2014-01-14 Lucas Forschler <[email protected]>

Merge r161574

2014-01-09 Filip Pizlo <[email protected]>

AI for CreateArguments should pass through non-SpecEmpty input values

https://bugs.webkit.org/show_bug.cgi?id=126709

Reviewed by Mark Hahnenberg.

* dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

* tests/stress/use-arguments-as-object-pointer.js: Added.

(foo):

2014-01-05 Sam Weinig <[email protected]>

[JS] Implement Promise.race()

https://bugs.webkit.org/show_bug.cgi?id=126506

Reviewed by Oliver Hunt.

* runtime/CommonIdentifiers.h:

Add identifier for "cast".

* runtime/JSPromiseConstructor.cpp:

(JSC::abruptRejection):

Helper for the RejectIfAbrupt abstract operation.

(JSC::JSPromiseConstructorFuncRace):

Add implementation of Promise.race()

2014-01-05 Martin Robinson <[email protected]>

[GTK] [CMake] Ensure that the autotools build and the CMake install the same files

https://bugs.webkit.org/show_bug.cgi?id=116379

Reviewed by Gustavo Noronha Silva.

* PlatformGTK.cmake: Install API headers, gir files, and the pkg-config file.

2014-01-04 Yusuke Suzuki <[email protected]>

Use Compiler macros instead of raw "final" and "override"

https://bugs.webkit.org/show_bug.cgi?id=126490

Reviewed by Sam Weinig.

* runtime/JSPromiseReaction.cpp:

2014-01-04 Martin Robinson <[email protected]>

[GTK] [CMake] Improve the way we locate gobject-introspection

https://bugs.webkit.org/show_bug.cgi?id=126452

Reviewed by Philippe Normand.

* PlatformGTK.cmake: Use the new introspection variables.

2014-01-04 Zan Dobersek <[email protected]>

Explicitly use the std:: nested name specifier when using std::pair, std::make_pair

https://bugs.webkit.org/show_bug.cgi?id=126439

Reviewed by Andreas Kling.

Instead of relying on std::pair and std::make_pair symbols being present in the current scope

through the pair and make_pair symbols, the std:: specifier should be used explicitly.

* bytecode/Opcode.cpp:

(JSC::compareOpcodePairIndices):

(JSC::OpcodeStats::~OpcodeStats):

* bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):

* parser/ASTBuilder.h:

(JSC::ASTBuilder::makeBinaryNode):

* parser/Parser.cpp:

(JSC::Parser<LexerType>::parseIfStatement):

* runtime/Structure.cpp:

(JSC::StructureTransitionTable::contains):

(JSC::StructureTransitionTable::get):

(JSC::StructureTransitionTable::add):

2014-01-03 David Farler <[email protected]>

[super dealloc] missing in Source/JavaScriptCore/API/tests/testapi.mm, fails to build with -Werror,-Wobjc-missing-super-calls

https://bugs.webkit.org/show_bug.cgi?id=126454

Reviewed by Geoffrey Garen.

* API/tests/testapi.mm:

(-[TextXYZ dealloc]):

add [super dealloc]

(-[EvilAllocationObject dealloc]):

add [super dealloc]

2014-01-02 Carlos Garcia Campos <[email protected]>

REGRESSION(r160304): [GTK] Disable libtool fast install

https://bugs.webkit.org/show_bug.cgi?id=126381

Reviewed by Martin Robinson.

Remove -no-fast-install ld flag since fast install is now disabled

globally.

* GNUmakefile.am:

2014-01-02 Sam Weinig <[email protected]>

Update Promises to the https://github.com/domenic/promises-unwrapping spec

https://bugs.webkit.org/show_bug.cgi?id=120954

Reviewed by Filip Pizlo.

Update Promises to the revised spec. Notable changes:

- JSPromiseResolver is gone.

- TaskContext has been renamed Microtask and now has a virtual run() function.

- Instead of using custom InternalFunction subclasses, JSFunctions are used

with PrivateName properties for internal slots.

* CMakeLists.txt:

* DerivedSources.make:

* GNUmakefile.list.am:

* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:

* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:

* JavaScriptCore.xcodeproj/project.pbxproj:

* interpreter/CallFrame.h:

(JSC::ExecState::promiseConstructorTable):

* runtime/CommonIdentifiers.cpp:

(JSC::CommonIdentifiers::CommonIdentifiers):

* runtime/CommonIdentifiers.h:

* runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::reset):

(JSC::JSGlobalObject::visitChildren):

(JSC::JSGlobalObject::queueMicrotask):

* runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::promiseConstructor):

(JSC::JSGlobalObject::promisePrototype):

(JSC::JSGlobalObject::promiseStructure):

* runtime/JSPromise.cpp:

(JSC::JSPromise::create):

(JSC::JSPromise::JSPromise):

(JSC::JSPromise::finishCreation):

(JSC::JSPromise::visitChildren):

(JSC::JSPromise::reject):

(JSC::JSPromise::resolve):

(JSC::JSPromise::appendResolveReaction):

(JSC::JSPromise::appendRejectReaction):

(JSC::triggerPromiseReactions):

* runtime/JSPromise.h:

(JSC::JSPromise::status):

(JSC::JSPromise::result):

(JSC::JSPromise::constructor):

* runtime/JSPromiseCallback.cpp: Removed.

