpreter32_64.asm: + * llint/LowLevelInterpreter64.asm: + +2012-05-07 Filip Pizlo + + DFG should support op_tear_off_arguments + https://bugs.webkit.org/show_bug.cgi?id=85847 + + Reviewed by Michael Saboff. + + Merged r116378 from dfgopt. + + * dfg/DFGAbstractState.cpp: + (JSC::DFG::AbstractState::execute): + * dfg/DFGByteCodeParser.cpp: + (JSC::DFG::ByteCodeParser::parseBlock): + * dfg/DFGCapabilities.h: + (JSC::DFG::canCompileOpcode): + (JSC::DFG::canInlineOpcode): + * dfg/DFGNodeType.h: + (DFG): + * dfg/DFGOperations.cpp: + * dfg/DFGOperations.h: + * dfg/DFGPredictionPropagationPhase.cpp: + (JSC::DFG::PredictionPropagationPhase::propagate): + * dfg/DFGSpeculativeJIT.h: + (SpeculativeJIT): + (JSC::DFG::SpeculativeJIT::callOperation): + * dfg/DFGSpeculativeJIT32_64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + * dfg/DFGSpeculativeJIT64.cpp: + (JSC::DFG::SpeculativeJIT::compile): + +2012-05-22 Mark Hahnenberg + + CopiedSpace::contains doesn't check for oversize blocks + https://bugs.webkit.org/show_bug.cgi?id=87180 + + Reviewed by Geoffrey Garen. + + When doing a conservative scan we use CopiedSpace::contains to determine if a particular + address points into the CopiedSpace. Currently contains() only checks if the address + points to a block in to-space, which means that pointers to oversize blocks may not get scanned. + + * heap/CopiedSpace.cpp: + (JSC::CopiedSpace::tryAllocateOversize): + (JSC::CopiedSpace::tryReallocateOversize): + (JSC::CopiedSpace::doneFillingBlock): + (JSC::CopiedSpace::doneCopying): + * heap/CopiedSpace.h: Refactored CopiedSpace so that all blocks (oversize and to-space) are + in a single hash set and bloom filter for membership testing. + (CopiedSpace): + * heap/CopiedSpaceInlineMethods.h: + (JSC::CopiedSpace::contains): We check for the normal block first. Since the oversize blocks are + only page aligned, rather than block aligned, we have to re-mask the ptr to check if it's in + CopiedSpace. Also added a helper function of the same name that takes a CopiedBlock* and checks + if it's in CopiedSpace so that check isn't typed out twice. + (JSC): + (JSC::CopiedSpace::startedCopying): + (JSC::CopiedSpace::addNewBlock): + +2012-05-22 Geoffrey Garen + + CopiedBlock and MarkedBlock should have proper value semantics (i.e., destructors) + https://bugs.webkit.org/show_bug.cgi?id=87172 + + Reviewed by Oliver Hunt and Phil Pizlo. + + This enables MarkedBlock to own non-trivial sub-objects that require + destruction. It also fixes a FIXME about casting a CopiedBlock to a + MarkedBlock at destroy time. + + CopiedBlock and MarkedBlock now accept an allocation chunk at create + time and return it at destroy time. Their client is expected to + allocate, recycle, and destroy these chunks. + + * heap/BlockAllocator.cpp: + (JSC::BlockAllocator::releaseFreeBlocks): + (JSC::BlockAllocator::blockFreeingThreadMain): Don't call MarkedBlock::destroy + because we expect that to be called before a block is put on our free + list now. Do manually deallocate our allocation chunk because that's + our job now. + + * heap/BlockAllocator.h: + (BlockAllocator): + (JSC::BlockAllocator::allocate): Allocate never fails now. This is a + cleaner abstraction because only one object does all the VM allocation + and deallocation. Caching is an implementation detail. + + (JSC::BlockAllocator::deallocate): We take an allocation chunk argument + instead of a block because we now expect the block to have been destroyed + before we recycle its memory. For convenience, we still use the HeapBlock + class as our linked list node. This is OK because HeapBlock is a POD type. + + * heap/CopiedBlock.h: + (CopiedBlock): + (JSC::CopiedBlock::create): + (JSC::CopiedBlock::destroy): + (JSC::CopiedBlock::CopiedBlock): Added proper create and destroy functions, + to match MarkedBlock. + + * heap/CopiedSpace.cpp: + (JSC::CopiedSpace::tryAllocateOversize): + (JSC::CopiedSpace::tryReallocateOversize): + (JSC::CopiedSpace::doneCopying): + (JSC::CopiedSpace::getFreshBlock): + (JSC::CopiedSpace::freeAllBlocks): + * heap/CopiedSpaceInlineMethods.h: + (JSC::CopiedSpace::recycleBlock): Make sure to call destroy before + returning a block to the BlockAllocator. Otherwise, our destructors + won't run. (If we get this wrong now, we'll get a compile error.) + + * heap/HeapBlock.h: + (JSC::HeapBlock::HeapBlock): const! + + * heap/MarkedAllocator.cpp: + (JSC::MarkedAllocator::allocateBlock): No need to distinguish between + create and recycle -- MarkedBlock always accepts memory allocated by + its client now. + + * heap/MarkedBlock.cpp: + (JSC::MarkedBlock::create): Don't allocate memory -- we assume that we're + passed already-allocated memory, to clarify the responsibility for VM + recycling. + + (JSC::MarkedBlock::destroy): Do run our destructor before giving back + our VM -- that is the whole point of this patch. + + (JSC::MarkedBlock::MarkedBlock): + * heap/MarkedBlock.h: + (MarkedBlock): + * heap/MarkedSpace.cpp: const! + + (JSC::MarkedSpace::freeBlocks): Make sure to call destroy before + returning a block to the BlockAllocator. Otherwise, our destructors + won't run. (If we get this wrong now, we'll get a compile error.) + +== Rolled over to ChangeLog-2012-05-22 == diff --git a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig index 1b4a75243..19d4b4037 100644 --- a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig +++ b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig @@ -44,7 +44,7 @@ ENABLE_CSS_IMAGE_ORIENTATION = ; ENABLE_CSS_IMAGE_RESOLUTION = ; ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS; ENABLE_CSS_SHADERS = ENABLE_CSS_SHADERS; -ENABLE_CSS_COMPOSITING = ; +ENABLE_CSS_COMPOSITING = ENABLE_CSS_COMPOSITING; ENABLE_CSS_STICKY_POSITION = ENABLE_CSS_STICKY_POSITION; ENABLE_CSS_VARIABLES = ; ENABLE_CSS3_TEXT_DECORATION = ; @@ -57,12 +57,20 @@ ENABLE_DETAILS_ELEMENT = ENABLE_DETAILS_ELEMENT; ENABLE_DEVICE_ORIENTATION = ; ENABLE_DIALOG_ELEMENT = ; ENABLE_DIRECTORY_UPLOAD = ; +ENABLE_DRAGGABLE_REGION = ; +ENABLE_ENCRYPTED_MEDIA = $(ENABLE_ENCRYPTED_MEDIA_$(REAL_PLATFORM_NAME)); +ENABLE_ENCRYPTED_MEDIA_macosx = $(ENABLE_ENCRYPTED_MEDIA_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR)); +ENABLE_ENCRYPTED_MEDIA_macosx_1070 = ; +ENABLE_ENCRYPTED_MEDIA_macosx_1080 = ; +ENABLE_ENCRYPTED_MEDIA_macosx_1090 = ENABLE_ENCRYPTED_MEDIA; ENABLE_FILE_SYSTEM = ; ENABLE_FILTERS = $(ENABLE_FILTERS_$(REAL_PLATFORM_NAME)); ENABLE_FILTERS_macosx = ENABLE_FILTERS; ENABLE_FULLSCREEN_API = ENABLE_FULLSCREEN_API; ENABLE_GAMEPAD = ; ENABLE_GEOLOCATION = ENABLE_GEOLOCATION; +ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING = $(HIDDEN_PAGE_DOM_TIMER_THROTTLING_$(REAL_PLATFORM_NAME)); +ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING_macosx = HIDDEN_PAGE_DOM_TIMER_THROTTLING; ENABLE_HIGH_DPI_CANVAS = ENABLE_HIGH_DPI_CANVAS; ENABLE_ICONDATABASE = $(ENABLE_ICONDATABASE_$(REAL_PLATFORM_NAME)); ENABLE_ICONDATABASE_macosx = ENABLE_ICONDATABASE; @@ -136,9 +144,7 @@ ENABLE_WEBGL = ENABLE_WEBGL; ENABLE_WEB_AUDIO = ENABLE_WEB_AUDIO; ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS; ENABLE_WEB_TIMING = ; -ENABLE_WIDGET_REGION = $(ENABLE_WIDGET_REGION_$(REAL_PLATFORM_NAME)); -ENABLE_WIDGET_REGION_macosx = ENABLE_WIDGET_REGION; ENABLE_WORKERS = ENABLE_WORKERS; ENABLE_XSLT = ENABLE_XSLT; -FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_TEXT_DECORATION) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LEGACY_VENDOR_PREFIXES) $(ENABLE_LEGACY_WEB_AUDIO) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NAVIGATOR_CONTENT_UTILS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WIDGET_REGION) $(ENABLE_WORKERS) $(ENABLE_XSLT); +FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_HIERARCHIES) $(ENABLE_CSS_IMAGE_ORIENTATION) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_COMPOSITING) $(ENABLE_CSS_STICKY_POSITION) $(ENABLE_CSS_VARIABLES) $(ENABLE_CSS3_TEXT_DECORATION) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST_ELEMENT) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS_ELEMENT) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DRAGGABLE_REGION) $(ENABLE_ENCRYPTED_MEDIA) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIDDEN_PAGE_DOM_TIMER_THROTTLING) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LEGACY_VENDOR_PREFIXES) $(ENABLE_LEGACY_WEB_AUDIO) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_ELEMENT) $(ENABLE_MHTML) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NAVIGATOR_CONTENT_UTILS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_ELEMENT) $(ENABLE_QUOTA) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT); diff --git a/Source/JavaScriptCore/Configurations/Version.xcconfig b/Source/JavaScriptCore/Configurations/Version.xcconfig index ffba40115..f0f18d9e1 100644 --- a/Source/JavaScriptCore/Configurations/Version.xcconfig +++ b/Source/JavaScriptCore/Configurations/Version.xcconfig @@ -22,7 +22,7 @@ // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. MAJOR_VERSION = 537; -MINOR_VERSION = 12; +MINOR_VERSION = 16; TINY_VERSION = 0; FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION); diff --git a/Source/JavaScriptCore/DerivedSources.pri b/Source/JavaScriptCore/DerivedSources.pri index 8d0f0537e..75fd5acc0 100644 --- a/Source/JavaScriptCore/DerivedSources.pri +++ b/Source/JavaScriptCore/DerivedSources.pri @@ -33,6 +33,13 @@ KEYWORDLUT_FILES += \ JIT_STUB_FILES += \ jit/JITStubs.cpp +LLINT_FILES = \ + llint/LowLevelInterpreter.asm + +LLINT_DEPENDENCY = \ + $$PWD/llint/LowLevelInterpreter32_64.asm \ + $$PWD/llint/LowLevelInterpreter64.asm + # GENERATOR 1-A: LUT creator lut.output = ${QMAKE_FILE_BASE}.lut.h lut.input = LUT_FILES @@ -80,3 +87,13 @@ klgen.script = $$PWD/KeywordLookupGenerator.py klgen.input = KEYWORDLUT_FILES klgen.commands = python $$klgen.script ${QMAKE_FILE_NAME} > ${QMAKE_FILE_OUT} GENERATORS += klgen + +linux-*:!equals(QT_ARCH, "arm") { + #GENERATOR: LLInt + llint.output = LLIntAssembly.h + llint.script = $$PWD/offlineasm/asm.rb + llint.input = LLINT_FILES + llint.depends = LLIntOffsetsExtractor $$LLINT_DEPENDENCY + llint.commands = ruby $$llint.script ${QMAKE_FILE_NAME} LLIntOffsetsExtractor ${QMAKE_FILE_OUT} + GENERATORS += llint +} diff --git a/Source/JavaScriptCore/GNUmakefile.list.am b/Source/JavaScriptCore/GNUmakefile.list.am index e79542f9e..ae5854b91 100644 --- a/Source/JavaScriptCore/GNUmakefile.list.am +++ b/Source/JavaScriptCore/GNUmakefile.list.am @@ -67,6 +67,7 @@ javascriptcore_sources += \ Source/JavaScriptCore/assembler/CodeLocation.h \ Source/JavaScriptCore/assembler/LinkBuffer.cpp \ Source/JavaScriptCore/assembler/LinkBuffer.h \ + Source/JavaScriptCore/assembler/MacroAssembler.cpp \ Source/JavaScriptCore/assembler/MacroAssembler.h \ Source/JavaScriptCore/assembler/MacroAssemblerARM.cpp \ Source/JavaScriptCore/assembler/MacroAssemblerARM.h \ @@ -84,6 +85,7 @@ javascriptcore_sources += \ Source/JavaScriptCore/assembler/X86Assembler.h \ Source/JavaScriptCore/bytecode/ArrayProfile.cpp \ Source/JavaScriptCore/bytecode/ArrayProfile.h \ + Source/JavaScriptCore/bytecode/ByValInfo.h \ Source/JavaScriptCore/bytecode/BytecodeConventions.h \ Source/JavaScriptCore/bytecode/CallLinkInfo.cpp \ Source/JavaScriptCore/bytecode/CallLinkInfo.h \ @@ -133,6 +135,8 @@ javascriptcore_sources += \ Source/JavaScriptCore/bytecode/ResolveGlobalStatus.h \ Source/JavaScriptCore/bytecode/SamplingTool.cpp \ Source/JavaScriptCore/bytecode/SamplingTool.h \ + Source/JavaScriptCore/bytecode/SpecialPointer.cpp \ + Source/JavaScriptCore/bytecode/SpecialPointer.h \ Source/JavaScriptCore/bytecode/StructureSet.h \ Source/JavaScriptCore/bytecode/StructureStubInfo.cpp \ Source/JavaScriptCore/bytecode/StructureStubInfo.h \ @@ -166,6 +170,7 @@ javascriptcore_sources += \ Source/JavaScriptCore/dfg/DFGCCallHelpers.h \ Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp \ Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.h \ + Source/JavaScriptCore/dfg/DFGCallArrayAllocatorSlowPathGenerator.h \ Source/JavaScriptCore/dfg/DFGCapabilities.cpp \ Source/JavaScriptCore/dfg/DFGCapabilities.h \ Source/JavaScriptCore/dfg/DFGCFAPhase.cpp \ @@ -252,6 +257,9 @@ javascriptcore_sources += \ Source/JavaScriptCore/heap/CopiedSpace.cpp \ Source/JavaScriptCore/heap/CopiedSpace.h \ Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h \ + Source/JavaScriptCore/heap/CopyVisitor.h \ + Source/JavaScriptCore/heap/CopyVisitorInlineMethods.h \ + Source/JavaScriptCore/heap/CopyVisitor.cpp \ Source/JavaScriptCore/heap/CardSet.h \ Source/JavaScriptCore/heap/ConservativeRoots.cpp \ Source/JavaScriptCore/heap/ConservativeRoots.h \ @@ -276,8 +284,12 @@ javascriptcore_sources += \ Source/JavaScriptCore/heap/BlockAllocator.h \ Source/JavaScriptCore/heap/GCThreadSharedData.cpp \ Source/JavaScriptCore/heap/GCThreadSharedData.h \ + Source/JavaScriptCore/heap/GCThread.cpp \ + Source/JavaScriptCore/heap/GCThread.h \ Source/JavaScriptCore/heap/Heap.cpp \ Source/JavaScriptCore/heap/Heap.h \ + Source/JavaScriptCore/heap/HeapStatistics.cpp \ + Source/JavaScriptCore/heap/HeapStatistics.h \ Source/JavaScriptCore/heap/JITStubRoutineSet.cpp \ Source/JavaScriptCore/heap/JITStubRoutineSet.h \ Source/JavaScriptCore/heap/ListableHandler.h \ @@ -363,8 +375,8 @@ javascriptcore_sources += \ Source/JavaScriptCore/interpreter/CallFrame.h \ Source/JavaScriptCore/interpreter/Interpreter.cpp \ Source/JavaScriptCore/interpreter/Interpreter.h \ - Source/JavaScriptCore/interpreter/RegisterFile.cpp \ - Source/JavaScriptCore/interpreter/RegisterFile.h \ + Source/JavaScriptCore/interpreter/JSStack.cpp \ + Source/JavaScriptCore/interpreter/JSStack.h \ Source/JavaScriptCore/interpreter/Register.h \ Source/JavaScriptCore/interpreter/VMInspector.cpp \ Source/JavaScriptCore/interpreter/VMInspector.h \ @@ -517,6 +529,7 @@ javascriptcore_sources += \ Source/JavaScriptCore/runtime/Identifier.h \ Source/JavaScriptCore/runtime/IndexingHeaderInlineMethods.h \ Source/JavaScriptCore/runtime/IndexingHeader.h \ + Source/JavaScriptCore/runtime/IndexingType.cpp \ Source/JavaScriptCore/runtime/IndexingType.h \ Source/JavaScriptCore/runtime/InitializeThreading.cpp \ Source/JavaScriptCore/runtime/InitializeThreading.h \ @@ -533,6 +546,7 @@ javascriptcore_sources += \ Source/JavaScriptCore/runtime/JSCell.h \ Source/JavaScriptCore/runtime/JSDateMath.cpp \ Source/JavaScriptCore/runtime/JSDateMath.h \ + Source/JavaScriptCore/runtime/JSDestructibleObject.h \ Source/JavaScriptCore/runtime/JSFunction.cpp \ Source/JavaScriptCore/runtime/JSFunction.h \ Source/JavaScriptCore/runtime/JSBoundFunction.cpp \ @@ -544,8 +558,8 @@ javascriptcore_sources += \ Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp \ Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h \ Source/JavaScriptCore/runtime/JSGlobalObject.h \ - Source/JavaScriptCore/runtime/JSGlobalThis.cpp \ - Source/JavaScriptCore/runtime/JSGlobalThis.h \ + Source/JavaScriptCore/runtime/JSProxy.cpp \ + Source/JavaScriptCore/runtime/JSProxy.h \ Source/JavaScriptCore/runtime/JSLock.cpp \ Source/JavaScriptCore/runtime/JSLock.h \ Source/JavaScriptCore/runtime/JSNotAnObject.cpp \ @@ -670,6 +684,7 @@ javascriptcore_sources += \ Source/JavaScriptCore/runtime/TimeoutChecker.cpp \ Source/JavaScriptCore/runtime/TimeoutChecker.h \ Source/JavaScriptCore/runtime/Tracing.h \ + Source/JavaScriptCore/runtime/TypedArrayDescriptor.h \ Source/JavaScriptCore/runtime/Uint16WithFraction.h \ Source/JavaScriptCore/runtime/WeakGCMap.h \ Source/JavaScriptCore/runtime/WeakRandom.h \ diff --git a/Source/JavaScriptCore/JSCTypedArrayStubs.h b/Source/JavaScriptCore/JSCTypedArrayStubs.h index e3926338c..2e273f66f 100644 --- a/Source/JavaScriptCore/JSCTypedArrayStubs.h +++ b/Source/JavaScriptCore/JSCTypedArrayStubs.h @@ -26,7 +26,7 @@ #ifndef JSCTypedArrayStubs_h #define JSCTypedArrayStubs_h -#include "JSObject.h" +#include "JSDestructibleObject.h" #include "ObjectPrototype.h" #include #include @@ -42,9 +42,9 @@ namespace JSC { #define TYPED_ARRAY(name, type) \ -class JS##name##Array : public JSNonFinalObject { \ +class JS##name##Array : public JSDestructibleObject { \ public: \ - typedef JSNonFinalObject Base; \ + typedef JSDestructibleObject Base; \ static JS##name##Array* create(JSC::Structure* structure, JSGlobalObject* globalObject, PassRefPtr impl) \ { \ JS##name##Array* ptr = new (NotNull, JSC::allocateCell(globalObject->globalData().heap)) JS##name##Array(structure, globalObject, impl); \ diff --git a/Source/JavaScriptCore/JavaScriptCore.order b/Source/JavaScriptCore/JavaScriptCore.order index 0742a0a0e..aa3d0ef32 100644 --- a/Source/JavaScriptCore/JavaScriptCore.order +++ b/Source/JavaScriptCore/JavaScriptCore.order @@ -29,7 +29,7 @@ __ZN3JSC10JSFunctionC1ENS_6JSCell20VPtrStealingHackTypeE __ZN3WTF15initializeDatesEv __ZN3WTF11currentTimeEv __ZN3WTF8msToYearEd -__ZN3JSC12RegisterFile19initializeThreadingEv +__ZN3JSC12JSStack19initializeThreadingEv __ZN3WTF39initializeMainThreadToProcessMainThreadEv __ZN3WTF36lockAtomicallyInitializedStaticMutexEv __ZN3WTF38unlockAtomicallyInitializedStaticMutexEv @@ -158,7 +158,7 @@ __ZN3JSC25DefaultGCActivityCallbackclEv __ZN3JSC11RegExpCacheC1EPNS_12JSGlobalDataE __ZN3JSC11InterpreterC1ERNS_12JSGlobalDataE __ZN3JSC10HandleHeap12writeBarrierEPNS_7JSValueERKS1_ -__ZN3JSC12RegisterFile23addToCommittedByteCountEl +__ZN3JSC12JSStack23addToCommittedByteCountEl __ZN3JSC11MarkedSpace21allocateFromSizeClassERNS0_9SizeClassE __ZN3JSC11MarkedSpace13allocateBlockERNS0_9SizeClassE __ZN3JSC11MarkedBlock6createEPNS_12JSGlobalDataEm @@ -370,7 +370,7 @@ __ZN3JSC4Heap9markRootsEv __ZN3JSC14MachineThreads23gatherConservativeRootsERNS_17ConservativeRootsEPv __ZN3JSC14MachineThreads23gatherFromCurrentThreadERNS_17ConservativeRootsEPv __ZN3JSC17ConservativeRoots3addEPvS1_ -__ZN3JSC12RegisterFile23gatherConservativeRootsERNS_17ConservativeRootsE +__ZN3JSC12JSStack23gatherConservativeRootsERNS_17ConservativeRootsE __ZN3JSC11MarkedSpace10clearMarksEv __ZN3JSC9MarkStack6appendERNS_17ConservativeRootsE __ZN3JSC9MarkStack5drainEv @@ -511,9 +511,9 @@ __ZN3JSC4Heap29reportExtraMemoryCostSlowCaseEm __ZN3JSC17BytecodeGeneratorD2Ev __ZThn16_N3JSC11ProgramNodeD0Ev __ZN3JSC11ProgramNodeD0Ev -__ZN3JSC12RegisterFile12globalObjectEv -__ZN3JSC14JSGlobalObject13copyGlobalsToERNS_12RegisterFileE -__ZN3JSC12RegisterFile15setGlobalObjectEPNS_14JSGlobalObjectE +__ZN3JSC12JSStack12globalObjectEv +__ZN3JSC14JSGlobalObject13copyGlobalsToERNS_12JSStackE +__ZN3JSC12JSStack15setGlobalObjectEPNS_14JSGlobalObjectE _ctiTrampoline __ZN3WTF15SegmentedVectorIN3JSC10IdentifierELm64EE6appendIS2_EEvRKT_ __ZNK3JSC9HashTable11createTableEPNS_12JSGlobalDataE @@ -682,7 +682,7 @@ __ZN3JSC18FunctionExecutable11discardCodeEv __ZN3JSC17FunctionCodeBlockD0Ev __ZN3JSC9CodeBlockD2Ev __ZN3JSC15WeakHandleOwner26isReachableFromOpaqueRootsENS_6HandleINS_7UnknownEEEPvRNS_9MarkStackE -__ZN3JSC12RegisterFile17GlobalObjectOwner8finalizeENS_6HandleINS_7UnknownEEEPv +__ZN3JSC12JSStack17GlobalObjectOwner8finalizeENS_6HandleINS_7UnknownEEEPv __ZN3JSC13ErrorInstanceD1Ev __ZN3JSC12StringObjectD1Ev __ZN3JSC12NumberObjectD1Ev @@ -784,7 +784,7 @@ __ZN3WTF9HashTableIPNS_10StringImplES2_NS_17IdentityExtractorIS2_EEN3JSC17Identi __ZN3JSC17BytecodeGenerator12addGlobalVarERKNS_10IdentifierEbRPNS_10RegisterIDE __ZN3JSC18FunctionExecutableC1EPNS_9ExecStateERKNS_10IdentifierERKNS_10SourceCodeEbPNS_18FunctionParametersEbii __ZN3JSC12FuncDeclNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE -__ZN3JSC14JSGlobalObject15copyGlobalsFromERNS_12RegisterFileE +__ZN3JSC14JSGlobalObject15copyGlobalsFromERNS_12JSStackE __ZNK3WTF12AtomicString5lowerEv __ZN3JSC41constructFunctionSkippingEvalEnabledCheckEPNS_9ExecStateEPNS_14JSGlobalObjectERKNS_7ArgListERKNS_10IdentifierERKNS_7UStringEi __ZN3WTF13StringBuilder6appendEPKcj @@ -810,7 +810,7 @@ __ZNK3JSC14JSGlobalObject14isDynamicScopeERb __ZN3JSC16VarStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE __ZN3JSC17AssignResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE __ZN3JSC17BytecodeGenerator15isLocalConstantERKNS_10IdentifierE -_cti_register_file_check +_cti_stack_check __ZN3JSC16JSCallbackObjectINS_24JSObjectWithGlobalObjectEE17staticValueGetterEPNS_9ExecStateENS_7JSValueERKNS_10IdentifierE __ZN3WTF9HashTableISt4pairINS_6RefPtrINS_10StringImplEEEjES1_IS5_PN3JSC7JSValueEENS_18PairFirstExtractorIS9_EENS6_24StructureTransitionTable4HashENS_14PairHashTraitsINSC_10HashTraitsENS_10HashTraitsIS8_EEEESF_E6rehashEi _JSValueMakeString @@ -979,7 +979,7 @@ _cti_op_eq _cti_op_resolve_with_base __ZN3JSC12JSActivation18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE _cti_op_call_eval -__ZN3JSC11Interpreter8callEvalEPNS_9ExecStateEPNS_12RegisterFileEPNS_8RegisterEii +__ZN3JSC11Interpreter8callEvalEPNS_9ExecStateEPNS_12JSStackEPNS_8RegisterEii __ZN3JSC14EvalExecutableC1EPNS_9ExecStateERKNS_10SourceCodeEb __ZN3JSC14EvalExecutable15compileInternalEPNS_9ExecStateEPNS_14ScopeChainNodeE __ZN3JSC6Parser5parseINS_8EvalNodeEEEN3WTF10PassRefPtrIT_EEPNS_14JSGlobalObjectEPNS_8DebuggerEPNS_9ExecStateERKNS_10SourceCodeEPNS_18FunctionParametersENS_18JSParserStrictnessEPPNS_8JSObjectE @@ -1155,6 +1155,7 @@ ___initializeScavenger_block_invoke_1 __ZN3WTF23waitForThreadCompletionEj __ZN3WTF23waitForThreadCompletionEjPPv _JSObjectCopyPropertyNames +__ZN3JSC8JSObject16copyBackingStoreEPNS_6JSCellERNS_11CopyVisitorE __ZN3JSC8JSObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE __ZN3JSC8JSObject19getOwnPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE __ZN3JSC9Structure16getPropertyNamesERNS_12JSGlobalDataERNS_17PropertyNameArrayENS_15EnumerationModeE @@ -1713,8 +1714,8 @@ __ZN3JSC9JITThunks22clearHostFunctionStubsEv __ZN3JSC11MarkedSpace7destroyEv __ZN3JSC12JSGlobalDataD1Ev __ZN3JSC12JSGlobalDataD2Ev -__ZN3JSC12RegisterFileD1Ev -__ZN3JSC12RegisterFileD2Ev +__ZN3JSC12JSStackD1Ev +__ZN3JSC12JSStackD2Ev __ZNK3JSC9HashTable11deleteTableEv __ZN3JSC5LexerD1Ev __ZN3WTF20deleteAllPairSecondsIP24OpaqueJSClassContextDataKNS_7HashMapIP13OpaqueJSClassS2_NS_7PtrHashIS5_EENS_10HashTraitsIS5_EENS8_IS2_EEEEEEvRT0_ @@ -1835,7 +1836,7 @@ __ZN3JSCL19constructJSCallbackEPNS_9ExecStateE __ZN3JSC24createStackOverflowErrorEPNS_9ExecStateE __ZN3JSC16createRangeErrorEPNS_9ExecStateERKNS_7UStringE _cti_op_mul -__ZN3JSC12RegisterFile21releaseExcessCapacityEv +__ZN3JSC12JSStack21releaseExcessCapacityEv __ZN3JSC16JSCallbackObjectINS_14JSGlobalObjectEED1Ev _JSObjectHasProperty _JSObjectGetPrototype @@ -2482,7 +2483,7 @@ __ZN3JSC4Heap16objectTypeCountsEv __ZN3WTF9HashTableIPN3JSC6JSCellES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S7_EEEENS_17HashTableIteratorIS3_S3_S5_S7_S9_S9_EERKT_ __ZN3WTF20fastMallocStatisticsEv __ZN3JSC22globalMemoryStatisticsEv -__ZN3JSC12RegisterFile18committedByteCountEv +__ZN3JSC12JSStack18committedByteCountEv __ZN3JSC19ExecutableAllocator18committedByteCountEv __ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEESt4pairIS3_N3JSC14OffsetLocationEENS_18PairFirstExtractorIS7_EENS_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E4findIPS2_NS_29RefPtrHashMapRawKeyTranslatorISI_S7_SF_SA_EEEENS_17HashTableIteratorIS3_S7_S9_SA_SF_SD_EERKT_ __ZN3WTF9HashTableINS_6RefPtrINS_10StringImplEEESt4pairIS3_N3JSC14OffsetLocationEENS_18PairFirstExtractorIS7_EENS_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E4findIS3_NS_22IdentityHashTranslatorIS3_S7_SA_EEEENS_17HashTableIteratorIS3_S7_S9_SA_SF_SD_EERKT_ diff --git a/Source/JavaScriptCore/JavaScriptCore.pro b/Source/JavaScriptCore/JavaScriptCore.pro index 393728f99..082244f8d 100644 --- a/Source/JavaScriptCore/JavaScriptCore.pro +++ b/Source/JavaScriptCore/JavaScriptCore.pro @@ -7,11 +7,18 @@ TEMPLATE = subdirs CONFIG += ordered +linux-*:!equals(QT_ARCH, "arm") { + LLIntOffsetsExtractor.file = LLIntOffsetsExtractor.pro + LLIntOffsetsExtractor.makefile = Makefile.LLIntOffsetsExtractor + SUBDIRS += LLIntOffsetsExtractor +} + derived_sources.file = DerivedSources.pri target.file = Target.pri SUBDIRS += derived_sources target +linux-*:!equals(QT_ARCH, "arm"):addStrictSubdirOrderBetween(LLIntOffsetsExtractor, derived_sources) addStrictSubdirOrderBetween(derived_sources, target) jsc.file = jsc.pro diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def index eda306f3c..0724ca1ca 100755 --- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def +++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def @@ -2,9 +2,9 @@ EXPORTS ??0ArrayBufferView@WTF@@IAE@V?