2014-02-20 Mark Hahnenberg <mhahnenberg@apple.com>

CopiedBlock::pin can call into fastFree while forbidden

https://bugs.webkit.org/show_bug.cgi?id=128654

Reviewed by Oliver Hunt.

A FullCollection that skips copying doesn't clear the CopyWorkList of the all the surviving

CopiedBlocks because we currently only call didSurviveGC() at the beginning of FullCollections.

EdenCollections always do copying, therefore they always clear all CopyWorkLists.

The fix is to call didSurviveGC() for all surviving CopiedBlocks at the end of FullCollections

as well at the beginning.

* heap/CopiedBlock.h:

(JSC::CopiedBlock::didSurviveGC):

* heap/CopiedSpace.cpp:

(JSC::CopiedSpace::doneCopying):

2014-02-20 Mark Hahnenberg <mhahnenberg@apple.com>

Add a JSC option to disable EdenCollections

https://bugs.webkit.org/show_bug.cgi?id=128849

Reviewed by Mark Lam.

This will help quickly identify whether or not GenGC is responsible for a

particular crash by prematurely collecting a live object.

* heap/Heap.cpp:

(JSC::Heap::collect):

(JSC::Heap::shouldDoFullCollection):

* heap/Heap.h:

* runtime/Options.h:

2014-02-20 Michael Saboff <msaboff@apple.com>

REGRESSION (r164417): ASSERTION FAILED: isBranch() in X86 32 bit build

https://bugs.webkit.org/show_bug.cgi?id=129118

Reviewed by Filip Pizlo.

Changed 32 bit version of SpeculativeJIT::compile handling of Jump nodes to match

what is in the 64 bit build.

* dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

2014-02-20 Zan Dobersek <zdobersek@igalia.com>

[Automake] Collect the JavaScript files required for JSC builtins through a wildcard

https://bugs.webkit.org/show_bug.cgi?id=129115

Reviewed by Oliver Hunt.

* GNUmakefile.list.am: Simplify adding new JavaScriptCore builtins by using a wildcard

to gather all the JavaScript files instead of listing each file explicitly.

2014-02-20 Mark Hahnenberg <mhahnenberg@apple.com>

Replace uses of deprecated POSIX index() with strchr() in ObjcRuntimeExtras.h

https://bugs.webkit.org/show_bug.cgi?id=128610

Reviewed by Anders Carlsson.

index() is deprecated in favor of strchr() so we should use the latter.

* API/JSWrapperMap.mm:

(selectorToPropertyName):

* API/ObjcRuntimeExtras.h:

(parseObjCType):

2014-02-19 Filip Pizlo <fpizlo@apple.com>

FTL should not emit stack overflow checks in leaf functions

https://bugs.webkit.org/show_bug.cgi?id=129085

Reviewed by Michael Saboff.

Miniscule (0.5%) speed-up on V8v7.

* ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::lower):

(JSC::FTL::LowerDFGToLLVM::didOverflowStack):

2014-02-20 Mark Hahnenberg <mhahnenberg@apple.com>

Dynamically generated JSExport protocols added to a class results in a crash

https://bugs.webkit.org/show_bug.cgi?id=129108

Reviewed by Oliver Hunt.

We're not getting any information from the runtime about the types of the methods on

these protocols because they didn't exist at compile time. We should handle this gracefully.

* API/ObjCCallbackFunction.mm:

(objCCallbackFunctionForInvocation):

* API/tests/JSExportTests.mm:

(+[JSExportTests exportDynamicallyGeneratedProtocolTest]):

(runJSExportTests):

2014-02-20 Gabor Rapcsanyi <rgabor@webkit.org>

ASSERTION FAILED: isUInt16() on ARMv7 after r113253.

https://bugs.webkit.org/show_bug.cgi?id=129101

Reviewed by Michael Saboff.

If the immediate value type is encoded then we shouldn't reach this assert.

Check the immediate type to avoid assertion in alignemnt check.

* assembler/ARMv7Assembler.h:

(JSC::ARMv7Assembler::add):

2014-02-20 Csaba Osztrogonác <ossy@webkit.org>

Get rid of redundant Platform.h includes

https://bugs.webkit.org/show_bug.cgi?id=128817

Reviewed by Brent Fulgham.

* API/tests/JSNode.c:

* API/tests/JSNodeList.c:

* API/tests/minidom.c:

* API/tests/testapi.c:

* assembler/MacroAssembler.h:

* bytecode/ByValInfo.h:

* bytecode/CallLinkInfo.h:

* bytecode/CallReturnOffsetToBytecodeOffset.h:

* bytecode/CodeType.h:

* bytecode/HandlerInfo.h:

* bytecode/MethodOfGettingAValueProfile.h:

* bytecode/PolymorphicAccessStructureList.h:

* bytecode/PolymorphicPutByIdList.h:

* bytecode/StructureStubClearingWatchpoint.h:

* bytecode/StructureStubInfo.h:

* bytecode/ValueRecovery.h:

* bytecode/VirtualRegister.h:

* dfg/DFGAbstractHeap.h:

* dfg/DFGAbstractInterpreter.h:

* dfg/DFGAbstractInterpreterInlines.h:

* dfg/DFGAbstractValue.h:

* dfg/DFGAdjacencyList.h:

* dfg/DFGAllocator.h:

* dfg/DFGAnalysis.h:

* dfg/DFGArgumentsSimplificationPhase.h:

* dfg/DFGArrayMode.h:

* dfg/DFGArrayifySlowPathGenerator.h:

* dfg/DFGAtTailAbstractState.h:

* dfg/DFGBackwardsPropagationPhase.h:

* dfg/DFGBinarySwitch.h:

* dfg/DFGBlockInsertionSet.h:

* dfg/DFGBranchDirection.h:

* dfg/DFGCFAPhase.h:

* dfg/DFGCFGSimplificationPhase.h:

* dfg/DFGCPSRethreadingPhase.h:

* dfg/DFGCSEPhase.h:

* dfg/DFGCallArrayAllocatorSlowPathGenerator.h:

* dfg/DFGCapabilities.h:

* dfg/DFGClobberSet.h:

* dfg/DFGClobberize.h:

* dfg/DFGCommon.h:

* dfg/DFGCommonData.h:

* dfg/DFGConstantFoldingPhase.h:

* dfg/DFGCriticalEdgeBreakingPhase.h:

* dfg/DFGDCEPhase.h:

* dfg/DFGDesiredIdentifiers.h:

* dfg/DFGDesiredStructureChains.h:

* dfg/DFGDesiredWatchpoints.h:

* dfg/DFGDisassembler.h:

* dfg/DFGDominators.h:

* dfg/DFGDriver.h:

* dfg/DFGEdge.h:

* dfg/DFGEdgeDominates.h:

* dfg/DFGEdgeUsesStructure.h:

* dfg/DFGFailedFinalizer.h:

* dfg/DFGFiltrationResult.h:

* dfg/DFGFinalizer.h:

* dfg/DFGFixupPhase.h:

* dfg/DFGFlushFormat.h:

* dfg/DFGFlushLivenessAnalysisPhase.h:

* dfg/DFGFlushedAt.h:

* dfg/DFGGraph.h:

* dfg/DFGInPlaceAbstractState.h:

* dfg/DFGInsertionSet.h:

* dfg/DFGInvalidationPointInjectionPhase.h:

* dfg/DFGJITCode.h:

* dfg/DFGJITFinalizer.h:

* dfg/DFGLICMPhase.h:

* dfg/DFGLazyJSValue.h:

* dfg/DFGLivenessAnalysisPhase.h:

* dfg/DFGLongLivedState.h:

* dfg/DFGLoopPreHeaderCreationPhase.h:

* dfg/DFGMinifiedGraph.h:

* dfg/DFGMinifiedID.h:

* dfg/DFGMinifiedNode.h:

* dfg/DFGNaturalLoops.h:

* dfg/DFGNode.h:

* dfg/DFGNodeAllocator.h:

* dfg/DFGNodeFlags.h:

* dfg/DFGNodeType.h:

* dfg/DFGOSRAvailabilityAnalysisPhase.h:

* dfg/DFGOSREntrypointCreationPhase.h:

* dfg/DFGOSRExit.h:

* dfg/DFGOSRExitBase.h:

* dfg/DFGOSRExitCompilationInfo.h:

* dfg/DFGOSRExitCompiler.h:

* dfg/DFGOSRExitCompilerCommon.h:

* dfg/DFGOSRExitJumpPlaceholder.h:

* dfg/DFGPhase.h:

* dfg/DFGPlan.h:

* dfg/DFGPredictionInjectionPhase.h:

* dfg/DFGPredictionPropagationPhase.h:

* dfg/DFGResurrectionForValidationPhase.h:

* dfg/DFGSSAConversionPhase.h:

* dfg/DFGSafeToExecute.h:

* dfg/DFGSaneStringGetByValSlowPathGenerator.h:

* dfg/DFGSilentRegisterSavePlan.h:

* dfg/DFGSlowPathGenerator.h:

* dfg/DFGSpeculativeJIT.h:

* dfg/DFGStackLayoutPhase.h:

* dfg/DFGStructureAbstractValue.h:

* dfg/DFGThunks.h:

* dfg/DFGTierUpCheckInjectionPhase.h:

* dfg/DFGToFTLDeferredCompilationCallback.h:

* dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h:

* dfg/DFGTypeCheckHoistingPhase.h:

* dfg/DFGUnificationPhase.h:

* dfg/DFGUseKind.h:

* dfg/DFGValidate.h:

* dfg/DFGValueRecoveryOverride.h:

* dfg/DFGValueSource.h:

* dfg/DFGVariableAccessData.h:

* dfg/DFGVariableAccessDataDump.h:

* dfg/DFGVariableEvent.h:

* dfg/DFGVariableEventStream.h:

* dfg/DFGVirtualRegisterAllocationPhase.h:

* dfg/DFGWatchpointCollectionPhase.h:

* dfg/DFGWorklist.h:

* disassembler/Disassembler.h:

* ftl/FTLAbbreviatedTypes.h:

* ftl/FTLAbbreviations.h:

* ftl/FTLAbstractHeap.h:

* ftl/FTLAbstractHeapRepository.h:

* ftl/FTLCapabilities.h:

* ftl/FTLCommonValues.h:

* ftl/FTLCompile.h:

* ftl/FTLExitArgument.h:

* ftl/FTLExitArgumentForOperand.h:

* ftl/FTLExitArgumentList.h:

* ftl/FTLExitThunkGenerator.h:

* ftl/FTLExitValue.h:

* ftl/FTLFail.h:

* ftl/FTLForOSREntryJITCode.h:

* ftl/FTLFormattedValue.h:

* ftl/FTLIntrinsicRepository.h:

* ftl/FTLJITCode.h:

* ftl/FTLJITFinalizer.h:

* ftl/FTLLink.h:

* ftl/FTLLocation.h:

* ftl/FTLLowerDFGToLLVM.h:

* ftl/FTLLoweredNodeValue.h:

* ftl/FTLOSREntry.h:

* ftl/FTLOSRExit.h:

* ftl/FTLOSRExitCompilationInfo.h:

* ftl/FTLOSRExitCompiler.h:

* ftl/FTLOutput.h:

* ftl/FTLSaveRestore.h:

* ftl/FTLStackMaps.h:

* ftl/FTLState.h:

* ftl/FTLSwitchCase.h:

* ftl/FTLThunks.h:

* ftl/FTLTypedPointer.h:

* ftl/FTLValueFormat.h:

* ftl/FTLValueFromBlock.h:

* heap/JITStubRoutineSet.h:

* interpreter/AbstractPC.h:

* jit/AssemblyHelpers.h:

* jit/CCallHelpers.h:

* jit/ClosureCallStubRoutine.h:

* jit/GCAwareJITStubRoutine.h:

* jit/HostCallReturnValue.h:

* jit/JITDisassembler.h:

* jit/JITStubRoutine.h:

* jit/JITThunks.h:

* jit/JITToDFGDeferredCompilationCallback.h:

* jit/RegisterSet.h:

* jit/Repatch.h:

* jit/ScratchRegisterAllocator.h:

* jit/TempRegisterSet.h:

* jit/ThunkGenerator.h:

* llint/LLIntData.h:

* llint/LLIntEntrypoint.h:

* llint/LLIntExceptions.h:

* llint/LLIntOfflineAsmConfig.h:

* llint/LLIntOpcode.h:

* llint/LLIntSlowPaths.h:

* llint/LLIntThunks.h:

* llint/LowLevelInterpreter.h:

* llvm/InitializeLLVM.h:

* llvm/InitializeLLVMPOSIX.h:

* llvm/LLVMAPI.h:

* os-win32/inttypes.h:

* runtime/ArrayStorage.h:

* runtime/Butterfly.h:

* runtime/CommonSlowPaths.h:

* runtime/CommonSlowPathsExceptions.h:

* runtime/IndexingHeader.h:

* runtime/JSExportMacros.h:

* runtime/PropertyOffset.h:

* runtime/SparseArrayValueMap.h:

2014-02-19 Filip Pizlo <fpizlo@apple.com>

DFG should have a way of carrying and preserving conditional branch weights

https://bugs.webkit.org/show_bug.cgi?id=129083

Reviewed by Michael Saboff.

Branch and Switch now have branch counts/weights for each target. This is encapsulated

behind DFG::BranchTarget. We carry this data all the way to the FTL, and the DFG

backend ignores it.

We don't set this data yet; that's for https://bugs.webkit.org/show_bug.cgi?id=129055.

* dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::branchData):

(JSC::DFG::ByteCodeParser::handleInlining):

(JSC::DFG::ByteCodeParser::parseBlock):

(JSC::DFG::ByteCodeParser::linkBlock):

* dfg/DFGCFGSimplificationPhase.cpp:

(JSC::DFG::CFGSimplificationPhase::run):

* dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

* dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):

* dfg/DFGGraph.h:

* dfg/DFGInPlaceAbstractState.cpp:

(JSC::DFG::InPlaceAbstractState::mergeToSuccessors):

* dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::link):

* dfg/DFGNode.cpp:

(JSC::DFG::BranchTarget::dump):

* dfg/DFGNode.h:

(JSC::DFG::BranchTarget::BranchTarget):

(JSC::DFG::BranchTarget::setBytecodeIndex):

(JSC::DFG::BranchTarget::bytecodeIndex):

(JSC::DFG::BranchData::withBytecodeIndices):

(JSC::DFG::BranchData::takenBytecodeIndex):

(JSC::DFG::BranchData::notTakenBytecodeIndex):

(JSC::DFG::BranchData::forCondition):

(JSC::DFG::SwitchCase::SwitchCase):

(JSC::DFG::SwitchCase::withBytecodeIndex):

(JSC::DFG::SwitchData::SwitchData):

(JSC::DFG::Node::targetBytecodeOffsetDuringParsing):

(JSC::DFG::Node::targetBlock):

(JSC::DFG::Node::branchData):

(JSC::DFG::Node::successor):

(JSC::DFG::Node::successorForCondition):

* dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compilePeepHoleDoubleBranch):

(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):

(JSC::DFG::SpeculativeJIT::compilePeepHoleBooleanBranch):

(JSC::DFG::SpeculativeJIT::compilePeepHoleInt32Branch):

(JSC::DFG::SpeculativeJIT::compileStrictEqForConstant):

(JSC::DFG::SpeculativeJIT::compileRegExpExec):

(JSC::DFG::SpeculativeJIT::emitSwitchIntJump):