* runtime/JSPromiseCallback.h: Removed.

* runtime/JSPromiseConstructor.cpp:

(JSC::constructPromise):

(JSC::JSPromiseConstructor::getCallData):

(JSC::JSPromiseConstructorFuncCast):

(JSC::JSPromiseConstructorFuncResolve):

(JSC::JSPromiseConstructorFuncReject):

* runtime/JSPromiseConstructor.h:

* runtime/JSPromiseDeferred.cpp: Added.

(JSC::JSPromiseDeferred::create):

(JSC::JSPromiseDeferred::JSPromiseDeferred):

(JSC::JSPromiseDeferred::finishCreation):

(JSC::JSPromiseDeferred::visitChildren):

(JSC::createJSPromiseDeferredFromConstructor):

(JSC::updateDeferredFromPotentialThenable):

* runtime/JSPromiseDeferred.h: Added.

(JSC::JSPromiseDeferred::createStructure):

(JSC::JSPromiseDeferred::promise):

(JSC::JSPromiseDeferred::resolve):

(JSC::JSPromiseDeferred::reject):

* runtime/JSPromiseFunctions.cpp: Added.

(JSC::deferredConstructionFunction):

(JSC::createDeferredConstructionFunction):

(JSC::identifyFunction):

(JSC::createIdentifyFunction):

(JSC::promiseAllCountdownFunction):

(JSC::createPromiseAllCountdownFunction):

(JSC::promiseResolutionHandlerFunction):

(JSC::createPromiseResolutionHandlerFunction):

(JSC::rejectPromiseFunction):

(JSC::createRejectPromiseFunction):

(JSC::resolvePromiseFunction):

(JSC::createResolvePromiseFunction):

(JSC::throwerFunction):

(JSC::createThrowerFunction):

* runtime/JSPromiseFunctions.h: Added.

* runtime/JSPromisePrototype.cpp:

(JSC::JSPromisePrototypeFuncThen):

(JSC::JSPromisePrototypeFuncCatch):

* runtime/JSPromiseReaction.cpp: Added.

(JSC::createExecutePromiseReactionMicroTask):

(JSC::ExecutePromiseReactionMicroTask::run):

(JSC::JSPromiseReaction::create):

(JSC::JSPromiseReaction::JSPromiseReaction):

(JSC::JSPromiseReaction::finishCreation):

(JSC::JSPromiseReaction::visitChildren):

* runtime/JSPromiseReaction.h: Added.

(JSC::JSPromiseReaction::createStructure):

(JSC::JSPromiseReaction::deferred):

(JSC::JSPromiseReaction::handler):

* runtime/JSPromiseResolver.cpp: Removed.

* runtime/JSPromiseResolver.h: Removed.

* runtime/JSPromiseResolverConstructor.cpp: Removed.

* runtime/JSPromiseResolverConstructor.h: Removed.

* runtime/JSPromiseResolverPrototype.cpp: Removed.

* runtime/JSPromiseResolverPrototype.h: Removed.

* runtime/Microtask.h: Added.

* runtime/VM.cpp:

(JSC::VM::VM):

(JSC::VM::~VM):

* runtime/VM.h:

2014-01-02 Mark Hahnenberg <[email protected]>

Add support for StoreBarrier and friends to the FTL

https://bugs.webkit.org/show_bug.cgi?id=126040

Reviewed by Filip Pizlo.

* ftl/FTLAbstractHeapRepository.h:

* ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

* ftl/FTLIntrinsicRepository.h:

* ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::compileNode):

(JSC::FTL::LowerDFGToLLVM::compileStoreBarrier):

(JSC::FTL::LowerDFGToLLVM::compileConditionalStoreBarrier):

(JSC::FTL::LowerDFGToLLVM::compileStoreBarrierWithNullCheck):

(JSC::FTL::LowerDFGToLLVM::loadMarkByte):

(JSC::FTL::LowerDFGToLLVM::emitStoreBarrier):

* heap/Heap.cpp:

(JSC::Heap::Heap):

* heap/Heap.h:

(JSC::Heap::writeBarrierBuffer):

2014-01-02 Mark Hahnenberg <[email protected]>

Storing new CopiedSpace memory into a JSObject should fire a write barrier

https://bugs.webkit.org/show_bug.cgi?id=126025

Reviewed by Filip Pizlo.

Technically this is creating a pointer between a (potentially) old generation object and a young

generation chunk of memory, thus there needs to be a barrier.