$PassRefPtr@VArrayBuffer@WTF@@@1@I@Z ??0BooleanObject@JSC@@IAE@AAVJSGlobalData@1@PAVStructure@1@@Z + ??0Collator@WTF@@QAE@PBD@Z ??0CString@WTF@@QAE@PBD@Z ??0CString@WTF@@QAE@PBDI@Z - ??0Collator@WTF@@QAE@PBD@Z ??0DateInstance@JSC@@IAE@PAVExecState@1@PAVStructure@1@@Z ??0DefaultGCActivityCallback@JSC@@QAE@PAVHeap@1@@Z ??0DropAllLocks@JSLock@JSC@@QAE@PAVExecState@2@@Z @@ -16,13 +16,14 @@ EXPORTS ??0JSLockHolder@JSC@@QAE@PAVExecState@1@@Z ??0JSLockHolder@JSC@@QAE@PAVJSGlobalData@1@@Z ??0MD5@WTF@@QAE@XZ + ??0MediaTime@WTF@@QAE@_JHI@Z ??0Mutex@WTF@@QAE@XZ ??0ParallelEnvironment@WTF@@QAE@P6AXPAX@ZIH@Z ??0RefCountedLeakCounter@WTF@@QAE@PBD@Z ??0RegExpObject@JSC@@IAE@PAVJSGlobalObject@1@PAVStructure@1@PAVRegExp@1@@Z ??0SHA1@WTF@@QAE@XZ ??0StringObject@JSC@@IAE@AAVJSGlobalData@1@PAVStructure@1@@Z - ??0Structure@JSC@@AAE@AAVJSGlobalData@1@PAVJSGlobalObject@1@VJSValue@1@ABVTypeInfo@1@PBUClassInfo@1@E@Z + ??0Structure@JSC@@AAE@AAVJSGlobalData@1@PAVJSGlobalObject@1@VJSValue@1@ABVTypeInfo@1@PBUClassInfo@1@EH@Z ??0ThreadCondition@WTF@@QAE@XZ ??0WTFThreadData@WTF@@QAE@XZ ??0YarrPattern@Yarr@JSC@@QAE@ABVString@WTF@@_N1PAPBD@Z @@ -34,19 +35,20 @@ EXPORTS ??1JSGlobalData@JSC@@QAE@XZ ??1JSGlobalObject@JSC@@QAE@XZ ??1JSLockHolder@JSC@@QAE@XZ + ??1MediaTime@WTF@@QAE@XZ ??1Mutex@WTF@@QAE@XZ ??1RefCountedLeakCounter@WTF@@QAE@XZ ??1SourceProviderCache@JSC@@QAE@XZ ??1ThreadCondition@WTF@@QAE@XZ - ??1WTFThreadData@WTF@@QAE@XZ ??1WeakHandleOwner@JSC@@UAE@XZ + ??1WTFThreadData@WTF@@QAE@XZ + ??8MediaTime@WTF@@QBE_NABV01@@Z ??8WTF@@YA_NABVCString@0@0@Z - ?EcmaScriptConverter@DoubleToStringConverter@double_conversion@WTF@@SAABV123@XZ - ?StringToDouble@StringToDoubleConverter@double_conversion@WTF@@SANPBDIPAI@Z - ?ToExponential@DoubleToStringConverter@double_conversion@WTF@@QBE_NNHPAVStringBuilder@23@@Z - ?ToFixed@DoubleToStringConverter@double_conversion@WTF@@QBE_NNHPAVStringBuilder@23@@Z - ?ToPrecision@DoubleToStringConverter@double_conversion@WTF@@QBE_NNHPAVStringBuilder@23@@Z - ?ToShortest@DoubleToStringConverter@double_conversion@WTF@@QBE_NNPAVStringBuilder@23@@Z + ??GMediaTime@WTF@@QBE?AV01@ABV01@@Z + ??HMediaTime@WTF@@QBE?AV01@ABV01@@Z + ??MMediaTime@WTF@@QBE_NABV01@@Z + ??OMediaTime@WTF@@QBE_NABV01@@Z + ?abs@WTF@@YA?AVMediaTime@1@ABV21@@Z ?absoluteTimeToWaitTimeoutInterval@WTF@@YAKN@Z ?activityCallback@Heap@JSC@@QAEPAVGCActivityCallback@2@XZ ?add@AtomicString@WTF@@CA?AV?$PassRefPtr@VStringImpl@WTF@@@2@PBD@Z @@ -64,14 +66,14 @@ EXPORTS ?addSlowCase@Identifier@JSC@@CA?AV?$PassRefPtr@VStringImpl@WTF@@@WTF@@PAVJSGlobalData@2@PAVStringImpl@4@@Z ?addStaticGlobals@JSGlobalObject@JSC@@IAEXPAUGlobalPropertyInfo@12@H@Z ?allocateSlowCase@MarkedAllocator@JSC@@AAEPAXI@Z - ?append@StringBuilder@WTF@@QAEXPBEI@Z ?append@StringBuilder@WTF@@QAEXPB_WI@Z + ?append@StringBuilder@WTF@@QAEXPBEI@Z + ?appendNumber@StringBuilder@WTF@@QAEX_J@Z + ?appendNumber@StringBuilder@WTF@@QAEX_K@Z ?appendNumber@StringBuilder@WTF@@QAEXH@Z ?appendNumber@StringBuilder@WTF@@QAEXI@Z ?appendNumber@StringBuilder@WTF@@QAEXJ@Z ?appendNumber@StringBuilder@WTF@@QAEXK@Z - ?appendNumber@StringBuilder@WTF@@QAEX_J@Z - ?appendNumber@StringBuilder@WTF@@QAEX_K@Z ?attach@Debugger@JSC@@QAEXPAVJSGlobalObject@2@@Z ?base64Decode@WTF@@YA_NABVString@1@AAV?$Vector@D$0A@@1@W4Base64DecodePolicy@1@@Z ?base64Encode@WTF@@YA?AVString@1@PBDIW4Base64EncodePolicy@1@@Z @@ -81,23 +83,24 @@ EXPORTS ?bufferLengthForStringExponential@DecimalNumber@WTF@@QBEIXZ ?byteCompile@Yarr@JSC@@YA?AV?$PassOwnPtr@UBytecodePattern@Yarr@JSC@@@WTF@@AAUYarrPattern@12@PAVBumpPointerAllocator@4@@Z ?byteSize@SourceProviderCache@JSC@@QBEIXZ + ?calculatedFunctionName@DebuggerCallFrame@JSC@@QBE?AVString@WTF@@XZ ?calculateDSTOffset@WTF@@YANNN@Z ?calculateStringHashAndLengthFromUTF8MaskingTop8Bits@Unicode@WTF@@YAIPBD0AAI1@Z ?calculateUTCOffset@WTF@@YAHXZ - ?calculatedFunctionName@DebuggerCallFrame@JSC@@QBE?AVString@WTF@@XZ ?call@JSC@@YA?AVJSValue@1@PAVExecState@1@V21@W4CallType@1@ABTCallData@1@1ABVArgList@1@@Z ?callHostFunctionAsConstructor@JSC@@YI_JPAVExecState@1@@Z ?callOnMainThread@WTF@@YAXP6AXPAX@Z0@Z ?callOnMainThreadAndWait@WTF@@YAXP6AXPAX@Z0@Z - ?canShrink@StringBuilder@WTF@@QBE_NXZ ?cancelCallOnMainThread@WTF@@YAXP6AXPAX@Z0@Z + ?canShrink@StringBuilder@WTF@@QBE_NXZ ?capacity@Heap@JSC@@QAEIXZ ?changePrototypeTransition@Structure@JSC@@SAPAV12@AAVJSGlobalData@2@PAV12@VJSValue@2@@Z ?checkCurrentIdentifierTable@Identifier@JSC@@CAXPAVExecState@2@@Z ?checkCurrentIdentifierTable@Identifier@JSC@@CAXPAVJSGlobalData@2@@Z - ?checkSyntax@JSC@@YA_NPAVExecState@1@ABVSourceCode@1@PAVJSValue@1@@Z ?checksum@MD5@WTF@@QAEXAAV?$Vector@E$0BA@@2@@Z + ?checkSyntax@JSC@@YA_NPAVExecState@1@ABVSourceCode@1@PAVJSValue@1@@Z ?className@JSObject@JSC@@SA?AVString@WTF@@PBV12@@Z + ?className@JSProxy@JSC@@KA?AVString@WTF@@PBVJSObject@2@@Z ?clear@SourceProviderCache@JSC@@QAEXXZ ?clearRareData@JSGlobalObject@JSC@@CAXPAVJSCell@2@@Z ?collate@Collator@WTF@@QBE?AW4Result@12@PB_WI0I@Z @@ -113,6 +116,7 @@ EXPORTS ?convertLatin1ToUTF8@Unicode@WTF@@YA?AW4ConversionResult@12@PAPBEPBEPAPADPAD@Z ?convertUTF16ToUTF8@Unicode@WTF@@YA?AW4ConversionResult@12@PAPB_WPB_WPAPADPAD_N@Z ?convertUTF8ToUTF16@Unicode@WTF@@YA?AW4ConversionResult@12@PAPBDPBDPAPA_WPA_W_N@Z + ?copyBackingStore@JSObject@JSC@@SAXPAVJSCell@2@AAVCopyVisitor@2@@Z ?create@JSFunction@JSC@@SAPAV12@PAVExecState@2@PAVJSGlobalObject@2@HABVString@WTF@@P6I_J0@ZW4Intrinsic@2@3@Z ?create@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@W4ThreadStackType@2@W4HeapType@2@@Z ?create@RegExp@JSC@@SAPAV12@AAVJSGlobalData@2@ABVString@WTF@@W4RegExpFlags@2@@Z @@ -131,6 +135,8 @@ EXPORTS ?createThread@WTF@@YAIP6APAXPAX@Z0PBD@Z ?createThread@WTF@@YAIP6AXPAX@Z0PBD@Z ?createTypeError@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVString@WTF@@@Z + ?createWithDouble@MediaTime@WTF@@SA?AV12@NH@Z + ?createWithFloat@MediaTime@WTF@@SA?AV12@MH@Z ?cryptographicallyRandomNumber@WTF@@YAIXZ ?cryptographicallyRandomValues@WTF@@YAXPAXI@Z ?currentThread@WTF@@YAIXZ @@ -145,14 +151,18 @@ EXPORTS ?defaultValue@JSObject@JSC@@SA?AVJSValue@2@PBV12@PAVExecState@2@W4PreferredPrimitiveType@2@@Z ?defineOwnProperty@JSGlobalObject@JSC@@SA_NPAVJSObject@2@PAVExecState@2@VPropertyName@2@AAVPropertyDescriptor@2@_N@Z ?defineOwnProperty@JSObject@JSC@@SA_NPAV12@PAVExecState@2@VPropertyName@2@AAVPropertyDescriptor@2@_N@Z + ?defineOwnProperty@JSProxy@JSC@@KA_NPAVJSObject@2@PAVExecState@2@VPropertyName@2@AAVPropertyDescriptor@2@_N@Z + ?deleteAllCompiledCode@Heap@JSC@@QAEXXZ ?deleteOwnedPtr@WTF@@YAXPAUHBITMAP__@@@Z ?deleteOwnedPtr@WTF@@YAXPAUHBRUSH__@@@Z ?deleteOwnedPtr@WTF@@YAXPAUHDC__@@@Z ?deleteOwnedPtr@WTF@@YAXPAUHFONT__@@@Z ?deleteOwnedPtr@WTF@@YAXPAUHRGN__@@@Z ?deleteProperty@JSObject@JSC@@SA_NPAVJSCell@2@PAVExecState@2@VPropertyName@2@@Z + ?deleteProperty@JSProxy@JSC@@KA_NPAVJSCell@2@PAVExecState@2@VPropertyName@2@@Z ?deleteProperty@JSSymbolTableObject@JSC@@SA_NPAVJSCell@2@PAVExecState@2@VPropertyName@2@@Z ?deletePropertyByIndex@JSObject@JSC@@SA_NPAVJSCell@2@PAVExecState@2@I@Z + ?deletePropertyByIndex@JSProxy@JSC@@KA_NPAVJSCell@2@PAVExecState@2@I@Z ?deleteTable@HashTable@JSC@@QBEXXZ ?description@JSValue@JSC@@QBEPADXZ ?despecifyDictionaryFunction@Structure@JSC@@QAEXAAVJSGlobalData@2@VPropertyName@2@@Z @@ -164,11 +174,11 @@ EXPORTS ?detachThread@WTF@@YAXI@Z ?didTimeOut@TimeoutChecker@JSC@@QAE_NPAVExecState@2@@Z ?displayName@JSFunction@JSC@@QAE?AVString@WTF@@PAVExecState@2@@Z - ?deleteAllCompiledCode@Heap@JSC@@QAEXXZ ?dtoa@WTF@@YAXQADNAA_NAAHAAI@Z ?dumpAllOptions@Options@JSC@@SAXPAU_iobuf@@@Z ?dumpCallFrame@Interpreter@JSC@@QAEXPAVExecState@2@@Z ?dumpSampleData@JSGlobalData@JSC@@QAEXPAVExecState@2@@Z + ?EcmaScriptConverter@DoubleToStringConverter@double_conversion@WTF@@SAABV123@XZ ?empty@StringImpl@WTF@@SAPAV12@XZ ?enumerable@PropertyDescriptor@JSC@@QBE_NXZ ?equalUTF16WithUTF8@Unicode@WTF@@YA_NPB_W0PBD1@Z @@ -199,35 +209,41 @@ EXPORTS ?from@Identifier@JSC@@SA?AV12@PAVExecState@2@H@Z ?from@Identifier@JSC@@SA?AV12@PAVExecState@2@I@Z ?functionGetter@PropertySlot@JSC@@ABE?AVJSValue@2@PAVExecState@2@@Z + ?get@Structure@JSC@@QAEHAAVJSGlobalData@2@VPropertyName@2@AAIAAPAVJSCell@2@@Z ?getCalculatedDisplayName@JSC@@YA?AVString@WTF@@PAVExecState@1@PAVJSObject@1@@Z - ?getCallData@JSCell@JSC@@SA?AW4CallType@2@PAV12@AATCallData@2@@Z ?getCallableObjectSlow@JSC@@YAPAVJSCell@1@PAV21@@Z + ?getCallData@JSCell@JSC@@SA?AW4CallType@2@PAV12@AATCallData@2@@Z ?getConstructData@JSCell@JSC@@SA?AW4ConstructType@2@PAV12@AATConstructData@2@@Z ?getObject@JSCell@JSC@@QAEPAVJSObject@2@XZ ?getOwnNonIndexPropertyNames@JSObject@JSC@@SAXPAV12@PAVExecState@2@AAVPropertyNameArray@2@W4EnumerationMode@2@@Z ?getOwnNonIndexPropertyNames@JSSymbolTableObject@JSC@@SAXPAVJSObject@2@PAVExecState@2@AAVPropertyNameArray@2@W4EnumerationMode@2@@Z ?getOwnPropertyDescriptor@JSGlobalObject@JSC@@SA_NPAVJSObject@2@PAVExecState@2@VPropertyName@2@AAVPropertyDescriptor@2@@Z ?getOwnPropertyDescriptor@JSObject@JSC@@SA_NPAV12@PAVExecState@2@VPropertyName@2@AAVPropertyDescriptor@2@@Z + ?getOwnPropertyDescriptor@JSProxy@JSC@@KA_NPAVJSObject@2@PAVExecState@2@VPropertyName@2@AAVPropertyDescriptor@2@@Z ?getOwnPropertyNames@JSObject@JSC@@SAXPAV12@PAVExecState@2@AAVPropertyNameArray@2@W4EnumerationMode@2@@Z + ?getOwnPropertyNames@JSProxy@JSC@@KAXPAVJSObject@2@PAVExecState@2@AAVPropertyNameArray@2@W4EnumerationMode@2@@Z ?getOwnPropertySlot@JSGlobalObject@JSC@@SA_NPAVJSCell@2@PAVExecState@2@VPropertyName@2@AAVPropertySlot@2@@Z + ?getOwnPropertySlot@JSProxy@JSC@@KA_NPAVJSCell@2@PAVExecState@2@VPropertyName@2@AAVPropertySlot@2@@Z ?getOwnPropertySlotByIndex@JSObject@JSC@@SA_NPAVJSCell@2@PAVExecState@2@IAAVPropertySlot@2@@Z + ?getOwnPropertySlotByIndex@JSProxy@JSC@@KA_NPAVJSCell@2@PAVExecState@2@IAAVPropertySlot@2@@Z ?getOwnPropertySlotSlow@JSObject@JSC@@AAE_NPAVExecState@2@VPropertyName@2@AAVPropertySlot@2@@Z ?getPropertyNames@JSObject@JSC@@SAXPAV12@PAVExecState@2@AAVPropertyNameArray@2@W4EnumerationMode@2@@Z + ?getPropertyNames@JSProxy@JSC@@KAXPAVJSObject@2@PAVExecState@2@AAVPropertyNameArray@2@W4EnumerationMode@2@@Z ?getSlice@ArgList@JSC@@QBEXHAAV12@@Z ?getStackTrace@Interpreter@JSC@@SAXPAVJSGlobalData@2@AAV?$Vector@UStackFrame@JSC@@$0A@@WTF@@@Z ?getString@JSCell@JSC@@QBE?AVString@WTF@@PAVExecState@2@@Z ?getString@JSCell@JSC@@QBE_NPAVExecState@2@AAVString@WTF@@@Z - ?get@Structure@JSC@@QAEHAAVJSGlobalData@2@VPropertyName@2@AAIAAPAVJSCell@2@@Z ?getter@PropertyDescriptor@JSC@@QBE?AVJSValue@2@XZ ?globalExec@JSGlobalObject@JSC@@QAEPAVExecState@2@XZ ?globalObjectCount@Heap@JSC@@QAEIXZ ?grow@HandleSet@JSC@@AAEXXZ ?growOutOfLineStorage@JSObject@JSC@@QAEPAVButterfly@2@AAVJSGlobalData@2@II@Z + ?hashSlowCase@StringImpl@WTF@@ABEIXZ ?hasProperty@JSObject@JSC@@QBE_NPAVExecState@2@I@Z ?hasProperty@JSObject@JSC@@QBE_NPAVExecState@2@VPropertyName@2@@Z - ?hashSlowCase@StringImpl@WTF@@ABEIXZ ?heap@Heap@JSC@@SAPAV12@VJSValue@2@@Z ?increment@RefCountedLeakCounter@WTF@@QAEXXZ + ?indefiniteTime@MediaTime@WTF@@SAABV12@XZ ?init@AtomicString@WTF@@SAXXZ ?init@JSGlobalObject@JSC@@AAEXPAVJSObject@2@@Z ?initialize@double_conversion@WTF@@YAXXZ @@ -235,6 +251,7 @@ EXPORTS ?initializeThreading@JSC@@YAXXZ ?initializeThreading@WTF@@YAXXZ ?interpret@Yarr@JSC@@YAIPAUBytecodePattern@12@ABVString@WTF@@IPAI@Z + ?invalidTime@MediaTime@WTF@@SAABV12@XZ ?isAccessorDescriptor@PropertyDescriptor@JSC@@QBE_NXZ ?isBusy@Heap@JSC@@QAE_NXZ ?isDataDescriptor@PropertyDescriptor@JSC@@QBE_NXZ @@ -254,6 +271,7 @@ EXPORTS ?monthFromDayInYear@WTF@@YAHH_N@Z ?msToYear@WTF@@YAHN@Z ?name@JSFunction@JSC@@QAE?AVString@WTF@@PAVExecState@2@@Z + ?negativeInfiniteTime@MediaTime@WTF@@SAABV12@XZ ?neuter@ArrayBufferView@WTF@@MAEXXZ ?newUninitialized@CString@WTF@@SA?AV12@IAAPAD@Z ?notifyWriteSlow@SymbolTableEntry@JSC@@AAEXXZ @@ -268,6 +286,7 @@ EXPORTS ?objectTypeCounts@Heap@JSC@@QAE?AV?$PassOwnPtr@V?$HashCountedSet@PBDU?$PtrHash@PBD@WTF@@U?$HashTraits@PBD@2@@WTF@@@WTF@@XZ ?parseDateFromNullTerminatedCharacters@WTF@@YANPBD@Z ?parseDoubleFromLongString@Internal@WTF@@YANPB_WIAAI@Z + ?positiveInfiniteTime@MediaTime@WTF@@SAABV12@XZ ?profiler@Profiler@JSC@@SAPAV12@XZ ?protect@Heap@JSC@@QAEXVJSValue@2@@Z ?protectedGlobalObjectCount@Heap@JSC@@QAEIXZ @@ -275,11 +294,14 @@ EXPORTS ?protectedObjectTypeCounts@Heap@JSC@@QAE?AV?$PassOwnPtr@V?$HashCountedSet@PBDU?$PtrHash@PBD@WTF@@U?$HashTraits@PBD@2@@WTF@@@WTF@@XZ ?put@JSGlobalObject@JSC@@SAXPAVJSCell@2@PAVExecState@2@VPropertyName@2@VJSValue@2@AAVPutPropertySlot@2@@Z ?put@JSObject@JSC@@SAXPAVJSCell@2@PAVExecState@2@VPropertyName@2@VJSValue@2@AAVPutPropertySlot@2@@Z + ?put@JSProxy@JSC@@KAXPAVJSCell@2@PAVExecState@2@VPropertyName@2@VJSValue@2@AAVPutPropertySlot@2@@Z ?putByIndex@JSObject@JSC@@SAXPAVJSCell@2@PAVExecState@2@IVJSValue@2@_N@Z + ?putByIndex@JSProxy@JSC@@KAXPAVJSCell@2@PAVExecState@2@IVJSValue@2@_N@Z ?putDirectIndexBeyondVectorLength@JSObject@JSC@@AAE_NPAVExecState@2@IVJSValue@2@IW4PutDirectIndexMode@2@@Z ?putDirectMayBeIndex@JSObject@JSC@@QAEXPAVExecState@2@VPropertyName@2@VJSValue@2@@Z ?putDirectVirtual@JSGlobalObject@JSC@@SAXPAVJSObject@2@PAVExecState@2@VPropertyName@2@VJSValue@2@I@Z ?putDirectVirtual@JSObject@JSC@@SAXPAV12@PAVExecState@2@VPropertyName@2@VJSValue@2@I@Z + ?putDirectVirtual@JSProxy@JSC@@KAXPAVJSObject@2@PAVExecState@2@VPropertyName@2@VJSValue@2@I@Z ?randomNumber@WTF@@YANXZ ?recompileAllJSFunctions@Debugger@JSC@@QAEXPAVJSGlobalData@2@@Z ?regExpFlags@JSC@@YA?AW4RegExpFlags@1@ABVString@WTF@@@Z @@ -289,6 +311,7 @@ EXPORTS ?removeBlock@MarkedAllocator@JSC@@QAEXPAVMarkedBlock@2@@Z ?reportAbandonedObjectGraph@Heap@JSC@@QAEXXZ ?reportExtraMemoryCostSlowCase@Heap@JSC@@AAEXI@Z + ?reportSuccess@HeapStatistics@JSC@@SAXXZ ?reserveAndCommit@OSAllocator@WTF@@SAPAXIW4Usage@12@_N11@Z ?reserveCapacity@StringBuilder@WTF@@QAEXI@Z ?reset@ParserArena@JSC@@QAEXXZ @@ -306,18 +329,19 @@ EXPORTS ?setEnumerable@PropertyDescriptor@JSC@@QAEX_N@Z ?setGarbageCollectionTimerEnabled@Heap@JSC@@QAEX_N@Z ?setGetter@PropertyDescriptor@JSC@@QAEXVJSValue@2@@Z + ?setGlobalThis@JSGlobalObject@JSC@@IAEXAAVJSGlobalData@2@PAVJSObject@2@@Z ?setLoc@StatementNode@JSC@@QAEXHH@Z ?setMainThreadCallbacksPaused@WTF@@YAX_N@Z ?setOption@Options@JSC@@SA_NPBD@Z ?setOrderLowerFirst@Collator@WTF@@QAEX_N@Z ?setPrototype@JSObject@JSC@@QAEXAAVJSGlobalData@2@VJSValue@2@@Z ?setSetter@PropertyDescriptor@JSC@@QAEXVJSValue@2@@Z + ?setTarget@JSProxy@JSC@@IAEXAAVJSGlobalData@2@PAVJSGlobalObject@2@@Z + ?setter@PropertyDescriptor@JSC@@QBE?AVJSValue@2@XZ ?setToCurrentLocalTime@GregorianDateTime@WTF@@QAEXXZ ?setUndefined@PropertyDescriptor@JSC@@QAEXXZ - ?setUnwrappedObject@JSGlobalThis@JSC@@IAEXAAVJSGlobalData@2@PAVJSGlobalObject@2@@Z ?setUpStaticFunctionSlot@JSC@@YA_NPAVExecState@1@PBVHashEntry@1@PAVJSObject@1@VPropertyName@1@AAVPropertySlot@1@@Z ?setWritable@PropertyDescriptor@JSC@@QAEX_N@Z - ?setter@PropertyDescriptor@JSC@@QBE?AVJSValue@2@XZ ?shrinkToFit@StringBuilder@WTF@@QAEXXZ ?signal@ThreadCondition@WTF@@QAEXXZ ?singleCharacterStringRep@SmallStrings@JSC@@QAEPAVStringImpl@WTF@@E@Z @@ -330,6 +354,7 @@ EXPORTS ?startSampling@JSGlobalData@JSC@@QAEXXZ ?stopProfiling@Profiler@JSC@@QAE?AV?$PassRefPtr@VProfile@JSC@@@WTF@@PAVExecState@2@ABVString@4@@Z ?stopSampling@JSGlobalData@JSC@@QAEXXZ + ?StringToDouble@StringToDoubleConverter@double_conversion@WTF@@SANPBDIPAI@Z ?suggestedNewOutOfLineStorageCapacity@Structure@JSC@@QAEIXZ ?sweeper@Heap@JSC@@QAEPAVIncrementalSweeper@2@XZ ?synthesizePrototype@JSValue@JSC@@QBEPAVJSObject@2@PAVExecState@2@@Z @@ -343,15 +368,22 @@ EXPORTS ?tlsKeyCount@WTF@@YAAAJXZ ?tlsKeys@WTF@@YAPAKXZ ?toBoolean@JSString@JSC@@QBE_NXZ + ?toDouble@MediaTime@WTF@@QBENXZ + ?ToExponential@DoubleToStringConverter@double_conversion@WTF@@QBE_NNHPAVStringBuilder@23@@Z + ?ToFixed@DoubleToStringConverter@double_conversion@WTF@@QBE_NNHPAVStringBuilder@23@@Z + ?toFloat@MediaTime@WTF@@QBEMXZ ?toInt32@JSC@@YAHN@Z ?toInteger@JSValue@JSC@@QBENPAVExecState@2@@Z ?toNumberSlowCase@JSValue@JSC@@ABENPAVExecState@2@@Z ?toObject@JSCell@JSC@@QBEPAVJSObject@2@PAVExecState@2@PAVJSGlobalObject@2@@Z ?toObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@PAVJSGlobalObject@2@@Z + ?ToPrecision@DoubleToStringConverter@double_conversion@WTF@@QBE_NNHPAVStringBuilder@23@@Z + ?ToShortest@DoubleToStringConverter@double_conversion@WTF@@QBE_NNPAVStringBuilder@23@@Z ?toString@JSObject@JSC@@QBEPAVJSString@2@PAVExecState@2@@Z ?toStringDecimal@DecimalNumber@WTF@@QBEIPAEI@Z ?toStringExponential@DecimalNumber@WTF@@QBEIPAEI@Z ?toStringSlowCase@JSValue@JSC@@ABEPAVJSString@2@PAVExecState@2@@Z + ?toThisObject@JSGlobalObject@JSC@@KAPAVJSObject@2@PAVJSCell@2@PAVExecState@2@@Z ?toThisObject@JSObject@JSC@@SAPAV12@PAVJSCell@2@PAVExecState@2@@Z ?toThisObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z ?toWTFStringSlowCase@JSValue@JSC@@ABE?AVString@WTF@@PAVExecState@2@@Z @@ -368,31 +400,15 @@ EXPORTS ?unprotect@Heap@JSC@@QAE_NVJSValue@2@@Z ?validate@SlotVisitor@JSC@@CAXPAVJSCell@2@@Z ?visitChildren@JSGlobalObject@JSC@@SAXPAVJSCell@2@AAVSlotVisitor@2@@Z - ?visitChildren@JSGlobalThis@JSC@@KAXPAVJSCell@2@AAVSlotVisitor@2@@Z ?visitChildren@JSObject@JSC@@SAXPAVJSCell@2@AAVSlotVisitor@2@@Z + ?visitChildren@JSProxy@JSC@@KAXPAVJSCell@2@AAVSlotVisitor@2@@Z ?wait@ThreadCondition@WTF@@QAEXAAVMutex@2@@Z ?waitForThreadCompletion@WTF@@YAHI@Z ?waitForThreadCompletion@WTF@@YAHIPAPAX@Z ?writable@PropertyDescriptor@JSC@@QBE_NXZ ?writeBarrier@HandleSet@JSC@@QAEXPAVJSValue@2@ABV32@@Z ?yield@WTF@@YAXXZ - ?toDouble@MediaTime@WTF@@QBENXZ - ?toFloat@MediaTime@WTF@@QBEMXZ - ?createWithDouble@MediaTime@WTF@@SA?AV12@NH@Z - ?createWithFloat@MediaTime@WTF@@SA?AV12@MH@Z - ?abs@WTF@@YA?AVMediaTime@1@ABV21@@Z ?zeroTime@MediaTime@WTF@@SAABV12@XZ - ??GMediaTime@WTF@@QBE?AV01@ABV01@@Z - ??HMediaTime@WTF@@QBE?AV01@ABV01@@Z - ??1MediaTime@WTF@@QAE@XZ - ??0MediaTime@WTF@@QAE@_JHI@Z - ?indefiniteTime@MediaTime@WTF@@SAABV12@XZ - ?invalidTime@MediaTime@WTF@@SAABV12@XZ - ??8MediaTime@WTF@@QBE_NABV01@@Z - ??MMediaTime@WTF@@QBE_NABV01@@Z - ??OMediaTime@WTF@@QBE_NABV01@@Z - ?positiveInfiniteTime@MediaTime@WTF@@SAABV12@XZ - ?negativeInfiniteTime@MediaTime@WTF@@SAABV12@XZ WTFGetBacktrace WTFInvokeCrashHook WTFLog diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj index f5cbbb150..a21dcf1e8 100644 --- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj +++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj @@ -521,6 +521,10 @@ RelativePath="..\..\runtime\ArrayStorage.h" > + + @@ -841,6 +845,10 @@ RelativePath="..\..\runtime\JSDateMath.h" > + + @@ -874,11 +882,11 @@ > + + @@ -1569,6 +1581,10 @@ RelativePath="..\..\bytecode\ArrayProfile.h" > + + @@ -1697,6 +1713,14 @@ RelativePath="..\..\bytecode\PolymorphicPutByIdList.cpp" > + + + + @@ -1801,6 +1825,10 @@ RelativePath="..\..\assembler\LinkBuffer.h" > + + @@ -2130,15 +2158,15 @@ > + + + + + + @@ -2421,6 +2461,14 @@ RelativePath="..\..\heap\BlockAllocator.h" > + + + + @@ -2445,6 +2493,14 @@ RelativePath="..\..\heap\HeapRootVisitor.h" > + + + + diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj index 7c5ebaded..28c2746dd 100644 --- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj +++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj @@ -76,6 +76,7 @@ 0F0CD4C215F1A6070032F1C0 /* PutDirectIndexMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0CD4C015F1A6040032F1C0 /* PutDirectIndexMode.h */; settings = {ATTRIBUTES = (Private, ); }; }; 0F0CD4C415F6B6BB0032F1C0 /* SparseArrayValueMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0CD4C315F6B6B50032F1C0 /* SparseArrayValueMap.cpp */; }; 0F0FC45A14BD15F500B81154 /* LLIntCallLinkInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */; settings = {ATTRIBUTES = (Private, ); }; }; + 0F13E04E16164A1F00DC8DE7 /* IndexingType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F13E04C16164A1B00DC8DE7 /* IndexingType.cpp */; }; 0F15F15F14B7A73E005DE37D /* CommonSlowPaths.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F15F15D14B7A73A005DE37D /* CommonSlowPaths.h */; settings = {ATTRIBUTES = (Private, ); }; }; 0F16015D156198C900C2587C /* DFGArgumentsSimplificationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F16015A156198BF00C2587C /* DFGArgumentsSimplificationPhase.cpp */; }; 0F16015E156198C900C2587C /* DFGArgumentsSimplificationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F16015B156198BF00C2587C /* DFGArgumentsSimplificationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; }; @@ -87,6 +88,7 @@ 0F21C27D14BE727A00ADC64B /* CodeSpecializationKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C27914BE727300ADC64B /* CodeSpecializationKind.h */; settings = {ATTRIBUTES = (Private, ); }; }; 0F21C27F14BEAA8200ADC64B /* BytecodeConventions.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F21C27E14BEAA8000ADC64B /* BytecodeConventions.h */; settings = {ATTRIBUTES = (Private, ); }; }; 0F242DA713F3B1E8007ADD4C /* WeakReferenceHarvester.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F242DA513F3B1BB007ADD4C /* WeakReferenceHarvester.h */; settings = {ATTRIBUTES = (Private, ); }; }; + 0F256C361627B0AD007F2783 /* DFGCallArrayAllocatorSlowPathGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F256C341627B0AA007F2783 /* DFGCallArrayAllocatorSlowPathGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; }; 0F2BDC15151C5D4D00CD8910 /* DFGFixupPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC12151C5D4A00CD8910 /* DFGFixupPhase.cpp */; }; 0F2BDC16151C5D4F00CD8910 /* DFGFixupPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC13151C5D4A00CD8910 /* DFGFixupPhase.h */; settings = {ATTRIBUTES = (Private, ); }; }; 0F2BDC21151E803B00CD8910 /* DFGInsertionSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC1F151E803800CD8910 /* DFGInsertionSet.h */; settings = {ATTRIBUTES = (Private, ); }; }; @@ -127,6 +129,8 @@ 0F4680D314BBD16700BFE272 /* LLIntData.