(JSC::DFG::SpeculativeJIT::emitSwitchImm):

(JSC::DFG::SpeculativeJIT::emitSwitchCharStringJump):

(JSC::DFG::SpeculativeJIT::emitSwitchChar):

(JSC::DFG::SpeculativeJIT::emitBinarySwitchStringRecurse):

(JSC::DFG::SpeculativeJIT::emitSwitchStringOnString):

(JSC::DFG::SpeculativeJIT::emitSwitchString):

* dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):

(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):

(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):

(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):

(JSC::DFG::SpeculativeJIT::emitBranch):

(JSC::DFG::SpeculativeJIT::compile):

* dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNull):

(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):

(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeStrictEq):

(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):

(JSC::DFG::SpeculativeJIT::compilePeepHoleInt52Branch):

(JSC::DFG::SpeculativeJIT::emitBranch):

(JSC::DFG::SpeculativeJIT::compile):

* ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::compileJump):

(JSC::FTL::LowerDFGToLLVM::compileBranch):

(JSC::FTL::LowerDFGToLLVM::compileSwitch):

(JSC::FTL::LowerDFGToLLVM::buildSwitch):

2014-02-19 ChangSeok Oh <changseok.oh@collabora.com>

Unreviewed build fix after r164396

* GNUmakefile.list.am: Added Promises.prototype.js properly

2014-02-19 Geoffrey Garen <ggaren@apple.com>

Crash after -[JSContext evaluateScript:] when initializing JSContext with JSVirtualMachine

https://bugs.webkit.org/show_bug.cgi?id=129070

Reviewed by Mark Hahnenberg.

Clear our exception explicitly before throwing away the VM because our

exception references VM memory.

* API/JSContext.mm:

(-[JSContext dealloc]):

* API/tests/testapi.mm:

(testObjectiveCAPI):

2014-02-19 Brent Fulgham <bfulgham@apple.com>

Unreviewed build fix after r164391

* runtime/Arguments.h: Make SlowArgumentData public so template libraries can

access its methods.

2014-02-19 Mark Lam <mark.lam@apple.com>

Need to align sp before calling operationLoadVarargs on 32-bit platforms.

<https://webkit.org/b/129056>

Reviewed by Michael Saboff.

In JIT::compileLoadVarargs(), we'll call operationSizeFrameForVarargs()

to compute the amount of stack space we need for the varargs, adjust the

stack pointer to make room for those varargs, and then call

operationLoadVarargs() to fill in the varargs. Currently, the stack

pointer adjustment takes care of allocating space for the varargs, but

does not align the stack pointer for the call to operationLoadVarargs().

The fix is to align the stack pointer there.

Note: The stack pointer adjustment is based on the new CallFrame pointer

value returned by operationSizeFrameForVarargs(). On 64-bit platforms,

both the stack pointer and call frame pointer are similarly aligned

(i.e. low nibbles are 0). Hence, no additional adjustment is needed.

Only the 32-bit code needs the fix.

Note: The LLINT also works this way i.e. aligns the stack pointer before

calling llint_slow_path_call_varargs().

* jit/JITCall32_64.cpp:

(JSC::JIT::compileLoadVarargs):

2014-02-19 Sam Weinig <sam@webkit.org>

[JS] Convert Promise.prototype.catch to be a built-in

https://bugs.webkit.org/show_bug.cgi?id=129052

Reviewed by Geoffrey Garen.

* GNUmakefile.list.am:

* JavaScriptCore.xcodeproj/project.pbxproj:

* builtins/Promise.prototype.js: Added.

(catch): Add JS based implementation of Promise.prototype.catch.

* runtime/JSPromisePrototype.cpp:

Remove the C++ implementation of Promise.prototype.catch.

2014-02-19 Filip Pizlo <fpizlo@apple.com>

FTL should allow LLVM to allocate data sections with alignment > 8

https://bugs.webkit.org/show_bug.cgi?id=129066

Reviewed by Geoffrey Garen.

We were previously using the native allocator's alignment guarantees (which we presumed

to be 8 bytes), and further hinting our desires by using the LSectionWord type (which

was 8 bytes). This breaks now that LLVM will sometimes ask for 16 byte alignment on

some sections.

This changes our data section allocation strategy to use the new FTL::DataSection,

which can handle arbitrary 2^k alignment.

* JavaScriptCore.xcodeproj/project.pbxproj:

* ftl/FTLCompile.cpp:

(JSC::FTL::mmAllocateDataSection):

(JSC::FTL::dumpDataSection):

(JSC::FTL::compile):

* ftl/FTLDataSection.cpp: Added.

(JSC::FTL::DataSection::DataSection):

(JSC::FTL::DataSection::~DataSection):

* ftl/FTLDataSection.h: Added.

(JSC::FTL::DataSection::base):

(JSC::FTL::DataSection::size):

* ftl/FTLJITCode.cpp:

(JSC::FTL::JITCode::addDataSection):

* ftl/FTLJITCode.h:

(JSC::FTL::JITCode::dataSections):

* ftl/FTLState.h:

2014-02-19 Filip Pizlo <fpizlo@apple.com>

Unreviewed, fix comment.

* ftl/FTLWeight.h:

(JSC::FTL::Weight::scaleToTotal):

2014-02-19 Anders Carlsson <andersca@apple.com>

Add WTF_MAKE_FAST_ALLOCATED to more classes

https://bugs.webkit.org/show_bug.cgi?id=129064

Reviewed by Andreas Kling.