* JavaScriptCore.xcodeproj/project.pbxproj:

* dfg/DFGOperations.cpp:

* heap/CopyWriteBarrier.h: Added. This class functions similarly to the WriteBarrier class. It

acts as a proxy for pointers to CopiedSpace. Assignments to the field cause a write barrier to

fire for the object that is the owner of the CopiedSpace memory. This is to ensure during nursery

collections that objects with new backing stores are visited, even if they are old generation objects.

(JSC::CopyWriteBarrier::CopyWriteBarrier):

(JSC::CopyWriteBarrier::operator!):

(JSC::CopyWriteBarrier::operator UnspecifiedBoolType*):

(JSC::CopyWriteBarrier::get):

(JSC::CopyWriteBarrier::operator*):

(JSC::CopyWriteBarrier::operator->):

(JSC::CopyWriteBarrier::set):

(JSC::CopyWriteBarrier::setWithoutWriteBarrier):

(JSC::CopyWriteBarrier::clear):

* heap/Heap.h:

* runtime/JSArray.cpp:

(JSC::JSArray::unshiftCountSlowCase):

(JSC::JSArray::shiftCountWithArrayStorage):

(JSC::JSArray::unshiftCountWithArrayStorage):

* runtime/JSCell.h:

(JSC::JSCell::unvalidatedStructure):

* runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):

* runtime/JSObject.cpp:

(JSC::JSObject::copyButterfly):

(JSC::JSObject::getOwnPropertySlotByIndex):

(JSC::JSObject::putByIndex):

(JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):

(JSC::JSObject::createInitialIndexedStorage):

(JSC::JSObject::createArrayStorage):

(JSC::JSObject::deletePropertyByIndex):

(JSC::JSObject::getOwnPropertyNames):

(JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):

(JSC::JSObject::countElements):

(JSC::JSObject::increaseVectorLength):

(JSC::JSObject::ensureLengthSlow):

* runtime/JSObject.h:

(JSC::JSObject::butterfly):

(JSC::JSObject::setStructureAndButterfly):

(JSC::JSObject::setButterflyWithoutChangingStructure):

(JSC::JSObject::JSObject):

(JSC::JSObject::putDirectInternal):

(JSC::JSObject::putDirectWithoutTransition):

* runtime/MapData.cpp:

(JSC::MapData::ensureSpaceForAppend):

* runtime/Structure.cpp:

(JSC::Structure::materializePropertyMap):

2013-12-23 Oliver Hunt <[email protected]>

Refactor PutPropertySlot to be aware of custom properties

https://bugs.webkit.org/show_bug.cgi?id=126187

Reviewed by Antti Koivisto.

Refactor PutPropertySlot, making the constructor take the thisValue

used as a target. This results in a wide range of boilerplate changes

to pass the new parameter.

* API/JSObjectRef.cpp:

(JSObjectSetProperty):

* dfg/DFGOperations.cpp:

(JSC::DFG::operationPutByValInternal):

* interpreter/Interpreter.cpp:

(JSC::Interpreter::execute):

* jit/JITOperations.cpp:

* llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

* runtime/Arguments.cpp:

(JSC::Arguments::putByIndex):

* runtime/ArrayPrototype.cpp:

(JSC::putProperty):

(JSC::arrayProtoFuncPush):

* runtime/JSCJSValue.cpp:

(JSC::JSValue::putToPrimitiveByIndex):

* runtime/JSCell.cpp:

(JSC::JSCell::putByIndex):

* runtime/JSFunction.cpp:

(JSC::JSFunction::put):

* runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):

* runtime/JSONObject.cpp:

(JSC::Walker::walk):

* runtime/JSObject.cpp:

(JSC::JSObject::putByIndex):

(JSC::JSObject::putDirectNonIndexAccessor):

(JSC::JSObject::deleteProperty):

* runtime/JSObject.h:

(JSC::JSObject::putDirect):

* runtime/Lookup.h:

(JSC::putEntry):

(JSC::lookupPut):

* runtime/PutPropertySlot.h:

(JSC::PutPropertySlot::PutPropertySlot):

(JSC::PutPropertySlot::setCustomProperty):

(JSC::PutPropertySlot::thisValue):

(JSC::PutPropertySlot::isCacheable):

2014-01-01 Filip Pizlo <[email protected]>

Rationalize DFG DCE

https://bugs.webkit.org/show_bug.cgi?id=125523

Reviewed by Mark Hahnenberg.

Adds the ability to DCE more things. It's now the case that if a node is completely

pure, we clear NodeMustGenerate and the node becomes a DCE candidate.

* dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

* dfg/DFGCSEPhase.cpp:

(JSC::DFG::CSEPhase::performNodeCSE):

* dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

* dfg/DFGDCEPhase.cpp:

(JSC::DFG::DCEPhase::cleanVariables):

* dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

* dfg/DFGGraph.h:

(JSC::DFG::Graph::clobbersWorld):

* dfg/DFGNodeType.h:

* dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileAdd):

* dfg/DFGSpeculativeJIT.h:

* dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

* dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

* ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::compileNode):

(JSC::FTL::LowerDFGToLLVM::compileValueAdd):

2014-01-02 Benjamin Poulain <[email protected]>

Attempt to fix the build of WebCore's code generator on CMake based system

https://bugs.webkit.org/show_bug.cgi?id=126271

Reviewed by Sam Weinig.