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680CF14BBB3D100BFE272 /* LLIntData.h */; settings = {ATTRIBUTES = (Private, ); }; }; 0F4680D414BBD24900BFE272 /* HostCallReturnValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4680D014BBC5F800BFE272 /* HostCallReturnValue.cpp */; }; 0F4680D514BBD24B00BFE272 /* HostCallReturnValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4680D114BBC5F800BFE272 /* HostCallReturnValue.h */; settings = {ATTRIBUTES = (Private, ); }; }; + 0F5541B11613C1FB00CE3E25 /* SpecialPointer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F5541AF1613C1FB00CE3E25 /* SpecialPointer.cpp */; }; + 0F5541B21613C1FB00CE3E25 /* SpecialPointer.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5541B01613C1FB00CE3E25 /* SpecialPointer.h */; settings = {ATTRIBUTES = (Private, ); }; }; 0F55F0F414D1063900AC7649 /* AbstractPC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F55F0F114D1063600AC7649 /* AbstractPC.cpp */; }; 0F55F0F514D1063C00AC7649 /* AbstractPC.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F55F0F214D1063600AC7649 /* AbstractPC.h */; settings = {ATTRIBUTES = (Private, ); }; }; 0F56A1D315000F35002992B1 /* ExecutionCounter.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F56A1D115000F31002992B1 /* ExecutionCounter.h */; settings = {ATTRIBUTES = (Private, ); }; }; @@ -163,6 +167,7 @@ 0F7B294B14C3CD2F007C3DB1 /* DFGCapabilities.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82E1F14172C2F00179C94 /* DFGCapabilities.h */; settings = {ATTRIBUTES = (Private, ); }; }; 0F7B294C14C3CD43007C3DB1 /* DFGByteCodeCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5F08CC146BE602000472A9 /* DFGByteCodeCache.h */; settings = {ATTRIBUTES = (Private, ); }; }; 0F7B294D14C3CD4C007C3DB1 /* DFGCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC0977E1469EBC400CF2442 /* DFGCommon.h */; settings = {ATTRIBUTES = (Private, ); }; }; + 0F8023EA1613832B00A0BA45 /* ByValInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8023E91613832300A0BA45 /* ByValInfo.h */; settings = {ATTRIBUTES = (Private, ); }; }; 0F919D0C157EE09F004A4E7D /* JSSymbolTableObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F919D09157EE09D004A4E7D /* JSSymbolTableObject.cpp */; }; 0F919D0D157EE0A2004A4E7D /* JSSymbolTableObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F919D0A157EE09D004A4E7D /* JSSymbolTableObject.h */; settings = {ATTRIBUTES = (Private, ); }; }; 0F919D10157F3329004A4E7D /* JSSegmentedVariableObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F919D0E157F3327004A4E7D /* JSSegmentedVariableObject.cpp */; }; @@ -231,6 +236,8 @@ 0FD82E86141F3FF100179C94 /* SpeculatedType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD82E84141F3FDA00179C94 /* SpeculatedType.cpp */; }; 0FE228ED1436AB2700196C48 /* Options.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE228EB1436AB2300196C48 /* Options.h */; settings = {ATTRIBUTES = (Private, ); }; }; 0FE228EE1436AB2C00196C48 /* Options.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE228EA1436AB2300196C48 /* Options.cpp */; }; + 0FEB3ECD16237F4D00AB67AD /* TypedArrayDescriptor.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEB3ECB16237F4700AB67AD /* TypedArrayDescriptor.h */; settings = {ATTRIBUTES = (Private, ); }; }; + 0FEB3ECF16237F6C00AB67AD /* MacroAssembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEB3ECE16237F6700AB67AD /* MacroAssembler.cpp */; }; 0FF42731158EBD54004CB9FF /* Disassembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF4272F158EBD44004CB9FF /* Disassembler.h */; settings = {ATTRIBUTES = (Private, ); }; }; 0FF42732158EBD58004CB9FF /* UDis86Disassembler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF42730158EBD44004CB9FF /* UDis86Disassembler.cpp */; }; 0FF42740158EBE8B004CB9FF /* udis86_decode.c in Sources */ = {isa = PBXBuildFile; fileRef = 0FF42734158EBD94004CB9FF /* udis86_decode.c */; }; @@ -277,7 +284,7 @@ 14280823107EC02C0013E7B2 /* Debugger.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8580255597D01FF60F7 /* Debugger.cpp */; }; 1428082D107EC0570013E7B2 /* CallData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCA62DFE0E2826230004F30D /* CallData.cpp */; }; 1428082E107EC0570013E7B2 /* ConstructData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCA62DFF0E2826310004F30D /* ConstructData.cpp */; }; - 1428083A107EC0750013E7B2 /* RegisterFile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1429D85B0ED218E900B89619 /* RegisterFile.cpp */; }; + 1428083A107EC0750013E7B2 /* JSStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1429D85B0ED218E900B89619 /* JSStack.cpp */; }; 14280841107EC0930013E7B2 /* RegExp.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A87D0255597D01FF60F7 /* RegExp.cpp */; }; 14280842107EC0930013E7B2 /* RegExpConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD202BD0E1706A7002C7E82 /* RegExpConstructor.cpp */; }; 14280843107EC0930013E7B2 /* RegExpObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A87B0255597D01FF60F7 /* RegExpObject.cpp */; }; @@ -439,10 +446,11 @@ 860161E40F3A83C100F84710 /* MacroAssemblerX86.h in Headers */ = {isa = PBXBuildFile; fileRef = 860161E00F3A83C100F84710 /* MacroAssemblerX86.h */; settings = {ATTRIBUTES = (Private, ); }; }; 860161E50F3A83C100F84710 /* MacroAssemblerX86_64.h in Headers */ = {isa = PBXBuildFile; fileRef = 860161E10F3A83C100F84710 /* MacroAssemblerX86_64.h */; settings = {ATTRIBUTES = (Private, ); }; }; 860161E60F3A83C100F84710 /* MacroAssemblerX86Common.h in Headers */ = {isa = PBXBuildFile; fileRef = 860161E20F3A83C100F84710 /* MacroAssemblerX86Common.h */; settings = {ATTRIBUTES = (Private, ); }; }; - 8604F505143CE1C200B295F5 /* JSGlobalThis.h in Headers */ = {isa = PBXBuildFile; fileRef = 8604F503143CE1C100B295F5 /* JSGlobalThis.h */; settings = {ATTRIBUTES = (Private, ); }; }; 860BD801148EA6F200112B2F /* Intrinsic.h in Headers */ = {isa = PBXBuildFile; fileRef = 86BF642A148DB2B5004DE36A /* Intrinsic.h */; settings = {ATTRIBUTES = (Private, ); }; }; 8612E4CD152389EC00C836BE /* MatchResult.h in Headers */ = {isa = PBXBuildFile; fileRef = 8612E4CB1522918400C836BE /* MatchResult.h */; settings = {ATTRIBUTES = (Private, ); }; }; 86158AB3155C8B4000B45C9C /* PropertyName.h in Headers */ = {isa = PBXBuildFile; fileRef = 86158AB2155C8B3F00B45C9C /* PropertyName.h */; settings = {ATTRIBUTES = (Private, ); }; }; + 862553D116136DA9009F17D0 /* JSProxy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 862553CE16136AA5009F17D0 /* JSProxy.cpp */; }; + 862553D216136E1A009F17D0 /* JSProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 862553CF16136AA5009F17D0 /* JSProxy.h */; settings = {ATTRIBUTES = (Private, ); }; }; 863B23E00FC6118900703AA4 /* MacroAssemblerCodeRef.h in Headers */ = {isa = PBXBuildFile; fileRef = 863B23DF0FC60E6200703AA4 /* MacroAssemblerCodeRef.h */; settings = {ATTRIBUTES = (Private, ); }; }; 863C6D9C1521111A00585E4E /* YarrCanonicalizeUCS2.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 863C6D981521111200585E4E /* YarrCanonicalizeUCS2.cpp */; }; 8642C510151C06A90046D4EF /* RegExpCachedResult.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86F75EFB151C062F007C9BA3 /* RegExpCachedResult.cpp */; }; @@ -663,7 +671,7 @@ BC18C45A0E16F5CD00B34460 /* RegExp.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A87E0255597D01FF60F7 /* RegExp.h */; settings = {ATTRIBUTES = (Private, ); }; }; BC18C45B0E16F5CD00B34460 /* RegExpObject.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A87C0255597D01FF60F7 /* RegExpObject.h */; settings = {ATTRIBUTES = (Private, ); }; }; BC18C45D0E16F5CD00B34460 /* Register.h in Headers */ = {isa = PBXBuildFile; fileRef = 149B24FF0D8AF6D1009CB8C7 /* Register.h */; settings = {ATTRIBUTES = (Private, ); }; }; - BC18C45E0E16F5CD00B34460 /* RegisterFile.h in Headers */ = {isa = PBXBuildFile; fileRef = 14D792640DAA03FB001A9F05 /* RegisterFile.h */; settings = {ATTRIBUTES = (Private, ); }; }; + BC18C45E0E16F5CD00B34460 /* JSStack.h in Headers */ = {isa = PBXBuildFile; fileRef = 14D792640DAA03FB001A9F05 /* JSStack.h */; settings = {ATTRIBUTES = (Private, ); }; }; BC18C4630E16F5CD00B34460 /* SourceProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = 65E866ED0DD59AFA00A2B2A1 /* SourceProvider.h */; settings = {ATTRIBUTES = (Private, ); }; }; BC18C4640E16F5CD00B34460 /* SourceCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 65E866EE0DD59AFA00A2B2A1 /* SourceCode.h */; settings = {ATTRIBUTES = (Private, ); }; }; BC18C4660E16F5CD00B34460 /* StringConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C3C10E16EE3300B34460 /* StringConstructor.h */; }; @@ -680,7 +688,6 @@ BC3046070E1F497F003232CF /* Error.h in Headers */ = {isa = PBXBuildFile; fileRef = BC3046060E1F497F003232CF /* Error.h */; settings = {ATTRIBUTES = (Private, ); }; }; BC3135640F302FA3003DFD3A /* DebuggerActivation.h in Headers */ = {isa = PBXBuildFile; fileRef = BC3135620F302FA3003DFD3A /* DebuggerActivation.h */; settings = {ATTRIBUTES = (Private, ); }; }; BC3135650F302FA3003DFD3A /* DebuggerActivation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC3135630F302FA3003DFD3A /* DebuggerActivation.cpp */; }; - BC3C4CA01458F5450025FB62 /* JSGlobalThis.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC3C4C9F1458F5450025FB62 /* JSGlobalThis.cpp */; }; BC6AAAE50E1F426500AD87D8 /* ClassInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */; settings = {ATTRIBUTES = (Private, ); }; }; BC756FC90E2031B200DE7D12 /* JSGlobalObjectFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */; }; BC87CDB910712AD4000614CF /* JSONObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC87CDB810712ACA000614CF /* JSONObject.lut.h */; }; @@ -705,11 +712,19 @@ C21122E215DD9AB300790E3A /* GCThreadSharedData.h in Headers */ = {isa = PBXBuildFile; fileRef = C21122DF15DD9AB300790E3A /* GCThreadSharedData.h */; settings = {ATTRIBUTES = (Private, ); }; }; C21122E315DD9AB300790E3A /* MarkStackInlineMethods.h in Headers */ = {isa = PBXBuildFile; fileRef = C21122E015DD9AB300790E3A /* MarkStackInlineMethods.h */; settings = {ATTRIBUTES = (Private, ); }; }; C2160FE715F7E95E00942DFC /* SlotVisitorInlineMethods.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FCB408515C0A3C30048932B /* SlotVisitorInlineMethods.h */; settings = {ATTRIBUTES = (Private, ); }; }; + C2239D1716262BDD005AC5FD /* CopyVisitor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2239D1216262BDD005AC5FD /* CopyVisitor.cpp */; }; + C2239D1816262BDD005AC5FD /* CopyVisitor.h in Headers */ = {isa = PBXBuildFile; fileRef = C2239D1316262BDD005AC5FD /* CopyVisitor.h */; settings = {ATTRIBUTES = (Private, ); }; }; + C2239D1916262BDD005AC5FD /* CopyVisitorInlineMethods.h in Headers */ = {isa = PBXBuildFile; fileRef = C2239D1416262BDD005AC5FD /* CopyVisitorInlineMethods.h */; settings = {ATTRIBUTES = (Private, ); }; }; + C2239D1A16262BDD005AC5FD /* GCThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2239D1516262BDD005AC5FD /* GCThread.cpp */; }; + C2239D1B16262BDD005AC5FD /* GCThread.h in Headers */ = {isa = PBXBuildFile; fileRef = C2239D1616262BDD005AC5FD /* GCThread.h */; }; C225494315F7DBAA0065E898 /* SlotVisitor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C225494215F7DBAA0065E898 /* SlotVisitor.cpp */; }; C22B31B9140577D700DB475A /* SamplingCounter.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F77008E1402FDD60078EB39 /* SamplingCounter.h */; settings = {ATTRIBUTES = (Private, ); }; }; C240305514B404E60079EB64 /* CopiedSpace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C240305314B404C90079EB64 /* CopiedSpace.cpp */; }; + C24D31E2161CD695002AA4DB /* HeapStatistics.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C24D31E0161CD695002AA4DB /* HeapStatistics.cpp */; }; + C24D31E3161CD695002AA4DB /* HeapStatistics.h in Headers */ = {isa = PBXBuildFile; fileRef = C24D31E1161CD695002AA4DB /* HeapStatistics.h */; settings = {ATTRIBUTES = (Private, ); }; }; C25F8BCD157544A900245B71 /* IncrementalSweeper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C25F8BCB157544A900245B71 /* IncrementalSweeper.cpp */; }; C25F8BCE157544A900245B71 /* IncrementalSweeper.h in Headers */ = {isa = PBXBuildFile; fileRef = C25F8BCC157544A900245B71 /* IncrementalSweeper.h */; settings = {ATTRIBUTES = (Private, ); }; }; + C2A7F688160432D400F76B98 /* JSDestructibleObject.h in Headers */ = {isa = PBXBuildFile; fileRef = C2A7F687160432D400F76B98 /* JSDestructibleObject.h */; settings = {ATTRIBUTES = (Private, ); }; }; C2B916C214DA014E00CBAC86 /* MarkedAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = C2B916C114DA014E00CBAC86 /* MarkedAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; }; C2B916C514DA040C00CBAC86 /* MarkedAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2B916C414DA040C00CBAC86 /* MarkedAllocator.cpp */; }; C2C8D02D14A3C6E000578E65 /* CopiedSpaceInlineMethods.h in Headers */ = {isa = PBXBuildFile; fileRef = C2C8D02B14A3C6B200578E65 /* CopiedSpaceInlineMethods.h */; settings = {ATTRIBUTES = (Private, ); }; }; @@ -845,6 +860,7 @@ 0F0CD4C015F1A6040032F1C0 /* PutDirectIndexMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PutDirectIndexMode.h; sourceTree = ""; }; 0F0CD4C315F6B6B50032F1C0 /* SparseArrayValueMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SparseArrayValueMap.cpp; sourceTree = ""; }; 0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LLIntCallLinkInfo.h; sourceTree = ""; }; + 0F13E04C16164A1B00DC8DE7 /* IndexingType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IndexingType.cpp; sourceTree = ""; }; 0F15F15D14B7A73A005DE37D /* CommonSlowPaths.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CommonSlowPaths.h; sourceTree = ""; }; 0F16015A156198BF00C2587C /* DFGArgumentsSimplificationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGArgumentsSimplificationPhase.cpp; path = dfg/DFGArgumentsSimplificationPhase.cpp; sourceTree = ""; }; 0F16015B156198BF00C2587C /* DFGArgumentsSimplificationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGArgumentsSimplificationPhase.h; path = dfg/DFGArgumentsSimplificationPhase.h; sourceTree = ""; }; @@ -857,6 +873,7 @@ 0F21C27A14BE727300ADC64B /* ExecutionHarness.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutionHarness.h; sourceTree = ""; }; 0F21C27E14BEAA8000ADC64B /* BytecodeConventions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeConventions.h; sourceTree = ""; }; 0F242DA513F3B1BB007ADD4C /* WeakReferenceHarvester.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakReferenceHarvester.h; sourceTree = ""; }; + 0F256C341627B0AA007F2783 /* DFGCallArrayAllocatorSlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCallArrayAllocatorSlowPathGenerator.h; path = dfg/DFGCallArrayAllocatorSlowPathGenerator.h; sourceTree = ""; }; 0F2BDC12151C5D4A00CD8910 /* DFGFixupPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGFixupPhase.cpp; path = dfg/DFGFixupPhase.cpp; sourceTree = ""; }; 0F2BDC13151C5D4A00CD8910 /* DFGFixupPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGFixupPhase.h; path = dfg/DFGFixupPhase.h; sourceTree = ""; }; 0F2BDC1F151E803800CD8910 /* DFGInsertionSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGInsertionSet.h; path = dfg/DFGInsertionSet.h; sourceTree = ""; }; @@ -898,6 +915,8 @@ 0F4680CF14BBB3D100BFE272 /* LLIntData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntData.h; path = llint/LLIntData.h; sourceTree = ""; }; 0F4680D014BBC5F800BFE272 /* HostCallReturnValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HostCallReturnValue.cpp; sourceTree = ""; }; 0F4680D114BBC5F800BFE272 /* HostCallReturnValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HostCallReturnValue.h; sourceTree = ""; }; + 0F5541AF1613C1FB00CE3E25 /* SpecialPointer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpecialPointer.cpp; sourceTree = ""; }; + 0F5541B01613C1FB00CE3E25 /* SpecialPointer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SpecialPointer.h; sourceTree = ""; }; 0F55F0F114D1063600AC7649 /* AbstractPC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AbstractPC.cpp; sourceTree = ""; }; 0F55F0F214D1063600AC7649 /* AbstractPC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AbstractPC.h; sourceTree = ""; }; 0F56A1D115000F31002992B1 /* ExecutionCounter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExecutionCounter.h; sourceTree = ""; }; @@ -933,6 +952,7 @@ 0F77008E1402FDD60078EB39 /* SamplingCounter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SamplingCounter.h; sourceTree = ""; }; 0F7700911402FF280078EB39 /* SamplingCounter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SamplingCounter.cpp; sourceTree = ""; }; 0F7B294814C3CD23007C3DB1 /* DFGCCallHelpers.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCCallHelpers.h; path = dfg/DFGCCallHelpers.h; sourceTree = ""; }; + 0F8023E91613832300A0BA45 /* ByValInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ByValInfo.h; sourceTree = ""; }; 0F919D09157EE09D004A4E7D /* JSSymbolTableObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSymbolTableObject.cpp; sourceTree = ""; }; 0F919D0A157EE09D004A4E7D /* JSSymbolTableObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSymbolTableObject.h; sourceTree = ""; }; 0F919D0E157F3327004A4E7D /* JSSegmentedVariableObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSegmentedVariableObject.cpp; sourceTree = ""; }; @@ -1004,6 +1024,8 @@ 0FD82E84141F3FDA00179C94 /* SpeculatedType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpeculatedType.cpp; sourceTree = ""; }; 0FE228EA1436AB2300196C48 /* Options.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Options.cpp; sourceTree = ""; }; 0FE228EB1436AB2300196C48 /* Options.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Options.h; sourceTree = ""; }; + 0FEB3ECB16237F4700AB67AD /* TypedArrayDescriptor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypedArrayDescriptor.h; sourceTree = ""; }; + 0FEB3ECE16237F6700AB67AD /* MacroAssembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MacroAssembler.cpp; sourceTree = ""; }; 0FF4272F158EBD44004CB9FF /* Disassembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Disassembler.h; path = disassembler/Disassembler.h; sourceTree = ""; }; 0FF42730158EBD44004CB9FF /* UDis86Disassembler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = UDis86Disassembler.cpp; path = disassembler/UDis86Disassembler.cpp; sourceTree = ""; }; 0FF42734158EBD94004CB9FF /* udis86_decode.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = udis86_decode.c; path = disassembler/udis86/udis86_decode.c; sourceTree = ""; }; @@ -1048,7 +1070,7 @@ 142711380A460BBB0080EEEA /* JSBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBase.h; sourceTree = ""; }; 1429D77B0ED20D7300B89619 /* Interpreter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Interpreter.h; sourceTree = ""; }; 1429D7D30ED2128200B89619 /* Interpreter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Interpreter.cpp; sourceTree = ""; }; - 1429D85B0ED218E900B89619 /* RegisterFile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegisterFile.cpp; sourceTree = ""; }; + 1429D85B0ED218E900B89619 /* JSStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStack.cpp; sourceTree = ""; }; 1429D8770ED21ACD00B89619 /* ExceptionHelpers.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExceptionHelpers.cpp; sourceTree = ""; }; 1429D8830ED21C3D00B89619 /* SamplingTool.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SamplingTool.cpp; sourceTree = ""; }; 1429D8840ED21C3D00B89619 /* SamplingTool.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SamplingTool.h; sourceTree = ""; }; @@ -1136,7 +1158,7 @@ 14BFCE6810CDB1FC00364CCE /* WeakGCMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakGCMap.h; sourceTree = ""; }; 14D2F3D8139F4BE200491031 /* MarkedSpace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkedSpace.cpp; sourceTree = ""; }; 14D2F3D9139F4BE200491031 /* MarkedSpace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedSpace.h; sourceTree = ""; }; - 14D792640DAA03FB001A9F05 /* RegisterFile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegisterFile.h; sourceTree = ""; }; + 14D792640DAA03FB001A9F05 /* JSStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStack.h; sourceTree = ""; }; 14D857740A4696C80032146C /* testapi.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; name = testapi.js; path = API/tests/testapi.js; sourceTree = ""; }; 14DA818E0D99FD2000B0A4FB /* JSActivation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSActivation.h; sourceTree = ""; }; 14DA818F0D99FD2000B0A4FB /* JSActivation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSActivation.cpp; sourceTree = ""; }; @@ -1200,9 +1222,10 @@ 8603CEF214C7546400AE59E3 /* CodeProfiling.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CodeProfiling.cpp; sourceTree = ""; }; 8603CEF314C7546400AE59E3 /* CodeProfiling.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeProfiling.h; sourceTree = ""; }; 8604F4F2143A6C4400B295F5 /* ChangeLog */ = {isa = PBXFileReference; lastKnownFileType = text; path = ChangeLog; sourceTree = ""; }; - 8604F503143CE1C100B295F5 /* JSGlobalThis.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalThis.h; sourceTree = ""; }; 8612E4CB1522918400C836BE /* MatchResult.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MatchResult.h; sourceTree = ""; }; 86158AB2155C8B3F00B45C9C /* PropertyName.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PropertyName.h; sourceTree = ""; }; + 862553CE16136AA5009F17D0 /* JSProxy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSProxy.cpp; sourceTree = ""; }; + 862553CF16136AA5009F17D0 /* JSProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSProxy.h; sourceTree = ""; }; 863B23DF0FC60E6200703AA4 /* MacroAssemblerCodeRef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerCodeRef.h; sourceTree = ""; }; 863C6D981521111200585E4E /* YarrCanonicalizeUCS2.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = YarrCanonicalizeUCS2.cpp; path = yarr/YarrCanonicalizeUCS2.cpp; sourceTree = ""; }; 863C6D991521111200585E4E /* YarrCanonicalizeUCS2.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = YarrCanonicalizeUCS2.h; path = yarr/YarrCanonicalizeUCS2.h; sourceTree = ""; }; @@ -1437,7 +1460,6 @@ BC3135630F302FA3003DFD3A /* DebuggerActivation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerActivation.cpp; sourceTree = ""; }; BC337BDE0E1AF0B80076918A /* GetterSetter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GetterSetter.h; sourceTree = ""; }; BC337BEA0E1B00CB0076918A /* Error.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Error.cpp; sourceTree = ""; }; - BC3C4C9F1458F5450025FB62 /* JSGlobalThis.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalThis.cpp; sourceTree = ""; }; BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ClassInfo.h; sourceTree = ""; }; BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObjectFunctions.cpp; sourceTree = ""; }; BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObjectFunctions.h; sourceTree = ""; }; @@ -1479,10 +1501,18 @@ C21122DE15DD9AB300790E3A /* GCThreadSharedData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GCThreadSharedData.cpp; sourceTree = ""; }; C21122DF15DD9AB300790E3A /* GCThreadSharedData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCThreadSharedData.h; sourceTree = ""; }; C21122E015DD9AB300790E3A /* MarkStackInlineMethods.