* dfg/DFGSpeculativeJIT.h:

* heap/CopyWorkList.h:

* heap/Region.h:

* runtime/Arguments.h:

* runtime/SymbolTable.h:

* runtime/WriteBarrier.h:

2014-02-19 Michael Saboff <msaboff@apple.com>

Unreviewed build fix after r164374

* llint/LLIntOfflineAsmConfig.h: Added #define OFFLINE_ASM_X86_WIN 0

for ENABLE(LLINT_C_LOOP).

2014-02-19 Filip Pizlo <fpizlo@apple.com>

FTL should be able to convey branch weights to LLVM

https://bugs.webkit.org/show_bug.cgi?id=129054

Reviewed by Michael Saboff.

This introduces a really nice way to convey branch weights to LLVM. The basic class

is Weight, which just wraps a float; NaN is used when you are not sure. You can

pass this alongside a LBasicBlock to branching instructions like condbr and switch.

But for simplicity, you can just pass a WeightedTarget, which is a tuple of the

two. And for even greater simplicity, you can create WeightedTargets from

LBasicBlocks by doing:

usually(b) => WeightedTarget(b, Weight(1))

rarely(b) => WeightedTarget(b, Weight(0))

unsure(b) => WeightedTarget(b, Weight()) or WeightedTarget(b, Weight(NaN))

This allows for constructs like:

m_out.branch(isCell(value), usually(isCellCase), rarely(slowCase));

This was intended to be perf-neutral for now, but it did end up creating a ~1%

speed-up on V8v7 and Octane2.

* JavaScriptCore.xcodeproj/project.pbxproj:

* ftl/FTLAbbreviations.h:

(JSC::FTL::mdNode):

* ftl/FTLCommonValues.cpp:

(JSC::FTL::CommonValues::CommonValues):

* ftl/FTLCommonValues.h:

* ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::lower):

(JSC::FTL::LowerDFGToLLVM::compileValueToInt32):

(JSC::FTL::LowerDFGToLLVM::compileStoreBarrierWithNullCheck):

(JSC::FTL::LowerDFGToLLVM::compileToThis):

(JSC::FTL::LowerDFGToLLVM::compileArithMul):

(JSC::FTL::LowerDFGToLLVM::compileArithDiv):

(JSC::FTL::LowerDFGToLLVM::compileArithMod):

(JSC::FTL::LowerDFGToLLVM::compileArithMinOrMax):

(JSC::FTL::LowerDFGToLLVM::compileCheckStructure):

(JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):

(JSC::FTL::LowerDFGToLLVM::compileGetById):

(JSC::FTL::LowerDFGToLLVM::compileGetIndexedPropertyStorage):

(JSC::FTL::LowerDFGToLLVM::compileGetTypedArrayByteOffset):

(JSC::FTL::LowerDFGToLLVM::compileGetByVal):

(JSC::FTL::LowerDFGToLLVM::compilePutByVal):

(JSC::FTL::LowerDFGToLLVM::compileArrayPush):

(JSC::FTL::LowerDFGToLLVM::compileArrayPop):

(JSC::FTL::LowerDFGToLLVM::compileNewArrayWithSize):

(JSC::FTL::LowerDFGToLLVM::compileToString):

(JSC::FTL::LowerDFGToLLVM::compileToPrimitive):

(JSC::FTL::LowerDFGToLLVM::compileStringCharAt):

(JSC::FTL::LowerDFGToLLVM::compileStringCharCodeAt):

(JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):

(JSC::FTL::LowerDFGToLLVM::compileNotifyWrite):

(JSC::FTL::LowerDFGToLLVM::compileBranch):

(JSC::FTL::LowerDFGToLLVM::compileSwitch):

(JSC::FTL::LowerDFGToLLVM::compareEqObjectOrOtherToObject):

(JSC::FTL::LowerDFGToLLVM::nonSpeculativeCompare):

(JSC::FTL::LowerDFGToLLVM::allocateCell):

(JSC::FTL::LowerDFGToLLVM::allocateBasicStorageAndGetEnd):

(JSC::FTL::LowerDFGToLLVM::boolify):

(JSC::FTL::LowerDFGToLLVM::equalNullOrUndefined):

(JSC::FTL::LowerDFGToLLVM::contiguousPutByValOutOfBounds):

(JSC::FTL::LowerDFGToLLVM::buildSwitch):

(JSC::FTL::LowerDFGToLLVM::doubleToInt32):

(JSC::FTL::LowerDFGToLLVM::sensibleDoubleToInt32):

(JSC::FTL::LowerDFGToLLVM::lowDouble):

(JSC::FTL::LowerDFGToLLVM::strictInt52ToJSValue):

(JSC::FTL::LowerDFGToLLVM::speculateObjectOrOther):

(JSC::FTL::LowerDFGToLLVM::speculateStringOrStringObject):

(JSC::FTL::LowerDFGToLLVM::emitStoreBarrier):

(JSC::FTL::LowerDFGToLLVM::callCheck):

(JSC::FTL::LowerDFGToLLVM::appendOSRExit):

* ftl/FTLOutput.cpp:

(JSC::FTL::Output::initialize):

(JSC::FTL::Output::appendTo):

(JSC::FTL::Output::newBlock):

(JSC::FTL::Output::sensibleDoubleToInt):

(JSC::FTL::Output::load):

(JSC::FTL::Output::store):

(JSC::FTL::Output::baseIndex):

(JSC::FTL::Output::branch):

(JSC::FTL::Output::crashNonTerminal):

* ftl/FTLOutput.h:

(JSC::FTL::Output::branch):

(JSC::FTL::Output::switchInstruction):

* ftl/FTLSwitchCase.h:

(JSC::FTL::SwitchCase::SwitchCase):

(JSC::FTL::SwitchCase::weight):

* ftl/FTLWeight.h: Added.