* CMakeLists.txt:

2013-12-30 Commit Queue <[email protected]>

Unreviewed, rolling out r161157, r161158, r161160, r161161,

r161163, and r161165.

http://trac.webkit.org/changeset/161157

http://trac.webkit.org/changeset/161158

http://trac.webkit.org/changeset/161160

http://trac.webkit.org/changeset/161161

http://trac.webkit.org/changeset/161163

http://trac.webkit.org/changeset/161165

https://bugs.webkit.org/show_bug.cgi?id=126332

Broke WebKit2 on Mountain Lion (Requested by ap on #webkit).

* heap/BlockAllocator.cpp:

(JSC::BlockAllocator::~BlockAllocator):

(JSC::BlockAllocator::waitForRelativeTimeWhileHoldingLock):

(JSC::BlockAllocator::waitForRelativeTime):

(JSC::BlockAllocator::blockFreeingThreadMain):

* heap/BlockAllocator.h:

(JSC::BlockAllocator::deallocate):

2013-12-30 Anders Carlsson <[email protected]>

Fix build.

* heap/BlockAllocator.h:

2013-12-30 Anders Carlsson <[email protected]>

Stop using ThreadCondition in BlockAllocator

https://bugs.webkit.org/show_bug.cgi?id=126313

Reviewed by Sam Weinig.

* heap/BlockAllocator.cpp:

(JSC::BlockAllocator::~BlockAllocator):

(JSC::BlockAllocator::waitForDuration):

(JSC::BlockAllocator::blockFreeingThreadMain):

* heap/BlockAllocator.h:

(JSC::BlockAllocator::deallocate):

2013-12-30 Anders Carlsson <[email protected]>

Stop using ThreadCondition in jsc.cpp

https://bugs.webkit.org/show_bug.cgi?id=126311

Reviewed by Sam Weinig.

* jsc.cpp:

(timeoutThreadMain):

(main):

2013-12-30 Anders Carlsson <[email protected]>

Replace WTF::ThreadingOnce with std::call_once

https://bugs.webkit.org/show_bug.cgi?id=126215

Reviewed by Sam Weinig.

* dfg/DFGWorklist.cpp:

(JSC::DFG::globalWorklist):

* runtime/InitializeThreading.cpp:

(JSC::initializeThreading):

2013-12-30 Martin Robinson <[email protected]>

[CMake] [GTK] Add support for GObject introspection

https://bugs.webkit.org/show_bug.cgi?id=126162

Reviewed by Daniel Bates.

* PlatformGTK.cmake: Add the GIR targets.

2013-12-28 Filip Pizlo <[email protected]>

Get rid of DFG forward exiting

https://bugs.webkit.org/show_bug.cgi?id=125531

Reviewed by Oliver Hunt.

This finally gets rid of forward exiting. Forward exiting was always a fragile concept

since it involved the compiler trying to figure out how to "roll forward" the

execution from some DFG node to the next bytecode index. It was always easy to find

counterexamples where it broke, and it has always served as an obstacle to adding

compiler improvements - the latest being http://webkit.org/b/125523, which tried to

make DCE work for more things.

This change finishes the work of removing forward exiting. A lot of forward exiting

was already removed in some other bugs, but SetLocal still did forward exits. SetLocal

is in many ways the hardest to remove, since the forward exiting of SetLocal also

implied that any conversion nodes inserted before the SetLocal would then also be

marked as forward-exiting. Hence SetLocal's forward-exiting made a bunch of other

things also forward-exiting, and this was always a source of weirdo bugs.

SetLocal must be able to exit in case it performs a hoisted type speculation. Nodes

inserted just before SetLocal must also be able to exit - for example type check

hoisting may insert a CheckStructure, or fixup phase may insert something like

Int32ToDouble. But if any of those nodes tried to backward exit, then this could lead

to the reexecution of a side-effecting operation, for example:

a: Call(...)

b: SetLocal(@a, r1)

For a long time it seemed like SetLocal *had* to exit forward because of this. But

this change side-steps the problem by changing the ByteCodeParser to always emit a

kind of "two-phase commit" for stores to local variables. Now when the ByteCodeParser

wishes to store to a local, it first emits a MovHint and then enqueues a SetLocal.