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkStackInlineMethods.h; sourceTree = ""; }; + C2239D1216262BDD005AC5FD /* CopyVisitor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CopyVisitor.cpp; sourceTree = ""; }; + C2239D1316262BDD005AC5FD /* CopyVisitor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CopyVisitor.h; sourceTree = ""; }; + C2239D1416262BDD005AC5FD /* CopyVisitorInlineMethods.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CopyVisitorInlineMethods.h; sourceTree = ""; }; + C2239D1516262BDD005AC5FD /* GCThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GCThread.cpp; sourceTree = ""; }; + C2239D1616262BDD005AC5FD /* GCThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCThread.h; sourceTree = ""; }; C225494215F7DBAA0065E898 /* SlotVisitor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SlotVisitor.cpp; sourceTree = ""; }; C240305314B404C90079EB64 /* CopiedSpace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CopiedSpace.cpp; sourceTree = ""; }; + C24D31E0161CD695002AA4DB /* HeapStatistics.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HeapStatistics.cpp; sourceTree = ""; }; + C24D31E1161CD695002AA4DB /* HeapStatistics.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapStatistics.h; sourceTree = ""; }; C25F8BCB157544A900245B71 /* IncrementalSweeper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IncrementalSweeper.cpp; sourceTree = ""; }; C25F8BCC157544A900245B71 /* IncrementalSweeper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IncrementalSweeper.h; sourceTree = ""; }; + C2A7F687160432D400F76B98 /* JSDestructibleObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDestructibleObject.h; sourceTree = ""; }; C2B916C114DA014E00CBAC86 /* MarkedAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedAllocator.h; sourceTree = ""; }; C2B916C414DA040C00CBAC86 /* MarkedAllocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkedAllocator.cpp; sourceTree = ""; }; C2C8D02B14A3C6B200578E65 /* CopiedSpaceInlineMethods.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CopiedSpaceInlineMethods.h; sourceTree = ""; }; @@ -1757,8 +1787,8 @@ 1429D7D30ED2128200B89619 /* Interpreter.cpp */, 1429D77B0ED20D7300B89619 /* Interpreter.h */, 149B24FF0D8AF6D1009CB8C7 /* Register.h */, - 1429D85B0ED218E900B89619 /* RegisterFile.cpp */, - 14D792640DAA03FB001A9F05 /* RegisterFile.h */, + 1429D85B0ED218E900B89619 /* JSStack.cpp */, + 14D792640DAA03FB001A9F05 /* JSStack.h */, ); path = interpreter; sourceTree = ""; @@ -1809,6 +1839,13 @@ 142E312A134FF0A600AFADB5 /* heap */ = { isa = PBXGroup; children = ( + C2239D1216262BDD005AC5FD /* CopyVisitor.cpp */, + C2239D1316262BDD005AC5FD /* CopyVisitor.h */, + C2239D1416262BDD005AC5FD /* CopyVisitorInlineMethods.h */, + C2239D1516262BDD005AC5FD /* GCThread.cpp */, + C2239D1616262BDD005AC5FD /* GCThread.h */, + C24D31E0161CD695002AA4DB /* HeapStatistics.cpp */, + C24D31E1161CD695002AA4DB /* HeapStatistics.h */, C225494215F7DBAA0065E898 /* SlotVisitor.cpp */, C21122DE15DD9AB300790E3A /* GCThreadSharedData.cpp */, C21122DF15DD9AB300790E3A /* GCThreadSharedData.h */, @@ -2043,27 +2080,16 @@ 7EF6E0BB0EB7A1EC0079AFAF /* runtime */ = { isa = PBXGroup; children = ( - 0F0CD4C315F6B6B50032F1C0 /* SparseArrayValueMap.cpp */, - 0F0CD4C015F1A6040032F1C0 /* PutDirectIndexMode.h */, - 0FB7F38915ED8E3800F167B2 /* ArrayConventions.h */, - 0FB7F38A15ED8E3800F167B2 /* ArrayStorage.h */, - 0FB7F38B15ED8E3800F167B2 /* Butterfly.h */, - 0FB7F38C15ED8E3800F167B2 /* ButterflyInlineMethods.h */, - 0FB7F38D15ED8E3800F167B2 /* IndexingHeader.h */, - 0FB7F38E15ED8E3800F167B2 /* IndexingHeaderInlineMethods.h */, - 0FB7F38F15ED8E3800F167B2 /* IndexingType.h */, - 0FB7F39015ED8E3800F167B2 /* PropertyStorage.h */, - 0FB7F39115ED8E3800F167B2 /* Reject.h */, - 0FB7F39215ED8E3800F167B2 /* SparseArrayValueMap.h */, - C2D58C3315912FEE0021A844 /* GCActivityCallback.cpp */, BCF605110E203EF800B9A64D /* ArgList.cpp */, BCF605120E203EF800B9A64D /* ArgList.h */, BC257DE50E1F51C50016B6C9 /* Arguments.cpp */, BC257DE60E1F51C50016B6C9 /* Arguments.h */, BC7952060E15E8A800A898AB /* ArrayConstructor.cpp */, BC7952070E15E8A800A898AB /* ArrayConstructor.h */, + 0FB7F38915ED8E3800F167B2 /* ArrayConventions.h */, F692A84D0255597D01FF60F7 /* ArrayPrototype.cpp */, F692A84E0255597D01FF60F7 /* ArrayPrototype.h */, + 0FB7F38A15ED8E3800F167B2 /* ArrayStorage.h */, 147B83AA0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h */, 866739D013BFDE710023D87C /* BigInteger.h */, BC7952320E15EB5600A898AB /* BooleanConstructor.cpp */, @@ -2072,6 +2098,8 @@ 704FD35305697E6D003DBED9 /* BooleanObject.h */, BC7952340E15EB5600A898AB /* BooleanPrototype.cpp */, BC7952350E15EB5600A898AB /* BooleanPrototype.h */, + 0FB7F38B15ED8E3800F167B2 /* Butterfly.h */, + 0FB7F38C15ED8E3800F167B2 /* ButterflyInlineMethods.h */, 869D04AE1193B54D00803475 /* CachedTranscendentalFunction.h */, BCA62DFE0E2826230004F30D /* CallData.cpp */, 145C507F0D9DF63B0088F6B9 /* CallData.h */, @@ -2116,6 +2144,10 @@ BC337BDE0E1AF0B80076918A /* GetterSetter.h */, 933A349D038AE80F008635CE /* Identifier.cpp */, 933A349A038AE7C6008635CE /* Identifier.h */, + 0FB7F38D15ED8E3800F167B2 /* IndexingHeader.h */, + 0FB7F38E15ED8E3800F167B2 /* IndexingHeaderInlineMethods.h */, + 0F13E04C16164A1B00DC8DE7 /* IndexingType.cpp */, + 0FB7F38F15ED8E3800F167B2 /* IndexingType.h */, E178636C0D9BEEC300D74E75 /* InitializeThreading.cpp */, E178633F0D9BEC0000D74E75 /* InitializeThreading.h */, BC9BB95B0E19680600DF8855 /* InternalFunction.cpp */, @@ -2131,6 +2163,7 @@ BC1167D80E19BCC9008066DD /* JSCell.h */, 9788FC221471AD0C0068CE2D /* JSDateMath.cpp */, 9788FC231471AD0C0068CE2D /* JSDateMath.h */, + C2A7F687160432D400F76B98 /* JSDestructibleObject.h */, A7B4ACAE1484C9CE00B38A36 /* JSExportMacros.h */, F692A85E0255597D01FF60F7 /* JSFunction.cpp */, F692A85F0255597D01FF60F7 /* JSFunction.h */, @@ -2140,8 +2173,6 @@ A8E894330CD0603F00367179 /* JSGlobalObject.h */, BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */, BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */, - BC3C4C9F1458F5450025FB62 /* JSGlobalThis.cpp */, - 8604F503143CE1C100B295F5 /* JSGlobalThis.h */, 65EA4C99092AF9E20093D800 /* JSLock.cpp */, 65EA4C9A092AF9E20093D800 /* JSLock.h */, 14874ADF15EBDE4A002E3587 /* JSNameScope.cpp */, @@ -2154,6 +2185,8 @@ A7F9935D0FD7325100A0B2D0 /* JSONObject.h */, A727FF660DA3053B00E548D7 /* JSPropertyNameIterator.cpp */, A727FF650DA3053B00E548D7 /* JSPropertyNameIterator.h */, + 862553CE16136AA5009F17D0 /* JSProxy.cpp */, + 862553CF16136AA5009F17D0 /* JSProxy.h */, 14874AE115EBDE4A002E3587 /* JSScope.cpp */, 14874AE215EBDE4A002E3587 /* JSScope.h */, 0F919D0E157F3327004A4E7D /* JSSegmentedVariableObject.cpp */, @@ -2220,7 +2253,9 @@ 0FF7168A15A3B231008F5DAA /* PropertyOffset.h */, 65621E6B089E859700760F35 /* PropertySlot.cpp */, 65621E6C089E859700760F35 /* PropertySlot.h */, + 0FB7F39015ED8E3800F167B2 /* PropertyStorage.h */, 65C02FBB0637462A003E7EE6 /* Protect.h */, + 0F0CD4C015F1A6040032F1C0 /* PutDirectIndexMode.h */, 147B84620E6DE6B1004775A4 /* PutPropertySlot.h */, F692A87D0255597D01FF60F7 /* RegExp.cpp */, F692A87E0255597D01FF60F7 /* RegExp.h */, @@ -2237,10 +2272,13 @@ F692A87C0255597D01FF60F7 /* RegExpObject.h */, BCD202BF0E1706A7002C7E82 /* RegExpPrototype.cpp */, BCD202C00E1706A7002C7E82 /* RegExpPrototype.h */, + 0FB7F39115ED8E3800F167B2 /* Reject.h */, 0F7700911402FF280078EB39 /* SamplingCounter.cpp */, 0F77008E1402FDD60078EB39 /* SamplingCounter.h */, 93303FE80E6A72B500786E6A /* SmallStrings.cpp */, 93303FEA0E6A72C000786E6A /* SmallStrings.h */, + 0F0CD4C315F6B6B50032F1C0 /* SparseArrayValueMap.cpp */, + 0FB7F39215ED8E3800F167B2 /* SparseArrayValueMap.h */, A730B6111250068F009D25B1 /* StrictEvalActivation.cpp */, A730B6101250068F009D25B1 /* StrictEvalActivation.h */, BC18C3C00E16EE3300B34460 /* StringConstructor.cpp */, @@ -2263,10 +2301,12 @@ 14A42E3E0F4F60EE00599099 /* TimeoutChecker.h */, 5D53726D0E1C546B0021E549 /* Tracing.d */, 5D53726E0E1C54880021E549 /* Tracing.h */, + 0FEB3ECB16237F4700AB67AD /* TypedArrayDescriptor.h */, 866739D113BFDE710023D87C /* Uint16WithFraction.h */, 14BFCE6810CDB1FC00364CCE /* WeakGCMap.h */, 1420BE7A10AA6DDB00F455D2 /* WeakRandom.h */, A7DCB77912E3D90500911940 /* WriteBarrier.h */, + C2D58C3315912FEE0021A844 /* GCActivityCallback.cpp */, ); path = runtime; sourceTree = ""; @@ -2322,20 +2362,21 @@ 0F5F08CC146BE602000472A9 /* DFGByteCodeCache.h */, 86EC9DB41328DF82002B2AD7 /* DFGByteCodeParser.cpp */, 86EC9DB51328DF82002B2AD7 /* DFGByteCodeParser.h */, + 0F256C341627B0AA007F2783 /* DFGCallArrayAllocatorSlowPathGenerator.h */, + 0FD82E1E14172C2F00179C94 /* DFGCapabilities.cpp */, + 0FD82E1F14172C2F00179C94 /* DFGCapabilities.h */, 0F7B294814C3CD23007C3DB1 /* DFGCCallHelpers.h */, 0FFFC94B14EF909500C72532 /* DFGCFAPhase.cpp */, 0FFFC94C14EF909500C72532 /* DFGCFAPhase.h */, 0F3B3A241544C991003ED0FF /* DFGCFGSimplificationPhase.cpp */, 0F3B3A251544C991003ED0FF /* DFGCFGSimplificationPhase.h */, - 0FFFC94D14EF909500C72532 /* DFGCSEPhase.cpp */, - 0FFFC94E14EF909500C72532 /* DFGCSEPhase.h */, - 0FD82E1E14172C2F00179C94 /* DFGCapabilities.cpp */, - 0FD82E1F14172C2F00179C94 /* DFGCapabilities.h */, 0FC0977E1469EBC400CF2442 /* DFGCommon.h */, 0F3B3A17153E68EF003ED0FF /* DFGConstantFoldingPhase.cpp */, 0F3B3A18153E68EF003ED0FF /* DFGConstantFoldingPhase.h */, 0FC0979D146B271E00CF2442 /* DFGCorrectableJumpPoint.cpp */, 0FC0979A146A772000CF2442 /* DFGCorrectableJumpPoint.h */, + 0FFFC94D14EF909500C72532 /* DFGCSEPhase.cpp */, + 0FFFC94E14EF909500C72532 /* DFGCSEPhase.h */, 0FF427611591A1C9004CB9FF /* DFGDisassembler.cpp */, 0FF427621591A1C9004CB9FF /* DFGDisassembler.h */, 0FD81ACF154FB4EB00983E72 /* DFGDominators.cpp */, @@ -2343,9 +2384,10 @@ 0F1E3A441534CBAD000F9456 /* DFGDoubleFormatState.h */, 0FD3C82014115CF800FD81CB /* DFGDriver.cpp */, 0FD3C82214115D0E00FD81CB /* DFGDriver.h */, - 86AE6C4B136A11E400963012 /* DFGFPRInfo.h */, + 0F66E16914DF3F1300B7B2E4 /* DFGEdge.h */, 0F2BDC12151C5D4A00CD8910 /* DFGFixupPhase.cpp */, 0F2BDC13151C5D4A00CD8910 /* DFGFixupPhase.h */, + 86AE6C4B136A11E400963012 /* DFGFPRInfo.h */, 86EC9DB61328DF82002B2AD7 /* DFGGenerationInfo.h */, 86AE6C4C136A11E400963012 /* DFGGPRInfo.h */, 86EC9DB71328DF82002B2AD7 /* DFGGraph.cpp */, @@ -2360,7 +2402,6 @@ 0FA581B7150E952A00B9A2D9 /* DFGNodeFlags.cpp */, 0FA581B8150E952A00B9A2D9 /* DFGNodeFlags.h */, 0FA581B9150E952A00B9A2D9 /* DFGNodeType.h */, - 0F66E16914DF3F1300B7B2E4 /* DFGEdge.h */, 86EC9DBF1328DF82002B2AD7 /* DFGOperations.cpp */, 86EC9DC01328DF82002B2AD7 /* DFGOperations.h */, 0FD82E52141DAEDE00179C94 /* DFGOSREntry.cpp */, @@ -2392,11 +2433,11 @@ 0F63943D15C75F14006A597C /* DFGStructureCheckHoistingPhase.h */, 0FC0979F146B28C700CF2442 /* DFGThunks.cpp */, 0FC097A0146B28C700CF2442 /* DFGThunks.h */, + 0F3B3A2915474FF4003ED0FF /* DFGValidate.cpp */, + 0F3B3A2A15474FF4003ED0FF /* DFGValidate.h */, 0F2BDC3F1522801700CD8910 /* DFGValueRecoveryOverride.h */, 0F2BDC4E15228BE700CD8910 /* DFGValueSource.cpp */, 0F2BDC401522801700CD8910 /* DFGValueSource.h */, - 0F3B3A2915474FF4003ED0FF /* DFGValidate.cpp */, - 0F3B3A2A15474FF4003ED0FF /* DFGValidate.h */, 0F620172143FCD2F0068B77C /* DFGVariableAccessData.h */, 0F2BDC5015228FFA00CD8910 /* DFGVariableEvent.cpp */, 0F2BDC411522801700CD8910 /* DFGVariableEvent.h */, @@ -2448,6 +2489,7 @@ 86E116B00FE75AC800B512BC /* CodeLocation.h */, 0FF4275615914A20004CB9FF /* LinkBuffer.cpp */, 86D3B3C110159D7F002865E7 /* LinkBuffer.h */, + 0FEB3ECE16237F6700AB67AD /* MacroAssembler.cpp */, 86C36EE90EE1289D00B3DF59 /* MacroAssembler.h */, 86C568DD11A213EE0007F7F0 /* MacroAssemblerARM.cpp */, 86D3B2C210156BDE002865E7 /* MacroAssemblerARM.h */, @@ -2472,56 +2514,59 @@ children = ( 0F63945115D07051006A597C /* ArrayProfile.cpp */, 0F63945215D07051006A597C /* ArrayProfile.h */, - 0F56A1D415001CF2002992B1 /* ExecutionCounter.cpp */, - 0F56A1D115000F31002992B1 /* ExecutionCounter.h */, - 0FB5467C14F5CFD3002C2989 /* MethodOfGettingAValueProfile.cpp */, - 0FB5467A14F5C7D4002C2989 /* MethodOfGettingAValueProfile.h */, - 0FB5467814F5C468002C2989 /* LazyOperandValueProfile.cpp */, - 0FB5467614F59AD1002C2989 /* LazyOperandValueProfile.h */, 0F21C27E14BEAA8000ADC64B /* BytecodeConventions.h */, - 0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */, - 0F2BDC2B151FDE8B00CD8910 /* Operands.h */, - 0F9FC8BF14E1B5FB00D52AE0 /* PolymorphicPutByIdList.cpp */, - 0F9FC8C014E1B5FB00D52AE0 /* PolymorphicPutByIdList.h */, - 0F9FC8C114E1B5FB00D52AE0 /* PutKind.h */, + 0F8023E91613832300A0BA45 /* ByValInfo.h */, + 0F0B83AE14BCF71400885B4F /* CallLinkInfo.cpp */, + 0F0B83AF14BCF71400885B4F /* CallLinkInfo.h */, 0F93329314CA7DC10085F3C6 /* CallLinkStatus.cpp */, 0F93329414CA7DC10085F3C6 /* CallLinkStatus.h */, - 0F93329514CA7DC10085F3C6 /* GetByIdStatus.cpp */, - 0F93329614CA7DC10085F3C6 /* GetByIdStatus.h */, - 0F93329714CA7DC10085F3C6 /* MethodCallLinkStatus.cpp */, - 0F93329814CA7DC10085F3C6 /* MethodCallLinkStatus.h */, - 0F93329914CA7DC10085F3C6 /* PutByIdStatus.cpp */, - 0F93329A14CA7DC10085F3C6 /* PutByIdStatus.h */, - 0FF4276E159275D2004CB9FF /* ResolveGlobalStatus.cpp */, - 0FF4276F159275D2004CB9FF /* ResolveGlobalStatus.h */, - 0F93329B14CA7DC10085F3C6 /* StructureSet.h */, 0F0B83B814BCF95B00885B4F /* CallReturnOffsetToBytecodeOffset.h */, - 0F0B83B614BCF8DF00885B4F /* GlobalResolveInfo.h */, - 0F0B83B214BCF85E00885B4F /* MethodCallLinkInfo.cpp */, - 0F0B83B314BCF85E00885B4F /* MethodCallLinkInfo.h */, - 0F0B83AE14BCF71400885B4F /* CallLinkInfo.cpp */, - 0F0B83AF14BCF71400885B4F /* CallLinkInfo.h */, - FEB63AA2159B9DA3008932A6 /* Comment.h */, - 0F0B83AC14BCF60200885B4F /* LineInfo.h */, - 0F0B83AA14BCF5B900885B4F /* ExpressionRangeInfo.h */, - 0F0B83A814BCF55E00885B4F /* HandlerInfo.h */, - 0F0B83A514BCF50400885B4F /* CodeType.h */, 969A07900ED1D3AE00F1F681 /* CodeBlock.cpp */, 969A07910ED1D3AE00F1F681 /* CodeBlock.h */, 0FBD7E671447998F00481315 /* CodeOrigin.h */, + 0F0B83A514BCF50400885B4F /* CodeType.h */, + FEB63AA2159B9DA3008932A6 /* Comment.h */, 0F426A4A1460CD6B00131F8F /* DataFormat.h */, 0FBC0AE41496C7C100D4FBDD /* DFGExitProfile.cpp */, 0FBC0AE51496C7C100D4FBDD /* DFGExitProfile.h */, 969A07920ED1D3AE00F1F681 /* EvalCodeCache.h */, + 0F56A1D415001CF2002992B1 /* ExecutionCounter.cpp */, + 0F56A1D115000F31002992B1 /* ExecutionCounter.h */, + 0F0B83AA14BCF5B900885B4F /* ExpressionRangeInfo.h */, + 0F93329514CA7DC10085F3C6 /* GetByIdStatus.cpp */, + 0F93329614CA7DC10085F3C6 /* GetByIdStatus.h */, + 0F0B83B614BCF8DF00885B4F /* GlobalResolveInfo.h */, + 0F0B83A814BCF55E00885B4F /* HandlerInfo.h */, 969A07930ED1D3AE00F1F681 /* Instruction.h */, BCFD8C900EEB2EE700283848 /* JumpTable.cpp */, BCFD8C910EEB2EE700283848 /* JumpTable.h */, + 0FB5467814F5C468002C2989 /* LazyOperandValueProfile.cpp */, + 0FB5467614F59AD1002C2989 /* LazyOperandValueProfile.h */, + 0F0B83AC14BCF60200885B4F /* LineInfo.h */, + 0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */, + 0F0B83B214BCF85E00885B4F /* MethodCallLinkInfo.cpp */, + 0F0B83B314BCF85E00885B4F /* MethodCallLinkInfo.h */, + 0F93329714CA7DC10085F3C6 /* MethodCallLinkStatus.cpp */, + 0F93329814CA7DC10085F3C6 /* MethodCallLinkStatus.h */, + 0FB5467C14F5CFD3002C2989 /* MethodOfGettingAValueProfile.cpp */, + 0FB5467A14F5C7D4002C2989 /* MethodOfGettingAValueProfile.h */, 969A07940ED1D3AE00F1F681 /* Opcode.cpp */, 969A07950ED1D3AE00F1F681 /* Opcode.h */, - 0FD82E84141F3FDA00179C94 /* SpeculatedType.cpp */, - 0FD82E4F141DAEA100179C94 /* SpeculatedType.h */, + 0F2BDC2B151FDE8B00CD8910 /* Operands.h */, + 0F9FC8BF14E1B5FB00D52AE0 /* PolymorphicPutByIdList.cpp */, + 0F9FC8C014E1B5FB00D52AE0 /* PolymorphicPutByIdList.h */, + 0F93329914CA7DC10085F3C6 /* PutByIdStatus.cpp */, + 0F93329A14CA7DC10085F3C6 /* PutByIdStatus.h */, + 0F9FC8C114E1B5FB00D52AE0 /* PutKind.h */, + 0FF4276E159275D2004CB9FF /* ResolveGlobalStatus.cpp */, + 0FF4276F159275D2004CB9FF /* ResolveGlobalStatus.h */, 1429D8830ED21C3D00B89619 /* SamplingTool.cpp */, 1429D8840ED21C3D00B89619 /* SamplingTool.h */, + 0F5541AF1613C1FB00CE3E25 /* SpecialPointer.cpp */, + 0F5541B01613C1FB00CE3E25 /* SpecialPointer.h */, + 0FD82E84141F3FDA00179C94 /* SpeculatedType.cpp */, + 0FD82E4F141DAEA100179C94 /* SpeculatedType.h */, + 0F93329B14CA7DC10085F3C6 /* StructureSet.h */, 0F766D3615AE4A1A008F363E /* StructureStubClearingWatchpoint.cpp */, 0F766D3715AE4A1A008F363E /* StructureStubClearingWatchpoint.h */, BCCF0D0B0EF0B8A500413C8F /* StructureStubInfo.cpp */, @@ -2563,6 +2608,10 @@ 86ADD1450FDDEA980006EEC2 /* ARMv7Assembler.h in Headers */, C2EAD2FC14F0249800A4B159 /* CopiedAllocator.h in Headers */, C2B916C214DA014E00CBAC86 /* MarkedAllocator.h in Headers */, + C2239D1816262BDD005AC5FD /* CopyVisitor.h in Headers */, + C2239D1916262BDD005AC5FD /* CopyVisitorInlineMethods.h in Headers */, + C24D31E3161CD695002AA4DB /* HeapStatistics.h in Headers */, + C2A7F688160432D400F76B98 /* JSDestructibleObject.h in Headers */, FE20CE9E15F04A9500DF3430 /* LLIntCLoop.h in Headers */, C21122E215DD9AB300790E3A /* GCThreadSharedData.h in Headers */, C2160FE715F7E95E00942DFC /* SlotVisitorInlineMethods.h in Headers */, @@ -2686,7 +2735,6 @@ BC18C4200E16F5CD00B34460 /* JSGlobalData.h in Headers */, BC18C4210E16F5CD00B34460 /* JSGlobalObject.h in Headers */, BC756FC90E2031B200DE7D12 /* JSGlobalObjectFunctions.h in Headers */, - 8604F505143CE1C200B295F5 /* JSGlobalThis.h in Headers */, A76C51761182748D00715B05 /* JSInterfaceJIT.h in Headers */, BC18C4230E16F5CD00B34460 /* JSLock.h in Headers */, BC18C4240E16F5CD00B34460 /* JSObject.h in Headers */, @@ -2696,6 +2744,7 @@ BC87CDB910712AD4000614CF /* JSONObject.lut.h in Headers */, 9534AAFB0E5B7A9600B8A45B /* JSProfilerPrivate.h in Headers */, BC18C4260E16F5CD00B34460 /* JSRetainPtr.h in Headers */, + BC18C45E0E16F5CD00B34460 /* JSStack.h in Headers */, BC18C4270E16F5CD00B34460 /* JSString.h in Headers */, 86E85539111B9968001AF51E /* JSStringBuilder.h in Headers */, 2600B5A7152BAAA70091EE5F /* JSStringJoiner.h in Headers */, @@ -2777,7 +2826,6 @@ BC18C52C0E16FCD200B34460 /* RegExpObject.lut.h in Headers */, BCD202C40E1706A7002C7E82 /* RegExpPrototype.h in Headers */, BC18C45D0E16F5CD00B34460 /* Register.h in Headers */, - BC18C45E0E16F5CD00B34460 /* RegisterFile.h in Headers */, 969A072B0ED1CE6900F1F681 /* RegisterID.h in Headers */, 86D3B3C410159D7F002865E7 /* RepatchBuffer.h in Headers */, 869EBCB70E8C6D4A008722CC /* ResultType.h in Headers */, @@ -2950,6 +2998,12 @@ 0FB7F39D15ED8E4600F167B2 /* Reject.h in Headers */, 0FB7F39E15ED8E4600F167B2 /* SparseArrayValueMap.h in Headers */, 0F0CD4C215F1A6070032F1C0 /* PutDirectIndexMode.h in Headers */, + 0F8023EA1613832B00A0BA45 /* ByValInfo.h in Headers */, + 862553D216136E1A009F17D0 /* JSProxy.h in Headers */, + 0F5541B21613C1FB00CE3E25 /* SpecialPointer.h in Headers */, + 0FEB3ECD16237F4D00AB67AD /* TypedArrayDescriptor.h in Headers */, + 0F256C361627B0AD007F2783 /* DFGCallArrayAllocatorSlowPathGenerator.h in Headers */, + C2239D1B16262BDD005AC5FD /* GCThread.h in Headers */, ); runOnlyForDeploymentPostprocessing = 0; }; @@ -3394,7 +3448,6 @@ E18E3A590DF9278C00D90B34 /* JSGlobalData.cpp in Sources */, 147F39D2107EC37600427A48 /* JSGlobalObject.cpp in Sources */, 14E9D17B107EC469004DDA21 /* JSGlobalObjectFunctions.cpp in Sources */, - BC3C4CA01458F5450025FB62 /* JSGlobalThis.cpp in Sources */, 14280875107EC13E0013E7B2 /* JSLock.cpp in Sources */, A72700900DAC6BBC00E548D7 /* JSNotAnObject.cpp in Sources */, 147F39D4107EC37600427A48 /* JSObject.cpp in Sources */, @@ -3402,6 +3455,7 @@ A7F993600FD7325100A0B2D0 /* JSONObject.cpp in Sources */, 95F6E6950E5B5F970091E860 /* JSProfilerPrivate.cpp in Sources */, A727FF6B0DA3092200E548D7 /* JSPropertyNameIterator.cpp in Sources */, + 1428083A107EC0750013E7B2 /* JSStack.cpp in Sources */, 147F39D5107EC37600427A48 /* JSString.cpp in Sources */, 2600B5A6152BAAA70091EE5F /* JSStringJoiner.cpp in Sources */, 1482B74E0A43032800517CFC /* JSStringRef.cpp in Sources */, @@ -3451,7 +3505,6 @@ 14280842107EC0930013E7B2 /* RegExpConstructor.cpp in Sources */, 14280843107EC0930013E7B2 /* RegExpObject.cpp in Sources */, 14280844107EC0930013E7B2 /* RegExpPrototype.cpp in Sources */, - 1428083A107EC0750013E7B2 /* RegisterFile.cpp in Sources */, 0F7700921402FF3C0078EB39 /* SamplingCounter.cpp in Sources */, 1429D8850ED21C3D00B89619 /* SamplingTool.cpp in Sources */, 9330402C0E6A764000786E6A /* SmallStrings.cpp in Sources */, @@ -3554,6 +3607,13 @@ 0F0CD4C415F6B6BB0032F1C0 /* SparseArrayValueMap.cpp in Sources */, FE20CE9D15F04A9500DF3430 /* LLIntCLoop.cpp in Sources */, C225494315F7DBAA0065E898 /* SlotVisitor.cpp in Sources */, + 862553D116136DA9009F17D0 /* JSProxy.cpp in Sources */, + 0F13E04E16164A1F00DC8DE7 /* IndexingType.cpp in Sources */, + 0F5541B11613C1FB00CE3E25 /* SpecialPointer.cpp in Sources */, + 0FEB3ECF16237F6C00AB67AD /* MacroAssembler.cpp in Sources */, + C24D31E2161CD695002AA4DB /* HeapStatistics.cpp in Sources */, + C2239D1716262BDD005AC5FD /* CopyVisitor.cpp in Sources */, + C2239D1A16262BDD005AC5FD /* GCThread.cpp in Sources */, ); runOnlyForDeploymentPostprocessing = 0; }; diff --git a/Source/JavaScriptCore/LLIntOffsetsExtractor.pro b/Source/JavaScriptCore/LLIntOffsetsExtractor.pro new file mode 100644 index 000000000..4a6f69a89 --- /dev/null +++ b/Source/JavaScriptCore/LLIntOffsetsExtractor.pro @@ -0,0 +1,55 @@ +# ------------------------------------------------------------------- +# Project file for the LLIntOffsetsExtractor binary, used to generate +# derived sources for JavaScriptCore. +# +# See 'Tools/qmake/README' for an overview of the build system +# ------------------------------------------------------------------- + +TEMPLATE = app +TARGET = LLIntOffsetsExtractor +DESTDIR = $$OUT_PWD + +QT = core # Needed for qglobal.h + +defineTest(addIncludePaths) { + # Just needed for include paths + include(../WTF/WTF.pri) + include(JavaScriptCore.pri) + + export(INCLUDEPATH) +} + +addIncludePaths() + +LLINT_DEPENDENCY = \ + $$PWD/llint/LowLevelInterpreter.asm \ + $$PWD/llint/LowLevelInterpreter32_64.asm \ + $$PWD/llint/LowLevelInterpreter64.asm \ + $$PWD/offlineasm/armv7.rb \ + $$PWD/offlineasm/ast.rb \ + $$PWD/offlineasm/backends.rb \ + $$PWD/offlineasm/generate_offset_extractor.rb \ + $$PWD/offlineasm/instructions.rb \ + $$PWD/offlineasm/offsets.rb \ + $$PWD/offlineasm/opt.rb \ + $$PWD/offlineasm/parser.rb \ + $$PWD/offlineasm/registers.rb \ + $$PWD/offlineasm/self_hash.rb \ + $$PWD/offlineasm/settings.rb \ + $$PWD/offlineasm/transform.rb \ + $$PWD/offlineasm/x86.rb + +INPUT_FILES = $$PWD/llint/LowLevelInterpreter.asm +llint.output = LLIntDesiredOffsets.h +llint.script = $$PWD/offlineasm/generate_offset_extractor.rb +llint.input = INPUT_FILES +llint.depends = $$LLINT_DEPENDENCY +llint.commands = ruby $$llint.script ${QMAKE_FILE_NAME} ${QMAKE_FILE_OUT} +llint.CONFIG += no_link +QMAKE_EXTRA_COMPILERS += llint + +# Compilation of this file will automatically depend on LLIntDesiredOffsets.h +# due to qmake scanning