(JSC::FTL::Weight::Weight):

(JSC::FTL::Weight::isSet):

(JSC::FTL::Weight::operator!):

(JSC::FTL::Weight::value):

(JSC::FTL::Weight::scaleToTotal):

* ftl/FTLWeightedTarget.h: Added.

(JSC::FTL::WeightedTarget::WeightedTarget):

(JSC::FTL::WeightedTarget::target):

(JSC::FTL::WeightedTarget::weight):

(JSC::FTL::usually):

(JSC::FTL::rarely):

(JSC::FTL::unsure):

2014-02-19 peavo@outlook.com <peavo@outlook.com>

[Win][LLINT] Incorrect stack alignment.

https://bugs.webkit.org/show_bug.cgi?id=129045

Reviewed by Michael Saboff.

LLINT expects the stack to be 16 byte aligned, but with MSVC it is not.

To align the stack, a new backend, X86_WIN, is created.

* llint/LLIntOfflineAsmConfig.h: Use X86_WIN backend on Windows.

* llint/LowLevelInterpreter.asm: Align stack to 16 byte boundaries. Otherwise, use same implementation for X86_WIN as for X86.

* llint/LowLevelInterpreter32_64.asm: Adjust stack offset to retrieve function parameters now that the stack is aligned.

* offlineasm/backends.rb: Added X86_WIN backend.

* offlineasm/x86.rb: Fix crash caused by incorrect assembly code for double types.

2014-02-19 Dániel Bátyai <dbatyai.u-szeged@partner.samsung.com>

ASSERTION FAILED: (year >= 1970 && yearday >= 0) || (year < 1970 && yearday < 0) in WTF::dateToDaysFrom1970

https://bugs.webkit.org/show_bug.cgi?id=128740

Very large numbers could cause an overflow which resulted in the assertion failing in WTF::dateToDaysFrom1970

DateConstructor will now check if the number fits into an Int32 before casting

Reviewed by Geoffrey Garen.

* runtime/DateConstructor.cpp:

(JSC::constructDate):

(JSC::dateUTC):

2014-02-19 Mark Hahnenberg <mhahnenberg@apple.com>

Dedicated worker crash caused by global DFG worklists + GC

https://bugs.webkit.org/show_bug.cgi?id=128537

Reviewed by Filip Pizlo.

The process-global DFG worklists were causing objects to participate in the garbage collections of VMs

other than the one they were allocated in. This started manifesting in the worker tests because they're

one of the few WebKit tests that do multithreaded JS.

The fix is to filter out Plans from other VMs during collection.

* dfg/DFGSafepoint.cpp:

(JSC::DFG::Safepoint::vm):

* dfg/DFGSafepoint.h:

* dfg/DFGWorklist.cpp:

(JSC::DFG::Worklist::isActiveForVM):

(JSC::DFG::Worklist::suspendAllThreads):

(JSC::DFG::Worklist::resumeAllThreads):

(JSC::DFG::Worklist::visitChildren):

* dfg/DFGWorklist.h:

* heap/Heap.cpp:

(JSC::Heap::deleteAllCompiledCode):

* heap/SlotVisitorInlines.h:

(JSC::SlotVisitor::copyLater):

2014-02-19 Brady Eidson <beidson@apple.com>

Add FeatureDefines for image controls

https://bugs.webkit.org/show_bug.cgi?id=129022

Reviewed by Jer Noble.

* Configurations/FeatureDefines.xcconfig:

2014-02-19 Dan Bernstein <mitz@apple.com>

Simplify PLATFORM(MAC) && !PLATFORM(IOS) and similar expressions

https://bugs.webkit.org/show_bug.cgi?id=129029

Reviewed by Mark Rowe.

* API/JSValueRef.cpp:

(JSValueUnprotect):

* jit/ExecutableAllocatorFixedVMPool.cpp:

2014-02-18 Filip Pizlo <fpizlo@apple.com>

Correctly install libllvmForJSC.dylib in production builds

https://bugs.webkit.org/show_bug.cgi?id=129023

Reviewed by Mark Rowe.

In non-production builds, we copy it as before. In production builds, we use the install

path.

Also roll http://trac.webkit.org/changeset/164348 back in.

* Configurations/Base.xcconfig:

* Configurations/LLVMForJSC.xcconfig:

* JavaScriptCore.xcodeproj/project.pbxproj:

2014-02-18 Filip Pizlo <fpizlo@apple.com>

Unreviewed, roll out http://trac.webkit.org/changeset/164348 because it broke some

builds.