The SetLocal isn't actually emitted until the beginning of the next bytecode

instruction (which the exception of op_enter and op_ret, which emit theirs immediately

since it's always safe to reexecute those bytecode instructions and since deferring

SetLocals would be weird there - op_enter has many SetLocals and op_ret is a set

followed by a jump in case of inlining, so we'd have to emit the SetLocal "after" the

jump and that would be awkward). This means that the above IR snippet would look

something like:

a: Call(..., bc#42)

b: MovHint(@a, r1, bc#42)

c: SetLocal(@a, r1, bc#47)

Where the SetLocal exits "backwards" but appears at the beginning of the next bytecode

instruction. This means that by the time we get to that SetLocal, the OSR exit

analysis already knows that r1 is associated with @a, and it means that the SetLocal

or anything hoisted above it can exit backwards as normal.

This change also means that the "forward rewiring" can be killed. Previously, we might

have inserted a conversion node on SetLocal and then the SetLocal died (i.e. turned

into a MovHint) and the conversion node either died completely or had its lifetime

truncated to be less than the actual value's bytecode lifetime. This no longer happens

since conversion nodes are only inserted at SetLocals.

More precisely, this change introduces two laws that we were basically already

following anyway:

1) A MovHint's child should never be changed except if all other uses of that child

are also replaced. Specifically, this prohibits insertion of conversion nodes at

MovHints.

2) Anytime any child is replaced with something else, and all other uses aren't also

replaced, we must insert a Phantom use of the original child.

This is a slight compile-time regression but has no effect on code-gen. It unlocks a

bunch of optimization opportunities so I think it's worth it.

* bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpAssumingJITType):

* bytecode/CodeBlock.h:

(JSC::CodeBlock::instructionCount):

* dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

* dfg/DFGArgumentsSimplificationPhase.cpp:

(JSC::DFG::ArgumentsSimplificationPhase::run):

* dfg/DFGArrayifySlowPathGenerator.h:

(JSC::DFG::ArrayifySlowPathGenerator::ArrayifySlowPathGenerator):

* dfg/DFGBackwardsPropagationPhase.cpp:

(JSC::DFG::BackwardsPropagationPhase::propagate):

* dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::setDirect):

(JSC::DFG::ByteCodeParser::DelayedSetLocal::DelayedSetLocal):

(JSC::DFG::ByteCodeParser::DelayedSetLocal::execute):

(JSC::DFG::ByteCodeParser::handleInlining):

(JSC::DFG::ByteCodeParser::parseBlock):

* dfg/DFGCSEPhase.cpp:

(JSC::DFG::CSEPhase::eliminate):

* dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

* dfg/DFGCommon.h:

* dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

* dfg/DFGDCEPhase.cpp:

(JSC::DFG::DCEPhase::run):

(JSC::DFG::DCEPhase::fixupBlock):

(JSC::DFG::DCEPhase::cleanVariables):

* dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

(JSC::DFG::FixupPhase::fixEdge):

(JSC::DFG::FixupPhase::injectInt32ToDoubleNode):

* dfg/DFGLICMPhase.cpp:

(JSC::DFG::LICMPhase::run):

(JSC::DFG::LICMPhase::attemptHoist):

* dfg/DFGMinifiedNode.cpp:

(JSC::DFG::MinifiedNode::fromNode):

* dfg/DFGMinifiedNode.h:

(JSC::DFG::belongsInMinifiedGraph):

(JSC::DFG::MinifiedNode::constantNumber):

(JSC::DFG::MinifiedNode::weakConstant):

* dfg/DFGNode.cpp:

(JSC::DFG::Node::hasVariableAccessData):

* dfg/DFGNode.h:

(JSC::DFG::Node::convertToPhantom):

(JSC::DFG::Node::convertToPhantomUnchecked):

(JSC::DFG::Node::convertToIdentity):

(JSC::DFG::Node::containsMovHint):

(JSC::DFG::Node::hasUnlinkedLocal):

(JSC::DFG::Node::willHaveCodeGenOrOSR):

* dfg/DFGNodeFlags.cpp:

(JSC::DFG::dumpNodeFlags):

* dfg/DFGNodeFlags.h:

* dfg/DFGNodeType.h:

* dfg/DFGOSRAvailabilityAnalysisPhase.cpp:

(JSC::DFG::OSRAvailabilityAnalysisPhase::run):

* dfg/DFGOSREntrypointCreationPhase.cpp:

(JSC::DFG::OSREntrypointCreationPhase::run):

* dfg/DFGOSRExit.cpp:

* dfg/DFGOSRExit.h:

* dfg/DFGOSRExitBase.cpp:

* dfg/DFGOSRExitBase.h:

(JSC::DFG::OSRExitBase::considerAddingAsFrequentExitSite):

* dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

(JSC::DFG::PredictionPropagationPhase::doDoubleVoting):

* dfg/DFGSSAConversionPhase.cpp:

(JSC::DFG::SSAConversionPhase::run):

* dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

* dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::speculationCheck):

(JSC::DFG::SpeculativeJIT::emitInvalidationPoint):

(JSC::DFG::SpeculativeJIT::typeCheck):

(JSC::DFG::SpeculativeJIT::compileMovHint):

(JSC::DFG::SpeculativeJIT::compileCurrentBlock):