the source file for header dependencies. +SOURCES = llint/LLIntOffsetsExtractor.cpp + +mac: LIBS_PRIVATE += -framework AppKit diff --git a/Source/JavaScriptCore/Target.pri b/Source/JavaScriptCore/Target.pri index 6f063fafb..861dbc740 100644 --- a/Source/JavaScriptCore/Target.pri +++ b/Source/JavaScriptCore/Target.pri @@ -45,6 +45,7 @@ SOURCES += \ assembler/ARMAssembler.cpp \ assembler/ARMv7Assembler.cpp \ assembler/LinkBuffer.cpp \ + assembler/MacroAssembler.cpp \ assembler/MacroAssemblerARM.cpp \ assembler/MacroAssemblerSH4.cpp \ bytecode/ArrayProfile.cpp \ @@ -64,6 +65,7 @@ SOURCES += \ bytecode/PutByIdStatus.cpp \ bytecode/ResolveGlobalStatus.cpp \ bytecode/SamplingTool.cpp \ + bytecode/SpecialPointer.cpp \ bytecode/SpeculatedType.cpp \ bytecode/StructureStubClearingWatchpoint.cpp \ bytecode/StructureStubInfo.cpp \ @@ -71,6 +73,7 @@ SOURCES += \ bytecompiler/BytecodeGenerator.cpp \ bytecompiler/NodesCodegen.cpp \ heap/CopiedSpace.cpp \ + heap/CopyVisitor.cpp \ heap/ConservativeRoots.cpp \ heap/DFGCodeBlocks.cpp \ heap/WeakSet.cpp \ @@ -80,7 +83,9 @@ SOURCES += \ heap/HandleStack.cpp \ heap/BlockAllocator.cpp \ heap/GCThreadSharedData.cpp \ + heap/GCThread.cpp \ heap/Heap.cpp \ + heap/HeapStatistics.cpp \ heap/HeapTimer.cpp \ heap/IncrementalSweeper.cpp \ heap/JITStubRoutineSet.cpp \ @@ -136,7 +141,7 @@ SOURCES += \ interpreter/AbstractPC.cpp \ interpreter/CallFrame.cpp \ interpreter/Interpreter.cpp \ - interpreter/RegisterFile.cpp \ + interpreter/JSStack.cpp \ jit/ExecutableAllocatorFixedVMPool.cpp \ jit/ExecutableAllocator.cpp \ jit/HostCallReturnValue.cpp \ @@ -155,6 +160,13 @@ SOURCES += \ jit/JITStubs.cpp \ jit/JumpReplacementWatchpoint.cpp \ jit/ThunkGenerators.cpp \ + llint/LLIntCLoop.cpp \ + llint/LLIntData.cpp \ + llint/LLIntEntrypoints.cpp \ + llint/LLIntExceptions.cpp \ + llint/LLIntSlowPaths.cpp \ + llint/LLIntThunks.cpp \ + llint/LowLevelInterpreter.cpp \ parser/Lexer.cpp \ parser/Nodes.cpp \ parser/ParserArena.cpp \ @@ -191,6 +203,7 @@ SOURCES += \ runtime/GetterSetter.cpp \ runtime/Options.cpp \ runtime/Identifier.cpp \ + runtime/IndexingType.cpp \ runtime/InitializeThreading.cpp \ runtime/InternalFunction.cpp \ runtime/JSActivation.cpp \ @@ -203,7 +216,7 @@ SOURCES += \ runtime/JSGlobalData.cpp \ runtime/JSGlobalObject.cpp \ runtime/JSGlobalObjectFunctions.cpp \ - runtime/JSGlobalThis.cpp \ + runtime/JSProxy.cpp \ runtime/JSLock.cpp \ runtime/JSNotAnObject.cpp \ runtime/JSObject.cpp \ diff --git a/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h b/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h index e6a9df994..c75adb7e9 100644 --- a/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h +++ b/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h @@ -261,6 +261,50 @@ public: }; + // TrustedImm64: + // + // A 64bit immediate operand to an instruction - this is wrapped in a + // class requiring explicit construction in order to prevent RegisterIDs + // (which are implemented as an enum) from accidentally being passed as + // immediate values. + struct TrustedImm64 { + TrustedImm64() { } + + explicit TrustedImm64(int64_t value) + : m_value(value) + { + } + +#if CPU(X86_64) + explicit TrustedImm64(TrustedImmPtr ptr) + : m_value(ptr.asIntptr()) + { + } +#endif + + int64_t m_value; + }; + + struct Imm64 : +#if ENABLE(JIT_CONSTANT_BLINDING) + private TrustedImm64 +#else + public TrustedImm64 +#endif + { + explicit Imm64(int64_t value) + : TrustedImm64(value) + { + } +#if CPU(X86_64) + explicit Imm64(TrustedImmPtr ptr) + : TrustedImm64(ptr) + { + } +#endif + const TrustedImm64& asTrustedImm64() const { return *this; } + }; + // Section 2: MacroAssembler code buffer handles // // The following types are used to reference items in the code buffer @@ -564,7 +608,7 @@ public: m_jumps.append(jump); } - void append(JumpList& other) + void append(const JumpList& other) { m_jumps.append(other.m_jumps.begin(), other.m_jumps.size()); } @@ -579,7 +623,7 @@ public: m_jumps.clear(); } - const JumpVector& jumps() { return m_jumps; } + const JumpVector& jumps() const { return m_jumps; } private: JumpVector m_jumps; diff --git a/Source/JavaScriptCore/assembler/MIPSAssembler.h b/Source/JavaScriptCore/assembler/MIPSAssembler.h index d3f8af996..30f172fb8 100644 --- a/Source/JavaScriptCore/assembler/MIPSAssembler.h +++ b/Source/JavaScriptCore/assembler/MIPSAssembler.h @@ -227,20 +227,17 @@ public: void addiu(RegisterID rt, RegisterID rs, int imm) { - emitInst(0x24000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) - | (imm & 0xffff)); + emitInst(0x24000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (imm & 0xffff)); } void addu(RegisterID rd, RegisterID rs, RegisterID rt) { - emitInst(0x00000021 | (rd << OP_SH_RD) | (rs << OP_SH_RS) - | (rt << OP_SH_RT)); + emitInst(0x00000021 | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT)); } void subu(RegisterID rd, RegisterID rs, RegisterID rt) { - emitInst(0x00000023 | (rd << OP_SH_RD) | (rs << OP_SH_RS) - | (rt << OP_SH_RT)); + emitInst(0x00000023 | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT)); } void mult(RegisterID rs, RegisterID rt) @@ -266,8 +263,7 @@ public: void mul(RegisterID rd, RegisterID rs, RegisterID rt) { #if WTF_MIPS_ISA_AT_LEAST(32) - emitInst(0x70000002 | (rd << OP_SH_RD) | (rs << OP_SH_RS) - | (rt << OP_SH_RT)); + emitInst(0x70000002 | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT)); #else mult(rs, rt); mflo(rd); @@ -276,151 +272,139 @@ public: void andInsn(RegisterID rd, RegisterID rs, RegisterID rt) { - emitInst(0x00000024 | (rd << OP_SH_RD) | (rs << OP_SH_RS) - | (rt << OP_SH_RT)); + emitInst(0x00000024 | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT)); } void andi(RegisterID rt, RegisterID rs, int imm) { - emitInst(0x30000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) - | (imm & 0xffff)); + emitInst(0x30000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (imm & 0xffff)); } void nor(RegisterID rd, RegisterID rs, RegisterID rt) { - emitInst(0x00000027 | (rd << OP_SH_RD) | (rs << OP_SH_RS) - | (rt << OP_SH_RT)); + emitInst(0x00000027 | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT)); } void orInsn(RegisterID rd, RegisterID rs, RegisterID rt) { - emitInst(0x00000025 | (rd << OP_SH_RD) | (rs << OP_SH_RS) - | (rt << OP_SH_RT)); + emitInst(0x00000025 | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT)); } void ori(RegisterID rt, RegisterID rs, int imm) { - emitInst(0x34000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) - | (imm & 0xffff)); + emitInst(0x34000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (imm & 0xffff)); } void xorInsn(RegisterID rd, RegisterID rs, RegisterID rt) { - emitInst(0x00000026 | (rd << OP_SH_RD) | (rs << OP_SH_RS) - | (rt << OP_SH_RT)); + emitInst(0x00000026 | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT)); } void xori(RegisterID rt, RegisterID rs, int imm) { - emitInst(0x38000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) - | (imm & 0xffff)); + emitInst(0x38000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (imm & 0xffff)); } void slt(RegisterID rd, RegisterID rs, RegisterID rt) { - emitInst(0x0000002a | (rd << OP_SH_RD) | (rs << OP_SH_RS) - | (rt << OP_SH_RT)); + emitInst(0x0000002a | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT)); } void sltu(RegisterID rd, RegisterID rs, RegisterID rt) { - emitInst(0x0000002b | (rd << OP_SH_RD) | (rs << OP_SH_RS) - | (rt << OP_SH_RT)); + emitInst(0x0000002b | (rd << OP_SH_RD) | (rs << OP_SH_RS) | (rt << OP_SH_RT)); } void sltiu(RegisterID rt, RegisterID rs, int imm) { - emitInst(0x2c000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) - | (imm & 0xffff)); + emitInst(0x2c000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (imm & 0xffff)); } void sll(RegisterID rd, RegisterID rt, int shamt) { - emitInst(0x00000000 | (rd << OP_SH_RD) | (rt << OP_SH_RT) - | ((shamt & 0x1f) << OP_SH_SHAMT)); + emitInst(0x00000000 | (rd << OP_SH_RD) | (rt << OP_SH_RT) | ((shamt & 0x1f) << OP_SH_SHAMT)); } void sllv(RegisterID rd, RegisterID rt, int rs) { - emitInst(0x00000004 | (rd << OP_SH_RD) | (rt << OP_SH_RT) - | (rs << OP_SH_RS)); + emitInst(0x00000004 | (rd << OP_SH_RD) | (rt << OP_SH_RT) | (rs << OP_SH_RS)); } void sra(RegisterID rd, RegisterID rt, int shamt) { - emitInst(0x00000003 | (rd << OP_SH_RD) | (rt << OP_SH_RT) - | ((shamt & 0x1f) << OP_SH_SHAMT)); + emitInst(0x00000003 | (rd << OP_SH_RD) | (rt << OP_SH_RT) | ((shamt & 0x1f) << OP_SH_SHAMT)); } void srav(RegisterID rd, RegisterID rt, RegisterID rs) { - emitInst(0x00000007 | (rd << OP_SH_RD) | (rt << OP_SH_RT) - | (rs << OP_SH_RS)); + emitInst(0x00000007 | (rd << OP_SH_RD) | (rt << OP_SH_RT) | (rs << OP_SH_RS)); } void srl(RegisterID rd, RegisterID rt, int shamt) { - emitInst(0x00000002 | (rd << OP_SH_RD) | (rt << OP_SH_RT) - | ((shamt & 0x1f) << OP_SH_SHAMT)); + emitInst(0x00000002 | (rd << OP_SH_RD) | (rt << OP_SH_RT) | ((shamt & 0x1f) << OP_SH_SHAMT)); } void srlv(RegisterID rd, RegisterID rt, RegisterID rs) { - emitInst(0x00000006 | (rd << OP_SH_RD) | (rt << OP_SH_RT) - | (rs << OP_SH_RS)); + emitInst(0x00000006 | (rd << OP_SH_RD) | (rt << OP_SH_RT) | (rs << OP_SH_RS)); + } + + void lb(RegisterID rt, RegisterID rs, int offset) + { + emitInst(0x80000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff)); + loadDelayNop(); } void lbu(RegisterID rt, RegisterID rs, int offset) { - emitInst(0x90000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) - | (offset & 0xffff)); + emitInst(0x90000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff)); loadDelayNop(); } void lw(RegisterID rt, RegisterID rs, int offset) { - emitInst(0x8c000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) - | (offset & 0xffff)); + emitInst(0x8c000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff)); loadDelayNop(); } void lwl(RegisterID rt, RegisterID rs, int offset) { - emitInst(0x88000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) - | (offset & 0xffff)); + emitInst(0x88000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff)); loadDelayNop(); } void lwr(RegisterID rt, RegisterID rs, int offset) { - emitInst(0x98000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) - | (offset & 0xffff)); + emitInst(0x98000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff)); + loadDelayNop(); + } + + void lh(RegisterID rt, RegisterID rs, int offset) + { + emitInst(0x84000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff)); loadDelayNop(); } void lhu(RegisterID rt, RegisterID rs, int offset) { - emitInst(0x94000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) - | (offset & 0xffff)); + emitInst(0x94000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff)); loadDelayNop(); } void sb(RegisterID rt, RegisterID rs, int offset) { - emitInst(0xa0000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) - | (offset & 0xffff)); + emitInst(0xa0000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff)); } void sh(RegisterID rt, RegisterID rs, int offset) { - emitInst(0xa4000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) - | (offset & 0xffff)); + emitInst(0xa4000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff)); } void sw(RegisterID rt, RegisterID rs, int offset) { - emitInst(0xac000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) - | (offset & 0xffff)); + emitInst(0xac000000 | (rt << OP_SH_RT) | (rs << OP_SH_RS) | (offset & 0xffff)); } void jr(RegisterID rs) @@ -481,51 +465,43 @@ public: void addd(FPRegisterID fd, FPRegisterID fs, FPRegisterID ft) { - emitInst(0x46200000 | (fd << OP_SH_FD) | (fs << OP_SH_FS) - | (ft << OP_SH_FT)); + emitInst(0x46200000 | (fd << OP_SH_FD) | (fs << OP_SH_FS) | (ft << OP_SH_FT)); } void subd(FPRegisterID fd, FPRegisterID fs, FPRegisterID ft) { - emitInst(0x46200001 | (fd << OP_SH_FD) | (fs << OP_SH_FS) - | (ft << OP_SH_FT)); + emitInst(0x46200001 | (fd << OP_SH_FD) | (fs << OP_SH_FS) | (ft << OP_SH_FT)); } void muld(FPRegisterID fd, FPRegisterID fs, FPRegisterID ft) { - emitInst(0x46200002 | (fd << OP_SH_FD) | (fs << OP_SH_FS) - | (ft << OP_SH_FT)); + emitInst(0x46200002 | (fd << OP_SH_FD) | (fs << OP_SH_FS) | (ft << OP_SH_FT)); } void divd(FPRegisterID fd, FPRegisterID fs, FPRegisterID ft) { - emitInst(0x46200003 | (fd << OP_SH_FD) | (fs << OP_SH_FS) - | (ft << OP_SH_FT)); + emitInst(0x46200003 | (fd << OP_SH_FD) | (fs << OP_SH_FS) | (ft << OP_SH_FT)); } void lwc1(FPRegisterID ft, RegisterID rs, int offset) { - emitInst(0xc4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS) - | (offset & 0xffff)); + emitInst(0xc4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS) | (offset & 0xffff)); copDelayNop(); } void ldc1(FPRegisterID ft, RegisterID rs, int offset) { - emitInst(0xd4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS) - | (offset & 0xffff)); + emitInst(0xd4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS) | (offset & 0xffff)); } void swc1(FPRegisterID ft, RegisterID rs, int offset) { - emitInst(0xe4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS) - | (offset & 0xffff)); + emitInst(0xe4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS) | (offset & 0xffff)); } void sdc1(FPRegisterID ft, RegisterID rs, int offset) { - emitInst(0xf4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS) - | (offset & 0xffff)); + emitInst(0xf4000000 | (ft << OP_SH_FT) | (rs << OP_SH_RS) | (offset & 0xffff)); } void mtc1(RegisterID rt, FPRegisterID fs) @@ -561,11 +537,21 @@ public: emitInst(0x46800021 | (fd << OP_SH_FD) | (fs << OP_SH_FS)); } + void cvtds(FPRegisterID fd, FPRegisterID fs) + { + emitInst(0x46000021 | (fd << OP_SH_FD) | (fs << OP_SH_FS)); + } + void cvtwd(FPRegisterID fd, FPRegisterID fs) { emitInst(0x46200024 | (fd << OP_SH_FD) | (fs << OP_SH_FS)); } + void cvtsd(FPRegisterID fd, FPRegisterID fs) + { + emitInst(0x46200020 | (fd << OP_SH_FD) | (fs << OP_SH_FS)); + } + void ceqd(FPRegisterID fs, FPRegisterID ft) { emitInst(0x46200032 | (fs << OP_SH_FS) | (ft << OP_SH_FT)); @@ -675,6 +661,19 @@ public: unsigned debugOffset() { return m_buffer.debugOffset(); } + // Assembly helpers for moving data between fp and registers. + void vmov(RegisterID rd1, RegisterID rd2, FPRegisterID rn) + { + mfc1(rd1, rn); + mfc1(rd2, FPRegisterID(rn + 1)); + } + + void vmov(FPRegisterID rd, RegisterID rn1, RegisterID rn2) + { + mtc1(rn1, rd); + mtc1(rn2, FPRegisterID(rd + 1)); + } + static unsigned getCallReturnOffset(AssemblerLabel call) { // The return address is after a call and a delay slot instruction @@ -684,7 +683,7 @@ public: // Linking & patching: // // 'link' and 'patch' methods are for use on unprotected code - such as the code - // within the AssemblerBuffer, and code being patched by the patch buffer. Once + // within the AssemblerBuffer, and code being patched by the patch buffer. Once // code has been finalized it is (platform support permitting) within a non- // writable region of memory; to modify the code in an execute-only execuable // pool the 'repatch' and 'relink' methods should be used. @@ -858,7 +857,7 @@ private: MIPSWord* insn = reinterpret_cast(reinterpret_cast(newBase) + pos); insn = insn + 2; // Need to make sure we have 5 valid instructions after pos - if ((unsigned int)pos >= m_buffer.codeSize() - 5 * sizeof(MIPSWord)) + if ((unsigned)pos >= m_buffer.codeSize() - 5 * sizeof(MIPSWord)) continue; if ((*insn & 0xfc000000) == 0x08000000) { // j @@ -894,11 +893,10 @@ private: static int linkWithOffset(MIPSWord* insn, void* to) { ASSERT((*insn & 0xfc000000) == 0x10000000 // beq - || (*insn & 0xfc000000) == 0x14000000 // bne - || (*insn & 0xffff0000) == 0x45010000 // bc1t - || (*insn & 0xffff0000) == 0x45000000); // bc1f - intptr_t diff = (reinterpret_cast(to) - - reinterpret_cast(insn) - 4) >> 2; + || (*insn & 0xfc000000) == 0x14000000 // bne + || (*insn & 0xffff0000) == 0x45010000 // bc1t + || (*insn & 0xffff0000) == 0x45000000); // bc1f + intptr_t diff = (reinterpret_cast(to) - reinterpret_cast(insn) - 4) >> 2; if (diff < -32768 || diff > 32767 || *(insn + 2) != 0x10000003) { /* diff --git a/Source/JavaScriptCore/assembler/MacroAssembler.cpp b/Source/JavaScriptCore/assembler/MacroAssembler.cpp new file mode 100644 index 000000000..2cff056d2 --- /dev/null +++ b/Source/JavaScriptCore/assembler/MacroAssembler.cpp @@ -0,0 +1,38 @@ +/* + * Copyright (C) 2012 Apple Inc. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY + * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY + * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#include "config.h" +#include "MacroAssembler.h" + +#if ENABLE(ASSEMBLER) + +namespace JSC { + +const double MacroAssembler::twoToThe32 = (double)0x100000000ull; + +} // namespace JSC + +#endif // ENABLE(ASSEMBLER) + diff --git a/Source/JavaScriptCore/assembler/MacroAssembler.h b/Source/JavaScriptCore/assembler/MacroAssembler.h index 1a9af2989..4d4a960d3 100644 --- a/Source/JavaScriptCore/assembler/MacroAssembler.h +++ b/Source/JavaScriptCore/assembler/MacroAssembler.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2008 Apple Inc. All rights reserved. + * Copyright (C) 2008, 2012 Apple Inc. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -26,6 +26,8 @@ #ifndef MacroAssembler_h #define MacroAssembler_h +#include + #if ENABLE(ASSEMBLER) #if CPU(ARM_THUMB2) @@ -68,10 +70,6 @@ public: using MacroAssemblerBase::pop; using MacroAssemblerBase::jump; using MacroAssemblerBase::branch32; -#if CPU(X86_64) - using MacroAssemblerBase::branchPtr; - using MacroAssemblerBase::branchTestPtr; -#endif using MacroAssemblerBase::move; #if ENABLE(JIT_CONSTANT_BLINDING) @@ -89,6 +87,8 @@ public: using MacroAssemblerBase::xor32; #endif + static const double twoToThe32; // This is super useful for some double code. + // Utilities used by the DFG JIT. #if ENABLE(DFG_JIT) using MacroAssemblerBase::invert; @@ -183,6 +183,23 @@ public: storePtr(imm, addressForPoke(index)); } +#if CPU(X86_64) + void peek64(RegisterID dest, int index = 0) + { + load64(Address(stackPointerRegister, (index * sizeof(void*))), dest); + } + + void poke(TrustedImm64 value, int index = 0) + { + store64(value, addressForPoke(index)); + } + + void poke64(RegisterID src, int index = 0) + { + store64(src, addressForPoke(index)); + } +#endif + // Backwards banches, these are currently all implemented using existing forwards branch mechanisms. void branchPtr(RelationalCondition cond, RegisterID op1, TrustedImmPtr imm, Label target) @@ -230,6 +247,11 @@ public: } #if !CPU(ARM_THUMB2) + PatchableJump patchableBranchPtr(RelationalCondition cond, Address left, TrustedImmPtr right = TrustedImmPtr(0)) + { + return PatchableJump(branchPtr(cond, left, right)); + } + PatchableJump patchableBranchPtrWithPatch(RelationalCondition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0)) { return PatchableJump(branchPtrWithPatch(cond, left, dataLabel, initialRightValue)); @@ -239,6 +261,16 @@ public: { return PatchableJump(jump()); } + + PatchableJump patchableBranchTest32(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1)) + { + return PatchableJump(branchTest32(cond, reg, mask)); + } + + PatchableJump patchableBranch32(RelationalCondition cond, RegisterID reg, TrustedImm32 imm) + { + return PatchableJump(branch32(cond, reg, imm)); + } #endif void jump(Label target) @@ -486,6 +518,11 @@ public: return branch32(cond, left, TrustedImm32(right)); } + Jump branchSubPtr(ResultCondition cond, RegisterID src, RegisterID dest) + { + return branchSub32(cond, src, dest); + } + Jump branchTestPtr(ResultCondition cond, RegisterID reg, RegisterID mask) { return branchTest32(cond, reg, mask); @@ -521,15 +558,295 @@ public: return MacroAssemblerBase::branchTest8(cond, Address(address.base, address.offset), mask); } #else + void addPtr(RegisterID src, RegisterID dest) + { + add64(src, dest); + } + void addPtr(Address src, RegisterID dest) + { + add64(src, dest); + } + + void addPtr(TrustedImm32 imm, RegisterID srcDest) + { + add64(imm, srcDest); + } + + void addPtr(TrustedImm32 imm, RegisterID src, RegisterID dest) + { + add64(imm, src, dest); + } + + void addPtr(TrustedImm32 imm, Address address) + { + add64(imm, address); + } + + void addPtr(AbsoluteAddress src, RegisterID dest) + { + add64(src, dest); + } + + void addPtr(TrustedImmPtr imm, RegisterID dest) + { + add64(TrustedImm64(imm), dest); + } + + void addPtr(TrustedImm32 imm, AbsoluteAddress address) + { + add64(imm, address); + } + + void andPtr(RegisterID src, RegisterID dest) + { + and64(src, dest); + } + + void andPtr(TrustedImm32 imm, RegisterID srcDest) + { + and64(imm, srcDest); + } + + void negPtr(RegisterID dest) + { + neg64(dest); + } + + void orPtr(RegisterID src, RegisterID dest) + { + or64(src, dest); + } + + void orPtr(TrustedImm32 imm, RegisterID dest) + { + or64(imm, dest); + } + + void orPtr(TrustedImmPtr imm, RegisterID dest) + { + or64(TrustedImm64(imm), dest); + } + + void orPtr(RegisterID op1, RegisterID op2, RegisterID dest) + { + or64(op1, op2, dest); + } + + void orPtr(TrustedImm32 imm, RegisterID src, RegisterID dest) + { + or64(imm, src, dest); + } + + void rotateRightPtr(TrustedImm32 imm, RegisterID srcDst) + { + rotateRight64(imm, srcDst); + } + + void subPtr(RegisterID src, RegisterID dest) + { + sub64(src, dest); + } + + void subPtr(TrustedImm32 imm, RegisterID dest) + { + sub64(imm, dest); + } + + void subPtr(TrustedImmPtr imm, RegisterID dest) + { + sub64(TrustedImm64(imm), dest); + } + + void xorPtr(RegisterID src, RegisterID dest) + { + xor64(src, dest); + } + + void xorPtr(RegisterID src, Address dest) + { + xor64(src, dest); + } + + void xorPtr(TrustedImm32 imm, RegisterID srcDest) + { + xor64(imm, srcDest); + } + + void loadPtr(ImplicitAddress address, RegisterID dest) + { + load64(address, dest); + } + + void loadPtr(BaseIndex address, RegisterID dest) + { + load64(address, dest); + } + + void loadPtr(const void* address, RegisterID dest) + { + load64(address, dest); + } + + DataLabel32 loadPtrWithAddressOffsetPatch(Address address, RegisterID dest) + { + return load64WithAddressOffsetPatch(address, dest); + } + + DataLabelCompact loadPtrWithCompactAddressOffsetPatch(Address address, RegisterID dest) + { + return load64WithCompactAddressOffsetPatch(address, dest); + } + + void storePtr(RegisterID src, ImplicitAddress address) + { + store64(src, address); + } + + void storePtr(RegisterID src, BaseIndex address) + { + store64(src, address); + } + + void storePtr(RegisterID src, void* address) + { + store64(src, address); + } + + void storePtr(TrustedImmPtr imm, ImplicitAddress address) + { + store64(TrustedImm64(imm), address); + } + + void storePtr(TrustedImmPtr imm, BaseIndex address) + { + store64(TrustedImm64(imm), address); + } + + DataLabel32 storePtrWithAddressOffsetPatch(RegisterID src, Address address) + { + return store64WithAddressOffsetPatch(src, address); + } + + void movePtrToDouble(RegisterID src, FPRegisterID dest) + { + move64ToDouble(src, dest); + } + + void moveDoubleToPtr(FPRegisterID src, RegisterID dest) + { + moveDoubleTo64(src, dest); + } + + void comparePtr(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID dest) + { + compare64(cond, left, right, dest); + } + + void comparePtr(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID dest) + { + compare64(cond, left, right, dest); + } + + void testPtr(ResultCondition cond, RegisterID reg, TrustedImm32 mask, RegisterID dest) + { + test64(cond, reg, mask, dest); + } + + void testPtr(ResultCondition cond, RegisterID reg, RegisterID mask, RegisterID dest) + { + test64(cond, reg, mask, dest); + } + + Jump branchPtr(RelationalCondition cond, RegisterID left, RegisterID right) + { + return branch64(cond, left, right); + } + + Jump branchPtr(RelationalCondition cond, RegisterID left, TrustedImmPtr right) + { + return branch64(cond, left, TrustedImm64(right)); + } + + Jump branchPtr(RelationalCondition cond, RegisterID left, Address right) + { + return branch64(cond, left, right); + } + + Jump branchPtr(RelationalCondition cond, Address left, RegisterID right) + { + return branch64(cond, left, right); + } + + Jump branchPtr(RelationalCondition cond, AbsoluteAddress left, RegisterID right) + { + return branch64(cond, left, right); + } + + Jump branchPtr(RelationalCondition cond, Address left, TrustedImmPtr right) + { + return branch64(cond, left, TrustedImm64(right)); + } + + Jump branchTestPtr(ResultCondition cond, RegisterID reg, RegisterID mask) + { + return branchTest64(cond, reg, mask); + } + + Jump branchTestPtr(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1)) + { + return branchTest64(cond, reg, mask); + } + + Jump branchTestPtr(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1)) + { + return branchTest64(cond, address, mask); + } + + Jump branchTestPtr(ResultCondition cond, Address address, RegisterID reg) + { + return branchTest64(cond, address, reg); + } + + Jump branchTestPtr(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1)) + { + return branchTest64(cond, address, mask); + } + + Jump branchTestPtr(ResultCondition cond, AbsoluteAddress address, TrustedImm32 mask = TrustedImm32(-1)) + { + return branchTest64(cond, address, mask); + } + + Jump branchAddPtr(ResultCondition cond, TrustedImm32 imm, RegisterID dest) + { + return branchAdd64(cond, imm, dest); + } + + Jump branchAddPtr(ResultCondition cond, RegisterID src, RegisterID dest) + { + return branchAdd64(cond, src, dest); + } + + Jump branchSubPtr(ResultCondition cond, TrustedImm32 imm, RegisterID dest) + { + return branchSub64(cond, imm, dest); + } + + Jump branchSubPtr(ResultCondition cond, RegisterID src, RegisterID dest) + { + return branchSub64(cond, src, dest); + } + + Jump branchSubPtr(ResultCondition cond, RegisterID src1, TrustedImm32 src2, RegisterID dest) + { + return branchSub64(cond, src1, src2, dest); + } + #if ENABLE(JIT_CONSTANT_BLINDING) - using MacroAssemblerBase::addPtr; - using MacroAssemblerBase::andPtr; - using MacroAssemblerBase::branchSubPtr; + using MacroAssemblerBase::and64; using MacroAssemblerBase::convertInt32ToDouble; - using MacroAssemblerBase::storePtr; - using MacroAssemblerBase::subPtr; - using MacroAssemblerBase::xorPtr; + using MacroAssemblerBase::store64; bool shouldBlindDouble(double value) { @@ -539,7 +856,7 @@ public: // Try to force normalisation, and check that there's no change // in the bit pattern - if (bitwise_cast(value * 1.0) != bitwise_cast(value)) + if (bitwise_cast(value * 1.0) != bitwise_cast(value)) return true; value = abs(value); @@ -578,7 +895,6 @@ public: default: { if (value <= 0xff) return false; -#if CPU(X86_64) JSValue jsValue = JSValue::decode(reinterpret_cast(value)); if (jsValue.isInt32()) return shouldBlind(Imm32(jsValue.asInt32())); @@ -587,7 +903,6 @@ public: if (!shouldBlindDouble(bitwise_cast(value))) return false; -#endif } } return shouldBlindForSpecificArch(value); @@ -617,6 +932,59 @@ public: rotateRightPtr(constant.rotation, dest); } + bool shouldBlind(Imm64 imm) + { +#if !defined(NDEBUG) + UNUSED_PARAM(imm); + // Debug always blind all constants, if only so we know + // if we've broken blinding during patch development. + return true; +#endif + + // First off we'll special case common, "safe" values to avoid hurting + // performance too much + uint64_t value = imm.asTrustedImm64().m_value; + switch (value) { + case 0xffff: + case 0xffffff: + case 0xffffffffL: + case 0xffffffffffL: + case 0xffffffffffffL: + case 0xffffffffffffffL: + case 0xffffffffffffffffL: + return false; + default: { + if (value <= 0xff) + return false; + } + } + return shouldBlindForSpecificArch(value); + } + + struct RotatedImm64 { + RotatedImm64(uint64_t v1, uint8_t v2) + : value(v1) + , rotation(v2) + { + } + TrustedImm64 value; + TrustedImm32 rotation; + }; + + RotatedImm64 rotationBlindConstant(Imm64 imm) + { + uint8_t rotation = random() % (sizeof(int64_t) * 8); + uint64_t value = imm.asTrustedImm64().m_value; + value = (value << rotation) | (value >> (sizeof(int64_t) * 8 - rotation)); + return RotatedImm64(value, rotation); + } + + void loadRotationBlindedConstant(RotatedImm64 constant, RegisterID dest) + { + move(constant.value, dest); + rotateRight64(constant.rotation, dest); + } + void convertInt32ToDouble(Imm32 imm, FPRegisterID dest) { if (shouldBlind(imm)) { @@ -635,6 +1003,24 @@ public: move(imm.asTrustedImmPtr(), dest); } + void move(Imm64 imm, RegisterID dest) + { + if (shouldBlind(imm)) + loadRotationBlindedConstant(rotationBlindConstant(imm), dest); + else + move(imm.asTrustedImm64(), dest); + } + + void and64(Imm32 imm, RegisterID dest) + { + if (shouldBlind(imm)) { + BlindedImm32 key = andBlindedConstant(imm); + and64(key.value1, dest); + and64(key.value2, dest); + } else + and64(imm.asTrustedImm32(), dest); + } + Jump branchPtr(RelationalCondition cond, RegisterID left, ImmPtr right) { if (shouldBlind(right)) { @@ -655,6 +1041,16 @@ public: storePtr(imm.asTrustedImmPtr(), dest); } + void store64(Imm64 imm, Address dest) + { + if (shouldBlind(imm)) { + RegisterID scratchRegister = scratchRegisterForBlinding(); + loadRotationBlindedConstant(rotationBlindConstant(imm), scratchRegister); + store64(scratchRegister, dest); + } else + store64(imm.asTrustedImm64(), dest); + } + #endif #endif // !CPU(X86_64) @@ -848,6 +1244,13 @@ public: storePtr(value, addressForPoke(index)); } +#if CPU(X86_64) + void poke(Imm64 value, int index = 0) + { + store64(value, addressForPoke(index)); + } +#endif + void store32(Imm32 imm, Address dest) { if (shouldBlind(imm)) { diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h index 298de9793..39d94adea 100644 --- a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h +++ b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h @@ -672,6 +672,17 @@ public: load32(Address(ARMRegisters::S0, 0), ARMRegisters::pc); } + void moveDoubleToInts(FPRegisterID src, RegisterID dest1, RegisterID dest2) + { + m_assembler.vmov(dest1, dest2, src); + } + + void moveIntsToDouble(RegisterID src1, RegisterID src2, FPRegisterID dest, FPRegisterID scratch) + { + UNUSED_PARAM(scratch); + m_assembler.vmov(dest, src1, src2); + } + Jump branchAdd32(ResultCondition cond, RegisterID src, RegisterID dest) { ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero)); diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h index 46d7225d0..1301038e5 100644 --- a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h +++ b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h @@ -754,6 +754,18 @@ public: store16(src, setupArmAddress(address)); } + // Possibly clobbers src, but not on this architecture. + void moveDoubleToInts(FPRegisterID src, RegisterID dest1, RegisterID dest2) + { + m_assembler.vmov(dest1, dest2, src); + } + + void moveIntsToDouble(RegisterID src1, RegisterID src2, FPRegisterID dest, FPRegisterID scratch) + { + UNUSED_PARAM(scratch); + m_assembler.vmov(dest, src1, src2); + } + #if ENABLE(JIT_CONSTANT_BLINDING) static bool shouldBlindForSpecificArch(uint32_t value) { @@ -1672,6 +1684,30 @@ public: dataLabel = moveWithPatch(initialRightValue, dataTempRegister); return branch32(cond, addressTempRegister, dataTempRegister); } + + PatchableJump patchableBranchPtr(RelationalCondition cond, Address left, TrustedImmPtr right = TrustedImmPtr(0)) + { + m_makeJumpPatchable = true; + Jump result = branch32(cond, left, TrustedImm32(right)); + m_makeJumpPatchable = false; + return PatchableJump(result); + } + + PatchableJump patchableBranchTest32(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1)) + { + m_makeJumpPatchable = true; + Jump result = branchTest32(cond, reg, mask); + m_makeJumpPatchable = false; + return PatchableJump(result); + } + + PatchableJump patchableBranch32(RelationalCondition cond, RegisterID reg, TrustedImm32 imm) + { + m_makeJumpPatchable = true; + Jump result = branch32(cond, reg, imm); + m_makeJumpPatchable = false; + return PatchableJump(result); + } PatchableJump patchableBranchPtrWithPatch(RelationalCondition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0)) { diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h b/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h index 22830a621..fc6f9f40d 100644 --- a/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h +++ b/Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h @@ -29,8 +29,8 @@ #if ENABLE(ASSEMBLER) && CPU(MIPS) -#include "MIPSAssembler.h" #include "AbstractMacroAssembler.h" +#include "MIPSAssembler.h" namespace JSC { @@ -155,12 +155,10 @@ public: m_assembler.lw(dataTempRegister, address.base, address.offset); if (imm.m_value >= -32768 && imm.m_value <= 32767 && !m_fixedWidth) - m_assembler.addiu(dataTempRegister, dataTempRegister, - imm.m_value); + m_assembler.addiu(dataTempRegister, dataTempRegister, imm.m_value); else { move(imm, immTempRegister); - m_assembler.addu(dataTempRegister, dataTempRegister, - immTempRegister); + m_assembler.addu(dataTempRegister, dataTempRegister, immTempRegister); } m_assembler.sw(dataTempRegister, address.base, address.offset); } else { @@ -177,12 +175,10 @@ public: m_assembler.lw(dataTempRegister, addrTempRegister, address.offset); if (imm.m_value >= -32768 && imm.m_value <= 32767 && !m_fixedWidth) - m_assembler.addiu(dataTempRegister, dataTempRegister, - imm.m_value); + m_assembler.addiu(dataTempRegister, dataTempRegister, imm.m_value); else { move(imm, immTempRegister); - m_assembler.addu(dataTempRegister, dataTempRegister, - immTempRegister); + m_assembler.addu(dataTempRegister, dataTempRegister, immTempRegister); } m_assembler.sw(dataTempRegister, addrTempRegister, address.offset); } @@ -257,8 +253,7 @@ public: { if (!imm.m_value && !m_fixedWidth) move(MIPSRegisters::zero, dest); - else if (imm.m_value > 0 && imm.m_value < 65535 - && !m_fixedWidth) + else if (imm.m_value > 0 && imm.m_value < 65535 && !m_fixedWidth) m_assembler.andi(dest, dest, imm.m_value); else { /* @@ -419,14 +414,11 @@ public: sw dataTemp, offset(base) */ m_assembler.lw(dataTempRegister, address.base, address.offset); - if (imm.m_value >= -32767 && imm.m_value <= 32768 - && !m_fixedWidth) - m_assembler.addiu(dataTempRegister, dataTempRegister, - -imm.m_value); + if (imm.m_value >= -32767 && imm.m_value <= 32768 && !m_fixedWidth) + m_assembler.addiu(dataTempRegister, dataTempRegister, -imm.m_value); else { move(imm, immTempRegister); - m_assembler.subu(dataTempRegister, dataTempRegister, - immTempRegister); + m_assembler.subu(dataTempRegister, dataTempRegister, immTempRegister); } m_assembler.sw(dataTempRegister, address.base, address.offset); } else { @@ -444,12 +436,10 @@ public: if (imm.m_value >= -32767 && imm.m_value <= 32768 && !m_fixedWidth) - m_assembler.addiu(dataTempRegister, dataTempRegister, - -imm.m_value); + m_assembler.addiu(dataTempRegister, dataTempRegister, -imm.m_value); else { move(imm, immTempRegister); - m_assembler.subu(dataTempRegister, dataTempRegister, - immTempRegister); + m_assembler.subu(dataTempRegister, dataTempRegister, immTempRegister); } m_assembler.sw(dataTempRegister, addrTempRegister, address.offset); } @@ -473,11 +463,9 @@ public: move(TrustedImmPtr(address.m_ptr), addrTempRegister); m_assembler.lw(dataTempRegister, addrTempRegister, 0); - if (imm.m_value >= -32767 && imm.m_value <= 32768 - && !m_fixedWidth) { - m_assembler.addiu(dataTempRegister, dataTempRegister, - -imm.m_value); - } else { + if (imm.m_value >= -32767 && imm.m_value <= 32768 && !m_fixedWidth) + m_assembler.addiu(dataTempRegister, dataTempRegister, -imm.m_value); + else { move(imm, immTempRegister); m_assembler.subu(dataTempRegister, dataTempRegister, immTempRegister); } @@ -531,7 +519,7 @@ public: // Memory access operations: // // Loads are of the form load(address, destination) and stores of the form - // store(source, address). The source for a store may be an TrustedImm32. Address + // store(source, address). The source for a store may be an TrustedImm32. Address // operand objects to loads and store will be implicitly constructed if a // register is passed. @@ -576,12 +564,39 @@ public: m_assembler.sll(addrTempRegister, address.index, address.scale); m_assembler.addu(addrTempRegister, addrTempRegister, address.base); m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16); - m_assembler.addu(addrTempRegister, addrTempRegister, - immTempRegister); + m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister); m_assembler.lbu(dest, addrTempRegister, address.offset); } } + void load8Signed(BaseIndex address, RegisterID dest) + { + if (address.offset >= -32768 && address.offset <= 32767 + && !m_fixedWidth) { + /* + sll addrTemp, address.index, address.scale + addu addrTemp, addrTemp, address.base + lb dest, address.offset(addrTemp) + */ + m_assembler.sll(addrTempRegister, address.index, address.scale); + m_assembler.addu(addrTempRegister, addrTempRegister, address.base); + m_assembler.lb(dest, addrTempRegister, address.offset); + } else { + /* + sll addrTemp, address.index, address.scale + addu addrTemp, addrTemp, address.base + lui immTemp, (address.offset + 0x8000) >> 16 + addu addrTemp, addrTemp, immTemp + lb dest, (address.offset & 0xffff)(at) + */ + m_assembler.sll(addrTempRegister, address.index, address.scale); + m_assembler.addu(addrTempRegister, addrTempRegister, address.base); + m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16); + m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister); + m_assembler.lb(dest, addrTempRegister, address.offset); + } + } + void load32(ImplicitAddress address, RegisterID dest) { if (address.offset >= -32768 && address.offset <= 32767 @@ -622,8 +637,7 @@ public: m_assembler.sll(addrTempRegister, address.index, address.scale); m_assembler.addu(addrTempRegister, addrTempRegister, address.base); m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16); - m_assembler.addu(addrTempRegister, addrTempRegister, - immTempRegister); + m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister); m_assembler.lw(dest, addrTempRegister, address.offset); } } @@ -675,8 +689,7 @@ public: m_assembler.addu(addrTempRegister, addrTempRegister, address.base); m_assembler.lui(immTempRegister, address.offset >> 16); m_assembler.ori(immTempRegister, immTempRegister, address.offset); - m_assembler.addu(addrTempRegister, addrTempRegister, - immTempRegister); + m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister); #if CPU(BIG_ENDIAN) m_assembler.lwl(dest, addrTempRegister, 0); m_assembler.lwr(dest, addrTempRegister, 3); @@ -763,12 +776,39 @@ public: m_assembler.sll(addrTempRegister, address.index, address.scale); m_assembler.addu(addrTempRegister, addrTempRegister, address.base); m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16); - m_assembler.addu(addrTempRegister, addrTempRegister, - immTempRegister); + m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister); m_assembler.lhu(dest, addrTempRegister, address.offset); } } + void load16Signed(BaseIndex address, RegisterID dest) + { + if (address.offset >= -32768 && address.offset <= 32767 + && !m_fixedWidth) { + /* + sll addrTemp, address.index, address.scale + addu addrTemp, addrTemp, address.base + lh dest, address.offset(addrTemp) + */ + m_assembler.sll(addrTempRegister, address.index, address.scale); + m_assembler.addu(addrTempRegister, addrTempRegister, address.base); + m_assembler.lh(dest, addrTempRegister, address.offset); + } else { + /* + sll addrTemp, address.index, address.scale + addu addrTemp, addrTemp, address.base + lui immTemp, (address.offset + 0x8000) >> 16 + addu addrTemp, addrTemp, immTemp + lh dest, (address.offset & 0xffff)(addrTemp) + */ + m_assembler.sll(addrTempRegister, address.index, address.scale); + m_assembler.addu(addrTempRegister, addrTempRegister, address.base); + m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16); + m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister); + m_assembler.lh(dest, addrTempRegister, address.offset); + } + } + DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address) { m_fixedWidth = true; @@ -809,8 +849,7 @@ public: m_assembler.sll(addrTempRegister, address.index, address.scale); m_assembler.addu(addrTempRegister, addrTempRegister, address.base); m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16); - m_assembler.addu(addrTempRegister, addrTempRegister, - immTempRegister); + m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister); m_assembler.sb(src, addrTempRegister, address.offset); } } @@ -855,8 +894,7 @@ public: m_assembler.sll(addrTempRegister, address.index, address.scale); m_assembler.addu(addrTempRegister, addrTempRegister, address.base); m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16); - m_assembler.addu(addrTempRegister, addrTempRegister, - immTempRegister); + m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister); m_assembler.sh(src, addrTempRegister, address.offset); } } @@ -901,8 +939,7 @@ public: m_assembler.sll(addrTempRegister, address.index, address.scale); m_assembler.addu(addrTempRegister, addrTempRegister, address.base); m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16); - m_assembler.addu(addrTempRegister, addrTempRegister, - immTempRegister); + m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister); m_assembler.sw(src, addrTempRegister, address.offset); } } @@ -912,8 +949,7 @@ public: if (address.offset >= -32768 && address.offset <= 32767 && !m_fixedWidth) { if (!imm.m_value) - m_assembler.sw(MIPSRegisters::zero, address.base, - address.offset); + m_assembler.sw(MIPSRegisters::zero, address.base, address.offset); else { move(imm, immTempRegister); m_assembler.sw(immTempRegister, address.base, address.offset); @@ -927,12 +963,10 @@ public: m_assembler.lui(addrTempRegister, (address.offset + 0x8000) >> 16); m_assembler.addu(addrTempRegister, addrTempRegister, address.base); if (!imm.m_value && !m_fixedWidth) - m_assembler.sw(MIPSRegisters::zero, addrTempRegister, - address.offset); + m_assembler.sw(MIPSRegisters::zero, addrTempRegister, address.offset); else { move(imm, immTempRegister); - m_assembler.sw(immTempRegister, addrTempRegister, - address.offset); + m_assembler.sw(immTempRegister, addrTempRegister, address.offset); } } } @@ -997,9 +1031,9 @@ public: // Stack manipulation operations: // // The ABI is assumed to provide a stack abstraction to memory, - // containing machine word sized units of data. Push and pop + // containing machine word sized units of data. Push and pop // operations add and remove a single register sized unit of data - // to or from the stack. Peek and poke operations read or write + // to or from the stack. Peek and poke operations read or write // values on the stack, without moving the current stack position. void pop(RegisterID dest) @@ -1283,10 +1317,21 @@ public: m_fixedWidth = false; } + void moveDoubleToInts(FPRegisterID src, RegisterID dest1, RegisterID dest2) + { + m_assembler.vmov(dest1, dest2, src); + } + + void moveIntsToDouble(RegisterID src1, RegisterID src2, FPRegisterID dest, FPRegisterID scratch) + { + UNUSED_PARAM(scratch); + m_assembler.vmov(dest, src1, src2); + } + // Arithmetic control flow operations: // // This set of conditional branch operations branch based - // on the result of an arithmetic operation. The operation + // on the result of an arithmetic operation. The operation // is performed as normal, storing the result. // // * jz operations branch if the result is zero. @@ -1495,7 +1540,7 @@ public: Call nearCall() { - /* We need two words for relaxation. */ + /* We need two words for relaxation. */ m_assembler.nop(); m_assembler.nop(); m_assembler.jal(); @@ -1583,8 +1628,7 @@ public: m_assembler.sltu(dest, MIPSRegisters::zero, dataTempRegister); } else { move(mask, immTempRegister); - m_assembler.andInsn(cmpTempRegister, dataTempRegister, - immTempRegister); + m_assembler.andInsn(cmpTempRegister, dataTempRegister, immTempRegister); if (cond == Zero) m_assembler.sltiu(dest, cmpTempRegister, 1); else @@ -1603,8 +1647,7 @@ public: m_assembler.sltu(dest, MIPSRegisters::zero, dataTempRegister); } else { move(mask, immTempRegister); - m_assembler.andInsn(cmpTempRegister, dataTempRegister, - immTempRegister); + m_assembler.andInsn(cmpTempRegister, dataTempRegister, immTempRegister); if (cond == Zero) m_assembler.sltiu(dest, cmpTempRegister, 1); else @@ -1680,6 +1723,34 @@ public: return tailRecursiveCall(); } + void loadFloat(BaseIndex address, FPRegisterID dest) + { + if (address.offset >= -32768 && address.offset <= 32767 + && !m_fixedWidth) { + /* + sll addrTemp, address.index, address.scale + addu addrTemp, addrTemp, address.base + lwc1 dest, address.offset(addrTemp) + */ + m_assembler.sll(addrTempRegister, address.index, address.scale); + m_assembler.addu(addrTempRegister, addrTempRegister, address.base); + m_assembler.lwc1(dest, addrTempRegister, address.offset); + } else { + /* + sll addrTemp, address.index, address.scale + addu addrTemp, addrTemp, address.base + lui immTemp, (address.offset + 0x8000) >> 16 + addu addrTemp, addrTemp, immTemp + lwc1 dest, (address.offset & 0xffff)(at) + */ + m_assembler.sll(addrTempRegister, address.index, address.scale); + m_assembler.addu(addrTempRegister, addrTempRegister, address.base); + m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16); + m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister); + m_assembler.lwc1(dest, addrTempRegister, address.offset); + } + } + void loadDouble(ImplicitAddress address, FPRegisterID dest) { #if WTF_MIPS_ISA(1) @@ -1710,6 +1781,65 @@ public: #endif } + void loadDouble(BaseIndex address, FPRegisterID dest) + { +#if WTF_MIPS_ISA(1) + if (address.offset >= -32768 && address.offset <= 32767 + && !m_fixedWidth) { + /* + sll addrTemp, address.index, address.scale + addu addrTemp, addrTemp, address.base + lwc1 dest, address.offset(addrTemp) + lwc1 dest+1, (address.offset+4)(addrTemp) + */ + m_assembler.sll(addrTempRegister, address.index, address.scale); + m_assembler.addu(addrTempRegister, addrTempRegister, address.base); + m_assembler.lwc1(dest, addrTempRegister, address.offset); + m_assembler.lwc1(FPRegisterID(dest + 1), addrTempRegister, address.offset + 4); + } else { + /* + sll addrTemp, address.index, address.scale + addu addrTemp, addrTemp, address.base + lui immTemp, (address.offset + 0x8000) >> 16 + addu addrTemp, addrTemp, immTemp + lwc1 dest, (address.offset & 0xffff)(at) + lwc1 dest+4, (address.offset & 0xffff + 4)(at) + */ + m_assembler.sll(addrTempRegister, address.index, address.scale); + m_assembler.addu(addrTempRegister, addrTempRegister, address.base); + m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16); + m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister); + m_assembler.lwc1(dest, addrTempRegister, address.offset); + m_assembler.lwc1(FPRegisterID(dest + 1), addrTempRegister, address.offset + 4); + } +#else + if (address.offset >= -32768 && address.offset <= 32767 + && !m_fixedWidth) { + /* + sll addrTemp, address.index, address.scale + addu addrTemp, addrTemp, address.base + ldc1 dest, address.offset(addrTemp) + */ + m_assembler.sll(addrTempRegister, address.index, address.scale); + m_assembler.addu(addrTempRegister, addrTempRegister, address.base); + m_assembler.ldc1(dest, addrTempRegister, address.offset); + } else { + /* + sll addrTemp, address.index, address.scale + addu addrTemp, addrTemp, address.base + lui immTemp, (address.offset + 0x8000) >> 16 + addu addrTemp, addrTemp, immTemp + ldc1 dest, (address.offset & 0xffff)(at) + */ + m_assembler.sll(addrTempRegister, address.index, address.scale); + m_assembler.addu(addrTempRegister, addrTempRegister, address.base); + m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16); + m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister); + m_assembler.ldc1(dest, addrTempRegister, address.offset); + } +#endif + } + void loadDouble(const void* address, FPRegisterID dest) { #if WTF_MIPS_ISA(1) @@ -1731,6 +1861,33 @@ public: #endif } + void storeFloat(FPRegisterID src, BaseIndex address) + { + if (address.offset >= -32768 && address.offset <= 32767 + && !m_fixedWidth) { + /* + sll addrTemp, address.index, address.scale + addu addrTemp, addrTemp, address.base + swc1 src, address.offset(addrTemp) + */ + m_assembler.sll(addrTempRegister, address.index, address.scale); + m_assembler.addu(addrTempRegister, addrTempRegister, address.base); + m_assembler.swc1(src, addrTempRegister, address.offset); + } else { + /* + sll addrTemp, address.index, address.scale + addu addrTemp, addrTemp, address.base + lui immTemp, (address.offset + 0x8000) >> 16 + addu addrTemp, addrTemp, immTemp + swc1 src, (address.offset & 0xffff)(at) + */ + m_assembler.sll(addrTempRegister, address.index, address.scale); + m_assembler.addu(addrTempRegister, addrTempRegister, address.base); + m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16); + m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister); + m_assembler.swc1(src, addrTempRegister, address.offset); + } + } void storeDouble(FPRegisterID src, ImplicitAddress address) { @@ -1762,17 +1919,99 @@ public: #endif } + void storeDouble(FPRegisterID src, BaseIndex address) + { +#if WTF_MIPS_ISA(1) + if (address.offset >= -32768 && address.offset <= 32767 + && !m_fixedWidth) { + /* + sll addrTemp, address.index, address.scale + addu addrTemp, addrTemp, address.base + swc1 src, address.offset(addrTemp) + swc1 src+1, (address.offset + 4)(addrTemp) + */ + m_assembler.sll(addrTempRegister, address.index, address.scale); + m_assembler.addu(addrTempRegister, addrTempRegister, address.base); + m_assembler.swc1(src, addrTempRegister, address.offset); + m_assembler.swc1(FPRegisterID(src + 1), addrTempRegister, address.offset + 4); + } else { + /* + sll addrTemp, address.index, address.scale + addu addrTemp, addrTemp, address.base + lui immTemp, (address.offset + 0x8000) >> 16 + addu addrTemp, addrTemp, immTemp + swc1 src, (address.offset & 0xffff)(at) + swc1 src+1, (address.offset & 0xffff + 4)(at) + */ + m_assembler.sll(addrTempRegister, address.index, address.scale); + m_assembler.addu(addrTempRegister, addrTempRegister, address.base); + m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16); + m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister); + m_assembler.swc1(src, addrTempRegister, address.offset); + m_assembler.swc1(FPRegisterID(src + 1), addrTempRegister, address.offset + 4); + } +#else + if (address.offset >= -32768 && address.offset <= 32767 + && !m_fixedWidth) { + /* + sll addrTemp, address.index, address.scale + addu addrTemp, addrTemp, address.base + sdc1 src, address.offset(addrTemp) + */ + m_assembler.sll(addrTempRegister, address.index, address.scale); + m_assembler.addu(addrTempRegister, addrTempRegister, address.base); + m_assembler.sdc1(src, addrTempRegister, address.offset); + } else { + /* + sll addrTemp, address.index, address.scale + addu addrTemp, addrTemp, address.base + lui immTemp, (address.offset + 0x8000) >> 16 + addu addrTemp, addrTemp, immTemp + sdc1 src, (address.offset & 0xffff)(at) + */ + m_assembler.sll(addrTempRegister, address.index, address.scale); + m_assembler.addu(addrTempRegister, addrTempRegister, address.base); + m_assembler.lui(immTempRegister, (address.offset + 0x8000) >> 16); + m_assembler.addu(addrTempRegister, addrTempRegister, immTempRegister); + m_assembler.sdc1(src, addrTempRegister, address.offset); + } +#endif + } + + void storeDouble(FPRegisterID src, const void* address) + { +#if WTF_MIPS_ISA(1) + move(TrustedImmPtr(address), addrTempRegister); + m_assembler.swc1(src, addrTempRegister, 0); + m_assembler.swc1(FPRegisterID(src + 1), addrTempRegister, 4); +#else + move(TrustedImmPtr(address), addrTempRegister); + m_assembler.sdc1(src, addrTempRegister, 0); +#endif + } + void addDouble(FPRegisterID src, FPRegisterID dest) { m_assembler.addd(dest, dest, src); } + void addDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest) + { + m_assembler.addd(dest, op1, op2); + } + void addDouble(Address src, FPRegisterID dest) { loadDouble(src, fpTempRegister); m_assembler.addd(dest, dest, fpTempRegister); } + void addDouble(AbsoluteAddress address, FPRegisterID dest) + { + loadDouble(address.m_ptr, fpTempRegister); + m_assembler.addd(dest, dest, fpTempRegister); + } + void subDouble(FPRegisterID src, FPRegisterID dest) { m_assembler.subd(dest, dest, src); @@ -1820,6 +2059,16 @@ public: m_assembler.cvtdw(dest, fpTempRegister); } + void convertFloatToDouble(FPRegisterID src, FPRegisterID dst) + { + m_assembler.cvtds(dst, src); + } + + void convertDoubleToFloat(FPRegisterID src, FPRegisterID dst) + { + m_assembler.cvtsd(dst, src); + } + void insertRelaxationWords() { /* We need four words for relaxation. */ diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86.h index f6e373d3e..8fd31466d 100644 --- a/Source/JavaScriptCore/assembler/MacroAssemblerX86.h +++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86.h @@ -138,6 +138,22 @@ public: ASSERT(-128 <= imm.m_value && imm.m_value < 128); m_assembler.movb_i8m(imm.m_value, address); } + + // Possibly clobbers src. + void moveDoubleToInts(FPRegisterID src, RegisterID dest1, RegisterID dest2) + { + movePackedToInt32(src, dest1); + rshiftPacked(TrustedImm32(32), src); + movePackedToInt32(src, dest2); + } + + void moveIntsToDouble(RegisterID src1, RegisterID src2, FPRegisterID dest, FPRegisterID scratch) + { + moveInt32ToPacked(src1, dest); + moveInt32ToPacked(src2, scratch); + lshiftPacked(TrustedImm32(32), scratch); + orPacked(scratch, dest); + } Jump branchAdd32(ResultCondition cond, TrustedImm32 imm, AbsoluteAddress dest) { diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h index 905c09426..66db26acb 100644 --- a/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h +++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h @@ -97,8 +97,11 @@ public: #if ENABLE(JIT_CONSTANT_BLINDING) static bool shouldBlindForSpecificArch(uint32_t value) { return value >= 0x00ffffff; } #if CPU(X86_64) + static bool shouldBlindForSpecificArch(uint64_t value) { return value >= 0x00ffffff; } +#if OS(DARWIN) // On 64-bit systems other than DARWIN uint64_t and uintptr_t are the same type so overload is prohibited. static bool shouldBlindForSpecificArch(uintptr_t value) { return value >= 0x00ffffff; } #endif +#endif #endif // Integer arithmetic operations: @@ -993,6 +996,11 @@ public: m_assembler.movq_i64r(imm.asIntptr(), dest); } + void move(TrustedImm64 imm, RegisterID dest) + { + m_assembler.movq_i64r(imm.m_value, dest); + } + void swap(RegisterID reg1, RegisterID reg2) { if (reg1 != reg2) diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h index 6493b0c34..ceacf6aa8 100644 --- a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h +++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h @@ -154,231 +154,225 @@ public: return Call::fromTailJump(newJump); } + Jump branchAdd32(ResultCondition cond, TrustedImm32 src, AbsoluteAddress dest) + { + move(TrustedImmPtr(dest.m_ptr), scratchRegister); + add32(src, Address(scratchRegister)); + return Jump(m_assembler.jCC(x86Condition(cond))); + } - void addPtr(RegisterID src, RegisterID dest) + void add64(RegisterID src, RegisterID dest) { m_assembler.addq_rr(src, dest); } - void addPtr(Address src, RegisterID dest) + void add64(Address src, RegisterID dest) { m_assembler.addq_mr(src.offset, src.base, dest); } - void addPtr(AbsoluteAddress src, RegisterID dest) + void add64(AbsoluteAddress src, RegisterID dest) { move(TrustedImmPtr(src.m_ptr), scratchRegister); - addPtr(Address(scratchRegister), dest); + add64(Address(scratchRegister), dest); } - void addPtr(TrustedImm32 imm, RegisterID srcDest) + void add64(TrustedImm32 imm, RegisterID srcDest) { m_assembler.addq_ir(imm.m_value, srcDest); } - void addPtr(TrustedImmPtr imm, RegisterID dest) + void add64(TrustedImm64 imm, RegisterID dest) { move(imm, scratchRegister); - m_assembler.addq_rr(scratchRegister, dest); + add64(scratchRegister, dest); } - void addPtr(TrustedImm32 imm, RegisterID src, RegisterID dest) + void add64(TrustedImm32 imm, RegisterID src, RegisterID dest) { m_assembler.leaq_mr(imm.m_value, src, dest); } - void addPtr(TrustedImm32 imm, Address address) + void add64(TrustedImm32 imm, Address address) { m_assembler.addq_im(imm.m_value, address.offset, address.base); } - void addPtr(TrustedImm32 imm, AbsoluteAddress address) - { - move(TrustedImmPtr(address.m_ptr), scratchRegister); - addPtr(imm, Address(scratchRegister)); - } - void add64(TrustedImm32 imm, AbsoluteAddress address) { - addPtr(imm, address); + move(TrustedImmPtr(address.m_ptr), scratchRegister); + add64(imm, Address(scratchRegister)); } - void andPtr(RegisterID src, RegisterID dest) + void and64(RegisterID src, RegisterID dest) { m_assembler.andq_rr(src, dest); } - void andPtr(TrustedImm32 imm, RegisterID srcDest) + void and64(TrustedImm32 imm, RegisterID srcDest) { m_assembler.andq_ir(imm.m_value, srcDest); } - void negPtr(RegisterID dest) + void neg64(RegisterID dest) { m_assembler.negq_r(dest); } - void orPtr(RegisterID src, RegisterID dest) + void or64(RegisterID src, RegisterID dest) { m_assembler.orq_rr(src, dest); } - void orPtr(TrustedImmPtr imm, RegisterID dest) + void or64(TrustedImm64 imm, RegisterID dest) { move(imm, scratchRegister); - m_assembler.orq_rr(scratchRegister, dest); + or64(scratchRegister, dest); } - void orPtr(TrustedImm32 imm, RegisterID dest) + void or64(TrustedImm32 imm, RegisterID dest) { m_assembler.orq_ir(imm.m_value, dest); } - void orPtr(RegisterID op1, RegisterID op2, RegisterID dest) + void or64(RegisterID op1, RegisterID op2, RegisterID dest) { if (op1 == op2) move(op1, dest); else if (op1 == dest) - orPtr(op2, dest); + or64(op2, dest); else { move(op2, dest); - orPtr(op1, dest); + or64(op1, dest); } } - void orPtr(TrustedImm32 imm, RegisterID src, RegisterID dest) + void or64(TrustedImm32 imm, RegisterID src, RegisterID dest) { move(src, dest); - orPtr(imm, dest); + or64(imm, dest); } - void rotateRightPtr(TrustedImm32 imm, RegisterID srcDst) + void rotateRight64(TrustedImm32 imm, RegisterID srcDst) { m_assembler.rorq_i8r(imm.m_value, srcDst); } - void subPtr(RegisterID src, RegisterID dest) + void sub64(RegisterID src, RegisterID dest) { m_assembler.subq_rr(src, dest); } - void subPtr(TrustedImm32 imm, RegisterID dest) + void sub64(TrustedImm32 imm, RegisterID dest) { m_assembler.subq_ir(imm.m_value, dest); } - void subPtr(TrustedImmPtr imm, RegisterID dest) + void sub64(TrustedImm64 imm, RegisterID dest) { move(imm, scratchRegister); - m_assembler.subq_rr(scratchRegister, dest); + sub64(scratchRegister, dest); } - void xorPtr(RegisterID src, RegisterID dest) + void xor64(RegisterID src, RegisterID dest) { m_assembler.xorq_rr(src, dest); } - void xorPtr(RegisterID src, Address dest) + void xor64(RegisterID src, Address dest) { m_assembler.xorq_rm(src, dest.offset, dest.base); } - void xorPtr(TrustedImm32 imm, RegisterID srcDest) + void xor64(TrustedImm32 imm, RegisterID srcDest) { m_assembler.xorq_ir(imm.m_value, srcDest); } - void loadPtr(ImplicitAddress address, RegisterID dest) + void load64(ImplicitAddress address, RegisterID dest) { m_assembler.movq_mr(address.offset, address.base, dest); } - ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest) - { - ConvertibleLoadLabel result = ConvertibleLoadLabel(this); - m_assembler.movq_mr(address.offset, address.base, dest); - return result; - } - - void loadPtr(BaseIndex address, RegisterID dest) + void load64(BaseIndex address, RegisterID dest) { m_assembler.movq_mr(address.offset, address.base, address.index, address.scale, dest); } - void loadPtr(const void* address, RegisterID dest) + void load64(const void* address, RegisterID dest) { if (dest == X86Registers::eax) m_assembler.movq_mEAX(address); else { move(TrustedImmPtr(address), dest); - loadPtr(dest, dest); + load64(dest, dest); } } - DataLabel32 loadPtrWithAddressOffsetPatch(Address address, RegisterID dest) + DataLabel32 load64WithAddressOffsetPatch(Address address, RegisterID dest) { padBeforePatch(); m_assembler.movq_mr_disp32(address.offset, address.base, dest); return DataLabel32(this); } - DataLabelCompact loadPtrWithCompactAddressOffsetPatch(Address address, RegisterID dest) + DataLabelCompact load64WithCompactAddressOffsetPatch(Address address, RegisterID dest) { padBeforePatch(); m_assembler.movq_mr_disp8(address.offset, address.base, dest); return DataLabelCompact(this); } - void storePtr(RegisterID src, ImplicitAddress address) + void store64(RegisterID src, ImplicitAddress address) { m_assembler.movq_rm(src, address.offset, address.base); } - void storePtr(RegisterID src, BaseIndex address) + void store64(RegisterID src, BaseIndex address) { m_assembler.movq_rm(src, address.offset, address.base, address.index, address.scale); } - void storePtr(RegisterID src, void* address) + void store64(RegisterID src, void* address) { if (src == X86Registers::eax) m_assembler.movq_EAXm(address); else { move(TrustedImmPtr(address), scratchRegister); - storePtr(src, scratchRegister); + store64(src, scratchRegister); } } - void storePtr(TrustedImmPtr imm, ImplicitAddress address) + void store64(TrustedImm64 imm, ImplicitAddress address) { move(imm, scratchRegister); - storePtr(scratchRegister, address); + store64(scratchRegister, address); } - void storePtr(TrustedImmPtr imm, BaseIndex address) + void store64(TrustedImm64 imm, BaseIndex address) { move(imm, scratchRegister); m_assembler.movq_rm(scratchRegister, address.offset, address.base, address.index, address.scale); } - DataLabel32 storePtrWithAddressOffsetPatch(RegisterID src, Address address) + DataLabel32 store64WithAddressOffsetPatch(RegisterID src, Address address) { padBeforePatch(); m_assembler.movq_rm_disp32(src, address.offset, address.base); return DataLabel32(this); } - void movePtrToDouble(RegisterID src, FPRegisterID dest) + void move64ToDouble(RegisterID src, FPRegisterID dest) { m_assembler.movq_rr(src, dest); } - void moveDoubleToPtr(FPRegisterID src, RegisterID dest) + void moveDoubleTo64(FPRegisterID src, RegisterID dest) { m_assembler.movq_rr(src, dest); } - void comparePtr(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID dest) + void compare64(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID dest) { if (((cond == Equal) || (cond == NotEqual)) && !right.m_value) m_assembler.testq_rr(left, left); @@ -388,67 +382,60 @@ public: m_assembler.movzbl_rr(dest, dest); } - void comparePtr(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID dest) + void compare64(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID dest) { m_assembler.cmpq_rr(right, left); m_assembler.setCC_r(x86Condition(cond), dest); m_assembler.movzbl_rr(dest, dest); } - Jump branchAdd32(ResultCondition cond, TrustedImm32 src, AbsoluteAddress dest) - { - move(TrustedImmPtr(dest.m_ptr), scratchRegister); - add32(src, Address(scratchRegister)); - return Jump(m_assembler.jCC(x86Condition(cond))); - } - - Jump branchPtr(RelationalCondition cond, RegisterID left, RegisterID right) + Jump branch64(RelationalCondition cond, RegisterID left, RegisterID right) { m_assembler.cmpq_rr(right, left); return Jump(m_assembler.jCC(x86Condition(cond))); } - Jump branchPtr(RelationalCondition cond, RegisterID left, TrustedImmPtr right) + Jump branch64(RelationalCondition cond, RegisterID left, TrustedImm64 right) { if (((cond == Equal) || (cond == NotEqual)) && !right.m_value) { m_assembler.testq_rr(left, left); return Jump(m_assembler.jCC(x86Condition(cond))); } move(right, scratchRegister); - return branchPtr(cond, left, scratchRegister); + return branch64(cond, left, scratchRegister); } - Jump branchPtr(RelationalCondition cond, RegisterID left, Address right) + Jump branch64(RelationalCondition cond, RegisterID left, Address right) { m_assembler.cmpq_mr(right.offset, right.base, left); return Jump(m_assembler.jCC(x86Condition(cond))); } - Jump branchPtr(RelationalCondition cond, AbsoluteAddress left, RegisterID right) + Jump branch64(RelationalCondition cond, AbsoluteAddress left, RegisterID right) { move(TrustedImmPtr(left.m_ptr), scratchRegister); - return branchPtr(cond, Address(scratchRegister), right); + return branch64(cond, Address(scratchRegister), right); } - Jump branchPtr(RelationalCondition cond, Address left, RegisterID right) + Jump branch64(RelationalCondition cond, Address left, RegisterID right) { m_assembler.cmpq_rm(right, left.offset, left.base); return Jump(m_assembler.jCC(x86Condition(cond))); } - Jump branchPtr(RelationalCondition cond, Address left, TrustedImmPtr right) + Jump branch64(RelationalCondition cond, Address left, TrustedImm64 right) { move(right, scratchRegister); - return branchPtr(cond, left, scratchRegister); + return branch64(cond, left, scratchRegister); } - Jump branchTestPtr(ResultCondition cond, RegisterID reg, RegisterID mask) + Jump branchTest64(ResultCondition cond, RegisterID reg, RegisterID mask) { m_assembler.testq_rr(reg, mask); return Jump(m_assembler.jCC(x86Condition(cond))); } - Jump branchTestPtr(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1)) + Jump branchTest64(ResultCondition cond, RegisterID reg, TrustedImm32 mask = TrustedImm32(-1)) { // if we are only interested in the low seven bits, this can be tested with a testb if (mask.m_value == -1) @@ -460,7 +447,7 @@ public: return Jump(m_assembler.jCC(x86Condition(cond))); } - void testPtr(ResultCondition cond, RegisterID reg, TrustedImm32 mask, RegisterID dest) + void test64(ResultCondition cond, RegisterID reg, TrustedImm32 mask, RegisterID dest) { if (mask.m_value == -1) m_assembler.testq_rr(reg, reg); @@ -471,19 +458,19 @@ public: set32(x86Condition(cond), dest); } - void testPtr(ResultCondition cond, RegisterID reg, RegisterID mask, RegisterID dest) + void test64(ResultCondition cond, RegisterID reg, RegisterID mask, RegisterID dest) { m_assembler.testq_rr(reg, mask); set32(x86Condition(cond), dest); } - Jump branchTestPtr(ResultCondition cond, AbsoluteAddress address, TrustedImm32 mask = TrustedImm32(-1)) + Jump branchTest64(ResultCondition cond, AbsoluteAddress address, TrustedImm32 mask = TrustedImm32(-1)) { - loadPtr(address.m_ptr, scratchRegister); - return branchTestPtr(cond, scratchRegister, mask); + load64(address.m_ptr, scratchRegister); + return branchTest64(cond, scratchRegister, mask); } - Jump branchTestPtr(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1)) + Jump branchTest64(ResultCondition cond, Address address, TrustedImm32 mask = TrustedImm32(-1)) { if (mask.m_value == -1) m_assembler.cmpq_im(0, address.offset, address.base); @@ -492,13 +479,13 @@ public: return Jump(m_assembler.jCC(x86Condition(cond))); } - Jump branchTestPtr(ResultCondition cond, Address address, RegisterID reg) + Jump branchTest64(ResultCondition cond, Address address, RegisterID reg) { m_assembler.testq_rm(reg, address.offset, address.base); return Jump(m_assembler.jCC(x86Condition(cond))); } - Jump branchTestPtr(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1)) + Jump branchTest64(ResultCondition cond, BaseIndex address, TrustedImm32 mask = TrustedImm32(-1)) { if (mask.m_value == -1) m_assembler.cmpq_im(0, address.offset, address.base, address.index, address.scale); @@ -508,28 +495,41 @@ public: } - Jump branchAddPtr(ResultCondition cond, TrustedImm32 imm, RegisterID dest) + Jump branchAdd64(ResultCondition cond, TrustedImm32 imm, RegisterID dest) + { + add64(imm, dest); + return Jump(m_assembler.jCC(x86Condition(cond))); + } + + Jump branchAdd64(ResultCondition cond, RegisterID src, RegisterID dest) { - addPtr(imm, dest); + add64(src, dest); return Jump(m_assembler.jCC(x86Condition(cond))); } - Jump branchAddPtr(ResultCondition cond, RegisterID src, RegisterID dest) + Jump branchSub64(ResultCondition cond, TrustedImm32 imm, RegisterID dest) { - addPtr(src, dest); + sub64(imm, dest); return Jump(m_assembler.jCC(x86Condition(cond))); } - Jump branchSubPtr(ResultCondition cond, TrustedImm32 imm, RegisterID dest) + Jump branchSub64(ResultCondition cond, RegisterID src, RegisterID dest) { - subPtr(imm, dest); + sub64(src, dest); return Jump(m_assembler.jCC(x86Condition(cond))); } - Jump branchSubPtr(ResultCondition cond, RegisterID src1, TrustedImm32 src2, RegisterID dest) + Jump branchSub64(ResultCondition cond, RegisterID src1, TrustedImm32 src2, RegisterID dest) { move(src1, dest); - return branchSubPtr(cond, src2, dest); + return branchSub64(cond, src2, dest); + } + + ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest) + { + ConvertibleLoadLabel result = ConvertibleLoadLabel(this); + m_assembler.movq_mr(address.offset, address.base, dest); + return result; } DataLabelPtr moveWithPatch(TrustedImmPtr initialValue, RegisterID dest) @@ -542,22 +542,22 @@ public: Jump branchPtrWithPatch(RelationalCondition cond, RegisterID left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0)) { dataLabel = moveWithPatch(initialRightValue, scratchRegister); - return branchPtr(cond, left, scratchRegister); + return branch64(cond, left, scratchRegister); } Jump branchPtrWithPatch(RelationalCondition cond, Address left, DataLabelPtr& dataLabel, TrustedImmPtr initialRightValue = TrustedImmPtr(0)) { dataLabel = moveWithPatch(initialRightValue, scratchRegister); - return branchPtr(cond, left, scratchRegister); + return branch64(cond, left, scratchRegister); } DataLabelPtr storePtrWithPatch(TrustedImmPtr initialValue, ImplicitAddress address) { DataLabelPtr label = moveWithPatch(initialValue, scratchRegister); - storePtr(scratchRegister, address); + store64(scratchRegister, address); return label; } - + using MacroAssemblerX86Common::branchTest8; Jump branchTest8(ResultCondition cond, ExtendedAddress address, TrustedImm32 mask = TrustedImm32(-1)) { diff --git a/Source/JavaScriptCore/bytecode/ByValInfo.h b/Source/JavaScriptCore/bytecode/ByValInfo.h new file mode 100644 index 000000000..8cba4463d --- /dev/null +++ b/Source/JavaScriptCore/bytecode/ByValInfo.h @@ -0,0 +1,158 @@ +/* + * Copyright (C) 2012 Apple Inc. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY + * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY + * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#ifndef ByValInfo_h +#define ByValInfo_h + +#include + +#if ENABLE(JIT) + +#include "ClassInfo.h" +#include "CodeLocation.h" +#include "IndexingType.h" +#include "JITStubRoutine.h" +#include "Structure.h" + +namespace JSC { + +enum JITArrayMode { + JITContiguous, + JITArrayStorage, + JITInt8Array, + JITInt16Array, + JITInt32Array, + JITUint8Array, + JITUint8ClampedArray, + JITUint16Array, + JITUint32Array, + JITFloat32Array, + JITFloat64Array +}; + +inline bool isOptimizableIndexingType(IndexingType indexingType) +{ + switch (indexingType) { + case ALL_CONTIGUOUS_INDEXING_TYPES: + case ARRAY_WITH_ARRAY_STORAGE_INDEXING_TYPES: + return true; + default: + return false; + } +} + +inline bool hasOptimizableIndexingForClassInfo(const ClassInfo* classInfo) +{ + return classInfo->typedArrayStorageType != TypedArrayNone; +} + +inline bool hasOptimizableIndexing(Structure* structure) +{ + return isOptimizableIndexingType(structure->indexingType()) + || hasOptimizableIndexingForClassInfo(structure->classInfo()); +} + +inline JITArrayMode jitArrayModeForIndexingType(IndexingType indexingType) +{ + switch (indexingType) { + case ALL_CONTIGUOUS_INDEXING_TYPES: + return JITContiguous; + case ARRAY_WITH_ARRAY_STORAGE_INDEXING_TYPES: + return JITArrayStorage; + default: + CRASH(); + return JITContiguous; + } +} + +inline JITArrayMode jitArrayModeForClassInfo(const ClassInfo* classInfo) +{ + switch (classInfo->typedArrayStorageType) { + case TypedArrayInt8: + return JITInt8Array; + case TypedArrayInt16: + return JITInt16Array; + case TypedArrayInt32: + return JITInt32Array; + case TypedArrayUint8: + return JITUint8Array; + case TypedArrayUint8Clamped: + return JITUint8ClampedArray; + case TypedArrayUint16: + return JITUint16Array; + case TypedArrayUint32: + return JITUint32Array; + case TypedArrayFloat32: + return JITFloat32Array; + case TypedArrayFloat64: + return JITFloat64Array; + default: + CRASH(); + return JITContiguous; + } +} + +inline JITArrayMode jitArrayModeForStructure(Structure* structure) +{ + if (isOptimizableIndexingType(structure->indexingType())) + return jitArrayModeForIndexingType(structure->indexingType()); + + ASSERT(hasOptimizableIndexingForClassInfo(structure->classInfo())); + return jitArrayModeForClassInfo(structure->classInfo()); +} + +struct ByValInfo { + ByValInfo() { } + + ByValInfo(unsigned bytecodeIndex, CodeLocationJump badTypeJump, JITArrayMode arrayMode, int16_t badTypeJumpToDone, int16_t returnAddressToSlowPath) + : bytecodeIndex(bytecodeIndex) + , badTypeJump(badTypeJump) + , arrayMode(arrayMode) + , badTypeJumpToDone(badTypeJumpToDone) + , returnAddressToSlowPath(returnAddressToSlowPath) + , slowPathCount(0) + { + } + + unsigned bytecodeIndex; + CodeLocationJump badTypeJump; + JITArrayMode arrayMode; // The array mode that was baked into the inline JIT code. + int16_t badTypeJumpToDone; + int16_t returnAddressToSlowPath; + unsigned slowPathCount; + RefPtr stubRoutine; +}; + +inline unsigned getByValInfoBytecodeIndex(ByValInfo* info) +{ + return info->bytecodeIndex; +} + +} // namespace JSC + +#endif // ENABLE(JIT) + +#endif // ByValInfo_h + diff --git a/Source/JavaScriptCore/bytecode/BytecodeConventions.h b/Source/JavaScriptCore/bytecode/BytecodeConventions.h index f33b060f8..e375f263c 100644 --- a/Source/JavaScriptCore/bytecode/BytecodeConventions.h +++ b/Source/JavaScriptCore/bytecode/BytecodeConventions.h @@ -27,7 +27,7 @@ #define BytecodeConventions_h // Register numbers used in bytecode operations have different meaning according to their ranges: -// 0x80000000-0xFFFFFFFF Negative indices from the CallFrame pointer are entries in the call frame, see RegisterFile.h. +// 0x80000000-0xFFFFFFFF Negative indices from the CallFrame pointer are entries in the call frame, see JSStack.h. // 0x00000000-0x3FFFFFFF Forwards indices from the CallFrame pointer are local vars and temporaries with the function's callframe. // 0x40000000-0x7FFFFFFF Positive indices from 0x40000000 specify entries in the constant pool on the CodeBlock. static const int FirstConstantRegisterIndex = 0x40000000; diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp index bd8bfec0d..9b8260a79 100644 --- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp +++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp @@ -641,7 +641,7 @@ void CodeBlock::dump(ExecState* exec) dataLog(" %1d = {\n", i); StringJumpTable::StringOffsetTable::const_iterator end = m_rareData->m_stringSwitchJumpTables[i].offsetTable.end(); for (StringJumpTable::StringOffsetTable::const_iterator iter = m_rareData->m_stringSwitchJumpTables[i].offsetTable.begin(); iter != end; ++iter) - dataLog("\t\t\"%s\" => %04d\n", String(iter->first).utf8().data(), iter->second.branchOffset); + dataLog("\t\t\"%s\" => %04d\n", String(iter->key).utf8().data(), iter->value.branchOffset); dataLog(" }\n"); ++i; } while (i < m_rareData->m_stringSwitchJumpTables.size()); @@ -1899,7 +1899,7 @@ void EvalCodeCache::visitAggregate(SlotVisitor& visitor) { EvalCacheMap::iterator end = m_cacheMap.end(); for (EvalCacheMap::iterator ptr = m_cacheMap.begin(); ptr != end; ++ptr) - visitor.append(&ptr->second); + visitor.append(&ptr->value); } void CodeBlock::visitAggregate(SlotVisitor& visitor) @@ -3002,8 +3002,8 @@ String CodeBlock::nameForRegister(int registerNumber) { SymbolTable::iterator end = m_symbolTable->end(); for (SymbolTable::iterator ptr = m_symbolTable->begin(); ptr != end; ++ptr) { - if (ptr->second.getIndex() == registerNumber) - return String(ptr->first); + if (ptr->value.getIndex() == registerNumber) + return String(ptr->key); } if (needsActivation() && registerNumber == activationRegister()) return ASCIILiteral("activation"); @@ -3017,7 +3017,7 @@ String CodeBlock::nameForRegister(int registerNumber) } if (registerNumber < 0) { int argumentPosition = -registerNumber; - argumentPosition -= RegisterFile::CallFrameHeaderSize + 1; + argumentPosition -= JSStack::CallFrameHeaderSize + 1; return String::format("arguments[%3d]", argumentPosition - 1).impl(); } return ""; diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h index 22c48311c..01a8ef4a1 100644 --- a/Source/JavaScriptCore/bytecode/CodeBlock.h +++ b/Source/JavaScriptCore/bytecode/CodeBlock.h @@ -31,6 +31,7 @@ #define CodeBlock_h #include "ArrayProfile.h" +#include "ByValInfo.h" #include "BytecodeConventions.h" #include "CallLinkInfo.h" #include "CallReturnOffsetToBytecodeOffset.h" @@ -159,7 +160,7 @@ namespace JSC { return result; } #endif - + void visitAggregate(SlotVisitor&); static void dumpStatistics(); @@ -209,6 +210,11 @@ namespace JSC { } void resetStub(StructureStubInfo&); + + ByValInfo& getByValInfo(unsigned bytecodeIndex) + { + return *(binarySearch(m_byValInfos.begin(), m_byValInfos.size(), bytecodeIndex)); + } CallLinkInfo& getCallLinkInfo(ReturnAddressPtr returnAddress) { @@ -610,6 +616,10 @@ namespace JSC { void setNumberOfStructureStubInfos(size_t size) { m_structureStubInfos.grow(size); } size_t numberOfStructureStubInfos() const { return m_structureStubInfos.size(); } StructureStubInfo& structureStubInfo(int index) { return m_structureStubInfos[index]; } + + void setNumberOfByValInfos(size_t size) { m_byValInfos.grow(size); } + size_t numberOfByValInfos() const { return m_byValInfos.size(); } + ByValInfo& byValInfo(size_t index) { return m_byValInfos[index]; } void addGlobalResolveInfo(unsigned globalResolveInstruction) { @@ -915,18 +925,32 @@ namespace JSC { } RegExp* regexp(int index) const { ASSERT(m_rareData); return m_rareData->m_regexps[index].get(); } - unsigned addConstantBuffer(unsigned length) + unsigned numberOfConstantBuffers() const + { + if (!m_rareData) + return 0; + return m_rareData->m_constantBuffers.size(); + } + unsigned addConstantBuffer(const Vector& buffer) { createRareDataIfNecessary(); unsigned size = m_rareData->m_constantBuffers.size(); - m_rareData->m_constantBuffers.append(Vector(length)); + m_rareData->m_constantBuffers.append(buffer); return size; } + unsigned addConstantBuffer(unsigned length) + { + return addConstantBuffer(Vector(length)); + } - JSValue* constantBuffer(unsigned index) + Vector& constantBufferAsVector(unsigned index) { ASSERT(m_rareData); - return m_rareData->m_constantBuffers[index].data(); + return m_rareData->m_constantBuffers[index]; + } + JSValue* constantBuffer(unsigned index) + { + return constantBufferAsVector(index).data(); } JSGlobalObject* globalObject() { return m_globalObject.get(); } @@ -1289,6 +1313,7 @@ namespace JSC { #endif #if ENABLE(JIT) Vector m_structureStubInfos; + Vector m_byValInfos; Vector m_globalResolveInfos; Vector m_callLinkInfos; Vector m_methodCallLinkInfos; diff --git a/Source/JavaScriptCore/bytecode/Instruction.h b/Source/JavaScriptCore/bytecode/Instruction.h index b276fd957..9fcf509f6 100644 --- a/Source/JavaScriptCore/bytecode/Instruction.h +++ b/Source/JavaScriptCore/bytecode/Instruction.h @@ -33,6 +33,7 @@ #include "MacroAssembler.h" #include "Opcode.h" #include "PropertySlot.h" +#include "SpecialPointer.h" #include "Structure.h" #include "StructureChain.h" #include @@ -195,6 +196,8 @@ namespace JSC { Instruction(WriteBarrier* registerPointer) { u.registerPointer = registerPointer; } + Instruction(Special::Pointer pointer) { u.specialPointer = pointer; } + Instruction(bool* predicatePointer) { u.predicatePointer = predicatePointer; } union { @@ -204,6 +207,7 @@ namespace JSC { WriteBarrierBase structureChain; WriteBarrierBase jsCell; WriteBarrier* registerPointer; + Special::Pointer specialPointer; PropertySlot::GetValueFunc getterFunc; LLIntCallLinkInfo* callLinkInfo; ValueProfile* profile; diff --git a/Source/JavaScriptCore/bytecode/JumpTable.h b/Source/JavaScriptCore/bytecode/JumpTable.h index a01f90cb0..f54a3718f 100644 --- a/Source/JavaScriptCore/bytecode/JumpTable.h +++ b/Source/JavaScriptCore/bytecode/JumpTable.h @@ -57,7 +57,7 @@ namespace JSC { StringOffsetTable::const_iterator loc = offsetTable.find(value); if (loc == end) return defaultOffset; - return loc->second.branchOffset; + return loc->value.branchOffset; } #if ENABLE(JIT) @@ -67,7 +67,7 @@ namespace JSC { StringOffsetTable::const_iterator loc = offsetTable.find(value); if (loc == end) return ctiDefault; - return loc->second.ctiOffset; + return loc->value.ctiOffset; } #endif }; diff --git a/Source/JavaScriptCore/bytecode/LazyOperandValueProfile.cpp b/Source/JavaScriptCore/bytecode/LazyOperandValueProfile.cpp index 59f0d0234..f923e4a28 100644 --- a/Source/JavaScriptCore/bytecode/LazyOperandValueProfile.cpp +++ b/Source/JavaScriptCore/bytecode/LazyOperandValueProfile.cpp @@ -81,7 +81,7 @@ LazyOperandValueProfile* LazyOperandValueProfileParser::getIfPresent( if (iter == m_map.end()) return 0; - return iter->second; + return iter->value; } SpeculatedType LazyOperandValueProfileParser::prediction( diff --git a/Source/JavaScriptCore/bytecode/SamplingTool.cpp b/Source/JavaScriptCore/bytecode/SamplingTool.cpp index f07dc79fb..f9b8245e5 100644 --- a/Source/JavaScriptCore/bytecode/SamplingTool.cpp +++ b/Source/JavaScriptCore/bytecode/SamplingTool.cpp @@ -410,7 +410,7 @@ void SamplingTool::dump(ExecState* exec) Vector codeBlockSamples(scopeCount); ScriptSampleRecordMap::iterator iter = m_scopeSampleMap->begin(); for (int i = 0; i < scopeCount; ++i, ++iter) - codeBlockSamples[i] = iter->second.get(); + codeBlockSamples[i] = iter->value.get(); qsort(codeBlockSamples.begin(), scopeCount, sizeof(ScriptSampleRecord*), compareScriptSampleRecords); @@ -446,8 +446,8 @@ void SamplingTool::dump(ExecState* exec) Vector lineCountInfo(linesCount); int lineno = 0; for (HashMap::iterator iter = lineCounts.begin(); iter != lineCounts.end(); ++iter, ++lineno) { - lineCountInfo[lineno].line = iter->first; - lineCountInfo[lineno].count = iter->second; + lineCountInfo[lineno].line = iter->key; + lineCountInfo[lineno].count = iter->value; } qsort(lineCountInfo.begin(), linesCount, sizeof(LineCountInfo), compareLineCountInfoSampling); diff --git a/Source/JavaScriptCore/bytecode/SamplingTool.h b/Source/JavaScriptCore/bytecode/SamplingTool.h index 52a6e35ad..8f90c3e17 100644 --- a/Source/JavaScriptCore/bytecode/SamplingTool.h +++ b/Source/JavaScriptCore/bytecode/SamplingTool.h @@ -37,6 +37,7 @@ #include #include #include +#include #include namespace JSC { diff --git a/Source/JavaScriptCore/bytecode/SpecialPointer.cpp b/Source/JavaScriptCore/bytecode/SpecialPointer.cpp new file mode 100644 index 000000000..7789653f0 --- /dev/null +++ b/Source/JavaScriptCore/bytecode/SpecialPointer.cpp @@ -0,0 +1,45 @@ +/* + * Copyright (C) 2012 Apple Inc. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY + * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY + * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#include "config.h" +#include "SpecialPointer.h" + +#include "CodeBlock.h" +#include "JSGlobalObject.h" + +namespace JSC { + +void* actualPointerFor(JSGlobalObject* globalObject, Special::Pointer pointer) +{ + return globalObject->actualPointerFor(pointer); +} + +void* actualPointerFor(CodeBlock* codeBlock, Special::Pointer pointer) +{ + return actualPointerFor(codeBlock->globalObject(), pointer); +} + +} // namespace JSC + diff --git a/Source/JavaScriptCore/bytecode/SpecialPointer.h b/Source/JavaScriptCore/bytecode/SpecialPointer.h new file mode 100644 index 000000000..2c624784b --- /dev/null +++ b/Source/JavaScriptCore/bytecode/SpecialPointer.h @@ -0,0 +1,60 @@ +/* + * Copyright (C) 2012 Apple Inc. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY + * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY + * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#ifndef SpecialPointer_h +#define SpecialPointer_h + +namespace JSC { + +class CodeBlock; +class JSGlobalObject; + +namespace Special { +enum Pointer { + CallFunction, + ApplyFunction, + TableSize // Not a real special pointer. Use this to determine the number of pointers. +}; +} // namespace Special + +inline bool pointerIsFunction(Special::Pointer pointer) +{ + ASSERT_UNUSED(pointer, pointer < Special::TableSize); + return true; +} + +inline bool pointerIsCell(Special::Pointer pointer) +{ + ASSERT_UNUSED(pointer, pointer < Special::TableSize); + return true; +} + +void* actualPointerFor(JSGlobalObject*, Special::Pointer); +void* actualPointerFor(CodeBlock*, Special::Pointer); + +} // namespace JSC + +#endif // SpecialPointer_h + diff --git a/Source/JavaScriptCore/bytecode/ValueRecovery.h b/Source/JavaScriptCore/bytecode/ValueRecovery.h index 1be5201ea..93ad221d8 100644 --- a/Source/JavaScriptCore/bytecode/ValueRecovery.h +++ b/Source/JavaScriptCore/bytecode/ValueRecovery.h @@ -38,13 +38,13 @@ namespace JSC { // Describes how to recover a given bytecode virtual register at a given // code point. enum ValueRecoveryTechnique { - // It's already in the register file at the right location. - AlreadyInRegisterFile, - // It's already in the register file but unboxed. - AlreadyInRegisterFileAsUnboxedInt32, - AlreadyInRegisterFileAsUnboxedCell, - AlreadyInRegisterFileAsUnboxedBoolean, - AlreadyInRegisterFileAsUnboxedDouble, + // It's already in the stack at the right location. + AlreadyInJSStack, + // It's already in the stack but unboxed. + AlreadyInJSStackAsUnboxedInt32, + AlreadyInJSStackAsUnboxedCell, + AlreadyInJSStackAsUnboxedBoolean, + AlreadyInJSStackAsUnboxedDouble, // It's in a register. InGPR, UnboxedInt32InGPR, @@ -54,13 +54,13 @@ enum ValueRecoveryTechnique { #endif InFPR, UInt32InGPR, - // It's in the register file, but at a different location. - DisplacedInRegisterFile, - // It's in the register file, at a different location, and it's unboxed. - Int32DisplacedInRegisterFile, - DoubleDisplacedInRegisterFile, - CellDisplacedInRegisterFile, - BooleanDisplacedInRegisterFile, + // It's in the stack, but at a different location. + DisplacedInJSStack, + // It's in the stack, at a different location, and it's unboxed. + Int32DisplacedInJSStack, + DoubleDisplacedInJSStack, + CellDisplacedInJSStack, + BooleanDisplacedInJSStack, // It's an Arguments object. ArgumentsThatWereNotCreated, // It's a constant. @@ -79,38 +79,38 @@ public: bool isSet() const { return m_technique != DontKnow; } bool operator!() const { return !isSet(); } - static ValueRecovery alreadyInRegisterFile() + static ValueRecovery alreadyInJSStack() { ValueRecovery result; - result.m_technique = AlreadyInRegisterFile; + result.m_technique = AlreadyInJSStack; return result; } - static ValueRecovery alreadyInRegisterFileAsUnboxedInt32() + static ValueRecovery alreadyInJSStackAsUnboxedInt32() { ValueRecovery result; - result.m_technique = AlreadyInRegisterFileAsUnboxedInt32; + result.m_technique = AlreadyInJSStackAsUnboxedInt32; return result; } - static ValueRecovery alreadyInRegisterFileAsUnboxedCell() + static ValueRecovery alreadyInJSStackAsUnboxedCell() { ValueRecovery result; - result.m_technique = AlreadyInRegisterFileAsUnboxedCell; + result.m_technique = AlreadyInJSStackAsUnboxedCell; return result; } - static ValueRecovery alreadyInRegisterFileAsUnboxedBoolean() + static ValueRecovery alreadyInJSStackAsUnboxedBoolean() { ValueRecovery result; - result.m_technique = AlreadyInRegisterFileAsUnboxedBoolean; + result.m_technique = AlreadyInJSStackAsUnboxedBoolean; return result; } - static ValueRecovery alreadyInRegisterFileAsUnboxedDouble() + static ValueRecovery alreadyInJSStackAsUnboxedDouble() { ValueRecovery result; - result.m_technique = AlreadyInRegisterFileAsUnboxedDouble; + result.m_technique = AlreadyInJSStackAsUnboxedDouble; return result; } @@ -158,29 +158,29 @@ public: return result; } - static ValueRecovery displacedInRegisterFile(VirtualRegister virtualReg, DataFormat dataFormat) + static ValueRecovery displacedInJSStack(VirtualRegister virtualReg, DataFormat dataFormat) { ValueRecovery result; switch (dataFormat) { case DataFormatInteger: - result.m_technique = Int32DisplacedInRegisterFile; + result.m_technique = Int32DisplacedInJSStack; break; case DataFormatDouble: - result.m_technique = DoubleDisplacedInRegisterFile; + result.m_technique = DoubleDisplacedInJSStack; break; case DataFormatCell: - result.m_technique = CellDisplacedInRegisterFile; + result.m_technique = CellDisplacedInJSStack; break; case DataFormatBoolean: - result.m_technique = BooleanDisplacedInRegisterFile; + result.m_technique = BooleanDisplacedInJSStack; break; default: ASSERT(dataFormat != DataFormatNone && dataFormat != DataFormatStorage); - result.m_technique = DisplacedInRegisterFile; + result.m_technique = DisplacedInJSStack; break; } result.m_source.virtualReg = virtualReg; @@ -222,14 +222,14 @@ public: } } - bool isAlreadyInRegisterFile() const + bool isAlreadyInJSStack() const { switch (technique()) { - case AlreadyInRegisterFile: - case AlreadyInRegisterFileAsUnboxedInt32: - case AlreadyInRegisterFileAsUnboxedCell: - case AlreadyInRegisterFileAsUnboxedBoolean: - case AlreadyInRegisterFileAsUnboxedDouble: + case AlreadyInJSStack: + case AlreadyInJSStackAsUnboxedInt32: + case AlreadyInJSStackAsUnboxedCell: + case AlreadyInJSStackAsUnboxedBoolean: + case AlreadyInJSStackAsUnboxedDouble: return true; default: return false; @@ -264,7 +264,7 @@ public: VirtualRegister virtualRegister() const { - ASSERT(m_technique == DisplacedInRegisterFile || m_technique == Int32DisplacedInRegisterFile || m_technique == DoubleDisplacedInRegisterFile || m_technique == CellDisplacedInRegisterFile || m_technique == BooleanDisplacedInRegisterFile); + ASSERT(m_technique == DisplacedInJSStack || m_technique == Int32DisplacedInJSStack || m_technique == DoubleDisplacedInJSStack || m_technique == CellDisplacedInJSStack || m_technique == BooleanDisplacedInJSStack); return m_source.virtualReg; } @@ -277,19 +277,19 @@ public: void dump(FILE* out) const { switch (technique()) { - case AlreadyInRegisterFile: + case AlreadyInJSStack: fprintf(out, "-"); break; - case AlreadyInRegisterFileAsUnboxedInt32: + case AlreadyInJSStackAsUnboxedInt32: fprintf(out, "(int32)"); break; - case AlreadyInRegisterFileAsUnboxedCell: + case AlreadyInJSStackAsUnboxedCell: fprintf(out, "(cell)"); break; - case AlreadyInRegisterFileAsUnboxedBoolean: + case AlreadyInJSStackAsUnboxedBoolean: fprintf(out, "(bool)"); break; - case AlreadyInRegisterFileAsUnboxedDouble: + case AlreadyInJSStackAsUnboxedDouble: fprintf(out, "(double)"); break; case InGPR: @@ -312,19 +312,19 @@ public: fprintf(out, "pair(%%r%d, %%r%d)", tagGPR(), payloadGPR()); break; #endif - case DisplacedInRegisterFile: + case DisplacedInJSStack: fprintf(out, "*%d", virtualRegister()); break; - case Int32DisplacedInRegisterFile: + case Int32DisplacedInJSStack: fprintf(out, "*int32(%d)", virtualRegister()); break; - case DoubleDisplacedInRegisterFile: + case DoubleDisplacedInJSStack: fprintf(out, "*double(%d)", virtualRegister()); break; - case CellDisplacedInRegisterFile: + case CellDisplacedInJSStack: fprintf(out, "*cell(%d)", virtualRegister()); break; - case BooleanDisplacedInRegisterFile: + case BooleanDisplacedInJSStack: fprintf(out, "*bool(%d)", virtualRegister()); break; case ArgumentsThatWereNotCreated: diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp index 9e993ec65..4308148b3 100644 --- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp +++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp @@ -230,7 +230,7 @@ bool BytecodeGenerator::addVar(const Identifier& ident, bool isConstant, Registe SymbolTable::AddResult result = symbolTable().add(ident.impl(), newEntry); if (!result.isNewEntry) { - r0 = ®isterFor(result.iterator->second.getIndex()); + r0 = ®isterFor(result.iterator->value.getIndex()); return false; } @@ -248,8 +248,8 @@ int BytecodeGenerator::addGlobalVar( newEntry.attemptToWatch(); SymbolTable::AddResult result = symbolTable().add(ident.impl(), newEntry); if (!result.isNewEntry) { - result.iterator->second.notifyWrite(); - index = result.iterator->second.getIndex(); + result.iterator->value.notifyWrite(); + index = result.iterator->value.getIndex(); } return index; } @@ -629,7 +629,7 @@ RegisterID* BytecodeGenerator::resolveCallee(FunctionBodyNode* functionBodyNode) if (functionBodyNode->ident().isNull() || !functionBodyNode->functionNameIsInScope()) return 0; - m_calleeRegister.setIndex(RegisterFile::Callee); + m_calleeRegister.setIndex(JSStack::Callee); // If non-strict eval is in play, we use a separate object in the scope chain for the callee's name. if ((m_codeBlock->usesEval() && !m_codeBlock->isStrictMode()) || m_shouldEmitDebugHooks) { @@ -1129,7 +1129,7 @@ PassRefPtr