* JavaScriptCore.xcodeproj/project.pbxproj:

2014-02-18 Filip Pizlo <fpizlo@apple.com>

Don't call LLVMInitializeNativeTarget() because it can be all messed up if you cross-compile LLVM

https://bugs.webkit.org/show_bug.cgi?id=129020

Reviewed by Dan Bernstein.

LLVMInitializeNativeTarget() is this super special inline function in llvm-c/Target.h that

depends on some #define's that come from some really weird magic in autoconf/configure.ac.

That magic fails miserably for cross-compiles. So, we need to manually initialize the things

that InitializeNativeTarget initializes.

* llvm/library/LLVMExports.cpp:

(initializeAndGetJSCLLVMAPI):

2014-02-18 Filip Pizlo <fpizlo@apple.com>

The shell scripts in the Xcode build system should tell you when they failed

https://bugs.webkit.org/show_bug.cgi?id=129018

Reviewed by Mark Rowe.

* JavaScriptCore.xcodeproj/project.pbxproj:

2014-02-17 Gavin Barraclough <barraclough@apple.com>

Add fast mapping from StringImpl to JSString

https://bugs.webkit.org/show_bug.cgi?id=128625

Reviewed by Geoff Garen & Andreas Kling.

* runtime/JSString.cpp:

(JSC::JSString::WeakOwner::finalize):

- once the JSString weakly owned by a StringImpl becomed unreachable remove the WeakImpl.

* runtime/JSString.h:

(JSC::jsStringWithWeakOwner):

- create a JSString wrapping a StringImpl, and weakly caches the JSString on the StringImpl.

* runtime/VM.cpp:

(JSC::VM::VM):

- initialize jsStringWeakOwner.

(JSC::VM::createLeakedForMainThread):

- initialize jsStringWeakOwner - the main thread gets to use the weak pointer

on StringImpl to cache a JSString wrapper.

* runtime/VM.h:

- renamed createLeaked -> createLeakedForMainThread to make it clear this

should only be used to cretae the main thread VM.

2014-02-18 Oliver Hunt <oliver@apple.com>

Prevent builtin js named with C++ reserved words from breaking the build

https://bugs.webkit.org/show_bug.cgi?id=129017

Reviewed by Sam Weinig.

Simple change to a couple of macros to make sure we don't create functions

named using reserved words.

* builtins/BuiltinExecutables.cpp:

* builtins/BuiltinNames.h:

2014-02-18 Filip Pizlo <fpizlo@apple.com>

FTL should build on ARM64

https://bugs.webkit.org/show_bug.cgi?id=129010

Reviewed by Sam Weinig.

* disassembler/X86Disassembler.cpp: Just because we have the LLVM disassembler doesn't mean we're on X86.

* ftl/FTLLocation.cpp: DWARF parsing for ARM64 is super easy.

(JSC::FTL::Location::isGPR):

(JSC::FTL::Location::gpr):

(JSC::FTL::Location::isFPR):

(JSC::FTL::Location::fpr):

(JSC::FTL::Location::restoreInto): This function wasn't even X86-specific to begin with so move it out of the #if stuff.

* ftl/FTLUnwindInfo.cpp: They're called q not d.

(JSC::FTL::UnwindInfo::parse):

* jit/GPRInfo.h:

(JSC::GPRInfo::toArgumentRegister): Add this method; we alraedy had it on X86.

2014-02-18 Filip Pizlo <fpizlo@apple.com>

FTL unwind parsing should handle ARM64

https://bugs.webkit.org/show_bug.cgi?id=128984

Reviewed by Oliver Hunt.

This makes unwind parsing handle ARM64 and it makes all clients of unwind info capable of

dealing with that architecture.

The big difference is that ARM64 has callee-save double registers. This is conceptually easy

to handle, but out code for dealing with callee-saves spoke of "GPRReg". We've been in this

situation before: code that needs to deal with either a GPRReg or a FPRReg. In the past we'd

hacked around the problem, but this time I decided to do a full frontal assault. This patch

adds a Reg class, which is a box for either GPRReg or FPRReg along with tools for iterating

over all possible registers. Then, I threaded this through SaveRestore, RegisterSet,

RegisterAtOffset, and UnwindInfo. With the help of Reg, it was easy to refactor the code to

handle FPRs in addition to GPRs.

* CMakeLists.txt:

* GNUmakefile.list.am:

* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:

* JavaScriptCore.xcodeproj/project.pbxproj:

* ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileStub):

* ftl/FTLRegisterAtOffset.cpp:

(JSC::FTL::RegisterAtOffset::dump):

* ftl/FTLRegisterAtOffset.h:

(JSC::FTL::RegisterAtOffset::RegisterAtOffset):

(JSC::FTL::RegisterAtOffset::operator!):

(JSC::FTL::RegisterAtOffset::reg):

(JSC::FTL::RegisterAtOffset::operator==):

(JSC::FTL::RegisterAtOffset::operator<):

(JSC::FTL::RegisterAtOffset::getReg):

* ftl/FTLSaveRestore.cpp:

(JSC::FTL::offsetOfReg):

* ftl/FTLSaveRestore.h:

* ftl/FTLUnwindInfo.cpp:

(JSC::FTL::UnwindInfo::parse):

(JSC::FTL::UnwindInfo::find):

(JSC::FTL::UnwindInfo::indexOf):

* ftl/FTLUnwindInfo.h:

* jit/Reg.cpp: Added.