(JSC::DFG::SpeculativeJIT::checkArgumentTypes):

(JSC::DFG::SpeculativeJIT::compileInt32ToDouble):

* dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::detectPeepHoleBranch):

(JSC::DFG::SpeculativeJIT::needsTypeCheck):

* dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

* dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

* dfg/DFGTypeCheckHoistingPhase.cpp:

(JSC::DFG::TypeCheckHoistingPhase::run):

(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):

(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):

* dfg/DFGValidate.cpp:

(JSC::DFG::Validate::validateCPS):

* dfg/DFGVariableAccessData.h:

(JSC::DFG::VariableAccessData::VariableAccessData):

* dfg/DFGVariableEventStream.cpp:

(JSC::DFG::VariableEventStream::reconstruct):

* ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

* ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::compileNode):

(JSC::FTL::LowerDFGToLLVM::compileGetArgument):

(JSC::FTL::LowerDFGToLLVM::compileSetLocal):

(JSC::FTL::LowerDFGToLLVM::compileMovHint):

(JSC::FTL::LowerDFGToLLVM::compileZombieHint):

(JSC::FTL::LowerDFGToLLVM::compileInt32ToDouble):

(JSC::FTL::LowerDFGToLLVM::speculate):

(JSC::FTL::LowerDFGToLLVM::typeCheck):

(JSC::FTL::LowerDFGToLLVM::appendTypeCheck):

(JSC::FTL::LowerDFGToLLVM::appendOSRExit):

(JSC::FTL::LowerDFGToLLVM::emitOSRExitCall):

* ftl/FTLOSRExit.cpp:

* ftl/FTLOSRExit.h:

* tests/stress/dead-int32-to-double.js: Added.

(foo):

* tests/stress/dead-uint32-to-number.js: Added.

(foo):

2013-12-25 Commit Queue <[email protected]>

Unreviewed, rolling out r161033 and r161074.

http://trac.webkit.org/changeset/161033

http://trac.webkit.org/changeset/161074

https://bugs.webkit.org/show_bug.cgi?id=126240

Oliver says that a rollout would be better (Requested by ap on

#webkit).

* API/JSObjectRef.cpp:

(JSObjectSetProperty):

* dfg/DFGOperations.cpp:

(JSC::DFG::operationPutByValInternal):

* interpreter/Interpreter.cpp:

(JSC::Interpreter::execute):

* jit/JITOperations.cpp:

* llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

* runtime/Arguments.cpp:

(JSC::Arguments::putByIndex):

* runtime/ArrayPrototype.cpp:

(JSC::putProperty):

(JSC::arrayProtoFuncPush):

* runtime/JSCJSValue.cpp:

(JSC::JSValue::putToPrimitiveByIndex):

* runtime/JSCell.cpp:

(JSC::JSCell::putByIndex):

* runtime/JSFunction.cpp:

(JSC::JSFunction::put):

* runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):

* runtime/JSONObject.cpp:

(JSC::Walker::walk):

* runtime/JSObject.cpp:

(JSC::JSObject::putByIndex):

(JSC::JSObject::putDirectNonIndexAccessor):

(JSC::JSObject::deleteProperty):

* runtime/JSObject.h:

(JSC::JSObject::putDirect):

* runtime/Lookup.h:

(JSC::putEntry):

(JSC::lookupPut):

* runtime/PutPropertySlot.h:

(JSC::PutPropertySlot::PutPropertySlot):

(JSC::PutPropertySlot::setNewProperty):

(JSC::PutPropertySlot::isCacheable):

2013-12-25 Filip Pizlo <[email protected]>

DFG PhantomArguments shouldn't rely on a dead Phi graph

https://bugs.webkit.org/show_bug.cgi?id=126218

Reviewed by Oliver Hunt.

This change dramatically rationalizes our handling of PhantomArguments (i.e.

speculative elision of arguments object allocation).

It's now the case that if we decide that we can elide arguments allocation, we just

turn the arguments-creating node into a PhantomArguments and mark all locals that

it's stored to as being arguments aliases. Being an arguments alias and being a

PhantomArguments means basically the same thing: in DFG execution you have the empty

value, on OSR exit an arguments object is allocated in your place, and all operations

that use the value now just refer directly to the actual arguments in the call frame

header (or the arguments we know that we passed to the call, in case of inlining).

This means that we no longer have arguments simplification creating a dead Phi graph

that then has to be interpreted by the OSR exit logic. That sort of never made any

sense.

This means that PhantomArguments now has a clear story in SSA: basically SSA just

gets rid of the "locals" but everything else is the same.

Finally, this means that we can more easily get rid of forward exiting. As I was

working on the code to get rid of forward exiting, I realized that I'd have to

carefully preserve the special meanings of MovHint and SetLocal in the case of

PhantomArguments. It was really bizarre: even the semantics of MovHint were tied to

our specific treatment of PhantomArguments. After this change this is no longer the

case.

One of the really cool things about this change is that arguments reification now

just becomes a special kind of FlushFormat. This further unifies things: it means

that a MovHint(PhantomArguments) and a SetLocal(PhantomArguments) both have the same

meaning, since both of them dictate that the way we recover the local on exit is by

reifying arguments. Previously, the SetLocal(PhantomArguments) case needed some

special handling to accomplish this.

A downside of this approach is that we will now emit code to store the empty value

into aliased arguments variables, and we will even emit code to load that empty value

as well. As far as I can tell this doesn't cost anything, since PhantomArguments are

most profitable in cases where it allows us to simplify control flow and kill the

arguments locals entirely. Of course, this isn't an issue in SSA form since SSA form

also eliminates the locals.

* dfg/DFGArgumentsSimplificationPhase.cpp:

(JSC::DFG::ArgumentsSimplificationPhase::run):

(JSC::DFG::ArgumentsSimplificationPhase::detypeArgumentsReferencingPhantomChild):

* dfg/DFGFlushFormat.cpp:

(WTF::printInternal):

* dfg/DFGFlushFormat.h:

(JSC::DFG::resultFor):

(JSC::DFG::useKindFor):

(JSC::DFG::dataFormatFor):

* dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCurrentBlock):

* dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

* dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

* dfg/DFGValueSource.h:

(JSC::DFG::ValueSource::ValueSource):

(JSC::DFG::ValueSource::forFlushFormat):

* dfg/DFGVariableAccessData.h:

(JSC::DFG::VariableAccessData::flushFormat):

* ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::buildExitArguments):

2013-12-23 Oliver Hunt <[email protected]>

Refactor PutPropertySlot to be aware of custom properties

https://bugs.webkit.org/show_bug.cgi?id=126187

Reviewed by msaboff.

Refactor PutPropertySlot, making the constructor take the thisValue

used as a target. This results in a wide range of boilerplate changes

to pass the new parameter.

* API/JSObjectRef.cpp:

(JSObjectSetProperty):

* dfg/DFGOperations.cpp:

(JSC::DFG::operationPutByValInternal):

* interpreter/Interpreter.cpp:

(JSC::Interpreter::execute):

* jit/JITOperations.cpp:

* llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

* runtime/Arguments.cpp:

(JSC::Arguments::putByIndex):

* runtime/ArrayPrototype.cpp:

(JSC::putProperty):

(JSC::arrayProtoFuncPush):

* runtime/JSCJSValue.cpp:

(JSC::JSValue::putToPrimitiveByIndex):

* runtime/JSCell.cpp:

(JSC::JSCell::putByIndex):

* runtime/JSFunction.cpp:

(JSC::JSFunction::put):

* runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):

* runtime/JSONObject.cpp:

(JSC::Walker::walk):

* runtime/JSObject.cpp:

(JSC::JSObject::putByIndex):

(JSC::JSObject::putDirectNonIndexAccessor):

(JSC::JSObject::deleteProperty):

* runtime/JSObject.h:

(JSC::JSObject::putDirect):

* runtime/Lookup.h:

(JSC::putEntry):

(JSC::lookupPut):

* runtime/PutPropertySlot.h:

(JSC::PutPropertySlot::PutPropertySlot):

(JSC::PutPropertySlot::setCustomProperty):

(JSC::PutPropertySlot::thisValue):

(JSC::PutPropertySlot::isCacheable):

2013-12-23 Benjamin Poulain <[email protected]>

Add class matching to the Selector Code Generator

https://bugs.webkit.org/show_bug.cgi?id=126176

Reviewed by Antti Koivisto and Oliver Hunt.

Add test and branch based on BaseIndex addressing for x86_64.

Fast loops are needed to compete with clang on tight loops.

* assembler/MacroAssembler.h:

* assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::branch64):

(JSC::MacroAssemblerX86_64::branchPtr):

* assembler/X86Assembler.h:

(JSC::X86Assembler::cmpq_rm):

2013-12-23 Oliver Hunt <[email protected]>

Update custom setter implementations to perform type checks

https://bugs.webkit.org/show_bug.cgi?id=126171

Reviewed by Daniel Bates.

Modify the setter function signature to take encoded values

as we're changing the setter usage everywhere anyway.

* runtime/Lookup.h:

(JSC::putEntry):

2013-12-23 Lucas Forschler <[email protected]>

<rdar://problem/15682948> Update copyright strings

Reviewed by Dan Bernstein.

* Info.plist:

* JavaScriptCore.vcxproj/JavaScriptCore.resources/Info.plist:

2013-12-23 Zan Dobersek <[email protected]>

[GTK] Clean up compiler optimizations flags for libWTF, libJSC

https://bugs.webkit.org/show_bug.cgi?id=126157

Reviewed by Gustavo Noronha Silva.

* GNUmakefile.am: Remove the -fstrict-aliasing and -O3 compiler flags for libWTF.la. -O3 gets

overridden by -O2 that's listed in CXXFLAGS (or -O0 in case of debug builds) and -fstrict-aliasing

is enabled when -O2 is used (and shouldn't be enabled in debug builds anyway).

2013-12-22 Martin Robinson <[email protected]>

[CMake] Fix typo from r160812

https://bugs.webkit.org/show_bug.cgi?id=126145

Reviewed by Gustavo Noronha Silva.

* CMakeLists.txt: Fix typo when detecting the type of library.

2013-12-22 Martin Robinson <[email protected]>

[GTK][CMake] libtool-compatible soversion calculation

https://bugs.webkit.org/show_bug.cgi?id=125511

Reviewed by Gustavo Noronha Silva.

* CMakeLists.txt: Use the POPULATE_LIBRARY_VERSION macro and the

library-specific version information.

2013-12-23 Gustavo Noronha Silva <[email protected]>

[GTK] [CMake] Generate pkg-config files

https://bugs.webkit.org/show_bug.cgi?id=125685

Reviewed by Martin Robinson.

* PlatformGTK.cmake: Added. Generate javascriptcoregtk-3.0.pc.

2013-12-22 Benjamin Poulain <[email protected]>

Create a skeleton for CSS Selector code generation

https://bugs.webkit.org/show_bug.cgi?id=126044

Reviewed by Antti Koivisto and Gavin Barraclough.

* assembler/LinkBuffer.h:

Add a new owner UID for code compiled for CSS.

Export the symbols needed to link code from WebCore.

2013-12-19 Mark Hahnenberg <[email protected]>

Clean up DFG write barriers

https://bugs.webkit.org/show_bug.cgi?id=126047

Reviewed by Filip Pizlo.

* dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::storeToWriteBarrierBuffer): Use the register allocator to

determine which registers need saving instead of saving every single one of them.

(JSC::DFG::SpeculativeJIT::osrWriteBarrier): We don't need to save live register state

because the write barriers during OSR execute when there are no live registers. Also we

don't need to use pushes to pad the stack pointer for pokes on x86; we can just use an add.

(JSC::DFG::SpeculativeJIT::writeBarrier):

* dfg/DFGSpeculativeJIT.h:

* jit/Repatch.cpp:

(JSC::emitPutReplaceStub):

(JSC::emitPutTransitionStub):

* runtime/VM.h: Get rid of writeBarrierRegisterBuffer since it's no longer used.

2013-12-20 Balazs Kilvady <[email protected]>

[MIPS] Missing MacroAssemblerMIPS::branchTest8(ResultCondition, BaseIndex, TrustedImm32)

https://bugs.webkit.org/show_bug.cgi?id=126062

Reviewed by Mark Hahnenberg.

* assembler/MacroAssemblerMIPS.h:

(JSC::MacroAssemblerMIPS::branchTest8):

2013-12-20 Julien Brianceau <[email protected]>

[sh4] Add missing implementation in MacroAssembler to fix build.

https://bugs.webkit.org/show_bug.cgi?id=126063

Reviewed by Mark Hahnenberg.

* assembler/MacroAssemblerSH4.h:

(JSC::MacroAssemblerSH4::branchTest8):

2013-12-20 Julien Brianceau <[email protected]>

[arm] Add missing implementation in MacroAssembler to fix CPU(ARM_TRADITIONAL) build.

https://bugs.webkit.org/show_bug.cgi?id=126064

Reviewed by Mark Hahnenberg.

* assembler/MacroAssemblerARM.h:

(JSC::MacroAssemblerARM::branchTest8):

2013-12-19 Joseph Pecoraro <[email protected]>

Web Inspector: Add InspectorFrontendHost.debuggableType to let the frontend know it's backend is JavaScript or Web

https://bugs.webkit.org/show_bug.cgi?id=126016

Reviewed by Timothy Hatcher.

* inspector/remote/RemoteInspector.mm:

(Inspector::RemoteInspector::listingForDebuggable):

* inspector/remote/RemoteInspectorConstants.h:

Include a debuggable type identifier in the debuggable listing,

so the remote frontend can know if it is debugging a Web Page

or JS Context.

2013-12-19 Benjamin Poulain <[email protected]>

Add an utility class to simplify generating function calls

https://bugs.webkit.org/show_bug.cgi?id=125972

Reviewed by Geoffrey Garen.

Split branchTest32 in two functions: test32AndSetFlags and branchOnFlags.

This is done to allow code where the flags are set, multiple operation that

do not modify the flags occur, then the flags are used.

This is used for function calls to test the return value while discarding the

return register.

* assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::test32AndSetFlags):

(JSC::MacroAssemblerX86Common::branchOnFlags):

(JSC::MacroAssemblerX86Common::branchTest32):

2013-12-19 Mark Hahnenberg <[email protected]>

Put write barriers in the right places in the baseline JIT

https://bugs.webkit.org/show_bug.cgi?id=125975

Reviewed by Filip Pizlo.