(JSC::Reg::dump):

* jit/Reg.h: Added.

(JSC::Reg::Reg):

(JSC::Reg::fromIndex):

(JSC::Reg::first):

(JSC::Reg::last):

(JSC::Reg::next):

(JSC::Reg::index):

(JSC::Reg::isSet):

(JSC::Reg::operator!):

(JSC::Reg::isGPR):

(JSC::Reg::isFPR):

(JSC::Reg::gpr):

(JSC::Reg::fpr):

(JSC::Reg::operator==):

(JSC::Reg::operator!=):

(JSC::Reg::operator<):

(JSC::Reg::operator>):

(JSC::Reg::operator<=):

(JSC::Reg::operator>=):

(JSC::Reg::hash):

(JSC::Reg::invalid):

* jit/RegisterSet.h:

(JSC::RegisterSet::set):

(JSC::RegisterSet::clear):

(JSC::RegisterSet::get):

2014-02-17 Filip Pizlo <fpizlo@apple.com>

More ARM FTL glue

https://bugs.webkit.org/show_bug.cgi?id=128948

Reviewed by Sam Weinig.

* Configurations/Base.xcconfig: Allow for an header search directory for LLVM's generated files.

* Configurations/LLVMForJSC.xcconfig: Link the right things for ARM.

* assembler/ARM64Assembler.h: Builds fix.

(JSC::ARM64Assembler::fillNops):

* disassembler/LLVMDisassembler.cpp: Use the right target triples.

(JSC::tryToDisassembleWithLLVM):

* ftl/FTLCompile.cpp:

(JSC::FTL::fixFunctionBasedOnStackMaps): Build fix.

* jit/GPRInfo.h: Builds fix.

* llvm/library/LLVMExports.cpp: Link the right things.

(initializeAndGetJSCLLVMAPI):

2014-02-17 Anders Carlsson <andersca@apple.com>

Remove ENABLE_GLOBAL_FASTMALLOC_NEW

https://bugs.webkit.org/show_bug.cgi?id=127067

Reviewed by Geoffrey Garen.

* parser/Nodes.h:

2014-02-17 Sergio Correia <sergio.correia@openbossa.org>

Replace uses of PassOwnPtr/OwnPtr with std::unique_ptr in WebCore/inspector

https://bugs.webkit.org/show_bug.cgi?id=128681

Reviewed by Timothy Hatcher.

Another step towards getting rid of PassOwnPtr/OwnPtr, now targeting

WebCore/inspector/*. Besides files in there, a few other files in

JavaScriptCore/inspector, WebKit/, WebKit2/WebProcess/WebCoreSupport/

and WebCore/testing were touched.

* inspector/ContentSearchUtilities.cpp:

* inspector/ContentSearchUtilities.h:

* inspector/agents/InspectorConsoleAgent.cpp:

* inspector/agents/InspectorConsoleAgent.h:

2014-02-17 Filip Pizlo <fpizlo@apple.com>

FTL should support ToPrimitive and the DFG should fold it correctly

https://bugs.webkit.org/show_bug.cgi?id=128892

Reviewed by Geoffrey Garen.

* dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

* dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

* dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

* ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

* ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::compileNode):

(JSC::FTL::LowerDFGToLLVM::compileToPrimitive):

* tests/stress/fold-to-primitive-in-cfa.js: Added.

(foo):

(.result.foo):

* tests/stress/fold-to-primitive-to-identity-in-cfa.js: Added.

(foo):

(.result.foo):

2014-02-17 Filip Pizlo <fpizlo@apple.com>

Register preservation wrapper should know about the possibility of callee-saved FPRs

https://bugs.webkit.org/show_bug.cgi?id=128923

Reviewed by Mark Hahnenberg.

* jit/RegisterPreservationWrapperGenerator.cpp:

(JSC::generateRegisterPreservationWrapper):

(JSC::generateRegisterRestoration):

* jit/RegisterSet.cpp:

2014-02-17 Filip Pizlo <fpizlo@apple.com>

lr is a special register on ARM64

https://bugs.webkit.org/show_bug.cgi?id=128922

Reviewed by Mark Hahnenberg.

* jit/RegisterSet.cpp:

(JSC::RegisterSet::specialRegisters):

2014-02-17 Filip Pizlo <fpizlo@apple.com>

Fix RegisterSet::calleeSaveRegisters() by making it correct on ARM64

https://bugs.webkit.org/show_bug.cgi?id=128921

Reviewed by Mark Hahnenberg.

* jit/RegisterSet.cpp:

(JSC::RegisterSet::calleeSaveRegisters):

2014-02-17 Filip Pizlo <fpizlo@apple.com>

RegisterSet::calleeSaveRegisters() should know about ARM64

https://bugs.webkit.org/show_bug.cgi?id=128918

Reviewed by Mark Hahnenberg.

* jit/RegisterSet.cpp:

(JSC::RegisterSet::calleeSaveRegisters):

2014-02-17 Csaba Osztrogonác <ossy@webkit.org>

Move back primary header includes next to config.h

https://bugs.webkit.org/show_bug.cgi?id=128912

Reviewed by Alexey Proskuryakov.

* dfg/DFGAbstractHeap.cpp: